On 15 April 2018, a Qantas Airways Airbus A330, registered VH-EBR, departed Brisbane Airport, Queensland, for a regular public transport flight to Auckland, New Zealand. Shortly after departure, the crew received an advisory notification indicating excessive vibration from the left engine.
The crew reduced thrust on the left engine to idle, and the noise and vibrations ceased. The crew elected to return to Brisbane, and landed uneventfully. The thrust on the left engine remained at idle during the air turn back.
What the ATSB found
The General Electric CF6‑80E1 engine utilises rows of variable stator vanes (VSV) between each of its high-pressure compressor (HPC) stages for optimal airflow. Worn bushings led to fretting damage on a lever arm in the fourth-stage VSV system. The lever arm fractured, allowing the VSV to become off‑schedule (misaligned), affecting the airflow entering the stage four HPC.
The airflow disturbance resulted in abnormal aerodynamic loading and ultimately, fatigue failure of a fourth stage compressor blade. The downstream turbomachinery was then damaged due to the progression of blade debris through the engine.
Three non-mandatory VSV lever arm inspections were carried out prior to the occurrence but were not effective in detecting the bushing wear.
General Electric intended that replacement of the complete set of bushings was required when more than half of the accessible bushings were worn. However, the operator had proactively replaced worn bushings individually when found during maintenance. As a result, the threshold to replace the complete set would not be reached and inaccessible bushings would not be replaced.
What's been done as a result
As a result of this occurrence, Qantas inspected all CF6‑80E1 engines in the A330 fleet for similar defects. No defects were identified. Additionally, Qantas issued a maintenance memo to service personnel, highlighting the maintenance actions for the VSV system and precautions to be aware of when carrying out work in this area.
Safety message
When maintenance organisations carry out additional activities to what is required, they should consider checking with the manufacturer to confirm that no unintended consequences could be introduced.
The occurrence
At about 0905 Eastern Standard Time[1] on 15 April 2018, Qantas Airways flight QF123, an Airbus A330-202 aircraft registered VH-EBR, departed Brisbane Airport, Queensland, for a regular public transport flight to Auckland, New Zealand.
About 4 minutes later, while climbing through 9,000 ft, the electronic centralised aircraft monitor displayed an ENG 1 N2 VIBRATION[2] advisory notification, indicating excessive vibration on the left engine. The crew carried out actions in accordance with the abnormal and emergency procedures checklist, reducing thrust on the left engine. The aircraft continued its climb at reduced thrust.
After several minutes, while climbing through flight level 190,[3] two loud bangs occurred and continuous airframe vibrations commenced. The crew reduced thrust on the left engine to idle and the noise and vibrations ceased. The thrust on the left engine remained at idle for the remainder of the flight. The crew declared a PAN PAN[4] and returned to Brisbane, landing safely at about 0945.
The Airbus A330 range of aircraft is a twin-engine, wide-body airliner. It is available with three different engine installation options. VH-EBR was fitted with General Electric (GE) CF6-80E1 (CF6) engines. Other engine options available for the A330 were the Pratt & Whitney PW4000, or the Rolls-Royce Trent 700 engines.
Recorded data
Figure 1 shows a plot of the data that was obtained from the quick access recorder (QAR). During the take-off roll, the left engine vibrations (black line) increased to a higher-than-normal level for the CF6. The vibrations continued to increase, resulting in the ENG 1 N2 VIBRATION message displaying on the electronic centralised aircraft monitor (ECAM) at about 0909. The left engine thrust was reduced in response. About 5 minutes later, two left engine vibration spikes were recorded, consistent with the loud bangs and airframe vibration reported by the crew. The left thrust lever was then reduced to idle.
The ATSB also downloaded data from the previous five flights. The recorded data showed that on each of those flights, the vibration level of the left engine was higher than normal but had not reached the limit to trigger the ECAM notification.
Figure 1: Plotted data from QAR showing vibration levels and thrust lever positions during the occurrence flight
Source: ATSB
Engine information
Post-flight engineering examination
A post-flight engineering inspection of the left engine identified metal fragments in the tail pipe and two missing fourth stage high-pressure compressor (HPC) blades. Figure 2 shows a cross‑section of the GE CF6 engine, with the location of stage four of the HPC highlighted.
The inspection also identified that several variable stator vane (VSV) lever arms were bent, and one was broken (Figure 3). The engine was subsequently shipped to an overhaul facility, where it was disassembled and inspected under the supervision of the engine manufacturer.
Figure 2: GE CF6 cross-section showing a detailed view of the HPC
Source: General Electric, annotated by ATSB
Figure 3: Section of the fourth stage variable stator vanes showing the fractured number 24 lever arm and resulting off-schedule vane. Inset shows location on engine at 3 o’clock position.
Source: Evergreen Aviation Technologies Corporation, annotated by ATSB
Engine disassembly and inspection
The engine disassembly and inspection revealed:
there was no damage to the first three HPC stages
two of the fourth stage HPC blade assemblies, number 3 and number 5, had separated at the dovetail-mounting portion of the blade root (Figure 4)
of the 50 fourth stage VSV lever arms, eight were distorted and the number 24 position was completely fractured
the separated blades had damaged the rear face of the fourth stage vanes with the distorted lever arms
the compressor and turbine sections downstream of the separated HPC blades were damaged from progression of the blade debris through the gas path.
All of the fourth stage compressor blades, variable stator vanes and lever arms were sent to the engine manufacturer’s materials examination laboratory for analysis.
Figure 4: Disassembled engine showing fractured dovetails within fourth stage
Source: Evergreen Aviation Technologies Corporation annotated by ATSB
Component failure analysis
Fourth stage blades
A laboratory examination by GE found that the blade fitted to the number 3 position failed due to the propagation of a high-cycle fatigue[5] crack that initiated in the blade root at the forward edge (in the direction of rotation). Other failures of the stage 4 blades have been reported previously, where the deterioration of the blade coating was identified as an important factor. There was no significant deterioration of the blade coating on this engine.
The blade in the number 5 position failed as a result of more rapid fatigue crack progression cracking (Figure 5). The examination found that this was due to secondary damage, likely from impact by the released number 3 blade. One other fourth stage blade was cracked.
Figure 5: Detailed view of fractured blades
Source: General Electric, annotated by ATSB
Variable stator vane lever arm
The VSV lever arm fractured as a result of fatigue crack progression that originated at an area of fretting[6] wear between the lever arm and washer (Figure 6 and Figure 7). The fretting on the lever arm was determined to have resulted from wear to the composite bushings fitted under the VSV lever arm. As the bushing wore, the VSV was allowed to tilt, placing a bending and twisting moment into the lever arm.
Figure 6: VSV design and component locations, highlighting outer bushing and lever arm
Source: General Electric, annotated by ATSB
Figure 7: Fractured VSV lever arm, its location and a close-up picture of the fracture surface showing fretting damage and high-cycle fatigue cracking
Source: General Electric, annotated by ATSB
Once the lever arm was broken, the vane rotated freely, which disrupted airflow into the fourth stage compressor. This created vibratory aerodynamic loading of the blades, which resulted in the fatigue cracking.
The bending damage in the nine VSV lever arms was determined to be secondary damage from contact with the separated compressor blades.
Engine maintenance history
The engine involved in this incident had accumulated 43,635 hours, 7,815 cycles since new and 13,047 hours, 3,352 cycles since its last overhaul. Since the last lever arm inspection, the engine had accumulated 2,474.46 hours and 551 cycles.
During the last engine overhaul, a number of fourth-stage compressor blades, including blade 3, were inspected, assessed as being serviceable and refitted. Others, including blade 5, were installed new at that time.
Variable stator vane inspections
Aircraft maintenance manual
VSV lever arm inspections were recommended by the engine manufacturer, but not mandatory. The inspection had an interval of 1,000 cycles between inspections. Qantas had opted to conduct this inspection, although in a modified form, due to a history of broken fifth stage lever arms experienced by other operators (see Related).
The aircraft maintenance manual (AMM) required inspection of the VSV:
stages 1, 2, 3 and 4 for vane trunnion metal touches stator case metal (MTM - metal-to-metal)
The manufacturer and operator both stated that lever arm looseness was identified through a wiggle check, which would indicate worn outer bushings. The AMM went on to state that if the engine had:
greater than 50% of the vanes in the stage with MTM
then the maintainer must:
replace outer bushings with new flanged outer bushings (this repair returns these parts to a serviceable condition).
This rectifying work could either be performed at the time of the initial inspection or postponed for a period, based on flight hours or cycles. The permitted extension was in place to allow time for maintenance action to be scheduled at the earliest opportunity.
Inspection accessibility
The ATSB examined a different CF6 engine fitted to an A330 undergoing maintenance and found that access to some VSV lever arms, at all stages of the compressor, was difficult.
About 75 per cent of the fourth stage VSV arms could be examined without engine removal and further disassembly of engine ancillary components. The remainder were not accessible due to the fitment of a large external gearbox covering the six to nine o’clock[7] position of the engine. The number 24 lever arm was situated at the three o’clock position and was therefore accessible.
The ATSB asked the engine manufacturer how a maintainer could determine when 50 per cent of the lever arms were worn, if a quarter of them were not able to be accessed. The engine manufacturer advised that the determination was 50 per cent of the number accessible. The engine manufacturer also advised that the intent of the rectification requirements was that when the 50 per cent threshold was met, the bushings were to be replaced as a complete set on that compressor stage.
The engine manufacturer surveyed five other A330 operators on current inspection practices and common findings. Some operators did not carry out bushing inspections on-wing, due to the inspection being non-mandatory. They were only inspected during shop visits or if found during other maintenance. The operators did not report that the lever arm bushings wore preferentially in any location around each compressor stage.
Operator inspections
The operator proactively replaced any VSV bushing that was found worn, prior to the engine reaching the 50 per cent limit. Stage four bushings had been replaced on other engines where, a portion were replaced at any one time. They advised this was to improve the overall condition of the vane stages. They sought clarification from the engine manufacturer prior to the occurrence, regarding the suitability of individual replacement, but reported they had not received a response.
The engine involved in this incident had undergone three inspections of the VSV system since its last overhaul. No defects resulting from these inspections were noted, and no bushings had been replaced.
Related occurrences
In November 2017, a Qantas A330 experienced similar inflight vibrations. The flight continued to its destination, where an inspection found that number 24 lever arm was fractured and one HPC blade had separated. GE reported that there had been no other fourth stage lever arm occurrences of this type in over 23 million flight hours and 4.7 million flight cycles accumulated by the CF6-80E1 world fleet as at March 2018. There were a number of failures of HPC stage 5 lever arms prior to 2002, however that issue was resolved through redesigned lever arms and bushings.
The manufacturer analysed the November event and determined the lever arm and blade had failed in the same manner as the subject occurrence. There were no commonalities found with engine hours or cycles, and no indication that the event engines had been operated significantly differently from the fleet. The manufacturer therefore determined that the two events were most probably related to maintenance in the area.
The ATSB reviewed the maintenance work packages for the engines involved and considered, for example, whether the lever arms at the number 24 position had been unintentionally damaged during a particular maintenance practice, causing accelerated bushing wear. However, there were no aspects identified with respect to personnel or work practices that may have linked the two occurrences.
The combination of worn outer bushings and fretting wear on a fourth stage high-pressure compressor (HPC) variable stator vane (VSV) lever arm resulted in a fatigue crack, leading to a fracture of the lever arm. The associated stator vane rotated into an off-schedule position and created turbulent airflow that acted like a cyclic pulse on the fourth stage HPC blades, as they passed the off-schedule vane. This aerodynamic cyclic loading resulted in initiation of a high-cycle fatigue crack in at least two compressor blades, until one blade separated at its root, causing damage to the downstream engine components and a noticeable increase in measured engine vibration.
Periodic maintenance
Qantas inspected the VSV system in accordance with the manufacturer’s non-mandatory inspection, with the exception of the individual replacement of worn bushings, as they were discovered. The inspections were generally effective in that assemblies accessible for inspection had previously been found to be loose and were replaced. However, while the failed (number 24) VSV lever arm was also accessible, no issues were found in the most recent inspections. Noting that the engine was approximately halfway between the 1,000 cycle inspections, it was possible that the looseness was not apparent at that time. Nevertheless, the inspections, as conducted, were not effective in detecting the worn bushing and thereby preventing this occurrence.
A consequence of the individual replacement of worn bushings, as opposed replacement of the entire set on a threshold of 50 per cent worn bushings, was that the inaccessible bushings would not be replaced while the engine was in service. While this would not have affected the outcome in this occurrence, modifying the replacement criteria reduced the overall effectiveness of the inspection.
Previous occurrences
This was only the second engine failure of its type on CF6‑80E1 engines. The occurrences were within five months of each other, involved the same operator and failure of the VSV arm in the same position. In the absence of commonalities in engine hours, cycles or service history, the engine manufacturer determined that the failures were most probably related to maintenance in the area of the VSV arm. The ATSB review of the associated maintenance work packages did not find any evidence to positively link the occurrences.
Findings
From the evidence available, the following findings are made with respect to the engine surge and high vibration involving an Airbus A330, registered VH-EBR, 44 km north-east of Gold Coast Airport, Queensland, on 15 April 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
A worn stator lever arm bushing resulted in fretting damage, initiation of a fatigue crack, and fracture of the lever arm.
The fracture of the lever arm led to an off-schedule variable stator vane, which created turbulent airflow within the engine compressor section. This turbulent airflow led to the failure of a compressor blade at the blade root, due to high-cycle fatigue.
The operator had conducted three non-mandatory inspections of the variable stator vane system since the engine's last overhaul. Despite these inspections being conducted, the outer bushing and lever arm at the number 24 position was able to wear, undetected.
Other findings
The engine issue was one of two identified worldwide. Both occurred within 5 months of each other, in the same operator’s fleet and in the same number 24 position, and both on the left engine. The engine manufacturer, operator and the ATSB were unable to establish fully the reason for the timing, fleet, and position commonalities in the context of worldwide historical data.
Safety actions
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Qantas Airways
Qantas has taken proactive safety actions, including performing a once-through fleet inspection of variable stator vane (VSV) lever arms in the number 24 position, across the A330 fleet. No defects were identified as a result of this inspection.
Qantas also issued a VSV system awareness maintenance memo to engineering staff. The purpose of this memo was to highlight the importance of the inspection of VSV lever arm system for worn bushings and precautions to be aware of when carrying out work in this area.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Qantas Airways
General Electric Aviation
aircraft Quick Access Recorder.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Qantas Airways, General Electric Aviation, National Transportation Safety Board, Bureau d’Enquêtes et d’Analyses and the Civil Aviation Safety Authority.
Submissions were received from General Electric Aviation. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0600 Western Standard Time[1] on 20 April 2018, the 103 m livestock carrier Angus Express (Cover) arrived at the Broome, Western Australia, pilot boarding ground. The ship had just completed a voyage from Singapore, and was expected to load cattle at berths 4 and 5.
A pilot boarded Angus Express and was escorted to the ship’s navigation bridge. The bridge team consisted of the master, chief mate (under supervision as trainee master), and a seaman as the helmsman. The chief mate, master and pilot then commenced the master-pilot information exchange (MPX). During the exchange, they discussed the ship’s characteristics, the inward passage and the berthing plan.
When booking the pilotage on 16 April 2018, the master had advised that the ship’s bow thruster was inoperable. The port’s handbook[2] recommended that a ship of Angus Express’s length with no thruster utilise two tugs for arrival and departure. The tugs were booked in advance, but at about 1845 on 19 April, the pilot became aware that only one of the port’s two tugs would be available as the other tug was out of service for a week for repairs. He informed the harbour master who advised that provided there were no strong winds and the ship berthed within an hour or less of slack water,[3] the pilot could make the decision whether to continue with the berthing. The pilot then conducted a risk assessment and discussed it with the harbour master. They determined that the ship could berth with the use of only one tug.
The pilot explained the plan to the ship’s chief mate and master during the MPX and they agreed with the plan. The pilotage into Broome continued with a tug in attendance from 0636 (Figure 1), and went as planned and without incident.
Figure 1: Angus Express’s arrival into Broome and the approach to berth 4 & 5
Source: Australian Hydrographic Service, annotated by ATSB
The pilot swung the ship to port and approached the wharf, to berth starboard side alongside. By 0710, the ship was alongside the wharf, with two Yokohama fenders[4] positioned forward and aft, between the ship and wharf’s vertical fender posts (low water was at 0711 (1.55 m)).
The ship was about 8 m aft of its berthing position at berth 4 and 5, when mooring lines were run to the wharf. The pilot then tried to use the mooring winches to heave in the mooring lines to move the ship forward into position. However, by this time, the slack tide was starting to change and the pilot estimated there was a current working against the bow and the mooring winches were ineffective. The pilot then instructed the tug, in position about amidships, to push forwards at a 45° angle using minimum power, to assist repositioning the ship.
At 0712, the weight of the ship against the forward Yokohama fender forced it to pass under the fender posts, which resulted in the ship’s bow moving towards the wharf (Figure 2). Shortly after, an overhanging scupper[5] protrusion made contact with the fender post (about 30 m from the ship’s bow).
Figure 2: Damage to the Angus Express’s starboard scupper protrusion
Source: Kimberley Ports Authority, annotated by ATSB
The pilot thought that the ship had pivoted on the Yokohama fender and instructed the tug to stop pushing. The ship moved slightly off the fender posts and the fender cleared the post.
At 0714, the pilot instructed the tug to push minimum forward again, resulting in the forward Yokohama fender once again passing underneath the fender posts. The ship’s bow again moved towards the wharf, and the scupper protrusion again made contact with the fender post (Figure 2). The pilot instructed the tug to stop, and the ship came away from the vertical fender posts.
The pilot then advised the master to use the ship’s engines to reposition the ship. At 0718, the ship was in position as intended and all fast[6] with the height of tide now at 1.65 m.
The pilot reported the incident to the harbour master who subsequently attended the ship and found minor damage to the ship’s superstructure.
Yokohama fenders in Broome
The Yokohama fender system in the Port of Broome consisted of large floating cylindrical rubber fenders, secured to vertical fender posts, which allowed vertical movement as the tide changed. The tyres fitted with chain to the outside of the fenders for protection also increased their width. The use of fenders kept the ship’s side clear of the wharf, protecting both, and allowed longer loading windows (Figure 3). The added clearance from the wharf also reduced the steepness of the gangway in the large tidal range at Broome.
Figure 3: Berthing plan showing the position of the Yokohama fenders at berth 4 & 5
Source: Kimberley Port Authority, annotated by ATSB
After the incident, inquiries by Angus Express’s pilot resulted in a pilot who had worked in the port until 2015 providing relevant information about the Yokohama fender system. That pilot’s personal pilotage log indicated that a height of tide of less than 2.5 m was considered a significant factor with respect to the fenders at berth 5. When the water level fell below this height, the fenders could be forced under the vertical fender posts by a ship.
Post-incident investigations by Kimberley Ports Authority (KPA) and the pilotage provider, West Coast Pilots (WCP) confirmed that the fender posts at berths 4 and 5 were shorter than at others. No evidence was found to indicate that these shorter posts or the potential for fenders to be forced under them when water levels fell had been documented or otherwise promulgated to pilots through training or instruction.
Safety analysis
Yokohama Fenders
The height of tide at the time of the incident was 1.62 m, which was low enough to expose the base of the fender posts (Figure 3). When the pilot attempted to manoeuvre Angus Express forward using the tug, the force exerted on the Yokohama fender by the ship, allowed it squash and roll under the fender post. Consequently, the ship moved closer to the wharf and the scupper protrusion contacted the post.
Risk assessment
The reason for changing Angus Express’s berthing plan was a possible 1-week delay due to tug unavailability. Such a delay could have resulted in stranding a large number of cattle in holding yards for a long period with only about 8 hours of loading fodder available. Therefore, the reason to change the berthing plan (subject to a risk assessment) were valid.
However, at that time, neither the pilot nor the management of both WCP and KPA were aware of the shorter fender posts at berths 4 and 5, and the potential for Yokohama fenders to be forced under them. Had this information been known and effectively disseminated, it would have been considered during the risk assessment and the incident could have been avoided.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The height of tide when Angus Express was berthing was low enough to expose the base of the wharf’s fender posts. Consequently, when the tug pushed to move the ship, the forward Yokohama fender was forced under the post, which allowed the ship's starboard scupper protrusion to contact the post with resulting damage.
The harbour master and pilot were unaware of any height of tide limitations associated with berthing ships alongside Yokohama fenders at berths 4 and 5. Therefore, the risk assessment did not include any mitigating factors for berthing alongside at a height of tide less than 2.5 m.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Kimberley Ports Authority
As a result of this occurrence Kimberley Ports Authority advised the ATSB that it had taken the following actions.
Berthing with Yokohama style fenders
Guidelines for berthing and being alongside when using Yokohama style fenders have been implemented for times of limiting low water levels. Also, the risk evaluation process between harbour master and pilot has been extended to include focussed quick risk assessment for circumstances such as tug shortages, vessel manoeuvring issues and tidal levels.
A memorandum has been issued to all pilots and port users advising of these changes.
Safety message
This incident highlights the fact that marine pilots may encounter operational parameters outside normal limits. Whenever this occurs and learning opportunities are identified, it is important to ensure these are captured through proper reporting processes. This information can then be shared through training and awareness to reduce risk and avoid incidents.
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. Marine pilotage is one of the safety concerns, with further information available from the ATSB’s website.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 28 April 2018, a Qantas Boeing 737 (VH-XZM) landed on runway 03 at Perth, Western Australia. The aircraft exited the runway onto taxiway J2, which led to a holding point for crossing runway 06. The aircraft did not stop at the holding point and crossed an illuminated stop bar without an air traffic control clearance.
At that time, a second Qantas Boeing 737 (VH-VZL) had commenced take-off from runway 06. An automated warning alerted the aerodrome controller (ADC) of the stop bar violation and the controller issued an instruction for the departing 737 to stop immediately. Soon after, the flight crew of VH‑XZM became situationally aware of their position and stopped just before crossing the edge of runway 06. VH-VZL’s wingtip passed about 15 m from VH-XZM’s nose at low speed.
What the ATSB found
The captain of VH-XZM developed an incorrect mental model of the exit taxiways off runway 03, believing the aircraft would not have to cross runway 06 after exiting onto either of the potential taxiways (J2 or D). Due to this incorrect mental model, and a combination of workload and distractions at key times, the flight crew did not detect the runway crossing issue until their aircraft had almost reached the edge of runway 06.
Taxiway J2 was the preferred runway exit for jet aircraft landing on runway 03. However, the location and design of the taxiway significantly increased the risk of a runway incursion onto runway 06/24. In particular, it had a relatively shallow intersection angle with the runway and a relatively wide turn radius, leading to higher taxi speeds, and a short distance to the holding point for runway 06/24.
Although the junction around taxiway J2 was identified as a ‘hot spot’, there was no detailed information about the reasons why it was a hot spot on aerodrome charts, and Qantas did not specifically require pilots to brief hot spots during departure and approach briefings.
What's been done as a result
In response to the runway incursion, Airservices Australia made taxiway J2 unavailable for use. Subsequently, Perth Airport removed taxiway J2 from aerodrome charts.
In addition, Airservices Australia changed the settings of an alerting system to ensure tower controllers at Perth Airport performing multiple roles received appropriate aural and visual alerts at their workstation.
Qantas published a safety information notice to all pilots containing information about the background of runway incursions, details of two recent runway incursion occurrences and safety educational information related to influencing factors, stop bar techniques and strategies to avoid a runway incursion. Qantas also updated its Flight Administration Manual to include a requirement for pilots to brief relevant airport hot spots and their contingency planning to mitigate against the possibility of collision or runway incursion.
Safety message
Runway incursions are one of the most significant risks to safe aviation operations and a key global safety priority. Airport operators and local runway safety teams are strongly encouraged to identify and mitigate the risk of hot spots, especially those that involve short distances between runways, complicated junctions, and the potential for higher taxi speeds.
Pilots are strongly encouraged to identify runway hot spots during departure and approach briefings, and discuss the actions they will take to reduce the risk of a runway incursion at such hot spots.
Air traffic controllers are strongly encouraged to provide safety alerts and/or clear instructions (such as ‘stop immediately’) to the flight crews of all aircraft involved in runway incursions and related occurrences.
The occurrence
Overview
On 28 April 2018, a Boeing 737-838 (737) aircraft, registered VH-XZM, was being operated by Qantas Airways Limited (Qantas) on a regular public transport flight from Sydney, New South Wales to Perth, Western Australia. The aircraft landed on runway 03 and exited using taxiway J2 (Figure 1). The aircraft did not stop at the runway 06 holding point and crossed an illuminated stop bar without an air traffic control (ATC) clearance.
VH-XZM’s incursion into the flight strip of runway 06 resulted in a rejected take-off of another Qantas Boeing 737 aircraft (VH-VZL), which was taking off from runway 06. VH-VZL’s wingtip passed about 15 m from the nose of VH-XZM at low speed before stopping.
Figure 1: Overview of the runway incursion
Source: Google Earth, modified by ATSB
Events prior to the occurrence
VH-XZM departed Sydney at 1033 Western Standard Time[1] on the scheduled flight to Perth. During their review of NOTAMs,[2] the flight crew noted the recent installation of stop bars at Perth Airport.
On this sector the captain was pilot monitoring and the first officer (FO) was pilot flying.[3] Prior to descent, the approach controller cleared the flight crew for an area navigation (RNAV-X) runway 03[4] approach. Weather conditions for the descent and approach were good.
Prior to descent, the FO conducted an approach briefing, noting taxiway J2 (Figure 2) was the preferred exit and they would need to get an ATC clearance to cross runway 06. The FO recalled being aware that taxiway J2 was a designated ‘hot spot’ but did not brief it as a hot spot or state that runway incursions happened there. The captain expressed a preference to request taxiway D, which was closer to the terminal building. At the completion of the briefing, the FO believed that the captain understood they would vacate runway 03 onto taxiway J2 unless they had a clearance to exit at taxiway D.
The captain recalled the briefing as professional and very thorough, but did not fully absorb all of the FO’s briefing points (due to the level of detail in the briefing). The captain also recalled, that when discussing the taxi route to their assigned parking bay (13), being mainly focussed on vacating onto taxiway D, which led directly onto the apron, with taxiway J2 being the secondary plan. Having referenced the smaller apron chart (Figure 3) and not the larger aerodrome chart, the captain’s mental model of the taxiway J layout was that if they used taxiway J2 they would vacate the landing runway 03 directly on taxiway J1, which led directly to the apron area. The captain interpreted the FO’s point about a requirement to cross runway 06 as being during the landing roll on runway 03.
During the approach phase, another aircraft, also on approach to land on Perth runway 03, was following VH-XZM. It had been slowed down by ATC to coordinate the two arriving aircraft. ATC requested the flight crew of VH-XZM to maintain a high speed descent, which they accepted.
Figure 2: Perth aerodrome chart
Source: Airservices Australia, annotated by ATSB
Figure 3: Perth apron chart showing captain’s mental model of taxi routes to bay 13
Source: Qantas, annotated by ATSB
Final approach and landing
The RNAV-X runway 03 approach required a descending right turn from about 2,180 ft to 790 ft. The FO recalled the captain commenting that, when flying the RNAV-X runway 03 approach, it could be difficult to slow the aircraft down and they would need to conservatively configure the aircraft for the arrival.
At 1438:55, the captain made first contact with the aerodrome controller (ADC) on the Perth ADC (tower) frequency. The captain recalled that the radio call was made during a period of high workload while closely monitoring the FO, the aircraft speed and the approach profile, and that the aircraft was not slowing down as quickly as desired.
The aircraft descended through 1,600 ft, configured with gear down and flaps 15 set, and the airspeed about 175 kt. As that speed was the flaps extension limit speed for flaps 30 (the intended flaps setting for landing), the captain suggested to the FO they select flaps 25 (a non-normal setting) to decelerate to enable selection of flaps 30, which they did once the aircraft slowed.
The captain recalled being ‘totally focused’ on the FO flying an accurate approach profile and descending turn. Due to this high workload, the request to take taxiway D after landing was forgotten. The captain also forgot to pre-set the Perth ground frequency in the radio’s standby frequency position, a routinely performed task.
The captain started actioning the landing checklist. At 1439:28, that process was interrupted by the ADC issuing them a clearance to land on runway 03. At that time the aircraft was passing approximately 1,100 ft and still in a descending right turn to final approach. The flight crew completed the landing checklist and continued the approach within the requirements of the Qantas stabilised approach criteria.
During this time, VH-VZL was taxiing to runway 06 for departure and its flight crew were monitoring the Perth surface movement controller (SMC/ground) frequency. At 1440:59, that flight crew changed to the ADC frequency and advised the ADC they were ready. At 1441:02, the ADC cleared them to line up and wait on runway 06.
At 1441:21, VH-XZM landed on runway 03 and the FO selected idle reverse thrust. While the aircraft was decelerating, the captain realised that an egress onto taxiway D had not been requested from the ADC and believed they were now committed to vacate via taxiway J2. At about 60 kt, the captain took control of the aircraft from the FO (consistent with normal procedures)[5] and applied heavier braking so the aircraft could make taxiway J2.
Approaching taxiway J2 for the first time, the captain thought it appeared to be a rapid exit taxiway (RET). The aircraft’s groundspeed was about 53 kt when, at 1441:42, the captain started to turn off the runway centreline towards taxiway J2, continuing to slow throughout the turn and passing over the left edge of runway 03 at 1441:47 at 35 kt.
Taxi and runway incursion
At 1441:51, once certain that VH-XZM would vacate runway 03 onto taxiway J2, the ADC issued VH‑VZL’s flight crew a take-off clearance on runway 06, which was then read back by the crew of VH-VZL. At 1441:59, another aircraft, which had been following VH-XZM and was now on final approach to runway 03, also made a transmission on the ADC frequency.
The captain of VH-XZM recalled hearing the ADC issue a take-off clearance to another Qantas aircraft but did not recall hearing the words ‘runway 06’ and did not associate it with a potential threat at the time. The FO did not recall hearing any ATC transmission at that time.
The SMC reported being aware that VH-XZM was on taxiway J2, and the flight crew would soon be calling on the SMC frequency to report they were at the holding point. However, when the ADC gave VH-VZL a take-off clearance, the SMC switched attention to other aircraft on the apron area, knowing that VH-XZM would not be able to cross runway 06 for a while.
Figure 4 shows the relative positions of VH-XZM and VH-VZL during the remainder of the occurrence sequence.
Figure 4: Overview of the runway incursion
White aircraft symbols show the aircraft positions at 5-second intervals. White lines show the angle between the two aircraft at some of those times. Labels show events that occur within 1 second of the aircraft’s position illustrated.
Source: Google Earth, modified by ATSB
At 1441:55, VH-XZM passed over the holding point for runway 03 at a groundspeed of about 22 kt. At about this time, the FO assessed that the captain was still slowing the aircraft at a rate to stop at the runway 06 holding point; the FO was aware that they needed an ATC clearance to cross runway 06 and assumed that the captain would stop.
The FO then refocused their attention inside the flight deck and noticed that the Perth SMC frequency had not been pre‑set as the radio’s standby frequency. As a result, reference was made to the aerodrome chart to find the frequency to set. This led to a delay in contacting the SMC to receive taxi instructions. The captain recalled also briefly looking down to understand the reason for the delay and telling the FO the required frequency.
Although being aware that stop bars had recently been installed at Perth, the captain recalled being surprised to see an illuminated stop bar ahead on the taxiway and thought it strange that a stop bar would be positioned at that location. The captain believed they were on taxiway J1, which did not require a runway crossing, and rationalised that the stop bar had been mistakenly constructed with omnidirectional lighting[6] and that it was for aircraft taxiing from the opposite direction entering runway 03. The captain also thought that, given their current taxi speed and how quickly it appeared after exiting the runway, the stop bar could not be meant for their aircraft. The captain did not recall noticing any markings that identified runway 06. Consequently, they taxied over the illuminated stop bar and through the runway 06 holding point.
At 1442:01, the nose of VH-XZM passed the runway 06 holding point (with an illuminated stop bar) at a groundspeed of 17 kt. At 1442:04, in the tower, the integrated tower automation suite (INTAS) made the first of two aural and text alerts on the ADC’s workstation. The aural alert comprised a synthetic voice stating ‘warning runway zero six stop bar violation’. The alert was designed to trigger when the aircraft was registered to be 8 m past the stop bar. At this time, the aircraft was travelling at about 14 kt.
Due to default settings within INTAS, no aural or text alert was provided on the SMC’s workstation. The SMC later reported hearing the aural alert through a speaker on the ADC’s workstation, and then saw VH-XZM entering the runway and VH-VZL rolling for take-off. At this time the SMC was part way through providing a pushback clearance to another aircraft and the flight crew of that aircraft then read back the clearance details on the SMC frequency.
At the time of the first INTAS alert, the flight crew of VH-VZL had just commenced rolling for take-off on runway 06 and were setting engine thrust. The ADC recalled having communication with VH-VZL and considered that, as VH-XZM had vacated runway 03, it should have transferred to the SMC frequency. Initially, a radio transmission from another aircraft prevented the ADC from transmitting on the ADC frequency. As soon as it stopped, at 1442:11, the ADC instructed VH-VZL’s flight crew to ‘stop immediately, stop immediately, runway incursion ahead’.
The captain of VH-VZL subsequently reported being aware of the other aircraft when it was taxiing on taxiway J2. When the stop instruction from the ADC was received, the captain was just starting to have an element of doubt as to whether the other aircraft would stop, and during the instruction initiated a rejected take-off by bringing the thrust levers back and braking. At that time the aircraft’s groundspeed was 58 kt.
As VH-XZM’s flight crew had transferred to the SMC frequency at some point before 1442:11, they did not hear the stop instruction issued to VH-VZL and were unaware of that aircraft’s presence and proximity. The captain continued taxiing towards runway 06 at about 10 kt, and then observed another aircraft (a Boeing 787) ahead on the apron (Figure 5). It had recently pushed back and was now blocking taxiway J1. The captain reported being distracted by the aircraft on the apron as it blocked their intended route on taxiway J1 and now required their aircraft to turn onto taxiway A.
Figure 5: Aircraft on the apron as XZM taxis toward runway 06
Source: Perth Airport
At 1442:16, the second INTAS aural (‘warning runway zero six occupied’) and text alert activated while the flight crew of VH-VZL was rejecting the take-off. As with the previous alert, the second alert was not presented at the SMC’s workstation. As the first INTAS alert was still active, the controllers now had multiple warnings sounding, which increased the noise level in the tower.
At the same time as the second INTAS alert, VH-XZM’s FO contacted the SMC advising they were taxiing for bay 13. The SMC did not respond to that transmission, and subsequently could not recall whether that transmission was heard.
The captain of VH-XZM recalled seeing (in peripheral vision) an aircraft (VH-VZL) going faster than would be expected on a taxiway, then applying the brakes to stop the aircraft. The FO recalled that, when looking up, probably about the time the captain began braking, they realised they were in a different position to that expected and called ‘stop, stop, stop’.
The captain applied VH-XZM’s brakes at 1442:19, when the speed was 9 kt, and the aircraft came to a full stop at 1442:25. At 1442:29, VH-VZL came to a stop on runway 06, having just passed ahead of VH-XZM. The wingtip of VH-VZL passed about 15 m from the nose of VH-XZM at low speed.
At 1442:26, just before VH-VZL stopped, the SMC asked if VH-XZM was ‘on this frequency’ and the FO responded with ‘affirm’, their callsign, and the intended bay. The SMC advised VH-XZM’s crew that they had crossed a stop bar and had a runway incursion, and to hold position. The flight crew of VH-VZL were subsequently cleared to taxi back to runway 06 for departure. The flight crew of VH-XZM were cleared to taxi to bay 13.
The captain held an Airline Transport Pilot (Aeroplane) Licence (ATPL) and was appropriately qualified to conduct the flight. Having flown 737s since 2007, the captain had operated into Perth Airport many times, including three to four times in the last 4–5 months. Most of the landings at Perth were on runway 21 or 24, using taxiway J1 from runway 24. The captain had rarely landed on runway 03 and only recalled using taxiway D off that runway and had not previously used taxiway J2. Although aware that stop bars had been installed at Perth Airport, and having encountered them at other airports, the captain had not previously encountered them at Perth.
The first officer (FO) held an ATPL and was appropriately qualified to conduct the flight. The occurrence flight was the third set of flights since completing FO training on the 737, having previously operated as an Airbus A330 second officer. The FO had landed at Perth on five previous occasions, including two landings on runway 03 (which had exited on taxiway D). The occurrence flight was the first time the FO had landed on runway 03 and vacated via taxiway J2.
Both flight crew were based in Brisbane. They both had 3 days off duty during 24–26 April 2018, then on 27 April they commenced a 3-day trip together. On 27 April they signed on at 0530 Eastern Standard Time (EST)[7] and flew a series of flights, ending their duty time at about 1530 EST. On 28 April, they signed on for duty at Gold Coast Airport about 0725 EST, then operated a flight from the Gold Coast to Sydney. Following a transit in Sydney they then commenced the flight to Perth. At the time of the occurrence both of them had been on duty for 10.3 hours. They described the workload during the day as not being significant or unusual. They departed Sydney about 1 hour behind schedule due to connecting aircraft and reported not feeling any commercial pressure.
The flight crew’s roster provided both flight crew with sufficient sleep opportunity in the nights prior to the occurrence. The captain reported having about 7 hours sleep the night before the occurrence and normal sleep in the nights before. The FO reported having a normal amount of sleep the night before the occurrence and the nights before that. Both flight crew reported being a little tired at the time of the occurrence. However, given the other available information, there was insufficient evidence to suggest they were experiencing a level of fatigue that has been demonstrated to adversely influence performance.
Air traffic controllers
At the time of the occurrence, Perth tower was staffed by two air traffic controllers:
the aerodrome controller (ADC), who was responsible for controlling all aircraft and vehicle movements on all runways
the surface movement controller (SMC), who was performing the combined duties of SMC (responsible for controlling all aircraft and vehicle movements on the airport aprons and other manoeuvring areas) and airways clearance delivery controller (responsible for issuing airways clearances to departing aircraft).
Both controllers were correctly endorsed for their roles. The ADC on duty at the time of the occurrence had over 30 years’ experience and was fully endorsed for all roles in the Perth tower. The SMC had 3 years’ experience at Perth tower (and prior experience overseas) and was endorsed for all roles in the Perth tower.
The controllers reported that aircraft movements had been ‘quiet’ in the period leading up to the occurrence, with only 4 or 5 aircraft movements occurring at intermittent times.
The ADC reported having about 8 hours sleep the night before the occurrence and normal sleep in the nights before. On 28 April, the ADC signed on for duty at 0730 WST and had several rest periods during the shift. At the time of the occurrence, the ADC had been on duty for 7.2 hours, due to sign off at 1530.
The SMC reported having a normal sleep the night before the occurrence and normal sleep in the nights before. On 28 April, the SMC signed on for duty at 1345, and had been performing the role for about 45 minutes prior to the occurrence.
Both of the controllers recalled feeling alert at the time of the occurrence and had sufficient sleep opportunity in the nights prior to the occurrence. There was no evidence to suggest they were experiencing a level of fatigue that has been demonstrated to adversely influence performance.
Meteorological information
At the time of the occurrence, the Perth automatic terminal information service (ATIS) broadcast the wind was variable at 5 kt with a maximum tailwind on runway 03 of 5 kt. The conditions were CAVOK[8] and the temperature was 28 °C. The ATIS also advised that stop bars were active at all runway holding points.
The flight crew of VH-XZM reported the weather conditions as fine with light winds and good visibility. The captain stated there was no tailwind during landing on runway 03. There were no reported concerns with sun glare or other factors affecting visibility for the flight crew of VH‑XZM. The controllers stated the weather conditions were fine with no restrictions on visibility from the tower.
Closed-circuit television footage at the terminal verified all recollections of weather and visibility conditions made by flight crews and controllers.
Recorded information
On-board recordings
Both 737 aircraft involved in the occurrence (VH-XZM and VH-VZL) were fitted with a flight data recorder (FDR) and cockpit voice recorder (CVR) as required by the applicable legislation.
Qantas downloaded both FDRs and sent the digital files to the ATSB. Both FDRs included data over the period of the occurrence. This information has been included in this report where relevant.
Each CVR was capable of recording 2 hours of data, which would have included communications between the flight crew, communications with air traffic control and various flight deck sounds, alerts and warnings. The CVR for VH-XZM was not preserved before being overwritten during ground activities.[9]
There were no reported defects associated with VH-XZM.
Air traffic control recordings
Air traffic control (ATC) audio recordings and integrated tower automation suite (INTAS) data records were obtained from Airservices Australia. The audio recordings provided all relevant radio communications between controllers and flight crews, and the synthetic voice INTAS warnings. INTAS data records provided aircraft position information that could be compared with other sources of recorded data.
Flight crew briefing requirements
Operator information
The Qantas FlightAdministrationManual (FAM) outlined standard operating procedures and detailed guidance to flight crew on the conduct of briefings.
The FAM stated:
The objective of a briefing is to ensure all Flight Crew understand and share a common mental model for the proposed plan of action.
Furthermore, it stated that for the briefings to remain effective they should be:
Interactive – engaging all Flight Crew members and ensuring a practical understanding of what is proposed.
ThreatandErrorManagementBased – briefing points should include identification and assessment of threats. Plans for dealing with identified threat should be discussed. The depth of the briefing content should be commensurate with the assessed threat environment.
ConciseandRelevant – content must serve to refresh knowledge considered necessary for crew coordination. It is unnecessary to reiterate standard operating procedures or discuss every detail of published procedures as each Flight Crew member must review pertinent information and FMS [flight management system] setup in preparation for the briefing.
Briefing emphasis should be directed to plans or requirements which vary from those routinely used.
On a multi-sector tour of duty involving Australian ports, there is no requirement for repetition of items previously briefed for the same departure or arrival, provided that the Pilot In Command is satisfied that the pertinent information is understood by all Flight Crew.
TimelyandLogical – to assist delivery and understanding, briefings must be scheduled so as not to interfere with operational tasks and the content should follow a logical sequence based on phase of flight. The briefing framework must conform to the following structure and sequence:
– Considerations with emphasis on threat identification, assessment and implementation of management strategies.
– Normal operations with emphasis on sharing plans of action.
– Contingency and non-normal aspects with emphasis on contingency planning.
For approach and arrivals at an airport, it was standard practice for the briefing to be completed prior to commencing the descent.
The FAM section 21.2.4.4 gave flight crew the following guidance:
Considerations – identify and assess the threats and considerations that may affect the arrival plan which may include but not necessarily be limited to terrain, adverse weather, airport conditions, NOTAMs, aircraft maintenance status, RMS [route manual supplement] or specific state requirements, traffic, ATC, ground support and fuel conservation opportunities.
NormalOperations
– ArrivalandApproach – brief chart page number, together with relevant charted requirements. For runways where there is no published instrument procedure the anticipated arrival plan should be briefed. Nominate planned approach procedures.
– NavigationandAltimetry – brief the relevant navigation and altimetry requirements.
– Automation – brief the planned level of automation to be used and the transition to manual flight.
– Landing – brief landing flap configuration, level of reverse thrust and auto-brake setting for planned runway exit.
– ContingencyPlanning – brief contingency plans for all threats assessed as requiring crew management.
The FAM guidance did not specifically require flight crews to brief hot spot locations or describe how runway incursion threats would be mitigated.
Other guidance for flight crew briefings
International Civil Aviation Organization (ICAO) document 9870 ManualonthePreventionofRunwayIncursions stated:
The “before start” and “descent” briefings should also contain a complete review of the expected taxi routes with special attention to the hot spots.
Guidance from the United States Federal Aviation Administration (FAA) in 2012 called for operators to develop and implement specific procedures to prevent runway incursions. The FAA advisory circular AC 120-74B (Parts 91, 121, 125, and 135 Flight crew procedures during taxi operations) emphasised that a thorough taxi briefing should include a review of the airport diagram and identify critical locations on a taxi route, including, but not limited to, hot spots, complex taxiway intersections and runway crossing points. In addition, the circular called for procedures that would require flight crews to describe how runway incursion threats would be mitigated: by briefing the timing and execution of checklists and communications, so that no flight crew member was preoccupied or head-down when approaching an active runway.
There was no CASA guidance regarding the inclusion of runway hot spots or incursion threats in pre-flight or in-flight briefings. The ATSB reviewed the documentation of two other Australian airlines and found that one specified a mandatory requirement for flight crews to verbally brief runway hot spots, and the other provided detailed guidance material regarding runway hot spots and recommended that flight crews verbally brief them.
Airport information
General information
Perth Airport had two runways. The main runway was oriented 03/21 and the cross runway 06/24 (Figure 2). Both were 45 m wide and had a 150-m wide flight strip.[10]
Preferred taxiway
Since 2014, the Aeronautical Information Publication (AIP) entry for Perth Airport stated the preferred exit taxiways for arriving aircraft on each runway and for different types of aircraft. The preferred taxiway for jet aircraft landing on runway 03 was J2 and for turboprop aircraft it was A6. The AIP stated that the preferred taxiways were to ‘ensure minimum runway occupancy time and support optimum spacing on final [approach]’.[11]
Data provided by Airservices Australia indicated that, from May 2017 to April 2018, about 24 per cent of all aircraft landing on runway 03 exited via J2. Data provided by Qantas showed that, of its 737 fleet landings on runway 03, about 44 per cent vacated runway 03 at taxiway J2. Qantas noted that its pilots preferred to exit runway 03 at taxiway D as it resulted in a shorter and more direct route to the terminal.
The AIP stated that, unless specified otherwise by ATC, an aircraft must promptly vacate the runway after landing without backtracking. There was no requirement under the AIP for an aircraft to use the first available taxiway.
Taxiway J2
Arrangement
Taxiway J2 was located approximately 1,911 m from the threshold of runway 03. It led to a 6-way intersection comprising runway 06/24 and three other taxiways (Figure 6).
Taxiway J2 intersected runway 03 at a 60° angle. The straight distance from the edge of runway 03 to the runway 06 holding point was approximately 176 m, and the distance from the runway 03 holding point and the runway 06 holding point was about 70 m. The distance from the runway 06 holding point to the edge of runway 06 was about 102 m.
Figure 6: Taxiway J2 in relation to runways and other taxiways
All annotations are approximate and for illustration purposes only.
Source: Google earth annotated by ATSB
The Civil Aviation Safety Authority (CASA) outlined Australian requirements for aerodromes in Civil Aviation Safety Regulation (CASR) Part 139 and the associated Manual of Standards (MOS). As an airport operator licensed by CASA, Perth Airport was responsible for the safety of the aerodrome in accordance with those requirements.
The MOS section 6.3.3 Taxiway Curves defined the minimum curve radius required for taxiway design speeds, which are listed in Table 1. For taxiway J2, with a curve radius of 200 m, the taxiway design speed was about 31 kt. VH-XZM’s turn from the runway onto the taxiway was made at an average speed of 34 kt.
Table 1: Taxiway design speed for minimum radius of curve
Taxiway design speed
Curve radius
20 km/h (11 kt)
24 m
30 km/h (16 kt)
54 m
40 km/h (22 kt)
96 m
50 km/h (27 kt)
150 m
60 km/h (32 kt)
216 m
70 km/h (38 kt)
294 m
80 km/h (43 kt)
384 m
90 km/h (49 kt)
486 m
100 km/h (54 kt)
600 m
Runway holding point markings
Perth Airport runway holding points (or runway-holding positions) were equipped with signage and ground markings to provide flight crews with visual cues indicating their position and proximity to a runway. Those markings identified the location where an aircraft was required to stop when it did not have an ATC clearance to proceed onto or to cross a runway.
For flight crew vacating runway 03 on taxiway J2, the holding point for runway 06/24 was marked with red and white ground markings identifying the runway ahead,[12] taxi-holding point signs and location signs. The runway holding point was also equipped with unidirectional[13] runway guard lights, which flashed continuously, and a stop bar (Figure 7).
Figure 7: View of the runway 06/24 holding point on taxiway J2
The central panoramic image was taken from the entrance to taxiway J2 from runway 03/21. The other images were taken from close to the runway holding point. All images were taken at a height lower than that of the flight crew of a Boeing 737.
Source: ATSB
Stop bars
Stop bars were intended to provide additional protection of runway/taxiway intersections to prevent runway incursions. They were a series of unidirectional lights at right angles to a taxiway centreline (Figure 8). The lights were spaced 3 m apart and located 0.3 m before a holding point. Stop bars showed red in the direction of approach to the stop bar. They were controlled by ATC and were independent of the runway guard lights. Additional raised lights at each end of the stop bar were not installed, nor were they required to be.[14]
Figure 8: Runway identifier (red and white markings) and stop bar (red lights) installed on taxiway J2
Source: ATSB
When seated in the normal position, the flight crew of a Boeing 737-800 cannot see the ground that is less than 11.5 m ahead of the aircraft’s nose (due to the obstruction of the flight deck glareshield). Consequently, the VH-XZM flight crew’s last opportunity to see the stop bar on taxiway J2 was at 1442:00, about 5 seconds after completing the turn onto the taxiway and 1 second prior to crossing the stop bar (Figure 9).
Figure 9: Last point when stop bar was visible from flight deck of VH-XZM
Source: Google Earth, modified by ATSB.
The AIP required flight crew to stop and hold their aircraft at all illuminated stop bars. Flight crew could only proceed to taxi an aircraft further once an ATC clearance to enter or cross a runway had been received and the stop bar lights had been switched off.
Stop bars were implemented at Perth on 30 March 2018. At the time of the occurrence (28 April 2018), all stop bars were reported to be operating correctly.
Other taxiways
In terms of the other taxiways off runway 03 (see Figure 2):
Most taxiways intersected at 90° with a curve radius of about 100 m.
Taxiway D intersected at 80° with a curve radius of about 60 m.
Taxiways P intersected at 45° with a turn radius of 100 m, with 318 m between the edge of runway 03 and the next (taxiway) holding point.
Taxiway N intersected at 45° with a turn radius of 100 m. In addition to taxiway J2, it was the only taxiway at Perth with a single holding point and a relatively short distance between the two runways. It led to a somewhat complicated four-way intersection. Two of the taxiways crossed runway 06/24 and shared a single holding point from taxiway N, set back about 120 m from the runway 06/24 flight strip. Both required a turn after the holding point to cross the other runway. The distance between the edge of runway 03 and the runway 06/24 holding point was about 350 m (with the first 280 m being a straight line).
Flight data analysed by Qantas indicated that the average exit speed of Qantas aircraft onto taxiway J2 over a 2-year period was 28 kt, compared with the average exit speed of 17 kt onto the tighter, near-right angle exit at taxiway D. The exit speed of VH-XZM was about 35 kt, and about 20 per cent of the landings over the 2-year period had an exit speed of 35 kt or higher (and about 5 per cent having an exit speed of over 40 kt).
Qantas reported that the distance between the runway 03 exit and the holding point for runway 06 on J2 at Perth was much shorter than any other runway exit taxiway leading directly to another runway on its 737 route network. The next shortest was about 397 m at Sydney Airport (for taxiway A2 off runway 34L that led to runway 25).
Rapid exit taxiway information
Requirements for rapid exit taxiways
As noted in The occurrence, the captain of VH-XZM thought that, when approaching taxiway J2 during the landing roll, the taxiway was a rapid exit taxiway (RET). Accordingly, the ATSB considered the design requirements for RETs.
The MOS defined a rapid exit taxiway (RET) as:
A taxiway connected to a runway at an acute angle, designed and intended to allow landing aeroplanes to turn off the runway at higher speeds than are achieved on exit taxiways, thereby minimizing runway occupancy times.
It additionally noted:
The provision of rapid exit taxiways is a financial decision for the aerodrome operator. The aerodrome operator should seek specialist advice on the geometric design of rapid exit taxiways.
The International Civil Aviation Organization (ICAO) specified standards and recommended practices (SARPs) for international aviation operations in a series of Annexes. ICAO Annex 14 (Aerodromes, Volume 1 AerodromeDesignandOperations) defined a taxiway as:
A defined path on a land aerodrome established for the taxiing of aircraft and intended to provide a link between one part of the aerodrome and another, including:
…c) Rapid exit taxiway. A taxiway connected to a runway at an acute angle and designed to allow landing aeroplanes to turn off at higher speeds than are achieved on other exit taxiways thereby minimizing runway occupancy times.
Annex 14 recommended that a RET should be designed with a curve radius of at least 550 m for certain types of runway (including those in Perth) to enable 93 km/h (50 kt) taxi under wet conditions. It also recommended that a RET should have a straight distance after the turn-off curve sufficient for an exiting aircraft to come to a full stop clear of any intersecting runway. There was no guidance regarding appropriate taxiway lengths, turn angles or curve radii.
ICAO also published other guidance about aerodrome taxiways. ICAO document 9157 (Aerodrome Design Manual Part 2 Taxiways, Aprons and Holding Bays) stated that the intersection angle of a RET with the runway should not be greater than 45° and preferably be 30°.
Neither the CASA MOS nor ICAO's Annex 14 provided restrictions or recommendations on direct access from one runway to another without an intermediate, transitional taxiway. The European Organisation for the Safety of Air Navigation (EUROCONTROL) in its November 2017 version of the EuropeanActionPlanforthePreventionofRunwayIncursions, recommended:
A RET should meet with a parallel taxiway, and never end directly onto another active runway (that is used for take-off/landing).
Similarly, the United States Federal Aviation Administration (FAA) Advisory Circular 150/5300 stated:
Do not provide direct access from a high speed exit to another runway.
The Airports Council International RunwaySafetyHandbookFirstEdition 2014 identified key elements to eliminate runway incursions, including:
• Rapid Exit Taxiways should be designed in such a way that crossing another runway via a rapid exit taxiway is not possible. A rapid exit taxiway should never be used for entry to a runway; and
• Complicated Taxiway Layouts linking adjacent runways – such as multi-taxiway intersections, Y-shaped taxiways, taxiways crossing high speed exits and taxiways connecting to V-shaped runways – should be avoided in the design. If any of these are unavoidable, mitigation measures for runway incursion should be included in the design.
Rapid exit taxiway identification
At airports equipped with RETs, aerodrome charts provided flight crews with information such as RET location, maximum design exit speed and lighting systems, if fitted. This information was included in text in the airport efficiency procedures section rather than annotated on a map of the aerodrome.
ICAO Annex 14 recommended aerodrome operators install rapid exit taxiway indicator lights (RETILs). RETILs consisted of six yellow lights adjacent to the runway centreline and configured in a three/two/one pattern spaced 100 m apart; the single light was 100 m from the start of the turn for the RET.
The Australian AIP detailed differences between Australian national aviation legislation and those specified by ICAO as SARPs. With regard to RETILs, Australia notified ICAO of a difference to the SARPs under the level of ‘less protective, partially implemented or not implemented’. Accordingly, at the time of this occurrence, CASR Part 139 and the MOS did not require or recommend aerodrome operators to install RETILs.
Rapid exit taxiways in Australia
Taxiway J2 was not designated as a rapid exit taxiway (RET) and it did not meet the design requirements of CASA MOS or ICAO Annex 14 for a RET. There were no RETs at Perth.
RETs were provided at several other airports in Australia, including Brisbane, Melbourne and Sydney. None of these RETS had RETILs.
Runway incursion hot spots
Recommended practices for identification of hot spots on aerodrome charts
ICAO defined a runway incursion as ‘any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft’.
ICAO document 9870 (ManualonthePreventionofRunwayIncursions) defined a hot spot as:
A location on an aerodrome movement area with a history or potential risk of collision or runway incursion, and where heightened attention by pilots/drivers is necessary.
The document stated that, once hot spots have been identified, suitable strategies should be implemented to either remove the hazard or to manage and mitigate the risk to be as low as reasonably practicable.
ICAO recommended that the local generation of AIP aerodrome charts show runway hot spots (see for example Figure 2). The criteria used to establish a hot spot on an aerodrome chart and the symbols to be used were contained in ICAO Annex 4 (Aeronautical charts), with more guidance provided in Annex 14 and document 9870.
Aerodrome charts for Perth
Aerodrome charts were published by Airservices Australia in the AIP. Jeppesen charts, used by Qantas, provided details similar to the AIP about the airport and taxiway layout and associated information, such as warnings and runway incursion hot spots.
Jeppesen charts identified the location of hot spots and marked the area of risk with a magenta box in accordance with the ICAO recommendation. Text on the aerodrome chart stated ‘HS2 – Caution Runway Incursion Hot Spot’. No text or specific information was provided to explain the risk and reasons why previous runway incursions had occurred at those locations (in either the Airservices Australia or the Jeppesen charts).
Study of aerodrome chart effectiveness
In 2016, EUROCONTROL published a safety study report that examined how AIP hot spot information was transposed to commercially-produced aerodrome charts and promoted practices to help improve the accessibility, visibility and quality of the information. The study collected samples of AIP and commercial aerodrome diagrams for 64 European airports and a small number of samples from Australia, China and the United States for comparison purposes. It stated:
Of those airports that did have Hot Spot information on their AIP charts, only 39% were judged to be effective or very effective. Effectiveness, in this case, being a combination of presentational clarity and usefulness of the information. However 45% of airport AIP charts were judged to be of no or low effectiveness.
The Australian samples included Adelaide, Darwin, Sydney and Perth. The report judged all of these AIP charts to be of low effectiveness, stating:
The expanded graphic of the runway incursion Hot Spots are useful, but there is no text to enhance the pilot’s understanding other than to use caution. Since it is not unreasonable to assume that pilots do exercise caution when taxying, the effectiveness of the Hot Spot information is low.
The report noted that in many countries, including Australia, there was variation in the manner in which hot spot information was presented at different airports.
The report also noted the following presentation styles that ‘seemed to provide clarity and effectiveness’ of hot spot information to flight crew:
• Each Hot Spot depicted by a clear bright red circle and joined to a red label box e.g. HS1
• Large tabulated textual information elaborating the action required of pilots in and around the Hot Spot. This may be on the main aerodrome diagram or on the obverse page if clarity is best served.
• The use of additional graphical boxes depicting the Hot Spots in greater detail. These additional boxes should be physically linked by lines or arrows to the Hot spot on the main diagram, if possible.
• Where the aerodrome diagram would otherwise be too cluttered to present Hot Spots effectively, the use of specific Hot Spot pages can be effective.
• The use of a colour-coded format which assists the depiction of runways, Hot Spot areas and normal taxiways.
In 2017, the FAA issued Safety Alert for Operators 17012 (High collision risk during runway crossing) that warned pilots of high-risk runway incursions and potential collisions in the first two-thirds of an active runway (with many such events occurring in the first third of the active runway). At Perth, the junction between taxiway J2 and runway 06 was within the first third of runway 06.
Runway incursions at Perth Airport
Airservices Australia recorded 44 runway incursions at Perth Airport between July 2015 and the day of the occurrence (Table 2). That equated to a rate of 11.6 incursions per 100,000 movements – higher than other major airports in Australia, including Sydney (2.0) and Melbourne (0.3).
Table 2: ICAO classification of the severity of runway incursions at Perth Airport, 1 July 2015 to 28 April 2018
ICAO severity classification
ICAO severitydescription
Numberof runwayincursions atPerth
Numberof runwayincursions ontaxiwayJ2 atPerth
A
A serious incident in which a collision is narrowly avoided.
0
0
B
An incident in which separation decreases and there is significant potential for collision, which may result in a time-critical corrective/evasive response to avoid a collision.
1[a]
1[a]
C
An incident characterized by ample time and/or distance to avoid a collision.
10
4
D
An incident that meets the definition of runway incursion, such as the incorrect presence of a single vehicle, person, or aircraft on the protected area of a surface designated for the landing and takeoff of aircraft but with no immediate safety consequences.
31
10
E
Insufficient information or inconclusive or conflicting evidence precludes a severity assessment.
2
1
[a] Including the investigation occurrence.
Source: Airservices Australia
Of the 44 incursions, 16 involved taxiway J2 on both runway 03/21 and runway 06/24. For that reason, the taxiway intersection of J2, J1 and A with runway 06/24 was marked as a runway incursion hot spot on aerodrome charts.
The ATSB’s occurrence database recorded 52 runway incursions at Perth involving turbine-engined aircraft (not under tow) over a 5-year period up to and including the 28 April 2018 occurrence. Exposure data was not available. Of these 52 incursions, the following types of incursion were excluded:
14 incursions that involved apparent ATC clearance errors (mostly not turning off stop bars after clearance was issued)
5 incursions involving a closed runway
2 incursions due to aircraft not departing the runway fully after landing.
Of the remaining 31 incursions, there were:
14 incursions on the cross runway via a taxiway immediately after landing (similar to the 28 April 2018 occurrence)
9 incursions that involved aircraft turning onto the cross runway instead of a taxiway
8 other incursions (general taxiing incursions).
Figure 10 shows the approximate location of incursions in these three groups, with most of the incursions on a cross runway via a taxiway happening near taxiway J2.
Figure 10: Selected types of runway incursion at Perth in a 5-year period
Source: Airservices, annotated by ATSB
Runway safety activities
ICAO have recognised runway safety as one of its highest priorities given it is currently one of the most significant threats to global aviation safety. In response, in 2011 the ICAO Runway Safety Programme (RSP) promoted the establishment of runway safety teams (RSTs) at airports as an effective means to reduce runway related accidents and serious incidents.
As part of Australia’s State Safety Programme, a National Runway Safety Group (NRSG) was established to perform a national advisory and coordination role, and promote the establishment and effectiveness of local runway safety teams (LRSTs). It utilised intelligence from these forums and other sources to develop and implement national strategies to improve runway safety and reduce runway related accidents and incidents.
An LRST consisted of local representatives addressing local runway safety issues. The purpose of an LRST was to identify current and potentially emerging issues related to runway safety and implement initiatives to assure the continuing safety of operations at their aerodrome.
Perth Airport had an LRST which met biannually and included the aerodrome operator, Airservices Australia, airline operators and other stakeholders operating at the airport.
Air traffic control information
Air traffic control at Perth Airport
Airservices Australia provided a 24-hour air traffic service at Perth Airport. The controllers responsible for all aircraft and vehicle movements on taxiways, runways and in the immediate vicinity of the airport were located in a tower on the eastern side of runway 03/21 (Figure 2).
The distance from the tower to the runway 06/24 holding point on taxiway J2 was about 1,200 m, and from the tower to the runway 06 threshold was about 3,000 m.
At the time of the occurrence the airport traffic flow was operating in a North flow. This permitted the most efficiency and therefore achieved the most operating capacity at Perth. A North flow traffic pattern had departures from both runway 03 and 06 and arrivals on runway 03.
Runway crossing procedures
The Australian AIP provided flight crew of domestic aircraft with procedures to follow when taxiing after landing. It stated:
2.16.2 After landing, unless specified otherwise by ATC, an aircraft must comply with the following:
a. Promptly vacate the runway without backtracking.
b. Change from the aerodrome frequency to the SMC frequency (where established) when vacating the runway strip and obtain an ATC taxi instruction.
c. Not cross any runway that intersects the taxi route unless in receipt of a taxi instruction and a “CROSS RUNWAY (number)” instruction from ATC…
The ICAO Manual on the Prevention of Runway Incursions outlined best practice for radio transmission guidelines and techniques. It stated:
Communication with any aircraft using the runway for the purpose of taxiing should be transferred from the ground controller to the aerodrome controller prior to the aircraft entering/crossing a runway.
The requirement for domestic aircraft to automatically[15] transfer to the SMC frequency when vacating the runway strip had been in place since prior to 2003. In June 2010 Airservices Australia commenced a trial of aircraft and vehicles being on the ADC frequency when crossing runways in line with the ICAO recommendation. The trial was conducted at Sydney, Cairns, Brisbane, Coolangatta, Perth, Adelaide and Broome.[16]
A post implementation review found no evidence that the trial procedures reduced the risk associated with runway incursions. It also identified a number of safety issues and concerns, including the reduction in ADC and SMC situational awareness at airports where crossing of active runways was required (including crossing runway configurations such as at Perth). Airlines involved in the trial agreed at that time that the trial should be ceased. Consequently, Airservices Australia returned the procedures to the pre-trial requirements of the AIP (as stated above).
Qantas advised that the ICAO-recommended approach to runway crossings, with the crossing aircraft on the ADC frequency, was used overseas in countries such as the United Kingdom and the United States. The ATSB identified that other countries such as New Zealand used a similar approach to that specified in the Australian AIP, with aircraft required to automatically transfer to the SMC frequency after landing.
Integrated tower automation suite
Tower controllers were responsible for separating aircraft visually but used a range of systems at their workstations to assist with performing that task. Each station in Perth tower was fitted with the integrated tower automation suite (INTAS), which included the advanced surface movement guidance and control system (A-SMGCS).
The INTAS provided controllers with electronic flight and operational information to enhance airport efficiency. The system combined flight and operational data, surveillance and voice communications into a single integrated, control tower-specific layout. Controller workstations were equipped with four customisable touch screens that displayed electronic flight strips, operational information, weather, terminal area radar displays, and, where available, surface surveillance data through the A-SMGCS.
The A-SMGCS provided automatic identification of all aircraft and transponder-equipped vehicles at Perth Airport. Using the collection of that surveillance data from multiple sources, the system provided controllers with an electronic picture of what was happening on the ground at any time. Additionally, the system added to a controller’s situational awareness by predicting potential conflicts between vehicles and aircraft, and multiple aircraft movements, before they could occur. Those protections included runway incursions by aircraft or vehicles. Visual and aural alarms alerted controllers to potential problems, enabling them to take early corrective action.
During the implementation of INTAS in the Perth tower, the system was configured with associated alert settings assigned to each controller’s position. The selection of a role (including combined position roles) by the tower shift manager automatically triggered the associated system alert settings that were assigned to each role in the INTAS adaptation settings.
At the time of the occurrence, due to the configuration of the Perth tower INTAS, when an SMC was operating the combined workstation roles of SMC, airways clearance delivery (ACD) and shift manager, the A‑SMGCS alerts were off. This inhibited the SMC from receiving an aural and visual stop bar violation alert (and runway occupied alert) at their workstation.
Emergency response actions
The Australian ManualofAir Traffic Standards (MATS) defined a safety alert as:
The provision of advice to an aircraft when an ATS Officer becomes aware that an aircraft is in a position which is considered to place it in unsafe proximity to terrain, obstructions or another aircraft.
The manual also stated:
Unless the pilot has advised that action is being taken to resolve the situation or that the other aircraft is in sight, issue a Safety Alert prefixed by the phrase ‘SAFETY ALERT’ when you become aware that an aircraft is in a situation that places it in unsafe proximity to:
a) terrain; b) obstruction; c) active restricted or prohibited areas; or d) other aircraft.
In addition, the manual stated:
Do not assume that because another Controller has responsibility for an aircraft that an unsafe situation has been observed and a Safety Alert or avoidance advice has been issue.
The MATS procedures for aerodrome controllers stated that, for cancelling a take-off clearance:
Only cancel a take-off clearance once an aircraft has commenced take-off roll in circumstances where an aircraft is in imminent danger e.g. ‘STOP IMMEDIATELY (repeat aircraft callsign) STOP IMMEDIATELY (reason)’. Accompany any instruction to cancel take-off with a description of the nature of the emergency.
Compromised separation recovery training
Separation between aircraft is considered to be compromised when separation standards have been infringed, or where separation assurance is absent to the extent that a breakdown of separation is imminent.
In order to help ensure controllers provided effective response actions when separation is compromised, they undertook compromised separation recovery (CRT) training. The ATSB has previously noted limitations with the provision of such training by Airservices Australia and the Department of Defence to their controllers in several investigation reports. In 2014 and in 2016, Airservices undertook a series of actions to improve its CRT training.[17]
The ATS Training Operations Manual stated in 2014:
Compromised separation recovery training must be included in all ATC endorsement training courses, and in particular, skills-based training in the simulator. The training must be assessed for competency…
EGM [Executive General Manager] ATC has determined that all operational staff must successfully complete annual training and assessment in compromised separation recovery training. It is a mandatory requirement that all controllers are assessed in skills-based simulator Compromised Separation Recovery training at intervals not exceeding three years.
In September 2020, Airservices Australia confirmed that, since 2012, all endorsed controllers were required to complete the knowledge-based component of compromised separation recovery training as part of the annual refresher training program. It also advised:
The skills-based component [of CRT training] only applies to tower controllers that hold the ADC endorsement. Given the role and responsibilities of a surface movement controller this continues to be appropriate. Separation on the manoeuvring area is a joint pilot controller responsibility and there are no defined separation standards.
The skills based compromised separation training scenarios do not align with the responsibilities of an SMC. All SMC endorsed controllers are trained and assessed at recognising ground conflicts and taking action as required commensurate with the risk of the situation using standard phraseology and taking into consideration aspects of the local operational context. The records of such training is maintained in individual training files.
In addition, all controllers that complete a tower course do destination specific CSR exercises as a part of the aerodrome control course element.
… all SMC endorsed controllers are trained and assessed at recognising ground conflicts and taking action as required commensurate with the risk of the situation using standard phraseology, as such no further rationale is required.
As noted in Air traffic controllers, both of the controllers involved in the 28 April 2018 occurrence sequence held an ADC endorsement, and therefore had undertaken skills-based as well as knowledge-based CRT training. The ADC reported the most recent training included a stop bar violation and runway incursion at Perth.
After landing on runway 03, VH-XZM vacated onto taxiway J2 and crossed the runway 06 holding point, with an illuminated stop bar, without an air traffic control (ATC) clearance. The aircraft continued to taxi toward runway 06. The aerodrome controller (ADC) received aural and visual alerts and instructed the crew of another aircraft (VH-VZL) taking off from runway 06 to stop immediately. The flight crew of the departing aircraft rejected their take-off, preventing further escalation of the occurrence.
This analysis will firstly discuss flight crew situational awareness, mental models and approach briefings associated with VH-XZM’s incursion onto runway 06. It will then discuss the design characteristics of taxiway J2 that increased the risk of incursion into runway 06/24. Finally, it will discuss a range of other safety factors identified during the investigation.
Flight crew situational awareness and mental model
The captain’s mental model of the expected taxi route from landing on runway 03 to the parking bay was incorrect. Instead of having to cross runway 06 on taxiway J2, the captain expected to be on a taxiway that connected straight to the apron and did not have cross the other active runway.
This incorrect mental model developed due to a combination of factors:
The captain’s prior experiences landing at Perth had not used taxiway J2, instead generally landing on runway 03 and vacating at taxiway D or, more commonly, landing on runway 24 and vacating at taxiway J1. Both of these taxiways led directly onto the apron area with no runway crossing.
The captain’s intention on this occasion was to use taxiway D, expecting they would be using taxiway D up until after they landed on runway 03.
When taxiways were discussed during the approach briefing, the captain was referring to the apron chart rather than the full aerodrome chart, and this smaller chart did not include runway 03 or the full length of taxiway J2. When the first officer (FO) briefed that taxiway J2 needed to cross runway 06, the captain believed the FO was referring to crossing runway 06 while still on runway 03 and did not discuss this different (and incorrect) understanding with the FO.
The approach briefing did not include a discussion of the airport’s known hot spots, including the hot spot associated with taxiway J2 (see also Approach briefing).
After landing, the captain realised that the request for taxiway D had not been made and quickly re-planned an exit onto taxiway J2, although continuing to have the same expectation that they not need to cross an active runway to reach the apron.
The runway holding point markings and warning lights would normally provide enough cues that an aircraft was approaching a runway holding point. In this case these cues were also supplemented by the very salient illuminated stop bar. However, although the captain saw the stop bar, it was not identified as a problem and no revision was made to the mental model of the taxiways, instead rationalising in a time-compressed situation that the stop bar had been installed incorrectly.
This behaviour is consistent with confirmation bias, or the tendency for people to seek information that confirms their hypotheses, interpret ambiguous evidence as supporting their hypotheses, and either discount or not seek information that contradicts their hypotheses (Wickens and others 2013). Confirmation bias is an inherent aspect of human decision-making and has been demonstrated to occur in a wide range of contexts.
Workload and distraction
High workload and time pressure lead to a reduction in the number of information sources a person will search, and the frequency or amount of time these sources are checked (Staal 2004). They also result in people conducting tasks with simpler strategies, relying on responses or strategies with which they are familiar, and persevering with a response or strategy even when it has proven to be unsuccessful (Staal 2004, Wickens and others 2013). In addition, people are likely to miss important cues and experience difficulty integrating disparate pieces of information and making sense of them (Burian and others 2005). Associated with the reduced search of information sources and increased perseverance, the influence of confirmation bias will be enhanced (Wickens and others 2013).
The flight crew’s overall workload during the approach and landing was not abnormally high. However, workload and distraction at key points in time combined together to result in a situation where the problem with the captain’s mental model was not detected and corrected.
During the approach phase, the captain's workload as pilot monitoring was increased due to the FO’s low level of experience and air traffic control's (ATC’s) request for a high-speed descent. This workload contributed to an omission of routine secondary tasks prior to landing, such as requesting a taxiway D exit from the tower and pre-setting the surface movement control (SMC) frequency in the radio’s standby frequency position.
These omissions were examples of prospective memory errors. Prospective memory relates to an intention to perform an action at a later time, and a delay between forming the intention and acting on it. It is known to be vulnerable to failure and has been associated with many aviation accidents and incidents (Dismukes 2006). Conditions that increase this vulnerability include the delay between the intention to do a task and the execution of the task being filled with other activities, an interruption to a task sequence, and the cues or prompts to retrieve the intention from memory not being explicit. Neither of these tasks was associated with a specific checklist item (and by themselves were not important enough to be checklist items), and their omission was not detected until after landing.
After landing, when the captain realised the omission in not requesting taxiway D, the normal workload associated with landing was increased, associated with replanning the exit onto taxiway J2 while taking over control of the aircraft.
During the taxi phase, there was less time than would normally be the case to detect the problem. As the aircraft was crossing the runway edge, the runway 06 holding point was only about 176 m away. The captain’s delayed realisation that they needed to exit on taxiway J2, and misidentification of taxiway J2 as a rapid exit taxiway (RET), meant the aircraft entered J2 at a higher groundspeed than usual. The relatively high exit speed and relatively short distance to the runway 06 holding point meant that the flight crew only had limited time after leaving runway 03 to identify the problem before reaching the holding point.
During this period, a series of distractions occurred. More specifically:
After vacating runway 03, the FO focussed attention inside the flight deck for a period of time to select the SMC frequency, instead of performing the more safety critical task of monitoring the aircraft's taxi path as it approached a known runway incursion hot spot. The FO assumed the captain would be stopping at the holding point and, focused on changing frequency and contacting the SMC, did not see that they had passed the holding point until about the time the captain was braking to stop.
When approaching the holding point, the captain briefly went heads down to gain an understanding for the delay in changing to the SMC frequency and then advised the FO of the applicable SMC frequency. This reduced the time available to notice and comprehend the holding point signs, warning lights and stop bar lights ahead.
After passing the holding point, the presence of runway 06 ahead still provided an indication of a potential problem. However, the captain was distracted by the presence of another aircraft on the apron. This focused attention on the distant apron area and reduced the ability to visually identify the runway immediately in front of the aircraft. The FO was still primarily focused inside the flight deck during this period.
Approach briefing and approach briefing guidance
The approach briefing was the best opportunity for the flight crew to have established a shared and correct understanding of the requirements for the remainder of the flight, including the taxiway options. However, as already noted, they did not specifically discuss the taxiway J2 hot spot during the approach briefing, even though the FO had identified it on the aerodrome chart. Had the topic of the hot spot been raised and discussed in the briefing, as well as the main reason why it was a hot spot (that it led to another runway), the captain’s mental model of the taxiway J1/J2 layout would probably have been enhanced.
The International Civil Aviation Organization (ICAO) has emphasised that flight crews should prepare well in advance for departure and arrival at any airport, including reviewing hot spots before taxiing from the gate and prior to beginning descent. Accordingly, departure and approach briefings should contain a complete review of not just the expected taxi routes but potential routes as well, with special attention to any hot spots.
Qantas provided detailed guidance to flight crews on the content of approach briefings. Hot spots should have been considered a threat under the threat and error management section of the briefing guidance. However, since that briefing guidance contained no specific requirement to brief hot spots or runway incursion threats, it is likely that the presence of hot spots on a taxi route would not always be noted by a flight crew.
Although the aerodrome chart for Perth identified that the area around taxiway J2 was a runway incursion hot spot, it did not provide specific information about the nature of the threat or why it was a hot spot. Such information would better enable flight crews to understand how the hot spot may affect them. If flight crews are to effectively identify and plan mitigating actions to avoid runway incursions, they should be provided with detailed information to assist their understanding of the common reasons why previous flight crews have incurred a runway at particular locations.
Taxiway location and design
Airservices Australia data identified that the rate of runway incursions at Perth Airport was significantly higher than other major airports across Australia. A significant proportion of the Perth incursions occurred on taxiway J2 and, accordingly, it was designated as a hot spot. To assist with minimising the risk of incursions, stop bars and CASA approved runway identifier markings (in addition to other holding point markings and lights) had recently been introduced.
In addition to providing salient or conspicuous markings and cues about the position of a holding point, it is also important to ensure flight crews are provided sufficient time during a high workload period after landing to identify and comprehend runway holding point visual cues and to allow for ATC to intervene, if required, before an aircraft incurs a runway.
Taxiway J2 was not a rapid exit taxiway (RET), but it had some similar qualities: a relatively shallow intersection angle and a relatively wide curve radius. These characteristics led some pilots to use higher speeds when exiting runway 03. Although the intersection angle was not acute enough to actually be a RET, the angle would be difficult to judge while approaching it from the runway.
Flight data showed VH-XZM entered taxiway J2 at about 35 kt, which was slightly higher than the taxiway design limit of 31 kt. Flight data analysis of other flights provided by Qantas showed its aircraft commonly vacated runway 03 onto taxiway J2 at a relatively high speed.
In addition, taxiway J2 had a relatively short distance from the exit from runway 03 to the runway 06 holding point. This meant that flight crews had less time to see the holding point markings and an illuminated stop bar, especially if taxiing at higher speeds.
Taxiway J2 also led to a relatively complicated runway crossing point, with other taxiways intersecting at the same point. A complicated intersection can be difficult for crews to navigate and can draw their attention.
Overall, the location and design of taxiway J2 significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. In particular, the following features made taxiway J2 problematic:
a relatively shallow intersection angle from runway 03
a wider than usual entry curve radius
a relatively short distance from the turn to the runway 06 holding point
the next intersection leading directly to a runway rather than a parallel taxiway
the next intersection being relatively complicated
the intersection adjoining the first two-thirds of runway 06.
In addition, the risk associated with taxiway J2, and runway incursions was exacerbated by it being made the preferred exit for landing off runway 03. Although many flight crews elected to use taxiway D instead, this required the crew to proactively make that request.
The introduction of stop bars in March 2018 would certainly have reduced the risk but, depending on the situation, not eliminated the risk. Although the exact sequence of events associated with this particular occurrence would have been difficult to predict beforehand, there was undoubtedly an increased risk of runway incursions that needed to be managed, and a range of scenarios that could have resulted in a high-risk runway incursion given the inherent limitations of the taxiway J2 location and design.
As previously noted, taxiway J2 had some features that would have made it appear similar to a RET. Flight crews would normally become aware of the existence of a RET from tables of information about an airport in the aerodrome charts. However, a flight crew may forget or may not brief the existence or absence of a RET among the potential taxiways that could be used. At the time of the occurrence there was no requirement in Australia for airports to use indicator lights at RETs to distinguish them from other taxiways, so there was no immediate way to identify a taxiway as a RET or otherwise during the landing. However, unless all RETs were equipped with the appropriate indicator lights, the absence of indicator lights at a particular taxiway may not be that effective as a cue. Overall, unless briefed otherwise, it would be generally safer for a flight crew to assume that a taxiway was not a RET and adjust the aircraft’s speed appropriately.
Air traffic control response
The ADC became aware of the problem on receipt of the first integrated tower automation suite (INTAS) alert. The ADC considered that, as VH-XZM had vacated and was clear of runway 03, the flight crew would most likely have changed over to the SMC frequency and therefore would have been unable to hear any safety alert instructions on the ADC frequency. Instead, an instruction was issued to VH-VZL to stop immediately.
A research study showed that the average time for tower controllers to act in response to a system alert was 4.6 seconds with a mean response duration of 2.3 seconds, with maximum response times being 8.1 seconds and 5.3 seconds respectively (Sanchez and others 2009). In this occurrence, the ADC transmitted the stop immediately instruction to the flight crew of VH-VZL about 7 seconds after the first alert, a time which included a period of blocked frequency from another aircraft transmitting.
The ADC’s action was effective in mitigating the consequence of the runway incursion. The ‘stop immediately’ instruction was simple and easily comprehended by the captain of VH-VZL, who was actively monitoring the developing situation and responded promptly to the ADC’s instruction.
However, although VH-VZL’s flight crew received a timely and clear instruction from ATC, VH‑XZM’s flight crew did not receive any communication from ATC during the period after the first INTAS alert (1442:04) until 1442:26, when the SMC asked the flight crew if they were on the SMC frequency. This was after the captain had commenced braking (1442:19), and 10 seconds after the FO made initial contact with the SMC (when the FO was unaware of the problem).
The exact reasons why the SMC did not issue an alert and instruction to the flight crew of VH‑XZM are unclear. In response to the first INTAS alert, the SMC was aware of the developing problem. However, at that stage there may have been some doubt regarding whether the flight crew had switched over to the SMC frequency. In addition, the SMC was in the progress of providing a pushback clearance to another aircraft. The SMC had received training in issuing stop instructions as well as compromised separation recovery training.
The second INTAS alert at 1442:16 was broadcast on the ADC workstation’s speaker at the same time as the VH-XZM FO’s first transmission on the SMC frequency, to which the SMC did not reply. The SMC may have focussed on the more relevant event—the second INTAS alert—at this time and as a result did not process VH-XZM’s transmission. Nevertheless, even after hearing the ADC provide the other aircraft with a stop instruction (1442:11), a prompt instruction to VH-XZM was warranted to further minimise any potential collision risk. A stop immediately instruction over any frequency that the flight crew might be using would have led to a more rapid response from that flight crew.
Although not directly related to this occurrence, the investigation identified some limitations with ATC processes that increased the potential risk of other occurrences:
Due to the way INTAS was configured at Perth, the SMC’s workstation did not directly receive INTAS alerts if the SMC position was combined with other positions. This meant that an SMC may not have received a salient warning that an aircraft under their control was at risk of collision. In this case, the SMC’s awareness of the runway incursion was raised as a result of the INTAS aural alert played through a speaker on the ADC’s workstation, but in other situations an SMC may not identify such an alert.
Communication practices for runway crossings at Australian airports differed from those recommended by ICAO and used in some countries overseas. According to ICAO, runway crossings should be managed by the ADC, which ensured that flight crews of aircraft crossing a runway were aware of any instructions being issued to aircraft using that runway. In Australia (and some other countries), runway crossings were handled by the SMC and not the ADC. Having two aircraft on a runway at the same time but not requiring them to be on the same frequency does create the potential for flight crews not to be aware of the presence of the other aircraft at a critical point in time. However, Airservices Australia reported that it trialled a version of the ICAO-recommended approach and determined it did not reduce the risk of runway incursions and instead it introduced new safety issues and concerns in the Australian environment, including a potential reduction in controller situational awareness.
Depending on how it was implemented, the ICAO-based approach could have required a flight crew to transfer to the SMC frequency, before the SMC then transferred them back to the ADC frequency prior to crossing the runway, which would have increased the complexity of communications at a location such as Perth Airport for aircraft landing on runway 03 and exiting on taxiway J2. One option that could have assisted with managing the unique problems associated with taxiway J2 was for the ADC to require flight crews landing on runway 03 and vacating on taxiway J2 to remain on the ADC frequency until after they crossed runway 06. However, introducing a unique approach to managing radio frequencies at one specific location in Australia could also increase risk. Alternatively, local procedures could have included advising a flight crew landing on runway 03 and exiting at taxiway J2 of the crossing runway hazard ahead.
Findings
From the evidence available, the following findings are made with respect to the runway incursion involving a Boeing 737, registered VH-XZM, which resulted in a rejected take-off involving a Boeing 737, registered VH-VZL, at Perth Airport, Western Australia on 28 April 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safetyissues, orsystemproblems, arehighlightedinboldtoemphasisetheirimportance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The captain developed an incorrect mental model of the exit taxiways off runway 03, believing the aircraft would not have to cross runway 06 after exiting on either of the potential taxiways (J2 or D). As a result, the captain did not expect to cross a runway holding point or stop bar and, upon seeing the stop bar was illuminated, incorrectly thought that it must only apply to aircraft coming from the other direction.
During the approach phase, the captain's workload as pilot monitoring was increased due to the first officer's low level of experience and air traffic control's request for a high-speed descent. This workload contributed to the omission of routine secondary tasks, such as requesting a taxiway D exit from the tower and pre-setting the surface movement control frequency.
After vacating runway 03, the first officer focused inside the flight deck for a period of time to select the surface movement control frequency, instead of performing the more safety critical task of monitoring the aircraft's taxi path as it approached a known runway incursion hot spot.
When approaching the holding point for runway 06, the captain briefly focused inside the flight deck to gain an understanding for the delay in changing to the next frequency. This reduced the time available to notice the holding point signs and lights ahead.
The captain taxied passed the runway 06 holding point (with an illuminated stop bar) without an air traffic control clearance.
After taxiing passed the illuminated stop bar, the captain was distracted by the presence of another aircraft on the apron. This focused the captain’s attention on the distant apron area, reducing the likelihood of visually identifying the runway immediately in front of the aircraft.
During the approach briefing, the flight crew discussed taxiway J2 and taxiway D, but the flight crew did not discuss the potential threat of the hot spot associated with taxiway J2.
Although some aerodrome navigational charts in Australia had identified hot spot locations, they generally provided limited explanatory information to enhance flight crew understanding or awareness of why the hot spot was there and what actions they could take to mitigate the associated risk.
The location and design of taxiway J2 at Perth Airport significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. Taxiway J2 was published as the preferred exit taxiway for jet aircraft and, although mitigation controls were in place, they were not sufficient to effectively reduce the risk of a runway incursion. [Safety issue]
Although the flight crew of VH-VZL taking off on runway 06 were provided with an instruction to stop immediately to reject their take-off, no safety alert or instruction was provided to the flight crew of VH-XZM during the period between when the controllers received a stop bar violation alert (1442:04) and the captain applied the brakes at 1442:19.
Other factors that increased risk
Airservices Australia’s configuration of the integrated tower automation suite (INTAS) at Perth Airport had resulted in a situation where controllers performing some combined roles had the INTAS aural and visual alerts inhibited at their workstation. As a result, controllers performing such combined roles would not receive a stop bar violation alert or runway incursion alert at their workstation. [Safety issue]
Other findings
The stop bar alert and the aerodrome controller’s high level of situational awareness led to a timely instruction to the flight crew of VH-VZL to stop immediately.
The high level of situational awareness of the VH-VZL flight crew significantly aided their immediate action to reject their take-off on runway 06 following the controller’s instruction.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties are provided with a draft report and invited to provide submissions. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Operator guidance for flight crew briefing of aerodrome hot spots
Safety issue description: Although Qantas provided detailed guidance to flight crews about the content of departure and approach briefings, it did not specifically require aerodrome hot spots to be briefed.
Location and design of taxiway J2 at Perth Airport
Safety issue description: The location and design of taxiway J2 at Perth Airport significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. Taxiway J2 was published as the preferred exit taxiway for jet aircraft and, although mitigation controls were in place, they were not sufficient to effectively reduce the risk of a runway incursion.
Inhibition of safety alerts for combined air traffic control roles
Safety issue description: Airservices Australia’s configuration of the integrated tower automation suite (INTAS) at Perth Airport had resulted in a situation where controllers performing some combined roles had the INTAS aural and visual alerts inhibited at their workstation. As a result, controllers performing such combined roles would not receive a stop bar violation alert or runway incursion alert at their workstation.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Qantas Airways advised that on 17 September 2019, following a runway incursion subsequent to this occurrence, it published a safety information notice to all pilots, which contained information about failure to comply with taxi clearances and details of the recent runway incursion occurrence. It also contained safety educational information related to influencing factors, mitigation techniques and strategies to avoid non-compliance with air traffic control ground clearances.
Airservices Australia and Qantas Airways advised they were in discussions to ascertain if there was merit in the conduct of a new trial of the ICAO-recommended approach to runway crossings, with the crossing aircraft on the ADC frequency,
The Civil Aviation Safety Authority (CASA) advised that in September 2019, CASR Part 139 (Aerodromes) Manual of Standards introduced guidance for rapid exit taxiway indicator lights (RETILs). The guidance stated ‘RETIL may be provided on a runway intended for use in RVR conditions less than 350 m or where the traffic density is heavy’. CASA advised the ‘optional’ application of subsection 9.89 (1) was consistent with ICAO SARPs (see Annex 14 volume I para 5.3.15.1), which set the application of RETIL as a Recommendation.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew of VH-XZM
the captain of VH-VZL
the aerodrome controller
the surface movement controller
flight data recordings from VH-XZM and VH-VZL
closed-circuit television recordings
Qantas Airways Limited
Airservices Australia
Perth Airport Pty Ltd.
References
Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.
Dismukes, K 2006. ‘Concurrent task management and prospective memory: pilot error as a model for the vulnerability of experts’. Proceedings of the Human Factors and Ergonomics Society 50th Annual Meeting, pp. 909–913.
Sanchez J, Smith EC & Chong RS 2009, Controller and Pilot Response Times to Runway Safety Alerts, MTR090237, The MITRE Corporation, McLean, VA.
Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.
Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew of VH-XZM, the captain of VH-VZL, Qantas Airways Limited, the aerodrome controller, the surface movement controller, Airservices Australia, Perth Airport and the Civil Aviation Safety Authority.
Submissions were received from the captain of VH-XZM, Qantas Airways Limited, the aerodrome controller, Airservices Australia, Perth Airport and the Civil Aviation Safety Authority. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 20–21 April 2018, Pacific National intermodal freight train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. A short time after commencing the downhill grade from Mount Lofty to Belair, South Australia, there was a structural failure in the underframe of platform 2 of wagon RRYY01X. Soon after, the shared bogie between platform 2 and 3 of the wagon derailed. The train continued down the grade until it separated (between platform 2 and platform 3), with both portions of the train coming to a stop near Glenalta.
What the ATSB found
The investigation found that a pre-existing structural crack in the underframe of platform 2 of wagon RRYY01X likely expanded due to in-train forces (compression and tension), causing the platform’s deck to bend and change the deck angle at the coupling to platform 3 (supported over a common bogie). As train 6MP4 negotiated a series of tight curves on the descending grade, the combination of wheel unloading (due to compressive forces and coupling angle on a light wagon) combined with increased lateral forces (due to compressive forces and a tight curve), resulted in flange climb (possibly complete wheel lift) and subsequent derailment.
The ATSB found that multiple train examinations and maintenance inspections did not identify the crack in platform 2 of wagon RRYY01X. In addition, Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of the cracks being detected.
Additionally, the ATSB found that the train separation at Glenalta did not activate the locomotives’ emergency braking systems, although this did not increase the risk associated with this accident.
What has been done as a result
Immediately following this accident, Pacific National issued a Rolling Stock Notice requiring immediate inspections of all RRYY class wagons for underframe cracking, with wagons exhibiting cracking around the underframe removed from service for repairs. Magnetic particle inspection or dye penetrant inspection of welded connections were also added to the scheduled preventative maintenance requirements.
Following the initial response, Pacific National undertook a fleet assessment of RRYY class wagons to ensure that they were safe to return to revenue service and developed a long-term repair methodology for RRYY wagons with identified cracks.
Safety message
Rolling stock managers should consider the key structural risk areas of their rolling stock and establish guidance methods for ensuring that these risk areas are given an appropriate level of priority when undertaking inspections.
The occurrence
Overview
On 20–21 April, Pacific National intermodal freight train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. At about 0003[1] on 21 April 2018, a short time after commencing the downhill grade from Mount Lofty to Belair, South Australia, there was a structural failure in the underframe of platform 2 of wagon RRYY01X. Soon after, the shared bogie between platform 2 and 3 of the wagon derailed. The train continued down the grade until the train separated (between platform 2 and platform 3 of wagon RRYY01X) and came to a stop near Glenalta.
Wagon RRYY01X was a multi-platform 5-pack[2] wagon. The wagon’s position behind the locomotives placed it about the centre in the train consist, and platform 2 was the only one not loaded with a container.
Prior to derailment
The train crew of 6MP4 involved in this accident commenced their shift at Dimboola (Victoria), departing at about 1854 on 20 April 2018. They did not pass or cross any trains between Dimboola and Glenalta. The train crew reported that, apart from a level crossing near miss with a road vehicle forcing an emergency stop near Lillimur (Victoria), the journey towards Mount Lofty was uneventful.
A third locomotive (8223) was added to train 6MP4 at Tailem Bend (88 km before Mount Lofty). At about 2342, the train began an 11 km steep climb up to Mount Lofty (Figure 1). The three locomotives were operating almost continuously in throttle notch 8 (maximum tractive effort), only easing off slightly at a couple of short sections of level track. At about 2358, 6MP4 passed Mount Lofty and commenced travel on the downhill grade[3] towards Belair (Figure 1).
Mount Lofty is located at the top of a cresting grade.[4] As the train passed over the cresting grade, the weight and resistance of the train’s rear portion still on the ascending grade (1,485 t trailing behind wagon RRYY01X) was opposed by the combined tractive effort and weight of the front portion of train now on the descending grade (1,368 t ahead of wagon RRYY01X).
As more weight moved onto the descending grade, the driver gradually decreased tractive effort and began applying braking effort using the locomotives’ dynamic brakes. The driver progressively increased braking effort until the locomotives were applying full dynamic brake, with the train transitioned to a compressed state.
Figure 1: ARTC track from Mount Lofty station to Glenalta station, including derailment information
Image shows ARTC track from Mount Lofty station to Glenalta station in grey, with red indicators showing kilometre markers. Location of key events indicated with orange markers.
Source: Google Earth annotated by the ATSB, and inset ARA Railways of Australia Map 2014 annotated by the ATSB
At some point during the train’s descent, the underframe of wagon RRYY01X’s platform 2 experienced a structural failure, which led to the deck of platform 2 dropping or sagging (Figure 2). This resulted in the deck angle of platform 2 rising towards the coupling to platform 3. The compressive forces acting on the angled deck of the empty platform 2 reduced the weight acting on the trailing axle from the bogie/wheels shared between platform 2 and 3.
Figure 2: Structural failure in underframe of platform 2 of RRYY01X
Image shows the structural failure in the underframe of wagon RRYY01X (platform 2) and its respective location to the derailed shared bogie between platforms 2 and 3.
Source: Pacific National and ATSB, annotated by the ATSB
Derailment
At about 0003 on 21 April, as the wagon negotiated a series of tight curves, the lightened axle between platform 2 and platform 3 climbed or lifted over the rail and subsequently derailed.
The first evidence of derailment was subsequently observed at the 28.6 km mark (about 2.4 km past Mount Lofty station). Wheel witness marks were identified on the exposed upper surface of the resilient track fastenings through a right curve (Figure 3).
Figure 3: Initial evidence of derailment between Mount Lofty and Belair
Image shows the location of the initial wheel witness marks on the upper surface of the resilient track fastenings at the 28.6 km mark.
Source: ATSB
The combination of a sagging deck and derailed wheels allowed the underframe to start rubbing on the leading axle of the bogie shared between platform 2 and 3 (Figure 4).
Figure 4: Contact abrasion damage to wheelset axle and platform 2 of 5-pack wagon RRYY01X
Image shows leading wheelset axle abrasion marks from the shared bogie between platform 2 and 3 of 5-pack wagon RRYY01X.
Source: ATSB
The trailing axle continued in a derailed state for a further 1.58 km, making intermittent contact with the ground, track fastenings and sleepers. At about 0005, when passing the 27.02 km point, bogie components collided heavily with a concrete sleeper, dislodging the constant-contact side-bearer pads at this location and breaking the bogie centre-pin (Figure 5).[5]
The failed centre-pin allowed the bogie to dislodge from its centre-bowl and move back towards the rear of the train, fouling with the leading end structure of platform 3. Over the next 3.9 km, the derailed rear axle made more frequent contact with the ground, track fastenings and sleepers.
Figure 5: Wagon coupler-pin and bogie centre-pin from RRYY class wagon
Image shows an intact combined wagon coupler-pin and bogie centre-pin from a RRYY class wagon, alongside the wagon coupler-pin from wagon RRYY01X with missing bogie centre-pin. Source: ATSB
At about 0011, as the derailed bogie of wagon RRYY01X passed through 20 Points at the entrance to the Belair crossing loop (23.081 km point, Figure 1), bogie components collided with the point components. About 25 m later, the derailed axle re-railed at the V-crossing[6] for the crossing loop. The train continued, with the bogie between platforms 2 and 3 running on the rails, but dislodged from its centre-bowl and fouling with platform 3.
Train separation
Train 6MP4 gradually slowed as it descended the grade. At about 0014, as the lead locomotive passed about the 20.36 km mark, there was a slight increase in train speed. This coincided with wagon RRYY01X uncoupling and separating between platforms 2 and 3.
Separation of the two platforms resulted in the breaking of the train’s brake air pipe and exhausting of brake pipe air to the atmosphere. The driver observed a high reading on the locomotive’s brake pipe airflow gauge and, expecting an emergency application of the automatic brake (train-line emergency brake), they commenced bailing or holding off the locomotives’ brakes.
The reduction in brake pipe air pressure to the rear portion of train 6MP4 resulted in the automatic application of the wagon brakes, bringing the 1,485 t rear portion of train 6MP4 to a stop in about 212 m. The breaking of the train’s brake pipe also exhausted air from the front portion of train 6MP4, causing the wagon brakes to apply, though the locomotives’ emergency brake systems did not activate.
At about 0015, the driver allowed the front portion of train 6MP4 to come to a stop using a combination of wagon braking effort (from the brake pipe rupture and pressure reduction), and an increase in the locomotive dynamic braking effort. The driver applied the locomotives’ brakes to stop the front portion of the train in the final 4 seconds of movement. The front portion of train 6MP4 was bought to a stop in about 662 m. After coming to a stop, the front and rear portions of the split train 6MP4 were separated by approximately 450 m (Figure 6).
The drivers recalled that when the front portion of the train came to a stop, there had been no bumping or crashing in the train. As such, neither of the drivers were expecting that the train had separated.
Figure 6: The stopped location of both portions of 6MP4 after the train separated
Image shows ARTC track in grey, with red markers showing kilometre markers, and 6MP4 stopped position of both portions in orange. Source: Google Earth annotated by ATSB
The previously derailed bogie was found lodged outside of its normal location under the leading end of RRYY01X platform 3, and the trailing end of platform 2 was found on the ground. There was substantial damage to the bogie and two platforms from the 5-pack wagon RRYY01X (Figure 7), plus minor damage to rail infrastructure (Location and infrastructure). There were no injuries.
Figure 7: Platform 2 and 3 from 5-pack wagon RRYY01X in their stopped locations
Image shows the final position of the bogie involved in derailment with platform 2 and 3, after train 6MP4 came to a stop near Glenalta.
The accident occurred over an 8.9 km section of standard gauge track between Mount Lofty and Glenalta, located in the Adelaide Hills approximately 31 to 19 track kilometres from Adelaide respectively (Figure 8). This section of track forms part of the interstate line between Melbourne and Adelaide, and is managed by the Australian Rail Track Corporation (ARTC).
The ARTC standard gauge track from Belair towards Adelaide is adjacent to the broad gauge track, part of the Adelaide Metropolitan Passenger Rail Network, managed by the Government of South Australia, Rail Commissioner.
Figure 8: Location of derailment site, between Mount Lofty and Glenalta
Image shows location of derailment site within South Australia, and inset image shows ARTC track in greater detail from Mount Lofty Railway Station to Glenalta Railway Station. Source: ARA Railways of Australia Map 2014 and Australian Government National Map, both annotated by the ATSB
The standard gauge track consists of continuously welded rail secured to concrete sleepers by resilient fasteners and supported on ballast. The configuration is typical of the standard used for the interstate line in South Australia.
From Mount Lofty, the track exhibits a 1 in 45 down gradient (Figure 9), with multiple tight curves. This section of track consists of both left and right curves varying in radius between 195 m and 700 m. A standard gauge crossing loop is located at Belair, about 8 km from Mount Lofty. The crossing loop provides 1,543 m of standing room[7] over an almost level straight section of track.
The Belair railway station is located approximately 200 m within the Adelaide end of the Belair crossing loop. The track continues to descend at a 1 in 47 down gradient (Figure 9), through multiple tight curves, towards Glenalta. Although each of the railway stations (from Belair) are active for passenger services, the platforms facing the standard gauge track are unused.
Figure 9: Mount Lofty to Glenalta track layout and gradient information
Image shows rail infrastructure layout, gradient and elevation information for section of ARTC track between Mount Lofty and Glenalta. Source: ATSB
The condition of the rail infrastructure including rail lubrication equipment between Mount Lofty and Belair was observed by the ATSB. The ATSB found no evidence to suggest that the condition of the rail infrastructure contributed to the derailment.
Approximately 5 km of standard gauge track sustained intermittent damage from the derailment, with about 50 concrete sleepers requiring replacement. At the Mount Lofty end of the Belair Station crossing loop, timber sleepers and associated points turnout components, rods and bars required replacement. Damage was also sustained to automatic rail lubricators between Belair and Mount Lofty.
There was no damage caused to the adjacent Adelaide Metropolitan Passenger Rail Network, or road bridges within the area.
Environmental conditions
Information obtained from the Bureau of Meteorology (BoM) established that the weather near Mount Lofty was mild, with light rain and relatively light winds in the period leading up to the accident. During the previous day, the BoM weather stations at Mount Lofty recorded a minimum temperature of 17.9 °C and a maximum of 25.6 °C. At the time of the accident, the temperature was about 18 °C.
Given these conditions, the ATSB determined that environmental factors were unlikely to have contributed either directly or indirectly to the accident.
Train information
Pacific National was the owner and operator of freight train 6MP4. The train consisted of two locomotives (NR62 and NR58) hauling 26 wagons (both single and multi-platform wagons) from Melbourne, with a third locomotive (8223) added at Tailem Bend (88 km before Mount Lofty). The total train length was about 1,499 m, and weighed about 2,853 t.
Although train 6MP4 was transporting dangerous goods in some containers, these were located on wagons further back in the train consist and were not associated with the derailed wagon. There was no release or spillage of dangerous/toxic goods from containers or wagon loads as a result of the accident.
Train crew information
Two Pacific National locomotive drivers were crewing train 6MP4. The driver operating train 6MP4 and the second driver had about 24 and 12 years’ experience (respectively) as locomotive drivers for Pacific National. Both held current driver competencies, route knowledge and rail safety worker health assessments.
The driver of train 6MP4 used dynamic brake alone to control train speed on the steep descending gradient from Mount Lofty. The locomotive event recordings indicate that the driver made gradual changes to dynamic braking effort, maintaining train speed between a minimum of 28 km/h and a maximum of 51 km/h, while also keeping in-train forces as constant as possible.
Although this approach to train handling has a number of benefits, the use of dynamic braking as the sole means of controlling train speed on a descending grade can generate significant in-train longitudinal compressive forces. However, this method of train handling is common practice for freight trains traversing the steep gradients in this location and is consistent with the handling instructions documented in Pacific National standard PN-STD-SAF - Train Handling.
In summary, the available evidence indicated that the driver handled train 6MP4 appropriately in the period leading up to the accident.
Consistent with Pacific National procedures, both drivers were requested to undertake drug and alcohol tests following the incident. The tests returned a negative result for each driver. A review of available evidence did not identify any concerns regarding the drivers’ fitness for duty in the period leading up to the accident.
Train braking systems
Dynamic brake
The dynamic brake, independent brake, and automatic brake are sub-systems of the train’s overall braking system.
Dynamic braking is a locomotive braking function present in diesel-electric and electric drive locomotives. It is not a substitute for the train’s air braking, but is a supplementary system that provides an additional means of speed control. A benefit of dynamic braking is to reduce the wear and heat generated by the friction style train braking equipment used by the independent and automatic braking sub-systems.
Dynamic braking uses the locomotive electrical traction motors as generators, converting the kinetic energy of a moving train into electrical energy. The electrical energy generated is dissipated into fan cooled electrical resistor banks. Increasing or decreasing the amount of electrical resistance in the resistor banks varies the load on the traction motor generator, which applies a corresponding resistance/braking effect on the rotating locomotive wheels.
Independent brake
The independent brake solely controls air brakes within the locomotive(s) and works independently of a train’s other braking control systems. The locomotive brakes are applied when the locomotive brake cylinder pressure is increased. This pressure can be increased or decreased via the driver’s independent brake control handle.
Automatic brake
The automatic brake controls the air brakes in the entire train, including the locomotive(s). An application of the automatic brake applies the locomotive(s) brakes by increasing locomotive brake cylinder pressure (similar to control via the independent brake system). The automatic brake simultaneously triggers the application of the train’s wagon brakes by reducing the air pressure within the train’s brake pipe. Maximum wagon braking effort is achieved when the brake pipe pressure is reduced to about 350 kPa, and wagon brakes are released when the brake pipe is charged to about 500 kPa.
The driver can vary the train’s braking effort, by operating the locomotive’s automatic brake control handle. Brake pipe air pressure is reduced at the service rate for normal braking applications, or at the greater emergency rate when an emergency brake application is made. The driver also has a ‘bail-off’ feature whereby they can suppress the braking action of the locomotive(s) following an automatic brake application, therefore enabling only the wagon brakes to stop the train.
Train-line emergency brake application
In the event that the train’s brake pipe is broken or ruptured following a train separation, the train’s wagon and locomotive brakes are automatically applied at the emergency rate. This safety feature of the automatic brake is also known as a train-line emergency brake application.
The Australian Standard AS7510.6:2014 (Braking Systems – Part 6 – Train), specified the minimum standards for brake performance, features, and compatibility for the braking systems of trains. This standard specified that:
In the event of train separation, the brake application provided by the stopping brake[8] shall be an emergency application of the stopping brake on every vehicle of the train.
That is, the rapid reduction in a train’s brake pipe pressure, caused by a train and brake pipe separation, must apply brakes at the emergency rate within every vehicle within the train, including locomotives. Although the locomotives of 6MP4 had the ability to comply with this requirement, practical application of the requirement can be influenced by the compliance of the connected wagons’ braking systems. In this case, the wagons which made up 6MP4 were manufactured before the standard was released, and there was no requirement to retrospectively apply this standard to these wagons.
Operationally, the driver has the option to prevent the automatic emergency application of the locomotive brake by using the bail-off feature. This is usually done in order to prevent a collision between two separated portions of a train, caused by the front portion of the train slowing faster than the rear portion. Despite this, there remains an initial automatic requirement for the braking systems in each vehicle of the train to respond to the train separation.
To detect train separations, locomotives are fitted with braking control systems designed (among other control purposes) to detect the rapid reduction of the train’s brake pipe pressure. In the event that a rapid reduction of brake pipe pressure is detected, the braking control systems enable the locomotive(s) emergency braking systems to remove the locomotive drive and provide a faster braking response to bring the train to a stop. These additional emergency braking system actions can include:
faster exhaustion of brake pipe air pressure via the locomotive’s brake control valves
removal of the brake pipe charging source (compressor output) from attempting to re-charge the train’s brake pipe
application of the locomotive brake
de-energization of the locomotive traction power via the pneumatic control switch/power knockout switch (PCS)
In this case, as the lead locomotive of 6MP4 passed the 20.362 km mark, wagon RRYY01X uncoupled between platforms 2 and 3. This resulted in the separation of the train’s brake air pipe, which exhausted the brake pipe air to the atmosphere.
Following the accident, the train’s brake pipe connections between platform 2 and 3 of RRYY01X were examined. This examination confirmed that the brake pipe had been cleanly broken in the train separation sequence (Figure 10). The brake pipe was not crimped or partially restricted during the train separation, allowing for unrestricted exhausting of brake pipe air.
Figure 10: Broken train brake pipe in platform 2 of 5-pack wagon RRYY01X
Image shows the broken brake pipe on platform 2 of 5-pack wagon RRYY01X.
Source: Pacific National and ARTC, annotated by the ATSB
The rear portion of train 6MP4 stopped due to the reduction in brake pipe air pressure and automatic application of the wagon brakes. Although the wagon brakes also applied on the front portion of 6MP4, the emergency brake systems on the three locomotives did not activate.
Examination of the locomotive event recording verified the absence of emergency brake application. More specifically:
Emergency brake application would normally trigger adhesion sanding in NR class locomotives, but this was not evident after the train separation in this instance (Figure 11).
Emergency brake application would normally trigger automatic application of a locomotive’s brakes. The locomotive brakes did not apply, though in this instance the driver reported bailing or holding off the locomotives’ brake after they observed the high brake pipe flow rate.
Emergency brake application would normally trigger complete evacuation of brake pipe air pressure. In this instance, brake pipe pressure appeared to remain just above 300 kPa (Figure 11).
Figure 11: Graph derived from extract of locomotive NR62 event recorder data
Image shows recorded locomotive NR62 data of the automatic brake pipe pressure, train speed, and sanding status from the front portion of the separated train. The NR62 recordings from the derailment sequence is not displayed in this graph.
Source: Data source Pacific National, graphed by the ATSB
Rolling stock – Wagon RRYY01X
General details
Wagon RRYY01X was one of 52 built in three tranches in 2004–05. The RRYY class wagon is a 5-pack skeletal container wagon (Table 1). This style of wagon consists of five individual wagons referred to as ‘platforms 1 to 5’, permanently coupled over common bogies (Figure 12).
Table 1: Summary details for Pacific National RRYY class wagons
Element
Value
Tare weight
59.6 t
Length
88.1 m (over couplers)
Max gross weight
200 t
Payload capacity
140 t
Max allowable speed
115 km/h
Number in class
52 (after this accident 50 remained in service)
Date first built
2004
Source: Pacific National Wagon Details Manual WDM-RRYY_04, Issued 28 July 2010
Figure 12: Pacific National RRYY class wagon
Image shows platform and shared bogie configuration of RRYY class wagon.
Source: Pacific National, annotated by the ATSB
The RRYY class wagons were a non-typical low deck wagon design, incorporating a light underframe that was intended to carry car containers. The low deck level was achieved by a combination of smaller diameter wheels, and large low depth gooseneck sections extending from the platform coupling and bogie centres to the larger platform main centre-sill section (Figure 13). Near the junction of this gooseneck and the main centre-sill section of the platform, an outrigger provided support for the container load via its connection to the main centre-sill and goose neck sections. The outrigger featured a large boxed opening for the wagon’s brake pull rod (Figure 13).
Figure 13: RRYY class wagon platform structure
Image shows the low depth platform gooseneck section which extends from the platform coupling and bogie centre to the larger main centre sill section of the platform, as well as the boxed outrigger section.
Source: Pacific National, and ATSB annotated by the ATSB
Post-accident examination
Platform 2 of wagon RRYY01X was recovered to the Adelaide Freight Terminal, allowing for a more detailed examination of the underframe failure. The failure originated from a crack between the join of the bottom centre sill plate and pull rod boxed opening in the wagon’s container loading outrigger (Figure 14).
Figure 14: Underframe cracks in platform 2 of 5-pack wagon RRYY01X
Image shows underframe cracks and their location in platform 2 of 5-pack wagon RRYY01X. The underframe cracks and derailed bogie were located at the trailing end of platform 2 of 5-pack wagon RRYY01X.
Source: Wagon drawing - Pacific National annotated by the ATSB; photos – ATSB
An examination of the crack surface on platform 2 suggested the initial propagation had occurred over a long period of time. This was followed by a rapid propagation shortly prior to and during the derailment. Although the exact period of time the initial crack was evident could not be determined, the crack surface condition suggested it existed weeks to months before, and most certainly was present prior to 6MP4’s departure from Melbourne (Figure 15).
Figure 15: Underframe crack fracture surfaces in platform 2 of 5-pack wagon RRYY01X
Image recorded on 27 April 2018, 6 days after derailment. Image shows the corrosion differences on the underframe crack fracture surface in platform 2 of 5-pack wagon RRYY01X.
Source: ATSB
Wagon RRYY01X loading
Pacific National documented specific freight loading and marshalling requirements for RRYY class wagons in its train inspection and freight loading manuals. In respect of train 6MP4 on 20–21 April 2018, four platforms of wagon RRYY01X were loaded with one container each. No container was loaded on platform 2 (Table 2).
Table 2: Loading of wagon RRYY01X
Platform number
Load
Platform 1
10 t container
Platform 2
Empty platform
Platform 3
12 t container
Platform 4
18 t container
Platform 5
13 t container
Wagon RRYY01X was positioned about 660 m behind the lead locomotive and about 750 m from the end of the train. There was about 1,405 t trailing[10] wagon RRYY01X.
Train 6MP4 and wagon RRYY01X were loaded in compliance with the Pacific National train inspection and freight loading manuals.
Wagon RRYY01X loading history
The maximum loading for each RRYY class wagon platform was 28 t. A review of the loading records for wagon RRYY01X indicated that platform 2 had exceeded its maximum loading on six occasions between 2005 and 2013. Since 2013, there had been no recorded overloading of this platform.
In summary, although wagon RRYY01X had some history of overloading, there was no recent history to suggest that wagon overloading contributed to its structural failure on 21 April 2018.
Rolling stock maintenance inspections
As per Pacific National Wagon Maintenance Manual (WMM), all standard gauge intermodal and steel wagon maintenance was based on time or kilometres travelled. The inspection frequency and assigned maintenance schedule was also dependant on the type of wagon. However, where a defect was detected by a safety inspection, roll-by inspection[11] or other means, the wagon could be scheduled for repairs and maintainer inspections outside of the schedule.
For the RRYY class wagons, the maintenance instruction assigned an IM3[12] maintenance schedule, based on distance travelled (Table 3).
Table 3: IM3 maintenance schedule for RRYY class wagons
Type of inspection
By whom
Schedule
Safety inspection
i) Train examiner
ii) Driver or terminal operator
i) FX[13] or GX[14] train examination prior to terminal departure
ii) Inward & outward roll-by inspection
Out-of-course repairs
Suitably qualified staff
As required
P Maintainer inspection
Maintainer/contractor
350,000 km (with up to 50,000 km tolerance)
A Maintainer inspection
Maintainer/contractor
700,000 km (with up to 50,000 km tolerance)
B Maintainer inspection
Maintainer/contractor
2,100,000 km (with up to 50,000 km tolerance)
The maintenance controls included a visual inspection to manage the risks associated with structural failure of wagons. Visual inspections were applicable during safety inspections and maintainer inspections, which included both scheduled inspections and anticipated inspections when wagons received out-of-course repairs.
Safety inspections
Train examination
The Pacific National Train Inspection Manual (TIM) required that all trains undergo a train examination prior to departing a yard or terminal location. Although, there were some exceptions to this requirement, these were not relevant to the operations related to this accident and wagon RRYY01X. Train examinations were normally conducted by train examination personnel.
Train examinations included inspections and tests on the train’s braking systems and visual inspections of the train’s loading and its rolling stock. The rolling stock inspection component included visual inspection of each wagon in the train in respect to the adjustment, condition and/or security of the wagon body. With potential relevance to this accident, this included structural damage and/or failure of components.
In respect to wagon underframes, the Pacific National TIM provided generic guidance on how to handle any identified longitudinal or transverse cracks in wagon underframes, cracks in component supports or mounting brackets, and cracks in body centre plates. However, there was no specific guidance requiring visual inspections of key structural points of RRYY class wagons, which might be susceptible to cracking.
It was reported by Pacific National train examination staff that the ability to visually inspect all areas during a train examination can be limited due to wagons being loaded, ambient lighting, shadows cast from adjacent wagons, cleanliness of wagons, and other obstructions.
The results of train examinations were required to be recorded within the Pacific National Train Inspection Certificate – Intermodal (TIM 01-04 Appendix B). The certificate related to train 6MP4 was completed on 20 April 2020 at 1240 and did not include any recorded issues related to wagon body inspections.
In the preceding 3-month period, wagon RRYY01X had been used on about 30 intermodal train services and undergone train examinations at Pacific National freight terminals in Melbourne, Adelaide, Perth, and Brisbane. These inspections, involving a wide group of train examination personnel, did not report any structural cracks in wagon RRYY01X.
Roll-by inspection
The Pacific National TIM required that all trains, excluding coal trains, undergo a roll-by inspection when departing or arriving at a yard or terminal location. They were normally conducted by train examiners, but could also be undertaken by other qualified rail safety workers.
Roll-by inspections included visual inspections, and these visual inspections were aimed at detecting air leaks, wheel flat spots, unreleased handbrakes, correct wheel rotation, axle bearing irregularities and dragging equipment, as well as a catch-all requirement to report any other observable defects. Roll-by inspections were generally concluded with a message to the train crew that the train has been inspected and whether it was complete (all wagons attached) or required action.
Although not directly intended as a method to inspect the wagon’s body for cracking, if the structure of the wagon had been compromised, this may be an observable defect during a roll-by inspection. In respect of train 6MP4, there was no evidence available to suggest that a defect had been identified in the roll-by inspection when 6MP4 departed Melbourne Freight Terminal on 20 April 2018.
In addition to arrival and departure from yards and terminals, additional roll-by inspections were also undertaken when a train was en-route. These roll-by inspections were undertaken by train crews of passing trains, incoming/outgoing train crews, and other qualified rail safety workers where applicable. These inspections were intended to observe the general security of loading, overall train integrity, and correct operation of the end of train marker. They were generally concluded with a message to the train crew that the train has been inspected and whether or not it is complete or requires action.
Figure 16: ARTC Adelaide to Melbourne corridor, with 6MP4 roll-by inspection locations
Image shows the location of the roll-by inspections undertaken on 6MP4 on its journey between Melbourne and Mount Lofty, noting roll-by location labels shown in orange.
Source: ARA annotated by the ATSB
Train 6MP4 passed other train services at Tooli Loop, Wingeel, and Deep Lead Loop, Victoria (Figure 16). A roll-by inspection was reported by the departing train crew at Dimboola, and the 6MP4 train crew reported that a roll-by was provided by the station assistant at Tailem Bend, South Australia (Figure 16). There was no evidence to suggest that a defect was identified from these inspections.
Maintainer inspections
Programmed maintenance inspection
The Pacific National Wagon Maintenance Manual (WMM) required that all RRYY class wagons undergo a ‘P’ inspection every 350,000 km with a tolerance of 50,000 km. ‘P’ inspections were also undertaken in combination with ‘A’ and ‘B’ inspections when the wagon had travelled the applicable threshold distances. The inspections were conducted by wagon maintenance personnel.
The wagon ‘P’ inspections included inspections, servicing, adjustments, and measurement/gauge checks of various wagon body, bogie, brake, and coupler components. With potential relevance to this accident, there was a requirement to check the wagon underframe for structural cracks in compliance with a specific Underframes, Body Work and Load Supports procedure.
The Pacific National WMM Underframes, Body Work and Load Supports procedure provided broad generic guidance on what to look for, and where to look, with respect to a typical wagon underframe. The procedure did not specifically guide wagon maintenance staff to key structural points on an RRYY class wagon or emphasise the areas susceptible to cracking.
It was reported by Pacific National wagon maintenance staff that wagons were normally delivered to maintenance facilities empty for the scheduled ‘P’, ‘A’ and ‘B’ inspections. As such, the limitations identified previously for train examiners were usually not a factor (for example, wagon loading, ambient lighting, and other obstructions). However, wagon cleanliness (build-up of grease, dirt or similar) could still limit visual inspections.
In relation to the scheduled maintenance inspections on wagon RRYY01X (Table 4), the last maintenance inspection was recorded as being undertaken on 24 October 2016 at the Perth Freight Terminal. There was no evidence available to suggest that this maintenance inspection identified any structural cracks in wagon RRYY01X. At the time of the accident on 21 April 2018, wagon RRYY01X was nearing the scheduled distance for its next ‘A’ Maintainer Inspection.
Table 4: Scheduled inspections of RRYY01X for previous 7 years
Inspection type
Date undertaken
Location
P maintainer inspection
24 October 2016
Perth Freight Terminal
B maintainer inspection
27 January 2015
Melbourne Wagon Maintenance Centre
P maintainer inspection
9 May 2013
Adelaide Freight Terminal
A maintainer inspection
20 July 2011
Adelaide Freight Terminal
The maintenance personnel conducting maintainer inspections were required to report any significant structural cracks or hairline cracks in inaccessible locations to their maintenance manager, with the provision for minor hairline cracks to be gouged and welded on site.
Pacific National maintenance and engineering representatives advised that they had no recollection of reports or observations about any significant structural cracking on RRYY wagons in the area where wagon RRYY01X had failed.
A review of previous ATSB investigation reports and available notifiable occurrence records did not identify any previous structural failures of RRYY class wagons.
Out-of-course maintenance inspection
Out-of-course maintenance inspection relates to ad-hoc maintainer visual inspections outside of the scheduled maintenance cycle. For example, Pacific National maintenance and engineering representatives advised of an expectation that a maintainer visual inspection would occur prior to the release of a repaired wagon. These ad-hoc maintainer visual inspections were also guided by the Pacific National WMM Underframes, Body Work and Load Supports procedure.
Wagon RRYY01X had been submitted for repair about 24 times since the last scheduled inspection (24 October 2016), with three of these within 3 months of the accident (Table 5). None of the repairs were specifically related to underframe cracking, and six instances were simply identified as ‘vehicle inspection’ (Table 5). There was no evidence available to suggest that any of these vehicle inspections, or maintainer repair opportunities, had identified any structural cracks in wagon RRYY01X.
Table 5: Out-of-course vehicle inspections of RRYY01X since scheduled inspection including out-of-course repairs undertaken in the 3 months prior to the accident
Reason
Date undertaken
Vehicle inspection
22 April 2017
Vehicle inspection
20 June 2017
Vehicle inspection
8 August 2017
Vehicle inspection
13 September 2017
Vehicle inspection
25 November 2017
Brake repair / wheelset replacements
29 January 2018
Vehicle inspection
29 January 2018
Brake block repair
12 February 2018
Auto-coupler repair
16 April 2018
Personnel information
Pacific National had documented its competence requirements for its rolling stock maintainers, train examination staff and train crew. The Pacific National personnel involved in the operation and pre-departure train examination of 6MP4, as well as the maintainers who had undertaken the last scheduled ‘P’ Maintainer Inspection, held current competencies for their tasks.
Post-accident RRYY fleet inspections
After the accident, Pacific National published and distributed a Rolling Stock Notice[15] to its terminal managers, maintenance planners, maintainers, train examiners and engineering representatives. The notice identified the location where the structural cracks within wagon RRYY01X had commenced and focussed post-accident inspections onto these specific stress areas of Pacific National’s RRYY class wagon fleet.
Staff in Adelaide, Melbourne, Perth, Sydney and Brisbane inspected the RRYY class fleet. Focussing on the structural areas specified within the Rolling Stock Notice, over half of the remaining 50 RRYY class wagon fleet were found to exhibit cracks of varying lengths.
Pacific National train examination, maintenance, and engineering representatives advised the ATSB that the extent of structural cracking on RRYY class wagons had not been observed previously. As a precaution, Pacific National ‘red carded’[16] the cracked RRYY class wagons until a long-term solution was formulated.
During freight train 6MP4’s descent from Mount Lofty, there was a structural failure in platform 2 of wagon RRYY01X. This resulted in one of the axles of the bogey between platform 2 and platform 3 derailing, and ultimately the train parting between these two platforms.
Post-accident observations found a crack in the underframe of platform 2 had propagated over time, most likely in the weeks and months prior to the derailment. The steep climb up to Mount Lofty under maximum tractive effort would have placed significant longitudinal tension through the wagon structure. This would have the effect of opening and encouraging growth of any pre-existing crack in the wagon underframe.
Mount Lofty is located at the top of a cresting grade. As a train passes over a cresting grade, the weight and resistance of the train’s rear portion still on the ascending grade is opposed by the combined tractive effort and weight of the front portion of train now on the descending grade. If a train is not handled appropriately, these conditions can cause in-train forces to exceed coupler strength with subsequent failure resulting in a train separation at the crest. In this case, the driver handled train 6MP4 appropriately. However, it is likely that the weakened structure of RRYY01X-platform 2 was unable to accommodate the high in-train forces, causing the underframe to fail and the crack to open significantly.
For the RRYY class wagon, the junction of the wagon’s bottom centre sill plate with the container loading outrigger included a pull-rod boxed opening within the outrigger (Figure 13). The loading and unloading of containers on the RRYY class wagons, accompanied by dynamic loading during normal operations, likely exposed this junction to cyclic strain and, as such, it would be susceptible to fatigue.
In support of this, the specific stress areas of the RRYY class wagon fleet that were a feature of this accident were, post-accident, inspected by Pacific National. These inspections identified that over half of the RRYY class wagon fleet were exhibiting cracks of varying lengths in the same areas.
Derailment
Failure of the underframe caused the deck of platform 2 to bend, changing the deck angle at the coupling to platform 3 (supported over a common bogie). Variations to drawbar or coupling angle, combined with large compressive longitudinal forces, are known to cause wheel unloading on empty wagons.[17]
In addition, high compressive longitudinal forces are known to increase lateral forces towards the outside of tight curves. For example, Pacific National’s train handling standard (PN-STD-SAF - Train Handling) noted the increased potential for derailment when under concentrated compressive force:
The presence of light wagons in the consist, or long wagons coupled to short wagons, or a coupler misalignment will increase the possibility of derailment.
As train 6MP4 negotiated a series of tight curves, the combination of wheel unloading (due to compressive forces and coupling angle on a light wagon) with increased lateral forces (due to compressive forces and a tight curve) resulted in flange climb (possibly complete wheel lift) and subsequent derailment.
Ultimately, the bogie re-railed about 5.5 km after it derailed. However, during this period, the derailed bogie had caused minor damage to rail lubricators, sleepers and points turnout components. In addition, the consequences could have been more serious if more bogies had derailed.
Rolling stock inspections
Pacific National had an established process of visual inspections for its rolling stock, including among other purposes, identifying cracks in wagons. These visual inspections were required to be undertaken within programmed and out-of-course maintenance inspections by maintenance staff, as well as within terminal arrival and departure train safety inspections by train examination staff.
A number of inspections were undertaken during the time that the crack likely existed in the underframe of wagon RRYY01X. More specifically:
In the 3 months prior to the derailment there had been one out-of-course maintenance inspection recorded on 29 January 2018, as well as two other out-of-course maintenance repairs on 12 February 2018 and 16 April 2018.
Wagon RRYY01X had performed about 30 train services, including train 6MP4, in the 3 months prior to the derailment. This involved train safety inspections from a wide group of train examination personnel at Pacific National Terminals in Melbourne, Brisbane, Adelaide and Perth.
There was no evidence that these inspections had identified any cracks in wagon RRYY01X. Similarly, it was evident that previous maintenance inspections had not detected cracks of varying lengths in more than half the 50 RRYY class wagon fleet.
Requirements and guidance for rolling stock inspections
As already noted, post-accident examinations found over half the RRYY class wagon fleet exhibited cracks in the junction of the bottom centre sill plate and the container loading outrigger. This junction was likely exposed to cyclic strain and fatigue, due to loading and unloading of containers and dynamic loading during normal operations. Although this was potentially predictable, it had not been considered and identified as a focus point for inspections by Pacific National.
Further to this, the Pacific National WMM Underframes, Body Work and Load Supports procedure provided broad generic guidance to wagon maintenance staff about what to look for and where to look, with respect to a typical wagon underframe. However, this procedure was generic and did not guide visual inspections to key structural points of an RRYY class wagon that had a reasonably predictable susceptibility to cracking.
Additionally, the Pacific National Train Inspection Manual provided generic guidance to train examination staff on how to handle any identified longitudinal or transverse cracks in wagon underframes, cracks in component supports or mounting brackets, and body centre plates. Similarly, this information also did not provide specific guidance on where to focus visual inspections with respect to key structural points of an RRYY class wagon that had a predictable susceptibility to cracking.
A large number of factors can influence visual inspection performance, such as the nature and salience of the defect, the use of inspection aids, environmental factors, duration of tasks and training and experience (See, 2012). Research across a number of visual search tasks has shown that experts are better than novices because they know from experience the most likely locations that relevant targets (or defects or hazards) are most likely to be located (Wickens and others, 2015). Accordingly, providing inspectors with information about locations most likely to contain defects (of feedforward information) improves defect detection performance.
In this case, Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This probably reduced the likelihood of the crack in wagon RRYY01X being detected prior to the accident.
Train separation and subsequent braking
Wagon RRYY01X uncoupled between platforms 2 and 3, resulting in the subsequent separation of the train’s brake air pipe, which exhausted the brake pipe air to the atmosphere. It was evident that the brake pipe had broken cleanly, allowing for unrestricted exhausting of brake pipe air.
Although air was exhausting from the front portion of the train via the separated brake pipe (wagon RRYY01X), it is likely the air production from the three locomotive compressors was sufficient to maintain the train’s brake pipe at a pressure high enough to inhibit the locomotives’ emergency braking system response. This effect meant that, although the wagon brakes on the front portion of the train applied, the locomotives continued to pump air into the broken brake pipe instead of exhausting the remaining brake pipe pressure. Overall, the brakes on the front portion did not slow the train at the emergency rate. The front portion of the train came to a stop about 450 m ahead of the rear portion.
The absence of the locomotives’ emergency braking systems was not contributory to the derailment, and did not increase risk associated with this accident. However, the automatic activation of the locomotives’ brakes at the emergency rate is a requirement of the Australian Standard and failure to do so may increase risk in different circumstances.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the derailment of train 6MP4 near Glenalta, South Australia, on 21 April 2018.
Contributing factors
A fatigue crack initiated in the bottom centre sill plate of wagon RRYY01X’s platform 2 underframe, which led to structural failure of the wagon and subsequent derailment of train 6MP4.
Multiple train examinations and maintenance inspections undertaken on wagon RRYY01X did not identify the crack in the wagon’s underframe.
Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected. (Safety issue)
Other factors that increased risk
The train’s brake pipe between platforms 2 and 3 was broken when wagon RRYY01X separated. Although this allowed air to exhaust from the brake pipe, enabling the train brakes on the wagons to bring the front and rear portions of the train to a stop, this loss of air on the front portion of the train did not activate the emergency braking system response of the locomotives.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Pacific National
Pacific National advised that all new wagons and locomotives procured by Pacific National will meet the Australian Standard AS7510.6 for braking systems.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Pacific National
the Australia Rail Track Corporation (ARTC)
the Office of the National Rail Safety Regulator (ONRSR)
the train crew of train 6MP4
Pacific National examination, maintenance and engineering personnel.
References
Pacific National, Train Inspection Manual, as current 21 April 2018.
Pacific National, Wagon Maintenance Manual, as current 21 April 2018.
Pacific National, Freight Loading Manual, as current 21 April 2018.
Pacific National, Train Handling Standard (PN-STD-SAF), version 5.0 issued 22 May 2017.
Rail Industry Safety and Standards Board (RISSB) AS7510.6:2014, Braking Systems – Part 6 – Train.
See JE 2012, Visual inspection: A review of the literature, Sandia Report SAND2012-8590, Sandia National Laboratories.
Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Pacific National
the Australian Rail Track Corporation (ARTC)
the Office of the National Rail Safety Regulator (ONRSR)
the train crew of train 6MP4
selected Pacific National examination, maintenance and engineering personnel.
Submissions were received from:
Pacific National
the Office of the National Rail Safety Regulator (ONRSR).
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 20/06/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
At approximately 0015[1] on 21 April 2018, Pacific National intermodal freight train 6MP4 derailed between Mt Lofty and Belair, South Australia. Train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. Train 6MP4 was approximately 1,499 m long with a trailing weight of 2,853 t, and consisted of three locomotives and 26 single and multi-platform wagons.
The train crew reported that apart from a level crossing near miss with a vehicle forcing an emergency stop near Lillimur, Victoria, the journey towards Mt Lofty was uneventful. At approximately 2358 on 20 April 2018, 6MP4 passed Mt Lofty, South Australia and commenced travel on the downhill grade[2] towards Belair (Figure 1).
Figure 1: The ARTC track from Mount Lofty to Glenalta, including derailment information.
Image shows ARTC track from Mount Lofty Railway Station to Glenalta Railway Station in green, with red markers for km points, and 6MP4 stopped position of both portions in yellow. A red star marker indicates the initial point of derailment, and key wagon debris / track evidence indicated with a white marker. Source: Google Earth annotated by ATSB
Multi-platform 5-pack[3] wagon RRYY01X was the eighth wagon behind the locomotives. At approximately the 28.6 km point (Figure 1), the trailing axle from the bogie shared between platform 2 and 3 derailed. The axle continued in a derailed state for a further 1.58 km, making intermittent contact with the ground, track fastenings and sleepers.
At the 27.02 km point, components underneath the derailed bogie collided heavily with a concrete sleeper dislodging the constant contact side bearer pads and breaking the centering bogie pin (Figure 2). The collision moved the bogie towards the rear of the train fouling with the leading end structure of platform 3 (wagon RRYY01X). The derailed rear axle travelled for a further 3.96 km making more frequent contact with the ground, track fastenings and sleepers.
As the derailed bogie passed over 20 Points at the entrance to the Belair crossing loop (23.06 km point - Figure 1), components underneath the derailed bogie collided with components of 20 points. About 10 m later, the derailed axle re-railed at the V-crossing[4] for the crossing loop. The collision with the points components and the axle re-railing likely dislodged the coupler pin[5] (Figure 2) allowing platforms 2 and 3 (wagon RRYY01X) to uncouple and separate.
Figure 2: Coupler Pin and Centre Bogie Pin from RRYY class wagon.
Image shows an intact combined wagon coupler pin and centre bogie pin from a RRYY class wagon, alongside the wagon coupler pin from wagon RRYY01X with missing bogie centre pin. Source: ATSB Annotated.
Separation of the two platforms resulted in breaking of the brake air pipe, which automatically applied the train brakes and brought both portions of train 6MP4 to a stop. The leading end of the front portion of 6MP4 stopped at approximately the 19.7 km point near Glenalta, and the leading end of the rear portion of the split 6MP4 stopped at the 20.84 km point (Figure 3). The front and rear portions of the split train 6MP4 were separated by approximately 450 m.
Figure 3: The stopped location of both portions of 6MP4 after the train parted.
Image shows ARTC track in green, with red markers for km points, and 6MP4 stopped position of both portions in yellow. Source: Google Earth annotated by ATSB
There was substantial damage to a bogie and two platforms from 5-pack wagon RRYY01X (Figure 4), plus minor damage to rail infrastructure. There were no injuries reported.
Figure 4: Platform 2 and 3 from 5-pack wagon RRYY01X in their stopped locations.
Image shows the final position of the bogie involved in derailment with platform 2 and 3, after train 6MP4 came to a stop near Glenalta. Source: Wagon drawing - Pacific National annotated by ATSB, and photos - ATSB.
Post incident
Post derailment inspection identified an underframe structural failure within platform 2 of RRYY01X 5-pack wagon. The failure originated from a crack between the join of the bottom centre sill plate and pull rod opening in the wagon’s underframe (Figure 5).
Figure 5: Underframe cracks in platform 2 of 5-pack wagon RRYY01X.
Image shows underframe cracks and their location in platform 2 of 5-pack wagon RRYY01X. The underframe cracks and derailed bogie were located at the trailing end of platform 2 of 5-pack wagon RRYY01X. Source: Wagon drawing - Pacific National annotated by ATSB, and photos - ATSB.
Following this incident, Pacific National issued a Rolling Stock Notice[6] in relation to its RRYY class wagon fleet. The notice required that:
all RRYY class wagons are inspected for underframe cracking
all RRYY class wagons exhibiting any cracking around the underframe to be red carded[7] for repairs
magnetic particle inspection or dye penetrant inspection of welded connections is to be conducted during scheduled preventative maintenance
a fleet assessment of RRYY class wagons is to be undertaken.
Continuing investigation
The ATSB investigation is continuing, and will include the following:
gathering further information from involved parties
examination of wagon RRYY01X
examination of inspection and maintenance processes, and historical records relating to RRYY class wagons
review of train loading and examination processes with respect to RRYY class wagons.
__________ The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 24 February 2018, the yacht Finistere capsized south of Perth, Western Australia, with the loss of two lives.
The Western Australian Department of Transport (WA-DoT) is responsible for investigating this accident. As part of its investigation, WA-DoT requested technical assistance from the Australian Transport Safety Bureau (ATSB), involving the examination of an electronic device.
To protect the information supplied by WA-DoT to the ATSB, as well as the ATSB’s investigative work to assist WA-DoT, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.
The ATSB completed its technical assistance and provided a report to the WA-DoT. Any enquires in relation to the accident investigation should be directed to WA-DoT at marine.investigations@transport.wa.gov.au
On 17 April 2018, the pilot of a Garlick Helicopters UH-1H, registered VH-HUE, was conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales. While on approach to pick-up a load, the helicopter’s engine failed. During the subsequent forced landing, the helicopter collided with trees and a riverbed. The pilot sustained serious injuries and the helicopter was destroyed.
What the ATSB found
The ATSB found that the inner struts in the exhaust diffuser fractured leading to the engine failure. The fracture was the result of high-cycle metal fatigue, which had not been detected for at least 36 routine maintenance inspections prior to the accident. It was also established that the maintenance practices and processes were likely inadequate to detect the potential impending failure of safety critical components. These practices related to inspections, record keeping and trend monitoring.
Following the engine failure, the pilot had limited assurance that ground support personnel could vacate the clearing directly below the helicopter, necessitating a forced landing to a less suitable location. This was likely the result of a risk assessment for helicopter operations that did not consider the hazard of an emergency landing as the helicopter approached to hook-up a load.
The pilot was not wearing the upper torso restraint fitted to the helicopter during the flight. It was virtually certain that this resulted in the pilot sustaining serious head injuries when the aircraft collided with terrain. It was also identified that upper torso restraints were likely not routinely worn by a notable proportion of pilots conducting vertical reference flying operations in Australia. This was likely due to these restraints not being fit-for-purpose for the operations being conducted. The operations mainly related to aerial firefighting, and to a lesser extent, lifting operations.
Although not contributory, the ATSB also found that a screw-clamp was retrofitted to the firefighting retardant delivery hose, which likely prevented the release of the long-line during the forced landing. While this did not influence the outcome of the accident, this had the potential of becoming snagged in trees and increase the severity of the impact.
Further, the immediate response of the ground personnel to extinguish a small fire in the engine bay and assist the pilot with exiting the helicopter, likely reduced the risk of more severe injuries to the pilot.
What has been done as a result
Following the accident, the maintenance organisation was acquired by another company. They advised improvements were made to their maintenance procedures and processes. Those improvements included the implementation of a new computer-based maintenance system that was expected to provide greater assurance in maintenance performed and assist with trend monitoring for detecting anomalies. Further, vibration test equipment was purchased to allow greater ease in conducting required checks.
In addition, the company responsible for managing the site ground works convened a hazard assessment workshop with the helicopter operators where they reviewed the hazards and controls for mountain flying and lifting operations. This was to ensure alignment, and a common approach and understanding between all parties. A risk management plan was collated during this workshop for use in similar future operations.
Safety message
Purposeful visual inspections of safety critical components, and the routine review of documented maintenance records for trend monitoring and anomaly detection purposes provide a vital role in preventative aircraft maintenance. These aspects would have likely allowed anomalies to be identified and investigated prior to the engine failure occurring.
Helicopter lifting operations introduce additional risks to personnel working in their vicinity. In circumstances where there may be insufficient time to formulate a plan, such as an emergency landing from a low height and low speed, carefully considered and clearly communicated pre‑flight risk assessments provide an important mechanism to mitigate these risks.
Upper torso restraints provide an important defence to reduce the severity of injuries during an accident. This report highlights an elevated risk to pilots who are unable to effectively wear these restraints during some vertical reference operations, such as aerial firefighting and lifting. Further consideration of engineering innovations for these restraints could reduce the risk associated with this problem.
The occurrence
Preparation for lifting operations
On 17 April 2018, the pilot of a Garlick Helicopters UH-1H, registered VH-HUE (HUE), was to be conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales. In the morning, the helicopter was prepared for flight at Tumut Airport, about 60 km north of the planned area of operation. Flight preparations involved a discussion between the pilot[1] and a contracted licenced aircraft maintenance engineer about the maintenance performed since the pilot had last flown the previous day. The pilot conducted a walk-around inspection of the helicopter, signed the maintenance release and conducted an engine run. Nothing abnormal was noted by the pilot or licenced aircraft maintenance engineer.
The helicopter departed Tumut Airport at about 0804 Eastern Standard Time,[2] for a positioning flight to a clearing 57 km south of Tumut, known as Lobs Hole, arriving at about 0837 (Figure 1). This location was used as the base of operations for the lifting work on the day, referred to as the ‘laydown area’. The operation was part of a proposed expansion of the Snowy Mountains Hydro‑electric Scheme, known as the Snowy 2.0 project. The planned work on the day involved using helicopters to relocate components of a de-constructed drill-rig used for geotechnical survey within the ‘area of operation’ shown in Figure 1.
Figure 1: Map showing morning repositioning flight and area of lifting operation
Source: Google Earth, annotated by the ATSB
The lifting operation involved HUE and two AS350 ‘Squirrel’ helicopters. HUE was to be utilised for heavier loads, and the Squirrels to be utilised for the lighter loads. Supporting the lifting operation on the ground at the drill site (location of the load hook-up) were two loadmasters, who had radio communications with the pilots. Three additional workers were also assisting with drill rig de-construction. Although these workers were not involved in the lifting operation, they remained at the drill site during lifting.
Conduct of lifting operations
Lifting operations involving HUE commenced at 1308. Each run involved lifting drill-rig components from the drill site to the laydown area, before returning for the next lift. Each lift run, and return, was completed in about 5 minutes, with ground personnel preparing the next load between lifts. HUE had completed 11 lift runs (Figure 2), which the pilot reported were ‘uneventful’. At about 1414, the pilot positioned HUE for the twelfth run (Figure 2 red flight path), in order to lift the drill rig motor. As the helicopter approached for the twelfth lift, one of the loadmasters advised the pilot that more time was required to prepare the rigging and requested the pilot hold off for a short time. HUE entered a holding circuit about 700 m to the north-east prior to making a very slow approach toward the drill site (Figure 2 red flight path). The pilot recalled that the weather conditions were ideal, with a slight breeze and good visibility.
Figure 2: Map of lifting runs conducted
Source: Google Earth, annotated by the ATSB
While waiting for a radio clearance to lift the drill rig motor, the pilot recalled conducting a full system check, and that all instruments indicated the helicopter was operating in the normal range. At about 1415, the loadmaster requested the pilot approach the site in preparation for lifting the drill rig motor. As HUE approached overhead, the loadmaster informed the pilot that the rigging required re-checking. In order to minimise the rotor downwash on the people below, the pilot raised the collective to climb the helicopter, and the 100-foot long-line, above the tree canopy.
Engine failure and forced landing
At about 1417, as the helicopter started to climb, the pilot heard a loud mechanical ‘screaming’ noise and started planning for a forced landing. Witnesses also reported seeing ‘smoke’ and some advised they heard a ‘bang’ at about the same time. Almost immediately, the pilot also heard an audible alarm, followed by a noticeable yaw and engine power loss. Time-lapse images from a camera mounted at the drill site showed a light-coloured gas or mist near the engine area of the helicopter (Figure 3).
Just prior to the engine failure, HUE was about 200 to 250 ft above ground level, with a forward airspeed of about 20 to 25 kt, based on global positioning system (GPS) data, eye-witness reports, and the pilot reporting flying into a slight headwind. From fuel-burn calculations by the ATSB, the weight of HUE was estimated at 2,900 kg at that time.
Figure 3: Light coloured gas or mist from the helicopter above the drill site
Source: GHD, annotated by the ATSB
The pilot broadcast a ‘Mayday’[3] call and attempted to conduct the forced landing (autorotation) into the Yarrangobilly riverbed, south-west of the lifting area and the ground personnel. The workers observed the helicopter being turned to the south-west, away from the drill site.[4] They described the helicopter as appearing to ‘float’ over the trees, before descending quickly. Around this time, the pilot commanded jettison of the long-line and lifting strops. At interview, the pilot advised that the helicopter was flared prior to the impact with the second tree, but could not recall the remainder of the impact sequence until exiting the helicopter. The helicopter subsequently collided with trees and the riverbed (Figures 4 and 5). Ground personnel from the drill site immediately responded to the accident with fire extinguishers. They extinguished a small fire in the engine bay, removed the pilot from the wreckage, and performed first aid until emergency services arrived at 1520. The pilot sustained serious injuries and the helicopter was destroyed.
Figure 4: Forced landing flightpath showing drill site and helicopter wreckage
Source: New South Wales Rural Fire Service, annotated by the ATSB
The pilot held a Commercial Pilot Licence (Helicopter) and current Class 1 Aviation Medical Certificate. In addition, the pilot held a low-level operational rating, with endorsements for helicopter sling-load. The pilot had accumulated more than 9,000 hours total aeronautical experience, predominantly in helicopters. In the previous 30 and 90 days, the pilot had flown 43.4 and 154 hours respectively. The pilot reported being well rested for the day of the accident.
Meteorological information
The meteorological conditions from witness reports and drill site time-lapse camera footage throughout the period of lifting operations indicated clear sky and light winds. The wind conditions recorded by a Bureau of Meteorology automatic weather station about 45 minutes after the accident at Cabramurra (18 km away), were 11 km/h (6 kt) from the west, consistent with reports from the accident pilot.
Helicopter information
General
The UH-1H helicopter was developed by Bell Helicopters as a military utility helicopter for the United States (US) Army. The accident helicopter was manufactured in 1965. The helicopter had a two-blade main rotor and two-blade tail rotor and was powered by a military variant of the Honeywell Aerospace (formally Lycoming Engines) T53-L-13B turboshaft engine. Several organisations were authorised by the US Federal Aviation Administration (FAA) to convert surplus US military helicopters for civilian operations. Garlick Helicopters Inc. was the holder of the type certificate for this helicopter, which was US-registered as N2220Y, when it entered civilian operations.
VH-HUE (HUE) was first registered in Australia in December 2002 and was operated by one owner, until it was purchased by the current owner in January 2011. At entry in Australia, HUE had accumulated 8,017.3 hours and had ‘no record of accident’. In 2006, HUE was transferred to the restricted ‘special purpose’ category, due to the limited ongoing maintenance technical support. This category included agricultural operations, forest and wildlife conservation, and firefighting, and only persons who were ‘directly associated with the special purpose’ could be carried. HUE was issued with a special certificate of airworthiness[5] in July 2008.
Weight and balance
The ATSB calculated that HUE was very likely below the maximum take-off weight and within centre of gravity limits for all flights on the day of the accident. This included the 11 previous lift runs. Furthermore, fuel-burn calculations and the presence of a considerable amount of fuel at the accident site indicated there was sufficient fuel on board, about 270 kg, to conduct the lifting operations at the time of the accident.
Continued airworthiness
The logbook statement for HUE indicated that it was to be maintained in accordance with the Garlick Helicopters Inc. Instructions for Continued Airworthiness (ICA) Report GH-H13WE-CA1H. which stated:
FAA [Federal Aviation Administration] type certified civil engines and FAA approved civil appliances…must be serviced, maintained, inspected, and repaired in accordance with the applicable manufacturer’s maintenance manuals, or manufacturer’s Instructions for Continued Airworthiness or this TC Holder’s Instructions for Continued Airworthiness.
Therefore, HUE’s engine was to be maintained as per the US Army technical publications.
Wreckage and impact information
Examination of the trees on the side of the river opposite to the drill site revealed multiple broken branches resulting from the tips of the main rotor blades. Based on the path of broken branches and witness accounts, the helicopter’s descent path from this point became much steeper. The helicopter descended with the main rotor blades striking tree branches to the right of the helicopter prior to striking and severing a tree (the main impact tree) about 11 m up from its base, and 30 m from the initial tree strike. Audio analysis by the ATSB of the tree strikes from the phone of an eye‑witness was used to calculate a mean groundspeed of 45 kt, and vertical speed of about 2,000 feet per minute during this phase of flight. The flight path suggested that the pilot probably maintained control of the helicopter until one of the main rotor blades broke apart from impacting the tree.
Examination of the wreckage and ground impact marks indicated that the helicopter had impacted the ground in a nose high, slightly right side down attitude. The tail boom of the helicopter struck the ground during the impact, detaching from the fuselage. The landing gear assembly showed evidence of deflection during the main impact of the fuselage with the ground. The helicopter likely bounced off the skids, leading to the fuselage coming to rest in a nose low, slightly inverted position (Figure 5).
Figure 5: Helicopter wreckage showing nose of helicopter in Yarrangobilly River
Note: Wreckage of VH-HUE looking upstream toward the drill site, showing the nose of the helicopter and pilot’s seat. Source: ATSB
For the lifting operations on the day of the accident, a 100 ft/30 m long-line was being used, with lifting strops attached at the remote hook. The site and wreckage examination revealed that, during the accident sequence, the long-line had detached from the belly hook, and the strops had released from the remote hook. This indicated that the long-line and strops were likely jettisoned during the accident sequence, as per emergency procedures. Although the pilot could not recall jettisoning the load, photographs confirmed that both the long-line and strops were attached to these hooks prior to the emergency, and the long-line did not appear to have snagged on any trees during the accident sequence. However, the long-line remained tethered to the fuselage due to the Sacksafoam hose line, which had failed to separate (refer to section titled Retention of the long-line) (Figure 6).
Figure 6: Failed to detach long line
Source: ATSB
During the examination of the wreckage, the ATSB identified cracking and material loss visible in the exhaust diffuser area (Figure 7 and Figure 8). In addition, the exhaust diffuser cover attachment bolt was not lock-wired, as required by the US Army maintenance manual applicable to HUE (Figure 8). Examination of the engine, including the exhaust diffuser assembly is discussed in the next section.
Figure 7: Visible cracking in the exhaust diffuser area
Source: ATSB
Figure 8: Diffuser area, unsecured cover plate, cracking and missing material
Source: ATSB
Engine examination and maintenance
Examination
Exhaust diffuser strut cracking
The engine was shipped to Honeywell’s facilities in Phoenix, Arizona, in the US and underwent a teardown examination under the supervision of a representative from the US National Transportation Safety Board. The purpose of the examination was to identify the technical failure mechanism, or mechanisms of the engine failure. This included a detailed examination of the exhaust diffuser assembly illustrated in Figure 9.
Figure 9: Exhaust diffuser assembly schematic and photograph (inset)
Source: Honeywell, modified by the ATSB
The Honeywell engine teardown identified extensive fatigue cracking in the exhaust diffuser inner struts (Figure 10 inset). The inner struts were a critical engine component that supported the rear of the power turbine assembly through the number 3 and number 4 bearings (Figure 10). Note for reference that Figure 10 (inset) shows missing material in the exhaust diffuser inner cone also shown in Figure 8. Honeywell identified the location of the cracking for each of the four inner struts:
two of the four inner struts were separated around the full circumference of the inner strut flange welds
another strut exhibited cracking around most of the circumference of the inner strut flange welds, although the inner strut remained attached to the inner cone by a small welded section
one strut was separated through the strut with no visible weld separations.
The analysis by Honeywell determined that the cracking in the inner struts resulted in the complete loss of structural integrity of the four struts. This led to the power turbine assembly moving rearward, indicated by the arrow labelled ‘direction of PT movement’ in Figure 10. The rearward movement was sufficient for the rear tapered section of the power turbine drive shaft (labelled ‘PT drive shaft rear taper’) to contact the adjacent rear shaft of the compressor assembly, highlighted in blue. Due to the compressor and turbine assemblies rotating in opposite directions, the contact resulted in considerable friction, and deformation of the rear compressor shaft. This led to the compressor assembly contacting the walls of the engine case.
Figure 10: Illustration of T53 engine and exhaust diffuser inner cone (inset)
Source: Honeywell, modified by the ATSB
Considering the contact between the tapered section of the drive shaft and the compressor assembly, Honeywell reported that, ‘by design, this was the most critical section for inter-shaft clearance of the counter-rotating components. Rapid frictional heating is imminent once the rub condition is established. All damage, therefore, is considered secondary to the fatigue cracking of the exhaust diffuser struts’.
High-cycle fatigue
Regarding the material analysis of the exhaust diffuser housing, Honeywell identified that:
the cracking in the strut/inner cone weld joints resulted from high-cycle fatigue emanating from multiple initiation sites along the inner edge of the weld bead, which was likely driven by power turbine vibration
no material anomalies were observed
the chemistry of the exhaust diffuser housing was indicative of the manufacturer’s specified material
the measured hardness of the strut, inner cone, and weld bead indicated that the assembly was heat treated subsequent to welding, as specified.
Honeywell reported that ‘the exact initiation locations [of the fatigue cracks] were unable to be determined due to secondary smearing damage’. Further, due to the post-accident damage to the engine and airframe structure, the ATSB concurred that it was not possible to determine the source of the power turbine vibration.
Visible indications of cracking
Honeywell advised that they have had some previous experience with cracking on exhaust diffuser assemblies. Specifically, they indicated that:
Empirical evidence suggests that the cracking develops and propagates over a considerable period of time, i.e. hundreds of operational hours. Therefore, it is believed that the exhaust diffuser cracking and material loss from the inner cone would have been visible during the most recent Phase Inspection performed 20.8 hours before the accident. Visual indications of cracking were likely present during the preceding phase inspection(s) as well. An investigation to assess and rectify the exhaust diffuser cracking would have necessitated the removal from service of the exhaust diffuser.
This indicated that cracking and missing material on the inner cone of the exhaust diffuser, as observed by the ATSB after the accident, was likely visible during maintenance inspections prior to the accident. Further, Honeywell stated:
During the previous 40 years, this is only the third reported incident of exhaust diffuser strut cracking that developed sufficiently to cause an engine malfunction in Honeywell’s experience with the T53 series engine. Typical experience for the T53 is that removal of the exhaust diffuser for observed cracking will necessitate off-engine inspections and repairs to the inner struts, as required.
This indicated an expectation that if the visible cracking in the exhaust diffuser was identified, removal of the exhaust diffuser would be required. Subsequent inspections would have led to the identification of the cracking in the inner struts.
Maintenance arrangements for VH-HUE
HUE had been maintained by Encore Aviation (Encore) since March 2016. Encore was a CASA‑authorised maintenance organisation established in 2002 and provided maintenance to a variety of fixed and rotary-wing aircraft. Encore incorporated another maintenance organisation in 2017. The chief engineer of Encore at the time of the accident was from the organisation prior to incorporation. Encore was then acquired by another company in March 2019 (1 year after the accident). The role of chief engineer changed to another person at about this time, due to retirement.
Field maintenance
The services provided for HUE included field maintenance, when requested by the operator. The chief engineer at the time of the accident advised that, when a licenced aircraft maintenance engineer (LAME) was providing field maintenance for HUE, the LAME would perform the daily inspection. This arrangement was intended to relieve a pilot of extended duty, outside of their flying requirements.
With respect to daily maintenance performed by the pilot, the pilot reported doing ‘fuel and oils, so walk around doing all the inspections…normal stuff…but I don’t actually do any maintenance because I travel everywhere with an engineer [LAME]’. This included the expectation by the pilot that the daily inspection, which included the requirement for an inspection of the exhaust diffuser housing, was conducted by the LAME. The LAME who provided field support for HUE reported that ‘they generally completed the greasing requirements’[6] and the pilot conducted the daily inspection. This LAME also advised that they had carried out a daily inspection on occasion, when specifically requested by the pilot. A review of records identified the LAME’s signature on a maintenance release daily inspection for HUE, dated in November 2017. The pilot reported that the LAME had conducted a compressor wash and greasing prior to the flight on the morning of the accident.
Phase inspections
The two most recent phase inspections, in January and April 2018, were conducted in the hangar by different LAMEs at Encore. The chief engineer reported that HUE was maintained in accordance with the US Army technical publication requirements, which were last updated in 2010.
Exhaust diffuser inspections
Inspection requirements
The tailpipe and exhaust diffuser could be readily accessed via a ladder (Figure 11). Inspection of this area was typically carried out with the aid of a bright torch and mirror. A borescope could also be utilised if closer inspection was warranted.
Figure 11: Typical exhaust, showing accessibility for inspection
Source: Honeywell
The US Army technical publications included the following inspection requirements for the exhaust area, including the diffuser (Table 1).
Table 1: US Army exhaust area inspection requirements
Engine combustion chamber housing, exhaust diffuser, support cone, fire shield, firewall gaskets and seal, and tailpipe for cracks, dents and burned or buckled areas
Daily – prior to the first flight of the day
Phased maintenance checklist (‘phase inspection’)
Engine exhaust tailpipe for cracks, dents and burned or buckled areas
Perform a daily inspection at the completion of the phase check
Every 150 hours
Recent exhaust diffuser inspection opportunities
In consideration of Honeywell’s comment that the exhaust diffuser cracking was likely visible at the previous two ‘phase inspections’, the ATSB examined the potential opportunities for detection. In 2018, HUE underwent phase inspections on 11 January and 1 April. Following each of these inspections, a new maintenance release was issued. From 11 January 2018 to the accident flight, a review of the maintenance release records showed 34 daily inspections, certified by four different people. It was permissible for these certifications to be made by the pilot in command, another pilot licenced to fly the helicopter or an appropriately qualified LAME. In addition to the pre-flight and phased maintenance inspections, maintenance records indicated another eight separate maintenance visits to the maintainer had occurred in the 4 months prior to the accident. The helicopter had accumulated 171 flight hours in this period.
Vibration checks
Rotating components, in the airframe and engine, are the primary source of vibration in helicopters. Maintaining vibration levels within manufacturer-specified limits is essential in enabling components to be functional for their projected life limit. If excessive vibration continues over time, the wear on components will increase exponentially to the point of failure. In addition, this vibration can affect the fatigue life of stationary components.
US Army vibration requirements applicable to HUE
The US Army engine maintenance manual required an engine vibration test be conducted following certain maintenance actions, including:
any maintenance that required removal and reinstallation of an engine for any reason
when excessive engine vibration was suspected
when more than 20 per cent of the total number of compressor blades were repaired to maximum limits.
Vibrations levels at specified engine revolutions per minute (RPMs) were to be recorded on the US Army Engine Vibration Test Data Sheet (vibration data sheet) applicable to the helicopter. The data sheet also detailed the maximum permissible vibration for each parameter. For HUE, a maximum vibration level of 2.5 inches per second applied to the majority of the tested parameters.
Maintenance records on vibration checks
Encore advised that, up to the time of the accident, they did not use the US Army vibration data sheet or keep physical records of vibration test data. Instead, they relied on the vibration test equipment internal memory storage for maintaining a record of the test results. However, during the investigation, Encore reported that their equipment suffered a major failure that required its return to the manufacturer for repair, resulting in a loss of all the stored data.
A review of the maintenance records identified that the engine had been removed from the helicopter for repairs from foreign object damage and re-installed on 12 November 2016, 417 hours prior to the accident. A vibration check had been conducted at that time. The certification indicated the vibration was ‘within limits’, however, no vibration data had been recorded. In addition, associated maintenance worksheets were not available as Encore did not retain these records beyond 24 months.[7] In accordance with the US Army engine maintenance manual, a re‑check of the vibration was required at 500 and 1,000 hours’ time-in-service. However, the engine had not accumulated 500 hours prior to the accident.
The engine logbook indicated that, on 1 April 2018, the top axial compressor half had been removed from the engine to repair minor foreign object damage to multiple compressor rotor blades. This was recorded as having been conducted in accordance with the US Army maintenance manual. However, there was insufficient information recorded by maintainers in HUE’s maintenance records to determine if a vibration check was required in this instance. Specifically, it was unclear if more than 20 per cent of blades required repair to maximum limits, which would have triggered the US Army requirement for a vibration test. Regardless, the engine logbook did not include any indication that a vibration check had been carried out.
Guidance for record keeping and trend monitoring
Trend monitoring in this investigation refers to the process of evaluating historical data to identify anomalies that may indicate an emerging technical failure of the engine. This process is generally considered to be in-line with industry best practice as a method to identify underlying problems before a safety incident occurs, such as the engine failure of HUE. This is supported by guidance produced by Civil Aviation Advisory Publication 30-04 Certificates of approval – Maintenance organisations, which set out the procedures that CASA would expect an authorised maintenance provider to have in place ‘to ensure that aviation safety is not compromised’. This publication stated that, part of an organisation’s quality system should detail ‘procedures for monitoring the other quality indicators such as facility malfunction reports, incidents, occurrences, maintenance errors, complaints and defects’.
The US Army engine maintenance manual, Section 1-73 General troubleshooting, provided a general statement with respect to identifying the source of failures, referred to as ‘general troubleshooting’, stating:
It is essential to have a thorough knowledge of specified fuel flow, oil pressure, exhaust gas temperature and other important specifications of normal engine operation to discover troubles. Having a record of prior trouble and work performed is essential when troubleshooting.
Although this advice did not specify requirements for vibration trend monitoring, it noted the general importance of recording prior work and ‘trouble’ encountered. In summary, these documents present ‘defect reporting’ and ‘record keeping’ as important sources of information for the effective management of continued airworthiness.
Review of Encore Aviation maintenance practices
VH-HUE replacement of engine related components
HUE’s maintenance records indicated that the power turbine (N2) tachometer generator[8] had been replaced four times: 29 August 2017 (10,060.0 aircraft hours), 27 November 2017 (10,146.4 hours), 11 January 2018 (10,200.3 hours) and 16 January 2018 (10,204.9 hours). The records did not detail the exact nature of each unserviceability. On 1 March 2018 (10,304.3 hours) the drive assembly for the tachometer generator was replaced, recorded in the maintenance logs as ‘suspect’. Again, there was no indication that further evaluation, such as a vibration check, had been conducted following any of these maintenance actions.
VH-HUE phase inspection documentation
The ATSB reviewed the worksheets and logbook entries for the phase inspections for HUE that were completed on 11 January and 1 April 2018. Inconsistencies were found in certification requirements including inspection items not certified as ‘completed’ or ‘not applicable’, and no indication of reference data. Therefore, it could not be established if these specific inspections were, or were not, performed.
Surveillance findings
From 24 October to 1 November 2018, CASA conducted a surveillance event of Encore and released a report documenting their findings. The surveillance was triggered by CASA becoming aware of a Cessna 172 (C172), maintained by Encore that had:
…significant defects and corrosion relating to inspections that should have been identified as part of SIDS [supplemental inspection documents] inspections.[9] The aircraft had been maintained by Encore Aviation and it was clear that significant anomalies related to execution of the mandatory inspections had occurred….
The CASA surveillance report noted that the C172 had been grounded while undergoing maintenance at another maintenance organisation to correct the ‘significant defects and corrosion’. This aircraft was operated by a company offering flight training, and it was expected that it was primarily used for this purpose. As a result of the surveillance, CASA issued three findings, applicable to the C172 and two Cessna 310 (C310) aircraft also maintained by Encore, which identified:
maintenance releases had been issued for certain aircraft, when all required maintenance had yet to be completed
tasks had been certified as complete when not all items within that task had been performed as per the maintenance instructions
various examples of certifications not containing reference data: using a stamp rather than a signature and missing date information.
The certifications identified in the report had been made between June 2016 and April 2018. Findings documented for the C172 aircraft included significant corrosion found in the area of the forward spar of the horizontal stabiliser and trim bracket, with cracking identified in the trim bracket. The horizontal stabiliser is considered a single point of failure for the aircraft, with failure expected to lead to an unrecoverable loss of control. Furthermore, the aircraft maintenance release was issued without a required inspection on the wing root rib being certified in the worksheets or aircraft logbook. This inspection was for the purpose of corrosion detection using non-destructive testing. In addition, CASA identified that the aircraft maintenance release was issued without a required engine mount inspection being performed.
The two C310 aircraft were operated by a company providing charter and aeromedical flights. Findings on these aircraft indicated that inspections on critical aircraft components were not performed, specifically relating to the elevator torque tube, wing lower rear spar carry through, wing lower front spar root, horizontal stabiliser spar attachments and engine support beam. These are all areas representing potential single points of failure leading to loss of control if any of these components failed in-flight.
Alternate options for continuing airworthiness
The Honeywell Aerospace (Honeywell) type-certified equivalent engine is designated the T5313B. The T53-L-13B engine is the military variant, as denoted by the ‘L’ in the model designation. Honeywell advised both engine types are ‘very similar, if not the same. The difference is that Honeywell owns the design and ICA [Instructions for Continued Airworthiness] responsibility for the commercial / type certified version, whereas the US Army is responsible for the design and ICA for the military variant’.
In 2010, Honeywell published a service bulletin T53-0173 R1 to owner/operators, where military variants could be ‘upgraded’ at overhaul, to align with civil standards. Honeywell had identified that ‘maintenance of T53 engines under the US Army and foreign military systems are not equivalent to standards of Honeywell Aerospace. Differences between the maintenance concepts exist in cycle counting, parts procurement, engine assembly tolerances, and general maintenance practices’. While not required by regulations, this ‘upgrade’ would have enabled the engine fitted to HUE to be maintained to Honeywell technical publications, which were routinely updated to represent current best practices. In contrast, the US Army publications had not been updated since 2010, as far as could be determined.[10]
Honeywell vibration maintenance requirements
The Honeywell T53-L-13B engine maintenance manual required a vibration check to be conducted upon installation into the airframe and after ‘repair/replacement of major components’, including:
after compressor blade replacement or compressor blade repair or blending
when excessive engine vibration was suspected.
Honeywell advised that, in 2008, they ‘undertook some actions to ameliorate the risk of exhaust diffuser cracking. Specifically, the power turbine component balance process was enhanced and the vibration limits reduced’. This was initially incorporated at the engine overhaul level (from the factory). These reduced limits were subsequently incorporated in the maintenance manual (T53-L-13B) in 2015. The maximum permissible limits, at specified parameters, were now 1.3 and 1.7 inches per second. In contrast, as noted above, the US Army manual limits were 2.5 inches per second. In addition, the Honeywell maintenance manual required a vibration check after any compressor blade repair, in contrast to the US Army requirement of more than 20 per cent.
Compared to the US Army requirements applicable to HUE, the Honeywell maintenance requirements were more stringent with respect to engine vibration inspections. Although not required, upgrading HUE to this standard may have provided additional opportunities for the detection of emerging engine problems.
Conduct of the forced landing
Height-velocity diagram restrictions
A successful forced landing in a single-engine helicopter can only be achieved if the helicopter has sufficient energy to achieve its required landing deceleration and touch down configuration, and the pilot has sufficient time to initiate a recovery to this configuration. The height-velocity envelope shows the combinations of height above the ground and forward velocity (airspeed), which have been demonstrated by flight test to allow, and which are also predicted to not allow, the pilot to complete a safe landing after an engine failure. These combinations of height and airspeed are primarily for use during the take-off or landing manoeuvre or when manoeuvring at low level, such as in long-line operations.
For single-engine helicopters, the height-velocity envelope for complete power failure must be established by the manufacturer at the time of certification. When constructed in the aircraft flight manual, the height-velocity envelope typically delineates areas that represent safe combinations of airspeed and height, and areas that represent combinations of airspeed and height that should be avoided. The avoid areas are specific to the helicopter design and are normally associated with increasing height and slow or no airspeed flight (hover as is the case with long lining) and low height with high airspeed.
The US Federal Aviation Administration (2019) also stated that:
As the airspeed increases without an increase in height, there comes a point at which the pilot’s reaction time would be insufficient to react with a flare in time to prevent a high speed, and thus probably fatal, ground impact.
Conversely, an increase in height without a corresponding increase in airspeed puts the aircraft above a survivable un-cushioned impact height, and eventually above a height where rotor inertia can be converted to sufficient lift to enable a survivable landing. This occurs abruptly with airspeeds much below the ideal autorotative speed (typically 40–80 knots). The pilot must have enough time to accelerate to autorotation speed in order to autorotate successfully; this directly relates to a requirement for height.
The nature of the long-line operation required HUE to enter the avoid area during the load hook‑up and unhook sequences. Further, comparing the height, airspeed and weight to the height-velocity diagram applicable to HUE established that it was likely within the avoid area at the time of the engine failure. This indicated that the pilot had limited options to manoeuvre following the engine failure.
Pilot decision-making and forced landing
The pilot reported that there were personnel working in and around the drill site when the helicopter was on approach to hook-up the load (the drill site also included a helipad). This was supported by time-lapse images from the drill site, which confirmed ground personnel moving in and around the drill site, including this approach. Consequently, when the engine failed, the pilot attempted to autorotate[11] the helicopter clear of the drill site and towards the river to keep clear of ground personnel. When asked where the pilot would have conducted the forced landing if the drill site was assured to be clear of personnel, the pilot reported that the drill site (Figure 12) would have been used. Figure 12 also shows the high trees and generally inhospitable terrain surrounding the drill site.
Figure 12: Drill site looking in direction of flight
Source: ATSB
The GPS data, time-lapse images (location shown in Figure 12), supplied camera footage from eyewitnesses and witness statements were evaluated to determine the sequence of events from the engine failure to the collision with terrain. At 1417:33, the helicopter was observed approaching the drill site (indicated by Figure 13 ‘A’). Following the loss of engine power (Figure 13 ‘B’), the aircraft started descending and began to accelerate (Figure 13 ‘C’). As the helicopter approached the line of trees at the end of the clearing, the helicopter had accelerated to about 40 kt and was close to the height of the tree canopy (Figure 13 ‘D’ and ‘E’). Around this time, GPS flight data indicated a notable shallowing of the descent profile.
The shallowing descent path was consistent with witness reports describing the helicopter as appearing to ‘float’ over the trees, and that it was not descending quickly until over the trees. Comparison of this glide performance with the published performance charts for HUE revealed this ratio was shallower than the autorotation range performance based on the speed and rate of descent. The pilot reported that, during this time the main rotor speed (RPM) became low. Audio analysis[12] by the ATSB using witness phone footage established that the main rotor speed was about 214 RPM as the helicopter passed over the first line of trees, about two-thirds below the optimal speed of 314 RPM. This suggested that the pilot increased collective pitch of the rotor system to avoid the line of trees prior to reaching the gap in the canopy created by the river below. The pilot stated during interview that the helicopter’s rotor system carried a lot of inertia, and as a result, elected to fly over the trees, knowing that the rotor speed would decay. The pilot’s response was consistent with guidance in the US Army operator’s manual, which stated that a ‘landing in trees should be made when no other landing area is available’. The reduction in rotor speed is a concern during an autorotation as this equates to energy available in the rotor system. As a result, the energy available to arrest the descent rate during landing or to cut through tree branches was reduced.
Lifting operations
Helicopter lifting operations were utilised to demobilise the drill site due to the remote location of the site and to minimise the environmental impact within the Kosciuszko National Park. Consequently, helicopters involved in the lifting operation were required to operate over terrain that was generally not suitable to make a safe landing.
Organisational information
There were four organisations working together during the lifting operation on the day of the accident. GHD Limited (GHD), another geotechnical company contracted by GHD, Heli Surveys and O’Driscoll Aviation. Ground-based geotechnical survey works at the drill site were coordinated by GHD Limited, in conjunction with the geotechnical company (geotechnical crew). GHD was contractually responsible to Snowy Hydro for the safety management of all works to be conducted at relevant sites.
Helicopter operations were led by Heli Surveys. They had a contractual arrangement with Snowy Hydro to provide helicopter services to support the drilling sites at the direction of GHD. In turn, GHD were contractually responsible for ‘liaison and coordination’ with Heli Surveys. As some loads exceeded the capability of Heli Surveys, they sub-contracted O’Driscoll Aviation (HUE) to lift these heavier loads.
GHD reported to the ATSB that they were responsible for safety management for works on the ground and Snowy Hydro were ultimately responsible for the risk management of all operations, both in the air and on the ground. Snowy Hydro reported that GHD were the principal contractor for all operations and therefore, it was their understanding that GHD were responsible for the risk management activities.
The works on the day of the accident followed the completion of a geotechnical survey at the drill site and involved helicopter lifting of all the main drill rig components to the laydown area. This involved three geotechnical workers deconstructing the drill rig and two load-masters from Heli Surveys, with GHD managing the aviation component of the operation. This included preparation of loads for helicopter lifting, providing direction to the helicopter pilots via radio communications, and hooking up loads.
Lifting operations risk assessment and toolbox talk
The pilot reported attending a meeting, referred to as a ‘toolbox talk’, that involved all ground personnel and pilots prior to the lifting operation. The toolbox talk was led by representatives from GHD and Heli Surveys. This discussion included the loads to be lifted by each helicopter and safety considerations. Heli Surveys reported that part of the safety considerations included discussion of a ‘sterile zone’. This sterile zone was reported as being:
…an area where all personnel on the ground are to avoid at all times. This is usually the area on the opposite side of the aircraft to where the pilot sits. The reason for this “zone” is to give the pilot an area to land in if a forced landing is required. Although the area might not be clear of obstacles, the pilot can be confident it is clear of people on the ground.
Further, as part of these discussions, all crew, including the pilot of HUE, signed a ‘pre‑work assessment’ form indicating attendance at the meeting and compliance with the Safe Work Methods Statement. Part of the purpose of the form was to:
…discuss the planned activities and hazards and modify [Safe Work Method Statements] (SWMSs) if required.
GHD, in consultation with Heli Surveys, developed a ‘helicopter operations hazard identification’ register, referred to hereafter as the ‘risk management plan’. According to GHD, this represented the safe work method statement referred to in the ‘pre-work assessment’ form, that applied on the day of the accident. GHD were reliant on Heli Surveys providing subject matter expertise to identify aviation related hazards, risks and controls. Neither of these documents were provided to the pilot before the day of the accident for review, however, the pilot was aware of the general procedures having previously worked with Heli Surveys. A sample of the risk management plan is reproduced in Table 2, noting that only an extract of one assessment is shown for illustrative purposes only.
Table 2: Reproduced sample from risk management plan
Job step
Identified hazards
Mechanism /pathway of harm
Initial risk level (A-D)
Control measures
Residual risk level
Control measures/responsibility for implementation
General site works
Unfit for work
No induction
…
B
Project induction
…
D
…
Safety Management Plan
All Personnel
The risk management plan identified hazards that were assigned an ‘initial risk level’ (Table 2). The specific ‘mechanism’ or ‘pathway’ was also recorded. Control measures were then listed, in order of preference, before being assigned a ‘residual risk level’. The risk management plan consisted of key operational activities grouped into a ‘Job step’, which included general site works (shown in Table 2), driving to site, pre-flight actions, passenger embarkation/disembarkation, mountain flying, ground operations and aircraft refuelling. Some of the job steps identified several pathways of harm to ground personnel during load-lifting as:
Ground operations: ‘Load not slung correctly’, ‘Load not correctly packaged’, and ‘Slung load out of control or not flying correctly’. Controls for this were related to having a lifting plan and ensuring the plan and long-line rigging was correct.
Mountain flying:
‘Lifting loads over buildings/people and wires’, which involved the pilot ’determining the most appropriate flight path away from obstructions and people etc’. Falling trees/branches caused by downwash were also considered for the load drop-off site. However, these controls related to the helicopter with an attached load or at the drop-off site.
‘Aircraft collision with spectators, objects, animals, during take-off and landing’. This had the associated risk control of ‘spectators are to be kept clear by ground personnel. If no ground personnel are present and spectators cause undue risk, an alternative landing site must be found’.
The hazard of an ‘emergency situation’ was also included in the risk management plan. Controls for this stated:
Each emergency situation is different and requires a unique set of procedures. All procedures set out in the Pilots Operating Handbook and the Flight Manual must be followed.
However, there were no control measures that explicitly addressed the risk to people underneath the helicopter for that hazard.
Despite the above, there was no specific job step for load-lifting operations in the risk management plan. Further, the risk management plan did not consider the risks to ground personnel when the helicopter was on approach to pick-up a load, which was where the engine failure occurred.
Retention of the long-line
In the days prior to the accident flight, the pilot was involved in bush firefighting operations on behalf of the New South Wales Rural Fire Service (NSW RFS). Equipment utilised during firefighting operations consisted of a long-line, connected to the helicopter belly-mounted hook. A Bambi Bucket was connected to the remote hook, at the base of the long-line. The remote hook worked independently to the belly hook and was powered by an electrical cable attached to the long-line (depicted in Figure 6). A Sacksafoam kit, which was used to provide a precise quantity of fire-retardant foam to the Bambi Bucket, was also fitted.
The Sacksafoam kit used in HUE consisted of a case located in the helicopter, which delivered the foam to the bucket via a hose. The kit included a short hose and junction, that reached from the case, around the fuselage, to the aircraft hook area. The helicopter operator then supplied the remaining length of hose required to deliver the foam to the bucket itself. An orange protective sheath held the second length of hose, electrical cables, and long-line together along the length of the line.
It was identified that a screw clamp (Figure 14) and barbed fitting had been utilised at the Sacksafoam-to-operator hose junction, located near the aircraft hook assembly. This was in contrast with the installation manual, which required the hoses to be connected via a barbed connector, without the use of clamps. The purpose of the barbed connector was to allow the hose to disconnect in the event of the long-line and bucket being released by the pilot from the belly hook in an emergency. It was this ‘clamped’ hose that prevented the complete release of the long-line from HUE.
The pilot reported that the screw-clamp had been fitted (Figure 14), in addition to the barbed fitting, to prevent the hose from ‘popping’, and leaking corrosive foam from the hose junction.
Figure 14: Operator hose with screw clamp installed
Source: ATSB and SEI Industries, annotated by the ATSB
Survival aspects
Pilot injuries
The pilot was wearing a helmet and lap-belt on the accident flight. During the impact sequence, the pilot sustained serious injuries, including a fractured right eye socket and nose. In addition, the pilot also suffered ligament damage surrounding the ribs, and ligament and tendon damage around both ankles and left knee.
Post-accident response
After witnessing the accident, video footage showed four of the workers at the drill site gathering fire extinguishers and immediately moving in the direction of the helicopter before the sound of the impact. One of the loadmasters stayed at the drill site and called for help via satellite telephone and radio. Upon arrival at the accident site (Figure 5), the first responders noticed fuel leaking down the outside of the fuselage. Fire was also observed in the area of the engine bay and fire extinguishers were deployed toward this area to extinguish the fire. Meanwhile, two workers assisted the pilot, who was unable to exit the wreckage, with moving safely away from the helicopter before commencing first aid.
The pilot of another helicopter (supporting the Snowy 2.0 project), who heard the Mayday call, flew to the drill site and dropped off three additional workers to assist. These workers gathered additional first aid supplies and assisted with rescue coordination. A third helicopter (also supporting the project) arrived at the site about 24 minutes after the accident, with two medical personnel. About 2 hours after the accident, the injured pilot was winched from the site and transported to hospital.
Liveable space
Measurements of the floor pan against published dimensions revealed no detectable deformation in the area where the pilot was sitting. This included the area of the floor pan from the position of the rudder pedals to the rear of the pilot’s seat. Furthermore, the wreckage examination did not reveal evidence of any intrusions to the occupied area. Therefore, the area occupied by the pilot did not appear to have been compromised during the accident.
Cockpit interior damage
The left side of the instrument panel and sunshade were damaged, consistent with being pushed forward from within the cabin in front of the pilot’s seat (Figure 15). For comparison, the right-side dash panel was undamaged. Although the windscreen exhibited extensive cracking, a localised concentration of damage was present in front of the left pilot seat, the position occupied by the pilot. The damage to the cockpit and injuries sustained were consistent with the pilot’s upper torso flailing forward during the accident sequence, sufficient for the pilot’s helmet and face to strike the instrument panel sunshade and windscreen.
Figure 15: Interior instrument panel sunshade and windscreen damage adjacent to pilot
Source: ATSB
Occupant protection systems
The pilot’s seat was fitted with a 4-point lap-belt and shoulder harness on an inertia reel. However, the shoulder harness (upper torso restraint (UTR)) was not worn. The pilot stated that, due to the nature of the long-line operations, it was not possible to use the shoulder harness and lean left into the door bubble-window to view the long-line and maintain the helicopter position for load hook-up and unhook operations. The helicopter was not fitted with energy absorbing seats designed to minimise vertical accelerations during impact, although this did not appear to influence the pilot injuries.
Flail analysis
The ATSB estimated the extent of pilot upper torso movement while restrained by the lap-belt worn at the time of the accident. This was focussed on backward horizontal accelerations leading to the pilot flailing forward. Two independent methods were adopted. The first assumed a circular arc traversed by the pilot’s head. The second method, derived from an empirical study by Young, J.W. (1967), was scaled for the sitting height (94 cm) of the accident pilot. The second method also provided an assessment of the probable movement a UTR was worn by the pilot.
Figure 16 shows a head forward flail circular arc, which indicated that the pilot’s head could contact the instrument panel and windscreen if restrained only by the lap-belt. Projections indicated the middle third of the pilot’s head aligned with the instrument panel and sunshade.
Figure 16: Pilot seat and cockpit side view with circular arc based on pilot sitting height
Source: ATSB
Young’s (1967) study compared the effectiveness of lap-belts combined with various UTRs and lap-belt only. This study found that there was a significant difference in forward and downward motion between using any shoulder harness and lap-belt compared to wearing only a lap-belt. This was based on head kinematics recorded in the vertical plane for a dummy weighing 82 kg and a sitting height of 97 cm, on a sled travelling at about 45 km/h prior to impact. Using the results of this study, assessments were performed by the ATSB to indicate the range of forward movement of the accident pilot for two scenarios – with, and without the use of a UTR (Figure 17).
The left diagram of Figure 17 shows the empirical projections of the dummy wearing a lap-belt only (from Figure 4 of Young (1967)) intersecting the approximate location of the instrument panel and sunshade. In contrast, the right diagram shows considerable distance between all dummy projections and the instrument panel (Figure 11 of Young (1967)). These results were consistent with the instrument panel damage and injuries sustained by the pilot.
Figure 17: Comparison of lap-belt and UTR effectiveness, with approximate location of HUE instrument panel and sunshade
Source: Young (1967), annotated by the ATSB
Upper torso restraint use
Benefits of upper torso restraint use
When correctly worn, UTRs form an important part of the occupant protection system in aircraft, and the benefits in reducing the likelihood and severity of injuries is well established. A significant benefit of correctly fitted UTRs is the minimisation of body movement to prevent the body striking the aircraft structure in lateral and longitudinal impacts, as established by Young (1967). There is also evidence to suggest that UTRs may assist to align the spine in an anatomically ideal position during vertical impacts (Laananen, D.H., 1983, as cited in Coltman, 1985).
Research into previous helicopter accidents revealed no serious or fatal injuries in a sample of longitudinal-type impacts where occupants wore a UTR, ‘even at very high velocities’ (Coltman et al., 1985). In comparison, occupants not wearing a UTR were found to consistently sustain severe or fatal injuries at longitudinal impact speeds above 25 km/h, indicating the effectiveness of UTRs in preventing impact injuries to the head and torso. These findings are supported by accidents in fixed-wing aircraft, in which the US National Transportation Safety Board (2011) found that pilots who used lap-belts only were nearly 50 per cent more likely to be seriously or fatally injured compared with those who wore lap-belts with UTRs.
Vertical reference flying in Australia
Long-line operations, as was being conducted in this instance, require the pilot to rotate their upper torso so they can look out and down through a bubble-window, during the load hook-up and unhook stages of the flight. This type of operation is referred to as vertical reference flying.
The most significant proportion of vertical reference flying operations were expected in firefighting operations, with more than 20,000 firefighting flights conducted in Australia in 2018.[13] Some of these flights may not require vertical reference flying techniques, such as fire spotting, and firefighting using integrated tanks and a snorkel. However, a significant number of these flights are likely to be vertical reference flying. In addition, about three-quarters of firefighting flights were conducted using single-engine helicopters. Firefighting operations were the majority of the flying performed by the pilot of HUE.
Vertical reference flying techniques are also used for construction sling-load work, similar to the accident flight. About 3,000 flights per year were recorded for construction sling-load work in 2018, mostly involving single‑engine helicopters.
Utilisation of upper torso restraints
Investigated occurrences
To identify the state of UTR use during vertical reference flying operations, a review of investigated aviation safety occurrences was conducted. This involved searching the ATSB’s aviation occurrence database and for comparison, the website of the Transportation Safety Board of Canada (TSB). The TSB were selected due to Canada being known to have a considerable amount of vertical reference flying activity. Australian investigations were identified using a regular expressions-based[14] search for terms commonly indicating the conduct of vertical reference flying. Canadian investigation records were identified by a text search for ‘long line operations’. These records were then manually verified as vertical reference flying operations and reviewed for evidence of UTR use.
At least[15] 14 Australian and 9 Canadian investigations involved the conduct of vertical reference flying operations between January 2000 and June 2020 (Figure 18). From the 14 Australian investigations it was found that 4 pilots confirmed they did not wear their UTR (recorded as ‘No’ in Figure 18), 1 partially wore it (recorded as ‘Partial’), 1 did wear it, and 8 were unknown. For the partially worn case, it was found that the UTR provided no benefit due to it being incorrectly worn. Therefore, where the use of UTR was determined,[16] it was found that 67 per cent (4/6) of pilots were not wearing their UTR, and 83 per cent (5/6) when considering cases where the UTR was not effectively worn. This result was consistent with known cases in Canadian investigations. When considering all investigated occurrences (including unknown cases), at least one-third of pilots conducting vertical reference flying were not correctly wearing a UTR.
The confirmation from several pilots in Australian investigations that they were not wearing their UTR was consistent with the physical restriction it would impose on rotating the upper torso for vertical reference flying. This was supported by one of the TSB investigations that stated ‘as is typical with many pilots involved in vertical reference flying, the pilot did not use the shoulder restraint system provided’ (TSB report A08P0265).
Figure 18: Number of pilots in ATSB and TSB investigations involving vertical reference flying by upper torso restraint use, January 2000 to June 2020
Source: ATSB
Industry experiences
The ATSB held a meeting with the Australian Helicopter Industry Association (AHIA) to discuss the issue of UTR use for vertical reference flying in light of investigation findings.
In general, investigations identified factors such as cockpit dimensions and seatbelt design probably contributed to the lack of UTR use by pilots conducting vertical reference operations. For example, ‘Most helicopters are not designed or certified to accommodate vertical reference external load operations; however, these operations are very common and pilots fly in this higher‑risk environment without proper safety-restraint devices’ (TSB report A05P0103). When these findings were reviewed by the AHIA, it was generally agreed that this practice was probably adopted due to the sideways leaning required by the pilot during vertical reference flying, rather than for reasons of comfort.
During the meeting with AHIA, the limitations of the accident helicopter were discussed. Helicopters such as HUE were expected to present greater challenges to vertical reference flying due to the distance between the pilot seat and door, coupled with an older-style seat-belt webbing being fitted. This was despite having a number of modifications to assist leaning into the bubble‑window to look down, such as some of the cockpit instruments being duplicated and mounted on the door. It was reported that, despite these modifications, the design of the harness inertia lock release mechanisms were generally insufficient to allow pilots to lean outside without a work-around, even if fitted with modern harnesses. One such reported work-around was wearing the UTR, but slipping one strap underneath the arm to aid leaning out and prevent the belt pressing into the pilot’s neck.
The consensus from the AHIA representatives was that the previous and current investigation findings were generally consistent with their collective experience. It was agreed that lack of UTR use or wearing the UTR differently to that recommended, was a commonly adopted practice during vertical reference flying. Specifically, due to the UTR impeding a pilot’s ability to effectively conduct vertical reference flying operations. This was expected to affect multiple helicopter types frequently used in long-line operations that were not initially designed for this purpose. However, they also acknowledged there was no readily available market solution.
Solutions for restraint in vertical reference operations
A small number of helicopter models are specifically designed for vertical reference flying. These helicopters allow the pilot to conduct vertical reference flying while being fully restrained. However, these helicopters were expected to form a small proportion of vertical reference operations in Australia.
The ATSB was also aware of a number of innovations to assist in the conduct of vertical reference flying. These innovations were available to be retrofitted to helicopter models not specifically designed for regular vertical reference operations. For example, the fitment of light-weight webbing. It was reported that light weight and low friction webbing of these seatbelts would probably assist with vertical reference flying. However, these seatbelts were generally fitted within the existing guide mechanisms on the helicopter. As a result, it was expected that work‑around solutions, such as tucking the seat-belt under the arm were likely to still be required.
Reports have also been received about tilting seats fitted to some helicopters. These allow the pilot to remained fully harnessed, with the entire seat assembly tilting outside the helicopter structure to allow vertical reference flying. The accident pilot reported that these seats were limited for taller pilots. At the time of writing, it could not be ascertained how many, if any, of these systems were used in Australia.
Injuries associated with damaging vertical reference flying accidents
A short study was conducted by the ATSB to evaluate the possible influence of UTR use on accident-related injuries sustained during vertical reference flying operations. This involved comparing the proportion of accidents with injuries between vertical reference flying and the mean of all other helicopter aerial work, where the helicopter was substantially damaged or destroyed. These accidents were intended to represent scenarios where the flight crew would have experienced significant in-cockpit accelerations.
From the sample, it was found that flight crew were significantly more likely to receive an injury in a vertical reference flying accident where the helicopter was substantially damaged or destroyed compared to the mean of all other helicopter aerial work. It was identified that for two of these, including this accident, head injuries were likely sustained or made more severe due to improper, or lack of UTR use. While it was possible that these injuries contributed to the difference in the proportion of injuries between the two groups, this was unable to be determined as the nature of injuries or UTR usage in other aerial work was not known. This supports the need for further research in this area. Further results, including the methodology for this study can be found in Appendix A – Injuries associated with vertical reference flying compared to other aerial work operations.
While conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales, VH-HUE (HUE) experienced an engine failure. During the subsequent forced landing, the helicopter collided with trees and a riverbed. The pilot sustained serious injuries and the helicopter was destroyed.
This analysis will discuss the factors contributing to the engine failure, including the maintenance procedures and practices that were in place at the time and the opportunities to identify the developing engine issue. It will also examine the limited options available for the forced landing, increasing the severity of the impact, and the risk management planning for personnel working near or underneath the helicopter in the event of an emergency landing. The limited ability for pilots to wear an upper torso restraint (UTR) during long-line operations will also be reviewed. Further, the retention of the helicopter long-line during the accident sequence, and the positive influence of ground personnel in recovering the pilot and reducing the potential severity of injuries are also discussed.
Engine exhaust diffuser inner strut fractures
While on approach for the twelfth lifting operation of the day, the pilot heard a mechanical ‘screaming’ noise, followed immediately after by a complete loss of engine power. The ATSB’s wreckage inspection identified cracking and missing material in the engine exhaust diffuser housing. Further examination of the engine by the manufacturer revealed extensive fatigue cracking led to the failure of the exhaust diffuser inner struts, which position the power turbine shaft. The loss of internal support resulted in interference between the power turbine shaft and compressor shaft, and subsequent failure of the engine.
Engine inspections
Following their examination of the engine, the manufacturer concluded that the cracking in the exhaust diffuser area was likely visible in at least the previous two phased maintenance inspections, which was at least 171 flying hours before the accident. Furthermore, 34 daily inspections had also been certified during this period. Another eight separate visits to the helicopter maintainer had also occurred during this time.
The phased maintenance inspections were typically conducted in a hangar by a licenced aircraft maintenance engineer (LAME) and involved a detailed inspection of the engine, where a higher level of scrutiny was expected. The daily inspection could be conducted and certified by a LAME or a pilot. This required a visual examination of the exhaust diffuser area, generally conducted in the field using a ladder, torch and mirror, which should have been sufficient to identify the cracks. However, there was a difference in understanding between the pilot and LAME as to who was responsible for conducting the daily inspections on HUE when in the field. Therefore, it was likely that the exhaust diffuser area daily inspection was not completed for all, or part of the period they were operating together with HUE.
Had the missing material and cracking been identified in any of these inspections, it would be reasonable to expect that further investigation of the exhaust diffuser would have been conducted. This would have typically involved removal of the engine for examination at an overhaul facility. However, for reasons that could not be determined, the missing material and visible cracking in the exhaust diffuser area was likely present, but not identified in either the phased or daily inspections, prior to propagating to the point of failure.
Maintenance practices and processes
The engine manufacturer concluded that the cracking in the exhaust diffuser would have been visible at the last phase inspection about 20 hours prior to the accident and likely visible at the preceding inspection about 171 hours before. These inspections were performed at Encore Aviation by two different LAME’s, neither of whom detected the cracking or the missing material. Similarly, another aircraft maintained by Encore Aviation was found to have significant defects and corrosion in critical components, which were not identified during routine maintenance, but were detected by another organisation. Also, two other aircraft that were used for passenger-carrying operations did not have inspections performed on critical components.
In addition to routine maintenance inspections, trend monitoring provides another mechanism for identifying engine deterioration, and the malfunction of engine components and accessories. In this case, the United States Army technical publication detailed when vibration checks were to be conducted on the engine type fitted to HUE and the maximum permissible limits. When adhered to, these should enable a component to reach its expected service life.
A vibration check had been conducted when the engine was installed in late 2016 and was recorded as being ‘within limits’. However, the actual vibration levels were not documented. Rather, the maintenance organisation’s standard practice was to rely on the internal memory in the test equipment for retaining a record of these values, which were subsequently deleted when the machine failed. While compressor blade repairs were conducted in early 2018, there was insufficient information available in the maintenance documents to establish if a vibration check was required and/or if one was conducted. Irrespective, this data could have been used as a baseline figure for comparison with future vibration checks to assist with trend monitoring. This was particularly relevant in this case given that the cracking resulted from high-cycle fatigue likely from excessive vibration of the power turbine.
The investigation also noted that an engine component associated with the power turbine assembly supported by bearings in the exhaust diffuser was replaced four times over a period of about 150 flying hours. In addition, the drive between the same engine component and the power turbine was also replaced during this time. The maintenance records did not detail the exact nature of each unserviceability, which provided limited information for identifying trends to detect anomalies. Therefore, it could not be established if this was also related to power turbine vibrations. Regardless, the repetitive replacement of a component should be cause for further investigation as trend monitoring has been shown to enable early detection of developing issues.
In addition to the above, the ATSB’s review of the 2018 maintenance records for HUE found inconsistencies in the documentation with regard to certification requirements. Likewise, following an audit in late 2018, the Civil Aviation Safety Authority also identified discrepancies regarding incomplete documentation and tasks being certified as completed although some had not been completely performed, covering the period 2016 to 2018. They subsequently issued three findings to the maintenance organisation.
While the ATSB was unable to review Encore Aviation’s operating procedures, the above demonstrates short comings in their maintenance practices and processes relating to inspections, record keeping and trend monitoring. Therefore, as was the case for HUE, it was unlikely that they were sufficient to detect the potential impending failure of safety critical components.
Forced landing
The lifting operation was being conducted over remote and mountainous terrain, with the drill site, that included a helipad, as the only clear area for a landing. On the day of the accident, ground personnel were observed moving in and around the drill site, including when HUE was on approach for the twelfth load. Therefore, when the engine failed, the pilot was not assured that the drill site was clear of personnel underneath. Consequently, out of concern for these people, the pilot moved HUE away from the drill site towards a river, which required the helicopter to clear a line of trees.
To clear the drill site and trees, the pilot had to reduce the rate of the autorotative descent, which resulted in sacrificing main rotor speed for range. Any loss of rotor speed will reduce the energy available for the rotor blades to cut through trees and arrest the rate of descent before contact with the ground. The helicopter subsequently impacted trees, leading to a complete loss of control before impacting the riverbed about 250 m away from the drill site. The combination of these factors likely contributed to the severity of the impact.
Alternatively, if the pilot was assured that ground personnel were clear of, or able to clear the drill site following the engine failure, the drill site and associated cleared area may have provided a suitable area for a forced landing. The option of a suitable forced landing site within the normal autorotation range profile would have allowed the pilot to use the stored rotor energy to conduct a normal autorotative landing and significantly reduce the risk of serious injuries.
Risk assessment for lifting operations
While the GHD risk management plan considered ground personnel during load lifting and take-off or landing, it did not capture hazards associated with the approach to, and during load hook-up. Consequently, the hazard of personnel being struck by the helicopter was not identified in this plan for the accident phase of flight. Similarly, risk controls in the event of an emergency did not specifically address the risk to personnel working near or underneath the helicopter. This indicated that, following an engine power loss, the documented plan would require the pilot in command to conduct the emergency landing, while also communicating with ground personnel to ensure they were clear of the drill site, which included the load pick-up area.
In this case, the pilot and witness statements, and time-lapse imagery, showed that the situation developed rapidly, with little time for decision-making and coordination. Although, it was reported that ‘sterile zone’ protocols were discussed, these were not documented in the risk management plan, despite other hazards and controls being identified. Therefore, a pre‑established plan detailing the actions and expectations of the pilot and ground personnel in the event of an emergency during this phase of flight would have been more ideal. This could have been achieved during a hazard identification workshop and documented in the risk management plan. This would have provided a prompt for the briefing on the day during the ‘toolbox talk’ and acted as an additional reference to those involved in the lifting operation.
Snowy Hydro contracted several organisations in support of the Snowy 2.0 project for the ground-based survey works and helicopter support. While the roles of each organisation were clear, there appeared to be a misunderstanding as to who was responsible for safely integrating the ground and air operations. This likely resulted in less oversight of the overall operation than was intended. This may have influenced the risk management plan not being sent to the accident pilot prior to the ‘toolbox talk’, which may have provided further opportunity to explicitly capture certain aspects of the load‑lifting operation.
Preplanning for an emergency situation is a critical component of risk management. For HUE, none of the controls in the risk management plan addressed the hazard of an emergency landing when on approach for load pick-up. As a result, this plan did not provide assurance to the pilot that ground personnel would be clear of the area if a forced landing at the drill site was required. This likely resulted in the pilot’s decision to attempt the forced landing away from the drill site to a less suitable location.
Upper torso restraint
The pilot was not wearing a UTR at the time of the accident as it interfered with the vertical reference flying that was being conducted. Consequently, the collision resulted in the pilot flailing forward at the waist and the pilot’s face impacting the instrument panel. The impact with the panel resulted in the pilot sustaining serious facial injuries. Although wearing a helmet probably reduced the potential for non‑facial head injuries, the helmet did not provide facial protection for the impact with the panel.
If the UTR fitted to the helicopter had been worn by the pilot, this would have significantly reduced the forward flailing motion of the pilot’s torso. Flail analysis of the potential torso movement with a UTR revealed it was virtually certain that the pilot’s face would not have struck the panel and therefore, would not have sustained the associated facial injuries. However, the ATSB noted that there appeared to be very limited after-market solutions currently available to the problem of vertical reference flying with a correctly worn UTR.
Upper torso restraints in vertical reference flying
In the last 21 years, from the ATSB investigations in which the use of a UTR was known, it was found that 83 per cent of pilots involved in vertical reference flying accidents were not effectively wearing the UTR, including the accident pilot. This was consistent with investigations from Canada and the experience of local industry members, who reported that it was a common practice for the UTR to be either partially worn or not at all.
In a short study of accidents where the helicopter was substantially damaged or destroyed, it was found to be significantly more likely for injuries to occur during vertical reference flying compared with the mean for other helicopter aerial work. This included two accidents where the head injuries were likely incurred from improper or lack of UTR use. This was consistent with the available literature, where it was found that wearing a lap-belt and UTR considerably reduced the likelihood of a fatal or serious injury to pilots in the event of an accident. In contrast, wearing a lap‑belt only significantly increased the chances of pilots sustaining upper body injuries. Therefore, the lack of use of the UTR was considered to be a large reduction in safety margins. Since most vertical reference flying in Australia is conducted for firefighting activities, this is currently the sector with the greatest exposure.
Therefore, based on investigation findings and reported industry experience, it was likely that UTRs were not routinely worn by a notable proportion of pilots during vertical reference flying. They were considered unlikely fit-for-purpose due to of the pilot’s inability to effectively view the long-line underneath the helicopter. This problem likely extended across the Australian helicopter industry and was not specific to the accident pilot or helicopter type.
Sacksafoam hose attachment
In response to the engine failure, the pilot attempted to jettison the long-line and strops from the helicopter. This opened the airframe mounted belly hook, which released the long-line, and the remote hook at the end of the long-line (via the electrical cable), which jettisoned the lifting strops. However, the wreckage examination established that the long‑line, which remained tethered by the Sacksafoam hose, did not fully detach from the helicopter. The fitment of a screw-clamp, installed by the pilot for firefighting operations in addition to the barbed connector, likely prevented the separation of the operator hose from the Sacksafoam hose. In turn, this prevented the long‑line from completely detaching. Although the retained lifting equipment did not contribute to the collision with terrain in this instance, it presented a snagging hazard, which increased the risk of a higher severity occurrence.
Emergency response
Prior to the sound of the helicopter impact, members of the ground personnel departed the drill site, with fire extinguishers and a first aid kit, and headed in the direction of the accident site. They assisted the pilot out of, and away from the helicopter, where medical aid could be administered. In addition, they extinguished a small fire in the engine bay, mitigating the risk of this, combined with leaking fuel, developing into a fuel-fed fire. These actions likely reduced the risk of more severe injuries to the pilot.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision with terrain involving a Garlick Helicopters UH-1H, VH-HUE, 24 km south-east of Talbingo, New South Wales, on 17 April 2018.
Contributing factors
On approach for a long-line lifting operation, the inner struts of the engine exhaust diffuser fractured as a result of fatigue cracking, which led to a complete loss of engine power.
The fatigue cracks in the exhaust diffuser were likely present, but not detected in at least 34 daily and 2 phased maintenance inspections.
Encore Aviation's maintenance practices and processes related to inspections, record keeping and trend monitoring, were likely inadequate to detect the potential impending failure of safety critical components. (Safety issue)
The pilot did not have assurance that ground support personnel could vacate the drill site in an emergency. As a result, although the engine failed close to the cleared area, the pilot conducted the forced landing to a less suitable location, increasing the severity of impact forces during the subsequent collision with terrain.
GHD's documented risk assessment for helicopter operations did not consider the hazard of an emergency landing at the drill site. This increased the risk that ground personnel were not clear of the load pick-up area in the event an emergency landing was required. (Safety issue)
The upper torso restraint fitted to the pilot's seat was not worn during the long-line operations, which virtually certainly resulted in the pilot sustaining serious head injuries from the collision with terrain.
Upper torso restraints were likely not routinely worn by a notable proportion of pilots conducting vertical reference flying operations in Australia, as they were likely not fit-for-purpose, increasing the risk of serious injury in the event of an accident.
Other factors that increased risk
A screw-clamp was retrofitted to the firefighting retardant delivery hose, which prevented the long-line from being released from the helicopter during the emergency.
Other findings
The immediate response of the ground personnel to extinguish a small fire and assist the pilot to exit the helicopter, likely reduced the risk of more severe injuries to the pilot.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Encore Aviation's maintenance practices and processes related to inspections, record keeping and trend monitoring, were likely inadequate to detect the potential impending failure of safety critical components.
Safety issue description: GHD's documented risk assessment for helicopter operations did not consider the hazard of an emergency landing at the drill site. This increased the risk that ground personnel were not clear of the load pick-up area in the event an emergency landing was required.
Glossary
AC
Advisory circular
AHIA
Australian Helicopter Industry Association
BITRE
Bureau of Infrastructure, Transport and Regional Economics
CAAP
Civil Aviation Advisory Publication
CASA
Civil Aviation Safety Authority
EST
Australian eastern standard time
FAA
United States Federal Aviation Administration
GPS
Global positioning system
ICA
Instructions for Continued Airworthiness
KNOTS
Nautical miles per hour
LAME
Licenced aircraft maintenance engineer
N2
Rotational speed of the power turbine
NSW RFS
New South Wales Rural Fire Service
NTSB
United States National Transportation Safety Board
PT
Power turbine
QCPM
Quality Control and Procedures Manual
RPM
Revolutions per minute
SIDS
Supplemental Inspection Documents
SMS
Safety management system. A systematic approach to organisational safety encompassing safety policy and objectives, risk management, safety assurance, safety promotion, third party interfaces, internal investigation and SMS implementation.
SWMS
Safe Work Method Statement
TSB
Transportation Safety Board of Canada
US
United States
UTC
Coordinated Universal Time
UTR
Upper torso restraint
Sources and submissions
Sources of information
The sources of information during the investigation included:
accident witnesses
Airservices Australia
the Bureau of Meteorology
the Bureau of Infrastructure, Transport and Regional Economics
the Civil Aviation Safety Authority
Encore Aviation
GHD Limited
Honeywell Aerospace
the pilot of the accident flight and another pilot who conducted flights for the operator
recorded data from the GPS unit on the aircraft
Snowy Hydro Limited.
References
Civil Aviation Safety Authority (2007). Safety Management Systems: An Aviation Business Guide, Canberra, Australia.
Coltman, J.W. Bolukbasi, A.O. Laananen, D.H. (1985). Analysis of Rotorcraft Crash Dynamics for Development of Improved Crashworthiness Design Criteria, DOT/FAA/CT-85/11, US Department of Transportation, Federal Aviation Administration.
National Transportation Safety Board (2011). Airbag Performance in General Aviation Restraint Systems, Safety Study, NTSB/SS-11/01, Washington, D.C.
Young J.W. (1967). Functional Comparison of Basic Restraint Systems. Federal Aviation Administration, Office of Aviation Medicine Report No. AM 67-13.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Australian Helicopter Industry Association
Bureau of Infrastructure, Transport and Regional Economics
Bureau of Meteorology
chief engineer
Civil Aviation Safety Authority
Encore Aviation
field-based LAME
Garlick Helicopters
GHD Limited
Heli Surveys Pty Limited
Honeywell Aerospace
Mulligan Geotechnical Pty Ltd
pilot
Snowy Hydro Limited
United States National Transportation Safety Board.
Submissions were received from:
Australian Helicopter Industry Association
Bureau of Infrastructure, Transport and Regional Economics
Bureau of Meteorology
Civil Aviation Safety Authority
Encore Aviation
Garlick Helicopters
GHD Limited
Heli Surveys Pty Limited
Honeywell Aerospace
pilot
Snowy Hydro Limited.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Injuries associated with vertical reference flying compared to other aerial work operations
This Appendix documents a short study conducted by the ATSB to provide further context of the relative exposure to injury during vertical reference flying operations to complement the analysis related to occupant protection systems. The objective of this study was to identify the chances of receiving an injury during an accident when conducting vertical reference flying compared to the mean of all other aerial work operations. To achieve this, statistical assessments comparing proportions of injuries to damage between groups were performed. The characteristics of injuries sustained are also discussed.
Methodology
Records from the ATSB’s occurrence database were extracted for review. Two groups of interest were identified in the study: vertical reference flying operations; and all remaining helicopter aerial work operations. To identify vertical reference flying operations, records were extracted when terms indicating fire control or other sling-load operations were identified. Preliminary results were then manually verified to include only those operations likely to involve long-line operations. The following fire control helicopter operations were excluded from these results: helicopters using integrated tanks drawing water through a snorkel (not using a fire bucket); winching or transporting fire control crews; and reconnaissance and fire spotting.
Only occurrences where the helicopters were substantially damaged or destroyed (accidents) were selected for analysis. These were selected as an indicator of significant whole of airframe accelerations. Consequently, it was expected that people on board were more likely to have experienced significant accelerating forces during impact that may lead to injuries. Accidents where the pilot experienced larger forces were also more likely to require the fitted restraint systems to mitigate injury risk. These accidents typically involved collisions with terrain or hard landings into clear and unsuitable areas.
A small number of vertical reference flying accidents were identified where substantial damage occurred, such as a tail rotor collision with a water bucket on the ground, where minimal accelerations were anticipated. However, these were included in this analysis to allow a fairer comparison with other aerial work operations where the damage was not characterised.
Results
Comparisons of injury proportions with other aerial work
Between 2000 and 2019, 15 accidents[17] were identified involving vertical reference flying where the helicopter was substantially damaged (13 accidents) or destroyed (2 accidents). Over the same period, 329 damaging accidents were identified for remaining aerial work operations.
The relative likelihood of accidents with injuries is shown in Figure A1 in comparison to the mean of all remaining aerial work operations (percentage of accidents where injuries occurred when the helicopter was substantially damaged or destroyed). Values were calculated based on the highest injury sustained to a flight crew member[18], meaning that each accident was only counted once.
Figure A1: Percentage of accidents with substantial damage or helicopter destruction by highest crew injury for vertical reference flying and other helicopter aerial work, 2000 to 2019
One fatal, three serious and five minor highest injury accidents with substantial damage or airframe destruction occurred for vertical reference flying, equating to 60 per cent (9/15) for this operation. In contrast, about 35 per cent (114/329) of all other helicopter aerial work accidents with the same damage categories resulted in injuries. The mean for all other helicopter aerial work produced a significantly lower percentage of accidents with injuries in comparison to vertical reference flying.[19] Considering only serious and minor injury accidents as an indication of known survivable impacts, the difference was also significant between vertical reference operations and all other helicopter aerial work.[20] This indicated that it was very likely that the chances of an injury were higher during vertical reference flying, than the mean of all other aerial work, in survivable impacts.
Injury characteristics
To identify the possible injury mechanisms, the characteristics of injuries sustained by specific body area were examined for each of the nine injury-related vertical reference flying accidents. This was also compared to known usage of upper torso restraints (UTRs). A limiting factor was that injuries were not known for the remaining all other aerial work operations. As a result, it was not possible to establish if differences existed between injury severity mechanisms, such as lack of UTR use, between the two groups.
Head injuries were identified in four accidents involving vertical reference flying. Upper torso restraints were not worn by two of these pilots: this accident (AO-2018-031) and a non‑survivable accident (AO-2018-057). Another head injury occurred when the UTR was worn loosely (AO-2009-076). In the two survivable accidents, the lack of use, or incorrect use of the UTR probably increased the severity of the injuries leading to facial fractures and hospitalisation.
It was uncertain how the fourth head injury occurred, with investigation (200300011) concluding that this probably resulted from striking the helicopter door frame or being struck in the helmet by the main rotor blade. However, it was unable to be determined if the pilot was wearing a UTR.
The serious injury accident involving spinal fractures (AO-2009-081) likely resulted from vertical acceleration forces through the seat during impact, following descent into trees. In this accident, the utilisation of the UTR was not examined, and it was not recorded if these restraints were worn. However, it was not expected that these would have prevented the serious back injuries sustained by the pilot in this case. Smalls cuts and scratches were reported in two minor injury accidents with one including seatbelt bruising and ligament or tendon damage on the pilot’s left shoulder from the UTR. The nature of the two other minor injuries were not recorded.
In summary, two of the three survivable accidents (including this accident) with head injuries likely resulted from the pilot’s head striking the airframe structure. In these two cases, investigations found that this was related to the lack of use, or incorrect use of UTRs.
Conclusion
In conclusion, it was found to be significantly more likely to receive an injury during vertical reference flying compared to the mean of all other helicopter aerial work activities. Two of the three survivable impacts with head injuries during vertical reference flying accidents were likely made more severe due to limited or no UTR use. Although it was possible that these injuries contributed to the difference between the proportion of injuries between the two groups, this was unable to be determined as the nature of injuries or UTR usage in other aerial work was not known. This supports the need for further research in this area.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 06/06/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
On 17 April 2018, the pilot of a Garlick Helicopter UH-1H, registered VH-HUE, was conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales. This operation was part of a proposed expansion of the Snowy Mountains Hydro-electric Scheme, known as the Snowy 2.0 project. The onsite ground crew consisted of two loadmasters, who had VHF/UHF radio communications with the helicopter, and three additional workers.
Figure 1: Accident location of VH-HUE
Accident site location approximately 24 km SSE of Talbingo Township. Source: Google Earth
After completing a number of earlier lifts, the pilot was positioning the helicopter to lift the motor of a drill rig. As the helicopter approached, the load master advised by radio that he needed some more time to prepare the rigging for the next lift and requested that the pilot to hold off for a short time. The pilot repositioned the helicopter approximately 700 metres north-east and maintained a hover while waiting for clearance to commence a forward approach to the intended lift. The pilot recalled that weather conditions were ideal in the valley with a slight breeze and good visibility (Figure 2). Wind observations[1] recorded approximately 45 minutes later at Cabramurra (18 km away), were 11 km/hr from the west.
While waiting for radio clearance to lift the drill rig motor, the pilot recalled that he had time to conduct a full systems check and that all instruments indicated the helicopter was operating in the normal range. At about 1415 EST, the load master requested the pilot approach the site in preparation for lifting the drill rig motor. As the pilot approached overhead, the load master radioed to the pilot that he wanted to re-check the rigging and to temporarily delay the approach. In order to minimise the rotor downwash on the people below, the pilot raised the collective to climb the helicopter, and the 100 foot long-line, above the tree canopy.
As the helicopter started to climb, the pilot heard a loud mechanical ‘screaming’ noise, and he started making plans for an emergency landing. Almost immediately, the pilot also heard an audible alarm, followed by a noticeable yaw. Around this time, a light-coloured gas or mist was evident near the engine area of the helicopter (Figure 2).
Figure 2: Light coloured gas or mist from helicopter prior to accident
A light-coloured mist or smoke is visible trailing from the helicopter in this photograph taken near the time of the ‘Mayday’ call. Source: GHD.
The pilot elected to conduct the emergency landing in the Yarrangobilly Riverbed, south-west of the lifting area and workers. Concurrently, the pilot transmitted a ‘Mayday’ call over the radio. The ground workers observed the helicopter turn to the south-west, away from the lifting site and descend toward the river. The helicopter subsequently collided with the riverbed. Two areas along the flight path with broken tree branches were identified, consistent with being struck by the helicopter main rotor blades.
The pilot, who was wearing a helmet and secured in a lap belt, sustained serious injuries and the helicopter was destroyed.
Figure 3: Accident site showing drill pad and helicopter wreckage
Drill pad shown in top right of photo including path of helicopter shown. Source: GHD.
At interview, the pilot advised he had flared the helicopter prior to the impact with the second tree but could not recall the remainder of the impact sequence until exiting the helicopter. Examination of the wreckage and ground impact marks indicated that the helicopter had impacted the ground in a nose high, slightly right side down attitude. During the impact with terrain, the tail boom of the helicopter detached from the fuselage. The fuselage then came to a rest inverted and nose low a short distance away, balancing on the main rotor head assembly.
Figure 4: Helicopter wreckage in Yarrangobilly River
Wreckage of VH-HUE looking downstream away from the drill pad, in the approximate direction of flight. Source: ATSB
Post-accident response
Four of the workers on the ground gathered fire extinguishers and immediately moved in the direction of the helicopter. One of the loadmasters stayed at the lifting site and called for help via satellite telephone and radio.
The four workers travelled on foot down river to access the accident site. Upon arrival, fuel was visible leaking down the outside of the fuselage. Some smoke was also observed in the area and, due to concerns of a potential fire in the engine bay, fire extinguishers were deployed toward this area to mitigate this risk. Meanwhile, two workers assisted the pilot to exit the helicopter and supported him in moving upstream, safely away from the wreckage, before commencing first aid.
The pilot of another helicopter (also operating in support of the Snowy 2.0 project), heard the Mayday call, flew to the lifting site, and dropped off three additional workers to assist. These workers gathered additional first aid supplies to help provide first aid to the injured pilot and also assisted with rescue coordination. As communication was limited from the site, the pilot of the helicopter took off and climbed the helicopter to relay messages from the ground by flight radio and UHF. This pilot remained overhead for the duration of the rescue efforts and medical extraction of the pilot.
The pilot of a third helicopter (also conducting Snowy 2.0 operations) had also become aware of the accident. This helicopter flew to Cabramurra to transport Snowy Hydro medical support workers to the accident site. Upon arrival at the accident site, the two medical personnel, consisting of a nurse and paramedic, commenced further medical treatment of the injured pilot.
During this time, a medical helicopter was deployed from Canberra to lift the pilot from the site. Approximately 2 hours after the accident, the injured pilot was winched from the accident site and transported to a Canberra hospital.
The immediate rescue efforts of the ground workers afforded the best opportunity to assist the pilot escaping the helicopter, conduct first aid and mitigate the risk of a serious fire.
While the helicopter was destroyed, the fuselage remained unaffected by fire (Figure 5).
Figure 5: Helicopter wreckage showing nose of helicopter in Yarrangobilly River
Wreckage of VH-HUE looking upstream toward the drill pad, showing the nose of the helicopter and pilot’s seat. Source: ATSB
Ongoing investigation
Due to the unstable nature of the wreckage, on-site examination was limited. Consequently, the helicopter was lifted from the accident site (Figure 6) and transported by road to a secure hangar for further examination.
Figure 6: Helicopter wreckage lifted to Cabramurra aircraft landing area
Wreckage of VH-HUE being lowered by an s-61 ‘Sea-King’ to Cabramurra ALA for transfer to a secure hangar. Source: ATSB
The ATSB investigation is continuing and will include the following:
Examination of the fuselage, flight and engine instruments, controls and linkages, engine and auxiliary components, and the pilot occupied space.
Technical failure mechanisms for the engine and/or drive train
Cabin safety and survivability factors
Helicopter maintenance history
Acknowledgements
The ATSB wishes to thank the significant contribution of the following organisations and their staff: New South Wales Rural Fire Service, Snowy Hydro Limited, GHD and Jindabyne Landscaping. These organisations assisted with transport to the accident site and operational support during the investigation process. The ATSB also acknowledges the support of Encore Aviation, Charles Taylor Adjusting, Heli Survey Jindabyne and Coulson Helicopters in supporting the lifting of the helicopter wreckage from the accident site.
______________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the afternoon of 10 April 2018, the 45.5 m landing craft Lauren Hansen was being prepared for sea at Hudson’s Creek, Darwin, Northern Territory. The ship’s operator, Shorebarge, had chartered the ship for a voyage to Elcho Island.
By about 1450 Central Standard Time[1] that afternoon, the ship’s crew had completed taking on fuel and had departed the ramp at Hudson’s Creek with a maximum draft of about 2.2 m. The ship’s cargo consisted of forklift machinery, construction material, a 20-foot container and other general cargo.
As the ship proceeded out of Darwin Harbour, the master encountered difficulties using the autopilot, which when engaged, applied port rudder regardless of the heading order set on the control panel. The master steered the ship manually until they had departed port limits at about 1705, at which time the master attempted to engage the autopilot again with limited success. Shortly after departing port limits, Lauren Hansen encountered engine difficulties with the fault traced to the starboard main engine’s gearbox cooling system. At about 1900, the ship’s crew dropped anchor to the south-west of the Vernon Islands while the gearbox cooling system fault was rectified. By about 2115, with both main engines operational again, Lauren Hansen weighed anchor and resumed passage for Elcho Island.
At about 2200, the master handed over the navigation watch to the chief mate and retired to his cabin located on the deck below the navigation bridge (bridge). At that time, the ship was on autopilot and the chief mate was the sole watchkeeper on the bridge. The weather was fine with partly cloudy skies, a north-westerly wind at force one[2] (10 knots or less) and calm seas.
At about 0200 on 11 April 2018, Lauren Hansen was on a course of about 042º with a speed of about 9.7 knots, with Cape Keith about 2 nautical miles (NM) to the north. At about 0213, the ship approached a planned course alteration position (waypoint) laid about 0.9 NM off the coast of Cape Keith, Melville Island. At the time, the ship was on a heading of about 043º with a speed of about 9.6 knots. The chief mate reported that he altered the ship’s heading by about 10° to port using the autopilot and that the ship appeared to settle on the new heading.
At some time between 0213 and 0218, the ship commenced an unexpected turn to port, towards land, without any alarms or indications. Shortly after, the chief mate, who was monitoring the chart plotter[3] and radar, noticed that the ship had started to turn to port. He reduced power on both main engines and attempted to call the master using the bridge telephone. Failing to receive a response using the telephone, the chief mate then left the bridge and went down to the master’s cabin, one deck below. He alerted the master to the situation and both then returned to the bridge. As the master and chief mate entered the bridge, they noticed that the ship no longer appeared to be turning but had steadied on a north-westerly heading. At about the same time, Lauren Hansen grounded on a shoal about 170 m off the shoreline on Cape Keith, Melville Island (Figure 1). The grounding was logged in the ship’s bridge logbook as having occurred at 0230.
As the crew were mustered, the master lowered the ship’s bow door in an attempt to adjust the ship’s trim and used the main engines in an unsuccessful attempt to re-float the ship. The crew then started to sound the ship’s tanks and bilges in attempt to detect any hull breaches or water ingress. After the initial inspection, no damage, hull breaches or environmental pollution was evident. The master assessed that the ship was not in any imminent danger and did not activate the ship’s EPIRB[4] or broadcast a distress, safety or urgency message on the radio.
Figure 1: Lauren Hansen's track and location of grounding
Source: Australian Hydrographic Service, annotated by the ATSB using electronically recorded data
As the tide ebbed, the ship remained aground in an upright position with the propellers and rudders relatively unaffected in deeper water at the ship’s stern (Figure 2). The crew continued to sound the ship’s tanks and bilges on a 2-hour basis throughout the duration of the grounding.
At about 0700, the master informed the company’s designated person ashore (DPA)[5] of the incident using the ship’s Inmarsat-C satellite telephone (sat-phone). The DPA then initiated notifications to the ship’s owners, insurers, Australian Maritime Safety Authority (AMSA), class and other stakeholders. At about 0745, the DPA contacted the ship on the sat-phone to get more details and formulate a plan. The master advised the DPA that the ship was expected to re-float at about 1330 that afternoon, on the rising tide, at which point the ship would proceed back to Darwin for an underwater inspection.
Figure 2: Lauren Hansen aground off Cape Keith
Source: Shorebarge
At about 1200, the DPA attempted to contact the ship on the sat-phone with no success. Further attempts to establish communications with the ship between 1300 and 1430 also failed. On board Lauren Hansen, attempts by the master to contact the DPA on the sat-phone were similarly unsuccessful.
At about 1400, Lauren Hansen re-floated. The ship’s tanks and bilges were sounded and with no breaches or water ingress evident, the ship commenced passage back towards Darwin.
Meanwhile, at about 1445, the ship’s operator authorised the use of a helicopter for the DPA to attempt to locate the ship and re-establish communications. At about 1600, the DPA departed Darwin in a Robinson R22 helicopter with a portable sat-phone on board. At about 1645, the DPA located Lauren Hansen while the vessel was en-route returning to Darwin. The portable sat-phone was lowered to the ship, communications re-established and the helicopter returned to Darwin.
By about 2300 that evening, Lauren Hansen had safely anchored in Darwin Harbour.
At about 1330 the next day, 12 April 2018, divers conducted an underwater inspection of the ship’s hull. A surveyor representing the ship’s classification society, American Bureau of Shipping, also attended the inspection. The underwater inspection identified several areas of impact damage across the ship’s bow with the largest indentation about 143 cm long, 50 cm wide and about 8 cm deep. While all the damaged areas had sustained hull distortion and indentations, no cracks, fractures or tears in the hull were evident.
Surveyors from AMSA attended Lauren Hansen on 13 April 2018 and detained the ship pending the class surveyor’s report. The damaged areas of the ship’s hull were checked by internally inspecting the ship’s affected tanks and spaces. Following this, the class surveyor issued a survey report recommending the damaged areas be repaired during the ship’s next dry-docking survey on 25 June 2018. AMSA subsequently lifted the detention order on the provision that the class survey report’s recommendations were adhered to by the prescribed date.
Crew
Lauren Hansen’s crew of five Australian nationals comprised a master, chief mate, chief engineer and two other crew. The master held an Australian master’s certificate of competency and had about 33 years’ experience at sea with at least 7 years as master on board Lauren Hansen.
The chief mate also held an Australian master’s certificate of competency with about 16 years at sea and had joined Shorebarge about 9 months before the grounding. In that time, the chief mate had served on board Lauren Hansen, among other vessels, and was familiar with the use and operation of the ship’s navigation and steering systems. Records of rest hours and interview evidence indicated that at the time of the grounding (0230), the chief mate had been awake for about 20 hours.
Lauren Hansen
At the time of the grounding, Lauren Hansen was an Australian registered, 45.5 m landing craft owned by Teras Offshore, Singapore and chartered by Shorebarge. The ship was under charter to Shorebarge from about June 2017 to 8 March 2018. The ship then lay idle until 10 April 2018 when it was once again chartered by Shorebarge for the voyage to Elcho Island.
Lauren Hansen was equipped with the required navigation equipment for a ship of its class including radar, magnetic compass, echo sounder, automatic identification system (AIS),[6] bridge navigational watch alarm system[7] and global positioning system receiver units. The ship’s bridge navigational watch alarm system was reported to be operational and active at the time of the grounding. The ship was also equipped with autopilot, chart plotter and a satellite compass.[8] The ship was not equipped with a voyage data recorder nor was it required to be. The ship’s propulsion was provided by two Cummins KT-19 M3 marine diesel engines driving twin propellers with steering by means of twin rudders driven by an electro-hydraulic steering gear system.
Lauren Hansen’s passage plan for the voyage comprised a route that passed north of the Vernon Islands through the Clarence Strait and thence north-easterly through the Van Diemen Gulf. The planned route took the ship close to the coast of Melville Island with a waypoint laid about 0.9 NM off land in the vicinity of Cape Keith (Figure 3). Navigational charts for the area included a recommended track further to the east in more open waters but it was not used. The ship’s master indicated that, generally, passages through the Van Diemen Gulf were laid close inshore off the coast of Melville Island and that this route had proved to be safe and reliable in the past. He also stated that the chart’s recommended track was not used as experience had shown that the southern section, passing south of the Vernon Islands (see Figure 1), was subject to strong and at times, unpredictable, tidal influences.
Figure 3: Section of navigational chart Aus 720 showing Lauren Hansen's planned track (in red) and the recommended track (in purple)
Source: Australian Hydrographic Service, annotated by the ATSB
Furthermore, AIS data indicated that Lauren Hansen was probably about 0.3 NM to port of the planned route and therefore, about 0.6 NM off land at about 0213, when the course alteration was performed (Figure 4).
Figure 4: Section of navigational chart Aus 720 showing Lauren Hansen's approximate track with AIS derived positions (in brown)
Source: Australian Hydrographic Service, annotated by the ATSB using AIS data provided by AMSA
Steering systems and heading data
On Lauren Hansen’s bridge, there were three primary modes of steering—autopilot, manual steering and emergency steering (Figure 5).
The ship’s autopilot was an AP-9 autopilot manufactured by TMQ International. To engage the autopilot steering mode, the ‘AUTO’ button was pushed and the ‘AUTO’ light would come on. The heading order was then set using the rotary knob or the keypad buttons and the autopilot would be ‘locked’ to steer the set heading shown on the autopilot display.
In order to change to manual steering mode, the ‘STANDBY’ button had to be pushed. The ‘AUTO’ light would go off and the ‘STANDBY’ light would come on. The ship would now be in manual steering mode using the joystick on the helm console. The display on the autopilot would now show the ship’s current heading.
Emergency steering on board Lauren Hansen was conducted from the ship’s bridge. The changeover procedure to emergency steering mode involved turning the autopilot off and then on again before opening two hydraulic changeover valves located in a cupboard on the bridge. Emergency steering was then carried out using the ship’s wheel. The instructions for the changeover to emergency steering were laid out in a laminated notice and affixed to the helm console on the bridge.
Heading reference information was fed to the autopilot from the ship’s magnetic compass through a compass top sensor (CTS) unit.
Figure 5: Helm console on Lauren Hansen's bridge
Source: Shorebarge
Magnetic compass
Lauren Hansen was fitted with a Daiko Keiki SR2-150PK magnetic reflector compass unit and a spare compass bowl as required by the regulations.
While the ship was also equipped with a satellite compass, past experience on board had shown this to be unreliable as a heading reference system for the autopilot. The magnetic compass was therefore substituted to feed heading information to the autopilot using a heading sensor unit sometime in 2017. There were no records available to show exactly when or how this changeover was performed.
Under AMSA regulations,[9]Lauren Hansen was required to have available, a table or curve of the residual deviations from the last compass adjustment and for compass deviations to be regularly calculated and recorded in a compass deviation book. The magnetic compass on board Lauren Hansen had last been adjusted by a licensed compass adjustor about 4.5 years previously in September 2013. The deviation table from this adjustment was available on board. There was no minimum statutory period for when Lauren Hansen’s compass needed to be re-adjusted provided: it was kept in good condition, a compass deviation book was maintained, and the deviation on all headings was less than 5º.
However, there was no evidence of a compass deviation book being maintained on board Lauren Hansen, as required by the regulations, and therefore, no recent compass deviations available for inspection.
Operator’s investigation
Lauren Hansen’s autopilot had been repaired at least twice in the 6 months prior to the incident, once in November 2017 and again in February 2018. In both instances, the faults were found to involve corrosion in the unit’s circuit boards and switches.
On 13 April 2018, Shorebarge engaged a technician to investigate the autopilot malfunction that occurred prior to the grounding. During the technician’s inspection, when the autopilot unit was powered up, the display showed a heading of about 307º whereas the magnetic compass indicated a heading of about 225º, which more accurately represented the true orientation of the ship’s head. Over the next hour, as the technician checked the magnetic compass and the CTS unit, the heading on the autopilot unit display slowly settled until it accurately reflected the magnetic compass heading. The technician was unable to recreate the fault and concluded that it was possible that there was an intermittent fault in either the autopilot unit or the CTS unit. Both units were replaced after the incident on 18 April 2018.
Similar past incidents
St Apollo
On 24 August 2015, the scallop dredger St Apollo grounded on a rocky shelf at the eastern entrance to the Sound of Mull, Scotland, United Kingdom. St Apollo had been entering the Sound of Mull in autopilot steering mode when, soon after a course alteration, the watchkeeper reported the vessel turning to starboard. The watchkeeper reduced the engine speed and went to the ship’s mess, just aft of the wheelhouse, from where he called out to the skipper, asleep one deck below. As the skipper arrived in the wheelhouse, St Apollo grounded. The skipper and four crew were recovered safely and there was no significant pollution but the ship was declared a constructive total loss.
The United Kingdom’s Marine Accident Investigation Branch Report No. 14/2016 concluded that the grounding was due to navigational error, equipment malfunction or both. It also found that while the cause of the reported loss of heading control could not be determined, the reactions of the watchkeeper were impaired by insufficient situational awareness, lack of equipment knowledge and a low state of arousal.
Safety analysis
During the ship’s passage from Darwin, the ship’s master encountered problems using the autopilot. The ship’s course appeared to, intermittently, deviate to port whenever the autopilot was engaged requiring the master to use manual steering. As the passage progressed, the master was able to re-engage the autopilot before eventually handing over the watch to the chief mate who was aware of the previous day’s autopilot issues. The planned route for the passage was laid less than 1 NM off land in the vicinity of Cape Keith in the Van Diemen Gulf. The navigation chart’s recommended track for the area lay further east, about 9 NM off land. An amendment to the planned route to pass further to the east of Cape Keith, similar to the recommended track, would have allowed more time and sea room to react to a navigational challenge such as an autopilot malfunction and reduced the risk of a grounding.
As Lauren Hansen approached the waypoint off Cape Keith, the AIS data indicated that the ship was likely about 0.3 NM to port of the planned route. The chief mate, who was on watch, then successfully executed a course alteration to port using the autopilot and continued to monitor the ship’s progress on the chart plotter and radar. Shortly after the course alteration, with the ship less than 1 NM off land, the chief mate reported observing the ship turn unexpectedly to port towards shallow water and land. The chief mate then reduced power on the ship’s engines to slow the ship’s progress towards land and attempted to alert the master for assistance. A changeover to either manual or emergency steering at this time would have enabled the chief mate to reassert control over the ship’s steering system and direct the ship away from land. Leaving the autopilot engaged while carrying out other actions meant that the ship continued to make way towards shallow water and subsequently grounded.
The chief mate was qualified, experienced and was familiar with the changeover and use of the ship’s manual steering. Reducing power on the ship’s engines and calling the master were both valid actions taken by the chief mate in response to the potential developing emergency. However, the chief mate’s response did not include the key step of assuming manual steering, which would have been the most effective way of preventing the grounding. This oversight may have been related to the sudden realisation of the unfolding potential emergency at a time of low arousal due to the combination of his circadian rhythm (early morning) and time awake (about 20 hours).
When turned on during the post-incident technical inspection, the autopilot unit’s heading display showed a heading discrepancy between the supplied heading information and the magnetic compass heading at the time. The observed heading discrepancy appeared to be consistent with the previously observed steering deviations. The post-incident technical inspection concluded that the autopilot malfunction was possibly the result of an intermittent fault in either the CTS unit or the autopilot unit itself.
While the magnetic compass appeared to have been performing satisfactorily, there was no compass deviation book being maintained on board Lauren Hansen, as required by the regulations. The performance of a ship’s magnetic compass can be affected by several factors such as the nature of the ship’s cargoes and periods of inactivity. At the time of the grounding, Lauren Hansen had been laid up for a period of about a month and even short periods of idleness can lead to serious deviations for a ship’s magnetic compass.[10] However, without a compass deviation book there was no record of regular compass deviation calculations and therefore, no means of monitoring the compass’s performance.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The decision to execute the planned route, which passed close to land, rather than a route in more open waters similar to the chart's recommended track through the Van Diemen Gulf, increased the risk of a grounding particularly when the unreliability of the autopilot was a known factor.
Lauren Hansen experienced an unexpected turn to port while on passage in autopilot steering mode. The ship’s manual or emergency steering modes were not engaged or utilised and the ship subsequently grounded.
The unexpected turn to port was most likely the result of an intermittent fault in the ship's autopilot unit or in the compass top sensor unit that fed heading information to the autopilot unit.
There was no compass deviation book maintained on board Lauren Hansen as required by Australian Maritime Safety Authority regulations.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Shorebarge
As a result of this incident, the ship’s operator has advised the ATSB that they are taking the following safety actions:
Repairs and replacement
The autopilot unit and compass top sensor were both replaced with new units, with the autopilot now reported to be functioning normally. The ship has since been dry-docked and repairs and replacement of the damaged hull areas have been carried out as recommended by class.
Magnetic compass adjustment
Lauren Hansen’s magnetic compass was inspected by a qualified compass adjustor and an up-dated table of deviations compiled. The compass was found to have been operating satisfactorily with deviations on all headings less than 5º.
Shipboard safety meetings
Safety meetings were conducted on board Shorebarge vessels to review the grounding and to discuss the management of fatigue. The discussion included a review of AMSA’s legislative requirements and the company’s procedures for fatigue management.
Safety message
The steering gear and associated control systems including the autopilot, compass and sensor units are, along with the ship’s propulsion system, the primary means of controlling the conduct of the ship. Any malfunction or suspected unreliability in these systems should be an immediate cause for concern.
This incident showed the implications of a failure or malfunction of any aspect of the ship’s steering systems and that these should be carefully assessed before committing a vessel to sea. If necessary, the situation should be rectified or measures implemented to reduce risk before the vessel embarks on a voyage. In this case, with prior knowledge of the autopilot’s unreliability, the passage plan or master’s orders could have mandated that manual steering be assumed when navigating in confined waters or in proximity to land. This would have prevented undue reliance being placed on the autopilot, especially in areas where there was limited time or options for action in the event of a malfunction. Alternatively, laying the planned track in more open waters, similar to the recommended track on the navigational charts in use, would have allowed more sea room in the event of a steering malfunction.
This investigation also provides an opportunity to highlight the necessity for magnetic compasses to be maintained, monitored and adjusted as required by the regulations. The need to monitor the performance of a magnetic compass is especially important when it is used as the primary source of heading information for the ship’s steering systems. While, in this case, the magnetic compass appears to have been performing satisfactorily, a record of regular compass deviation checks allows the performance of a compass to be monitored and therefore, adjusted when necessary. Further guidance on the maintenance and adjustment of magnetic compasses can be found in Marine Notice 19/2016 – Maintenance and Adjustment of Magnetic Compasses published by the Australian Maritime Safety Authority.
General details
Ship details
Name:
Lauren Hansen
IMO number:
9580869
Call sign:
VZXU
Flag:
Australia
Classification society:
American Bureau of Shipping
Ship type:
Landing craft
Builder:
Far East Shipyard Company, Malaysia
Year built:
2010
Owner(s):
Teras Offshore
Manager:
Shorebarge
Gross tonnage:
490
Deadweight (summer):
490 t
Summer draught:
2.5 m
Length overall:
45.5 m
Moulded breadth:
11 m
Moulded depth:
3.2 m
Main engine(s):
Cummins KTA19-M3
Total power:
640 HP
Speed:
11 knots
Damage:
Hull indentations and distortion across underwater bow area
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 30 March 2018, a 16 t jumbo (steel) coil became unstable and fell from Pacific National freight service 6WM2 after it crossed the Seven Mile Creek Bridge near Winton, Victoria. After falling from 6WM2, the coil struck and caused damage to both tracks before coming to rest between, and obstructing both tracks at about 204.5 track km. About 10 minutes later, V/Line passenger service 8615, traveling north on the west track, struck the tail of the coil and the damaged west track at about 110 km/h, but did not derail. Two staff on the V/Line train received minor injuries.
What the ATSB found
The ATSB found that the absence of a rubber load mat from one face of the jumbo coil cradle, and the likely failure of the steel unitising straps allowed the centre of the coil to telescope (where the inner layers of the coil move laterally relative to the outer layers), adversely affecting its stability and increasing the likelihood of movement.
As Pacific National’s Freight Loading Manual did not require the use of rubber load mat on cradles, there was no requirement to consider the condition of the load mat during inspections and maintenance. This allowed the continued use of cradles without load mat, decreasing their effectiveness at restraining loads.
The Freight Loading Manual also did not require a configuration of radial unitising straps on jumbo coils so that one strap was always free from contact with the cradle, which would have reduced the risk of straps breaking and therefore, the coil telescoping.
In addition, Pacific National did not demonstrate that the load restraint system provided by their demountable cradles when carrying jumbo coils provided sufficient restraint against lateral accelerations to prevent coils from moving and falling during transit.
What's been done as a result
Following the occurrence, Pacific National updated their Freight Loading Manual to require all coils to have a minimum of two radial and two circumferential unitising straps applied. In addition, PN have drafted a revision to their Wagon Maintenance Manual to include a part specific to inspection of jumbo coil cradles. The manual part relates to demountable type cradles and includes a requirement to 'consider the condition of load mat during inspection and maintenance', and repair or replace as required.
The ATSB has issued two safety recommendations to Pacific National to address safety issues identified in this investigation that have not yet been addressed. The first is to address the risk presented by continuing to allow jumbo coils to be loaded in an orientation where all the radial straps are positioned within the contact zone between the coil and cradle. The second is to review the load restraint system provided by the demountable cradle design to demonstrate that they sufficiently restrain jumbo coils against lateral accelerations and prevent coils from moving and falling during transit.
BlueScope Steel also introduced a requirement to apply a third radial unitising strap to all coils. In practice, they applied the third strap in a position diagonally opposite to the first two. Additionally, they have proposed to work with the carrier to undertake a review of the current load restraint system.
Safety message
Robust load restraint systems are required to protect against movement of loads during transport. This is particularly important for significantly heavy loads, such as jumbo steel coils, as should they fall from the train they pose a significant risk to the safety of other rail vehicles and passengers. The system should also include assessments and documentation that demonstrate appropriate load cases, design requirements, operational and loading requirements have been met, to ensure that the safety of the load restraint is maintained over time.
The occurrence
Loading of the jumbo coil
On 27 March 2018, a BlueScope Steel jumbo coil[1] (number 1H8S2486) was loaded onto the ‘A‑end’ (trailing) cradle of Pacific National (PN) wagon number NQJF-21574, along with another coil in the ‘B-end’ (leading) cradle. BlueScope applied two circumferential and two radial steel straps (an example of circumferential and radial straps applied to a jumbo coil is shown in Figure 1) to each coil in order to secure them as a unit (unitise).[2] The following day the loaded wagon was inspected by PN terminal operators and moved to South Yard, Port Kembla, New South Wales (NSW).
Figure 1: Jumbo coil fitted on a wagon within a cradle, showing radial and circumferential unitising straps
Source: ATSB
On 29 March 2018, the wagon was marshalled as the 35th wagon of train 6WM2 and was inspected by PN terminal operators, who provided a completed brake certificate[3] to the outgoing train crew. The train departed Port Kembla at 2354 Eastern Daylight-saving Time,[4] and received a roll‑by[5] inspection from PN terminal operators with no issues reported.
Train 6WM2 journey to Melbourne
Train 6WM2 was a scheduled service carrying steel products from Port Kembla (Wollongong) to the Melbourne Freight Terminal, Victoria. It travelled north from Port Kembla to the Sydney Freight Terminal before traveling on the Defined Interstate Rail Network[6] for the remainder of its journey to Melbourne.
On 30 March 2018, at about 0300, train 6WM2 arrived at Chullora, NSW for a crew change with a two-person crew from Junee, NSW relieving the Port Kembla drivers. The disembarking crew reported that the train was running well and they conducted a roll-by inspection of the train as it departed, and did not report any issues.
At about 1055, train 6WM2 arrived at Junee for its second crew change. Again, the disembarking crew reported that the train was running well and they conducted a roll-by inspection of the departing train with no issues reported.
On its journey from Junee to Wangaratta, Victoria, train 6WM2 crossed[7] passenger train ST24 and freight train 6MC7. The drivers of both conducted roll-by inspections of train 6WM2 and observed no issues. Closed-circuit television footage captured from a platform at Wangaratta Station at about 1427 identified that all jumbo coils on train 6WM2 were present and not grossly out of place.
The occurrence
At about 1440, a jumbo coil fell off train 6WM2 as it passed 204.5 track km.[8] The train was travelling at a speed of about 76 km/h. The drivers of 6WM2 reported nothing remarkable about the train’s behaviour at this location and were unaware of the coil falling off.
At about 1448, the train proceeded south and crossed the northbound V/Line passenger service 8615. The crew of 8615 conducted a roll-by inspection of 6WM2 with no issues reported. The recorded data indicated that both trains were travelling just below 80 km/h at this time, so from the driver of 8615’s perspective, train 6WM2 would have passed at almost 160 km/h.
At about 1450, the driver of train 8615 saw a jumbo coil obstructing the track ahead and made an emergency brake application. Train 8615 subsequently struck the unravelled tail of the coil and associated damage to the west track (Figure 2) at about 110 km/h, but it did not derail. After traversing the damaged track, the train travelled over the Seven Mile Creek Bridge, which was less than 100 m beyond the steel coil and damaged west track, as shown in Figure 3.
Figure 2: Jumbo coil and track damage at location 204.5 km
Source: ARTC, annotated by the ATSB
Figure 3: Location of track obstruction and associated track features
Source: Google earth, annotated by the ATSB
After bringing the train to a stop, the driver of 8615 advised the Australian Rail Track Corporation (ARTC)[9] train control that they had struck a steel coil from 6WM2 and that there was significant damage to the west track. In response, the ARTC train controller applied signal blocks to both tracks and requested that the drivers of 6WM2 stop and inspect their train.
At about 1454, the driver in control stopped train 6WM2 at the next suitable location. Between 1517 and 1600, the second driver inspected the train and reported to ARTC train control and PN that a jumbo coil was missing from the 35th wagon, NQJF‑21574. The driver also reported that 39 trailing wagons had been damaged to varying extents. This included damage to the steps, handbrakes, brake cylinders and bearing caps. The driver advised that train 6WM2 would not be able to continue without repair.
The driver of V/Line passenger service 8615 inspected the train and determined that superficial damage had occurred to the locomotive and that there were no passenger injuries. Train 8615 continued its journey to Albury, NSW without further incident. Later, two staff reported that they had received minor injuries.
Initial inspection of the occurrence location by PN and ARTC representatives focused on identifying damage to the track and rollingstock, and planning the recovery of the coil. Both parties provided photographs and reports of the condition to the ATSB. Subsequent inspections of the track and of wagon NQJF-21574 were conducted by ARTC on 4 April 2018. A further inspection of the wagon was performed by the ATSB at PN’s West Melbourne Yard on 22 May 2018.
Train 6WM2 comprised four NR class locomotives, hauling 75 wagons for a combined length of 1,275 m and total weight of 5,132 t.
Wagon details
Wagon NQJF-21574 had a listed tare mass of 20 t, which did not include the mass of the demountable coil cradles (2.8 t each). Subsequently, the gross mass of the wagon loaded with two jumbo coils was 61.76 t, within the maximum allowable gross mass of 72 t.
Pacific National’s NQJF class wagon was a 60 ft flat-bed wagon with mounting fixtures for accepting standard size shipping containers (20 or 40 ft containers). The main structure of this design was a large central longitudinal beam (commonly called the centre sill) that spans the length of the wagon and supports the transfer of load between both bogies and couplers. Transverse beams (also known as transoms) connect to the longitudinal beam and provide a load path from the container mounting points and bogie side-bearers[10] back to the central beam. For NQJF wagons, the transverse beams and several other components were connected with a lighter gauge steel u-section to create a fully enclosed rectangular bed. An example of these components is shown in Figure 4.
Figure 4: Structural components of an NQJF class wagon with jumbo coil cradles mounted.
Source: Brad White, annotated by the ATSB
Jumbo coil cradle design
Pacific National have been utilising several different designs of cradles to move jumbo coils by rail since their formation in 2002. Some designs were permanently attached to the frame of the wagon, meaning that those wagons were restricted to carrying jumbo coil only, while others could be removed (demountable). The cradles used on the NQJF wagons were designed to connect to existing 20 ft container mounting hardware (as shown in Figure 4). Although the cradles were demountable, photographic evidence indicated that the cradle involved in the occurrence, serial number DMJU‑000271, appeared to have been mounted to wagon NQJF-21574 since at least January 2016.
The cradles were designed and manufactured to PN specifications by an engineering contractor and this particular cradle was manufactured in 2012. An isometric drawing of the cradle design is shown in Figure 5.
The technical specification relating to the design required that the cradles:
be structurally sound for accelerations of, 2 g longitudinally, 1 g laterally, 1 g vertically up and 1 g vertically down
accommodate heavy rolled steel coil up to a maximum weight of 29 t
include rubber liners fitted to the walls (slope face) of the cradle.
While the technical specifications contained requirements for the strength of the cradle structure, they did not include any corresponding requirement for restraint of the load (refer to section titled Load restraint requirements) nor for tests to be performed with the actual jumbo coils used as load.
The cradle manufacturer conducted mechanical testing in accordance with the requirements of Australian Standard 3711 Part 8: Freight containers - Platform containers. The requirements tested the function, strength and restraint of the container. However, while this required a load to be present, the restraint of the load was not within the scope of the tests. The load used for testing was a fabricated cradle filled with steel shot (pellet) that did not replicate the dimensions or mass distribution of a jumbo coil, nor was it required to.
Figure 5: Isometric drawing of demountable coil cradle
Source: Cradle manufacturer, annotated by the ATSB
The design of the cradles included rubber mats on the slope faces that contact the coils. The mats were attached on their top edge by bolts passed through a metal plate. The manufacturer indicated that the intended purpose of the rubber mat was to protect the coil from contacting the steel surface of the cradle.
In addition, while not shown in the drawing, the design included retractable fingers that protrude from the cradle slope faces. These were intended to provide lateral support to the coils while accommodating different coil widths. While the exact contact position is a function of the coil diameter, which varied from coil to coil, the ATSB’s observation of a coil being loaded into the same cradle type (Figure 6) showed that the fingers aligned with the coil below the contact point and close to the bottom surface of the coil. Therefore, while the fingers potentially provided some resistance to lateral movement, they did not significantly restrain the load from rotation around a longitudinal axis (toppling to the side).
Figure 6: Coil cradle retractable fingers and their position relative to a loaded coil
Note: The position of the radial steel straps are below the contact location with the slope face of the cradle.
Source: ATSB
Jumbo coil information
Coils on the 35th wagon
The occurrence coil (1H8S2486) weighed 16.04 t, was 1.94 m in diameter, 0.81 m wide, and comprised a wound sheet of 3.2 mm gauge steel that was unitised with two circumferential and two radial steel straps. Coils of this size are referred to within industry as ‘jumbo coils’.
The jumbo coil mounted in the other cradle of the wagon (the B-end cradle) weighed 20.12 t, was 1.91 m in diameter, 1.06 m wide, and comprised a wound sheet of 2.3 mm gauge steel unitised with two circumferential and two radial straps.
Unitising straps
According to BlueScope Steel, the primary purpose of the unitising straps is to maintain coil integrity. Pacific National’s procedures and BlueScope Steel’s practice called for application of circumferential and radial unitising straps to jumbo coils that were to be transported by rail. These straps are made of steel and were applied to the circumference and radius of the coil respectively. Figure 1 shows a coil with both radial and circumferential unitising straps identified. BlueScope Steel described that the purpose of the circumferential straps was to keep the outer wraps tight to prevent telescoping and unravelling. Likewise, the radial straps were for:
Preventing eye wraps from unravelling during cooling
Preventing eye wraps from telescoping or becoming damaged during coil handling with ram trucks and/or cranes
Reducing the propensity for telescoping if the coil is dragged sideways in coil handling
Providing support in keeping outer wraps tight to prevent telescoping or unravelling
Telescoping
Telescoping refers to a situation where the inner layers of a steel coil move laterally relative to the outer layers (Figure 7). This is undesirable as it results in a shift in the centre-of-mass to one side, reducing the stability of the coil, and making it more likely to tip in that direction as well as creating difficulty in handling. A method used to prevent this occurring is to apply multiple radial and circumferential straps to the coil. The circumferential straps keep the coil layers tight so that the resulting inter-wrap friction between the layers can resist the relative motion required for telescoping. The radial straps provide additional support to keep the wraps tight as well as resistance to relative motion of the layers as the straps themselves would have to stretch for telescoping to occur.
Figure 7: Illustration of coil telescoping
Source: ATSB
Jumbo coil preparation and loading
Jumbo coils were prepared and loaded at BlueScope Steel’s facility at Port Kembla. BlueScope indicated that the coil involved in the occurrence had two circumferential and two radial steel straps applied in order to secure it as a unit (unitise). This was their standard practice at the time.
ATSB investigators attended the BlueScope loading facility on 27 June 2018 and observed the loading process used for jumbo coils. The coils were lifted and side‑loaded onto cradles using a forklift with a single tine. In-line with the PN loading requirements, forklift drivers were observed to be positioning the coil so that it was oriented with the tail (the outside end of the coiled steel) positioned no higher than the contact point between the coil and cradle. Two radial unitising straps were applied on the tail of the coil, and therefore, were also positioned on or below the contact between the coil and cradle (an example is visible in Figure 6 above).
By the time of the ATSB observation in June 2018, BlueScope had also begun to apply a third radial strap to all coils being transported by rail. The third strap was being applied to the coils in a position diagonally opposite to the first two.
Track information
Track location and features
The coil came to rest at about 204.5 track km, about 100 m south of the Seven Mile Creek Bridge, and about 500 m south of the Winton Road Level Crossing in the Glenrowan to Benalla track section (Figure 3). The track at this location was tangent (straight) with minimal gradient. Further, there were no significant curves for several kilometres in either direction from the coil location.
In the location of the occurrence, trains 6WM2 and 8615 were permitted to travel up to the maximum speeds listed for their train types in the ARTC Route Access Standard, 80 km/h and 115 km/h respectively. There were no speed restrictions on either track at the 204.5 km location nor were there any on the east track for 40 km north of this location.
Track geometry
Track geometry measurements for the east track (used by 6WM2) were provided by both ARTC and V/Line.
ARTC’s recording was captured by their AK car track recording vehicle[11] from the last scheduled measurement before the occurrence, which was 38 days prior on 20 February 2018. These values were directly comparable to the geometry defect maintenance limits utilised by ARTC.[12]
V/Line’s recording came from their instrumented revenue vehicle (IRV) passenger ride comfort monitoring system that was fitted to one carriage of train 8615. While this system did not measure gauge or lateral alignment, it had recorded the vertical geometry of the occurrence location on the east track on the morning of the occurrence (30 March 2018). Due to differences in the data capture method, the V/Line results were not directly comparable to ARTC’s geometry defect maintenance limits.
The recorded track geometry was reviewed for about 1 km of track preceding the occurrence location (204.5 km to 205.5 km on the east track). There were no track geometry defects exceeding ARTC’s maintenance limits. Further, while some variation in the vertical alignment of the rails was evident in proximity to the Winton Road Level Crossing (204.968 km), this was also within the limits.
Variation in track geometry is common around features such as level crossings and bridges due to the change in track structure and support. Due to this, vehicle dynamic motion often increases at these locations, although in this case the geometry at the Seven Mile Creek Bridge and Winton Road crossings (Figure 3) were within ARTC limits.
The V/Line IRV data was not directly compared to the ARTC limits, as it was not measured using the same method as the ARTC AK car. However, since it was recorded on the day of the event, it showed that no significant track fault or deterioration (such as a track buckle[13] or mud hole[14]) had developed in the 38 days between the ARTC recording and the occurrence.
In addition to the track geometry measurements, ARTC provided track condition reports, and records of track defects and maintenance conducted for a track section 5 km either side of the occurrence for 12 months prior. The records did not indicate any pre-existing issues or recent maintenance associated with the occurrence location.
Train handling
During interviews, neither driver recalled any issues with train handling during the journey, nor feeling any in-train force[15] events that could have contributed to the coil coming loose.
Analysis of the event recorder fitted to the lead locomotive of 6WM2 showed that the driver had used partial throttle (between notch 2-5) to maintain speed (between 75-80 km/h) for about 2 minutes prior to the estimated time when the coil was lost, which was appropriate for the relatively flat track grade in this area. They continued with this strategy afterward. While the in‑train forces for the 35th wagon may have differed to what the drivers had experienced, the recorded data showed that the train handling was appropriate and did not likely induce any significant in‑train force events while approaching the location of the occurrence.
Closed-circuit television footage
V/Line provided closed-circuit television footage from cameras mounted at both ends of the Wangaratta Station platform that recorded train 6WM2 as it passed. Wangaratta Station was located about 15 track km before the occurrence location. The cameras’ primary purpose was to monitor the platforms, and therefore, the passing train was away from the main focus of the lens. Subsequently, while the occurrence coil was identified in the footage, and was not grossly out of place or unwound, the images were not clear enough to determine whether the unitising straps were present.
A comparison of still shots from the footage (Figure 8) showed differences in the silhouette of the side face between the occurrence coil and the coil from the B-end cradle of the same wagon. In particular, there was a clear (sharp edged) transition between the top and side faces of the coil in the B-end cradle. In contrast, the transition for the occurrence coil was less well defined (more gradual). This observation for the occurrence coil was consistent with a coil that had begun to telescope.
Figure 8: Comparison of closed-circuit television footage at Wangaratta Station - occurrence coil (top) and other coil (bottom)
Source: V/Line
Post-occurrence inspections
Track and coil site inspection
While the ATSB did not attend the occurrence location, ARTC and PN representatives provided information, including photographs of the site and the coil. Impact marks were present indicating that the coil had significantly impacted the ballast between the two tracks at least twice. The initial impact to the ballast between the tracks was sufficient to shift the rails and sleepers of the west track, resulting in the misalignment that is visible in Figure 9 below. The force of the second impact dug through the ballast layer and exposed the formation below while also displacing the rails and sleepers on the east track. The coil came to rest immediately next to the second impact location (Figure 10). The steel unitising straps were not present with the coil though two were observed in close proximity. A broken steel strap was also found on the ballast between the two tracks about 1 km before this location at 205.5 km. However, it could not be determined if this strap had been fitted to the occurrence coil.
Figure 9: The initial impact location, track damage, and location of the broken steel unitising straps
Source: ARTC, annotated by the ATSB
The outer layers (the tail) of the coiled steel had unrolled and was observed in a final position on top of the east track (Figure 2). The unrolled section showed significant damage consistent with the reported impacts with the trailing wagons of train 6WM2. The tail’s position on the east track was consistent with it having been struck by the locomotive of train 8615 on the west track and pushed across. There was no evidence to suggest that train 8615 struck the main body of the coil. The rest of the layers remained coiled, however, the centre of the coil (the eye) had moved relative to the outer layers (telescoped) by about 235 mm. In Figure 10, the layers of the coil are clearly visible at the top and bottom, with the centre of the coil having moved downward relative to the outside. This is effectively the same as a coil, in its normal orientation, having telescoped sideways.
Figure 10: The coil in its final position with telescoping evident
Source: Pacific National, annotated by the ATSB
Wagon inspection
An inspection of wagon NQJF-21574 was conducted by ARTC on 4 April 2018 (4 days after the occurrence) and a further inspection was performed by the ATSB at PN’s West Melbourne Yard on 22 May 2018. Those inspections identified a break in a portion of the frame (Figure 11). The break was in a piece of U-section steel on the outside of the frame under the B-end cradle.
Figure 11: Inspection of wagon NQJF-21574 showing location of break in wagon frame
Source: ARTC, annotated by the ATSB
ATSB photographic analysis of the break from the ARTC inspection indicated that it was a brittle fracture[16] at a previous weld repair. However, the fracture surface showed significant rust and no conclusion could be made about the age of the fracture due to the four days that had elapsed since the occurrence, providing time for surface oxidation to form.
The wagon’s orientation within the train meant that the B-end was leading the A-end during this journey. As such, the break in the wagon frame could not have been a result of impact from the coil that fell from the A-end cradle. Pacific National reported that maintenance of the wagon occurred on 22 February 2018. The maintenance record indicated this was a ‘minor repair’ to a ‘broken or cracked’ part of the frame. However, it could not be confirmed if this was the same location as the break that was present after the occurrence.
The broken part was not part of the main structure of the wagon frame that transmitted load from one bogie to the other, and was between the attachment points for the B-end cradle. As such, the break location did not affect retention of the A-end cradle nor was it likely to have significantly affected the torsional stiffness of the wagon frame. Due to these factors, no link between the break and the loss of the coil from the A-end cradle could be established.
The inspections also identified that all wheels mounted to the A-end bogie of the wagon showed high wear, although none exceeded the wear limits for maximum flange height or minimum width when measured. Asymmetric wear was not occurring, with wheel wear observed to be even from side-to-side on each axle. Wheel tread hollowing[17] and diameter were not measured, however, photographs of the wheelsets indicated that hollowing and tread wear were not a concern.
Photographs of the bogies taken on 4 April 2018 showed no indication of recent severe wear on bogie contact surfaces. This indicated that it was unlikely that the bogie had experienced significant hunting[18] motion leading to the occurrence.
Figure 12 shows ballast observed on the right side-frame (in direction of travel) and bolster of the A‑end bogie, which was consistent with ballast being sprayed on the wagon from the coil striking the ground immediately beside it.
Figure 12: Residual ballast rocks on the A-end bogie
Source: Pacific National
Jumbo coil cradle
The inspections of the wagon conducted by ARTC and the ATSB also assessed the jumbo coil cradles. They identified that a rubber mat was missing from one face of the A-end cradle. The mat had dislodged from its mounts and fallen to the floor of the cradle (see Figure 14 below).
A photograph (Figure 13) obtained from a member of public, taken in June 2017, showed that the rubber mat was also dislodged at that time. This was eight months prior to maintenance conducted on the wagon in February 2018. The maintenance record did not note the condition of, or indicate that any maintenance to the mat had been performed. This suggested the mat had not been replaced since at least June 2017 and was likely to have been missing for this entire 9-month period of operation.
Figure 13: Rubber load mat missing from the cradle face in June 2017
Source: Brad White
Photographs of both slope faces of the cradle (Figure 14) showed two distinct sets of witness marks consistent with a coil that had toppled to the right side of the cradle. The marks closest to the side of the cradle (bottom of the image) had a distinct layered pattern, which indicated that separate layers of the coil had contacted the cradle at the same time as it toppled. A close-up image of this detail on one face is provided in Figure 15. There were also some indications of contact on the edges of the side face of the cradle, but not on the top, indicating that the coil made minimal contact with the side as it toppled.
Figure 14: Witness marks on cradle slope faces and side
Source: ATSB
Figure 15: Detail of witness marks on cradle slope face
Source: ARTC
V/Line train 8615 data
Train 8615 was a V/Line scheduled passenger service from Southern Cross Station, Melbourne, Victoria to Albury, NSW. The train had three crew on-board; a driver and two other staff in the passenger area.
Train 8615 had two on-board data logging systems, an event recorder fitted to the locomotive and a continuous ride monitoring system fitted to one of the passenger carriages (IRV). The IRV included measurement of speed and location from GPS, and measures of track vertical geometry and passenger comfort derived from accelerometers. While the IRV did not measure locomotive parameters such as brake or throttle, the event recorder measured these items and the two data sources were cross-referenced.
Both data logging systems showed that train 8615 was traveling about 115 km/h immediately prior to decelerating. The deceleration was due to an emergency brake application occurring at about 1450 and indicated that train 8615 took about 957 m and 53 seconds to stop. During the deceleration, the IRV system recorded a significant jerk[19] response of 5.4 g/s at about 110 km/h, which was consistent with the train transitioning the area of damaged track shown in Figure 9 above. To provide context, the response was more than four times the highest passenger safety severity threshold identified in a paper by Monash University (Thompson, 2018). The paper indicated that a ‘high’ jerk motion, of greater than 1.2 g/s ‘forces a total loss of balance, instinctive grasping for hand supports or multiple steps’ for a standing passenger.
Such a large response was consistent with reports from the staff in the passenger area who were standing at the time and reported that the lateral motion of the train threw them into the benches and sides of the buffet car from which they received minor injuries. The number of passengers on‑board was not provided to the ATSB and no injuries to passengers were reported.
Load restraint
Load restraint requirements
Pacific National maintained a document suite called the Freight Loading Manual (FLM), which provided instructions on the loading and carriage of rail freight on their rolling stock. The FLM included a section for the basic requirements of load restraint (FLM 01-07), general loading and lashing principles (FLM 02-01), and a specific section for loading and unitising jumbo coils (FLM 05-09).
Basic requirements of load restraint
The basic requirements of load restraint section of the FLM stated that a load restraint system must be ‘designed, constructed and used in such a way to prevent [movement of the load]’. It also provided requirements for load restraint systems including:
Avoid steel-on-steel loading due to the low friction between the two surfaces. Rubber load matting or similar should be used between the steel contact points to increase friction.
Every type of load must be positioned and secured so that the structure of the container/wagon or the securing devices will prevent the load from becoming displaced or falling from the wagon in transit.
General loading and lashing principles
The general loading and lashing principles section included statements indicating that it was provided as guidance material only and the specific load restraint requirements were provided in the load specific FLM. However, this section did provide general requirements for load restraint, including that:
a load restraint system must ensure:
the load does not dislodge from the container or wagon
load movement does not occur.
the load restraint system should be capable of providing each of the following:
restraining forces equal to 200 per cent of the weight of the load to prevent the load shifting forwards or backwards (e.g. during braking, accelerating or shunting)
restraining forces equal to 100 per cent of the weight of the load to prevent the load shifting sideways (e.g. during cornering, hunting)
restraining forces equal to 100 per cent of the weight of the load to prevent the load moving vertically and ensure the load always remains in contact with the container/wagon (e.g. over rough sections of rail).
Note that ‘forces equal to 100 per cent of the weight of the load’ are equivalent to an acceleration of 1 g (9.81 m/s2) being applied to the coil.
Loading and unitising jumbo coils
The FLM specific to loading and unitising jumbo coils did not explicitly reference load restraint or indicate the minimum acceptable condition of wagons or coil cradles for use in transporting jumbo coils. However, it did require that:
The width of a coil must not be less than one-third of the diameter (height), any coil that did not meet this requirement was required to be attached to the wagon with chains or straps secured through the coil eye.
For coils with steel less than 2 mm thick, a minimum of two radial and two circumferential straps were required to unitise the coil. The radial straps were not a requirement if the steel was greater than 2 mm thick.
Where radial straps were utilised, they were to be positioned near the tail of the coil.
The tail of the coil must be positioned below the cradle contact point to prevent the tail from lifting if the unitising straps fail.
The maximum amount of telescoping allowed was 150 mm if only two circumferential straps were fitted and 250 mm if two radial straps were also used.
Code of Practice for the loading of rail freight
The Rail Industry Safety Standards Board provide a Code of Practice (CoP) for the loading of rail freight. While compliance with the requirements of the CoP was not mandatory, it represented common practice for the loading of freight on rail vehicles. When discussing the loading of coils on coils wagons, the CoP stated that:
Coil steel should be carried, wherever possible, on specially equipped vehicles fitted with cradles designed to accommodate coils of various widths and diameters. Cradles are lined with rubber or timber to minimise the risk of coil movement during transit.
Coil protectors such as rubber or synthetic strips or mats should be fitted between the coil and the securing devices to prevent damage to the coil.
The CoP further included a section on restraint and retention systems, which contained requirements for the minimum forces that a restraint system should withstand. The values in the CoP were consistent with those provided by PN in the general loading and lashing principles section of the FLM, including a requirement for restraint against 1 g lateral load.
However, the CoP also recognised that alternative load cases may be more appropriate for some types of loading, and allowed that an operator may choose to use different forces where they could ‘demonstrate that the alternative values are safe and fit for purpose for that particular application’. Pacific National’s FLM did not indicate that alternative load cases were being used for the carriage of jumbo coils and PN did not provide any other evidence of calculation or use of alternative load cases.
Load restraint calculations
In response to ATSB questions about how load restraint was managed for jumbo coils, PN indicated that the ‘cradles are designed to provide the containment (not restraint) of coils during transit’.
They also provided calculations, which indicated that the jumbo coil involved in the occurrence could topple sideways when subjected to a lateral acceleration of 0.42 g. The method adopted by PN in deriving this figure was conservative when compared to the actual condition of the occurrence coil in the cradle, as it assumed the coil pivoted on its bottom surface rather than the cradle slope faces.
A subsequent calculation by the ATSB indicated the figure was about 0.55 g when the actual contact location between the coil and cradle slope faces was used as the pivot point (with the coil unitised). In either case, the lateral acceleration required to topple the coil was below 1 g.
The ATSB also repeated the calculation for a telescoped coil approximating the condition of the coil as it was observed post-occurrence. An estimate of 235 mm telescoping over the outer 30 layers of the coil was derived by scaling Figure 10 against the known coil width (810 mm). This allowed the mass distribution of the telescoped coil to be estimated and the lateral acceleration required to topple the coil to be recalculated. The result was an acceleration of about 0.30 g required to topple the coil toward the side that had telescoped, a 46 per cent reduction in stability compared with the unitised coil.
ATSB simulations of coil–cradle contact marks
As discussed previously, distinct contact marks were observed on the cradle, left by the coil as it fell. The ATSB used multibody simulation software to evaluate the contact path of a coil that was forced to topple from the cradle. The results indicated that a unitised coil (without any telescoping) would have only had one edge in contact with the cradle slope face as it toppled. The path of the contact represented an arc up and outward toward the top edge of the cradle, which was consistent with the path of the upper inboard contact mark (‘top contact marks’ shown in Figure 14). When the simulation was repeated with a telescoped coil (using 235 mm estimated telescoping) a second contact path was also observed, consistent with the lower outboard marks (‘bottom contact marks’ shown in Figure 14).
Similar occurrences
A search of the ATSB and Office of the National Rail Safety Regulator shared occurrence database was conducted for similar events where it had been reported that a jumbo coil had fallen or moved during transit or upon arrival at the destination. The search was limited to occurrences within NSW from 20 January 2013 and Victoria from 19 May 2014[20] until the date of the occurrence on 30 March 2018. Where available, supplementary detail of the occurrences were provided by PN. The search returned seven related records, details of which included:
Four records confirmed as jumbo coils that were found out of position in their cradle. Pacific National advised that they were unable to determine whether the load had moved in transit or had been incorrectly loaded at the departure point.
A coil that was reported to have fallen over, however, it could not be confirmed if this was a jumbo coil. Pacific National could not provide any further detail on this event.
A wagon at the Melbourne Freight Terminal, when inspected, was found to have steel straps broken on coils in both cradles. The straps were subsequently sticking out of gauge.
A jumbo coil was found out of position in its cradle at the Melbourne Freight Terminal. In this occurrence, the jumbo coil had been carried in a demountable cradle on an NQJF wagon. The occurrence record described that the coil was found to have moved to one side of the cradle, was tilting heavily, and that the rubber matt was detached from one cradle face. Pacific National advised that they replaced the rubber mat and wheels on this wagon as corrective actions before it was returned to service.
In addition, the ATSB were made aware of two subsequent occurrences where coils had been found to have moved. In the first, on 25 August 2018, multiple jumbo coils were found to have moved to one side of their cradles upon arrival at the Melbourne Freight Terminal. PN advised that they had conducted an internal investigation into this occurrence and could not determine whether the load had moved in transit or had been incorrectly loaded at the departure point.
In the second, which occurred on 12 April 2020, a roll-by inspection conducted en-route detected a jumbo coil that had shifted to one side of its cradle. As a result, the train was stopped and the affected wagon was removed. PN advised that they had reviewed closed-circuit television footage of the wagon as it departed Port Kembla, which confirmed that the coil had been correctly loaded and had subsequently moved in transit.
While on the journey from Port Kembla, New South Wales to Melbourne, Victoria, a 16 t jumbo steel coil fell from the trailing cradle of the 35th wagon on train 6WM2 after passing the Seven Mile Creek Bridge near Winton, Victoria. After falling from the wagon, the coil impacted the ballast twice and the trailing wagons, causing damage and affecting the alignment of the east and west tracks. The coil subsequently came to rest between the two tracks at about 204.5 km. Train 6WM2 received damage to 39 of the trailing wagons to varying extents.
Soon after, a scheduled passenger service (train 8615) travelling in the opposite direction impacted the unravelled tail of the coil and associated track damage at a speed of about 110 km/h, but did not derail. As it travelled over the damaged track, the train was subjected to large lateral accelerations sufficient to throw members of staff into benches and the sides of the buffet car resulting in minor injuries. No injuries to passengers were reported. The locomotive of train 8615 received superficial damage.
The driver of train 8615 had performed a roll-by inspection of 6WM2 as it passed after the jumbo coil had fallen off. However, given the relative speed of the trains (about 160 km/h), a roll-by inspection would only be effective at detecting the presence of gross errors such as smoke or sparks and loose items moving in the wind, none of which were reported on 6WM2. Therefore, it was not unreasonable that the driver of the passenger train did not detect the absence of a single coil.
The evidence did not suggest that the handling of 6WM2, the condition of the wagon, or the track geometry contributed to the occurrence.
This analysis will examine the condition of the demountable cradle the coil was carried in, and the steel straps used to unitise the coil. Further, it will discuss the requirements for load restraint of freight when carried by rail and whether the load restraint system used for the carriage of jumbo coils had been assessed against these requirements.
Unitising straps broke
Closed-circuit television footage captured as the train passed Wangaratta Station was not of sufficient quality to determine whether the unitising straps (both radial and circumferential) were present at that time. Although it did indicate that the coil had not unwound and was not significantly leaning. There was, however, some evidence consistent with the coil having begun to telescope near to its outside diameter.
Pictures of the coil in its final position showed that all four straps were missing and that the outer layers of coiled steel were telescoped by about 235 mm. Two broken straps were found near the initial impact location and another broken strap was on the ground about 1 km prior to the occurrence location. As the broken straps were not recovered, the mechanisms of failure could not be determined.
The inspection of the cradle showed that there were two separate bands of witness marks left on the cradle from the coil as it toppled. These marks showed a distinct pattern consistent with multiple layers of the coil coming in to contact with the cradle at the same time, indicating the coil had already telescoped before it toppled. This was supported by the ATSB’s simulations, which indicated that the contact path for toppling of a similarly telescoped coil was consistent with the witness marks observed on the cradle.
Therefore, while it could not be conclusively determined when the unitising straps broke, it was likely that at least some broke (either radial or circumferential) during transit, reducing the ability of the remaining straps to maintain the coil as a unit. Subsequently, the remaining straps either also broke due to the forces imposed on them or were insufficient to prevent the coil from telescoping. ATSB calculations showed that the observed amount of telescoping would have resulted in an estimated 46 per cent reduction in the coil’s stability when compared with a unitised coil. Consequently, the lateral stability of the coil was reduced increasing the risk of it falling from the cradle.
Rubber load mat missing
The demountable cradles were designed to carry jumbo coils and included the use of rubber load mat on the surfaces that were normally in contact with the steel coil (the angled ‘slope faces’). Inspections of the jumbo coil cradle after the occurrence identified that there was no rubber load mat present on one side of the cradle and it was likely that this had been the case for some time. This was evident from the photographs obtained from a member of public showing the mat had been missing since at least June 2017. Further, Pacific National’s (PN) maintenance records indicated that the wagon had been maintained about 1 month prior to the occurrence, but the missing mat, which had fallen to the floor of the cradle, was not noted or repaired.
The use of rubber load mat (or other soft materials such as wood) to prevent steel-on-steel contact is common practice in freight loading. The Rail Industry Safety Standards Board Code of Practice for the loading of rail freight, PN’s Freight Loading Manual (FLM), and the cradle manufacturer, stated that the use of rubber load mat served the purposes of increasing friction between the surfaces and protecting the load from damage.
Therefore, the absence of the mat resulted in steel-on-steel contact between the coil and the cradle on one face. This reduced the friction between the contact surfaces making relative movement of the two surfaces more likely. In turn, this increased the likelihood of wear on the unitising straps, particularly if the radial straps were positioned within the area in contact, which was permitted by the loading rules. This increased the risk of the unitising straps breaking during the journey.
Rubber load mats not required in the Freight Loading Manual
The Rail Industry Safety Standards Board Code of Practice, representing common practice, recommended that coil cradles be lined with rubber, synthetic or timber. The PN FLM included several references to the use of rubber load mats to prevent steel‑on‑steel contact. However, these were contained within the general sections of the FLM that were not load‑specific. The section specific to the loading of jumbo coils did not mention rubber load mat nor did it contain any guidance, or requirements for the minimum acceptable condition for use of jumbo coil cradles.
Therefore, as there was no specific requirement in the FLM to have rubber load mat fitted to jumbo coil cradles, there was no subsequent obligation for PN to check for the fitment of, and the condition of the mats during inspections and maintenance activities. This allowed the continued use of cradles without matting or with damaged matting. This diminished the effectiveness of having rubber load mats fitted as a means for restraining loads and minimising load damage.
The absence of a requirement to check was evident at the recent maintenance inspection where there were no records indicating the condition of the mat had been considered. This was a missed opportunity to replace the mat and thereby reduce the risk of the coil moving during the journey.
Radial unitising straps contacting the cradle
When using radial unitising straps on jumbo coils (for steel with thickness less than 2 mm), PN’s FLM indicated that the straps were required to be positioned together ‘near the tail of the coil’. The FLM also required that ‘the tail end of the coil must be positioned below the cradle contact point’. Applying these requirements together allowed a coil to be loaded in an orientation where both of the radial straps were positioned within the contact zone between the coil and cradle. The ATSB’s observations of the loading of jumbo coils at Port Kembla was consistent with these requirements. This increased the risk that, if one strap broke due to relative movement between the coil and cradle, the other strap would likely also fail, having been subjected to the same contact conditions. However, if a strap was always free from contact with the cradle, this would ensure that the coil remained unitised and thereby prevent telescoping.
After the incident, BlueScope implemented a practice of applying a third strap in a position diagonally opposite to the first two. This practice ensured that, regardless of orientation of the coil when placed in the cradle, there would always be one strap free from contact. However, the practice was not a requirement in the PN FLM.
Load restraint system
PN and ATSB calculations established that the occurrence jumbo coil would topple when subjected to less than 1 g lateral acceleration and PN provided information that the cradle ‘provided containment (not restraint)’. Yet both PN’s FLM and the Rail Industry Safety Standards Board Code of Practice indicated that a load restraint system should restrain a load against an applied lateral acceleration of 1 g. The Code of Practice also provided operators the discretion to nominate their own values of acceleration ‘where they can demonstrate that the alternative values are safe and fit for purpose for that particular application’ but PN had not done so.
Technical specifications relating to the design of the jumbo coil cradles required that the cradles ‘be structurally sound for acceleration of 1 g laterally’. However, the specifications did not require the cradle to provide restraint of the load (jumbo coil) when subjected to the same acceleration. Further, there was no guidance on how to maximise the load restraint provided by the cradle. PN did not require any additional restraints such as tie down straps or chains, as long as the width of a coil was greater than one-third of its diameter.
However, the occurrence cradle had been in-service transporting jumbo coils since 2012, and PN had been regularly transporting jumbo coils using other similar cradle designs since their formation in 2002. A search of the reportable occurrence database, from 20 Jan 2013 to the date of the occurrence, found only two other instances where a jumbo coil was known to have tilted (toppled). Since the occurrence, the ATSB have been notified of two further occurrences where jumbo coils have been found out of position in their cradle, however none of these resulted in a loss of freight. The low number of other occurrences suggested that the cradles, in their current state, may have provided sufficient restraint for jumbo coils for normal in‑service loads when coils are prevented from telescoping.
However, PN did not include any assessment of the suitability of the load restraint provided by the cradle designs, nominate an alternative value of acceleration, or have related requirements in either of their technical specification for the cradle design or in the FLM. Therefore, although there had only been a low number of reported load shifts, PN had not demonstrated that the load restraint system of the demountable cradles carrying jumbo coils was safe and fit for purpose.
Radial unitising straps not required in the Freight Loading Manual
BlueScope Steel indicated that the jumbo coil involved in the occurrence was fitted with two radial and two circumferential straps, and that this was their standard practice regardless of steel thickness. However, the jumbo coil section of PN’s FLM did not require the use of radial unitising straps when the steel thickness was greater than 2 mm. This implied that there was no significant risk of coil telescoping occurring when the steel was greater than this thickness.
It was likely that the coil, comprised of 3.2 mm thick steel had telescoped after the unitising straps broke. Therefore, this suggested that the PN FLM limit of 2 mm was not effective at controlling the risk of coil telescoping. While this did not contribute to the occurrence, as the coil was fitted with straps, a latent risk existed, as there was no directive to prevent similar jumbo coils from being transported without radial straps.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the loss freight involving train 6WM2 and subsequent track obstruction, near Winton, Victoria, on 30 March 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
A jumbo coil on the 35th wagon of the train became unstable and fell from its cradle in transit and came to rest between the east and west tracks. A passenger train travelling the opposite direction struck the coil and associated damaged track.
It was likely that the steel straps used to unitise the jumbo coil broke, allowing the centre of the coil to telescope, which adversely affected its stability.
A rubber load mat had become detached from one side of the jumbo coil carrying cradle. The resulting metal-on-metal contact between the cradle and coil both increased the likelihood of coil movement, and the risk of the unitising straps breaking.
Pacific National's Freight Loading Manual, specific to the loading and unitising of jumbo coils, did not require the use of rubber load mat on cradles. Consequently, there was no requirement to consider the condition of load mat during inspection and maintenance. This allowed the continued use of cradles without load mat, which decreased their effectiveness at restraining loads.[Safety issue]
Pacific National's Freight Loading Manualdid not require a combination of radial unitising straps on jumbo coils positioned such that a strap was always free from contact with the cradle. The provision of straps in this configuration would have reduced the risk of the coil telescoping in the event of strap breakage due to contact with the cradle. [Safety issue]
Other factors that increased risk
Pacific National did not demonstrate that the load restraint system provided by demountable cradles carrying jumbo coils was safe and fit for purpose. [Safety issue]
Pacific National's Freight Loading Manualdid not require the use of radial unitising straps to prevent telescoping on jumbo coils where the thickness of the steel was greater than 2 mm. [Safety issue]
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Rubber load mats not required in the Freight Loading Manual
Safety issue description: Pacific National's Freight Loading Manual, specific to the loading and unitising of jumbo coils, did not require the use of rubber load mat on cradles. Consequently, there was no requirement to consider the condition of load mat during inspection and maintenance. This allowed the continued use of cradles without load mat, which decreased their effectiveness at restraining loads.
Safety issue description: Pacific National's Freight Loading Manual did not require a combination of radial unitising straps on jumbo coils positioned such that a strap was always free from contact with the cradle. The provision of straps in this configuration would have reduced the risk of the coil telescoping in the event of strap breakage due to contact with the cradle.
Safety recommendation description: The ATSB recommends that Pacific National address the risk presented by continuing to allow jumbo coils to be loaded in an orientation where all the radial straps are positioned within the contact zone between the coil and cradle.
Safety issue description: Pacific National did not demonstrate that the load restraint system provided by demountable cradles carrying jumbo coils was safe and fit for purpose.
Safety recommendation description: The ATSB recommends that Pacific National review the load restraint system provided by the demountable cradle design to demonstrate that they sufficiently restrain jumbo coils against lateral accelerations and prevent coils from moving and falling during transit.
Radial unitising straps not required in the Freight Loading Manual
Safety issue description: Pacific National's Freight Loading Manual did not require the use of radial unitising straps to prevent telescoping on jumbo coils where the thickness of the steel was greater than 2 mm.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
Additional safety action by BlueScope Steel
From 12 April 2018, BlueScope Steel introduced a requirement for a third radial strap to be applied to any jumbo coils to be transported by rail wagon to Western Port, Victoria. On 11 May 2018, they extended this requirement to all jumbo coils transported by rail wagon.
In addition, BlueScope Steel indicated that they have proposed to:
Undertake a review of the current load restraint system, working with the carrier to refine a representative load case for jumbo steel coil. This review will cover the physical aspects of the coils being transported, combined with the carrier transport cradle(s) to determine the total load restraint system.
Additional safety action by Pacific National
Pacific National issued a safety notice to drivers on 8 June 2018 requiring jumbo coils be unitised with a minimum of three radial and two circumferential straps, the notice also indicated that they:
Had conducted ride performance tests between Port Kembla and Melbourne, which identified that, when passing through some locations steel trains were experiencing vertical accelerations above 1 g. Consequently, drivers were instructed to implement speed restrictions in these locations (including a 70 km/h restriction that included the occurrence location) until further notice.
Reduced the maximum allowed aspect ratio of jumbo coils (diameter/width) from 3:1 to 2.39:1.
Reduced the maximum allowed telescoping of jumbo coils to 75 mm, and only when two circumferential and three radial straps were fitted.
Further, Pacific National have undertaken the following safety actions relating to this type of occurrence:
Established the Freight Load Irregularity Prevention Network Group with a defined charter to reduce the number of load irregularity events for all freight product types including the review and analysis of Pacific National load irregularity events.
Reviewed and updated the load incident management procedure to ensure all load irregularity events are accurately identified, captured and investigated by Pacific National.
Implemented a third party freight loading assurance auditing program of customer sites to monitor Freight Loading Manual compliance and performance. This has included joint audits by Pacific National and BlueScope Steel in relation to jumbo coil transport by rail.
Implemented a routine testing program to monitor in-train forces associated with the transportation of steel products. This included constantly reviewing data to identify routes that contribute to elevated in-train forces and monitor self-imposed speed restrictions to minimise track related factors that could reduce the effectiveness of current containment measures for steel product.
Installation of closed-circuit television at key locations to assist in the identification of Freight Loading Manual non-compliant loads prior to departure (including Morandoo, New South Wales, Port Kembla and the Melbourne Freight Terminal). closed-circuit television has also been installed at Junee, New South Wales, to provide additional ability to monitor potential load shift issues in transit.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Australian Rail Track Corporation
Pacific National
V/Line
Rail Industry Safety Standards Board
BlueScope Steel.
References
Australian Rail Track Corporation 2018, Route Access Standard DIRN Section Pages D53 - Albury to Somerton, p4, version 1.8.
Rail Industry Safety and Standards Board 2017, Code of practice – Loading of rail freight, version 1.0.
Thompson, C., et-al 2018, Continuous measurement of passenger ride comfort and track condition on the V/Line network, CORE 2018, Railway Technical Society of Australia.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Pacific National
Australian Rail Track Corporation
V/Line
BlueScope Steel
the Rail Industry Safety Standards Board
the engineering contractor
train crew of 6WM2
the Office of the National Rail Safety Regulator.
Submissions were received from:
Pacific National
BlueScope Steel
the Office of the National Rail Safety Regulator.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 19/11/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 30 March 2018, at about 1440 Eastern Daylight-saving Time,[1] a 16 t jumbo (steel) coil[2] fell from Pacific National (PN) freight service 6WM2, which was traveling south toward Melbourne, Victoria on the east track of the Defined Interstate Rail Network (DIRN).[3] After falling from 6WM2, the coil struck and caused damage to both tracks before coming to rest between, and obstructing both tracks at about the 204.5 km mark[4] near Winton, Victoria (Figure 1). Subsequently, at about 1450, V/Line passenger service 8615, traveling north on the west track, struck the tail of the coil and the damaged west track at a speed above 100 km/h, but did not derail. The driver of 8615 notified the Australian Rail Track Corporation (ARTC)[5] train control that they had struck the coil and reported minor damage to the train and no injuries to passengers.
Figure 1: Location of track obstruction and associated track features on the DIRN
Source: Google earth, annotated by the ATSB
Loading at Port Kembla, NSW
On 27 March 2018, Bluescope Steel loaded jumbo coil number 1H8S2486 onto the ‘A-end’ (trailing) cradle of PN wagon number NQJF-21574 along with another coil in the ‘B-end’ (leading) cradle. Information provided to the ATSB by Bluescope Steel indicated that coil 1H8S2486 weighed 16.04 t, was 1.93 m in diameter, 0.8 m wide and comprised a wound sheet of 3.2 mm gauge steel that was unitised with steel strapping (two circumferential and two radial straps).
On 28 March 2018, loaded wagon NQJF-21574 was inspected by PN terminal operators and moved to South Yard, Port Kembla, New South Wales (NSW). On 29 March 2018, the wagon was marshalled as the 35th wagon of train 6WM2.
Train 6WM2 comprised four locomotives hauling 75 wagons for a combined length of 1,275.3 m and total weight of 5,131.8 t. The train was inspected by PN terminal operators who provided a completed brake certificate[6] to the outgoing train crew. Train 6WM2 departed Port Kembla at 2354 and received a roll by[7] inspection from PN terminal operators with no issues reported.
Journey
Train 6WM2 was a scheduled service carrying steel products from Port Kembla (Wollongong) to Melbourne Freight Terminal. Train 6WM2 travelled north from Port Kembla to Sydney Freight Terminal before traveling on the DIRN for the remainder of its journey to Melbourne.
On 30 March 2018, at about 0300, train 6WM2 arrived at Chullora, NSW for a crew change with a two-man crew from Junee, NSW relieving the Port Kembla drivers. The disembarking crew reported that the train was running well and conducted a roll-by inspection of the departing train with no issues reported.
At about 1055, train 6WM2 arrived at Junee for its second crew change with a two-man crew from Melbourne taking over. Again, the disembarking crew reported that the train was running well and conducted a roll-by inspection of the departing train with no issues reported.
On its journey from Junee to Wangaratta, Victoria, train 6WM2 crossed[8] passenger train ST24 and freight train 6MC7, who both conducted roll-by inspections of 6WM2 with no issues reported. Closed circuit television footage captured from a platform at Wangaratta Station at about 1427 identified that all jumbo coils on train 6WM2 were present and not grossly out of place. The quality of the footage was not sufficient for the ATSB to determine whether the unitising straps were still attached to the coils on wagon NQJF-21574, but it did show that the incident coil in the trailing cradle had not unwound, tipped or shifted drastically.
The incident
At about 1440, train 6WM2 passed the incident site (204.5 km) at a speed of about 76 km/h. Track grade leading to the incident site was relatively flat and the driver had been maintaining moderate traction power (throttle between notches 2 – 5) for approximately 2 minutes prior to the loss of the coil. The drivers of 6WM2 reported nothing remarkable about the train’s behaviour at the incident location and were not aware that the coil had fallen off at that time.
At about 1448, train 6WM2 proceeded south and crossed the northbound V/Line passenger service 8615. The crew of 8615 conducted a roll-by inspection of 6WM2 with no issues reported.
At about 1450, the driver of train 8615 saw the coil obstructing the track and applied the emergency train brakes. Train 8615 subsequently struck the unravelled tail of the coil and associated damaged west track at a speed above 100 km/h, but did not derail. Figure 2 shows the damaged west track (foreground) and jumbo coil between the tracks (background). The photo is oriented southbound towards Melbourne on the west track. This is facing against the direction of travel of train 8615.
Figure 2: Incident location 204.5 km - looking south on the west track
Source: ARTC
After bringing the train to a stand, the driver of 8615 advised ARTC train control that they had struck a steel coil from 6WM2 and that there was significant damage to the west track. In response, ARTC train control applied signal blocks to both tracks and requested that the drivers of 6WM2 stop and investigate their train.
Post-incident inspections
At about 1454, the driver in control of 6WM2 stopped his train at the next suitable location, coming to a stand at 190.475 km. Between 1517 and 1600, the second driver inspected train 6WM2 and reported to ARTC train control and PN that a coil was missing from the 35th wagon, NQJF-21574. The driver also reported that 39 trailing wagons had been damaged to varying extents. The damage to trailing wagons included damage to steps, handbrakes, brake cylinders and bearing caps, and the driver advised that 6WM2 would not be able to continue without repair.
The driver of V/Line passenger service 8615 inspected his train and determined that superficial damage had occurred to the locomotive and that there were no passenger injuries. Train 8615 continued its journey to Albury without further incident.
Subsequent inspection of wagon NQJF-21574 was conducted by ARTC in Violet Town, Victoria on 4 April 2018, and by the ATSB at PN’s West Melbourne Yard on 22 May 2018. The inspections, shown in Figure 3, identified:
that the rubber mat was dislodged from one face of the A-end coil cradle
witness marks on the exposed metal surface of the A-end cradle
a break in the wagon frame under the B-end cradle.
Figure 3: Inspection of wagon NQJF-21574
Source: ARTC (top and bottom right images) and ATSB (bottom left image), annotated by the ATSB
Investigation progress
As part of the investigation, the ATSB has interviewed the crew of train 6WM2, reviewed operational information from both rollingstock operators and the infrastructure manager, and analysed information recorded on the on-board recorders for both trains. Further, the ATSB conducted an inspection of wagon NQJF-21574 at PN Yard, West Melbourne and observed jumbo coil loading at Port Kembla. The investigation is ongoing and further analysis work to be completed includes:
examination of the loading, load restraint and examination processes with respect to jumbo coil wagons
review of the frequency and mechanisms of historical occurrences of jumbo coil load shift
examination of possible dynamic forces acting on the wagon
analysis of the effect of wagon condition on the incident
analysis of the track conditions, both historical and on the day, present in the vicinity of the incident
gather further information from involved parties.
__________
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 6 April 2018, the ATSB commenced an investigation into a Terrain Awareness and Warning System (TAWS) warning and missed approach involving a Beechcraft B200, VH-FDW, near Gladstone Airport, Queensland, on 5 April 2018.
During the conduct of the area navigation (RNAV) approach for runway 10 the pilot received a ‘Terrain, Terrain, Pull up’ warning. As the aircraft was in instrument metrological conditions (IMC), the pilot responded in accordance with standard operating procedure. Only a single warning presented and the pilot climbed the aircraft to an appropriate safe altitude. At that point, the aircraft was no longer in IMC and the pilot conducted a visual approach, landing without further incident.
The ATSB obtained additional information from the operator that identified the TAWS warning received as a nuisance alert. The aircraft was not in danger of impact with terrain and was safely established on the RNAV runway 10 profile. The operator had known about nuisance alerts on this approach since it was amended in 2010, when the final track was aligned over high ground near Mt Larcom. Other operators also experienced nuisance alerts in the same location.
The operator had implemented use of the TAWS flap override function to prevent nuisance alerts specifically for the Gladstone RNAV runway 10 approach. Before implementing this procedure, the operator consulted with the TAWS manufacturer and conducted a flight validation. On this occurrence, the pilot forgot to select flap override.
At the time of publishing, Airservices Australia had completed a draft revised RNAV runway 10 approach for Gladstone that was runway aligned and not over the high terrain leading to the nuisance TAWS alerts. While still requiring a flight validation, this new approach should eliminate the nuisance TAWS alerts.
The ATSB reviewed the information relating to this occurrence as well as information relating to previous TAWS occurrences involving the RNAV runway 10 at Gladstone. Based on this review, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation, but will continue to monitor TAWS occurrences involving all operators.
Occurrence summary
Investigation number
AO-2018-029
Occurrence date
05/04/2018
Location
Gladstone Airport
State
Queensland
Report release date
21/08/2018
Report status
Discontinued
Investigation level
Defined
Investigation type
Occurrence Investigation
Investigation status
Discontinued
Mode of transport
Aviation
Aviation occurrence category
E/GPWS warning
Occurrence class
Incident
Highest injury level
None
Aircraft details
Manufacturer
Raytheon Aircraft Company
Model
B200 King Air
Registration
VH-FDW
Serial number
BB-1880
Aircraft operator
Royal Flying Doctor Service of Australia (Qld Section) Ltd
On 2 April 2018 at about 0615 Eastern Standard Time (EST), a Kavanagh Balloon E-240, registered VH-DUX, departed from Fawkner Park, Victoria (Vic), on a passenger charter flight to Westerfolds Park, Templestowe, Vic (Figure 1). On board the balloon were a pilot and 10 passengers. A second company balloon also departed around the same time.
Figure 1: Map showing take-off and landing locations
Source: Google, annotated by ATSB
The evening before the flight, the pilots of both balloons reviewed the weather forecast for the flight. The forecast wind speed for the planned flight altitude was a 10–12 knot south-westerly. Using this information, the pilots elected to conduct the flight with Westerfolds Park as their target landing site.
On arriving at Fawkner Park on the morning of the flight, the pilots again reviewed the forecast and checked the actual wind speed and direction using a pibal.[1] The pilot of VH-DUX later reported the wind speed was a 7 knot south-westerly at ground level. Prior to the flight, the ground crew and the pilots gave the passengers several safety briefings. These briefings included what to expect during the take-off, flight and landing, and the required positions in the basket for these stages of flight. The pilot reported that given the conditions he expected to conduct a lay-over landing, during which the basket would tip and drag upon landing.
About 45 minutes into the flight, the pilot reduced altitude to allow the passengers a better view. The pilot later reported the wind at this point was about 10 knots at a height of about 200–300 ft above ground level, and noted a change in wind direction, to include a more westerly component. The pilot communicated with the pilot of the other balloon and determined that they would not be able to land at their target landing site of Westerfolds Park.
The pilot of VH-DUX then began looking for an alternate landing site along the now anticipated flight path, and identified Rosanna Golf Course as a suitable landing site.
In preparation for the landing, the pilot used the rotation vents[2] to orient the balloon so that the long side of the basket was across the direction of travel and the side with the cushions would touch first.
About five minutes before landing, the pilot informed the passengers that the basket might end up on its side and he instructed them to assume the proper landing position, which included:
The pilot later reported that all passengers adopted the correct position. About two minutes later, the pilot began descending the balloon slowly using the parachute vent.[4] At the beginning of the golf course, the pilot rapidly descended the balloon to land in the available space and the wind conditions, using the Lite Vent.[5] The balloon touched down and the pilot conducted a lay-over landing (Figure 2).
During the landing, one passenger sustained minor injuries and the aircraft was not damaged.
Figure 2: Balloon drag marks
Source: Global Ballooning, annotated by ATSB
Aircraft loading details
The maximum passenger capacity of the balloon was 11 people. During the landing, the pilot and the passengers stood as shown in Figure 3, with the passengers facing the direction indicated by the white arrows.
Figure 3: Basket loading configuration
Source: ATSB (not to scale)
The basket featured foam padding around the top bars and foam cushions for the passengers’ backs with handles for the passengers to hold (Figure 4). When positioned for landing, the passengers’ shoulders were roughly at the level of the top of the basket sides, or just below.
The passenger instruction cards were affixed to the interior of the basket (Figure 4).
Figure 4 Interior of basket
Safety analysis
Prior to the flight, the pilot reviewed the weather forecast and noted that the wind conditions were high, but within acceptable limits. He elected to conduct the flight, considering that he may need to conduct a lay-over landing.
During the flight, the pilot noted that the wind strength was as forecast. He then prepared for a lay‑over landing and briefed the passengers in preparation.
During the landing, a passenger sustained a minor injury. The investigation could not determine the cause of the injury.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Due to the expected wind conditions, the pilot conducted a lay-over landing, during which a passenger was injured.
Safety message
This incident underlines the importance of following the safety procedures and ensuring that all passengers fully understand the instructions. Due to the effective communication and briefings, the passengers were able to assume the correct landing position, which resulted in only one passenger suffering minor injuries.
The United States Federal Aviation Administration publication: Balloon Flying Handbook provides further information on high-wind landings and passenger briefings and management.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
