Executive summary

What happened

On Saturday 30 May 2020, V/Line train 8185 was operating as the 2216 evening service from Melbourne’s Southern Cross Station to Wendouree in suburban Ballarat. The train was a three-car VLocity Diesel Multiple Unit (DMU).

The service was scheduled to stop at Ballarat Railway Station in central Ballarat before proceeding to its destination at Wendouree. The station was located a short distance before the Lydiard Street North level crossing that was fitted with heritage swing gates.

Approaching Ballarat Railway Station, the train did not respond to the driver’s braking demands and could not be stopped. At about 2336, the train passed through the station and impacted the level crossing gates that were closed to rail traffic. The train was estimated to be travelling at between 93 and 97 km/h at the time of the collision.

The impact destroyed the pair of southern gates, damaged the front and side of the train, and resulted in gate debris being scattered into the surrounding area. There were no injuries to members of the public from this debris.

The driver subsequently brought the train to a stand approximately 640 m beyond the station. One of the two passengers on board required hospitalisation, and the train driver and conductor sustained minor injuries.

What the ATSB found

It was found that slippery rail conditions existed for at least the final 2.5 km of the approach to Ballarat Railway Station and probably the final 5 km. It was concluded that moisture from light rain was the primary environmental factor influencing the formation of very low levels of adhesion[1] at the contact between the train’s wheels and the rail head. This substantially reduced the braking performance of train 8185.

It was found that the sanding system installed on train 8185 to improve adhesion in slippery conditions was ineffective at improving braking performance during this event. It was concluded that several factors potentially adversely influenced the effectiveness of the sanders.

The design configuration of the sanding system, and specifically the locating of the sanding nozzles behind wheels, was not consistent with the current design practice of locating sanding nozzles ahead of the wheel-rail interface being targeted.

It was also found that there were missed opportunities to identify weaknesses in the sander design configuration. Operator acceptance of the three-car VLocity braking system did not include assessment of sander performance against defined criteria for improving adhesion. In addition, V/Line investigation of previous rail safety occurrences that involved poor wheel-rail adhesion did not examine sander effectiveness.

Other factors that increased the risk of diminished sander performance included vegetation contamination in sander mechanisms that reduced sand flow, and the depletion of sand in one sand box. These factors were associated with sander maintenance and train preparation processes. It was also noted that the strong crosswinds present that evening may have adversely influenced sand distribution.

Loss of adhesion leading to increased stopping distance was not recognised as a risk source for collision in V/Line’s risk registers. It was concluded that there were insufficient risk controls in place to mitigate against a train arriving at Ballarat Railway Station travelling at excessive speed and being unable to stop before impacting the Lydiard Street North level crossing gates.

The configuration of the crossing protection that used swing gates introduced additional hazards compared to boom barrier style crossing protection and risk controls were not in place to manage the unique risks that existed at the crossing.

What has been done as a result

V/Line has advised the ATSB of the following safety actions that address five of the identified safety issues:

• Sanders have been installed on the intermediate cars of VLocity three-car sets. The added units discharge sand in front of the wheel-rail contact point (in the direction of travel) and are operational on all VLocity trains.
• A sand flow test has been added to the VLocity servicing schedule to monitor through-life sander discharge performance.
• The work instruction for checking sand boxes has been reviewed and will be updated to include enhanced guidance on required sand levels.
• A number of additional risk assessments have been undertaken in relation to loss of adhesion leading to increased stopping distance.
• To enhance risk controls associated with the Lydiard Street level crossing, V/Line has reduced the permitted train speed on the approaches to Ballarat Railway Station from 160 to 80 km/h. Boom barrier level crossing protection has been installed at the Lydiard Street North level crossing and speed monitoring has been installed at the Humffray Street level crossing to initiate activation of the Lydiard Street North level crossing protection in the case of a train travelling above the design threshold.

On the remaining safety issue, the Australian Transport Safety Bureau recommends that V/Line takes safety action to ensure the performance of sanders on the VLocity three-car set is assessed against defined acceptance criteria for improved braking performance in low adhesion conditions.

Safety message

This occurrence has highlighted the importance of passenger rail operators having risk controls in place to prevent collisions because of slippery rail conditions. Controls include effective train-borne equipment such as wheel slip/slide protection systems and sanders, and targeted risk controls at locations vulnerable to risks associated with train overrun.

The occurrence

Journey before incident

On Saturday 30 May 2020, V/Line[1] train 8185 departed Melbourne’s Southern Cross Station at its scheduled time of 2216[2] travelling to Wendouree in suburban Ballarat. The train stopped at several stations en-route to Ballarat, including Ballan about 36 km to the east. At about 2318 on the approach to Ballan, train 8185 experienced wheel slide[3] during braking but was able to stop at the station. The driver observed light rain and gusty winds at this time.

Figure 1: Rail route from Melbourne to Ballarat and Wendouree

Source: Google Maps. Annotated by Chief Investigator, Transport Safety (CITS)

Departing Ballan, the driver experienced wheel slip[4] events during the next 12 km when powering and, as the journey progressed, instances of wheel slide during braking. The train’s event recorder detected that the wheel slip/slide protection (WSP) system was active for about 75 per cent of the time in the first 5 km after departing Ballan. The WSP train system is activated automatically to assist management of wheel slip and slide in slippery conditions.

The incident

The driver reported that they commenced braking slightly earlier than they normally would on the approach to Ballarat due to the wet and windy weather conditions. The train’s event recorder detected braking being initiated at 23:33:44, approximately 5.1 km from the intended stopping point at Ballarat Railway Station. Train logger information indicated that the train was travelling at just over 160 km/h.

Over about 650 m, the brake was applied, then released and then reapplied. During these early brake applications, the train’s WSP system detected wheel slide, which was followed by activation of the sanding system. The brake was again released at 23:34:04, with the train about 4.3 km from the intended stopping point and estimated to be travelling at between 150 and 155 km/h.[5]

The train then coasted for 22 s, after which the driver made a further brake application. At this point, the train was approximately 3.4 km from its intended stopping point at Ballarat Railway Station and travelling at approximately 160 km/h. Four seconds later, the train’s WSP and sanding systems were activated by the braking system.[6]  

When about 2.6 km from the train’s intended stopping point, the driver increased braking to a full-service brake application. The full-service braking was then maintained except for a short reduction in brake demand for between 3 and 4 s when the train was about 1.5 km from the station. Under full-service braking, the speed of the train was reducing at an average rate of about 0.2 m/s² compared to the design rate of 0.95 m/s² in dry conditions.

About 730 m from the intended stop at Ballarat Railway Station, the train passed over Humffray Street North level crossing and estimated to be travelling at between 120 and 125 km/h. The flashing lights, bells and boom barriers were all operating when the train passed through the crossing but with reduced warning time.[7] Seven seconds after passing over the crossing, and probably travelling at between 110 and 119 km/h, the train passed through a set of facing points (number 39 points) and associated turnout that were speed limited to 40 km/h, and onto the southern track that led to platform 1 at Ballarat Railway Station.

At 23:35:49, and now about 300 m from the intended stopping point, the driver moved the brake controller from a full-service to an emergency brake application. The train entered the station travelling at about 100 km/h.

The train passed its intended stopping point at the western end of Ballarat Railway Station at 23:35:59, travelled through departure signal 20 that was at stop, and entered the Lydiard Street North level crossing at a speed estimated to be between 93 and 97 km/h (Figure 2).

Figure 2: Train 8185 having impacted the first gate and about to strike the second.

CCTV snapshot of train having entered the level crossing traveling from right to left.
Source: V/Line Corporation

About a second before the train passed through the crossing, the road traffic lights changed from green to flashing amber as the train occupied a track circuit[8] for the crossing. However, the gates were still across the railway track rather than protecting the crossing from road traffic and were struck by the train. CCTV had recorded a group of three pedestrians walking across the level crossing approximately 49 s before the train passed across Lydiard Street North.

The train continued westwards, through a set of trailing points that were also speed limited to 40 km/h. It then passed over the Doveton Street North level crossing that was about 400 m after its intended stopping point. The flashing lights, bells and boom barriers were operating when the train passed through the crossing, but with reduced warning time. The train came to a stand about 640 m beyond its intended stop.

Following the incident

After stopping, the driver communicated with the V/Line regional train control centre (Centrol) to report the incident and arrange for an emergency response. The conductor, who had been in the rear driver’s cab, moved forward along the train and checked on the two passengers in the front carriage before checking on the driver.

The passengers and crew had been subjected to lateral forces (rough ride) as the train negotiated the series of turnouts. One passenger had been standing near an exit door as the train approached the station. This person sustained head, back, and leg injuries and was taken to hospital by emergency services. The other passenger had been seated and indicated to the conductor that they were uninjured.

Once the passengers were detrained, the conductor was also taken to hospital for assessment before being discharged. The driver of the train sustained minor injuries.

Collision damage to train 8185

The front of the lead car (1270) was significantly damaged as a result of impact with the heritage gates. The driver’s cab survival space was maintained and the windscreen was not penetrated.[9] Impact marks on train front were consistent with portions of the gate support (Figure 3).

Figure 3: Impact damage to the front of train 8185, car 1270

Source: CITS

Part of the gates impacted the left side of the leading car, penetrating the side window surface (Figure 4).[10] The internal fittings remained intact.

Figure 4: VLocity car 1270 impact damage to passenger (left) side leading window

Source: CITS

Level crossing gate damage from collision

Train 8185 was travelling on the southern-most track when it passed through the Lydiard Street North level crossing with the gates closed to rail traffic. The train struck and destroyed the southern-side pair of gates (Figure 5). Parts of the gates were reported to have impacted adjacent buildings. The gates on the northern side of the crossing remained attached to their support posts.

Figure 5: Remnants of the damaged gates on the southern side of the crossing

Source: V/Line

Context

Location

The incident occurred in Ballarat, a Victorian regional city located about 100 km west of Melbourne. Ballarat Railway Station is the main station within Ballarat, and is located adjacent to Lydiard Street North (Figure 6).

Figure 6: Ballarat Railway Station locality and level crossings

Source: Google Maps. Annotated by CITS

Environmental conditions

The Bureau of Meteorology (BoM) weather monitoring station was located at Ballarat Aerodrome, about 8 km from Ballarat Railway Station. The BoM station recorded an air temperature of 9.0 °C and a relative humidity of 90 per cent at 2330 on the 30 May 2020.

Light rain was recorded between 2300 and 2330 on the evening of the incident, registering a total fall of 0.2 mm. The previous recorded rain fall was at around 0300 in the early hours of that day, when 0.2 mm precipitation was also recorded at the BoM station. After the incident, there was no further rain recorded prior to the departure of the first train the following morning.

At 2330, wind was recorded by the BoM as being from the north at 33 km/h, gusting to 42 km/h. The potential for the presence of airborne particulates was considered. The nearest Environmental Protection Agency (EPA) testing station that was recording on the day of the incident was in suburban Melbourne, about 95 km from Ballarat. Data recorded by the EPA showed no significant increase in PM₁₀ particles[11] in Victoria on the day of the incident.

Track information

Track and associated infrastructure were owned by the Victorian Rail Track Corporation (VicTrack) and managed by V/Line Corporation (V/Line). V/Line was responsible for track maintenance.

Track construction and corridor environment

Ballarat is linked to Melbourne and other regional centres by the regional rail network. The track from Deer Park Junction in western suburban Melbourne to around 2 km from Ballarat Railway Station was Class 1 (allowing a maximum speed of 160 km/h) and constructed on concrete sleepers. This track was upgraded as part of Victoria’s Regional Fast Rail (RFR) project that was completed in 2006. The gauge of the RFR upgraded track approaching Ballarat was, on average, about 7 mm narrower than the nominal 1600 mm broad gauge.[12] About 2 km from Ballarat Railway Station the line speed reduced from 160 km/h to 130 km/h. Track construction from this point was a mixture of concrete and wooden sleepers.

Between 6 km to 1 km from the station, the rail corridor was predominantly contained within a shallow cutting. There was a mix of trees, shrubs, and grass in the rail corridor in this area.

Track gradient

From about 6.5 km, the track approaching Ballarat Railway Station was on an approximate 1:52 downgrade. The gradient eased to approximately 1:100 downgrade between 1 km and 2 km from the station, then changed in the vicinity of Humffray Street North to a slightly uphill grade of 1:737. Approximately level track immediately preceded the station, with a slight rising grade of 1:383 recorded along the platform. On leaving Ballarat Railway Station, there was an uphill gradient of approximately 1:71 in the vicinity of Doveton Street.

Signalling Information

V/Line was responsible for the operation and maintenance of the signalling system.

The signalling at Ballarat was operated from the Centrol train control facility in Melbourne. Centrol interfaced with signal interlocking at Ballarat to provide remote monitoring and control. The area was equipped with three aspect colour light signalling.  

Signals 52 and 40 on the approach to Ballarat were equipped with Train Protection and Warning System (TPWS) Train Stop Sensors (TSS)[13] that would have applied the train’s brakes if either of these signals had been passed at stop. In this instance, both signals were at proceed and therefore the TSS was not triggered. The TPWS at this location was not fitted with an overspeed sensor (OSS) that initiates a train emergency brake application if a train is detected as being overspeed.

Signal 40 at Ballarat was located before facing points[14] (39 points) that were set to direct the train to platform 1. The speed limit across these points and turnout was 40 km/h.

Train route and signal status recording

Centrol train control had set the route for train 8185 to Ballarat Railway Station. From signal 52, located about 1 km from the station, the route was set to take the train into platform 1 up to signal 20 (Figure 7). Signal 52 displayed a yellow over green aspect, requiring the train to reduce to medium speed (40 km/h) for signal 40, that was located approximately 500 m from the station.

Figure 7: The route set for and taken by train 8185 at Ballarat

The green line indicates that the route had been set and cleared for train 8185 through to signal 20.
Source: V/Line, annotated by CITS

Lydiard Street North level crossing

The level crossing over Lydiard Street North was immediately adjacent to the west end of the Ballarat Railway Station platforms and located at a chainage of 113.923 rail km from Melbourne (Figure 8).

Figure 8: Aerial view of Lydiard Street North level crossing

Source: Google Maps. Annotated by CITS

A set of swing gates were installed on either side of the rail corridor (Figure 9). The gates were first installed in 1885, and were a heritage-listed element of the preserved station precinct.

Figure 9: Level crossing gates at Lydiard Street North, approaching from the south

Source: Pass Assets - Department of Transport (Vic)

The mechanism to operate the gates was replaced by a motorised system in 2001.[15] When required to permit the passage of rail traffic, the gates were motored closed to road traffic. Further modification was made in 2017 when the pedestrian crossing gates were upgraded to include emergency gate control locks. Road traffic lights also protected the rail crossing. The road manager was the City of Ballarat.

Control of gates

The Lydiard Street level crossing gates were controlled from a signal box at Ballarat until 2016, when control was transferred to the Centrol train control facility in Melbourne. The crossing was equipped with CCTV to assist with this remote operation.

When the level crossing was closed to rail traffic (normal position), departure signals at the station for westbound traffic were set to stop (red aspect over a red aspect). Signal 20, the departure signal for platform 1, was one of three down[16] departure signals located at the west end of Ballarat Railway Station that were similarly interlocked with the gates.

To operate the gates so that they opened for rail traffic, the train controller (at Centrol) moved an on-screen icon from ‘normal’ to ‘reverse’ in the display of the train control system. This resulted in the road traffic lights on either side of the crossing changing to red, stopping road traffic. The train controller was then able to close the gates to road traffic by remote control of the motorised system.

With the gates confirmed closed to road traffic, the train controller would then set the relevant departure signal to a proceed indication, permitting the train to depart towards Wendouree.

Train crew and passengers

The driver

The driver of train 8185 had more than 46 years driving experience. They had been driving VLocity DMU since they were introduced into service in 2005.

In the four months leading up to the incident, the driver worked 23 shifts,11 of which were VLocity runs from Southern Cross Station to either Ballarat or Wendouree. Of these 11 trips, five were with three-car sets and six with six-car sets.

The driver’s last annual Train Driver Safety Audit was conducted in September 2019 with no detected non-conformances, and their most recent periodical medical was completed in February 2020, from which they were assessed as fit for duty.

The driver suffered minor injuries as a result of this incident.

Driver roster and fatigue

The previous 14 days rostering would not have contributed to a fatigue condition. The driver did not work for 10 of the 14 days preceding the incident. That last work day was 29 May 2020 where they worked an 8 hour shift to 2309.

There was no evidence to suggest that the driver’s shift on the day of the incident had led to fatigue being a factor in this incident. On that day, the driver commenced duty at 1700 and first ran a VLocity service from Ballarat to Melbourne, experiencing no operational issues. Arriving at Southern Cross Station, they changed platforms to access train 8185 for the return trip to Wendouree.

There were no other indicators or conditions identified that suggested driver fatigue was a factor in this incident.

The conductor

The conductor signed on for duty at 1406 on the day of the incident and was completing their fourth and final run of the day when the incident occurred. The conductor was travelling in the rear cab of the train as it approached Ballarat. After the incident, they moved to the front of the train to assist the passengers and driver. The conductor received minor injuries and attended hospital for assessment.

Passengers

There were two passengers on board at the time of the incident. The train had fewer passengers than would otherwise be expected owing to movement restrictions associated with the Covid-19 pandemic. One of the passengers was taken to hospital for treatment following the incident.

Train 8185

Car-set 3VL70

Train 8185 comprised the three-car VLocity Diesel Multiple Unit (DMU) set 3VL70. In the direction of travel towards Ballarat, the set consisted of car DM1270 (a powered car with driving cab), TM1370 (a powered intermediate car), and DM(D)1170 (a powered car with driving cab).

Car-set 3VL70 was purchased as a three-car unit and entered service in 2017. The VLocity type train was designed, manufactured, and maintained by Bombardier Australia.[17] VLocity trains were originally introduced to the Victorian broad gauge network as two-car sets in 2005. In 2006, three-car units were ordered and additional intermediate (TM) cars procured to insert into the existing two-car units. VLocity trains were subsequently operated as three-car and six-car sets.

The three-car VLocity operated to a maximum speed of 160 km/h. Traction power was provided by a diesel engine under each vehicle, driving the cab-end bogie of the DM and DM(D) cars, and the rear bogie of the intermediate TM car, in the direction of travel for train set 3VL70 travelling from Melbourne to Ballarat. Tractive force was delivered from the engine via a hydrodynamic transmission.

Train 8185 on day of incident

On the morning of 30 May, train set 3VL70 received its primary preparation at Geelong.[18] The preparation was recorded on a Vehicle Preparation Form and no train faults were detected during the preparation. The primary preparation included checking sand boxes that supplied sand for braking in slippery conditions. The process did not include objective criteria for the assessment of adequate sand level, and there was no checklist of individual items completed by the preparation driver as part of this task.

Coupled for six-car operation with another three-car set, 3VL70 then operated on western sectors of the V/Line network, before operating as a three-car set on the Ararat to Melbourne (Southern Cross) service (8166), and the Melbourne to Ballarat service (8185).

The driver of train 8185 joined the train at Southern Cross Station. The driver reported that on joining the train, they were not aware of any faults with the train. There was no opportunity nor responsibility on the driver to check sand levels at this point in the day.

Event recorder information

Train 8185

The VLocity was equipped with a Faiveley Transport VM-40 event recorder that logged 40 digital inputs with an additional four internal state digital signals, 11 analogue inputs and eight other channels  from the VLocity subsystems and equipment. The logger recorded key information including driver power and brake controller demand, braking system activity and train location and time from an on-board GPS receiver.

Information on train speed

Two values of speed were logged by car 1270, pulse speed and BCU speed:

• Pulse speed was calculated from the rotating speed of the third axle from the leading end of car 1270 and was also the input to the speedometer display. If this wheelset was sliding during braking, the pulse speed was an underestimate of the speed of the train.
• Brake Control Unit (BCU) speed was calculated (when in braking) from the rotating speed of the fastest rotating axle on car 1270. During a slide event, it was more accurate than pulse speed because it was using information from the wheelset with the least slide (fastest rotating). None-the-less, it could also be an underestimate of the train’s speed during wheel slide.

Both the pulse and BCU speeds underestimated actual train speed during periods when wheels were sliding. Graphed pulse and BCU speeds tended to be saw-tooth in shape (Appendix E, Figure 34), with wheelsets slowing sharply during brake application with slide, and then returning towards actual speed when braking was automatically released to reduce the sliding.

Driver braking and train speed on the approach to Ballarat

The event recorder showed that the driver of train 8185 engaged in three distinct periods of brake application on approach to Ballarat Railway Station (Figure 10 and Table 1).

Figure 10: Locations of brake applications of train 8185 on Ballarat approach

Source: V/Line, Google Maps, annotated by CITS

Table 1: Brake application points, with recorded speeds and an estimated speed

[1] Given the potential underestimate of the recorded pulse and BCU speeds during wheel slide, an estimate of the speed range in which the actual train’s speed would probably lie was made using the logger GPS data. The GPS data was not sufficiently accurate to give instantaneous speeds and estimates were limited to an average over a period. All speeds are therefore estimates only. Source: Pulse and BCU speeds from train data logger. Speed estimate by CITS, using available logger data including GPS.

A graphical representation of the brake demand shows the first two braking periods, followed by the 22 s period of no braking, and then the continuous braking through to the collision (Figure 11). The term ‘brake demand’ refers to the total (load compensated) braking request transmitted from the brake control unit that is converted to a brake cylinder pressure. The range of brake demand was between 0 and 64 kN.[19]

Figure 11: BCU speed[20] and brake demands from the intended stopping point

This graph is drawn from train data logger records. There is some inaccuracy in logged distance information during the sliding event, in addition to the known limitations of the BCU speed. Source: CITS, from VLocity event recorder data

First period of brake application (from position 1 to 2)

At around 6 km from Ballarat Railway Station, the driver shut off power and commenced coasting. When approximately 5.1 km[21] from the station (position 1), the driver-initiated brake demand of 13 per cent of a full-service application.[22] This brake application was held for 13 s, during which the train travelled about 530 m. At the point of brake release (position 2), the train was approximately 4.6 km from the station.

Second period of brake application (from position 3 to 4)

Following about a second of brake release, a brake demand of about 70 per cent of full-service was commenced (position 3), before being eased to about 47 per cent. This second period of brake application lasted for 6 s, with a maximum brake cylinder pressure of 174 kPa[23] being recorded for the power bogie on car 1270. The driver released the brakes (position 4) when the train was approximately 4.3 km from the intended stopping point.

Third period of brake application (from position 5 to collision)[24]

After coasting for approximately 22 s, a third period of brake application commenced (position 5). The train was about 3.4 km from the intended stopping point. The initial brake demand was about 13 per cent of full-service. Then, with the train about 2.6 km from the station stop (position 6), the brake application was increased to full-service (100 per cent), that produced an average brake cylinder pressure of around 297 kPa over the next 66 s. At one point, the brake demand was briefly reduced (for about 3 s) to 30 per cent before being increased back to full-service when the train was about 1.5 km from the station.

With the train approximately 300 m from its intended stopping point, the driver moved from full-service to an emergency brake application (position 7).[25] The emergency braking was maintained as the train passed its intended stopping point at Ballarat Railway Station (position 8), collided with the crossing gates and subsequently came to a stop.

Wheel slip/slide protection (WSP) and sanding activity

The train was fitted with wheel slip/slide protection (WSP) and sanding systems to manage traction and braking in slippery rail conditions (refer braking system description). During all three described periods of braking on the approach to Ballarat, the WSP and sander systems automatically activated (Figure 12).[26]

Figure 12: Graph of event recorder information from car 1270 of train 8185

The figure shows WSP and sanding activity through each phase of braking. It also shows the saw-tooth behaviour of the BCU speed in the periods of heavier braking, and in particular during the full-service application from 23:34:43. Source: CITS, from train 8185 car 1270 event recorder data

Trains operating before and after the occurrence

Data logger records were also examined for the trains operating prior to train 8185, and the first train departing Ballarat the next morning.

Train arriving at Ballarat before train 8185

The previous train to enter Ballarat left Southern Cross Station at 2052 and arrived at Ballarat Railway Station at 2214 (train 8181). This train did not experience any wheel slip or slide events on this journey. The event recorder did detect wheel slip and sanding as power was applied after the trip at about 2331, on the entrance to Ballarat East depot. This event was shortly before the arrival of train 8185 and after the light drizzle had commenced.

Train departing Ballarat prior to train 8185

Train 8174 left Ballarat Railway Station for Southern Cross Station at 2119 on the evening of the incident. The event recorder of this train detected 4 s of WSP activation on the approach to Ballan Station at 2134. The train was braking from 145 km/h when the WSP was recorded. The train stopped safely at Ballan Station.

Train departing Ballarat after train 8185

The first train departing Ballarat after train 8185 was on the following morning (train 8104). The train departed at 0615 and there had been no rain recorded since that on the evening of the incident. The event recorder detected a number of slip and slide events between Ballarat and Ballan, including WSP and sander activity. This suggested that conditions remained slippery the next morning, with moisture probably remaining on the rail head.

Post-incident wheel and rail inspections

Train wheels

Post-incident inspection of train 8185 wheels identified some markings. The wheels of the leading car (1270) exhibited some minor marks approximately 25 mm long around the flange root of the wheels (Figure 13). It could not be determined whether these were caused by the slide incident or a previous event.

Figure 13: Markings on the wheels of car 1270

Source: CITS

Profile measurements of wheels on incident train 8185 were compared to the MP2[27] profile specified by V/Line. An assessment of the wheel profiles indicated that wheelset condition was consistent across the train and had no significant asymmetric wear, flange wear or tread wear. Analysis of wheel hollowing[28] provided by V/Line showed that measurements were within specification.

Track inspection and measurement

Monash Institute of Railway Technology (IRT) was engaged by V/Line to inspect the track during the day following the incident (IRT 2020). Inspections and measurements were at five sites, with three of those sites located on the approach side of Ballarat Railway Station (Figure 14). Site 1 was at the 110.243 km mark, site 2 at the 110.772 km mark, and site 3 at the 112.850 km mark.[29]

Figure 14: IRT measurement sites east of Ballarat Railway Station

Source: Department of Transport (Vic) Pass Assets, CITS

Geometry

Track at sites 1 and 2 consisted of 60 kg rail on concrete sleepers, installed as part of the RFR project. There was also a track cant of approximately 75 mm[30] at these sites, consistent with the shallow radius left-hand curve of 2400 m radius. IRT concluded that rails at sites 1 and 2 were not significantly worn.

Site 3 was at the location of the older 94 lb/ft rail. The down rail showed significantly more wear than the up rail,[31] however transverse rail profiles were found to be close to the specified template.[32]

Rail head contamination inspection and assessment

IRT reported that the surface condition at sites 1 and 2 showed relatively typical levels of contamination, consistent with the presence of normal oxides and dust/dirt. More significant contamination was observed at site 3, with what appeared to be dirt/dust on the surface of the rails (Figure 15). The particulates on the rail head were not tested for composition.

Figure 15: Rail surface condition at 112.850 km chainage, about 1.1 km from station stop

The figure shows some surface dust/dirt on the rail head and grease on the gauge corner of the down rail, the left rail looking towards Ballarat. The source of the dust/dirt is not known. Source: IRT (2020)

Grease was also observed on the gauge corner of the down rail at site 3, which was likely to have been carried from the wayside lubricator located approximately 150 m from this site in the direction of Ballarat Railway Station. The lubricant had not migrated onto the top of the rail where wheel contact was likely to have occurred.

Friction measurements

Measurement of the friction coefficient at the rail surface was undertaken by IRT the day after the incident using a push tribometer within the main wheel-rail contact band. Both dry and simulated wet conditions were measured, with wet conditions simulated by applying water to the rail surface using a conventional watering spray following the dry measurements.

Results showed that on the approach to Ballarat Railway Station between sites 1 and 3, friction conditions were relatively consistent. Dry rails recorded values between 0.42 and 0.47 (average 0.44). This figure reduced once water was applied, with results ranging between 0.28 to 0.33 (average 0.29).

IRT advised that adhesion levels decreased with increasing speed, and maximum friction levels for rolling stock travelling at 160 km/h might be expected to be 39 per cent less than that measured with the tribometer.^[33] Based on this IRT reported figure of a 39 per cent reduction, the average measured wet coefficient of 0.29 would reduce to 0.18 at a train speed of 160 km/h.

Geometric analysis of wheel and rail contact

The effective management of the contact between wheels and rails is an important element of railway operations. ATSB undertook a geometric analysis[34] of the likely wheel rail contact conditions present for train 8185 at sites 1-3. A track gauge of 1593 mm was used for site 1 and 2, reflecting the narrower gauge on the RFR section, and 1600 mm was used for site 3. The leading wheelset (wheel 1 and wheel 8)[35] from the first powered bogie of car 1270, and leading wheelset (wheel 3 and wheel 6)[36] of the first unpowered bogie on that car were used for the analysis.

Sites 1 and 2 wheel-rail interfaces

Sites 1 and 2 were both on a section of mild, left-curving track and, because the sites were of similar geometry, the results of site 1 are presented (Figure 16).

On the high rail of the curve, a narrow band of contact was likely present for typical wheel positions,[37] localised on the gauge shoulder only. Narrow contact in this location was not ideal for promoting good adhesion conditions between wheel and rail. This was also away from the area of the rail targeted by sanding (the central crown) and toward a region of the wheel and rail that was more likely to be affected by any contaminant such as grease that could migrate from the wheel flange.

On the low rail of the curve, wheels were expected to have maintained a relatively broad, central contact that should have been able to utilise any sanding that occurred and should not have been susceptible to grease contamination.

As the low and high rail wheels are rigidly connected, the net available adhesion is the sum of the two. Therefore, while a reduction in available adhesion in braking could be expected on this curve, it is unlikely to have been significant.

Site 3 wheel-rail interface

On the straighter section at site 3, more centralised contact on both rails was predicted for both the leading axle of the car, and the leading axle of the first unpowered bogie (Figure 17).

Figure 16: Site 1 profile overlays showing likely contact scenarios for the leading axle

The figure shows the predicted wheel rail contact of the leading axle during curving at site 1 Three scenarios are shown; a 1mm offset, 2 mm offset and 3 mm offset from flange contact condition . Source: ATSB

Figure 17: Site 3 profile overlays showing likely contact scenarios for two axles

The figure shows the predicted wheel rail contact of the leading axle and third axle of car 1270 at site 3, assuming centralised running. Source: ATSB

Potential contribution of wheel-rail contact geometry to event

The braking response of the train at geometrically different locations consistently indicated low wheel-rail adhesion. This suggests that wheel-rail contact conditions, while not optimal, were probably not substantially contributory to the prevailing low adhesion condition experienced in this occurrence.

Train 8185 braking system

System description

The VLocity braking system automatically blended a combination of hydrodynamic[38] and friction brakes.[39] Brake Control Units (BCUs) were fitted to each car to control the braking and interfaced with the Vehicle Control Unit (VCU). The BCU determined the blend of hydrodynamic and friction braking to ensure the braking effort satisfied required brake demand.

The braking demand request was by the movement of the power/brake controller (PBC) (Figure 18). The PBC operated in power mode when pulled back from the centre ‘off’ position and in the brake mode when pushed forward from the centre position. There were six power notches that dictated the tractive effort. In brake mode, the controller moved seamlessly between minimum and full-service braking. When pushed fully forward, emergency braking was applied.[40]

Figure 18: Power/brake controller, WSP and sanding indicator

Source: CITS

Wheel slip/slide protection

Control systems to manage low adhesion

The term ‘adhesion’ is commonly used in the rail industry to describe the level of friction available to transfer forces between the wheel and the rail.

The VLocity was equipped with a wheel slip/slide protection (WSP) system to optimise traction and braking and prevent damage to wheels and track in instances of reduced adhesion conditions. The technical description of the VLocity braking system (Bombardier 2017) stated that:

When a sliding axle is detected and the pneumatic brake is active, the corresponding dump valve is energised by the BCU, so that the brake cylinders are vented which reduces the brake force until the wheels speed up again. An independent monitoring function is provided, which ensures that the friction brake is reapplied, if the dump valves are continuously energised for a certain time period.

When WSP was activated owing to wheel slide, hydrodynamic braking was automatically terminated, and all braking was supplied by the friction disc brakes. Once the wheel slide had been corrected, the system reinstated braking effort according to the train driver’s brake control setting. The system on the VLocity was designed to avoid wheels locking and did not allow for maintaining slide in certain circumstances.[41]

In the event of wheel slip being detected (such as when the train was attempting to depart from a station where the tracks were slippery, and powered axles were rotating faster than non-powered axles), engine speed and tractive effort were automatically reduced. Upon correction of the wheel slip condition, the system re-applied tractive power according to the train driver’s power control setting.

Activation of the WSP was evident to the train driver from a warning light on the control panel (Figure 18). The WSP warning light extinguished when adhesion was regained. Sanding was also automatically applied under such circumstances, and activation indicated by a separate warning light.

Physical removal of materials from wheel tread

The configuration of the train braking system can affect adhesion levels at the wheel-rail interface. Tread brakes or abrasive brake blocks that act to directly remove materials from the wheel tread can strongly influence the adhesion levels between wheel and rail. This was not a feature on the VLocity train that was equipped with disc brakes, and therefore did not have the benefit from having the wheels cleaned during brake application. RSSB (2014) found that tread brakes appeared to be less susceptible to moist rail head than trains with disc brakes.

Post-incident brake testing

Post-incident brake testing indicated that all three cars were compliant with the braking system routine test procedure (Bombardier 2014), and sufficient brake force was available to decelerate train 8185 had there been sufficient adhesion at the wheel-rail interface.

Testing also showed the BCU on all three cars met requirements in relation to WSP activation and the operation of dump valves to reduce brake cylinder pressure on detection of wheel slide.[42]

Sanding system

Layout

VLocity DMUs were fitted with a sanding system to apply sand to the rail head to improve the friction between the wheels and rails. Sand could be applied automatically by the WSP system or manually by the driver using a foot pedal. Sanders were located on the front and rear cars of the three-car set. The TM cars were not equipped for sanding.

The sander operation depended on whether the train was powering, or under braking (Figure 19). If the train was under power and wheel slip was detected, sand was applied behind the second axle of the first car and in front of the third axle of the rear car of the train. If the train was braking, sand was applied (only) behind the second axle at the front of the train.

Figure 19: VLocity DMU sanding arrangement pertinent to the direction of travel.

Source: CITS

This arrangement for sand application was the same as for the VLocity two-car set (with DM and DMD cars only) introduced into passenger service in 2005.

Position of sanding nozzle relative to wheel

The nozzles of the sanders that operated in braking were positioned behind the second wheelset, facing toward the direction of train travel (Figure 20).

Measurement of discharge nozzles on car 1270 found that the end of the sand discharge pipes were about 150 mm above the rail head and about 440 mm from the wheel centreline. Bombardier drawing titled ‘Body to bogie motor bogie attachment’ (BTA 2006) specified the nozzle to be 120 mm above the rail head and 412 mm from the centreline of the wheel. The nozzles were therefore located about 30 mm higher than the specified height in the drawing.

The angle of the nozzles was approximately 20 degrees to the rail surface and was in the plane of the rail. The nozzles were midway between the inner and outer surfaces of the wheel.

Figure 20: Location of sand nozzle relative to the wheel

Source: CITS

Sand boxes and metering units

Two sand boxes were fitted at the cab-end bogies of each of the DM and DM(D) cars and incorporated sand metering units (Figure 21).

Figure 21: A car 1270 sand box and sand metering unit removed (right-hand side image).

Source: CITS

When sanding was required, solenoid valves were energised which supplied pressurised air from the main reservoir into the sanding system through a sintered metal plate. Within the sand box, supply air was used to agitate the sand and meter the desired sand flow rate through the sanding discharge pipe and discharge nozzle (Appendix A).

Sand specification

V/Line used sand sourced from a local supplier, either bagged or in bulk, depending on the depot being supplied. The product was silica sand, sourced from local sand quarries and screened to a specified grain size. The sand grain size profile was finer than specified by RISSB guidelines for braking applications (Appendix B).

Routine maintenance of sanding system

V/Line Work Instruction VEWI-79 (V/Line 2019) detailed the VLocity servicing schedule. This required:

• sand boxes to be checked and filled every 21 days.
• checking the sand box assemblies and that the sanding units operated every 31,000 km.
• checking the sand box lid every 93,000 km.
• checking the sanding magnet valve every 186,000 km.
• checking the sanding brackets and hoses every 186,000 km.
• checking the sanding system pressure reducing valve and isolating cock every 372,000 km.

The maintenance processes did not require sand flow rates to be monitored over time, against defined criteria.

V/Line did not have a process in place for nozzle position or alignment relative to the wheel to be checked or adjusted during maintenance. The group standard in Great Britain for sanding equipment (RSSB 2021) stated that maintaining sand discharge nozzle alignment was necessary to maintain performance of the sanding equipment.

Post-incident inspection and testing of sanding system

Condition of sand boxes following the occurrence

The condition of the sand boxes in car 1270 were checked following the stabling of train 8185 after the incident (Figure 22).

Figure 22: Sand boxes on car 1270 at Ballarat East depot, after the incident.

Source: CITS

The sand box on side A (left side in direction of travel) contained approximately 21.6 kg of sand compared to the nominal capacity of 25 kg. The sand box on side B contained approximately 3.9 kg when measured and was effectively depleted.[43]

Flow rate measurements prior to disassembly and cleaning

Following the incident, 3VL70 was tested by Bombardier at Ballarat East depot to assess the function of the train’s sanders. These tests were witnessed by V/Line and the Chief Investigator Transport Safety (CITS). The expected and desired sand delivery rate was advised to be between 1.5 and 2 kg/min.

Sand output was measured from side A and B sanders on cars 1270 and 1170 (Table 2). The first set of tests (1-3) were conducted without any addition of sand to the sand box from the time of the incident. The remaining tests (4-6) were additional tests conducted on car 1270 boxes only, with the sand boxes emptied and then half-filled with sand that was supplied to Ballarat East depot.[44] The desired rate of 1.5-2 kg/min was only achieved in one test; test 5 on sand box B of car 1270 after it was refilled.

Table 2: Sander performance tests

[1] The sanders on the rear car (1170) were not designed to dispense sand during braking into Ballarat.
[2] No data recorded
Source: Bombardier with averages by CITS

Sander inspections

Following the initial flow tests, the sand was drained from all the sand boxes and the sanding units disassembled for inspection. Dry vegetation was found in the sand domes of all metering units.

For the units from car 1270, there was significant vegetation in both units, and more in the unit from side A (Figure 23).  

Figure 23: Vegetation in metering unit sand domes of car 1270

Source: CITS

Vegetation was also found in the sand domes of the metering units of car 1170 (Figure 24).

Figure 24: Vegetation in metering unit sand domes of car 1170.

Note the sand discharge connector pipe is not shown in this figure. Source: CITS and Bombardier.

Sander flow rate measurements following cleaning

Vegetation was removed and the sanding units were reassembled. Flow tests were repeated and sand delivery rates consistently matched the expected flow rate Table 3).

Table 3: Sander performance tests following cleaning of units

[1] No data recorded. Source: Bombardier

Sander rate comparison of VLocity trains that had experienced overruns

In July 2020, V/Line undertook retrospective testing of sanders on VLocity trains, including nine involved in low adhesion overrun incidents between 2010 and 2020. The four sanders on each of the nine trains were tested, giving a total of 36 tests. Testing found that 15 of the 36 sanders tested did not meet the desired sand delivery output of 1.5-2 kg/min (Appendix C).

There was a wide distribution of flow rates between 0 and 2 kg/min (Figure 25).

Figure 25: Sand flow rates for a sample of 36 sanding units on VLocity trains

The bar chart shows the distribution of flow rates across the 36 sanders tested. The sanders were those fitted to nine trains involved in overruns between April 2010 and June 2020. The tests were conducted July 2020. Source: CITS, based on Bombardier test data

Type testing of VLocity braking in low adhesion conditions

Type testing

Prior to delivery, type testing of the train’s equipment was undertaken to verify that the equipment met the specification (Bombardier n.d.). Pre-acceptance slip/slide type tests were performed on the VLocity three car set in 2008. A test procedure (Bombardier 2008) was developed with the objective of verifying correct operation of the slip/slide equipment. There was no type testing to specifically verify sander performance against defined criteria.

Testing was conducted on a closed section of track with the train at both tare[45] and gross loaded mass. For low adhesion tests, the train was equipped with a watering system that supplied a water/detergent mix to the leading wheelset of the train.[46]

Type testing outcomes

The test report (BTA 2008b) concluded: ‘… the slip/slide equipment responded correctly both to skid and spin situations and provided an effective protection of the wheels from wheel flats’.

Low adhesion tests (in braking) were conducted with the train set to brake in blended (fiction and hydrodynamic), friction only and emergency conditions and braking (stopping) distance recorded (Figure 26 and Figure 27). The tests were conducted for a range of initial speeds, and for each speed, there were 3 tests without sand (relying on the WSP system only), and one test with sanding activated. No statistically significant difference in the braking distance with or without sanding applied was observed.

Figure 26: Slip/slide braking test results for a tare loaded three-car set, for normal braking, friction only braking (F) and emergency braking (E), and range of initial speeds.

Source: Bombardier, CITS

Figure 27: Slip/slide braking test results for a gross loaded three-car set, for normal braking, friction only braking (F) and emergency braking (E), and range of initial speeds.

Source: Bombardier, CITS

As would be expected, braking (stopping) distances during the low adhesion type tests exceeded stopping distances for braking on dry track (Figure 28). The longest recorded stopping distance from 160 km/h for the loaded, friction only braking test scenario was about 1400 m. This equates to a retardation rate of 0.71 m/s² or about 75 per cent of the dry retardation rate.

Figure 28: VLocity slip/slide type test results from 2008, friction braking scenario

This graph shows the outcome of individual tests for the gross (loaded) and friction (only) brakes scenario. For each starting speed, there were 3 tests without sand (relying on the WSP system only), and one test with sanding activated. Source: Bombardier test data

Driver training and actions taken by the driver of train 8185

Instructions for drivers regarding low wheel-rail adhesion

The V/Line Professional Driving Booklet contained information describing low adhesion conditions at locations where high levels of trackside vegetation existed (with cuttings presenting a particular problem), and during light drizzle and immediately following stormy conditions (V/Line n.d.). The booklet also warned against errors leading to low adhesion incidents. These included not considering environmental indicators of possible low levels of rail adhesion, and incorrect braking techniques (these being unspecified) for low adhesion conditions.

Further guidance in the form of an information notice (V/Line 2013) was distributed to drivers in 2013 (Appendix D). The notice included advice on driving techniques in low adhesion conditions, automatic and manual sanding, the WSP system, and extended stopping distances. The guidance indicated that the shortest stopping distance (on a VLocity) would be achieved by allowing the WSP system to control braking effort.

V/Line used simulator training for its drivers. However, drivers did not receive ongoing driving simulator instruction in handling low adhesion conditions as part of continuation training.

Actions taken by the driver of train 8185

The driver reported experiencing some wheel slip on departing Ballan and applying manual sanding. The driver reported and train data confirmed that the train subsequently experienced intermittent wheel slip (in power) and wheel slide (during braking) from Ballan onwards.

The driver reported having applied braking earlier than would be usual on the approach to Ballarat due to the conditions of wheel slip experienced earlier in the trip. Shortly after the initial application, they released the brake on encountering wheel slide, reapplied and then released. During this phase in the approach, the driver’s intention was to attempt to manage the braking in the low adhesion conditions through release and reapplication of braking demand.

The driver subsequently made a full-service brake application when about 2.6 km from the intended stopping point, and the management of braking effort was then with the train’s WSP system. For the train to stop in this distance, a retardation of about 0.4 m/s² was required. In dry conditions, a retardation rate of 0.95 m/s² would be expected.

The driver moved the controller from a full-service braking application to emergency when the train was about 300 m from the intended stop. The driver reported that they chose not to make an emergency brake application earlier, concerned that there would be a time delay to regain braking control if they were to move back to service braking.

Risk register references to loss of adhesion

V/Line risk register

Loss of adhesion (specifically listed as wheel to rail interface failure) was recorded in V/Line’s Train to Vehicle risk register as a risk source for the risk event of a road user being presented with inadequate warning time at a level crossing. Despite V/Line having commenced work on improving sander design at the time of the collision, no other risk register references to loss of adhesion were provided. The risk controls for the risk event relating to loss of adhesion were listed as the construction and maintenance of level crossings.

Work undertaken by V/Line on improving sander design

Despite there being no V/Line risk register entry for loss of adhesion resulting in a collision, V/Line had commenced a review of the sanding system in 2016, and in 2019 commenced a program to modify all VLocity trains to include an additional sanding arrangement on the intermediate cars. These sanding systems were activated in 2022.

RISSB hazard register

RISSB had developed a hazard register (RISSB n.d.), primarily to support the development of RISSB standards. This register had been refined in a programme of work drawing on industry expertise and it was a resource made available to its members. Within this register, inadequate adhesion was listed as a factor in the collision and derailment precursor,[47] for which the source of the hazard was ‘brakes being inadequate when moving’.

Other similar occurrences involving V/Line VLocity

Ten VLocity overrun events that occurred between April 2010 and June 2020 were identified for closer review. These events were either greater than 100 m in length, or events that were on the same day (Table 4).

Table 4: Significant VLocity overrun events selected for further analysis

Source: V/Line

Of the two events that recorded overruns of 1000 m or greater, both occurred at Macedon. The first of these events occurred in August 2010, with the driver reporting wet and slippery conditions. The second occurred in February 2018, with the driver reporting no wheel-rail adhesion. Of the overruns that were reported to be approximately 500 m, one occurred at Rochester in 2014, and the other at Drouin in 2016. Slippery rail conditions were reported for both these incidents.

While inspections were made of the track in some of these instances, there was no record of examination of the train sanding system or assessment of sander performance and its potential contribution to an overrun event.

Safety analysis

Wheel-rail adhesion

Estimated level of wheel-rail adhesion

The wheel slip/slide protection (WSP) system was active during braking on the approach to Ballarat Railway Station indicating that the level of adhesion between wheel and rail was insufficient to support the level of braking demanded. The response of the train’s braking system during the event provided an estimate of the wheel-rail adhesion for train 8185.

Commencing about 2.6 km before the intended stopping point at the station, there was a near continuous full-service brake application for 66 s.[48] During this period of braking, a train retardation of about 0.2 m/s²was achieved compared to a full-service braking rate in dry conditions of 0.95 m/s². Available adhesion experienced by train 8185 was therefore likely to have been between 0.02 and 0.03 on this section (Appendix E).[49] This reflects very low to extremely low levels of available adhesion.

Sources of low adhesion conditions at Ballarat

The level of adhesion achieved between wheel and rail can be strongly influenced by rail surface contamination. There are a range of contaminants that may occur including leaf matter, oils and greases, dry contaminants such as iron oxides and dust, and small amounts of moisture.[50]

Post-incident site measurements[51] found an average friction coefficient on wet rail of 0.29 (at walking pace), that may reduce by around 39 per cent for a train travelling at 160 km/h (IRT 2020). Based on this reduction figure, the measurements would equate to a level of adhesion of about 0.18 for a train speed of 160 km/h. These levels are not unusually low for wet rail and did not indicate the presence of a lubricating agent. Post-incident track inspections also did not identify significant leaf, oil or grease contamination on the approach to Ballarat Railway Station.

In the absence of any apparent matter contamination, the most significant environmental condition present at the time of the occurrence was a small amount of moisture. Work commissioned by RSSB (2014) reviewed research and data gathered from service experience and found that there was evidence for low adhesion being caused by slightly wet rails. The report defined the wet rail phenomenon as:

Poor adhesion conditions caused when low levels of moisture are present at the wheel-rail interface. These conditions are associated with dew on the rail head, very light rain, misty conditions and the transition between dry and wet rails at the onset of rain. They are not necessarily associated with the additional presence of other (non-water) rail head contaminants. These conditions are not associated with continuous rain.

Weather recordings indicated that between 2300 and 2330 on the night of the event, light rain started to fall in the Ballarat area. Rain was also observed on CCTV footage of Ballarat Railway Station and Humffray Street crossing at the time train 8185 passed. It is probable that this small amount of rail head moisture was the primary environmental factor in the development of low adhesion conditions at the wheel-rail interface of train 8185. The train that arrived into Ballarat prior to train 8185 and prior to the light rain did not experience wheel slip or slide events.

Noting the mostly dry conditions and prevailing winds in the lead up to light rain that evening, the possibility that particulates had mixed with moisture to form an unusual interfacial layer was considered. An investigation of recurring low adhesion events in Melbourne (OCI n.d.) found that (in those instances):

The majority of overrun events have occurred with rail head moisture resulting from light rain or dew. The investigation concluded that moisture combined in particular proportion with rail head contaminants such as iron oxides and mineral clay produces a liquid suspension sufficient to result in low coefficient of friction conditions including instances of low shear strength within the interfacial layer.

However, there was insufficient evidence in this instance to conclude if any other contaminant had influenced the available adhesion at the wheel-rail interface.

Sanding system design and performance

Performance of train 8185 sanding in this event

For many trains, sanders are used to modify conditions between wheel and rail in slippery conditions. The entrainment of sand into the wheel–rail contact has been shown to be an effective way of improving friction levels between the wheel and rail in conditions of low adhesion (RAIB 2005). Train 8185 was fitted with sanders for that purpose.

The event recorder for train 8185 showed that sanding was automatically requested on the detection of low wheel-rail adhesion by the train, and was active for a long period on the approach to Ballarat Railway Station. However, available adhesion between wheels and rails remained very low indicating that the sanders were ineffective at raising the friction between wheel and rail surfaces.

Positioning of sanding nozzles

Location of sanders relative to wheels

The VLocity three-car set was fitted with sanding devices on its lead and trailing cars. During braking, by design only the sanders on the leading car operated to dispense sand (Figure 29). The nozzles on these sanders were located behind the leading bogie of the lead vehicle, with the outlet facing toward the rear wheels of the leading bogie.

Figure 29: Train 8185 sanders activation during braking

Source: CITS

The RISSB standard for Braking Systems on Multiple Unit Passenger Rolling Stock (RISSB 2014), introduced in 2014, stated that sanding systems should, in general, conform to the requirements of GM/RT2461. Standard GM/RT2461 was developed as a Railway Group Standard in Great Britain (Railway Safety 2001) and mandated that new multiple unit trains in Great Britain be fitted with a sanding system. The standard also specified requirements for any systems that were installed on existing trains.

The version of GM/RT2461 that existed at the time of VLocity design specified that in braking mode:

...sand shall be delivered to the railhead by the leading vehicle only for all train formations (including multiple formations), at a location forward of the third axle and after the second axle, in the direction of travel.

The 2016 update of GM/RT2461 was more specific in relation to the position of sand delivery forward of the third wheelset in the direction of travel. The later version of the standard specified the necessary criteria for sand application under braking and contained a good practice design guide for sanding equipment. This guide stated that sanding equipment would be more effective in reducing the risk from low adhesion if the discharged sand was effectively focused ‘just in front of the wheel-rail contact point’ and delivered at a rate within the design and maintenance parameters of the equipment. The practice of sand being delivered in front of the wheel-rail contact point for braking, rather than behind it, was a consistent design feature sighted on rolling stock studied by this investigation.

On a VLocity three-car set, the location of the sanding nozzles (for braking) behind the wheels of the lead bogie was inconsistent with these design practices and likely to be a significant recurring factor in the diminished performance of the sanding system in improving adhesion.

Response from Alstom in relation to location of the sanding nozzles

Alstom provided background on the design development leading to the locating of the sanding nozzles behind the wheels of the lead bogie, and advised that the initial design was considered consistent with the GM/RT2461 standard that existed at that time. Alstom also advised that stakeholders[52] involved at the time of the procurement of the initial two-car VLocity prioritised train detection (track circuits) over maximising the effectiveness of the sanding system. Alstom advised that effective application of wheel slip/slide protection system was considered the primary method of optimising the brake application to prevent the formation of wheel flats, and to improve braking performance in low adhesion conditions.

An unwanted side effect of low adhesion remedial treatments such as sand was a failure of the train to activate a track circuit, with subsequent safety implications related to signalling and level crossing operation. Alstom advised that DMUs were considered to have a higher train detection risk over an Electric Multiple Unit (EMU) as there was no return current in the rail to ‘burn off’ railhead contamination. Any build-up of sand deposit on the rail was considered to increase the risk (of lack of train detection).

Height and distance of nozzle from wheel-rail contact point

Experiments have been conducted into the effect of the height and longitudinal position of the sanding nozzle on the proportion of sand reaching the rail (Lewis et al. 2018). In the test conditions used, it was found that the further the nozzle was from the contact point, generally the lower the proportion of dispensed sand being deposited on the rail (Appendix F).

The results of these experiments cannot be directly related to train 8185 given the difference between the test arrangements and the configuration of train 8185. However, for comparative purposes, the height and longitudinal offset of the sanding nozzles on car 1270 were plotted against the test samples. It was found that the nozzles on car 1270 were higher and more longitudinally distant from the wheel-rail contact point than the tested samples.

Sand availability

The amount of sand remaining in each sand box on car 1270 after the incident differed significantly. Post-incident inspection found 21.6 kg remaining in the sand box on side A (left side in direction of travel). Based on the average measured (post-incident) flow rate from this unit (0.6 kg/min) and the time activated during the journey, the sand box on side A was probably near full at the time train 8185 departed from Southern Cross Station.[53]

In contrast, only about 3.9 kg of sand remained in the sand box on side B (right side) of car 1270.[54] When tested with the remaining sand, only a small amount of sand was dispensed and the sand box was therefore functionally empty. It was not possible to ascertain at which point the sand box on side B was effectively exhausted. It is possible this occurred on the final approach or earlier in the journey. Assuming the sand was exhausted as the train came to a stop in Ballarat, the box would have been no more than half full at the start of the journey from Southern Cross Station.[55]

A process for preparing the train at Geelong on the morning of the incident included a checking of the sand levels in the sand boxes. However, this process did not include any quantitative criterion on the volume of sand required to be in the box at that inspection, nor was there a separate check-off for this item of the inspection. The sand boxes did not contain a mark or trigger point for the topping up of sand.

Sanding flow rates

Post-incident disassembly of sanders on train 8185 found that all units were contaminated with vegetation. Comparative testing conducted before and after cleaning of units found significant improvement in flow rates after cleaning (Table 5). All cleaned units met the desired flow rate of 1.5-2 kg/min.[56]

Table 5: Mean sand flow rates from train 8185 sanders, before and after cleaning

Source: CITS analysis and summary of V/Line test data

Based on the test results, it is probable that in service, including on the day of the incident, the amount of sand dispensed from the car 1270 sanders (during braking) was less than the desired rate of 1.5-2 kg/min. Research has found that small changes in flow rate can lead to reductions in the amount of sand delivered to the wheel-rail contact (Lewis et al. 2018).

Testing of sanding systems by Rail Safety Standards Board (RSSB)

In 2009, the RSSB published research that evaluated the performance of sanders on multiple units in Great Britain (RSSB 2009). The research found that there was considerable variability in the performance of sanding systems with many operating well below the 2 kg/min discharge rate recommended (Appendix G).[57] The RSSB research material was compared with V/Line testing conducted of VLocity vehicles involved in overrun incidents. Similar variation in discharge rates across the fleet were observed in the RSSB and VLocity tests (Appendix G).

The RSSB report identified the lack of regular maintenance and ineffective design as causes for sanding systems not dispensing the required amount of sand, and that performance may deteriorate over time. The research also recommended that acceptable discharge rates in the maintenance manuals should be close to the design criteria for the system.

Maintenance of the VLocity units did not include testing of sander discharge flow rates. Without measurement of flow rates or some other assurance process, deficiencies could not be identified and addressed.

Influence of crosswinds

Around the time of the occurrence, recorded winds were 33 km/h gusting to 42 km/h from the north, and so orientated across the direction of travel of train 8185 on its approach into Ballarat. Experiments conducted on sanding equipment have shown that even moderate crosswinds can adversely influence the amount of sand reaching the rail (Lewis et al. 2018). It is possible that the crosswinds at the time of the event influenced the distribution of sand towards the rails, particularly when present in combination with the location of sander nozzles (for braking) behind the wheel-rail contact point, and the height of the sanding nozzles above rails.

Missed opportunities to identify sanding system weakness

Type testing of VLocity three-car set

Braking system type testing of the VLocity three-car set was conducted in 2008 against a performance requirement for braking on dry rail. Additional type testing was conducted with a water-detergent mix to simulate low adhesion conditions, with the aim to demonstrate WSP operation. Data from this whole-of-train WSP testing in reduced adhesion conditions showed stopping distances with and without sand being applied. However, the results of these tests did not demonstrate any consistent reduction in stopping distances when the sanders were activated.

While not mandatory in Australia and noting its release was after the 2008 type testing, the European standard for wheel slide protection (CEN 2018) stated that testing should include assessment of the impact of the sanding on the low adhesion braking performance achieved. The type testing of the VLocity three-car set in 2008 did not include demonstration of performance of the sanding system against specified criteria. This was a missed opportunity for weaknesses in the sander design configuration (for braking) to be identified and remedial action taken.

Other investigations have identified gaps in processes for defining and proving rolling stock performance in low adhesion conditions. An investigation of recurring low adhesion events in Melbourne (OCI n.d.) found that (in that instance):

…performance requirements for braking in low-adhesion conditions were not adequately defined within the procurement documentation for the train.

and,

… acceptance testing did not fully verify the braking performance … for some conditions that were later to be experienced in service.

V/Line response to previous low adhesion events

Significant events associated with low adhesion conditions and involving VLocity rolling stock were experienced on previous occasions on the V/line network. While inspections of the track were made that resulted in treatments such as vegetation removal and scrubbing of the track, there was no record of examination of the train sanding system or assessment of sander performance and its potential contribution to the overrun events.

Risk of collision owing to low adhesion

Despite previous low adhesion events, the loss of adhesion leading to increased stopping distance was not recognised as a risk source for a train overrun collision in V/Line’s risk registers. The risk of a collision, either with a level crossing gate, terminal infrastructure, or another train, was not documented. The only risk event reference to loss of adhesion was for a road user being presented with inadequate warning time at a level crossing. Controls to treat the risk of collision associated with low adhesion were also not documented in V/Line’s risk registers.

The risk of collision events associated with low adhesion had been identified by other standards and investigative agencies. RISSB, the industry body, had identified inadequate adhesion as a factor for collision and derailment owing to brakes being inadequate when moving, and documented this in their hazard register (RISSB n.d.). Also, in 2013 ATSB published its investigation report into a collision of a passenger train into a station buffer stop at Cleveland, Queensland (ATSB 2013). In relation to the management of risk, one of the findings made in that report was that:

Despite numerous occurrences of slip/slide events in the years leading up to the accident at Cleveland, Queensland Rail’s risk management processes did not precipitate a broad, cross-divisional, consideration of solutions to the issue including an investigation of the factors relating to poor wheel-rail adhesion.

The ATSB advised that this finding affected all owners and operators of rolling stock fitted with electro-pneumatic disc actuated braking systems incorporating wheel slip/slide protection control.

Lydiard Street gates

Proximity of gates to departure signal

The Lydiard Street North crossing gates were closed to rail traffic (and open to road traffic) except when required to be opened for the passage of trains. For train 8185, the level crossing and gates were protected by departure signal 20 being at stop. Signal 20 would remain at stop until the gates were closed to road traffic and made open for the passage of train 8185. That operation, to open the gates to rail, had not yet commenced when train 8185 arrived.

The level crossing was located 17 m beyond signal 20 and this proximity provided only a small margin in the event of signal 20 at stop being overrun by a train (Figure 30).

Figure 30: Departure signal 20 and the Lydiard Street North level crossing

This photograph was taken after the event. The gates on the northern side of the crossing are shown closed to road traffic. The departure signal 20 is shown at stop, as it was when passed by train 8185. Source: CITS

Standards existing prior to the event, and another published following the event, identified the risks associated with short distances between protective signals and level crossings, and potential mitigating actions (Appendix H). Possible mitigating actions cited include increasing the safety zone between signals and level crossings, particularly for new crossings, and train protection systems or other predictive systems to detect train overspeed in sufficient time to take remedial action.

In the case of the Lydiard Street North level crossing and gate configuration, neither the train controller located in Melbourne, nor the signalling system had the means of detecting that train 8185 was traveling at a speed that made it likely it would pass signal 20 at stop and enter the Lydiard Street crossing while it was closed to rail traffic. There were no effective safety controls in place to specifically mitigate against a train arriving at Ballarat Railway Station travelling at excessive speed and being unable to stop before colliding with the crossing gates closed against rail traffic.

About a second before the train passed through the crossing, the road traffic lights changed from showing a green indication to a flashing amber as the train occupied a track circuit[58] at the crossing. This was the only warning provided to road traffic.

Unique hazards associated with Lydiard Street North level crossing gates

The configuration of the crossing protection at Lydiard Street North level crossing, that used swing gates, introduced unique hazards when compared to boom barrier style crossing protection. Train 8185 was estimated to be travelling between 93 and 97 km/h when it struck the gates. The collision resulted in several events including impact with the driving cabin, side impact of the passenger compartment, and the projection of gate debris into surrounding public spaces.

Owing to the time of the collision and the movement restrictions associated with the Covid-19 pandemic, there were few pedestrians or road vehicles in the area, and there were none affected by the overrun or collision with the gates. The outcome to public outside the train may have been different in other circumstances.

The potential for impact with the gates was not documented in risk registers and risk controls were not in place to manage the unique risks associated with the gates at the Lydiard Street North level crossing.

Speed across 39 points

Train 8185 passed over 39 points on the approach to Ballarat Railway Station at a speed estimated to be in the range of 110 – 119 km/h. The turnout was rated for 40 km/h operations and routed trains to platform 1 at Ballarat Railway Station (Figure 31). The train crew recounted being thrown around when the train passed over the points.

Work undertaken for the Regional Fast Rail project by Transportation Technology Center, Inc (TTCI) for the Department of Infrastructure, Victoria (DOI 2006) calculated that the overturning speed for a VLocity train at an uncanted[59] 1:8.7 turnout, as installed at 39 points, was 117 km/h. This overturning speed assumed no crosswind and a loaded train. Train 8185 passed through this turnout at an estimated speed of over 110 km/h therefore having a significantly reduced margin to overturning and derailment.

The Australian standard for signalling principles (RISSB 2018), recognised the risk of rail traffic derailing owing to overspeed at points. The standard offered guidance for mitigating the risk, which included enforcement systems, such as Train Protection Warning System (TPWS). Train 8185, was equipped with on-board TPWS, as were all VLocity trains. However, the trackside TPWS components to enforce the speed restriction across 39 points were not installed.

In this instance, train 8185 was already in full-service braking from about 2.6 km before the intended stopping point, and at least 2 km before 39 points. Overspeed enforcement within this distance, and in the circumstances of very low adhesion conditions, may therefore not have reduced the train speed at the turnout.

Figure 31: Route taken by train 8185 via 39 points towards platform 1

Source: Pass Assets (DoT, Vic), annotated by CITS

Driver expectations and response

Expectation

Adhesion conditions

The driver of train 8185 was familiar with the route into Ballarat Railway Station and had last driven it four days prior to the incident. The driver was also an experienced driver of the VLocity DMU and had experienced wheel slide conditions requiring WSP activations on previous occasions. However, the driver had not previously experienced extremely low levels of adhesion where the train’s speed could not be controlled by the braking, WSP and sanding systems. The driver of train 8185 had no reasonable means of knowing the extent of the extremely low adhesion conditions, nor that the sanding system would be ineffective at improving adhesion.

The braking records of train 8185 and train 8181, that preceded train 8185, were compared. The evaluation found that train 8185 was not able to achieve the retardation of train 8181 even though the brake application on train 8185 was significantly greater. With moderate brake application in the 2 km between 2.8 km and 800 m from the station, train 8181 achieved an average retardation of about 0.4 m/s², with a peak retardation of about 0.6 m/s² (Appendix I).

Sander performance

The driver was familiar with the sanding system on train 8185 and understood that it delivered sand to the rail to improve friction when either the WSP system triggered the sanding system to activate, or when sand was demanded manually by the driver using the foot pedal.

On the evening of the incident, the train provided the driver with an indication that the sanding system was delivering sand. However, the data recordings indicated that the adhesion remained extremely low and train deceleration under full-service brake application was between 20 and 30 per cent of expectation. The driver was presented with information that the sanders were operating and had no reasonable means of knowing that sander performance may have been affected by other factors, and was not improving adhesion conditions.

Information and driver training for low adhesion conditions

The Professional Driving Booklet provided some guidance on driving in low adhesion conditions, and an information notice on Braking in Slippery Track Conditions had been issued to VLocity drivers in 2013. The guidance on low adhesion conditions advised on allowing the WSP system to control the brake activation and not to release and reapply braking. Initially, the driver attempted to manage braking by release and reapplication as one might on a train not fitted with a WSP system. However, from approximately 2.6 km from the station stop, the driver afforded the WSP system the opportunity to manage the adhesion conditions.

The driver’s considerable experience and training did not prepare them for the extremely low adhesion conditions that existed at Ballarat at the time of the incident. While simulator training for the VLocity was provided by V/line, drivers did not receive driving simulator instruction in handling very low adhesion conditions as part of continuation training. It was technically feasible for the V/Line VLocity simulator to model low adhesion conditions.

Findings

From the evidence available, the following findings are made with respect to the collision of passenger train 8185 with level crossing gates at Ballarat, Victoria, on 30 May 2020.

Contributing factors

• Very low levels of adhesion existed between the wheels of train 8185 and the rail head on the approach to Ballarat Railway Station. A small amount of rail head moisture was probably the primary environmental factor in the development of low adhesion conditions.
• The sanding system on train 8185 did not effectively improve wheel-rail adhesion during braking of the train on its approach to Ballarat Railway Station.
• Safety controls were ineffective in mitigating against a train arriving at Ballarat Railway Station travelling at excessive speed and being unable to stop before colliding with the crossing gates closed against rail traffic. [Safety issue]

Other factors that increased risk

• The location of sanding nozzles (for braking) behind the wheels of the lead bogie was inconsistent with design practice existing at the time of the collision and was probably a recurring factor in diminished sander effectiveness on VLocity trains. [Safety issue]
• Neither V/Line nor Bombardier identified during type testing of the three-car VLocity in 2008 that the sanding system may not reduce stopping distances in low adhesion conditions. The results of type testing did not show any statistically significant difference in the stopping distance with or without the sanding system operational.
• There was no suitable assessment of the performance of sanders on the VLocity three-car set against defined acceptance criteria for improved braking performance in low adhesion conditions. [Safety Issue]
• V/Line investigation of previous rail safety occurrences that involved poor wheel-rail adhesion did not include examination of the train sanding system or assessment of sander performance and its potential contribution to the overrun events.
• The sanding mechanism of all sanders on train 8185 was partially blocked by vegetation. Testing showed that flow rates were affected by the vegetation, and that suitable rates were achieved when vegetation was removed.
• Maintenance of the VLocity sander units did not include testing of sand discharge flow rates (or some other process) to confirm performance. Without performance checks over time, deficiencies could not be identified and addressed. [Safety Issue]
• The car 1270 side B sand box of train 8185 was probably no more than half full on leaving Southern Cross Station and functionally empty on arrival at Ballarat.
• The processes involved in train preparation did not ensure a required minimum amount of sand in sand boxes. [Safety Issue]
• Loss of adhesion leading to increased stopping distance was not recognised as a risk source for any type of collision in V/Line’s risk registers. [Safety issue]
• Train 8185 passed through 39 points and the associated turnout at a speed estimated to be greater than 110 km/h. This reduced its margin for navigating this turnout safely, and without overturning or derailment.

Other findings

• Comparison with experiments conducted on sander nozzle discharge position found that the nozzles on car 1270 were higher and more longitudinally offset from the wheel-rail contact point than all tested samples. Research indicates that the height and offset of the sander nozzle outlet relative to the wheel-rail contact point influences the proportion of sand deposited on the rail.
• Winds at the time of the event were strong and orientated across the direction of travel of train 8185 as it approached Ballarat Railway Station. Research indicates that even moderate crosswinds can influence the amount of sand reaching the rail.
• The driver did not have information on the severity of the very low wheel-rail adhesion that would exist on the approach to Ballarat, limiting their ability to take informed action.
• The driver did not have information about the ineffective sander performance, limiting their ability to take informed action.
• V/Line drivers did not receive ongoing driving simulator instruction in handling very low adhesion conditions.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• V/Line
• V/Line personnel
• Event recorders from train 8185 and other V/Line trains
• Bombardier sanding test results
• Monash Institute of Railway Technology (IRT) track inspection and measurements
• Bureau of Meteorology
• Environmental Protection Agency (Vic)
• CCTV footage from Ballarat Railway Station
• Photographs taken on the day after the incident

References

ATSB rail occurrence investigation RO-2013-005 Collision of passenger train T842 with station platform, Cleveland, Queensland, 31 January 2013, Australia.

BTA (Bombardier Transportation Australia) (n.d.)  Vlocity Technical Specification 3EAM919567 .

BTA (Bombardier Transportation Australia) (2003) Technical Specification for Diesel Railcar Sets For V/Line Passenger Services 3EAM 0-0042, issue 8E.

BTA (Bombardier Transportation Australia) (2006) Body to bogie motor bogie attachment 3EAM 200563, revision K

BTA (Bombardier Transportation Australia) (2008). Vlocity Type Test Procedure Slip / Slide, 3EAM904906.

BTA (Bombardier Transportation Australia) (2008b). Vlocity Type Test Report Slip / Slide, 3EAM905030.

BTA (Bombardier Transportation Australia) (2014). 3EAM-0300 VLocity DMU routine test procedure, revision 9.

BTA (Bombardier Transportation Australia) (2017). VLocity DMU Technical Specification Knorr Brake System, revision 7.

British Rail Specification (1978) BR 566 – Specification for High Impact Windscreens, U.K.

CEN (European Committee for Standardization) (2009). EN15663 Railway applications - Vehicle reference masses, Belgium.

CEN (European Committee for Standardization) (2018) EN15595 Railway applications – Braking – Wheel Slip Protection, Belgium.

DOI (Department of Infrastructure, Victoria) (2006). Regional Fast Rail Project: Turnout Safety Analysis, prepared by TCCI (Transportation Technology Center, Inc), U.S.A

FRA (Federal Railroad Administration) (1980), Standard 49 CFR 223 Safety Glazing Standards -  Locomotives, Passenger Cars and Cabooses. Department of Transportation, U.S.A.

FRA (Federal Railroad Administration) (2017), A survey of wheel/rail friction, Department of Transportation, U.S.A.

IRT (Monash Institute of Railway Technology) (2020), Ballarat rail measurements for V/Line Pty Ltd,  Report No: Monash/RT/2020/1521, Australia.

Lewis SR, Riley S, Fletcher DI and Lewis R (2018) ‘Optimisation of a railway sanding system for optimal grain entrainment into the wheel–rail contact’. Proc IMechE Part F: J Rail and Rapid Transit 2018, Vol. 232(1) 43–62.

OCI (Office of the Chief Investigator, Transport Safety) (n.d.) Platform overruns Siemens Nexas EMU Connex / Metro Trains Melbourne, Rail Safety Investigation, Report No 2009/05.

Olofsson U, Zhu Y, Abbasi S, Lewis R and Lewis S (2013). Tribology of the wheel−rail contact – aspects of wear, particle emission and adhesion. Vehicle System Dynamics. 51. 1091-1120.

ONRSR (Office of the National Rail Safety Regulator) (2019) Reporting requirements for notifiable occurrences, Australia.

RAIB (Rail Accident Investigation Branch) (2005) Autumn Adhesion Investigation Part 3: Review of adhesion-related incidents, U.K.

Railway Safety (2001) Sanding Equipment Fitted to Multiple Units and On-Track Machines    Railway Group Standard GMRT2461, Issue 1, U.K.

RISSB (Rail Industry Safety and Standards Board) (n.d.) Hazard register, RISSB website, accessed 8 March 2022.

RISSB (Rail Industry Safety and Standards Board) (2014), AS 7510.3:2014 Braking Systems on Multiple Unit Passenger Rolling Stock, Queensland.

RISSB (Rail Industry Safety and Standards Board) (2018), AS 7711:2018 Signalling Principles, Rail Industry Safety and Standards Board, Queensland.

RISSB (Rail Industry Safety and Standards Board) (2020) AS 7658:2020 Level crossings – rail industry requirements, Queensland.

RSSB (Rail Safety and Standards Board) (2009) Understanding the current use of sanders on multiple units, Research Report T796’, U.K.

RSSB (Rail Safety and Standards Board) (2014) Investigation into the effect of moisture on rail adhesion, Research Report T1042’, U.K.

RSSB (Rail Safety and Standards Board) (2018) Trial of sander configurations and sand laying rates, Research Report T1107’, U.K.

RSSB (Rail Safety and Standards Board) (2021) Sanding Equipment Railway Group Standard GMRT2461 Issue 3.1, U.K.

Standards Australia (1995), Safety glass for land vehicles, AS 2080, Standards Australia, NSW.

Transit Cooperative Research Program (TCRP) (1997) ‘Improved Methods for Increasing Wheel/Rail Adhesion in the Presence of Natural Contaminants’, Research Results Digest 17.

Veerbeck H (1973) ‘Present knowledge of adhesion and its utilization’, Rail International, No 6.

VRIOG (Victorian Rail Industry Operators Group Standards) (2010) 12.0.1 Signalling Principles – Overlaps, Victoria.

V/Line (n.d.) Professional Driving Booklet MSR01345

V/Line (2013) VLocity Information Notice V38: Braking in Slippery Track Conditions.

V/Line (2016) VLocity DMU - Operator’s manual, revision 4.

V/Line (2017) Rail and Wheel Profiles,. NIST-2621, Revision 1.

V/Line (2019) Work Instruction VEWI-79 VLocity servicing schedule, revision 5.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• V/Line
• The crew of train 8185
• Alstom (Bombardier were acquired by Alstom)
• ONRSR
• RISSB
• City of Ballarat
• Department of Transport (Vic)
• Monash Institute of Railway Technology

Submissions were received from the driver of train 8185 and all consulted organisations. Submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Sand box configuration and operation

The sander fitted to the VLocity used compressed air to agitate the sand in the sand box and discharge the sand at a metered rate through the discharge nozzle (Figure 33).

Figure 33: Air and sand flow controlled by sand box metering unit

Source: CITS, adapted from diagram by Knorr-Bremse (not to scale)

When operating, pressurised air was supplied from the main reservoir into the sand box through a sintered plate. Inside the sand box, the air supply stream divided into two streams, the exhaust air stream (1), and the metering air stream (2). The exhaust air stream agitated the sand in the sand box to make it flow more readily and was returned to the manifold through the exhaust cap and hose. The metering air stream flowed through the sand dome and conveyed the sand through the sanding discharge pipe at the base of the sanding unit.

Appendix B – Sand used and comparison with guidelines

Sand specification

The sand used in VLocity sanders was silica sand, sourced from local sand quarries and screened to a specified grain size. The sand was specified as 16/30 and was sized according to a sieve analysis (Table 6). The sand was also specified to have a maximum uniformity coefficient of 1.6.[1]

Table 6: Size specification for sand used on VLocity

Source: V/Line

Comparison with sand standards for braking applications

The Rail Industry Safety and Standards Board (RISSB) standard for braking systems on multiple unit passenger rolling stock (RISSB 2014), stated that:

Sanding systems should, in general, conform to the requirements of GM/RT2461. 

Standard GM/RT2461 (RSSB 2021) was developed as a Railway Group Standard in Great Britain and specified requirements for sand types to be used in both braking and traction sanders. The standard advised that coarse/medium grain size sand was more suitable for use in braking sanders owing to the grain size tending to be larger than the rail contaminant layer and providing a mechanical link between the wheels and rails.

The standard stated that the sand for braking sanders should have a uniformity coefficient less than 1.5, and that the maximum proportion of grains with a diameter of less than 0.71 mm should not exceed 5 per cent by weight. A sieve analysis conducted by the supplier of sand for the VLocity trains found that approximately 45 per cent of the sand had a diameter of less than 0.71 mm. The sand used for the VLocity trains was therefore finer than that specified by GM/RT2461 (RSSB 2021). Research and standards suggest the sand used was probably better suited to addressing wheel spin rather than wheel slide.

Appendix C – Measurement of sander flow rates on other VLocity

Other overrun events examined

An examination was made of sanders fitted to nine VLocity trains involved in 10 overrun events between April 2010 and June 2020. There were 66 reported overrun events involving VLocity trains during this period. The 10 incidents selected for further analysis involved trains that experienced overruns of greater than 100 m, or events that were on the same day.[2] Several of the overrun events were in the Macedon (Ranges), and the others distributed (Table 7).

Table 7: Significant VLocity overshoot events selected for further analysis, by location

Source: V/Line

Results of sander flow tests

The sand flow rates from the four sanders fitted on each of the nine trains selected were measured in testing conducted in July 2020 (Table 8). The flow rates were first measured without unit maintenance (36 tests). Fifteen of the 36 units tested did not meet the desired sand delivery output of between 1.5 to 2 kg/min on their initial flow tests. For those units where the desired flow rate was not achieved (in italics in Table), the sanding system was subjected to maintenance[3] until a desired sand flow rate was achieved. Where the flow rate of between 1.5 and 2 kg/min was achieved on initial testing, the system was generally not tested a second time.

Table 8: Sand flow measurements of nine VLocity sets involved in overruns

[1] No data recorded as expected sand flow rate was met in the first test. Source: V/Line, Bombardier.

Appendix D – Information on driving in low adhesion conditions

Appendix E – Retardation during full-service brake application

The period of consistent full-service braking has been used to estimate the average retardation of train 8185 achieved during this period.[4]

For this period, a train retardation of about 0.2 m/s² (represented by the slope of the blue dashed line) was achieved compared to a full-service braking rate in dry conditions of 0.95 m/s² (Figure 34).

Figure 34: BCU, pulse and speed estimated from GPS, from 2.5 km to 450 m from intended stopping point at Ballarat Railway Station.

The figure shows a comparison of the BCU speed with pulse speed and the speed estimated from GPS recordings. The pulse speed is the speed recorded by one of the third axle on car 1270, whereas the BCU speed represents the speed of the fastest rotating axle on that car. The dashed line represents an estimate of the average reduction in speed over the period.

Source: CITS, based on train 8185 event recorder and GPS data

The level of adhesion has been estimated as the ratio of the longitudinal force and normal force (weight). Considering grade, available adhesion experienced by train 8185 was estimated to probably be between 0.02 and 0.03 on the approach of train 8185 to Ballarat Railway Station. This reflects very low to extremely low levels of friction and compares to a required adhesion at the wheel-rail interface for full-service braking retardation of at least 0.1.

Appendix F – Test data on implications of nozzle position

Experiments were identified that measured the amount of sand delivered to the rail head for different nozzle positions (Lewis et al. 2018). Tests were conducted with a 25 mm diameter hose fitted with a nozzle and the nozzle at various positions relative to nip and rail. Tests were conducted under dry conditions, with the discharge nozzle in front of wheel at a 15-degree angle to the rail, and a 48 km/h longitudinal wind.

The height and distance of the nozzle from the wheel-rail contact point was found to influence the proportion of the sand reaching the interface (Figure 35).

Figure 35: Mass of sand deposited on rail for different nozzle positions

Source: Lewis et al (2018). adapted by CITS

The specified position for the VLocity discharge nozzle and the actual position of the nozzles on car 1270 of train 8185 were plotted alongside the test results for reference. Direct qualitative comparison with the test results was not possible given the difference between test conditions and the sander orientation on car 1270.

Appendix G – Performance testing on sanders in Great Britain

Testing of sanding systems by Rail Safety Standards Board (RSSB)

In 2009, the RSSB published research that evaluated the performance of sanders on multiple units in Great Britain (RSSB 2009). The findings showed that there was considerable variability in performance of sanding systems with many operating well below the 2 kg/min discharge rate recommended by guidance in issue 1 of GM/RT2461 (Railway Safety 2001). The large variation in discharge rates reported by RSSB was thought to be due to several factors, including discharge hose length, hose bore diameter, nozzles fitted to the end of discharge hoses, dampness of sand, and design of sand storage hoppers. The report specified the lack of regular maintenance and ineffective design as causes for sanding systems not dispensing the required amount of sand. The testing also suggested that performance may deteriorate over time.

Comparison between RSSB data and VLocity measurements

The RSSB test result distribution was compared with the 36 tests conducted by Bombardier in July 2020 on nine VLocity sets (Figure 36). The mean discharge rate from 330 RSSB tests was 1.148 kg/min, that was similar to the VLocity mean of 1.236 kg/min. Figure 36 shows the distrution of sanding rates for SDN14 units which are equivalent to those installed on VLocity trains.

Figure 36: Comparison of sanding rates - RSSB (2009) and Bombardier tests on VLocity

Source: CITS, Bombardier, RSSB

Appendix H – Risk mitigation for rail overruns of level crossings

Australian level crossing standard

Noting that the version cited was not published at the time of the incident, the Australian level crossing standard[5] stated the requirement that rail traffic shall have priority over road and pedestrian traffic at level crossings. For the hazard associated with a train passing a signal displaying a stop indication (SPAD), the standard stated the following possible mitigation:

New level crossings should be located beyond a signals safety zone (overlap).[6] Existing signals may be relocated to meet the necessary safety zone (overlap). Train protection systems may also be a mitigation.

The Ballarat Railway Station precinct dates to the nineteenth century and the crossing gates at Lydiard Street North were not located beyond the safety zone of signal 20. The standard identified train protection systems as also a possible mitigation.

Australian standard for signalling principles

The Australian standard for signalling principles, AS 7711:2018 (RISSB 2018), also considered the risk of a signal near a crossing and stated:

Where the position of a signal presents the risk of a significantly reduced crossing warning time in the event of the overrun of a signal additional controls should be considered to mitigate the risk.

AS 7711:2018 also advised that:

…predictive systems can be used to activate the crossing where overspeeding is detected on the approach to the stop signal.

Appendix I – Comparison of braking on trains 8185 and 8181

Graphical presentation of braking profiles

The approach of train 8185 into Ballarat was compared with the previous train that evening, train 8181 (Figure 37). Both trains were three-car VLocity trains and braking on both was initiated about 5 km from the intended stopping point, and when the trains were travelling at around 160 km/h.  

Figure 37: Speed (BCU)[7] and braking profile comparison of trains 8185 and 8181

Source: CITS (from data provided by V/Line)

Comparison of braking profiles

The approach of train 8181 and its arrival at the station were unremarkable and no activation of either the WSP system or of sanding was observed. The train speed was reduced in increments as the train approached the 40 km/h-limited crossover that directed the train onto the track for the № 1 platform. Between 2.8 km and 800 m from the station stop, brake applications were between 70 per cent and 20 per cent of a full-service application, except for a short application at about 80 per cent.[8] During this period, the average retardation of train 8181 was about 0.4 m/s², with a peak retardation of about 0.6 m/s². The train coasted to the platform for a normal stop.

From approximately 2.6 km before the intended stopping point, the driver of train 8185 made a full-service brake application. However, average retardation achieved was only about 0.2 m/s² and insufficient to slow the train for the intended stop. This compares to the 0.4 m/s² retardation of train 8181 with significantly less brake demand.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     A numerical expression of the variety in particle sizes, defined as the ratio of the sieve size through which 60 per cent (by weight) of the material passes to the sieve size that allows 10 per cent of the material to pass. It is unity for a material whose particles are all of the same size, and it increases with variety in size

Executive summary

What happened

On 24 May 2020, APL England was making way down the east coast of New South Wales, with a cargo of containers, bound for Melbourne, Victoria. Early that morning, in adverse weather, the ship underwent a series of heavy rolls that resulted in the loss of 50 containers overboard and shutdown of the main engine.

What the ATSB found

The ATSB found that APL England’s fixed container securing arrangements on deck were in a poor state of repair and the strength of many securing fixtures was severely reduced by corrosion. In the seas encountered, the fittings failed, and containers were lost overboard. The investigation also found that this condition would have taken several years of poor maintenance to develop. This showed that the ship had not received the scrutiny from crewmembers, shore management or other agencies that a ship of its age or condition required. This presented an increased risk to the continued safe operation of the vessel, security of the cargo carried, and safety of crew members working around the containers.

In addition, the investigation found that procedures for adverse weather were not followed. Had these procedures and associated assessment tools been used, navigational and operational decisions could have been made, which would have better prepared the ship for the conditions encountered.

What has been done as a result

In addition to the repairs conducted on APL England, the ATSB has been advised that the deck and container fittings in all other vessels in the APL fleet were inspected and repaired as required. The company also implemented improved vessel inspections and associated reporting requirements for both ship and shore staff. APL assessed the safe stowage and carriage of high cube containers and conducted an internal safety assessment of the practice. As a result, limits were placed on the numbers of high cube containers that could be loaded into bays fitted with cell guides, which limited the extent to which containers protruded above the cell guides. Cargo securing manuals were reviewed and updated to include the revised stowage arrangements for high cube containers.

Additionally, APL implemented additional safety action regarding passage planning and navigation in heavy weather. They also advised that the wider CMA CGM Group and subsidiary entity fleets were made aware of these issues and the safety actions taken in response to this investigation.

Finally, in July 2022 the classification society, DNV, updated Class Guideline DNV-CG-0182 to include a new section which provided requirements and guidance on the allowable wear and tear of container supporting structures and container securing equipment.

Safety message

This investigation highlights the importance of regular maintenance of vessel fixtures to ensure the security and stability of the ship and its cargo, as well as crew safety.

Ships’ officers and crew are also reminded of the importance of adhering to the cargo securing manual and of following specific procedures and guidance material to assist preparations for, and decision making during, adverse weather conditions.

The occurrence

Passage to Australia

On 11 May 2020, the 5,780 TEU[1] fully-cellular container ship APL England (Figure 1) departed Ningbo, China, bound for Sydney, New South Wales. The ship was loaded with 3,161 containers (5,048 TEU), with a forward draught of 11.44 m, an aft draught of 13.32 m, and a GM[2] of 1.69 m. The Singapore-flagged ship was technically managed by the CMA CGM International Shipping Company Pte. Ltd (CCISC).

The vessel’s load computer results based upon ship conditions on departure from Ningbo showed 9 lashing force exceedances, from 102–107% of the maximum force (see the section titled Load computer). The master and chief mate accepted these values in the knowledge that changing ship conditions (ballast and fuel) would bring these forces within the acceptable range as the voyage progressed.

On 13 May the master was informed of a change in destination from Sydney to Melbourne, Victoria.

On 22 May, the master received weather advice from the CMA CGM group Fleet Navigation and Support Centre (FNSC) regarding a low pressure system and high swells (5–6 m) developing off the New South Wales coast. The master monitored the weather forecasts via updates from the commercial weather guidance provider ship performance optimization system (SPOS) service.

Figure 1: APL England arriving into Brisbane

Source: ATSB

On 23 May, at 0800 Eastern Standard Time,[3] the ship was 20 NM north-east of Port Macquarie, making good a speed of 14 knots, in north-westerly winds to force 5[4] (17–21 knots) with 2 m seas on a 2.5 m swell. Over the following hours, the weather deteriorated as the winds moved round to the south and the seas increased. The ship’s pitching and rolling motion also increased. The master ordered the ship’s speed reduced to about 7 knots as the ship was ahead of schedule into Melbourne, and advised the officer of the watch (OOW) to use hand steering as required to reduce the motion. The bridge log recorded that all lashings were checked during the afternoon (log entry time 1630).

The master rested from 2030 to 2300 and then returned to the bridge. At midnight, the OOW recorded in the bridge log south-westerly winds to force 9 (41–47 knots), high seas (sea state 7, 6–9 m wave height) on a southerly 4.5 m swell. At about 0100, with intermittent use of hand steering, the master felt the rolling was acceptable and returned to the accommodation to sleep.

The duty engineer completed the evening inspection of the engine room and at 2130 responded to an engine room alarm. The alarm reset when accepted by the duty engineer, who then returned to the accommodation at about 2200 and went to sleep. At 2326, and again at 2347, the engineer responded to alarms sounding, silencing them on each occasion. The engineer found no faults and attributed the alarms to the motion of the ship.

At 0215 on 24 May, when about 40 NM east of Sydney, the ship underwent a series of heavy rolls. Crew members, including the master and the duty engineer were woken by the heavy rolling, and unsecured items moved and fell to the deck. The master went to the bridge where the OOW (second mate) had re‑engaged hand steering in response to the significant movement.

Just after being woken, the duty engineer received a telephone request from the OOW to stand by in the engine room. At about that time, an engine room alarm sounded, and the engineer went to the engine room to attend to it. The alarm reset upon accepting.

The heavy rolling dissipated while the ship continued to pitch noticeably. At about 0230, the master changed course more southerly to 195°, and maintained a ship speed of about 7 knots in 40–45 knot winds from ahead (south-westerly). This reduced the ship’s motion and the master retired again at about 0300. The duty engineer remained on standby in the engine room and kept watch from the engine control room.

At 0400, the third mate took the navigation watch (OOW), and at about 0420, the master again awoke and returned to the bridge. The ship’s course was altered to 185°, and hand steering used as necessary. The master remained on the bridge, and the duty engineer remained in the engine room.

The incident

Just after 0600, the ship was on hand steering and maintaining its southerly course at about 7 knots (Figure 2). Conditions remained unchanged with the ship pitching and periodically rolling more noticeably in high seas and gale force winds.

At 0610, 46 NM south-east of Sydney, the ship underwent a series of very heavy rolls, to about 25° either side of upright. Again, many items moved and fell to the deck, including those which were previously secure, and personnel held on to maintain their footing.

The movement also resulted in activation of a steering system alarm, followed by an engine room alarm at 0610:28. The duty engineer was seated at the engine control console (near the alarm acknowledge push button) when the heavy roll and alarm occurred. The engineer had to hold on for security and answered the engine alarm 6 seconds after it sounded.

Figure 2: APL England track and incident location

Source: Australian Hydrographic Office, Google Earth, annotated by the ATSB

The ship continued to roll heavily. At 0610:53, 25 seconds after the initial alarm, the main engine shut down due to loss of engine lubricating oil pressure.

The OOW noted the loss of power and slowing of the ship. They alerted the master to the loss of propulsion and, following standard procedure, moved the engine telegraph to ‘stop’.

At 0611:50, the duty engineer informed the OOW that, with the engine telegraph set to ‘stop’, the engine could be started again once the alarms had cleared and the main engine shutdown lockouts had reset. The main engine was subsequently restarted, dead slow ahead.

The events had woken the chief engineer and the chief mate who both went to the bridge. Upon seeing that the main engine had shut down the chief engineer went to the engine room, while the chief mate took control of navigation to recover the ship.

Incident recovery

The ship was turned easterly and then southerly, into the weather. The response was slow and the main engine speed was increased to half ahead. The ship gathered speed and, by 0617, passed 2 knots and continued turning to starboard and south. At 0622 the ship’s speed was 6 knots on a steady 165° heading. The master and chief mate discussed options. It was decided to head north, with the weather, while the situation was assessed further.

The turn to starboard was commenced at 0627 and the ship was steady on a northerly course (about 015°) and with a speed of about 12 knots at 0700. At this time, the ship was 44 NM south‑east of Sydney. The chief mate contacted Sydney vessel traffic services (VTS) and was informed that the weather was not expected to improve and that Sydney and Port Botany were closed.[5]

As the skies lightened (sunrise was at 0647), the chief mate noticed fallen stacks of containers aft, from bay 62 (Figure 3 right). The master notified the company of the incident. Upon returning to the bridge about 10 minutes later, the master was further notified by the chief mate of the damage and loss of containers forward at bay 30 (Figure 3 left).

Figure 3: Looking forward and aft from navigation bridge at about 0700

Source: APL, annotated by the ATSB

On the northerly heading, though the weather remained unabated from the south-south-west, the ship’s movement improved and no further loss of containers occurred. The winds eased to force 7 (28–33 knots) into the afternoon and, at 1600, the ship was passing Newcastle.

Due to the closure of Sydney and nearby ports due to the weather, the decision was made to continue passage to Brisbane, Queensland, the next closest, suitable place of refuge and about 400 NM further north. The weather eased as the ship travelled north. By noon on 25 May, off Byron Bay with 120 NM to travel, winds were force 5 (17–21 knots) from the south-west with sea state 5 (2.5–4 m waves) on a 3 m south-south-easterly swell.

Brisbane arrival

At about 2136 on 25 May, APL England anchored 7 NM off Point Cartwright and the entrance to the Port of Brisbane. Prior to being allowed entry into port, several inspections and assessments by surveyors and maritime authorities were carried out. Maritime Safety Queensland (MSQ) formulated a recovery plan and risk assessment for the operation. Additional piloting, towage, pollution prevention and on-water guidance measures were put in place.

Two days after arriving off the port, at 0600 on 27 May, APL England weighed anchor and proceeded into Brisbane. At 1342 the ship was all fast alongside.

Over the following days personnel representing several different stakeholders attended the ship, including investigators from the ATSB, the Australian Maritime Safety Authority (AMSA) and MSQ.

On 29 May, the first damaged container was removed from the ship. In all, 50 containers were lost (16 from bay 62 and 34 from bay 30), and 79 were damaged but remained on board. One container lost overboard contained hazardous goods in the form of dry powder fire extinguishers. AMSA identified a search area of about 1,000 km² stretching between the Illawarra and Sydney’s southern suburbs in water depths of up to 200 m.

By 19 June all remaining containers had been discharged and AMSA released APL England to sail from Australia to Zhoushan, China, to undertake repairs. On 4 July, APL England arrived at the shipyard in Zhoushan.

Post-incident inspections identified that more than 550 single and double lashing plates required replacement, along with significant amounts of deck steelwork and structures. This included lashing plates and structures supporting and securing containers lost overboard. APL England underwent repairs and departed the shipyard on 2 August to continue operating. DNV GL placed a condition of class on the ship noting that numerous corroded or thinned bracket/stiffener plates on the exposed weather deck and cross decks remained to be repaired.

Soon thereafter the ship was sold and it changed name, owners, managers, operators, flag, classification society, Protection and Indemnity (P&I) insurers and area of operations.

Context

APL England

At the time of the incident, APL England was owned by CMB Ocean 13 Leasing Company and technically managed by CMA CGM International Shipping Company, both of Singapore. It was chartered by ANL Singapore Pte. Ltd from APL Co Pte. Ltd (APL).[6]

During March 2020, APL changed APL England’s voyage plan from the China–India service to the China–Australia service. APL England completed the China–India service in Manila and in early April proceeded to Shanghai to load for the Australia service.

The change of service prompted increased attention to the ship’s condition (deck and engine room), including deck condition, cargo lashing equipment, access hatches and deck structures as well as other machinery and equipment such as lifeboats, winches and windlasses. Two additional fitters joined the ship to assist with deck repairs and maintenance. Direction was received from, and regular reports were made to, fleet management. A three-day period at anchor to effect repairs and prepare for the change of service was conducted at Shanghai, prior to loading cargo for Australia.

The ship was classed with DNV GL[7] and had completed its most recent annual survey during April 2020.

Crew

APL England had a multi-national crew of 25 including two third mates, two cadets and two supernumerary fitters on deck. The master was from Malaysia and the chief engineer from Singapore. Other deck and engineering officers were from China, the cadets from Malaysia and Singapore, the fitters were from Ukraine and remaining crewmembers were from Myanmar. All were suitably qualified, and Singapore endorsed, for the positions they held.

The deck department consisted of the master plus four deck officers (chief mate, second mate and two third mates) and a deck cadet. There was a boatswain (bosun) and three able seafarers, an ordinary seaman and the two additional fitters for deck maintenance. The able seafarers usually maintained bridge watches overnight and assisted the chief mate and bosun on deck during day watches when available. The two fitters had been recently added to the ship’s complement to assist with deck maintenance under the direction of the chief mate.

The engineering complement consisted of the chief engineer plus three engineers, an electrical trades officer, a refrigeration engineer, and an engineer cadet plus two oilers and a fitter. The second, third and fourth engineers kept a rotating duty routine in which each engineer was responsible for the engine room operations and alarm monitoring for a 24-hour period every third day, from 0800 to 0800.

APL England’s master had worked at sea since 1996 and progressed through the ranks to obtain a Master Mariner’s (Class 1) certificate in 2008. The master served in container ships of various size as chief mate from 2007 to 2018 at which time they were promoted to master. This voyage was their second contract in APL England and third as master. The master had been on board for 11 weeks.

The chief mate held a Chief Mate certificate of competency obtained in 2016 after first going to sea as cadet in 2008. They had wide experience on container ships up to 8,000 TEU and had been on board for almost 20 weeks having joined APL England for the first time in January 2020. The chief mate did not keep a navigation watch.

The third mate was the officer of the watch at the time of the incident. They held a Third Mate certificate of competency obtained in 2018 and had joined APL England in December 2019. The third mate’s first trip to sea was in 2016 as cadet and all their experience had been in container ships.

The able seafarer on watch and performing helm duties held a certificate of proficiency for rating as an able seafarer—deck, issued in 2016. They first went to sea in 2001 and had joined APL England in July 2019. Normal routine was to keep watch during the night (4 to 8 watch) and work on deck during the day watch.

The chief engineer held a marine engineer officer Class 1 (Motorship) certificate obtained in 2016. They had joined the APL fleet as a fourth engineer in 2012 and had since progressed to this, their first, ship as chief engineer. The chief engineer joined APL England in March 2020 and had been on board for 11 weeks.

The third engineer was duty engineer at the time of the incident and had first gone to sea in 2010 within the APL fleet. They held a third engineer’s certificate of competency obtained in 2016 with all their experience being in container ships with low-speed main engines. The third engineer joined APL England in January 2020 and had been on board for 19 weeks.

Carriage of containers

APL England was designed exclusively for the carriage of containers as cargo. Containers were carried in athwartship spaces called ‘bays’, both on deck and in cargo holds. The ship’s bays were numbered from bay 01 forward to bay 62 aft, with bay numbers 45 to 62 located aft of the accommodation.

Containers are stowed and secured with suitable securing arrangements to withstand the forces imposed on them while being transported by sea. The motions of a ship in a seaway give rise to accelerations and forces, the magnitude of which depend upon the dimensions of the ship, its stability conditions and the wind and sea conditions being experienced. A ship’s cargo stowage arrangement and securing system is designed to ensure that the forces generated at sea remain within defined, allowable limits and that the container stow remains intact. The ship’s cargo securing manual (CSM) provided details of these limits, stowage arrangements and container securing systems, including lashing patterns and details of lashing gear.

On board APL England, the equipment used to secure containers on deck included twistlocks, lashing bars and turnbuckles. Twistlocks were used to secure containers stowed on deck to the hatch cover or deck, and to secure containers to one another vertically in a stack. Turnbuckles were anchored to lashing eyes on the ship’s deck, hatch coaming or lashing bridge, depending on the location on board. The lashing bars secured containers to the ship and were tensioned via the turnbuckles.

Container securing

SOLAS[8] required that, in part:

Cargo…carried on or under deck shall be so loaded, stowed and secured as to prevent as far as is practicable, throughout the voyage, damage or hazard to the ship and the persons on board, and loss of cargo overboard.

All cargoes…shall be loaded, stowed and secured throughout the voyage in accordance with the Cargo Securing Manual approved by the Administration. The Cargo Securing Manual shall be drawn up to a standard at least equivalent to relevant guidelines[9] developed by the Organization (IMO).

The ‘relevant guidelines’ required that the CSM covered all necessary aspects of cargo stowage and securing and had uniform layout and content. Consistent with this guidance, APL England’s CSM included the following general information, that:

• the CSM specified the arrangements and cargo securing devices provided on board the ship for the correct application to and the securing of…containers…based on transverse, longitudinal and vertical forces which may arise during adverse weather and sea conditions
• it is imperative to the safety of the ship and the protection of the cargo and personnel that the securing of the cargo is carried out properly and that only appropriate securing points or fittings should be used for cargo securing
• information on the strength, and instructions for the use and maintenance, of each specific type of cargo securing device, is provided in this manual
• cargo securing devices should be maintained in a satisfactory condition (and) items worn or damaged to such an extent that their quality is impaired should be replaced.

In accordance with requirements, APL England’s cargo securing manual was compiled by Kunshan Lucky Sea Industrial and first approved in 2001. The CSM in force at the time was approved, with amendments, by Class (DNV GL) on behalf of the Republic of Singapore Flag Administration on 15 May 2017.

Fixed container securing devices

Chapter 2 of the CSM provided details on the fixed securing devices used on deck which included 1,500 lashing plates—686 single, 686 double and 128 swivel. Each lashing plate had a safe working load of 250 kN and a breaking load of 500 kN. The single and double lashing plates were welded to the ship’s structure and were made from 25 mm thick steel plate (Figure 4).

Figure 4: Lashing plates (eyes), spare and as recently fitted to APL England

Source: ATSB

Maintenance of securing equipment

Sound engineering practice, prudent seamanship and multiple industry and business guides, circulars and directives dictate that it is important that shipboard equipment, such as cargo securing devices, meet acceptable functional and strength criteria applicable to the ship and its cargo. Additionally, (as detailed above in the CSM) such devices should be maintained in a satisfactory condition and items worn or damaged to such an extent that their quality is impaired should be replaced.

Chapter 2.3 of APL England’s CSM described the inspection and maintenance requirements for the fixed and portable securing equipment. This section included the following information:

Inspection and maintenance of both fixed and portable securing gear should be carried out under the responsibility of the master…at intervals not exceeding six months…and…should be documented in an appropriate record book, which should be kept with the Cargo Securing Manual.

Damage to fixed cargo securing devices must be repaired by an authorized workshop and reported at the next suitable survey of the classification society.

During the voyage…inspection and adjustment of securing arrangements…is limited to moderately retensioning turnbuckles of lashings. This is particularly important when heavy weather or swell is being expected.

Additional remarks included:

…where there is any doubt over the capability of existing fixed securing arrangements including supporting structure, the fixed fitting should be proof tested at loads equal to the maximum specified securing load + 25%. The proof loading is to be applied at both the mean and extreme angles of operation.

DNV GL advised that, at the time of the occurrence, there were no class rules specifically for the wear and tear and corrosion of fixed lashing devices. Rather, assessment of acceptable wastage was based on class standards for lifting appliances.[10] That allowed for 10% reduction in plate thickness due to wear and tear and general corrosion, and 30% in the case of isolated pitting.

Appendix VII of the CSM contained the ‘Record of cargo securing devices inspection and maintenance’. This included third party service reports and a section listing on board inspections. An ATSB review of these records identified that they were intermittent and inconsistent, particularly after 2014. The latest entries were from monthly inspections January to April 2020. All lashing gear was considered in ‘satisfactory’ condition with limited comments which included ‘Lashing eye found corrosive (sic)’. Prior to 2020, the preceding record was from October 2016.

No planned maintenance system or other digital or other record of fixed and portable lashing equipment inspection and maintenance was provided to the ATSB by the master or APL.

Container forces

The CSM in addressing stowage and securing and the forces acting on containers remarked:

• The stowage and securing system as described in [this manual] is designed under the condition of GM ≤1.5 m.[11] If, for any reason, the ship is to be operated with larger GM values, the expected acceleration will increase accordingly.
• If a GM value greater than 1.5 m cannot be avoided a reduction of stack masses or stack heights…or a shifting of masses to lower tiers in the stack should be effected.

APL England’s container stowage and securing arrangement was designed so that forces remained within the maximum allowable limits. The preparation and approval of the container securing arrangement plan and the lashing computer system was based upon DNV GL 2017 rules which were in turn based upon and similar to the Germanischer Lloyd (GL) ‘Guidelines for Loading Computer Systems 2013’ (GL2013) rules.

DNV GL documents relating to container ships and stowage and lashing of containers outlined the forces calculations and the static and dynamic variables used. These variables included:

• static gravity forces—container weight; stack weight
• dynamic, inertial forces generated by accelerations due to roll, pitch and heave motions of the ship—the calculations took into consideration ship’s speed, stability condition (GM) and trading route, combined with statistical wave data according to IACS recommendations[12]
• wind forces
• wave impact forces from seas
• forces imposed by the securing arrangements
• strength of the container and of the lashing equipment including ship’s structure.

The DNV GL method used roll, pitch and sway to determine a roll motion (transverse) acceleration for each loading condition. A minimum heeling angle of 16° and maximum of 21.4° were used to calculate the maximum transverse acceleration. The maximum expected heeling angle for the load condition (taking into consideration vessel speed, stability condition and route) was then calculated.

All calculations were based upon lashing equipment in new condition with a factor of safety of 2 (failure strength 2 times the design load) to allow for corrosion and wear and tear.

Non-standard height (high cube) containers

The CSM provided guidance on securing of all containers approved for use on board. To this end the CSM made specific reference to the various size containers the ship could carry, and which type of container could be carried in which location on the ship. Therefore, multiple references were made throughout section ‘4.3 Container stowage and securing plans’ to the size (length and height) of container to which each plan applied. The summary page of the plans listed 20 ft and 40 ft containers as being International Organization for Standardization (ISO) standard 8 ft 6 in high units. Taller containers (high cube)[13] were limited to the longer (45 ft, 48 ft and 53 ft) containers.

The plans for 40 ft container stowage on deck each noted a height of 8 ft 6 in for 40 ft containers. The CSM only allowed for 40 ft containers to be loaded into bay 62 and did not allow for these to be high cube containers.

The CSM further stated:

• The mass distribution within bays and stacks as stated in this manual presents an optimum under the given circumstances. Any alteration of this distribution will have an effect to the magnitude and distribution of forces in containers and securing devices.
• In deciding on another vertical distribution of masses in a stack the relevant distribution as given in this manual should be taken as a reference (and in that case) the following principles should be used (including):

When stacking 9' 6” containers a reduction of top masses or a shifting of masses from top to bottom should be carried out in order to compensate for the higher center of gravity and the higher windage area of that stack.

Cell guides

APL England was fitted with cell guides[14] for on deck stowage of containers into the aftmost bay (bay 62). According to DNV GL rules, containers stowed within cell guides on deck were considered as though they were stowed in cell guides below deck and needed to comply with those rules. The rules allowed for athwartships clearance of 25 mm and fore-aft clearance of 38 mm.

The support provided by cell guides was not allowed for in DNV GL (GL2013) forces calculations (see the section titled Load computer) for container securing.

Manufacturers of the MACS3 loading computer advised that the program assumed all containers with the bottom within the cell guides did not have twistlocks fitted and those above the guides did. The program assumed all containers loaded into bay 62 were standard 40 ft (8 ft 6 in high) with twistlocks fitted between tiers 5 and 6 and above. Furthermore, program forces calculations assumed that all containers with their base within the cell guides were completely covered (supported) by the cell guides.

Contrary to the CSM requirements, APL England was loaded with exclusively high cube containers into bay 62. The top of tier 4 was therefore 1.2 m higher than if standard height containers had been loaded (Figure 5). This reduced the amount of the tier 5 containers held within the cell guides although the loading computer program considered them to be completely within.

Figure 5: Bay 62 container stowage versus cell guide arrangement

Source: ATSB

Container securing arrangement document

The CSM was supported by a Class approved (DNV GL 15 May 2018) ‘Container securing arrangement’ (CSA) document which outlined the stowage and securing arrangements for the vessel for each location and for each size of container carried. The information in this document was similar to that contained in Chapter 4.3 (Container stowage and securing plan) of the CSM. However, there were notable differences between the information provided in the CSM2017 and CSA2018, especially regarding numbers of tiers, container and stack weights and lashing of forward bays. It was not apparent which of these two documents was the definitive one upon which the cargo loading and securing plan was based, or upon which the settings for the load computer were based.

This document agreed with the CSM in defining 40 ft containers to be standard height, with no reference to 40 ft containers of different heights for loading throughout the ship, including bay 62.

Load computer

The CSM, in addressing stowage and securing and the forces acting on containers remarked:

In the light of the complexity of the problem of proper stowage and securing of containers with varying gross masses under the usual condition of time pressure in port it is strongly recommended to ship owners or ship operators to provide appropriate computer software in order to enable ship's staff to keep the securing of individual loading situations under control.

APL England had a capacity of 5,780 TEU. With limited durations in port for cargo operations, a means to easily and quickly ascertain that the forces acting on the ship would not exceed specified limits was required. Therefore, in addition to the CSM, the ship was fitted with a Seacos MACS3 (v NET1.1) loading computer system developed by Interschalt Maritime Systems. Among other applications, this system also incorporated a container or cargo loading module and a lashing calculation program. The system met the requirements of the GL2013 rules.

A loading computer alone does not meet the SOLAS requirements for a CSM approved by the Administration. Consequently, DNV GL rules stated that

An approved loading computer system is not a substitute for the approved loading manual, (or) the approved stability booklet…It is used as a supplement to these approved documents to facilitate strength and stability calculations.

System functions

The MACS3 system utilized a wide range of hydrostatic, stability and strength calculations to assist the safe loading and unloading of the ship. The system was also capable of assessments of stability and stress conditions throughout a voyage.

Among other features, the MACS3 program included the Sealash cargo securing module. This module checked and analysed lashing forces. It was also capable of inventory management for the securing materials.

The software combined details of the ship’s structure, securing arrangements (equipment and securing methods), container weights and distribution (sourced from load condition files delivered to the ship prior to loading), and ship condition in calculations. Many of these details were unable to be changed by the user and were based on classification society requirements.

However, some parameters which influenced the lashing forces calculation results, were able to be changed by the user. This included GM, draught and speed.

The load computer generated a coded bay plan for each bay which displayed relevant container details including position (bay, row and tier numbers), container serial number, size, weight, class of dangerous goods (if relevant), load and discharge port. All information was also available in tabular format.

The graphical plan also showed the lashing arrangement. Each page of the plan included tabulated figures on stack weight and forces calculated for each stack. Exceedances were highlighted in red.

Non-standard cargo containers—high cube

High cube containers were indicated in bay plans by a dark triangle on the upper right corner of the software’s graphical image. The difference in height between standard and high cube containers was visible, as the container representation was also higher. Further, the overall stack height would appear higher on the bay plan graphic.

Loading of high cube containers into bay 62 was in contravention of the CSM. However, no error messages were displayed on board APL England for this loading condition.

The APL cargo operations manual included a procedure for ‘Lashing system—loading restriction’. This procedure highlighted height restrictions for full stacks of high cube containers below the lashing level (as per bay 62). This procedure described that, upon starting the MACS3 software, a pop-up warning window would display directing the user to refer to the CSM and that ‘when loading containers on deck…it is compulsory to stow particular amount of standard or high cube containers on tiers 80 to 86 (tiers 1 to 4 on deck) as per the Cargo Securing Manual’. This document was dated 6 April 2020, however the required warning was not displayed on the APL England loading system software.

No explanation was provided in relation to how the high cube containers were permitted to be loaded into bay 62 or why the MACS3 software allowed this breach of the CSM.

Machinery

APL England’s main engine was a Samsung B&W 12K90MC, delivering 55,659 kW at 94 revolutions per minute (RPM) through a direct drive six-bladed propeller. At 94 RPM the main engine consumed 210 tonnes of fuel per day at a ship speed of 25 knots. Economical speed was 60 RPM, consuming 67.7 tonnes of fuel per day at 16.3 knots.

The main engine lubricating oil system included two vertical centrifugal pumps with 400 mm delivery bore and 1,200 m³/hour capacity at 0.45 MPa pressure. The pumps were mounted into the lubricating oil sump tank at the forward end of the main engine. Minimum oil level in the sump tank was 480 mm maintaining the pump suction submersed by 350 mm. Records of sump level showed that the engine was being operated with oil levels within recommended parameters.

In accord with DNV GL rules, the system was designed to operate in dynamic conditions to up to 22.5° roll and 7.5° pitch angles.

The main engine lubricating oil system pressure monitoring consisted of two pressure sensing circuits. The first was a pressure transducer which provided real-time pressure values to the engine room alarm and monitoring computer system. The monitoring system provided a display of oil pressure in the machinery control room. Normal inlet pressure to the engine was 0.27 MPa. Software alarm and shutdown triggers were based upon readings from this transducer. A separate pressure switch was also fitted as an independent low-low pressure main engine shutdown. The software low pressure alarm was set at 0.17 MPa with zero-time delay, and both low-low pressure shutdowns were set to 0.15 MPa with zero-time delay.

Recorded data

Voyage data recordings

APL England was fitted with a simplified voyage data recorder (S-VDR)[15] designed to collect and store data from various shipboard systems in compliance with SOLAS requirements. This included parametric data, bridge and communication audio, and radar images. Roll and pitch data were not recorded on board, nor was there any requirement to do so.

APL England’s system was designed to capture 12 hours of data, written concurrently to a Compact Flash (CF) card and the protective capsule. This system required crew interaction to ensure the data was saved following an incident where power was not lost. The oldest data was continually overwritten and to preserve data, it was saved to the CF card and the card removed. This procedure was followed on this occasion and the recorded data was provided to the ATSB. The downloaded data was successfully converted into a usable format in accordance with the manufacturer’s procedures.

APL England was also fitted with a Panasonic video recording system, which captured 8 video feeds from cargo areas and the bridge, and contained about 1 month of data. The video recordings were viewed as part of the investigation but did not capture the loss of containers overboard.

Machinery alarm log

APL England’s machinery control, monitoring and alarm system provided a record of alarm activations. This system was independent of the VDR and analysis showed the alarm time stamp to be 2 minutes and 43 seconds ahead of the times recorded on the VDR. Times were captured for alarm activation, acknowledgement and clearance.

Recorded data

Data from the time of the heavy rolling and loss of containers are shown in Table 1 and Figure 6.

Table 1: Recorded data times and events from the time of the container loss overboard

Time (Local, VDR time)	Event
0609	Rolling begins to increase, ship speed about 7 knots
0610:28	Steering system alarm
0610:28	First machinery alarm since 0218—piston cooling oil inlet low pressure[1]
0610:37	Roll 1—audio of objects within the bridge sliding and falling to the deck[2]
0610:50	Roll 1 return—sliding and banging audio of objects within the bridge
0610:53	Main engine shutdown alarm
0610:59	Roll 2—audio
0611:04	OOW and master note that the main engine had stopped. Ship speed slowed to about 5 knots
0611:08	Roll 2 return—audio
0611:18	Roll 3—heavy sustained roll audio. Period of maximum rolling
0611:29	Roll 3 return—sustained audio
0611:41	Roll 4
0611:55	Roll 4 return
0612:06	Roll 5. Ship speed to 3.5 knots
0612:14	Main engine shutdown interlocks reset
0612:18	Roll 5 return
0612:30	Roll 6
0612:39	Roll 6 return, no further sliding or falling object audio
0612:46	Public address warning
0613	Ship speed to less than 2 knots
0613:07	Main engine slowdown alarm indicating the engine was running
0614 to 0615	Slowest speeds of about 0.5 knots recorded
0615:24	Master confirmed main engine was running
0615:41	Speed of 1 knot audibly confirmed
0617	Speed increases through 2 knots

The duty engineer had changed the machinery alarm duty call system to ‘Attended’ and alarms were not sounding on the bridge or recorded by VDR audio References in this table to audio are to objects within the bridge sliding and falling to the deck. No audio of containers falling was recorded

Figure 6: APL England's track from 0609 with times and events marked

Track waviness is related to the port-starboard motion of the GPS sensor (mounted about 25 m above the waterline) as the ship rolled.
Annotation 0610:37 falling objects refers to audio of objects within the bridge falling to the deck, not external audio of containers falling.
Source: Google Earth, with APL data, annotated by ATSB

The data showed that the rolling preceded the main engine shutdown and reached maximum as, or just after, the main engine stopped. The rolling then quickly diminished as the ship slowed and propulsion was re-established. No audio, or other recording, captured the moment the containers fell overboard.

Ship inspection

General guidance in SOLAS (Chapter 1 Regulation 11) stated:

1. The condition of the ship and its equipment shall be maintained to conform with the provisions of the present regulations to ensure that the ship in all respects will remain fit to proceed to sea without danger to the ship or persons on board.

Additional references and IMO circulars[16] supported and expanded on this principle.

Multiple organisations and agencies have an interest in the condition of ships within their sphere of influence. These entities thus have roles, responsibilities and obligations when it comes to ensuring that the ship is safe to operate and is fit for service. Typically, the list of interested parties includes the:

• shipping company
• flag administration
• classification society
• protection and indemnity insurance (P&I Club)
• coastal and port States within the area of operation of the ship.

Shipping company and shipboard (APL)

The ISM Code[17] (Part A, paragraph 10) makes it clear that the ship operator (the shipping company) is responsible for ensuring the safe and pollution-free operation of the ship. In particular, the shipping company is required to ensure that the ship is maintained and operated in accordance with applicable rules and regulations and any additional requirements that may be established by the company.

Maintenance for control of corrosion of deck fittings is difficult and is heavily reliant upon good inspection regimes. APL had a planned maintenance system, and survey and inspection cycle in operation throughout its fleet. Part of this regime included regular vessel visits and inspections by shore management and technical staff along with routine vessel management contact and practices.

Records of these visits and inspections included:

• a vessel maintenance planning spreadsheet (referred to as the Fleet 077 document). The latest spreadsheet prior to the incident (updated 24 May) contained 229 jobs, 53 of which remained outstanding. While this list contained many jobs related to repair of corroded deck fittings (including lashing bridges), no jobs existed for repair of cargo securing arrangements such as lashing eyes or container foundations.
• chief mate handover notes (from 11 January 2020) providing an exchange of information between departing and boarding crewmembers regarding job relevant information including deck maintenance. This document referred the reader to the Fleet 077 list and made particular mention of renewal of container foundations by the deck fitters.
• chief mate’s deck maintenance prior to arrival in Australia list compiled as part of routine duties—undated, unsigned. This list contained mention of 50 lashing eyes and 200 container foundations requiring replacement and said to be included in the dry dock list. In addition to this list, correspondence from the previous chief mate to shore management reported a total of 270 container foundations requiring replacement. 
• an undated dry dock list provided details of shipboard maintenance which could only be, or would be more appropriately, completed when the ship was out of service and/or out of the water. The dry dock list included 276 lashing eyes and 270 container foundations along with lashing bridge structures requiring repair or replacement. APL England’s next scheduled dry docking was due by early 2021.
• the cargo securing manual contained a sporadic manual record of cargo securing gear maintenance. The records contained therein included monthly entries for 2020. These entries included comments that lashing eyes were found corroded and damaged container foundations had been repaired.

APL did not provide detail of the history of shore management inspections of APL England.

Change of service preparations

Prior to loading cargo for the change of service to Australia, APL England proceeded to anchorage for 3 days and undertook repairs. This repair time was to address items related to the recent detention of another company vessel in Australia, however it did not include any inspection or maintenance of cargo securing equipment.

Flag administration (Singapore)

Responsibility for the safety of a ship and compliance to relevant international instruments rests with the flag State, as provided under Article 94 of the United Nations Convention on the Law of the Sea (UNCLOS).

As part of the discharge of its obligations and to ensure compliance with flag requirements, the Maritime and Port Authority (MPA) of Singapore conducts flag state control (FSC) monitoring and inspection on all Singapore-registered ships. The MPA advised the ATSB that APL England was generally inspected every 4-5 months with the last inspection carried out on 18 March 2019. The advice went on to say, that apart from some common deficiencies, the vessel was generally well-maintained with no deficiencies related to cargo securing devices.

Port state inspections

International conventions and the UNCLOS give nations responsibilities to check and control ships in coastal waters so that they do not pose threats to ship and crew safety or to the marine environment. These countries utilise port state control (PSC) as a method to ensure shipowners and flag states comply with their responsibilities for the safety and operation of a ship.

APL England first entered service in 2001. From then, until this incident, the ship had been subjected to at least 50 separate port state inspections. No detentions were recorded and while deficiencies were regularly recorded from 2013 onwards, only one deficiency (in 2016) related to lashing material.

The last PSC inspection was completed in December 2019, with one minor deficiency recorded.

As part of the PSC operations, port states and collectives of port states (under various geographical memoranda of understanding) periodically conduct inspection campaigns targeted (or focused) at particular areas of concern. Several of these campaigns have been directed toward cargo securing including container ships and container securing. The results from campaigns conducted world-wide since 2016, including by MOUs in APL England’s areas of operation,[18] did not highlight fixed cargo securing arrangements as an area of concern.

Australian Maritime Safety Authority port state control inspections

In Australia, the Australian Maritime Safety Authority (AMSA) conducts PSC inspections. AMSA figures for 2020 showed:

• 26,179 ship arrivals into Australian ports (5,981 individual ships), 3,694 container ship visits
• 3,021 PSC inspections, 
  • 6,377 deficiencies—2.1 per ship inspection
  • 178 ships detained
• 263 inspections of container ships (8.7% of total)
  • 879 container ship deficiencies, 3.3 per inspection, 436 deficiencies were structural/equipment related
  • 17 container ships detained
• 295 Singapore flagged ships were inspected with 13 being detained
• 519 DNV GL vessels inspected, 1,182 deficiencies, 30 detentions.

AMSA Marine Notice 03/2018 Proper stowage of cargo containers

Australia expects cargo to be carried in full compliance with a vessel’s CSM and in accordance with the requirements of the SOLAS Convention. In 2018 AMSA published Marine Notice 03/2018 ‘Proper stowage of cargo containers’.[19] This notice reminded vessel owners, operators and masters of the need to stow and secure cargo containers in accordance with approved arrangements.

The notice revealed that AMSA was aware of recent incidents in which the stowage of cargoes did not comply with the approved arrangements, including that fixed and portable securing equipment were not maintained appropriately.

AMSA focused inspection campaigns

In 2010, AMSA conducted a focused inspection campaign (FIC)[20] into securing arrangements of cargo containers. That campaign found that, of 111 vessels inspected, 8% of the vessels inspected had container lashings and fittings that were in a condition which was a cause of concern. Further, 10% of the vessels recorded deficiencies in relation to containers not lashed in accordance with the vessel’s CSM.

In 2020, following this occurrence, AMSA conducted a FIC on proper stowage and securing of cargo containers. This was to verify that containerised cargo was stowed and secured in accordance with SOLAS. Over a 3-month period, AMSA conducted a total of 208 FIC inspections. Results from the campaign included that ‘fixed cargo securing equipment (was) in good condition’. Two ships were detained as a direct result of the FIC, neither for condition of fixed securing devices nor deck condition.

The FIC web report included the observation that:

Since the campaign, AMSA has continued to observe failures of fixed physical securing arrangements onboard ships visiting Australia.

In May 2021, AMSA detained the container ship Sealand Michigan for, among other items, the deficiency ‘Fixed cargo securing devices corroded and defective.’ This ship was of similar age and size to APL England.

AMSA maritime safety awareness bulletin

In March 2021, AMSA published marine safety awareness bulletin number 13: ‘Preventing container loss’.[21] This bulletin focused on the risk of losing shipping containers at sea, the impact on safety and the environment, and what measures should be considered to prevent it from happening. Points raised in the bulletin included:

• The ship’s crew must be familiar with, and containers must be stowed and secured in accordance with, the approved cargo securing manual
• Cargo securing arrangements should be regularly inspected and maintained and be sufficient to withstand severe weather conditions
• Preparations, including weather routing and adding lashings, should be made to ensure containers are secured for the most severe weather expected on the voyage.

Port of Rotterdam, Netherlands

In 2019, in response to the loss of 342 containers from MSC Zoe, the Netherland authorities and Port of Rotterdam conducted a concentrated inspection campaign into ‘Lashing of containers on board seagoing vessels’. The campaign involved random inspections of seagoing vessels in the Port of Rotterdam to determine whether the loading and securing of containers complied with international laws and regulations.

A total of 69 ships were inspected. A significant proportion of the vessels (36%) did not secure containers according to their CSM, including heavy containers stowed over lighter ones.

The campaign included inspection for ‘damaged portable/fixed lashing devices’, and 11 vessels were found not to comply to international regulations in this area. No further detail was given and no specific mention of the damage or condition of fixed securing devices was made in the report. No vessels were detained as part of the campaign.

Classification society—DNV GL

At the time of the incident, APL England was classified with DNV GL, was up to date with surveys, in class and had completed the most recent Annual survey during April 2020.

DNV GL advised that annual survey is a general survey of the hull and equipment, machinery and systems to confirm that the ship complies with the relevant rule requirements and is in satisfactorily maintained condition. The thoroughness and stringency of the survey should depend upon the condition of the ship and its equipment.

Annual surveys were to include inspection of hull and equipment and machinery systems. DNV GL also advised that

Hull and Equipment survey shall cover examination of as far as applicable…fittings and hull supporting structures…for stowage, securing and supporting of...containers (and) condition and origin/identity of loose lashing/securing elements, against documentation on board (approved container stowage plan).

DNV GL rules require that parts of the container stowage and lashing system fixed to the ship are subject to classification in accordance with Class construction rules. Loose lashing elements (lashing rods, turnbuckles, twistlocks etc) are to be examined within the approval of the entire stowage and lashing system in accordance with Class rules and recorded in the CSM.

The annual survey from April 2020 made no observations regarding cargo securing devices. This survey identified, among other items, heavy corrosion, wastage and cracking around a small number of cargo hatch coamings.

Protection and indemnity club insurance—Steamship Mutual

A protection and indemnity (P&I) club is an independent, not-for-profit mutual insurance association, providing cover for its shipowner and charterer members against third party liabilities arising out of the use and operation of ships.

At the time of the incident, APL England’s P&I Club was Steamship Mutual. Steamship Mutual state[22] that

…it is extremely important for the Club to manage the quality of entered tonnage in order to ensure that undue risk is not presented to the Membership as a whole by any particular entry.

To manage this, the Club conducted surveys of vessels prior to entry (if over 12 years old for container ships), as a result of a detention, a casualty or similar or as part of a programme of planned vessel surveys.

The purpose of these condition surveys was to examine risk, not only from the perspective of the physical condition of the vessel, but also with reference to shipboard operation and management. Club guidance for condition surveys of container ships included advice for surveyors to pay particular attention to, among others:

• Condition of cell guides
• Type, condition and sufficiency of container lashing equipment
• Condition of securing points on vessel
• Condition of shoes and twist locks
• Approved stowage plans, securing & lashing arrangement drawings as per CSM.

No evidence was made available to the ATSB by Steamship Mutual, or their representatives, to show that APL England had been inspected by the club during membership. Further, details of any inspections completed after the incident were not provided to the ATSB.

Condition of securing arrangements

The ATSB examined securing arrangements and lashing equipment in use on APL England. The portable lashing equipment appeared in generally good condition. However, many of the ship fittings (fixed securing devices including lashing eyes, lashing bridges and deck structures) were in poor condition. Figure 7 (bay 30) and Figure 8 (bay 62) show examples of the condition of container lashing eyes and ship’s structure from where containers were lost.

ATSB inspection showed this deterioration was apparent throughout the ship.

Corrosion

The ATSB sought expert assistance regarding corrosion of marine and shipboard structures to understand the phenomenon occurring on board APL England and the resultant condition as illustrated above.

Advice received was that the environmental conditions of a ship’s deck equipment and structures are complex and difficult to replicate for research purposes. Control over the conditions is difficult and research directly comparable to life-cycle conditions for container ship deck fittings is scant. That said, the advice was that corrosion of 25 mm steel plate to the state shown in Figure 7 and Figure 8 was high and was unlikely to have occurred in the 5 years between dry dockings. This was supported by corrosion research texts which suggested that corrosion rates of 1 mm per year were high.

Figure 7: Typical, thinned, heavily wasted and failed double (left) and single (right) lashing eyes from bay 30

Source: ATSB

Figure 8: Thinned, heavily wasted and failed lashing eyes (top) and wasted and failed container support structure (bottom) from bay 62

Source: ATSB

Weather

As APL England travelled down the east coast of Australia, the master received weather information regarding a complex low pressure system developing off the south-east of the country. This included regular forecasts and warnings (including gale warnings) issued by the Bureau of Meteorology (BoM) through the automated Marine Safety Information (MSI) Enhanced Group Call (EGC) system, along with reports and guidance provided by the CMA CGM fleet navigation and support centre (FNSC) and through commercial weather guidance service providers (ship performance optimization system—SPOS).

Enhanced Group Call (EGC) communications

APL England received and automatically printed the MSI broadcasts into the bridge as required. This included navigational and meteorological warnings, meteorological forecasts, and other urgent safety-related messages.

The printed messages were then filed on the ship’s bridge. Ship’s officers stated that in day-to-day operations they gave preference to consulting the weather and routing information regularly received from the FNSC and SPOS.

Bureau of Meteorology

BoM provides marine weather services covering 78 coastal water zones around the coast of Australia. Additionally, forecasts and warnings to ships are provided via VHF and HF radio services, and the EGC MSI service through global satellite communications services. Services are also accessible via the internet.[23] BoM advised that forecasters ensure the most accurate information is provided in MSI bulletins by using multiple models and guidance sources.

On 20 May, as APL England entered the Coral Sea, the BoM was issuing storm force wind warnings (48–55 knots) for the south-eastern seas off Australia.

On 22 May, APL England was off the southern Queensland coast and received weather advice from the FNSC of a low pressure system off south-eastern Australia. The BoM issued storm force wind warnings throughout 22 May and into 23 May. At 1008 on 23 May the warning was reduced to a gale warning (34–40 knots). The gale warning remained into 25 May, well after APL England had lost the containers.

BoM also provided wind and wave forecast maps (to 7 days in advance) for the area. Daily copies of the wave maps and mean sea level pressure prognoses, from 11 May onwards, were sent to the master of APL England by the FNSC. These included forecast of 5–7 m waves on 23–24 May.

Ship performance optimization system (SPOS)

APL England was fitted with the DTN[24] ship performance optimization system (SPOS) weather routing software, with Seakeeping module. This module combined weather forecasts with hydrodynamic modelling and operational data from the ship for motion forecasting and risk assessment, based upon the IMO MSC.1/Circ.1228 guidance. This was to assist the master in optimising the ship’s route. The service provided a data file sent to the ship via email which was accessed via on board software. Each file contained 9-day forecasting and could be received 1, 2 or 4 times per day.

On board APL England, the master stated that the latest SPOS data file was regularly downloaded and that they did so on 23 May. Figure 9 shows the update forecast map from 0400 on 24 May, used by the master to assess conditions. The ship weather inset graphic displayed the local weather conditions forecast for the ship at the time. The Spot weather inset listed the conditions at a point determined by the computer mouse pointer (in Figure 9, the mouse pointer was over the ship’s position at 0220 hrs on 24 May).

The master stated that through experience they had come to rely more heavily on the information provided through the SPOS system than other means.

Figure 9: Weather map from SPOS data as used by the master prior to the incident

The figure is displaying APL England’s position with projected route down the NSW coast. Displayed weather features include wind barbs, with coloured wind contours (clear to burned orange—user adjustable) and lines overlaying a grid of pressure readings. Insets show a list of spot (computer mouse position) weather conditions and the ship’s weather graphic. The left hand side of the window shows the map elements available and those on display (checked). Note that times in the figure are in UTC.
Source: APL, annotated by ATSB

Fleet navigation and support centre (FNSC)

In 2017, CMA CGM opened a navigation and port operations centre in Singapore to provide 24‑hour support to vessels operating in the Asia-Pacific region. The facility used the latest navigation assistance tools and technologies to track and examine wide-ranging nautical, meteorological, and geographic information in real-time and provided this support to the fleet’s ships.

The FNSC advised, that for vessels trading between Asia and Australia, route planning was delegated to the ship’s master using the on board SPOS software. That said, the FNSC also provided the ship with a daily weather forecast email covering the Australia-Oceania area. This email included the:

• Australian BoM mean sea level pressure prognosis charts for 12-hourly forecasts for that day and the following 3 days
• BoM Auswave Global total wave height and direction forecast charts for that day and the next
• Stormgeo[25] wind and wave forecast maps covering the Oceania region for that day and the next.

During the voyage to Australia, the FNSC monitored the progress of APL England. A route optimisation plan was sent to the ship after departure from Ningbo, to provide the master with guidance for improved fuel savings when transiting the Australian coast. On the master’s request, the FNSC would also provide heavy weather avoidance advice in accordance with company procedures. No evidence of a request or any specific heavy weather advice from the FNSC was provided to the ATSB during the investigation.

Information sent by the FNSC, from 21 May onwards, forecast the high seas and heavy weather system developing in APL England’s path, off the south-east coast of Australia.

Navigation in adverse weather

Possible causes of rolling

IMO circular MSC.1/Circ.1228[26] provided masters with assistance for making ship handling decisions in adverse weather and sea conditions. The circular described adverse weather conditions that may cause heavy rolling with a risk of damage or capsize.

Dangerous phenomena detailed in the circular were:

• Phenomena occurring in following and quartering seas—not apparent in this case
• Synchronous rolling motion—when the ship’s roll period[27] coincides with the wave encounter period.[28] Ships are more prone to such rolling when the seas are abeam.
• Parametric roll motions—large and dangerous roll amplitudes due to the variation of ship stability between the position on the wave crest and the position in the wave trough.
• Combination of various dangerous phenomena—extremely dangerous situations arising from combination of the above phenomena, with ship motion affected by waves and water on deck, cargo movement, and so on.

Operational guidance was provided to assist the master in avoiding dangerous situations when navigating in bad weather.

The circular cautioned that:

A ship could be unsafe even outside the dangerous zones defined in this guidance if the stability of the ship is insufficient.

The bridge procedure ‘Navigation in adverse weather’ described adverse weather as ‘unfavorable (sic) weather conditions which can lead to endanger the crew, the vessel and the cargo’. The procedure provided direction to the OOW and master for such conditions. Among other directions, the master was to inform the FNSC if support was required, and to report to the FNSC if the passage plan was to be amended.

The OOW was to monitor and assess the situation and use available information sources (including local observations and sources as outlined above) to minimise consequences of the adverse weather. The OOW was to advise the master of any significant happenings including changes in speed or course etc.

The procedure directed that at least once per watch, the master or OOW were to assess the weather using the ‘Dangerous motion criteria’ tool (described in the following section). Further, the ‘Navigation in adverse weather check list’ and the engine procedure ‘Engine safety measures for adverse weather’ were to be followed.

The procedure then included information on dangerous phenomena similar to that outlined in the IMO circular MSC.1/Circ.1228. This included synchronous rolling and parametric rolling. The advice and procedures were supported by the dangerous motions calculation tool.

The adverse weather procedures were not enacted during the voyage and deteriorating conditions. Further, as the weather worsened, the master did not direct the chief engineer or the duty engineer(s) to complete the engine room safety measures. Among other things, this procedure called for:

• the engine room to be continually attended
• main and generator engine sump levels to be adjusted to avoid loss of pump suction
• an additional steering pump to be running.

Dangerous motion criteria calculation tool

The dangerous motion criteria calculation tool determined the encounter period based upon values of the ship’s speed, wave period and the angle between the ship’s course and the wave direction. The tool then indicated if the master should be called due to the presence of one, or more, of the dangerous conditions (see Appendix: Dangerous motions criteria tool).

Using the formulae from the calculation tool and the conditions present at the time of the loss of containers, the ATSB constructed a map of encounter angle versus ship’s speed for various values of the ship’s roll period (TR) over the encounter period (TE) (TR/TE). The map (Figure 10) was used to highlight the conditions in which a danger of parametric or synchronous rolling existed. Also shown on the figure are the approximate speed and encounter angle existing at about 0610.

This representation indicated that, based on APL’s criteria, APL England was operating in the region of susceptibility to parametric rolling. Of note, the criteria used to determine the ship’s susceptibility to parametric rolling are independent of the state of the weather conditions. That is, these criteria do not vary with the size of the sea or waves or with deterioration in the state of the sea or weather, although the severity of the resulting rolling does.

The ATSB analysis showed that a significant alteration in a ship’s course and / or speed would have been required to change the conditions such that the ship was not susceptible to parametric rolling.

Figure 10: ATSB analysis map of dangerous rolling conditions for APL England based upon the dangerous motion criteria tool calculations

Source: ATSB

APL England motion preceding the occurrence event

During the hours preceding the loss of containers, as APL England pushed into the heavy weather, the ship went through intermittent periods of increased rolling. These events involved increases in the roll amplitude for several rolls after which the motion abated and more comfortable conditions returned.

One such event occurred at about 0215 on the morning before the loss of containers. At that time the ship was steering 200° and had a speed of about 7 knots, with winds from the south-west at force 8 (gale force 34–40 knots), sea state 7 (high seas 6–9 m) and a 4 m swell. The ship was proceeding comfortably when the amplitude of rolling increased for several rolls before reducing.

The rolling was sufficient to wake many crewmembers. It also moved furniture and unsecured items, and made standing difficult. The master went to the bridge to assist, and a machinery alarm called the duty engineer to the engine room. The alarm cleared on acceptance, but the duty engineer remained in the engine room and stayed there until about 0800.

These roll events precipitated a number of course changes and hand steering to attempt to reduce the amount of rolling and pitching. Several bouts of rolling, albeit not as severe, were experienced between 0215 and 0610, however the magnitude of the rolling at 0610 exceeded that encountered at 0215.

Related occurrences

334-MO-2018-002 YM Efficiency, 1 June 2018

At about 0035 on 1 June 2018, YM Efficiency was steaming slowly into strong gale force winds and very rough seas off Newcastle, en route to Sydney, when it suddenly rolled heavily, causing container stacks to collapse and topple. As a result, 81 containers were lost overboard and a further 62 were damaged. The ship sustained structural damage to its lashing bridges, superstructure, and accommodation ladder. Substantial debris from the lost containers subsequently washed ashore on the New South Wales coast.

The ATSB investigation[29] determined that the forces generated during the sudden, heavy rolling placed excessive stresses on containers stowed aft of the ship’s accommodation. This resulted in the structural failure of containers and components of the lashing system, leading to the loss of containers overboard. Potential causes for the sudden rolling were investigated, but there was insufficient evidence to establish a definitive reason.

Further, the condition of the ship’s lashing equipment was considered not to have contributed to the loss of containers. However, the investigation found that the weights and distribution of containers in the affected bays were such that calculated forces exceeded those allowable as defined in the ship’s cargo securing manual.

APL England, 18 August 2016

At about 1500 Western Standard Time[30] on 18 August 2016, while transiting the Great Australian Bight, APL England lost 37 containers overboard in rough seas. At the time of the occurrence, the ship was on an easterly heading (095°) at a speed of 17.9 knots in south-westerly winds of force 7/8 (34–47 knots) with a 4–5 m south-westerly swell on 6 m seas.

The master reported that the ship was rolling easily/moderately to a beam and quarterly swell but at around 1445–1500 the vessel encountered a sudden heavy roll to port (about 25°) coinciding with the loss of containers.

While the ATSB did not investigate this occurrence, AMSA conducted an investigation and concluded that:

• the vessel had a high GM which may have contributed to generation of excessive dynamic forces leading to failure of container base sockets and collapse of the stow
• the topmost container tier in all rows of the collapsed bay was over the recommended weight although the stack weight in each row was not exceeded
• the master was well prepared for heavy weather and had complied with safety management system requirements on departure from Fremantle
• the weather experienced was as expected in the Great Australian Bight during the winter season
• the ship conditions (draft, loading, stability) were within criteria which may have led to parametric rolling.

The condition of fixed securing equipment on deck was not mentioned as a factor in this incident.   APL England was subsequently inspected by AMSA in early 2017 and then departed the Australian coast and did not return to Australia until the current incident.

Safety analysis

Introduction

On 24 May 2020, APL England was making way down the east coast of New South Wales, with a cargo of containers, bound for Melbourne, Victoria. Early that morning, the ship underwent a series of heavy rolls in adverse weather, leading to failure of the container securing arrangements and the loss of 50 containers overboard.

Evidence indicated that the rolling, and resulting forces, exceeded the design limits for the securing system. However, APL England’s container securing arrangements on deck were in a poor state of repair and at risk of failing in a seaway below those limits.

The evidence also showed that the degree of rolling exceeded the design dynamic operating limits for the main engine and machinery. Consequently, the main engine lubricating oil pump momentarily lost suction causing the system pressure to fall below the low-low pressure main engine shutdown setting. The main engine shutdown and propulsion was temporarily lost.

Heavy weather preparations

As early as 21 May, APL England received Bureau of Meteorology (BoM) reports of high seas gale and storm force wind warnings, issued through the enhanced group call automated communications system. At about the same time, the master received similar information regarding a low pressure system and high seas developing along the south-east coast of Australia, from supporting company and commercial weather services. The warnings continued over the following days.

In response, the master and crew undertook the following heavy weather preparations:

• container lashings were checked during the afternoon of 23 May
• the master spent increased time on the bridge with the navigating officers
• the master directed course changes and the use of hand steering to reduce the degree and effects of rolling and pitching.

However, the required adverse weather procedures and checklist were not followed and the dangerous motion criteria tool was not used.

The investigation was unable to state with certainty that compliance with the heavy weather procedures would have prevented this incident. However, not following procedures meant that opportunities to have been better prepared for the conditions encountered were missed.

Had procedures been followed, the master would have informed the fleet navigation support centre (FNSC) of local observations, navigation changes and ship conditions. The FNSC would then have been in a position to provide explicit, targeted, advice and support for avoidance of the heavy weather.

Furthermore, had the dangerous motions criteria tool been used, it would have indicated that the ship was in conditions conducive to parametric rolling and that greater changes to the ship’s heading and / or speed were required to avoid the dangerous conditions.

In addition, if the engineering department had been notified of the situation, and completed the engine adverse weather procedure, the volume of oil in main engine and generator engine sumps would have been checked and, if necessary, increased. This would have reduced the likelihood that the main engine lubricating oil pump would lose suction, triggering a shutdown.

Finally, completing the adverse weather checklist would have ensured that all crewmembers were prepared for the conditions, followed the procedures, and used the tools. The checklist would also have prompted navigation checks and alterations which would have reduced the likelihood of the ship encountering rolling events to the extremes it did. It would also have reminded crewmembers of the need for other machinery preparations such as running an additional steering motor.

Given the condition of the deck, not completing adverse weather preparations in accordance with the procedure, exposed the ship and crew to increased risk.

Vessel condition and maintenance

A well designed and effectively implemented maintenance management system not only helps a shipping company to meet the safety and pollution-prevention objectives, it is also an investment in the protection of a valuable asset.

Built in 2001, by 2020 APL England’s container securing arrangements on deck were in a poor state of repair and the strength of many securing fixtures, including in bays from which containers were lost, was severely compromised. For example, some of the lashing plates were reduced to less than 5 mm effective cross-sectional thickness from the original 25 mm plate (Figure 7 and Figure 8). The ATSB concluded that, in the seas encountered, the poor condition of these fittings contributed to the failure of many and the loss of containers overboard.

As the ship reportedly rolled beyond its design limit, the ATSB considered the possibility that the loss of containers was entirely due to forces associated with excessive rolling. However, as a factor of safety is applied to the securing fixtures, ultimate failure of these components should not occur close to the design limit if they are well maintained. On this occasion many of the fixtures securing the lost containers had been significantly reduced by corrosion, it was therefore considered likely that their poor condition also contributed to the incident.

It is also important to note that, in the sequence of events, it was not necessary for every single instance of lashing device failure to have been the result of corrosion. Any one failure of a lashing or, a combination of such failures could have imparted forces on adequately secured containers sufficient to dislodge them.

The severely corroded condition would have taken several years of poor maintenance to develop.

The investigation was unable to determine how the ship had come to be in this condition. Given the multiple inspection and maintenance arrangements in place, it was evident that APL England was not maintained to the standards expected by the industry and customers. Additionally, the ship had not received the scrutiny from shore management and agencies that a ship of its age or condition warranted. This presented an increased risk to the continued safe operation of the vessel and security of the cargo carried.

However, the evidence did not show that the condition of APL England was indicative of a wider problem with container ship condition. Container loss incident investigations and regulator inspection campaigns before and after this incident did not highlight poor condition of fixed securing devices as an issue.

Loading of high cube containers into bay 62

For APL England’s voyage to Australia, bay 62 was loaded with 7 tiers of high cube (9 ft 6 in) containers. On the day of the incident, all containers in bay 62 above tier 4 (42 in total) were dislodged, of which 16 containers were lost overboard.

APL England’s cargo securing manual (CSM) only allowed 40 ft containers of standard height (8 ft 6 in) to be loaded into bay 62. Stowage in accordance with the CSM would have ensured that the lower 4 tiers of containers were securely held within bay 62’s cell guide structure. It would also have ensured that about 1.5 m of the tier 5 containers were held within the cell guides, that is, over half of the tier 5 containers’ vertical extent would have been secured within the cell guides. The CSM’s lashing arrangements then called for the bottom of tier 6 to be secured to the top of tier 5 with twist locks and tier 7 to tier 6 similarly.[31] In addition, tiers 6 and 7 were to be secured by lashing rods and turnbuckles to lashing plates.

However, because the containers loaded in bay 62 were high cube (9 ft 6 in), loaded in contravention to the CSM and not detectable by the cargo computer software in use at time, the top of tier 4 was 1.2 m (4 ft) higher than if it the bay been loaded with standard height containers. Consequently, only about 0.3 m of the tier 5 containers were held within the tapered (fore-aft) lead-in section of the guides, which were themselves heavily corroded (Figure 5 and Figure 11). This left tier 5 containers with most of the container’s height (about 2.3 m) protruding above the cell guide, resulting in them being virtually unsecured. The high cube containers in tiers 6 and 7 were then secured to tier 5 in the pattern described in the CSM (albeit intended for standard height containers). However, this meant that tier 6 and tier 7 containers were in turn secured by twistlocks to the virtually unsecured tier 5 containers and by lashing bars and turnbuckles attached to heavily corroded lashing plates. The combined effect was that the securing of the containers in tiers 5, 6 and 7 was inadequate.

Further, while containers in bay 62 were lashed in the pattern described in CSM, tiers 5 to 7 were higher than allowed for in the manual by virtue of being high cube containers. Consequently, lashing bar extension pieces were used to get the bars to reach the tops of the tier 6 and tier 7 containers. However, the extension pieces were not listed in the CSM, not part of the ship’s lashing arrangements and therefore not approved for use on board APL England.

Figure 11: Bay 62 stack comparison between standard height and high cube containers

Source: ATSB

Cargo not stowed as per CSM

In addition to the factors discussed above, there were instances across the ship where container weights exceeded the maximum permissible weights allowed for in the CSM for that location. This included containers which were lost overboard.

In this incident, the weight discrepancies were not excessive (maximum being a 5.2 t container stowed in a location approved for 2.5 t) and the cargo computer calculated forces in these locations remained within limits. However, given the condition of the securing devices, any exceedance of the CSM recommended weight increased the risk of containers being lost.

Findings

From the evidence available, the following findings are made with respect to the loss of containers overboard involving APL England, 46 NM south-east of Sydney, NSW, on 24 May 2020.

Dangerous motions criteria tool

The CMA CGM bridge manual procedure ‘Navigation in adverse weather’ required that ‘The Master or OOW shall assess the weather condition, at least, once a watch by using the…Dangerous Motion Criteria’. This requirement was included as an item in the ‘Navigation in adverse weather checklist’. Output from the tool, including any action to take, was indicated in red and green boxes (Figure 12).

Figure 12: Dangerous motions criteria tool

Source: APL, annotated by ATSB

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     TEU—twenty-foot equivalent unit—a standard shipping container. The nominal size of a container ship in TEU refers to the number of standard containers it can carry.

Safety summary

What happened

On Saturday 9 May 2020, NSW TrainLink passenger service 283D, an 8-car H OSCar set, travelling from Newcastle to Sydney, encountered a rail worker on the Up Main track at approximately 130.500 km. The worker saw and heard the approaching train and removed themselves from the track and out of the danger zone.

The train stopped past the location where the worker was situated, and the driver spoke with the worker to understand what had happened. The driver learned that the worker was an outer handsignaller (OHS) for a Track Work Authority (TWA) worksite at Dora Creek bridge at 127.100 km.

The OHS had been instructed by the protection officer (PO) for the worksite to remove the railway track signals^[1] (RTS) being used for protection for the TWA. This instruction was made in the knowledge there was a train approaching the OHS location, but no warning or other information was relayed to the worker in relation to the proximity of the train.

What the ATSB found

An unapproved practice occurred during the application of the approved method of protection of TWA. This practice involved the person managing the safeworking, the PO, instructing workers to remove the RTS used to protect the worksite while trains were closely approaching. This was for the purpose of improving train operations. This practice put the track worker involved at risk as there was no defined process or method for protecting this worker. This practice was not part of the recognised methodology of using a TWA as published by the Rail Infrastructure Manager, Sydney Trains.

What has been done as a result

Sydney Trains acknowledged an unapproved practice occurred during the TWA whereby workers were directed to remove RTS while the train was closely approaching its location. Sydney Trains have included this issue in their change request process for Network Rules. The amendment will reinforce the existing requirement in step 12 of NPR 702 as it relates to a TWA using an inner and outer handsignaller protection, in that both the inner and outer protection must be replaced immediately after the passage of each rail traffic movement.

Safety message

Network Rules and Procedures for safeworking on railways have been developed to give direction and instruction to workers in how to safely manage work on track. When practices develop that deviate from the established procedures, care needs to be exercised to ensure these practices do not introduce unintended risk. Rail safeworking practices should only be implemented as approved by the Rail Infrastructure Manager.

__________

1. Railway track signal: A device attached to a rail that explodes on impact, used to attract attention of drivers and track vehicle operators.

The occurrence

Overview

Sydney Trains Major Works Branch commissioned John Holland Group (JHG) to conduct repairs and maintenance to the Dora Creek rail bridge on the main north rail line between Sydney and Newcastle (Figure 1). JHG used a PO from within their own workforce to supervise the safeworking for the job. The method of protection chosen by the JHG PO was a TWA.

As the OHS approached the RTS to remove it from the rail line, they heard the sound of the train whistle of 283D and moved off the Up Main line to the safety of the Up Cess area. The train ran over the RTS and the driver applied the emergency brakes. The train came to a stand around
60 m past the OHS.

Figure 1: Location Map

Source: Geoscience Australia, annotated by the ATSB

Preparation activities for the work

JHG and Sydney Trains Major Works Branch engineers and workers collaborated about the preparatory activity for the bridge works at Dora Creek. This involved submission of various plans for engineering and safeworking activity.

The JHG PO was provided with a scope of information on Sunday 3 May 2020 about the upcoming work and was tasked with planning the worksite protection arrangements. The proposed worksite protection plan (WPP) for the work on the bridge was submitted to both a JHG safety advisor and Sydney Trains for review.

The plan included use of a TWA to protect work on the Up Main line, and the use of Lookout Working to protect work on the adjacent Down Main line^[2] . This plan was approved by Sydney Trains Major Works Branch for use.

The work before the incident

The planned work for Dora Creek Bridge was due to start at 0700^[3] on Saturday 9 May 2020. The JHG PO arrived on site at 0530 and commenced a review of the safeworking arrangements. The handsignallers for the TWA arrived on site at 0620 and were briefed by the PO on the safeworking arrangements, including the instruction that the preferred approach would be for the handsignallers to remove the RTS as trains approached. No one in the work group questioned or challenged this proposed method of working.

The handsignallers made their way to their designated locations and placed the protection in the form of RTS when requested by the PO. The TWA was authorised at 0650 and work commenced on the bridge. As per the approved safeworking arrangements, there was also Lookout Working in place for the adjacent Down Main line.

At 0945, a Sydney Trains Major Works Branch employee attended the site and asked for work to be stopped. The reason given was Sydney Trains Major Works Branch do not permit Lookout Working on their worksites unless specific approval is provided prior to the work commencing. The work was stopped, and the PO supervising the Lookout Working attempted to obtain an Absolute Signal Block (ASB) for the Down Main. The ASB could not be established due to the lack of a second person in the signal box at Wyong to conduct a peer review of the proposed working.

Given the unavailability of ASB, the next option chosen was for a Track Occupancy Authority (TOA) to be used, and a TOA was granted at 1130 for the Down Main, while the TWA continued to be used on the Up Main.

The TOA on the Down Main was fulfilled at 1209, while the TWA remained on the Up Main. The PO protecting the Down Main arranged for TWA protection to be provided for the Down Main, with inner and outer handsignallers only, that is, without the use of fixed signals. The work continued in this fashion for the remainder of the afternoon.

The incident

At around 1525, the OHS for the TWA on the Up Main was asked by the PO, via radio, to remove the RTS to allow the next train to run unimpeded through the worksite. At the time of this request, NSW TrainLink service 283D, the 1453 Newcastle to Sydney passenger service, was heading towards the location where the OHS was stationed.

The OHS accessed the Up Main track adjacent to the location of the RTS closest to the worksite at approximately 130.381 km, removed the RTS and proceeded to walk along the Up Main line towards the second RTS located 20 m away in the down direction. The OHS was at this point walking towards the approaching train 283D. As the OHS approached the second RTS, they heard the sound of the train whistle of 283D and immediately moved off the Up Main line to the safety of the Up Cess area. The train ran over the remaining RTS and the driver applied the emergency brakes and the train came to a stand around 60 m past the OHS.

The driver and the OHS briefly spoke to each other to understand what had occurred, and the driver reported the incident to the Network Control Officer at Broadmeadow signal box, who then reported the matter to the Rail Operations Centre (ROC). The Network Incident Manager in the ROC made enquiries and determined that work should cease and the incident be investigated. A Sydney Trains Incident Rail Commander was despatched to the site to commence investigations and drug and alcohol testing was organised.

The TWA on the Up Main was fulfilled at 1556 and all personnel requested to return to the site office for initial interview and commencement of the investigation.

__________

2. Trains travelling on the Up line are travelling towards Sydney Central Station; trains travelling on the Down line are travelling away.
3. All times are in Australian Eastern Standard Time (UTS + 10:00) and in 24-hour format.

Context

The location, signalling system and infrastructure

Dora Creek is located on the main northern rail line from Sydney to Newcastle, with the Dora Creek bridge located at 126.900 to 127.100 km and Dora Creek station platforms located at 127.140 km.

The rail line consists of an Up and Down Main line, with the signalling system being double line unidirectional rail vehicle detection. Dora Creek station is located in the automatic signalling section between Morisset and Eraring.

The signalling system is overseen by the Network Control Officer at Broadmeadow signalbox. Morisset has a local signalbox on the station that can be switched in and out as required. Eraring Power Station siding is controlled by the NCO at Broadmeadow signalbox, and it also has a local control panel that may be switched in and out as required.

All the main line rail assets and infrastructure are managed by Sydney Trains, who is the Rail Infrastructure Manager (RIM) for this part of the NSW rail network. The area has a number of private sidings that branch off the main line, including Vales Point Colliery and the Eraring Power Station.

The train involved

Train 283D was an 8-car H (OSCar) outer suburban and intercity set, performing the route from Newcastle Interchange to Sydney Terminal. The timetable for the train was a 1453 departure, due for arrival in Sydney at 1729.

The train was operated by NSW TrainLink, the NSW Government transport agency for above rail operation for intercity and regional passenger trains. The train was crewed by a driver and guard. Sydney Trains is the maintainer of the rolling stock.

The train was being driven as per operational requirements, with the headlights and fog lights switched on. The train was within the required speed limits for the section of track, according to the data logger report provided by Sydney Trains Engineering and System Integrity Branch. The speed of the train when it encountered the OHS was recorded as travelling at 94 km/h; the maximum permitted track speed was 95 km/h.

No defects or abnormal operation of the train was noted by Sydney Trains, and the train responded to the inputs of the driver within the normal operational parameters and requirements. The operation of the train was not considered to be a factor in relation to this incident.

The people involved

The Protection Officer

The Protection Officer (PO) was employed by JHG.

The PO was rostered on for weekend track work on the Sydney Harbour Bridge on Sunday 3 May 1400 – 2400 hours, then the afternoon shift at Dora Creek from 1400 – 0200 each night, Monday to Thursday. Fatigue was not considered to be a factor in this incident.

The PO was qualified as a Protection Officer Level 4, and also as a Handsignaller level 2. The PO had 11 years of rail industry experience and held the PO4 qualification since 2013 and had been recertified in August 2018 by Transport for NSW. The PO was also qualified as a Handsignaller Level 2 and held that certification since May 2013, and was recertified by TfNSW in August 2018.

The Outer Hand signaller

The OHS was employed by Swetha International as a casual rail safety worker.

The OHS worked in a job outside the rail industry from Monday to Friday 1300 – 1800 on each of the two previous weeks prior to the incident. The shift at Dora Creek on Saturday 9 May was the only rail work performed in the previous two weeks. Fatigue was not considered to be a factor in this incident.

The OHS was qualified as a Handsignaller Class 2, and was certified in August 2018. The OHS had previously been employed in the rail industry as an infrastructure worker.

Network Rules and Procedures

Sydney Trains administer the RailSafe Network Rules and Procedures for work on the Sydney Trains network. These rules and procedures are published on the RailSafe website and are publicly available.

There are a range of Network Rules and Procedures that may apply to any particular worksite, The following Network Rules and Procedures were applicable in this incident.

NWT 300 Planning work in the rail corridor

This rule prescribes the rules for planning work within the rail corridor and assessing the work for safety. In general;

Work planned for the Rail Corridor must be assessed for safety and its potential to intrude on the Danger Zone.
Work in the Danger Zone must:
- be carried out in accordance with the Network Rules and Network Procedures
- not begin until the required safety measures are in place.
The level of safety must not be reduced:
- to allow rail traffic movements, or
- because of a lack of Qualified Workers.

The work at Dora Creek was required to be planned in accordance with this rule. As required by this rule, work in the danger zone may be carried out by using one of the permitted forms of work on track authorities. In this case, the work on track authority implemented was NWT 306 Track Work Authority.

NWT 306 Track Work Authority

This rule prescribes the rules for authorising, issuing and using a Track Work Authority (TWA). In general:

A TWA:
- authorises occupancy of a defined portion of track between rail traffic movements
- does not give exclusive occupancy of the defined portion of track
- is requested by and issued to the Protection Officer
- may include multiple worksites
- allows work that breaks or obstructs the track or alters track geometry or structure.
Drivers and Track Vehicle Operators must follow instructions given by Handsignallers and the Protection Officer.

The TWA entailed use of outer and inner handsignallers only, not using signals, in order to manage the approach of rail traffic to and through the worksite.

The role of handsignallers in TWA

The role of handsignallers during a TWA is to provide direction to drivers and track vehicle operators about the approach to, and transit through, the worksite. The PO for the work provides instructions to the handsignallers about when and how rail traffic can proceed, or not, through the worksite. The handsignallers then relay that information to rail traffic through a combination of handsignals, placement or removal of RTS, and other instructions.

TWA is a form of protection that has a number of possible combinations, depending on the available signalling infrastructure, the location of the worksite, what conditions exist and other factors.

In the case of the TWA in use at Dora Creek on this day, the PO had chosen to use the handsignallers only method, not placed at signals. The version of TWA contained specific instructions on how the OHS interacts with rail traffic.

NPR 702 Using a Track Work Authority

In this situation NPR 702, page 11, contained the following instructions:

‘Protecting Worksites using Handsignallers only

Protection Officer

1. Place an outer handsignaller and two railway track signals 2500 m from where the inner handsignaller will be positioned in the direction of approaching rail traffic

2.Tell the outer handsignaller to display a CAUTION handsignal to approaching rail traffic.'

NPR 702, page 18, also contained a further instruction about what an outer handsignaller must do when not at a signal.

‘Managing rail traffic transits through worksites

Protection Officer

10. If it is safe for rail traffic to pass the outer Handsignaller not at a signal, tell the Handsignaller to take the following actions:

NGE 202 Handsignals

Network Rule NGE 202 Handsignals described a proceed at caution handsignal as (during daylight) a green flag waved slowly from side to side or (during darkness) a green light waved slowly from side to side or an outstretched arm waved slowly.

This was the only described and approved action for an OHS, not at a signal, working under a TWA in relation to rail traffic transit through the worksite.

The RailSafe Network Rules and Procedures did not provide permission or instructions for OHS to remove RTS during a TWA while a train is approaching. It was not an approved activity under a TWA.

NWT 308 Absolute Signal Blocking

Absolute Signal Blocking is used to exclude rail traffic from a defined portion of track for a specified period. Its effectiveness depends on the Protection Officer correctly nominating the worksite location and the Signaller correctly identifying all protecting signals and points to exclude rail traffic from the nominated worksite location.

Peer review of Absolute Signal Blocking

The peer review process came into effect in February 2020 and was implemented by Special Instruction No. 02/20 to signallers. The peer review was conducted in larger signalling locations such as the Rail Operations Centre and at Granville, Blacktown, Broadmeadow and Wollongong signal boxes. Smaller signalboxes were not permitted to issue ASB unless there is another person, qualified as a signaller, present to conduct the peer review.

This process effectively ruled out the use of ASB for a large part of the Sydney Trains network. This restriction was brought about in response to a series of incidents involving ASB in the Sydney Trains network.

The peer review process did not appear in any training or competence management material provided to POs. The Special Instruction was published on the Sydney Trains Intranet and was not available to workers not directly employed by Sydney Trains.

NGE 200 Walking in the Danger Zone

The two key requirements from NGE 200 that relate to this investigation are:

‘Walking in the Danger Zone is:

• Doing no other work than placing or removing protection.

Placing or removing protection

If placing or removing protection, workers must stay alert for approaching rail traffic.’

A limited number of activities are permitted under NGE 200, and when placing or removing protection, workers are responsible for their own safety. Therefore the circumstances when an OHS is required to access the Danger Zone must be managed carefully.

NPR 709 Using Railway Track Signals

This procedure described the specific requirements necessary when placing or removing protection in the form of RTS. An OHS in this case needed to place two RTS on the right hand rail in the direction of travel 20 m apart.

The requirement to use the right hand rail places the RTS on the opposite side to where the driving station is in the cab on most rail traffic, where the driver is located on the left hand side.

This requirement was in place for many years, and was designed to reduce the noise impact of the explosion of the RTS on the driver.

The effect this requirement has on the worker placing the protection is that the worker is most often further away from a safe place, as the right hand rail in the direction of travel in a double track unidirectional environment is in the middle of the corridor. A worker bending down to place or remove RTS will be likely intruding into the Danger Zone of the adjacent track as well as the track on which the protection is required.

NWT 310 Lookout Working

This rule prescribes the rules for working in the Danger Zone without a work on track authority using Lookouts or an approved Automatic Track Warning System (ATWS) as the safety measure.

If the safety assessment shows that it is safe then some kinds of work may be done in the Danger Zone without a work on track authority.

NGE 204 Network Communication

This rule prescribes the rules for spoken and written communication in the Network. In principle;

Communication in the Network must be:
            - clear, brief and unambiguous
            - relevant to the task at hand
            - agreed to its meaning before being acted upon.
Safeworking communication must use:
            - the 24-hour clock to give the time of day
            - the phonetic alphabet and spoken numbers to identify:
                        - train numbers and track vehicle numbers
                        - signal numbers
Communication equipment used for rail traffic operation or work on track must be tested and checked for its intended operation.

NPR 721 Spoken and written communication

This procedure provides specifics on how the rail safety worker can be effective with their written, radio and telephone communications in the Network. How to pronounce spoken numbers, to use the phonetic alphabet to spell words, standard terms, open channel and emergency radio communication protocols and written communication abbreviations.

Worksite Protection Plan (WPP) review processes

The JHG PO prepared a draft WPP for the work on Dora Creek Bridge that was to occur on Saturday 9 May 2020. Planning work was a requirement of Sydney Trains that was mandated in the Network Rule NWT 300 Planning Work in the Rail Corridor. The PO records those details by completing a WPP which was a requirement contained in the form NRF 015 Worksite Protection Plan.

The WPP identified that the worksite on the Up Main would be protected by a TWA and adjacent line protection for the Down Main would be by the use of a lookout under Lookout Working.

Both forms of protection were suitable for the task and were available to be used based on the required considerations for each. Issues such as sighting distance on the Down Main were appropriate for Lookout Working, and the nature of the bridge work on the Up Main required that a level of protection above ASB was required. A TWA was therefore a suitable method of protection.

JHG and Sydney Trains both required that the PO submit the plan for review through various channels. There were four separate processes that needed to be undertaken before the work could commence using the proposed method of protection; none of these processes detected deficiencies with the plan.

Both organisations approved the plan and it was then put into practice in terms of organising labour and other supporting activities, ready to be implemented on the day.

The John Holland review process

The JHG review process involved an assessment of the WPP by an internal safety advisor. According to JHG, this person was part of their safety team and was in place to provide support and advice to project teams and workers. The review process did not extend to testing or validating the safety assessment made by the PO in relation to the suitability of the sites chosen for the handsignallers.

JHG were not aware of the Sydney Trains Major Works Branch pre-approval process for the use of Lookout Working.

The Sydney Trains Access Pre-Advice System process

The Sydney Trains Access Pre-Advice System (APS) review process is a planning tool rather than an endorsement or approval system. Sydney Trains implemented this new system on 1 May 2020.

APS was advertised as a resource planning system not as a safety system. This system did not endorse or approve the method of protection, it recorded and registered the presence of the workgroup.

If a PO wanted to use a TWA on the Sydney Trains Network, then the PO must submit a WPP no less than 4 days prior to the work commencing.

The Sydney Trains Major Works Branch review process

There was an additional review process that Sydney Trains Major Works Branch required for work that was undertaken either directly by its own staff or indirectly by contractors, as was the case for the works on Dora Creek Bridge.

This review process required a special pre-approval for the use of Lookout Working and was implemented in August 2018. It was a branch only process, and was not documented or recognised outside of the Major Works Branch of Sydney Trains.

The WPP was submitted by the PO as required for registration in the Sydney Trains APS. This included reference to the use of a lookout for the Down Main, however no one in Sydney Trains had apparently linked the Major Works Branch pre-approval process to this WPP, so it was approved for use.

The detection of the unapproved use of Lookout Working was made when a Sydney Trains Major Work Branch manager attended the site around 0945 and requested the work be stopped while another form of protection be implemented for the Down Main.

This incurred delays to the work and resulted in additional workload for the PO, who now had to organise a new form of protection for the Down Main line, whilst still supervising the TWA for the Up Main line.

The Sydney Trains Corridor Safety Centre

There was another review process employed by Sydney Trains to review and approve work on the network. The Corridor Safety Centre (CSC) was established to help identify any deficiencies with the WPP of POs. The PO for the Dora Creek work called the CSC prior to starting work and the operator at the CSC identified a deficiency with the WPP.

The CSC operator asks the PO a series of pre-determined questions, and there are a range of possible combinations of how the conversation will develop, depending on the answers given by the PO. The question sets are configured to try and capture essential information from the PO in order to determine if the safeworking arrangements are suitable.

While it is not feasible to address each and every factor or consideration in these question sets, there are some basic requirements that could be considered. In the case of the work at Dora Creek, the operator detected an error in the way the work location was classified.

The location of work was listed as between Dora Creek platform 1 and 78.8 signal. However the Network Rule NWT306 required the PO to identify the work as being between:

• two signals, or
• a signal and a set of points, or
• a signal and the end of a terminal line, or
• a set of points and the end of a terminal line.

The error was minor in nature but identified by the operator and noted to the PO, who did not realise the requirement. The CSC operator quoted the requirements of the rule to the PO, who then corrected this detail and noted the location of the work was between signals 88.0 and 78.8.

Correction of the work location was made and the worksite was approved and an approval number was issued.

The PO did not know who the Network Control Officer was for the work location in the Up direction. The PO asked the operator at the CSC who was the responsible signaller for the worksite in order to obtain the TWA. The CSC incorrectly identified Wyong as the controlling signalbox and the PO asked for and received the phone number for Wyong signalbox.

Safety analysis

Removing railway track signals during a TWA

Overview

In relation to TWA, the practices described in NWT 306 and NPR 702 were designed to deliver the safest possible outcomes for workers performing work on or around the track, and for train crew and passengers. In particular, the role of the OHS includes some inherent risks that require careful management given they often work alone when performing their duties.

The two main tasks performed by an OHS are:

• Placing and replacing RTS
• Displaying a caution handsignal to the drivers of approaching rail traffic.

Displaying the caution handsignal is performed from a safe place outside of the Danger Zone, most of time in the cess next to the track associated with the TWA. TWA as a method of protection was most widely used in the Sydney Trains Network in the dual track outer suburban and inter-city areas, as multiple track locations such as found in inner suburban areas provide limited safe places for handsignallers to operate.

The placement and replacement of RTS is therefore the task that involves the most risk for the OHS, as that task entails entering the Danger Zone alone, and bending down to affix the RTS to the head of the rail.

The permission to place and replace RTS was not in the rules and procedures for TWA. The permission for such activity is in rule NGE 200 Walking in the Danger Zone.

Placing or removing protection

The requirements for an OHS, not at a signal, to place or remove protection is not defined in the RailSafe Network Rules and Procedures. The established practice for an OHS to replace RTS after a train has run over them is to do so as soon as practicable after the train has passed.

The training material provided to handsignallers instructs them to:

• ‘Advise the inner handsignaller when the train or track vehicle has passed you.
• Replace the Railway Track Signals.’

The rationale behind this is to permit the OHS access to the Danger Zone relatively soon after the train has passed. The proximity of the previous train prevents another train from closely approaching at track speed, because of the reduced proceed indications of the signalling system that will be displayed to any following rail traffic. This is therefore the safest time for a handsignaller, operating on their own, to be in the Danger Zone and replacing RTS protection.

Removing protection while a train is heading towards the OHS at track speed is not stated in the TWA Rule and Procedure but this practice occurred during this TWA, numerous times in the incident under investigation.

Placing and removing Railway Track Signals by the outer handsignaller

The practice of placing and removing RTS is approved under NGE 200 Walking in the Danger Zone which covers a range of work on track rules where placement or removal of RTS protection is required. Placing and removing protection are the only types of work approved under this rule. It also requires workers to stay alert for the approach of rail traffic under their own watchfulness.

There are no specified warning times applied to this type of work which is in contrast to Network Rule NWT 310 Lookout Working, where there is a defined formula for see time, move time and safe time to allow workers to move to a safe place and to be there for 10 seconds prior to the arrival of a train.

In a TWA, the approved practice for the OHS, not at a signal, is:

• the OHS gives the driver a caution handsignal (which means the train slows down on the journey to the inner handsignaller)
• the OHS replaces the RTS after the train has passed their location and exploded them.

This practice means that the worker is protected because a train has just passed and another train cannot enter the area as the signalling system holds the preceding signals to stop until the previous train has passed beyond the signalling system safety overlap. This is a deliberate and considered practice and is what the OHS is required to do during a TWA using handsignallers only. However, it was not applied in this instance.

The actions of the JHG PO in directing the OHS to retrieve the RTS before the arrival of train, with no indication of the train’s whereabouts, placed that worker in direct risk of being struck. It was also not an approved action under the Network Rules and Procedures for TWA.

The JHG PO indicated that it was common to adopt this practice during use of a TWA and had been done so many times before.

Sydney Trains have acknowledged that this was not an approved practice under the rules and procedures for TWA but that its use was known by the Safety Division of the organisation at the time of the incident.

Removal of railway track signal protection during a Track Work Authority

The JHG PO said that it was his clear intention to ask the handsignallers on the Up Main to remove their RTS to allow rail traffic to pass through the worksite unimpeded. This intention was conveyed to both handsignallers at their pre-work briefing at the site shed at Dora Creek station prior to them leaving for their designated locations.

For the OHS, this meant they were being asked to enter the Danger Zone, while a train was on its way towards them at track speed, in order to retrieve the RTS.

Evidence provided from the OHS log indicates that of the 14 trains that travelled through the section since the TWA was granted at 0650 until the near hit incident at 1526, 11 of those trains were allowed to ‘run free’, that is, the protection was removed prior to the arrival of the train.

This practice places the OHS in danger, as the worker is being asked to enter the Danger Zone alone with no other specified form or method of protection to remove the RTS while a train is moving towards them at track speed.

The OHS said that as he reported the near hit to the PO, he heard the PO say over the radio he should have informed the OHS that there was a train closely approaching”. However this could not be verified as these radio transmissions were not recorded.

Evidence provided by Sydney Trains Network Rules Unit for this investigation indicated that the practice of removing the protection while the TWA was in force, was not an approved activity under the RailSafe Network Rules and Procedures. The practice of removing the protection effectively fulfils the TWA each and every time it occurs. If protection is removed to allow trains to run unimpeded, then effectively there is no TWA in place.

Sydney Trains Network Rules Unit indicate they were aware of the non-conforming practice at the time and have since provided instruction to the portion of its workforce where this type of protection is used more commonly that it is not an approved practice. Sydney Trains also undertook to revise the Network Rules and Procedures to make it clear that this practice is not acceptable.

Making a safety assessment

The common rule for all work on track is NWT 300 Planning Work in the Rail Corridor. That rule says, among other things, that work in the rail corridor must be planned and a safety assessment made by the PO. The manner of recording information about the safety assessment and the way the assessment is conducted is not described in the rules.

One of the factors involved in the use of a TWA is the placement of the handsignallers. NWT 300 states in part:

‘When making a safety assessment, Protection Officers must consider, amongst other factors, if:

• Easily-reached safe places will be available for workers…’

The PO for this work made their safety assessment from the site office next to Dora Creek station. No attempt was made to visit the site to understand if there was an easily reached safe place for the OHS or if the location provided suitable visibility for the OHS to see, and be seen by, approaching rail traffic

Evidence provided for this investigation revealed that the PO for this work was on site from Monday 4 May to Thursday 7 May 2020, working afternoon shift 1600 – 0200, and that there were opportunities to visit the site to establish that it was suitable for the task.

There was no overt instruction provided by JHG to the PO for this purpose. During the review by the JHG internal safeworking advisor, there was no indication that the adequacy of the safety assessment was checked or validated.

The location of the outer handsignaller

While NWT 300 does not mandate that a site visit is required by a PO when undertaking the safety assessment, the PO was not able to confirm how he verified that the safety assessment for the site chosen for the OHS was suitable. NPR 702 is quite specific in terms of the placement of handsignallers when using handsignallers only. It states:

‘Protecting Worksites using handsignallers only

Protection Officer

1. Choose locations where handsignaller, Drivers and Track Vehicle Operators can see each other clearly…’

Evidence provided from the OHS was that at approximately 0900 he relocated himself approximately 50 - 100 m closer to the worksite, that is in a southerly direction, in order to establish better sighting distance with rail traffic on the Up Main. The reason for the relocation was a train standing at signal E1 on the Down Main line awaiting authority to proceed.

A train in this position on the Down Main obscures rail traffic approaching in the Up direction as the stationary train impedes visibility around the left hand curve. Figure 2 below shows the location where the OHS was stationed and the impact of a train standing at signal E1.

The location of the OHS was noted on the WPP as at 130.500 km, however the position the OHS adopted after relocation at 0900 was closer to 130.380 km.

The OHS decision to relocate was made without consultation or knowledge of the PO and placed the OHS slightly within the required 2500 m distance to the inner handsignaller, who was located at 128.000 km. This is a technical breach of NPR 702, however there is no evidence to suggest it had an adverse effect on the worksite protection.

Figure 2: View from the outer handsignaller’s original location

Source: John Holland

Communications between the Protection Officer and handsignallers

The OHS described some of the radio communications between the PO and the various handsignallers as confusing and ineffective. The OHS described having to clarify the arrangements with the inner handsignaller for the Up Main TWA in order to confirm who instructions were being given to at particular points in time.

The OHS reported that formal open channel radio protocols as described in the RailSafe Network Rules and Procedures NGE 204 and NPR 721 were not being used, and that the communication was casual and unclear. It was not possible to validate this assertion with certainty as these open channel radio transmissions were not recorded.

Competency of workers at CSC

The CSC question set did not test whether the placement of the handsignallers met the requirements of the Network Rules and Procedures in terms of visibility between the handsignaller and drivers of approaching rail traffic.

Operators at the Sydney Trains CSC are required to possess safeworking qualifications. The required qualification at a minimum is PO2. To implement a TWA as a method of protection requires a PO3 or above qualification. Of the 12 CSC operators, 9 were (as at July 2020) PO2 level only. The CSC operator who took the call from the PO at Dora Creek was a PO2 at the time of the incident.

The operators at the Sydney Trains CSC were, in some cases, providing advice and support to POs about methods of protection they could not implement given their current level of qualification (PO2).

Knowledge and awareness of the various review and approval processes

A common factor across Sydney Trains review processes that form part of the approval for worksite protection examined through this investigation, was that they did not appear in the training materials and courseware for PO training which raised questions as to how POs and contract POs in particular are made aware of review process requirements.

The courseware for Sydney Trains PO 4 training did not reference the APS system or the Major Works review process for the use of Lookout Working, nor the ASB peer review process. There was one reference to the CSC, and that was in relation to being able to seek support through a rail safety coach. There was no reference to requirements to submit WPP details for review by the CSC.

The applicable review processes for worksite protection approval, require POs to do a range of things in relation to the planning and delivery of their proposed worksite protection arrangements, but they were not routinely provided with any training or support material to make them aware of and competent to do these tasks.

The applicable review processes do exist in various forms outside of the Network Rules and Procedures, including in memos, newsletters, and internal Sydney Trains procedures. However, given they are outside of the Network Rules and Procedures then if changes are made to them, there is no assurance that changes would be notified to people that need to know and understand them, like a contract PO.

Changes to Sydney Trains Network Rules and Procedures are communicated to employees through defined and comprehensive change and communication processes which are distributed more broadly through a subscriber mailing list. However not all contractors are on this distribution list.

The rail industry, like many industries, relies upon an extended supply chain rather than purely in-house resources. As a result, many POs are contractors and do not have ready access to internal information resources like an employee would.

Changes to auxiliary processes that support worksite protection rules and procedures, like the ones made for review processes involving the CSC and APS in this incident, were not communicated to the JHG contract PO and as a result, there is little assurance that JHG or other contractors who need to know this information received it.

Without ready access to information and training about Sydney Trains review processes that sit out side of the Network Rules and Procedures, there is an increased risk of errors and mistakes occurring in the planning, preparation and delivery of worksite protection services. An integrated set of training materials and processes to communicate changes to contractors are essential to ensure all workers, employees and contractors alike, are aware of and competent to provide worksite protection services on the network.

Prohibitions in the Network Rules

The RailSafe Network Rules provided instruction about the required responses during the use of the various work on track rules. The rules are predicated on the basis of instructing people what they must do in order to deliver the desired safe outcome and are not based, for the most part, on informing people what they cannot or should not do, as it is not possible to identify each and every undesired practice for the application of the rule or procedure.

But, there are exceptions to this in some rules, for example in Lookout Working NWT 310, contains a specific prohibition on the use of radios and telephones.

‘Lookouts must:

• Not use radios or telephones to warn workers….’

This prohibition was included in the rule because it is a known practice that compromises the safe outcomes intended by the rules and there is a desired need to specifically tell people about the prohibition. Other rules are silent on prohibited or undesired practices and rely on the description of the approved practices to deliver the desired safe outcome.

Workload

The interruptions to the work because of the cancellation of Lookout Working and the need to implement a new type of protection on the Down Main, incurred delays to the work and caused an increase in the workload for the PO. At interview, the PO acknowledged the workload increase, but did not report that it was beyond his capability to manage and did not believe it contributed to the incident involving the OHS later in the afternoon. The investigation determined that it was unlikely that the workload level of the PO contributed to the incident.

Findings

From the evidence available, the following findings are made with respect to the safeworking occurrence involving NSW Trains 283D and an OHS near Dora Creek NSW, 9 May 2020.

Contributing factors

• There was an unapproved practice occurring during Track Work Authority of asking the Outer Handsignaller to remove Railway Track Signals from the track as a train was closely approaching in order to let it run free, which placed the Outer Handsignaller at risk of being struck by the train. (Safety issue)
• The Outer Handsignaller, under direction from the Protection Officer, removed the Track Work Authority Railway Track Signals while a train was heading towards their location.

Other findings

• Sydney Trains Protection Officer training and competence assessment did not address a number of important operational safety processes, such as the Corridor Safety Centre, making sure these workers get the information they need.
• The various processes used to register, review and approve the Worksite Protection Plan did not detect some basic deficiencies that impacted its effectiveness such as a site visit to determine safe place location.
• The operators at the Sydney Trains Corridor Safety Centre were, in some cases, providing advice and support to Protection Officers about methods of protection they were not certified to implement.
• NPR 709 requires placement of Railway Track Signals on the right hand rail in the direction of travel of rail traffic, often placing the worker in the Danger Zone of the adjacent line.
• The workload of the Protection Officer increased signifcantly during the day because of the cancellation of the pre-arranged Lookout Working by Sydney Trains Major Works and the Sydney Trains Absolute Signal Blocking Peer review process, meaning Absolute Signal Blocking was not available because of the lack of a peer review person.
• The Sydney Trains Absolute Signal Blocking peer review process effectively prevented use of this method in certain parts of the network unless an additional person was provided and present to conduct the review.

Safety issues and actions

Unapproved practice during TWA

Safety issue number: RO-2020-006-SI-01 
Safety issue description: There was an unapproved practice occurring during Track Work Authority of asking the Outer Handsignaller to remove Railway Track Signals from the track as a train was closely approaching in order to let it run free, which placed the Outer Handsignaller at risk of being struck by the train.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Sydney Trains recorded audio
• Sydney Trains data logger report
• Sydney Trains Incident Information Management System (IIMS) reports
• Sydney Trains RailSafe Network Rules and Procedures
• John Holland 5 Whys investigation report and statements
• Swetha International Investigation report and statements
• TfNSW training material for Protection Officers and Handsignallers
• Interview with the Protection Officer
• Interview with the Outer handsignaller.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Sydney Trains
• John Holland Pty Ltd
• NSW Trains
• Swetha International Pty Ltd
• Transport for NSW
• Office of the National Rail Safety Regulator

Submissions were received from all of these parties. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Table of abbreviations

Table of abbreviations

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

Mid-morning on 17 May 2020 an experimental amateur-built Osprey 2 amphibious aircraft, registered VH-WID (WID), took off from Maitland Airport, New South Wales, for a local private flight. The pilot was the sole occupant and was conducting the aircraft’s second test flight.

During the climb, passing 2,400 ft, the pilot was advised, via radio, of white smoke coming from the aircraft and noted that the engine was not running smoothly. In response, the pilot broadcast that they were returning to land on runway 23. However, during the descent they turned to join the reciprocal runway 05. As the aircraft was turned on to the base leg of the circuit the engine failed, and the pilot attempted to conduct a forced landing on to the closer runway 08. During the final stage of the glide approach, the aircraft was observed to abruptly roll, pitch down and collide with terrain.

What the ATSB found

The ATSB found that the use of a damaged engine oil cooler fitting, which was not compatible with the fitted oil hose, most likely resulted in the hose disconnecting from the oil cooler during the climb, and the loss of oil from the engine.

During the return to the airport, the airborne duration and engine power required to maintain height were both increased when the pilot decided to change runways. This resulted in the engine failing due to oil starvation as the aircraft was turning on to the base leg of the circuit. During the subsequent forced landing, control of the aircraft was lost due to an aerodynamic stall at a height too low for recovery.

It was also identified that neither the required, nor the majority of the recommended stage build inspections of the aircraft were conducted. This was not detected prior to the issuance of a certificate of airworthiness that permitted the aircraft to be flown. While these inspections would probably not have detected the damaged fitting, they may have identified that the oil supply hose was in poor condition. They would also have been an opportunity to identify and improve the overall build quality of the aircraft.

The ATSB also identified a number of other deficiencies relating to the inspection and flight testing of amateur‑built aircraft, including the risk assessment of the proposed test pilot.

What has been done as a result

As a result of this investigation, the Sport Aircraft Association of Australia (SAAA) amended the Authorised Person’s Manual of Procedures and submitted it to the Civil Aviation Safety Authority (CASA) for approval. The revisions to the manual:

• stated that if the authorised person considered that an aircraft was unsafe, they were not required to issue a certificate of airworthiness and could refer the matter to CASA
• clarified that the Risk Radar Aviation report must be endorsed in writing by both the technical counsellor (TC) and the builder
• required that the authorised person (AP) receive 3 technical counsellor reports
• required the AP to name the pilot who would be conducting the initial test flying of the aircraft in the limitations
• required that any changes made to the aircraft after the certificate of airworthiness was issued be notified to the AP
• clarified that a TC or AP cannot inspect their own aircraft.

The SAAA also updated their other manuals to reflect these changes.

In addition, the SAAA have written to CASA to request an urgent 1-day refresher training course for all authorised persons and annual refresher training courses be made available. They have also amended their procedures to mandate that 3 stage inspections, inclusive of the final inspection, are conducted by a technical advisor (or equivalent) on the aircraft during the build. The SAAA have also requested that CASA provide them with a summary of the audits conducted on authorised persons to ensure they are aware of issues which may arise.

Safety message

As stated in the ATSB publication, Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft, managing a partial engine failure is often a more complex scenario than a complete engine failure. The course of action chosen can be strongly influenced by the engine producing some power. Pilots are advised that as the engine could stop at any stage, the aircraft should be landed at the earliest opportunity and consideration should be given to forced landing options along the flight path.

This accident also highlights the importance of adhering to the design specifications and good engineering practices when building an amateur-built experimental aircraft. Attention should be given to the component manufacturer’s specifications, installation instructions and limitations to ensure the component, and consequently the aircraft, will perform as intended.

Consideration should also be given to having independent inspections during the build process. Independent inspections conducted during the early stages of the build, and prior to closing components such as the wings and fuselage, will assist in ensuring the builder has used accepted practices and reduce the likelihood of inadvertent construction errors.

Finally, while most amateur-built aircraft are built to a high standard consideration should be given to the use of a professionally‑trained test pilot for the initial test flying. Use of the Sport Aircraft Association of Australia’s risk assessment tool, and consultation with their Flight Safety Advisors, can significantly assist the test flying stage.

The occurrence

On 17 May 2020, at around 0800 Eastern Standard Time,^[1] a pilot arrived at Maitland Airport, New South Wales, to prepare for a private flight in an experimental amateur-built^[2] Osprey 2 amphibious^[3] aircraft, registered VH-WID (WID). The pilot was conducting their second test flight in the aircraft and was to be the sole occupant for the flight.

Immediately prior to the test flight, the pilot conducted a flight in a Piper Aircraft Inc. PA-28 Archer (PA-28) aircraft, reportedly to practice forced landings. This flight took about 35 minutes.

While the pilot was flying the PA-28, the owner/builder (builder) of WID conducted the aircraft’s pre-flight inspection and ran the engine on the ground for about 5 minutes. The builder then signed the maintenance release to confirm that the inspection had been completed.

It was reported that the pilot also conducted a pre-flight inspection, however this did not include checks of the fuel for contamination or the oil level in the engine. The pilot consulted the checklist to start the engine and spent around 15 minutes on the ground taxiing and conducting further checks, including a high-speed taxi.

At 1002, the aircraft departed from runway 23^[4] and turned left. During the subsequent climb, the pilot made a broadcast on the common traffic advisory frequency (CTAF),^[5] advising they^[6] were on climb to 3,000 ft to operate overhead the airport (Number 1 in Figure 1). At 1007, the pilot of a second aircraft made a radio transmission stating they were entering runway 05 (the reciprocal runway) for a departure to the west.

Shortly after, as WID passed approximately 2,400 ft above ground level (AGL), a witness on the ground contacted the pilot of WID, on the CTAF, to advise that white smoke could be seen ‘coming back from the aircraft’. The pilot responded that they had also detected ‘some rough running’ and consequently they were returning to join the crosswind leg of the circuit for runway 23. The pilot of the second aircraft taxied back to the airport apron to ensure WID had access to all runways, however, they did not broadcast this on the CTAF.

Figure 1: Accident flight track and key events

Source: Google Earth with OzRunways data, annotated by the ATSB

The pilot of WID commenced a descending left orbit to the north of the airport. However, instead of continuing the descent to land on the previously‑advised runway 23, they stopped the descent at about 1,000 ft AGL and conducted a turn in the opposite direction. They then turned to join the circuit for runway 05, advising on the CTAF they were joining downwind (Number 4 in Figure 1). The pilot subsequently increased the engine power and climbed to maintain between 1,100 and 1,200 ft AGL on a widening downwind leg.

As the aircraft turned base for runway 05, (about 5 minutes after the pilot was advised of smoke from the aircraft) the engine stopped. The pilot made a broadcast to advise they had a ‘complete engine failure’ and they were conducting a glide approach to runway 05, which they quickly changed to runway 08 (Numbers 5 and 6 in Figure 1).

Several witnesses reported that as the aircraft was on final approach to runway 08 with the wings level it suddenly rolled to the left and the nose dropped. The aircraft subsequently collided with terrain in an inverted position. The pilot was fatally injured, and the aircraft was destroyed.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. An amateur-built aircraft is an aircraft, the major portion of which has been fabricated and assembled by a person or persons who undertook the construction project solely for their own education or recreation.
3. Amphibious aircraft: An aircraft that can take-off and land on both land and water.
4. Runway number: the number represents the magnetic heading of the runway.
5. Common traffic advisory frequency (CTAF): is the name given to the VHF radio frequency used for air-to-air communication at Australian non-towered airports. Pilots use the common frequency to coordinate their arrivals and departures safely, giving position reports and acknowledging other aircraft in the airfield traffic pattern. These frequencies are not normally monitored by ATC.
6. Gender-neutral plural pronouns are used throughout the report to refer to an individual (i.e. they, them and their).

Context

Pilot information

The pilot held a valid Private Pilot Licence (Aeroplane) issued in June 2010. They also held a single engine aeroplane class rating with manual pitch propeller control and retractable undercarriage design feature endorsements. In addition, the pilot had spin and aerobatic endorsements, issued in July 2012.

The pilot commenced flying in the United Kingdom (UK) however, they had not attained a UK pilot licence. They had recorded approximately 60 flight hours to the end of 2003. After attending the Empire Test Pilot’s School^[7] as a flight test engineer^[8] in 2003, they had worked as a professional flight test engineer in both the UK and Australia.

The pilot commenced flying in Australia in 2007. A review of their logbook indicated they had accumulated approximately 189 hours of flying in Australia, of which approximately 103 hours were as pilot in command. Prior to the day of the accident, they had flown twice in 2020, with the last recorded flight on 29 March 2020. In 2019, they had flown 10.4 hours, including an aeroplane flight review, which covered stall recognition with recovery and forced landings.

The pilot conducted a high-speed taxi test and their first flight test in WID in December 2019. As far as the ATSB could ascertain, the pilot had not flown as a test pilot in any other aircraft prior to the first test flight.

Medical information

The pilot’s Class 2 medical certificate expired on the 16 May 2020. However, due to the COVID‑19 pandemic, the Civil Aviation Safety Authority (CASA) issued an automatic exemption to all medical certificates valid on 31 March 2020. This exemption authorised licence holders to fly without a current medical certificate for a period of 6 months beyond the certificate’s expiry date. The pilot’s medical certificate noted one restriction requiring distance vision correction to be worn during flight.

The post-mortem and toxicological examinations did not reveal any medical issues that may have contributed to the accident. In addition, there was no indication that the pilot was experiencing a level of fatigue known to affect performance.

Aircraft information

Overview

The Osprey 2 amateur-built aircraft was designed in the United States in 1972, to be built from a set of plans. It was a mid-wing, cantilever monoplane with a flying boat hull and a strut mounted engine, driving a wooden pusher style propeller (Figure 2). The aircraft was manufactured primarily from wood, with wooden formers and frames, and skinned with plywood. The conventional flight control surfaces (ailerons, elevator, and rudder) were covered with fabric and no flaps were fitted. It was equipped with retractable tricycle undercarriage.

Figure 2: VH-WID

Source: Aircraft owner/builder

Aircraft build

The aircraft build was started in 1977 in Australia, and the original builder had manufactured and built the:

• fuselage
• spars
• empennage
• wing ribs (which were not assembled)
• fuel tank
• landing gear
• engine mount.

The plans and the manufactured parts were then sold a number of times before being bought by the last builder in 2014. The aircraft was placed on the Australian register on 18 August 2014, with the aircraft build then completed over several years.

In 2016, the builder purchased a Lycoming O-320-E2A^[9] engine, which had previously sustained a propeller strike. The engine was sent to a CASA-approved engine repair shop for a sudden stoppage inspection. After the inspection, the engine was test run, then inhibited to prevent corrosion and all entry points were covered. The builder received the engine, with a new engine driven fuel pump and oil filter, in August 2016.

Maintenance

The aircraft was being maintained in accordance with the CASA maintenance schedule, which required an inspection every 12 months or 100 hours, whichever came first. It had a valid maintenance release, issued by the builder^[10] on 3 December 2019.

Wreckage and accident site information

Site and wreckage information

The accident site was located on the extended centreline, approximately 740 m west of the threshold for runway 08 (Figure 1). The on-site examination identified that the aircraft struck terrain in an inverted position with the left wing likely striking first, followed by the aircraft nose, engine pod and right wing (Figure 3). The ground impressions formed by the leading edge of the wings were of a curved nature and likely indicative of the aircraft rotating to the left as it impacted the ground.

The distance from the first impact point to the last item of wreckage was about 27 m, with the engine and fuselage coming to rest about 11 m from the initial impact point. This, along with the angle at which the impact occurred, suggested a low forward speed. There was no post‑impact fire.

Figure 3: Accident site

Source: ATSB

All the major aircraft components were accounted for at the site. The inspection also identified that:

• the flight control system was intact, with no defects identified that may have contributed to the accident
• while the main landing gear was found retracted, video evidence indicated that the gear was extended for the duration of the flight, as such retraction likely occurred during the accident sequence
• one of the propeller blades was significantly fragmented while the other remained intact
• the oil supply line from the engine to the oil cooler was disconnected (Figure 4)
• the engine cowl, rear fuselage, and empennage were heavily coated with engine oil, with streams forming as the oil migrated on the surfaces (Figure 5)
• there was no oil in the engine
• the oil gauge/filler tube was broken at the base where it attached to the engine lower crankcase assembly (Figure 4)
• the crankcase below the no. 1 cylinder was perforated (see the section titled Engine inspection).

Figure 4: Oil cooler supply hose disconnected

Source: ATSB

Figure 5: Empennage with oil residue

Source: ATSB

Engine inspection

The engine was inspected at an independent CASA-approved engine overhaul facility. The inspection found signs of internal damage indicative of an engine that had been starved of lubricating oil. The inspection also found that:

• the connecting rod in the no. 1 cylinder had separated at the big-end (Figure 6), most likely resulting in the observed hole in the crankcase (Figure 6 and Figure 7)
• the crankshaft journals^[11] exhibited various levels of heat damage (Figure 7)
• within the no. 3 cylinder, corrosion was observed on the bolts on the connecting rod and the bearings were heavily distressed with copper discolouration and deformed on one side
• within the no. 4 cylinder, while oil was observed in the connecting rod bearing, it was discoloured black
• all oil galleries were clear of obstructions.

Figure 6: Number one cylinder damage

Source: ATSB

Figure 7: Crankcase hole and heat damage to crankshaft journals

Source: ATSB

Engine manufacturer analysis

The ATSB subsequently transported engine parts to the engine manufacturer for additional inspection. They confirmed that the engine had most likely failed through oil starvation with the connecting rods and bearings showing obvious signs of oil starvation. They also advised that if a hose had disconnected from the oil cooler, that was the most likely cause of the oil loss.

Oil cooling system

An oil cooler removes surplus heat from an internal combustion engine. The oil pump transfers the oil from the sump through a supply hose to the oil cooler. The return hose passes the oil through an oil filter and then on to lubricate and cool the engine. The supply hose to the oil cooler was found disconnected at the accident site (Figure 8).

Figure 8: Oil cooling system

Source: ATSB

The builder advised they had reused an automotive oil cooler from a previous project. They also advised that a length of oil hose and fittings were purchased new from an automotive supplier, a few years before the hose was cut to length, assembled with the fittings and installed on the aircraft.

Figure 9: Oil hose assemblies

The hose assembly at the top of the image is the oil cooler supply hose which was found disconnected at the accident site. The lower hose is the oil cooler return hose. The lighting in this photo resulted in the silver-coloured fittings appearing brass coloured.

Source: ATSB

Hose examination

The two hose assemblies were similar in construction but of different lengths. It was reported that the hoses were most likely cut from the same length of hose (Figure 9) however, they were different shades of blue. The hoses had a polyester textile outer braid with an internal textile reinforcement. They were designed to be used in low pressure, high temperature applications to carry petroleum-based products including lubricating fluids, hydraulic and transmission oils. Crazing was found on the outer surface of both hoses but was more significant on the detached oil cooler supply hose (Figure 10).

Figure 10: Crazing on oil cooler supply hose

Source: ATSB

Fitting examination

Both hose assemblies had push-on type fittings that do not require external clamping (Figure 11). The integrity of the connection relied on the hose expanding over a series of barbs^[12] on the fitting. The internal liner material conformed to the barbs under the pressure of the internal textile reinforcement and outer braid of the hose.

Figure 11: Hose and fittings

Source: ATSB

On each hose assembly, the end connected to the engine had a straight, silver colour plated mild‑steel fitting, with three barbs and a yellow collar. The end connected to the oil cooler had a 90° curved, red and blue aluminium alloy fitting, with two barbs (Figure 11–Figure 13). Table 1 lists the differences between the two fittings.

Table 1: Differences between fittings

The two-barb fitting from the detached oil cooler supply hose, showed signs of mechanical damage consistent with tooling marks which could not have been sustained during the accident sequence (Figure 12).

Figure 12: Damage to two barbed fitting of the detached oil cooler supply hose 

Source: ATSB

The two-barb fitting on the oil cooler return hose, which did not detach, also had some mechanical damage, though this was less severe, with no significant damage to the barb (Figure 13). This connection also showed signs of the hose migrating off the fitting. However, as there was impact damage on the fitting collar, it could not be established if the migration of the hose occurred prior to, or during, the accident sequence.

Figure 13: Images of two-barb fitting from the oil cooler return hose

The image on the left shows mechanical damage to the fitting, the image on the right shows damage to the fitting and migration of hose from fitting.

Source: ATSB

Hose supplier advice

The ATSB discussed the aspects of hose design and push-on fittings with the Australian supplier of the hose. They advised that:

• the hose was compatible with the type of engine oil that was in use
• the hose was rated for the operating temperature and pressure it would sustain in use on the aircraft engine
• external crazing indicated that the hose was at the end of its in‑service life and would have lost its pliability due to age
• with external crazing, the inner braid reinforcement layer would likely also have deteriorated affecting the ability of the hose to grip the barbs of the fitting
• a fitting could be re-used provided it was undamaged
• they recommended a three-barb fitting be used with the hose
• they could not comment on the use of a two-barbed fitting, as no testing had been conducted on the fitting in combination with the type of hose used
• they had not conducted testing of the product to certify its use in an aviation setting.

Aircraft build

During the inspection of the aircraft wreckage, non-standard practices and parts, different to those specified in the build drawings, were identified. Examples of these are listed in Table 2.

There was no requirement to follow aviation‑specific standards when building an amateur-built aircraft, for which an experimental, special certificate of airworthiness applied. However, CASA advisory circular (AC) 21.4(2) Amateur-built experimental aircraft – certification referenced ACs containing information and guidance on acceptable fabrication and assembly. Section 7.2 stated:

…it is strongly recommended that approved components and established aircraft quality material be used, especially in fabricating parts constituting the primary structure, such as wing spars, critical attachment fittings, and fuselage structural members.

Table 2: practices identified

Weather

The weather observations recorded by the Bureau of Meteorology for Maitland Airport showed that at 1000 the wind was from the south-east at 4 kt reducing to 3 kt at 1030. Visibility was greater than 10 km with no cloud detected. This was consistent with both witness statements and video imagery recorded from inside the aircraft.

Recorded data

The aircraft was not equipped with a flight data recorder or cockpit voice recorder, nor was it required to be.

The aircraft was fitted with a Garmin AERA 500 GPS unit that was reported to be operating on the accident flight. The ATSB examined this unit and determined that the ‘track record mode’ was set to OFF, therefore the accident flight was not recorded.

A damaged iPad was recovered from the accident site. The pilot utilised the iPad to run an electronic navigation program (OzRunways), however the damage to the device precluded any on-device data download. However, the software provider supplied remotely stored data (Figure 1).

In addition, the aircraft was fitted with a Drift Innovation HD170 portable video recorder mounted inside the cockpit, behind the pilot, facing forwards. While the camera sustained significant damage during the accident sequence, audio and video imagery from the accident flight and the pilot’s first test flight were recovered. The recorded audio was not in sync with the video, so was not used in the analysis of the accident flight.

Recording of the accident flight

The video of the accident flight ended prior to the accident when the aircraft was approximately 200 ft above the ground.

Most of the cockpit instrumentation was visible in the video, although at times the footage was affected by sun glare. The oil pressure and temperature gauges were difficult to see on the video however, it showed that about 30 seconds after the pilot gave their departure call, the engine oil pressure was in the normal range. Due to the sun glare, the gauge was not visible again until about 1 minute 50 seconds later, where it showed low oil pressure. This was after the pilot had advised the engine was running rough. The engine RPM gauge was not visible in the video. There was no evidence on the video of smoke entering the cockpit.

The video also recorded that as the aircraft was turning on to the base leg for runway 05, the shadow of the propeller became stationary and there was a change in vibrations, consistent with the engine stopping. As the pilot continued the turn onto final for runway 08, the airspeed displayed on the aircraft instruments decreased to between 60–65 kt and the rate of descent almost immediately increased from level flight to approximately 1,700 ft per minute.

Amateur-built experimental aircraft

CASA permitted an amateur builder to construct an aircraft solely for educational or recreational purposes.^[13] There were no prescribed design standards, and the aircraft could be constructed from any materials, using any engine and propeller combination. In addition, CASA approval was not required before construction commenced and CASA did not conduct any inspections of the aircraft.

Before an amateur-built aircraft could be flown, it was required to be registered with CASA and have a valid certificate of airworthiness (CoA). According to Advisory Circular (AC) 21.1(1)

aircraft certification is the whole process of assessing an aircraft type against its type design and the aircraft’s condition for safe operation, which culminates in issue of a Certificate of Airworthiness (CoA) for an individual aircraft.

As amateur-built aircraft did not have a type design, there was no aircraft type‑specific standard to assess the aircraft against. To allow these aircraft to operate, they are issued a specific special CoA.

An authorised person (AP)^[14] or CASA was able to issue an experimental CoA.^[15] To obtain a CoA a builder could:

• approach CASA directly
• approach an industry member who was a CASA‑appointed AP
• become a member of the Sport Aircraft Association of Australia (SAAA – see the following section) and approach a SAAA member who was a CASA‑appointed AP.

AC 21.4(2) Amateur-built experimental aircraft - certification, last updated in September 2000, provided guidance and information to applicants applying for a special certificate of airworthiness for an amateur-built aircraft in Australia. This stated that:

Amateur builders should^[16] call upon persons having experience with aircraft construction techniques, such as the SAAA technical counsellors [see the section titled Technical counsellor] …. to inspect particular components eg. wing assemblies, fuselages etc. prior to closure and to conduct other inspections as necessary. This practice is an effective means of monitoring construction integrity.

The AC went on to describe that although CASA had previously inspected aircraft at several stages though the build, overseas experience had shown that only one final inspection was required. The purpose of this inspection was

to allow the inspector [AP] to make a subjective assessment of the workshop methods, techniques and practices used in the construction of the aircraft solely for the purpose of prescribing appropriate conditions and operating limitations necessary to protect other airspace users and persons on the ground or water, ie. to protect persons and property not involved in the activity.

It also stated that:

the person carrying out the inspection is not responsible for the integrity of the design or construction of the amateur-built experimental aircraft, nor for the identification of any structural design or construction deficiencies – responsibility for the design, construction and integrity of the aircraft rests with the amateur builder.

In addition, in seeking a CoA the AC advised that the applicant should be prepared to supply

evidence of inspections, such as logbook entries signed by the amateur builder, describing all inspections conducted during construction of the aircraft in addition to photographic documentation of construction details. This will substantiate that the construction has been accomplished in accordance with acceptable workshop methods, techniques, and practices.

CASA recommended that amateur builders contacted an approved organisation before commencing a project to seek advice. One of the ways of doing this was to contact the SAAA.

Sport Aircraft Association of Australia

The SAAA is a voluntary ‘…group of aviation enthusiasts, assisting each other to build, maintain and operate sport aircraft’. There was no regulatory requirement for members to follow the SAAA procedures or advice, nor did the SAAA have any powers granted by CASA to direct and enforce members to perform any activity in relation to building, certification and test flying the aircraft. To receive a CoA through the SAAA system, the builder was required to be a member when they applied for the CoA, but there was no requirement for them to be a member at the commencement of or throughout a build project.

The organisation had two functions, which were overseen by CASA. These included management of CASA‑appointed APs and management and delivery of a CASA‑approved maintenance procedures course for SAAA members. As the accident aircraft was in the flight‑testing phase, the ATSB did not review the maintenance procedures course.

One of the main functions of the SAAA was to support people building their own aircraft, including assisting them to gain a CoA. They did this by providing:

• a risk assessment tool (see the section titled Risk Radar Aviation)
• a group of advisors to provide advice on building the aircraft (see the section titled Technical counsellor)
• access to APs to certify the aircraft
• advice on technical and regulatory matters.

They also provided advice on flight safety, including test flying, through flight safety advisors, and assistance with the flight testing of the aircraft once the aircraft had received a CoA. The builder stated that when they contacted the SAAA in relation to the flight testing, they were told that none of the advisors had experience in the aircraft type.

Risk Radar Aviation

According to the SAAA, the Risk Radar (RRAv) report was a whole of life measuring and awareness system developed by the SAAA that covers every aspect from choosing an aircraft to building/modifying that aircraft through to testing and routine flight operations and maintenance.

It was a self-assessment tool designed to alert the user to areas of high risk to allow appropriate mitigations to be considered, rather than to stop a project. It relied on the builder and when requested, a technical counsellor (TC), objectively answering relevant questions about the project.

The RRAv report covered four areas:

• planning (assessed whether the design of aircraft was suitable for the experience of the owner)
• build/modify (assessed the quality of the aircraft build)
• flight testing (assessed experience levels of test pilot and the suitability of the test area)
• post-build (assessed experience level of the owner/builder to continue flying the aircraft after the CoA was attained).

Build/modify section

The build/modify section had separated the assessment criteria into nine areas, including one on the engine group. This in turn had more specific questions, including for example, questions on the oil cooler (see Table 3). A user was required to select the rating which best described the aircraft from a drop-down list, and the tool would automatically alert if this was considered a concern. The RRAv instructions advised that a user should discuss and close out the concern with their TC and/or flight safety advisor and a TC should document in the RRAv tool detail of any concerns that had been waived.

Table 3: Example of questions raised within the oil cooler section showing all available options, ratings and alerts

Flight-testing section

The flight-testing section had an area relating to the proposed test pilot, including a space to name the test pilot and where their flying experience and currency was rated. Again, the various responses were automatically assessed and a caution was raised to alert the user to areas where additional risk mitigations may be required.

Technical counsellor

A TC was a member of the SAAA who was:

willing to assist others, inspecting their work, guiding them through construction phases and finally, perhaps most importantly, guiding them through the lead up to the aircraft certification process.

To become a TC, an applicant had to have a reasonable amount of experience with building and maintaining amateur-built experimental aircraft. They were nominated by another TC or the president of the local area group. The TC was not responsible for the design or construction of an aircraft. They could provide suggestions to a builder, however the builder was under no obligation to accept their advice. However, where there was a difference of opinion on the design or construction technique being applied, it was recommended that the TC highlight this in a visit report and their copy of the RRAv report and provide that to the SAAA.

The TC’s handbook, current at the time of the build but not available to a builder, stated in the list of duties that TCs were required to:

assist the builder to prepare for Final Inspection day … this must also include a “Plan-Build-Test” RRAv Report (prepared by the Builder and signed off by both Owner/Builder and TC) that presents the project, the pilot and test flying programme plans for consideration by an Authorised Person (AP).

In the section titled Stage inspections, it stated that a:

thorough nuts and bolts inspection must occur prior to the on-site visit carried out by the authorised person (AP). The builder is responsible for this, with assistance from their TC and other experienced builders [emphasis added by ATSB].

The handbook did not detail that a TC who was building their own aircraft was required to have an independent TC conduct the ‘nuts and bolts’ inspection of the aircraft.

Builder’s assist program

The SAAA ran a voluntary program, called the Builder’s Assist Program (BAP), where a builder and a TC worked together on a project. The program included a minimum of three inspections of an aircraft to be conducted at major milestones during the build.

Inspections of an aircraft during the build process

Regardless of whether a builder had signed up to the BAP, the SAAA recommended that they organise at least three formal TC visits, including:

• on completion of the first component
• during the fuselage/wing assembly
• engine installation.

The RRAv tool had a checklist section to document the inspection and it was recommended that a TC submit a report to the SAAA after each inspection. However, there was no regulatory requirement to organise stage inspections or inspections prior to the closure of any components.

Final assembly (nuts and bolts) inspection

To attain a CoA, the AP Manual of Procedures required that a

duly completed and executed RRAv report pertaining to the planning, build and test phases of the applicant’s project has been received.

This required that a builder organise a ‘nuts and bolts’ inspection to be completed with a TC, irrespective of whether they had liaised with a TC during the build. This inspection was to be completed prior to organising an inspection for the certificate of airworthiness.

The SAAA technical counsellor handbook advised that before conducting a ‘nuts and bolts’ inspection, the TC should use the RRAv report as a guide to create a checklist of what to inspect. The handbook also detailed that a report, signed by the builder of an aircraft, and endorsed by a TC, should be submitted to the SAAA after the ‘nuts and bolts’ inspection was completed.

While the ‘nuts and bolts’ inspection was required by the SAAA, the SAAA had no process to check that this inspection had been completed, or if any of the recommended TC visits for a project were completed or a report was submitted.

Information provided to members on inspection requirements

The SAAA made a number of information booklets available to members that contained advice on how to complete a project through the SAAA process. The ATSB reviewed the information available to a builder to determine if there was consistent advice that a TC was required to conduct the nuts and bolts inspection or endorse the RRAv report prior to it being submitted to the AP. A review of these booklets can be found in Appendix A.

In summary, while some documents advised that both the owner of the aircraft and the principal advisor (TC) must cause a RRAv report to be executed, none of the documents included any mandatory inspections, although they detailed  that the TC was available to assist the builder to complete the ‘nuts and bolts’ inspection.

The information paper on the process for how to apply for the CoA listed the documents required to be submitted when applying for the certificate of airworthiness. It stated the RRAv report must be supplied, and that the TC was the ‘first point of contact for any assistance required’. However, it did not specify that the TC was required to conduct the ‘nuts and bolts’ inspection nor that they were required to endorse the RRAv report.

Authorised Persons using SAAA processes

The SAAA nominated experienced members to CASA to become APs. These members were assessed by CASA and then completed a CASA‑run training course, which provided training on the legal requirements to issue a CoA. There was no requirement for an AP to be a licenced aircraft maintenance engineer (LAME) or to have other engineering qualifications.^[17]

According to the conditions of their instrument of appointment, the AP must issue the CoA in accordance with:

• the Sport Aircraft Association of Australia SAAA ‘Authorised Person’ manual of procedures Special certificate of airworthiness – Experimental (Amateur-built) … and
• for amateur-built experimental aircraft – CASA Advisory Circular AC 21-4

In addition, in accordance with Civil Aviation Safety Regulation (CASR) 21.195A Issue of experimental certificates, an AP must issue an experimental certificate if ‘granting the authorisation would not be likely to have an adverse effect on the safety of other airspace users on the ground or water’^[18] and the applicant:

• is eligible
• applies for the certificate
• is entitled to the certificate.

SAAA AP manual of procedures

The SAAA AP Manual of procedures special certificate of airworthiness – experimental (amateur‑built) (manual) was written by the SAAA and approved by CASA. The manual did not identify that a TC was required to conduct a nuts and bolts inspection prior to the request for a CoA. It stated that before an AP could attend an aircraft, they were required to receive a

duly completed and executed RRAv [Risk Radar (see the section titled Risk Radar Aviation)] report pertaining to the planning, build and test phases of the applicant’s project...

and

As a minimum, the owner of an aircraft must cause a RRAv report to be executed by both him/herself and the principal advisor (Technical counsellor) [see the section titled Technical counsellor] which presents the project, the pilot and test flying programme plans prior to consideration by an Authorised Person (AP) for issuance of a CoA.

A checklist itemised the documents the AP must receive before a CoA could be issued. It included a RRAv report, however it did not specify that the RRAv report was required to be endorsed by a TC.

Since this accident, the SAAA have clarified in a Special Bulletin to all APs that the requirement that the RRAv report must be ‘executed’ indicated it was required to be ‘signed with the proper formalities’ by the final assisting TC.

The checklist also listed the items on the aircraft the AP was required to inspect, including ensuring the aircraft markings and passenger warning placarding met the regulations. The AP was also required to do a general inspection of the aircraft to check the:

• engine and flight controls and pilot/static system operated correctly
• seatbelts met the minimum standards
• cockpit did not have protrusions
• carburettor heat system (where installed)
• firewall was adequate (where required).

The manual went on to state that after the AP’s inspection of the aircraft was complete, the AP should consider any conditions and limitations to apply to the aircraft, which should be listed on the CoA. These limitations are designed ‘in the interests of the safety of other airspace users and persons on the ground or water’. In determining whether any limitations were necessary, the AP was required to use the RRAv report to assess the:

• aircraft
• operating airfield
• area it was to be flown
• proposed test pilot’s experience and flight test schedule.

The manual listed examples of limitations, which were based on a list of examples contained within AC 21‑4(2) Attachment 3. While these lists included the airfield to be used and the area the aircraft could be flown, neither specified the name of the pilot who was to conduct the testing or the flight test schedule to be used. AC 21-10 v 4.2 Experimental certificates, which also listed example limitations to apply to aircraft with an experimental certificate, similarly did not list the pilot’s name in the examples.

The AP manual of procedures stated one of the reasons to revise the certificate of airworthiness was a change of nominated pilot, however, this was not stated in other publications.

After the CoA was issued, the AP was required to submit all the paperwork to CASA using the delegate notification management system (DNMS).

Interviews with authorised persons

The ATSB interviewed a number of SAAA APs to establish if consistent procedures were being followed when issuing a certificate of airworthiness. The APs were selected from a range of backgrounds (both LAME and non-technical) and included both those recently appointed and others who had held their authorisations for many years.

All APs advised that most of the aircraft they assessed were well built.

They also all advised that, as it was on the checklist, they ensured they received a copy of the builder’s RRAv report. However, all but one advised that they had not been checking to ensure the RRAv report was endorsed by a TC. Some APs advised that they used the summary section of the RRAv report but did not assess the build section as builders mostly rated their aircraft construction highly, which was not always the case. They also did not routinely request a copy of TC inspection reports due to an assessment that they often just detailed that the TC had attended and did not add value to the process.

The interviewed APs also stated that, until they received the Special Bulletin from the SAAA on the 12 May 2021, they had been issuing CoAs to builders who had no TC involvement with the build. Consequently, CoAs had been issued in circumstances where TC inspections, including the ‘nuts and bolts’ inspection (see the section titled Final assembly (nuts and bolts) inspection), had not been conducted.

However, all but one AP advised, they themselves conducted a thorough inspection of the aircraft to ensure, as far as they could establish, the integrity of the build. This was done by having the aircraft presented with all access panels opened and cowls removed. They would often identify areas where the builder could make improvements and, in most cases, the builder would correct the issues.

In the case of the one AP who did not conduct an inspection of this nature, they had knowledge of the build from the start, with all builds having TC involvement and regular inspections of the aircraft.

One AP advised that where a builder used non-aviation components, they required that the builder justify the safety and reliability of the part. The AP would also do their own research on the component and applied limitations on the aircraft to suit.

All APs stated that they considered the suitability of the flight-testing pilot who was named on the RRAv report and would often contact that pilot, especially if they were not known to them. However, only half the APs advised that they named the test pilot in the limitations on the certificate.

They all advised that the CASA surveillance of them as an AP was thorough in checking the paperwork against the regulations and would identify missing dates or areas where more detail should be added. However, they also stated that CASA did not assess the RRAv report to ensure they were received and endorsed or check if any inspections of the aircraft had been conducted during the build process.

CASA surveillance of SAAA authorised persons

The ATSB interviewed relevant personnel at CASA in relation to the surveillance conducted on the SAAA APs. The Sport Aviation section advised that they conducted regular surveillance events to ensure the APs were issuing the certificates in accordance with their instrument of appointment. The frequency of these surveillance events was determined by:

• the national surveillance scheme, generally each of the APs was surveilled every 2 years.
• response‑based surveillance, which was based on intelligence from industry inspections and engagements
• campaign surveillance where any emerging risk across a particular sector was the focus of the surveillance.

The surveillance event consisted of randomly selecting and assessing work packages from the DNMS for the AP under surveillance. To ensure the AP met the requirements of their instrument of appointment, the audit assessed the paperwork to ensure it met the regulatory requirements and the process was conducted in accordance with the SAAA AP manual of procedures. They advised that even though all the SAAA APs used the same manual of procedures, CASA personnel did not have a checklist to ensure all events surveilled the same items.

The Sport Aviation section advised that as AC 21.4 was a condition of the instrument of appointment, it was mandatory that it be considered when issuing certificates. They also advised that although the SAAA Manual of procedures required that a RRAv report be submitted, CASA as part of a surveillance event, did not assess it, or ensure it was endorsed, as this was a SAAA requirement which was above the minimum mandatory requirements.

They advised that, regardless of CASR 21.195A stating that the AP was required to give the builder a certificate if they were entitled to one, the AP was required to inspect the aircraft to ensure it is safe to fly. CASA also stated that the AP should apply limitations appropriate to the aircraft being considered.

CASA’s views were sought on the actions that an AP should take if they considered that the aircraft was unsafe but the builder was entitled to a certificate in accordance with CASR 21.195A. CASA advised the AP could request additional information relating to the deficient area/s and, if they requested something which could not be supplied, then:

• refuse to issue the certificate because they are not satisfied with the supplied information
• apply very stringent limitations on where and when the aircraft could be flown.

They also advised that if they refused to issue a certificate, this should be notified to CASA through the DNMS, which would prevent the builder from then going to another AP to have the certificate issued.^[19]

CASA advised that they did not check if a test pilot had been named in the limitations as the minimum experience required to test an amateur-built aircraft was a private pilot licence and the appropriate aircraft‑related endorsements, nor was it a requirement to name a test pilot.

However, in a separate interview, the CASA surveillance management team advised that they would expect the pilot of a certified aircraft operating under an experimental certificate conducting test flying to be named in the limitations on the certificate of airworthiness.

Comparable international amateur built aircraft regulatory systems

A review of the regulatory system for the construction of amateur‑built aircraft systems internationally found that a number of countries had regulations which allowed amateur-built aircraft to be constructed under a similar system to that in Australia. These countries had based their legislation on the United States Federal Aviation Administration (FAA) legislation. These systems had a requirement that evidence of independent inspections during the build process be provided to the person conducting the assessment to issue the CoA. This was to ensure that the integrity of the aircraft build had been maintained. A review of these systems can be found in Appendix B

Other countries, such as the United Kingdom, required the design and construction to be approved by a licenced engineer. The European Aviation Safety Authority did not regulate amateur-built aircraft, leaving that to individual states to register the aircraft.

Build process for VH-WID

The builder was a member of, and TC with, the SAAA and had elected to use their processes to obtain a CoA for the aircraft and had signed up for the builder’s assist program.

Risk radar aviation report for VH-WID

The builder submitted an RRAv report to the AP prior to the CoA inspection. On the form the builder documented that two TCs had been involved in the project and that more than two inspections had been completed.^[20] However, a TC had not endorsed the form.

Of the two TCs named, one had inspected the aircraft in 2014, when the project was first started and had submitted a TC visit report and a RRAv report. The second named TC advised that while they had seen the aircraft at the start of the project, they were not involved in the project and had not inspected the aircraft nor written a TC report. The builder later advised they had not engaged an independent TC as there were not many TCs who had experience with wood and fabric construction.^[21]

The builder also advised that a ‘nuts and bolts’ inspection with an independent TC had not been completed nor was it required, and they did not involve an independent TC with the completion of the RRAv report. However, the builder noted that they themselves were a technical counsellor. With regard to performing these dual roles, the SAAA advised that it was ‘counterintuitive for a builder to do their own inspection, irrespective of whether they are TCs or not’.

Build section of RRAv report

The builder had selected ‘well constructed to standards within AC43’ for most questions in the build/modify area of the RRAv report, including the engine build/modify section. There was no indication on the RRAv report that the builder had used non-aviation parts in the aircraft, apart from the engine ignition system.

Flight test section of RRAv report

The builder advised that when they entered their own flying experience in the RRAv report, the tool flagged concerns. Consequently, they decided to contract a pilot to do the test flying, however they had not engaged a pilot when they organised the certificate of airworthiness inspection.

In the test phase section of the RRAv report, the builder had not named a pilot to conduct the test flying, although they had filled in the section with a specific, experienced test pilot in mind. As such, they had entered extensive experience against all criteria (Figure 14). This was not representative of the experience of the accident pilot (Figure 15).

Figure 14: Risk Radar Aviation section for test pilot as submitted by builder of VH-WID

Source: supplied

Figure 15: Risk Radar Aviation section with the accident pilot’s experience

Source: SAAA with changes by ATSB

Certificate of airworthiness on-site inspection for VH-WID

The builder applied for a CoA for WID in November 2017. The AP did not request a TC ‘nuts and bolts’ inspection report or evidence of previous inspections.

The AP conducted an on-site visit on the 16 March 2018, during which a number of issues were identified with the aircraft. These included:

• aft wing attach bolts not installed safely
• right wing attach bolts loose
• twisted flight control cables
• loose nuts in flight control connections
• wear on the aileron cable
• skin on the inboard section of both wings not bonded to the ribs
• loose engine mount
• sharp edges around items in the cockpit
• installed ‘experimental’ signage on the aircraft of the incorrect size.

Consequently, the AP cancelled the inspection to allow for defect rectification.

After a second on-site visit, organised after the listed items had been corrected, the CoA (valid for 12 months) was issued on 21 August 2018. The AP recorded that the quality of the build was ‘fair’. The certificate was subsequently re‑issued on 10 October 2019, due to the time taken to complete the test flying. The following limitations, among others, were included on both certificates:

• the AP was to be notified of any major changes to the aircraft or the aircraft sustaining major damage
• at least 25 hours flight testing was required within the stated test area
• the aircraft was not to be operated over built up areas
• no passengers were permitted
• all flights from Maitland were to be from/to runways 05/23 with no flight permitted over built up areas of Windella or Rutherford. Circuit operations at Maitland were to be left hand from runway 05, remaining clear of Windella.

The AP advised they discussed a specific pilot to do the test flying with the builder and had also discussed this with the proposed test pilot, however they did not name the pilot in the limitations. The builder advised that the nominated test pilot was subsequently too busy to do the test flying. The AP also stated that their expertise was not in assessing if a pilot was suitable to conduct the flight testing and that they encouraged all builders to talk to the SAAA flight advisors before conducting the first flight.

Aircraft changes after the certificate of airworthiness was issued

After the CoA was received, a registered operator (builder) was required to advise the AP when a ‘major change’ to the aircraft was made, before flying the aircraft again. In 2017, a major change was defined among other things as having an effect on ‘the operational characteristics of the aircraft’. As such, the builder was required to assess if a major change had been made and if it would have a significant effect on the aircraft.

The builder made the following changes to the aircraft after the CoA was issued:

• after a circuit by a different pilot,^[22] the wings were removed and the rear mounts for the wing were redrilled to change the angle of incidence on both wings
• a trim tab was fitted to the rudder
• vortex generators were installed on the underside of the horizontal stabiliser and the top of the cabin.

These changes were recorded in the aircraft logbook, however the AP was not advised.

The builder advised that between the accident pilot’s first and second test flight, the aileron movement had also been adjusted. The design instructions for the aircraft stated that to eliminate adverse yaw, the ailerons should be set such that the up moving aileron moved 80 per cent further than the opposite side moved down. The owner advised that initially they had set the ailerons to move in a 1:1 ratio. After the pilot’s first test flight, this had been adjusted so the up moving aileron moved 70 per cent further than the down moving aileron. The accident pilot had been made aware of these changes.

Test pilot requirements for amateur-built aircraft

The minimum qualification required to conduct initial flight testing in an amateur-built experimental aircraft was a private pilot licence with the appropriate aircraft‑related endorsements. There were no minimum experience requirements however, CASA advised it was ‘unwise’ for the initial flight test to be carried out by someone other than a pilot with specific test flying qualifications or knowledge.^[23]

In addition, CASA AC 21.47 Flight test safety stated that personnel involved in flight testing should be ‘appropriately qualified, experienced and current’. It also advised: 

A formal experimental test flying certificate does not, in itself, necessarily mean that the holder is the best person to employ for a specific flight test project. For example, a qualified TP [test pilot], who graduated from Test Pilot School over thirty years ago and who has only operated military fast jets or transport category airliners since that date, may not be the ideal pilot to choose for the developmental test flying of a Light Sport Aircraft with a tail-wheel landing gear configuration. 

The CASA AC also urged ‘most strongly’ that builders made detailed reference to the FAA AC 90–89 Amateur-built aircraft and ultralight flight testing handbook. This FAA AC stated that the test pilot should be ‘rated, current, and competent in the same category and class as the aircraft being tested’. The minimum flying experience suggested for an aircraft built from a ‘time-proven set of plans’ was 100 hours in command, and a minimum of 1 hour training in recovery from unusual attitudes within the 45 days prior to the first flight test.

Information provided by the accident pilot to the builder

Just before the CoA was re‑issued in 2019, the builder was put in contact with the accident pilot. The pilot sent information about their experience, advising they had ‘been in testing for a long time for both the UK and Oz [Australian] militaries, plus flown GA [general aviation] and gliders for years’. They advised that they were a flight test engineer and had attended the Empire Test Pilot’s School (ETPS), however, they did not specify that their attendance at ETPS was as a flight test engineer rather than as a test pilot.

They stated that they had a private licence and did not provide their total number of flying hours. In discussing their recent flying experience, they advised that

Just of late, I fly the robin^[24] out of WLM [Williamtown] for aerobatics, plus the archer and occasionally the lance^[25] out of MND [Maitland] for touring.

They also advised that they had an aerobatic, retractable landing gear and constant speed endorsement. The builder did not request further information.

Aircraft testing

Taxi test

The pilot had written a report on the initial taxi test conducted on the 13 December 2019, which identified that:

• the airspeed indicator was overreading by about 10–12 knots compared to the onboard GPS unit (with no headwind or tailwind present)
• there was considerable slack in the nose wheel steering control cables
• the braking system was not effective.

In response to these observations, the builder conducted work on the nose wheel and rudder tracking to correct the issues.

The builder advised that the airspeed indicator overread was not corrected prior to the test pilot flying the aircraft as the pilot and builder were unsure if the discrepancy was the result of the aircraft’s attitude during taxi. They had planned to test the airspeed indicator at a later stage in the flight testing. However, the builder advised the pilot had intended to use the speed indicated on their iPad rather than the airspeed indicator in the aircraft, during the initial flights, as the wind conditions were light.

Accident pilot’s first flight test

While no report could be found relating to the accident pilot’s first flight test, conducted on the 30 December 2019, the video recorder was operational during the flight. The video showed the aircraft was controllable, although the yaw and roll characteristics of the aircraft were poor. In an email to the builder, the pilot advised that all turns were done using rudder almost exclusively and stated if you use the stick at all the adverse yaw is so strong it has the nose off in the opposite direction … the only issue is near the ground when you may wish to pick up a wing. Getting it to roll with your feet has some delay, which isn’t ideal near the ground.

Stall

A note in the pilot’s test sheet for the accident flight, indicated that the pilot had assessed the stall speed as 65 kt on the airspeed indicator in the aircraft, during the first test flight. They had also assessed that they should not fly below 75 kt on the airspeed indicator during the approach.

The information in the pilot operating manual, written by the builder, stated that the stall speed was 56 kt with the landing gear extended.^[26] In the ‘Operating suggestions’ section of this document, it stated that ‘the aircraft is very docile approaching the stall and does not exhibit any bad characteristics’. This document suggested that 70 kt be used in the circuit, however, it also stated in the downwind check that 78 kt be maintained on final.

The ATSB discussed the aircraft’s flight characteristics with another pilot who had built and owned an Osprey 2 in the early 1980’s. They advised that their aircraft stalled at 52 kt with the landing gear retracted and there were no inherent indications of an approaching stall. They also advised that during the stall, while the wing did drop, it was not violent, and the aircraft required 100–200 ft to recover. As these aircraft were built from plans by different builders, the stall characteristics may have differed.

Finally, this pilot stated that during the process to get a certificate of airworthiness for their aircraft, the Department of Civil Aviation^[27] had required that a stall warning system be installed.

VH‑WID did not have a stall warning system installed.^[28]

Previous occurrences

ATSB research report AR-2007-043(2) Amateur-built aircraft Part 2: Analysis of accidents involving VH-registered non-factory-built aeroplanes 1988-2010 found that amateur-built aircraft had an accident rate three times higher than comparable factory-built certified aircraft. They also found that over half of the accidents were precipitated by mechanical events, which were mainly complete or partial engine failures.  

__________

7. Empire Test Pilots School: trains UK Ministry of Defence and international pilots, engineers, and aircrew to run civil and military flight test programmes.
8. Flight test engineer (FTE): is an engineer involved in the flight testing of prototype aircraft or aircraft systems. Generally, they have overall responsibility for the planning of a specific flight test phase. They and the flight test pilot are jointly responsible for the safety of the test flying. They are also responsible for the analysis of the data acquired during a test flight.
9. The Lycoming O-320-E2A is a naturally aspirated, air-cooled, four-cylinder, direct-drive engine produced by Lycoming Engines.
10. Civil Aviation Regulations 1988 – Reg 42ZC allows an authorised person to perform maintenance on an amateur-built aircraft. The person must be authorised by a CASA-appointed Authorised Person (see the section titled Amateur-built experimental aircraft) having built the aircraft and completed an approved maintenance procedures course.
11. A journal is the part of a shaft that rotates inside a bearing.
12. Barb: A barb is a sloped, raised ring that provides grip to the fitting to prevent it separating from the hose.
13. Advisory Circular (AC) 21.1 (1) Aircraft airworthiness certification categories and designation.
14. Under Civil Aviation Safety Regulation (CASR) 201.001, CASA could appoint a person to be an authorised person (AP). In making this appointment, CASA must be satisfied that the person has the appropriate qualifications and experience.
15. CASR 21.195A
16. AC 1-01 v2.0 8.2.3 stated that 'should' indicated that while the topic does not have a legal requirement, adherence to CASA policy or guidance material is strongly recommended. As these requirements are not specified in legislation, alternate methods that can be shown to meet the same intent can be accepted where deemed appropriate.
17. The CASA Delegates Management Manual required that an applicant have, among other requirements, ‘substantial experience in the design, manufacture, modification, and maintenance of aircraft similar to the scope sought’ and, ‘Current technical knowledge and experience commensurate with that required for issuing experimental certificates.’
18. Civil Aviation Safety Regulations 1998 11.055 Grant of Authorisations
19. DMNS – CASA was later asked whether the DNMS would alert an AP that a builder had previously been denied a certificate of airworthiness. They advised that there was no automatic alerting against a particular registration.
20. The SAAA clarified that a TC visit report on the aircraft was submitted to them for an inspection conducted on 2 April 2010 by the builder as a TC for the previous owner, when that owner acquired the aircraft. Just after the builder acquired the aircraft, an independent TC submitted both a TC visit report and RRAv report for an inspection completed on 14 April 2014. On 6 August 2018, the builder submitted a RRAv report which was not endorsed by a TC, when applying for the CoA.
21. The SAAA advised that while this was true, they had access to a technical network to provide advice where needed.
22. This was the only reported flight prior to the accident pilot’s first test flight, this occurred prior to the issuing of the second CoA.
23. The SAAA RRAv tool would flag concerns in the Flight Test section if the minimum level of experience was entered.
24. Robin is a single engine aircraft manufactured by Robin Aircraft.
25. Piper Lance is a six-seat, single engine aircraft manufactured by Piper Aircraft.
26. Landing gear: The owner/builder and the accident pilot had decided the landing gear should remain extended during the initial test flights. The video showed that the pilot did not retract the landing gear during the flight.
27. From 1938, the Department of Civil Aviation regulated aviation in Australia. In 1988, the Civil Aviation Authority was established and, in July 1995, that organisation separated into the Civil Aviation Safety Authority and Airservices Australia.
28. On the RRAv report, the stall warning device was marked as ‘N/A’ and no alert flag was raised.

Safety analysis

Introduction

Passing 2,400 ft on climb after taking off from Maitland Airport, the pilot was advised, via radio, of white smoke coming from the aircraft and noted that the engine was not running smoothly. In response, the pilot broadcast that they were returning to land on runway 23, however, during the descent, they turned to join the reciprocal runway 05. As the aircraft was turned on to the base leg of the circuit, the engine failed, and the pilot attempted to conduct a forced landing on to the closer runway 08. During the final stage of the approach, the aircraft was observed to abruptly roll, pitch down and collide with terrain.

This analysis will discuss the reason for the engine power loss and the pilot’s response. It will also examine the aircraft build and approval process, including the involvement of the Civil Aviation Safety Authority (CASA) and the Sport Aircraft Association of Australia (SAAA).

Development of the accident

Examination of the engine identified a number of significant deficiencies with the oil supply hose and fitting connected to the oil cooler. Firstly, a damaged fitting was used to connect the oil supply hose to the oil cooler. This damage would likely have allowed oil to leak past the fitting’s barbs. Secondly, the external condition of the supply hose indicated that it had reached the end of its effective lifespan. Its aged condition probably reduced the ability of the hose to mechanically grip the barbs and ensure the integrity of the connection.

Finally, the fitting was not approved for use in combination with the hose by the hose manufacturer and had slightly different dimensions, and one less barb, compared to the hose manufacturer’s approved fitting on the other end of the assembly. The combination of these three factors likely resulted in the pressurised hose separating from the oil cooler fitting (either partially or completely), allowing the oil to be lost overboard.

This disconnection and oil loss most likely occurred while the aircraft was on climb, as white smoke was observed by witnesses on the ground and the pilot reported rough running of the engine. Given that the engine was above and behind the pilot’s position in the aircraft, this would not have been visually obvious to the pilot.

The pilot initially advised that they were returning to runway 23, which would have allowed the aircraft to land as soon as possible. However, the pilot then turned to join the reciprocal runway 05, possibly due to a pilot of another aircraft reporting they were departing from this runway. The pilot also flew a widening circuit, which was in accordance with one of the limitations on the certificate of airworthiness (CoA) to avoid a built-up area. However, this extended the time the aircraft was airborne and increased the power required from the engine to maintain height. The combination of these factors resulted in the engine failing in flight due to oil starvation.

The engine failed as the aircraft commenced the turn to base. Due to its relatively poor glide performance, from that position it was likely unable to reach any runway. There were opportunities for a forced landing to be conducted off the airport. However, it is possible that, as the pilot had just practiced forced landings in an aircraft (PA‑28) that was probably capable of reaching the airport environment from that position, they overestimated the Osprey’s glide performance.

During the forced landing, video imagery recorded the speed decreasing to between 60–65 kt on the aircraft’s airspeed indicator, which was below the speed the pilot had previously identified as the stall speed. There was no stall warning system installed, and no known aircraft indications to increase the pilot’s awareness of the approaching stall.

Examination of the accident site confirmed that the aircraft contacted the ground with low forward airspeed while rolling to the left, consistent with an aerodynamic stall. The height at which the stall occurred was too low to permit recovery.

Amateur-built aircraft system

The amateur-built aircraft system was designed to allow people the freedom to design and build their own aircraft. Responsibility for ensuring that such aircraft were built to a safe standard rested with the builder and methods of ensuring safety and reliability included:

• following build instructions and plans
• using accepted construction techniques/practices and aviation‑compatible parts.

Assistance in this regard was available from the SAAA, specifically the technical advice from their Technical Councillors (TCs).

Build inspections

Independent inspections at milestone points during the construction are an effective method of ensuring the builder is following accepted practices and that no inadvertent errors have been made. CASA stated that to meet their safety objectives, amateur builders should have independent inspections of the aircraft and these inspections should be documented in the builder’s log. However, this was not mandated and so while the SAAA recommended that at least three inspections with a technical counsellor (TC) occurred during the course of the build, compliance was optional.

Despite this, the SAAA had written a clause into the Authorised Person’s (AP’s) manual of procedures requiring that an AP receive a TC‑endorsed risk radar aviation (RRAv) report. This clause did not clearly articulate that a TC was required to conduct a ‘nuts and bolts’ inspection of the aircraft. In addition, the checklist of the required documentation to be supplied to an AP, which included the RRAv report, did not clarify that it was required to be endorsed by a TC. This resulted in some APs accepting RRAv reports which had not been endorsed. This allowed aircraft to be presented for the Certificate of Airworthiness (CoA) assessment without having an independent ‘nuts and bolts’ inspection. However, most of the APs interviewed by the ATSB were conducting their own inspection of the aircraft, which mitigated some of the risk.

On this occasion the builder had supplied an RRAv report to the AP, however it had not been endorsed by an independent TC, nor had any independent stage or closure inspections of the aircraft been conducted during the builder’s project. While it was considered unlikely a TC would have detected the damaged barb on the fitting, as the oil hose assembly would most likely have been assembled prior to an inspection, they may have identified the visibly aged condition of the oil supply hose.

Additionally, had these inspections been conducted, it is likely several other building practices not normally used in aviation would have been detected. These had the potential to increase risk but were not considered contributary to the accident.

The SAAA information booklets were written to ensure that builders understood that they were responsible for the integrity of the construction of the aircraft. The booklets, available to a builder at the time of the project, did not clearly articulate that a TC was required to conduct an independent ‘nuts and bolts’ inspection of the aircraft before it was presented to the AP for inspection.

They also did not state that a builder, who was also a TC, was required to have an independent TC conduct a ‘nuts and bolts’ inspection. The builder of VH‑WID was a TC with the SAAA. Recognising that this was the only TC‑built aircraft examined by the ATSB, the issues found in the techniques used in the construction of the aircraft, raised questions as to the efficacy of the method of appointing TCs by the SAAA.^[29]

At the time of the accident, the SAAA also did not have a system in place to ensure inspections, including the ‘nuts and bolts’ inspections, were being completed on aircraft which were built using the SAAA processes. The TCs were supposed to complete reports to document their visits and inspections of the aircraft, but this was not formally monitored by the SAAA.

Regulatory oversight of Authorised Persons

The purpose of CASA surveillance was to ensure APs were issuing certificates in accordance with their instrument of approval. Their instrument of approval required that they issue certificates in accordance with the CASA Advisory Circular AC 21-4 and the SAAA AP Manual of procedures special certificate of airworthiness – experimental (amateur‑built) (manual), which was approved by CASA.

CASA inspectors were conducting regular surveillance on the APs. However, during these events, they were ensuring the APs were meeting the regulatory requirements but not ensuring that the requirements in the manual were being met. As such, they were not ensuring APs were receiving endorsed copies of the RRAv report. While the RRAV report was above the minimum requirements of the legislation, it was a requirement of the AP’s manual of procedures which in turn was a requirement of their instrument of approval.

The use of an Advisory Circular (AC) as a mandatory item in the instrument of approval introduced an element of uncertainty in the process. AC 21.4, in particular, was written for a number of different audiences and created uncertainty around which inspections were required and which were recommended.

Other countries with similar systems to Australia for the certification of amateur‑built aircraft had a requirement that evidence of independent inspections of the aircraft during the build process, be provided to the person conducting the assessment to issue the CoA. This was to ensure the integrity of the aircraft build had been maintained. The Australian system did not have this requirement.

Test pilot suitability

The AP advised that, while they did not name a specific pilot to conduct the flight test program in the limitations on the CoA, they had discussed a specific highly experienced test pilot with the builder and had this pilot in mind when they considered the limitations. That pilot was later unavailable to conduct the flight test program, so the builder engaged a new test pilot.

The accident pilot met the minimum requirements to test fly the aircraft. However, while they were a professional flight test engineer, they had significantly less pilot in command experience than the originally suggested test pilot, having accrued approximately 100 hours flying as pilot in command over 13 years.

When the builder arranged for the pilot to do the testing, they did not assess the pilot’s experience using the RRAv report. Use of the RRAV report would have provided an objective assessment of the pilot’s experience levels. Furthermore, the RRAv report would most likely have raised ‘concerns’ due to the pilot's recent flying and overall flying experience.

In addition, if the pilot had been named in the limitations on the CoA, the builder would have been required to advise the AP of the change. This would have provided the AP an opportunity to consider the pilot’s experience and discuss the test flying program with the pilot. They would also have had the opportunity to reassess the RRAV report and consequently whether they needed to reassess the limitations on the CoA.

__________

29. The SAAA advised that in 2017, issues around the depth of experience and currency of some TCs was recognised and a procedure (Criterion for the Appointment of a Technical Counsellor) was put in place. This was implemented after the builder was appointed as a TC.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving an Osprey 2 Amphibian aircraft, registered VH-WID, near Maitland Airport, New South Wales on 17 May 2020.

Contributing factors

• The use of a damaged fitting, which was not compatible with the installed, aged hose, most likely resulted in the hose disconnecting from the oil cooler during the climb and the loss of oil from the engine.
• During the descent to runway 23, the pilot elected to approach the reciprocal runway 05. This necessitated increased power from a damaged engine to maintain height and extended the time airborne.
• As the aircraft turned on to the base leg of the circuit for runway 05, the engine failed due to oil starvation.
• While attempting a forced landing, control of the aircraft was lost due to an aerodynamic stall at a height insufficient for recovery.

Other factors that increased risk

• Neither the recommended stage nor the final ‘nuts and bolts’ inspections were conducted. Additionally, the technical counsellor had not endorsed the risk radar aviation report and the authorised person did not detect that these inspections were not completed before the certificate of airworthiness certificate was issued, resulting in missed opportunities to improve the aircraft’s build quality.
• While the intention by Sport Aircraft Association of Australia was that an independent ‘nuts and bolts’ inspection with a technical counsellor was required, this was not clearly stated in the procedures applicable to the builder, and the authorised person.
• The Civil Aviation Safety Authority (CASA) had approved the system to allow the Sport Aircraft Association of Australia authorised person to issue a special certificate of airworthiness - experimental (amateur-built). This system required the authorised person to receive an endorsed risk assessment prior to the authorised person’s inspection. However, during surveillance activities, CASA inspectors did not assess that these risk assessments were complete.
• The builder did not use the Sport Aircraft Association of Australia 'risk radar aviation' (RRAv) assessment report to establish the risk for the accident pilot to conduct the test flying. Use of the RRAv report would most likely have raised ‘concerns’ due to the pilot's recent, and overall, flying experience.
• The Sport Aircraft Association of Australia's Manual of Procedures for the authorised person (approved by CASA) required, and Advisory Circular 21.4 recommended, that the proposed test pilot's experience be assessed when considering limitations placed on a certificate of airworthiness. However, the pilot was not required to be named and therefore there was no means of ensuring the test pilot would be re-assessed if they were changed after the certificate was issued.

Safety action

Proactive safety action Sport Aircraft Association of Australia

The SAAA have:

• written to CASA to request an urgent 1-day refresher training course for all authorised persons (AP)
• requested that CASA provide annual refresher training and require that an AP must attend at least once every 3 years
• advised APs that they are not required to issue a CoA if they are of the opinion that operation of the aircraft would present an unacceptable risk
• amended their procedures to require 3 stage inspections be completed during an aircraft build (this is inclusive of the final ‘nuts and bolts’ inspection). They have amended the Technical Counsellor Handbook – now TC manual, including that the TC must submit reports to the SAAA and use the risk radar checklist to conduct the inspection
• submitted a revised Authorised Person Manual of Procedures to CASA. This reinforces that RRAv form must be ‘completed and executed’ which means signed with comments from both builder and an independent TC. It also required:
  • that the AP receive 3 TC visit reports – one of which may be the final TC ‘nuts and bolts’ inspection – if these are not available the AP must request an independent inspection by a licenced aircraft maintenance engineer or equivalent
  • the test pilot be named in the limitations contained within the certificate of airworthiness and if the pilot is changed, the authorised person needs to be informed
  • any structural change or damage repair to the aircraft during the ‘phase 1’ testing are to be notified to the AP and written authorisation is required before flying can continue
  • if the AP considers it is not safe to issue a certificate they can refer the matter to CASA.
• specified that a technical counsellor or an authorised person are not permitted to inspect their own aircraft
• updated the Risk radar aviation report signature blocks
• written a new booklet ‘Construction of Amateur-built experimental aircraft’ to include information on the risk radar aviation report (this clarifies that the RRAv is required however it does not state it must be endorsed by a TC)
• updated the Member’s Handbook to explain how to use the risk radar and require its use to create checklists
• requested that CASA provide summaries of the audits conducted by authorised persons to ensure they are made aware of developing issues

SAAA intend to:

• further review and update the SAAA Member handbook to ensure any matters referred to unequivocally describe the steps and processes an owner / builder of an aircraft should follow through construction, obtaining an experimental certificate of airworthiness, and managing flight operations through the Phase 1 flight testing phase
• publish a new topic in the Builder CoA pack regarding ‘Nominating your test pilot(s)’
• develop a visual guide that sets out the essential process and requirements a builder needs to observe through the build of an aircraft
• all documents will be updated to reflect the findings in this report.

Glossary

AC        Advisory Circular

AP        Authorised Person

BAP     Builder’s Assist Program

CAA     Civil Aviation Authority

CASA   Civil Aviation Safety Authority

CoA     Special certificate of airworthiness – experimental (amateur-built)

CTAF    Common Terminal Area Frequency

DNMS  Delegate Notification Management System

EST      Eastern Standard Time

FAA      Federal Aviation Administration

LAME   Licenced Aircraft Maintenance Engineer

NZ       New Zealand

PFA     Popular Flying Association

RRAv   Risk Radar Aviation

SAAA   Sport Aircraft Association of Australia

SACAA South African Civil Aviation Authority

TC        Technical Counsellor

UK        United Kingdom

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• owner/builder of aircraft
• authorised person
• engine rebuild workshop
• Sport Aircraft Association of Australia
• Civil Aviation Safety Authority
• New South Wales Police Force
• accident witnesses
• video footage of the accident flight
• OzRunways flight data
• engine manufacturer
• Air Accidents Investigation Branch, United Kingdom

References

CASA (Civil Aviation Safety Authority) (2000), Advisory Circular 21.4(2), Amateur-built experimental aircraft – certification, September 2000, Australia.

CASA (Civil Aviation Safety Authority) (2019) Advisory Circular 21.47(1.1), Flight test safety, March 2019, Australia.

CASA (Civil Aviation Safety Authority) (2019) Advisory circular 21-10 v 4.2, Experimental certificates, March 2019, Australia.

FAA (Federal Aviation Administration) (2015) Advisory Circular 90–89B, Amateur-built aircraft and ultralight flight testing handbook, April 2015, United States.

FAA (Federal Aviation Administration) Advisory Circular 43.13-1B, Acceptable methods, techniques, and practices–aircraft inspection and repair, September 1998, United States.

FAA (Federal Aviation Administration) (2009) Advisory Circular 20–27G, Certification and operations of amateur-built aircraft, September 2009, United States.

CAA (Civil Aviation Authority) New Zealand (2014) Advisory Circular 21-4, Special category – Amateur-built aircraft airworthiness certificates, February 2014, New Zealand.

CAA (Civil Aviation Authority) United Kingdom (2005) Civil Aviation Procedure 659, Amateur built aircraft A guide to approval, construction and operations of amateur built aircraft, November 2005, United Kingdom.

CAA (Civil Aviation Authority) South Africa (2017) Technical Guidance Material, Amateur-built aircraft guidance material for constructing and certification of an amateur-built aircraft, December 2017, South Africa.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• owner/builder of aircraft
• authorised person
• engine manufacturer
• Sport Aircraft Association of Australia
• Civil Aviation Safety Authority
• New South Wales Police Force
• National Transportation Safety Board, United States
• Air Accidents Investigation Branch, United Kingdom

Submissions were received from:

• owner/builder of aircraft
• Sport Aircraft Association of Australia
• Civil Aviation Safety Authority
• Air Accidents Investigation Branch, United Kingdom

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Acknowledgements

The ATSB acknowledges the significant assistance provided by the Sport Aviation Association of Australia throughout the investigation and the safety action they have undertaken in response to this accident.

Appendices

Appendix A – Summary of Sport Aircraft Association of Australia reference handbooks available to a builder in 2017–2018

Appendix B – Summary of comparable international amateur‑built aircraft systems

United States Federal Aviation Administration (FAA) publication AC 20-27G Certification and Operation of amateur-built aircraft stated that, while aircraft were not inspected by the FAA during the build, the aircraft was inspected for general airworthiness before a certificate of airworthiness was issued. They also required evidence of inspections conducted by an Experimental Aircraft Association technical counsellor, certified mechanic or other builders/commercial assistance providers during construction. The FAA could refuse to issue a certificate of airworthiness if it was considered that the aircraft was unsafe to fly.

Civil Aviation Authority of New Zealand (CAA NZ) AC 21-4 Special category – Amateur-built aircraft airworthiness certificates advised that the builder should contact CAA NZ prior to commencing the project. It also stated an aircraft was not inspected by the CAA NZ during the build, however evidence of inspections conducted during the construction of the aircraft was required including mentor visits and vital point inspections.[1] Vital point inspections should be carried out by an appropriately rated licenced aircraft maintenance engineer, mentor appointed by Sport Aircraft Association of New Zealand, or a person nominated by the builder who was acceptable to CAA NZ.

South Africa Civil Aviation Authority (SACAA) Technical guidance material Guidance material for constructing and certification of an amateur-built aircraft advised that builders must register that they are commencing a build project with the SACAA. To receive an authorisation to conduct a ‘proving flight’, the builder must supply evidence describing the inspections which were conducted during the build. The SACAA may conduct an inspection of the aircraft to enable the applicant to demonstrate compliance, including examination of the aircraft builder’s logbook and the completed aircraft.

United Kingdom Civil Aviation Authority (CAA) Civil aviation publication (CAP) 659 Amateur-built aircraft A guide to approval, construction and operation of amateur built aircraft advised that an amateur‑built aircraft could not qualify for a certificate of airworthiness as it had not been designed and constructed by an appropriately qualified organisation. However, an amateur‑built aircraft could receive a permit to fly. To do so, the builder must register with the CAA or Popular Flying Association (PFA) before the project was commenced. The CAA, or PFA, appointed a licenced engineer, or similar, to oversee the project. They approved the design of the aircraft, and inspected the premises it was to be built, and then conduct inspections as required. The licenced engineer had responsibility for the quality and design of the aircraft. 

__________

29. Vital point inspection means an inspection carried out to ensure the correct assembly and functioning of a structural item or component, the failure of which would cause structural collapse or loss of control.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 22 December 2019, the crew of a Cessna 172R aircraft, registered VH-YXZ and operated by Hartwig Air, was conducting aerial shark patrols. The aircraft departed Parafield, South Australia for the second flight of the day and flew along the coast to Goolwa Murray Mouth, returning along the same route.

About 2 hours into the flight, the crew started to experience symptoms typically associated with carbon monoxide (CO) poisoning, and subsequently observed a localised discolouration on the disposable CO chemical spot detector. The pilot notified air traffic control, who offered the pilot to land at Adelaide Airport. The pilot initially agreed, but as their symptoms resulted in confusion about the runways at Adelaide Airport, they subsequently decided to fly to Parafield, due to their familiarity with that airport.

The aircraft was landed safely and the three crew were taken to hospital for assessment. Blood tests confirmed all crew had mildly elevated carboxyhaemoglobin levels.

What the ATSB found

The ATSB found that, despite having only mildly elevated carboxyhaemoglobin levels, the crew’s physical symptoms and cognitive effects likely resulted from exposure to elevated CO levels in the aircraft cabin. The CO source within the aircraft could not be established. Further, the discrepancy between the low carboxyhaemoglobin levels and severity of experienced effects could not be resolved.

Safety message

Carbon monoxide is a colourless and odourless gas, and its presence may not be detected until the physical symptoms and cognitive effects are more developed. Therefore, operators and owners of piston‑engine aircraft are strongly encouraged to install a CO detector with an active warning to alert pilots to the presence of elevated levels of CO in the cabin. Should any smell or sensation of illness develop, pilots should check their CO detector, ensure cabin heat has been turned off, open all fresh air vents and windows, make prompt decisions to land as soon as possible, and use all available resources for assistance. Further information on CO poisoning and detectors can be found at the following:

Are you protected from carbon monoxide poisoning?

Carbon Monoxide: A Deadly Menace

The investigation

The occurrence

On the morning of 22 December 2019, the crew of a Cessna 172R aircraft, registered VH-YXZ and operated by Hartwig Air, was being operated on an aerial shark patrol flight under visual flight rules.^[1] The three crew on board included the pilot, a communications officer^[2] and an observer.

The morning consisted of two flights, flying the same route along the coast. At about 1000 Central Daylight-saving Time,^[3] the first flight departed Parafield Airport, South Australia, and proceeded along the coast to Goolwa Murray Mouth, before returning along the same route (Figure 1). This flight went for about 2.75 hours, which was longer than expected. This resulted in limited time for the crew to refuel the aircraft, conduct all the checks and ground runs, and have a lunch break prior to the second flight.

At about 1330, the aircraft departed Parafield Airport for the next flight. While overhead Sellicks Beach on the return leg, and about 2 hours into the flight, the communications officer became sick, followed shortly thereafter by the pilot. The crew discussed their sickness and dismissed it on the assumption that it was likely due to turbulence encountered while flying across the hills.

After passing Port Noarlunga, the pilot looked down and observed a localised discolouration on the disposable carbon monoxide (CO) chemical spot detector. The communications officer, sitting in the front right seat, verified the discolouration on the detector and all the crew confirmed they were feeling light-headed.

The crew immediately opened the windows and confirmed that the aircraft’s heating was turned off. The crew reported that, due to smoke haze in the area from the Cudlee Creek bushfire, they experienced no relief from this action and began to feel worse. The pilot noted losing periods of time, had begun to lose feeling in their legs, experienced chest pains, and had a tingling feeling in their hands.

The pilot contacted Adelaide air traffic control, notified the controller of potential CO poisoning and requested a clearance to fly direct to Parafield. The controller offered the pilot direct to Adelaide Airport for runway 30, to which the pilot initially agreed. The pilot then decided to fly to Parafield due to their familiarity with the airport, as their light-headedness had become worse and resulted in confusion about the runways at Adelaide.

The pilot continued to experience confusion for the rest of the flight, including with radio calls, however, the aircraft was landed safely at Parafield. The three crew were subsequently taken to hospital for a medical examination (refer to section titled Medical information).

Figure 1: Aircraft’s flight path (in white)

Source: Google earth, annotated by the ATSB

Context

Medical information

Physical symptoms and cognitive effects experienced

The crew all reported experiencing nausea, headaches, fatigue and light headedness. Individually, the pilot experienced memory loss, confusion, a numbness/tingling sensation in their extremities, chest pains and mildly blurred vision. The observer reported experiencing chest pains, fatigue and breathlessness, while the communications officer reported vomiting.

The crew did not experience any eye irritations and did not detect a strong smoke smell while flying. They also did not identify a significant difference in the strength of the smoke odour while on the ground, compared with in the air. Both the communications officer and the observer did not recall a smoke odour on their clothing after the flight, however, the pilot recalled a slight odour on their shirt when they got home.

General health and fitness

With respect to their health and fitness, the crew reported that:

• All crew felt well, were well-rested prior to the first flight, and were fit and healthy.
• Both the pilot and the observer had a light breakfast. The communications officer could not recall if, or what they had for breakfast. The crew all had a light lunch prior to the second flight.
• The crew were non-smokers, were not taking any medication, and did not have any pre‑existing conditions that could have contributed to the incident.
• The communications officer reported being prone to motion sickness, particularly on an empty stomach.
• The observer felt a bit more tired than usual after the first flight. The pilot felt okay after the first flight but recalled having a slight headache. The communications officer felt fine.

Dehydration

The crew reported drinking minimum amounts of water prior to the flight and only having small sips during the flight. Specifically, the pilot had some water before the flight and also sipped water during the flight. The observer had not drunk any water during the morning before the flight but took regular small sips during the flight. It was unknown if the communications officer had drunk any water prior to the flight.

In addition, the pilot and observer reported having not consumed any alcohol or drugs in the 24 hours leading up to the flight. The communications officer had a slight headache from drinking alcohol the night before but was fit to fly.

Dehydration is caused by excessive water loss. Causes include alcohol and caffeine consumption; and as both create a diuretic effect, working in the heat before flying and by not drinking enough water (Flight Safety Foundation, 2001). Symptoms of dehydration can include fatigue, nausea, elevated pulse and respiratory rate, headache, dizziness and confusion.

Medical examinations

Blood samples were taken approximately 3 hours after the crew’s initial physical symptoms and cognitive effects were detected. The results of these tests established that the crew had mildly elevated levels of carboxyhaemoglobin (COHb). Both the pilot and communications officer had levels of 1.2 per cent and the observer had 1 per cent. The crew declined the administration of oxygen while at hospital.

Carbon monoxide is an odourless, colourless and tasteless gas formed by the incomplete combustion of carbon-containing materials. When inhaled, it preferentially binds to haemoglobin, the oxygen carrying molecule in red blood cells. This creates COHb compounds and prevents oxygen from binding to the molecule and being transported, resulting in oxygen starvation.

According to Baselt (2014), normal endogenous levels of COHb are generally reported to fall within the range of 0.4-0.7 per cent. Smokers, and those living in an urban area, may have higher than average levels of COHb. Carbon monoxide has a half-life of 4-5 hours at sea level, meaning that the COHb will reduce to half its initial value within that time, after the source of CO has been removed. The CO half-life can be reduced to 80 minutes with the administration of pure oxygen.

The physical symptoms and cognitive effects of CO poisoning can worsen with an increasing level of COHb, however, different individuals’ reactions to a given COHb level can vary (Lacefield et al., 1982). Typically, COHb levels of 10-20 per cent can result in symptoms of a mild headache. Levels of 20-40 per cent can result in increasing severity of headaches, irritability, mental changes, fatigue, weakness, nausea, dizziness, visual problems and confusion (Knobeloch & Jackson, 1999; Lacefield et al., 1982). Though physical symptoms do not generally show at levels below 10 per cent, researchers have found that a person’s ability to perform complex tasks can be adversely affected at levels of 10 per cent or less (Baselt, 2014). It has also been found that the effects of CO can begin to show with the deterioration of psychomotor function at COHb levels of about 3 per cent (Hawkins, 1993).

Given the half-life of CO and elapsed time since the symptoms and effects were first detected, it was likely that the crew’s COHb levels were a maximum of approximately 2 per cent. For the crew to have obtained a saturation level of 2 per cent COHb, according to Baselt (2014), they would have been exposed to 200 parts per million (ppm)^[3] for about 2 hours, not taking into account the break between flights. The maximum exposure level, as recommended by Safe Work Australia, is 30 ppm over an 8-hour period.

Aircraft maintenance

A new engine was installed on the aircraft 10 days prior to the incident. An inspection was conducted during this process and no faults were found that would relate to a possible exhaust leak.

Immediately after the incident, an inspection was carried out on the aircraft, focusing on the exhaust system and airframe, including the firewall and door seals. No faults or exhaust gas leaks were found. The aircraft was not tested for CO leaks prior to the inspection. However, there were no reports or maintenance release entries made prior to the incident that indicated a possible exhaust leak. Further, the pilot who operated the aircraft the day before the incident reported not feeling any adverse health effects during the flight.

After the inspection, ground runs were conducted with a digital CO detector in the aircraft cabin. No indications of CO were found during the ground runs or during a subsequent check flight.

Environmental conditions

Bureau of Meteorology

The Bureau of Meteorology 1-minute observation data at Adelaide Airport, indicated the surface wind was variable, blowing to the south-west with wind speeds between 5-13 kt, and the temperature was 24 °C.

On the day of the incident, a bushfire was burning at Cudlee Creek, 16 km south-east from Parafield Airport and 40 km from the coast. The fire had grown to 25,000 hectares in size. There were also two small fires burning on Kangaroo Island to the south-west of Adelaide. However, given the wind conditions on the day, it was unlikely that these fires would have contributed to the smoke haze in Adelaide.

Throughout the flight, the crew reported the visibility was approximately 6 km due to smoke haze from the bushfire and that this remained constant. The visibility in the routine aerodrome weather report^[4] for Adelaide and Parafield were recorded as CAVOK^[5] and above 10 km respectively, throughout the day. The Adelaide Airport automatic terminal information service ^[6] reported smoke haze to the north-east of the airport.

The South Australian Environment Protection Authority recorded CO levels in the Adelaide central business district at ground level of 0.46 ppm at 1500. The average was 0.29 ppm from 1000 to 1600.

Bushfire smoke

The ATSB engaged the Commonwealth Scientific and Industrial Research Organisation (CSIRO) Climate Science Centre who were conducting research into the effects of bushfire smoke on firefighters. CSIRO reported that CO disperses in the air and high CO concentrations of about 400 ppm are generally correlated with low visibility of only a few metres. They noted that, to have CO poisoning with the effects the crew reported after 3 hours, the crew would have been exposed to very high levels. They also advised that, given the distance to the fire and the fact that there was no strong smell of smoke experienced by the crew, the CO concentrations in the plume would not have been elevated enough to cause adverse health effects.

The ATSB also engaged the South Australian Country Fire Service to determine if any of their aircrew had experienced similar symptoms while conducting aerial firefighting on the day of the incident. They reported that none of their aircrew had experienced any CO effects during this fire or during any other fires in the past.

The possibility of other toxins in the bushfire smoke that may have potentially led to the crew’s partial incapacitation were also considered. CSIRO advised that typically, if the concentrations were high enough to cause adverse health effects, one of the main symptoms would be irritation in the eyes and throat. The crew did not report any irritations nor a strong smoke smell, therefore, it was unlikely that other toxins in the smoke led to their symptoms.

Carbon monoxide detector

The aircraft was fitted with an Aviation Supplies and Academics disposable CO chemical spot detector, attached to the centre of the instrument panel. The detector consisted of an orange‑coloured circle (spot) in the middle of the card, which was designed to change colour to grey/black following a chemical reaction with CO in the immediate vicinity. The spot then returns to normal (orange) after it has been exposed to fresh air. The chemical reaction depends on the concentration of CO in the air and the time of exposure. This detector was designed to react to a minimum of 50 ppm of CO within 30 minutes, 100 ppm within 10 minutes and 200 ppm within 4 minutes.

A limitation of this type of detector is that it does not actively alert the pilot to the presence of CO. Therefore, its effectiveness relies on the pilot regularly monitoring the detector throughout the flight. It is also dependent on the detector being easily visible and accessible, in a well-lit position. In a low ambient light environment, the discolouration of the chemical spot, from orange to a grey/black colour, can be difficult to see. 

Similar occurrences

ATSB investigation (AO-2017-118)

On 31 December 2017, the pilot and five passengers of a de Havilland Canada DHC-2 floatplane, registered VH-NOO, boarded the aircraft for a charter flight from Cottage Point to Rose Bay, New South Wales. The aircraft taxied for about 7 minutes. Shortly after take-off, the aircraft deviated from the standard flight path, stopped climbing, and entered a confined area (Jerusalem Bay) below the height of the terrain. The aircraft continued along the bay before making a very steep right turn and colliding with the water. All on board were fatally injured and the aircraft destroyed.

Toxicology results identified that the pilot and passengers had higher than normal levels of COHb in their blood. This was almost certainly due to elevated levels of CO in the aircraft cabin. The ATSB’s wreckage examination established that several pre-existing cracks in the exhaust collector ring, very likely released exhaust gas into the engine/accessory bay. This then very likely entered the cabin through holes in the main firewall where three bolts were missing from the magneto access panels.

ATSB investigation (AO-2020-055)

On 23 September 2020, the pilot of a Piper PA-28 aircraft, registered VH-TBB, departed Moree, New South Wales on a private ferry flight to Tamworth. Shortly after take-off, the pilot started to experience dizziness, breathlessness, and a warm feeling in the chest. The pilot conducted a visual scan and observed a discolouration on the disposable CO chemical spot detector that was gradually getting darker. The pilot opened the air vents and storm window and returned to Moree. The investigation is ongoing.

National Transportation Safety Board investigation (CEN17LA101)

On 2 February 2017, shortly after take-off, the pilot of a Mooney M20C aircraft became incapacitated. The aircraft continued flying until running out of fuel and then collided with terrain near Ellendale, Minnesota, United States. The pilot survived the accident but had no recollection of events between becoming incapacitated and waking up on the ground. The National Transportation Safety Board investigated the accident and concluded that the pilot’s incapacitation was due to CO poisoning.

The pilot reported using the aircraft’s heater throughout the day and having a headache and experiencing ‘butterflies’ in their stomach by the end of the first flight. The symptoms subsided after the first flight but returned after landing on the second flight. The symptoms were still present on the third flight and the last event the pilot remembered was being cleared to climb to 6,000 ft by air traffic control.

A post-accident inspection revealed several cracks in the exhaust muffler. The pilot’s COHb level, taken 4.5 hours after the accident, was 13.8 per cent. However, given the half-life of CO, the pilot’s level would have been at least 28 per cent at the time of the accident. In response to the experience, the pilot stated that:

Current technology has made portable CO detection very accurate and expensive. A high-resolution detector would have not only prevented this accident flight but may have alerted me to a comprimise [compromise] in my exhaust system many flight hours before the incedent [incident].

Analysis

Partial crew incapacitation

The observed physical symptoms reported by the crew were consistent with CO poisoning. This was supported by their blood tests, which established that they had mildly elevated levels of COHb adjusted to 2 per cent, and the positive indication on the CO detector in the aircraft’s cabin. Although, the extent of these symptoms was inconsistent with the literature and would generally be associated with COHb levels between 20-40 per cent. However, research has shown that adverse effects on cognitive functions can occur as low as 3 per cent and different individuals’ reactions to a given COHb level can vary.

While it was noted that a level of dehydration and possible motion sickness may have exacerbated the crew’s symptoms, this would not account for the elevated COHb levels.

Source of carbon monoxide

The ATSB considered the likely sources of CO, including cigarette smoke, bushfire smoke, and the aircraft. None of the crew were smokers and the reported visibility throughout the day indicated a relatively modest amount of smoke pollution. Further, as high concentrations of CO in bushfire smoke are generally associated with low visibility of only a few metres, it was unlikely that the smoke haze observed by the crew was sufficient to result in adverse health effects. This was consistent with the low CO levels recorded in Adelaide.

Therefore, the most likely source of CO was from the aircraft. There were no indications of a potential exhaust leak prior to the flight and the post-flight testing found no fault with the aircraft. Although it was possible that, by disassembling the aircraft prior to testing, an existing problem was masked. However, despite the unresolved inconsistency with measured CO levels and in the absence of other sources, it was likely that the crew were exposed to elevated levels of CO in the aircraft cabin. Therefore, it was likely that the crew’s symptoms were associated with CO poisoning.

Findings

From the evidence available, the following findings are made with respect to the partial incapacitation of the crew involving a Cessna 172R, registered VH-YXZ that occurred 44 km south of Adelaide Airport, South Australia on 22 December 2019.

Contributing factors

• It was likely that the flight crew were exposed to elevated levels of carbon monoxide in the aircraft cabin, which likely contributed to them experiencing mild incapacitating symptoms and effects.

Other findings

• The source of the carbon monoxide could not be determined.

Safety actions

Carbon monoxide education

As a result of this incident, the operator has advised the ATSB that they will:

• Install additional CO detectors in all aircraft, in both the cockpit and in the back of the cabin.
• Brief all pilots on the effects of CO poisoning, using the audio of the incident pilot’s radio calls to help demonstrate these effects.
• Instruct pilots to monitor both the instrument panel-mounted CO detector and the domestic electronic detector, with the instruction to land as soon as possible should the presence of CO be detected,
• Adjust the rosters to ensure that shark patrol flights were split into two shifts and separated by a few hours to assist in the dissipation of any CO that may have started to accumulate in the flight crew’s bodies.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the crew
• Hartwig Air
• Gulfstream Aviation (aircraft maintainer)
• Commonwealth Scientific and Industrial Research Organisation (CSIRO)
• South Australian Country Fire Service.

References

Baselt, R.C. (2014). Disposition of Toxic Drugs and Chemicals in Man (10th ed.). Seal Beach: Biomedical Publications.

Flight Safety Foundation. (2001). Dehydration Presents Unique Risks for Pilots. Human Factors and Aviation Medicine, 48(4):1-6. Retrieved from https://flightsafety.org/hf/hf_jul-aug01.pdf

Hawkins, F. H. (1993). Human Factors in Flight (2nd ed.). Aldershot, England: Ashgate Publishing.

Knobeloch, L & Jackson, R. (1999). Recognition of Chronic Carbon Monoxide Poisoning. Wisconsin Medical Journal, 98(6):26-9. Retrieved from https://www.researchgate.net/publication/12696822_Recognition_of_chronic_carbon_monoxide_poisoning

Lacefield, D. J., Roberts, P. A., & Grape, P. M. (1982). Carbon monoxide in-flight incapacitation: An occasional toxic problem in aviation (FAA-AM-82-15). Oklahoma City, Oklahoma: Federal Aviation Administration.

Safe Work Australia. (n.d.). Exposure Standard Documentation: Carbon monoxide. Retrieved from http://hcis.safeworkaustralia.gov.au/ExposureStandards/Document?exposureStandardID=111

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the crew
• Hartwig Air
• Gulfstream Aviation.

Submissions were received from:

• the crew.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Visual flight rules: a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
2. The communications officer’s role was to contact the police in the event a shark was spotted.
3. The concentration of CO in the air is represented as parts per million.
4. METAR: a routine aerodrome weather report issued at routine times, hourly or half-hourly.
5. CAVOK ceiling and visibility okay: visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather.
6. Automatic terminal information service (ATIS): continuous broadcast of recorded aeronautical information. ATIS broadcasts contain essential information, such as current weather information, active runways, available approaches, and any other information required by flight crew.

Safety summary

What happened

On 11 May 2020, a Fairchild SA227-DC Metro 23 (Metro) aircraft, registered VH-HPE and operated by Toll Aviation, was being loaded for its scheduled freight service from Townsville to Rockhampton then Brisbane, Queensland. The pilot was the only person on board.

The pilot completed a load and trim sheet, which indicated that the planned load was not within the allowable centre of gravity limits. It was agreed that 126 kg of freight would be moved from compartment three to the nose compartment. The revised load and trim sheet indicated the centre of gravity to be within the limits. During the flight to Rockhampton, the pilot observed that the aircraft felt tail heavy, but did not experience any controllability issues.

Due to the concern of an aft centre of gravity, the additional freight loaded at Rockhampton was limited, which was still within the calculated allowable centre of gravity limits. On take-off from Rockhampton, the pilot reported that the aircraft had a strong pitch-up tendency and that strong forward pressure on the flight controls was required to maintain the correct pitch attitude. During the cruise, the autopilot would not consistently maintain level flight. The pilot disconnected the autopilot and with full nose-down trim applied, the pilot had to maintain forward pressure to control the pitch attitude of the aircraft. The aircraft continued to Brisbane and the pilot reported that no problems were experienced during the approach and landing.

What the ATSB found

The ATSB found that, the ground handlers at Townsville did not accurately weigh the freight relocated into the nose compartment, but rather, it was estimated by feel. This resulted in an inaccurate load and trim sheet, and the centre of gravity being further aft than expected. Therefore, when additional freight was loaded in Rockhampton, this unknowingly moved the centre of gravity beyond the rear limit, leading to the pitch-up tendency experienced by the pilot.

Although not contributory, the operator’s paper-based load planning tool used by ground handlers for the Metro did not account for the centre of gravity position. Rather, this was later determined by the pilot on the load and trim sheet, which was potentially completed after loading had commenced. This increased the chance of freight having to be relocated and the potential for loading errors to occur.

It was also identified that the operator’s ground handling manual did not contain sufficient procedural detail to facilitate the accurate redistribution of freight. In particular, there was no guidance on conducting last-minute changes or taking into account the centre of gravity when preparing a load plan to ensure that an aircraft would be correctly loaded.

What has been done as a result

Following the incident, the operator amended their ground handling processes and included increased direction to ensure that freight would be accurately redistributed in the event of a last-minute change. The operator has since relinquished their Civil Aviation Safety Authority’s Air Operator’s Certificate and divested their flying operations to another operator. The new Metro aircraft operator also considered the findings of this investigation, reviewed their ground handling manual and incorporated amendments to ensure that an aircraft would be correctly loaded.

Safety message

This incident demonstrates the critical nature of load control and the requirement to ensure an aircraft is correctly loaded and the centre of gravity is within the allowable limits. It also emphasises the importance of providing ground handlers with sufficient and detailed procedures to allow them to accurately conduct load control duties and minimise the potential for error.

The occurrence

Townsville–Rockhampton

On 11 May 2020, a Fairchild SA227-DC Metro 23 (Metro) aircraft, registered VH-HPE and operated by Toll Aviation, was being loaded for its scheduled freight service from Townsville to Rockhampton then Brisbane, Queensland. The pilot was the only person on board.

The pilot signed on for duty at 1700 Eastern Standard Time^[1] and shortly after commenced pre‑flight preparations of the aircraft. The loading process had already commenced by that time and was about half complete when the ground handlers provided the load plan to the pilot.

The pilot then completed a load and trim sheet and ascertained that the planned load was aft of the rear centre of gravity limit. The pilot advised the ground handlers that the load was too heavy in compartment (zone) three and that some of that freight be moved to the nose compartment.

A team of four ground handlers were loading the aircraft, none of which were designated as a supervisor. One ground handler suggested to the pilot that 126 kg could be moved from compartment three into the nose compartment, leaving 300 kg in zone three. The pilot agreed, provided this could be achieved, having noted that the nose compartment was much smaller than the remaining compartments in both size and weight limit (Figure 1).

The ground handler contacted their supervisor who was at the freight depot. The supervisor had completed and signed the load plan, and advised the ground handler to carry out the pilot’s request to move the load. The ground handler commenced loading freight into the nose compartment. The ground handler recalled that ‘the nose is small in space’ and that it will ‘only fit a certain amount of things in there’, so only loaded as many bags as they could, filling the nose to volume capacity. This freight was not weighed, but rather, estimated by feel as there were no scales available at the aircraft. The ground handler explained that the load change took place at about 1745 and that the aircraft was scheduled to depart at 1800.

The pilot asked the ground handler if the freight had been moved as requested and the ground handler confirmed it had been. Believing that the load distribution was correct as amended from the original plan, the pilot completed a new load and trim sheet, which indicated the centre of gravity to be within the limits.

Shortly after, the aircraft departed Townsville. During the flight to Rockhampton, the pilot indicated that the aircraft felt tail heavy, but did not experience any controllability issues.