On 26 January 2018, a Cessna Citation 560 aircraft, registration VH-PSU, was conducting a business flight from Brisbane to Townsville, Queensland. VH-PSU was operated by the State of Queensland, Public Safety Business Agency, with two flight crew and six passengers.
While passing through flight level (FL) 320[1], a loud noise was heard from the rear of the aircraft, along with the smell of smoke. The flight crew made a PAN PAN[2] call to air traffic control (ATC) and requested an emergency descent and return to Brisbane. The aircraft returned to Brisbane for an emergency landing and landed without incident.
An examination of the Pratt & Whitney Canada JT15D-5D engine, using borescope inspection, revealed the low pressure (LP) compressor (boost) rotor had lost an aerofoil and sustained some damage.
Operator’s investigation
Passing through FL320 on climb, the flight crew experienced (both heard and felt) a series of bangs from the rear of the aircraft. The pilot monitoring[3] (PM) immediately saw and smelt a slight mist of ‘acrid’ smoke in the cockpit. The PM donned his oxygen mask, immediately made a PAN PAN call to ATC and requested an immediate return to Brisbane and emergency descent. An immediate examination of engine and other system parameters indicated no other abnormalities. The pilot flying (PF) commenced the descent and turn back in accordance with ATC instruction, however, as he did not sense any smoke he did not immediately don his oxygen mask. This was a decision made so that he could maintain communications with ATC. Once satisfied that any immediate communications were carried out, he donned his mask and both crew kept their masks on until an altitude of 10,000 ft above mean sea level was reached. The PF elected not to deploy the passenger oxygen masks as there was no indication of smoke subsequent to that first noticed by the PM.
During the descent, the crew discussed the options of landing at Bundaberg or Sunshine Coast airports, but they were discounted in favour of Brisbane.
It was likely that the reduction in power necessitated by the emergency descent eliminated the smell and visual evidence of the smoke. However, the PM reported a very brief re-occurrence of the odour when power was reapplied upon gear extension at commencement of the approach into Brisbane.
Interviews with the crew after the occurrence revealed some inconsistencies in their recollections of the event, including what actions were immediately taken by whom. The inconsistencies had no direct impact on the safe outcome of the flight.
Examination of the aircraft in Brisbane revealed that the cause of the loud bangs was the failure of one of the aerofoils of the integrally bladed LP compressor (boost) stage rotor, which then exited the engine via the usual gas flow. Small globules of molten metal were found in the exhaust.
The engine was removed from the aircraft and sent to the owner[4] for initial disassembly. The relevant sections of the LP compressor were forwarded to the manufacturer in Canada for further examination and determination of the blade failure mechanism.
Engine owner’s report
Disassembly of the engine cold section (by the owner) revealed one aerofoil from the boost stage rotor (part number (PN) 3070232-01, serial number (SN) A0010EHB) had liberated and was found wedged in the trailing edge of the front inner LP compressor stator. The integrated disk did not have any impact damage in the area of the fracture. There was also no missing material upstream from the boost rotor other than the damage on the trailing edges of the LP compressor front inner stator. This indicated that the fracture was not initiated by impact damage, either foreign or domestic.
Secondary damage due to the aerofoil liberation was relatively extensive downstream of the LP compressor.
Manufacturer’s report
A general view of the boost rotor as received by the manufacturer can be seen in Figure 1. The aerofoils were arbitrarily numbered, beginning with number 1 at the fractured aerofoil. Figure 2 shows the damage on the aerofoils around the fractured one (nicks on the aerofoils are shown with arrows). Nicks, dents and deformation along the leading edge of all the aerofoils was observed, as well as rubbing and deformation along their tips. Dimensional analysis was performed on aerofoils 1, 2, 13, 25, 38 and 50. The aerofoil break edges were within requirements but the trailing edge root radius were all below minimum requirements.
Nicks, plastic deformation and foreign surface contamination were visible on the other aerofoils; they were likely the result of the release of the fractured aerofoil. The composition of the contamination on aerofoil 2 was consistent with projections of abradable coating, likely due to the rubbing that followed the aerofoil release.
Figure 1: Upstream view of the low-pressure compressor boost rotor
Source: Pratt & Whitney Canada
Figure 2: Boost rotor showing missing aerofoil and surrounding damage
Source: Pratt & Whitney Canada
The (Figure 2, number 1) aerofoil fracture surface showed river marks (Figure 3, dashed arrows) and beach marks (Figure 3, arrowed), consistent with fatigue cracking. The markings indicated that the fatigue likely initiated at the trailing edge area along the pressure side and progressed towards the leading edge. The exact location of the fatigue origin could not be determined since the rubbing of the mating surface damaged the area. No anomalies were observed near the origin.
Figure 3: Magnified view of the aerofoil fracture surface
Aerofoil fracture surface showed crack progression lines from the trailing edge (white dashed arrows) along with beach marks (yellow arrows) which were indicative of a fatigue failure mechanism. Source: Pratt & Whitney Canada
The manufacturer then examined the fracture surface using a scanning electron microscope. Observations included river lines, and striations, which indicated local crack propagation direction. The final fracture area exhibited a dimpled fracture surface typical of tensile overstress. No material anomalies were identified.
A cross-section examination of the fractured aerofoil was performed; the microstructure conformed to specifications and there was no evidence of material anomaly.
The manufacturer’s report concluded that the aerofoil fractured as a result of fatigue cracking progressing from the trailing edge, pressure side towards the leading edge. The exact origin of the fatigue crack could not be determined, and no evidence of damage or material anomaly was found near the suspected origin area. The deviation observed at the trailing edge root radius (below dimensional requirements) was not believed to be a contributing factor to the crack initiation.
History of the component
The engine (SN JC0580), including the LP compressor (boost) rotor (PN 3070232-01), was manufactured in October 2001. It had completed 3,126.6 flight hours since new and 3,122 flight cycles since new. The engine was installed on the left side of VH-PSU on 25 October 2017 and had completed 27.2 flight hours since that time.
The maintenance manual did not contain any periodic inspections for the boost rotor, however, there was a requirement to inspect both the impeller and the boost rotor before a hot section inspection (recommended every 1,750 hours). No other maintenance was required to be performed on the rotor until overhaul, at 3,500 hours’ time in service.
Engine SN JC0580 had undergone a hot section inspection in January 2009, and was not due for overhaul for another 373.4 hours’ time in service. There were no other maintenance entries where the boost rotor was accessed.
Between 1997 and 1999, the manufacturer reported they had investigated a number of events involving boost rotor aerofoil distress. The rotors had developed cracks, which had initiated at the trailing edge, at approximately 3,000 hours or less of operation. Several of the events were attributed to impact/mechanical damage or manufacturing deviations, while the others were fatigue cracks with no obvious signs of defects/damage. The location of the crack along the trailing edge was not always the same (varying heights above the platform). As a result of these events, Service Bulletin, SB 7569 Turbofan Engine, Low Compressor Rotor – Replacement/Modification Of, was introduced in November of 1999. The service bulletin introduced a new or reworked LP compressor rotor with a ‘cut-back’ at the trailing edge, which was designed to reduce the dynamic stresses. The entire rotor was to be removed and replaced with the new or modified rotor.
Several years after the rework was introduced, the manufacturer reported that some events occurred with the post SB 7569 rotors. Their investigation found that restoration of the trailing edge profile was not consistent following the machining cutback. This had the potential of leaving sharp edges, which in turn generated a stress riser. As a result, in 2004, service bulletin SB 7595 Turbofan Engine – Low Compressor Rotor – Replacement/Modification Of, was issued. This SB introduced a honing process to ensure a consistent aerofoil trailing edge profile.
Boost rotor SN A0010EHB was manufactured with the new design (post-SB 7569), and had been reworked in January 2009 to incorporate the honing process specified by SB 7595.
The manufacturer reported that they had received notification of five boost rotor distress events (including this event involving SN A0010EHB), since the introduction of SB 7595. The manufacturer investigated all these events, and in each case, failures were contained (that is, no liberated debris) and did not cause in-flight shutdowns. However, the ability to achieve full commanded thrust was compromised. For two events, it was determined that the rotor aerofoil fractured due to mechanical damage on the leading edge, and the other two events were similar to this one.
Safety analysis
The bangs and smoke experienced by the flight crew of VH-PSU were a result of a failure of a single aerofoil on the low-pressure compressor (boost) rotor. The aerofoil fractured as a result of a fatigue crack, which had initiated at the trailing edge on the pressure side, and progressed towards the leading edge until final fracture occurred. The exact origin of the fatigue crack could not be determined.
The boost rotor on JT15D-5D engines had a history of aerofoil distress, and a number of actions had previously been taken to address the issue. However, as a result of some additional events (including this one), the engine manufacturer commenced further work aimed at better understanding the distress mechanism.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
A single aerofoil on the low-pressure compressor (boost) rotor failed as a result of high-cycle fatigue cracking. A loud bang observed by the flight crew prompted a precautionary descent and return to the departure aerodrome.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Pratt & Whitney Canada
As a result of this occurrence, the engine manufacturer advised the ATSB that they are taking the following safety actions:
Proactive safety action
The Pratt & Whitney Canada engineering specialists formed a group to review the complete history of the boost rotor and boost rotor distress. An initial meeting was held to establish the data that would be required to assess what further activities (if any) would be performed. The data included fleet demographics (configuration of fleet with respect to boost rotor), boost rotor events, and when event rotors were modified to the various service bulletins.
The next meeting was scheduled for mid-September 2018 and the ATSB will update this report if any new information is received.
Public Safety Business Agency – Queensland Government Air
As a result of this occurrence, the operator advised the ATSB that they are taking the following safety actions:
Proactive safety action
The operator introduced a number of new training packages for flight crew including:
crew resource management for all pilots
line oriented flight training with reinforcement of the multi-crew coordination
a future line operations safety audit program.
Although some of this training was programmed, it was expedited following a review of the occurrence involving VH-PSU. The first tranche of crew resource management training was conducted prior to publication of this report.
Safety message
Operators and maintainers of Pratt & Whitney Canada JT15D-5D engines are alerted to the potential for aerofoil distress within the low-pressure compressor (boost) rotor. It is possible that, if not detected and addressed, this could lead to blade cracking and fracture. However, service experience has shown only three aerofoil distress and failure events since service bulletin SB 7595 was issued in 2004.
While blade separation will cause engine malfunctions, potentially leading to an inability to achieve full commanded thrust, the associated risks to the safety of continued flight are minor. Failures are very likely to be contained (that is, no liberated debris) and procedures for managing engine malfunctions are detailed and effective as shown in this occurrence.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 17 January 2018, at about 1700 New Zealand Daylight Time,[1] a Boeing 737‑800, registered VH-YIR and operated by Virgin Australia Airlines (Virgin), prepared to depart Auckland, New Zealand. The aircraft was operating scheduled passenger flight VA91 to Rarotonga, Cook Islands, with two flight crew, four cabin crewmembers and 135 passengers on board. Runway 05 right was in use and the wind direction and strength was from 040° true at 25 knots gusting to 38 knots. The captain was the pilot flying (PF) and the first officer was the pilot monitoring (PM).[2]
The flight crew prepared the take-off performance calculations and determined the take-off limit weight to be 76.7 t with an actual take-off weight of 75.0 t. The flight crew elected to use the 24,000 pound thrust rating for the reported weather conditions.
At about 1715, the PF commenced the take-off. During the take-off, the PF maintained a small amount of left aileron input for the crosswind. The aircraft accelerated to V1[3] and the automated V1 announcement sounded, shortly followed by the PM making the ‘rotate’ call at the rotation speed of 149 knots. During rotation, the PF felt a slight side-to-side movement of the aircraft’s tail, which he corrected with minor rudder input, and observed some fluctuation of the airspeed. The PF did not recall the PM announcing any variation in airspeed during the rotation. Just before the aircraft became airborne, the PF noticed the nose-up attitude of the aircraft was slightly higher than the target 8° pitch angle. The PM also recognised this and called out that the pitch attitude was high. As the main wheels left the ground, the flight crew felt a bump from the rear of the aircraft.
After the initial climb, the flight crew discussed the sequence of events and concluded that their observations were most likely the result of a tailstrike. The captain handed control of the aircraft to the first officer and called the cabin supervisor to verify their suspicion. The cabin crewmembers reported that there had been a very loud noise from the rear of the aircraft during take-off.
The captain then contacted air traffic control (ATC), informed them of the suspected tailstrike, requested a runway inspection and asked for the tower’s observations of the take-off.
The flight crew elected to stop the climb at 12,000 ft. Shortly after stopping the climb, ATC confirmed that the tower had not observed any abnormalities, and the runway inspection had identified no debris or damage to the runway.
The captain then called the Virgin ground operations duty manager to report the situation and seek input on whether an overweight landing be conducted or to continue a holding pattern to burn off fuel prior to return to Auckland. Subsequently, the captain elected to return to Auckland for an overweight landing. He then updated the cabin crew and made a passenger announcement advising of the intention to return to Auckland.
The aircraft returned to the airport where an overweight landing was conducted without further incident.
After shut-down, the captain monitored the off-loading of the bags and freight. The captain found that there were 10 fewer bags in the forward compartment of the cargo hold than detailed on the load sheet.
No persons were injured and the aircraft sustained minor damage in the incident.
Engineering inspection
An engineering inspection confirmed that the aircraft had sustained a tailstrike during the take-off. The damage was limited to a scratch on the tailskid shoe that was found to be within the allowable limits. An overweight landing check was completed and the aircraft was determined to be serviceable.
Recorded flight data
Analysis of flight data from the aircraft’s digital flight data recorder indicated the rotation occurred in gusty conditions with aircraft speed reducing during rotation. The data showed:
a reduction in airspeed of 7 knots (Figure 1), followed by a stagnation in airspeed (the groundspeed continued to increase over this period, indicating the change in airspeed was a result of the variation in headwind component, which reduced by up to 11 knots during rotation)
at lift-off, the pitch attitude of the aircraft was 10.55°
maximum pitch rate during the rotation was 3.5° per second
the average pitch rate during rotation was 2.4° per second
the aircraft was slow to lift-off the runway (6 seconds from the point of initial rotation).
Figure 1: VH-YIR take-off data
Source: ATSB
Flight crew training manual and Boeing guidelines
The operator’s 737 Flight Crew Training Manual provided the following guidance:
With a consistent rotation technique, where the pilot uses approximately equal control forces and similar visual cues, lift-off attitude is achieved in approximately 3 to 4 seconds.
A rotation rate of 2 to 3° per second is required to ensure adequate tail clearance is achieved on take-off.
At flaps 5 setting, the target attitude to achieve a 51 cm tail clearance to the runway is 8°.
Under gusty wind and strong crosswind conditions, do not rotate early or use a higher-than-normal rotation rate in an attempt to clear the ground and reduce the gust effect because this reduces the tail clearance margins (tail clearance).
The PM makes callouts based on instrument indications or observations for the appropriate condition. The PM should monitor engine instruments and airspeed indications during the take-off roll and announce any abnormalities.
Guidelines that relate to Boeing aircraft show that the following factors contribute to reduced tail clearance:
lateral control deflection
activation of flight spoilers, which reduces the amount of lift on the aircraft
average pitch rate above 2.5° per second
maximum pitch rate in excess of 4° per second.
Pilot’s comments
The captain stated that the runway in use had slowly rising terrain along the departure path, which created the visual illusion that the pitch attitude of the aircraft was lower than it actually was. He advised that this delayed his appreciation that the aircraft was approaching the pitch attitude where a tailstrike could occur.
The captain stated that during his initial training with the operator in 2012, a training captain had advised that he needed to increase the rotation rate on take-off. The captain advised that, because of this tail-strike, he has reduced his take-off rotation rate to ensure it is within the manufacturer’s recommended limits of 2 to 3° per second.
The captain also advised that, due to the crosswind conditions, significant control wheel input was required to keep the wings level. Even so, the aircraft became airborne with the right wing slightly lower than the left. The captain noted that in strong crosswind conditions, flight crews are required to make a quick decision on the compromise between keeping wings level and avoiding raising a spoiler, which has a corresponding loss of performance.
Operator’s comments
With respect to take-offs in strong crosswind conditions, the operator made the following comments:
The correct technique is as described below in the Boeing Flight Crew Training Manual:
Limit control wheel input to that required to keep the wings level. Use of excessive control wheel increases spoiler deployment, which has the effect of reducing tail clearance. All of these factors provide maximum energy to accelerate through gusts while maintaining tail clearance margins at lift-off.
In a swept wing jet aircraft additional momentary aileron input is often required after lift-off to maintain wings level until the control wheel can be neutralised and the aircraft direction controlled with rudder.
Training on crosswind take-offs is provided to pilots during each simulator session. The simulation is frequently conducted on a 30 m runway, which is more difficult than normal operations on a 45 m runway. Both take-off and landing simulations are conducted at maximum crosswind. Check and training captains assess that the correct procedures are used for the manoeuvres.
Crosswind technique is further reinforced during the supervised line training components of both intake and command upgrade training.
Safety analysis
Analysis of the flight data determined that, during rotation, as the aircraft continued to accelerate, a reduction in headwind resulted in an initial drop and then stagnation in airspeed until just after lift-off. The airspeed variations were reportedly not identified and called out by the PM, as required in the flight crew training manual. Stagnation in airspeed at rotation had a similar effect to that of rotating too early: reduced lift and an extended the take-off roll, as confirmed by the flight data. The continued rotation with the main landing gear remaining on the runway then resulted in a reduced tail clearance.
The flight crew training manual indicated that the recommended rate of rotation on take-off to achieve sufficient tail clearance is 2 to 3° per second, with a lift-off target attitude of 8°. The maintenance of take-off and initial climb performance is dependent on rotation at the correct airspeed and rate to the target attitude. Boeing data indicated that average rotation rates above 2.5° per second to 10° pitch attitude, impact tail clearance. Analysis of the flight data showed that the aircraft was rotating at an average of 2.4° per second up to lift‑off, at a pitch attitude of 10.55°. While the average rotation rate was towards the upper end of the recommended limit, it was not likely to have reduced the available tail clearance. Similarly, the maximum rotation rate of 3.5° was not considered to have contributed to the tailstrike.
Boeing data indicates that lateral control inputs can significantly reduce tail clearance on take-off. The small amount of left aileron input maintained during take-off to compensate for the crosswind was not considered to be sufficient to impact lift and consequently reduce tail clearance.
The minor discrepancy between the actual loading of the cargo hold and the load sheet was not significant and did not contribute to the tailstrike.
Following the occurrence event, the flight crew were proactive in gathering information from all available sources, which enabled them to make a complete assessment of the situation. They were decisive in their actions and kept cabin crew, passengers, ATC and ground staff up to date with clear communications.
Findings
This finding should not be read as apportioning blame or liability to any particular organisation or individual.
A decrease in the headwind component reduced the airspeed during rotation and extended the time required for VH-YIR to leave the runway, resulting in a reduced tail clearance and subsequent tailstrike.
Safety message
External factors can change flight conditions rapidly. How the crew plans for and mitigates threats can make the difference between an uneventful take-off or landing and one that results in a tailstrike. Boeing guidance shows that airspeed loss, lateral control deflection and a greater than average pitch rate can all contribute to reduced tail clearance. The risk of a tailstrike can be mitigated by using recommended take-off techniques. The Boeing Aero-magazine article Tail strikes: Prevention contains a number of useful recommendations on tailstrike prevention, which include stressing the importance of:
The role of the pilot monitoring to actively monitor and identify airspeed stagnation during the rotation phase to take-off target pitch attitude.
In gusty conditions, momentarily delay rotation to ensure that the aircraft starts rotation at an average speed above the rotate speed.
Adherence to the recommended average all-engine take-off rotation rate of 2 to 3° per second.
Following this tailstrike event, the flight crew made good use of resources and were proactive in assessing and resolving the situation. A safe outcome was achieved through the crew’s use of effective communication and by following practiced failure management procedures.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 1347 on 24 January 2018, loaded Aurizon coal train EF01 encountered a track buckle at Duaringa, on Aurizon Network’s Blackwater System between Emerald and Rockhampton, Queensland. The buckle resulted in 17 wagons in the train consist derailing, damaging 502 m of track on the down line and 54 m of track on the adjacent up line, with rails, sleepers and overhead line equipment requiring replacement. Thirteen coal wagons were extensively damaged and not expected to be repaired. There were no injuries.
What the ATSB found
The ATSB found the track buckle had formed on a falling 1 in 50 grade at the point of the track where ballast cleaning and track stabilisation work had been completed less than 12 hours earlier. The ballast cleaning operational plan did not consider compressive stress in the continuous welded rail as a risk at this location.
The compressive stress, steep grade, proximity to a turnout and high ambient temperature meant the track structure had a limited capacity to constrain lateral forces. While the ballast cleaning, track resurfacing and dynamic track stabilisation work met Aurizon Network’s civil engineering track standards, negative operational outcomes were not anticipated when a risk assessment was done for the site.
What has been done as a result
While work was conducted to re-open the Blackwater System, de-stressing was performed on the down line on the approach to the point of derailment, and on the up line on both sides of the turnout adjacent to the point of derailment.
Aurizon Network has changed its procedures to ensure a temporary speed restriction is applied to all work sites on which ballast undercutting has been performed. The restriction is to remain in place until rail adjustment or stress testing has been completed and it has been determined that the rail stresses are within accepted limits. In addition, sites with a high risk of compressive rail stress will be identified and added to the site hazard map before conducting ballast cleaning.
Safety message
The incident highlights the importance of developing, maintaining and consulting a network hazard register to identify locations at risk of buckling, and producing site-specific risk assessments that consider rail stress when planning track disturbing maintenance work.
The incident also demonstrates that effective rail stress management is dependent on a knowledge of the rail stress free temperature and the identification of any variations from that stress free temperature.
The occurrence
At 1110[1] on 23 January 2018, Aurizon Network’s Plasser RM900 High Output Ballast Cleaning Machine began undercutting work along a straight section of the down line[2] between Duaringa and Aroona, Queensland (Qld) from 103.130 km[3] to 102.800 km. The work was part of planned track maintenance on Aurizon Network’s Blackwater System between Emerald and Rockhampton.
Without dismantling the track, the ballast cleaning machine undercut the ballast bed with a moving chain beneath the rails and sleepers, removed contaminated and degraded ballast, screened it to eliminate contaminants and replaced the screened ballast under the track.
Work concluded at 1505, at a point just before the 11 A/B turnout[4] at the eastern end of Duaringa yard. Plasser 09-2X Continuous Action Tamping machine MMA505 then tamped[5] and aligned the track, and performed dynamic track stabilisation,[6] completing its first pass through the work site at 1730.
Three loaded coal trains subsequently passed over the re-opened down line. MMA505 began its second and final pass through the work site at 0200 on 24 January, tamping, re-aligning and stabilising the track. Another eight loaded coal trains passed over the down line between 0248 and 1332.
At 1345 on 24 January, the loaded coal train EF01 passed signal DA14 at the western end of Duaringa, rolling at 66 km/h. It was the twelfth loaded coal train to pass over the down line since ballast undercutting and dynamic track stabilisation had been completed.
As the train began to descend the 1 in 50 grade[7] the driver applied and progressively increased the dynamic brake.[8] When the train passed signal DA16 at the eastern end of Duaringa at 57 km/h, the lead locomotive’s dynamic brake controller was set at B8.
On the steep falling grade, the driver supplemented the dynamic brake with a brake pipe reduction of 100 kPa and increased the dynamic brake to its maximum setting at B10. At this point, the driver noticed a track buckle forming ahead of the train, just before the 11 A/B turnout on the down line.
At 1347, train EF01 negotiated the track buckle at 53 km/h, throwing the lead locomotive and wagons from side to side, as they passed over it. The driver placed the automatic brake handle in the full service position and made an emergency radio call, warning other trains in the vicinity that the train may have derailed.
Looking back from the locomotive, the second driver reported that several wagons appeared to be off the line. The driver placed the automatic brake handle in the emergency position at 48 km/h, reducing the train’s brake pipe pressure to 0 kPa at an emergency rate and fully applying the brakes.
Line voltage was lost, indicating that the 25kV AC overhead line equipment had been damaged, and at 1348, the train came to a halt; 65 seconds after the lead locomotive had passed over the track buckle (Figure 1).
Figure 1: Position of train EF01 after the derailment, and area of ballast undercutting on the Duaringa to Aroona down line
Source: Google Earth annotated by ATSB
Wagon 12 on the train, the first to derail, travelled for 502 m in a derailed state before the train stopped. Wagon 20 had also derailed and wagon 24 appeared to have derailed and then re-railed. Flange marks found on the head of the rail showed the leading wheelset of the leading bogie of wagon 12 had climbed over the rail at the 102.782 km mark—identified as the initial point of derailment.
Examination of the wagons behind the lead locomotive after the derailment, including those that had not derailed, showed their auto-couplers and drawbars had experienced movement from side to side well beyond their normal range of operation, consistent with running through a short ’S’ shaped track buckle at considerable speed.
Strike marks to the sides, wear plates and upper surfaces of the draw gear housings became more pronounced further back in the train consist. This indicates that the amplitude of the track buckle had increased as the train ran through it. The first light contact was noted on the auto-couplers between the wagons 4 and 5 and significant strike marks were identified on the four auto-couplers and drawbars between wagons 6, 7, 8, 9 and 10. Severe strike marks found on the auto-coupler and draft gear housings between wagons 10 and 11 showed the track buckle had developed into a full ’S’ shape by the time they passed over it.
The 13 wagons in positions 33 to 45 were completely derailed. Eleven were on their sides, spread across the up and down lines at the eastern end of Duaringa, over the 11 A/B and 11 C/D turnouts and along the northern side of the track (Figures 2 and 3).
Figure 2: Derailed wagons 33 to 46 on the Duaringa to Aroona down line
Source: Aurizon annotated by ATSB
Two derailed wagons remained upright, but off the track. The leading bogie of wagon 46 had derailed, but its trailing bogie remained on the track. The rail vehicles behind the partially derailed wagon, including six loaded wagons, the mid-train remote locomotive, another 50 loaded wagons and the end-of-train remote locomotive, remained on the track.
Figure 3: Looking back towards the point of derailment over the damaged 11 A/B turnout.
Source: ATSB
There were no injuries. Of the 17 wagons that derailed, 13 were extensively damaged and not expected to be repaired. In addition, 502 m of track on the down line and 54 m of track on the adjacent up line was damaged, with rails, sleepers and overhead line equipment requiring replacement.
Aurizon train EF01 was operating from Boonal Balloon, 9 km east of Blackwater, to the R G Tanna coal terminal at the Port of Gladstone, Queensland. It had been loaded with coking coal at Boonal Balloon, with 102 coal wagons and an estimated gross mass of 11,004 tonnes. The 1,722 m train included lead locomotive 3804, 52 wagons, mid-train locomotive 3813, another 50 wagons and end-of-train locomotive 3808.
Stress free temperature
In the past, rail track was laid with short lengths of jointed rail up to 25 m long, which expanded and contracted with the rise and fall of the ambient temperature. Today, most main line rail track is laid with continuous welded rail, which is less expensive to maintain and has a longer lifespan than jointed rail, but expands and contracts significantly with variations in temperature.
When the state of the rail is neither in tension nor in compression, it is at its stress free temperature. Over weeks, months or years, the stress free temperature of a specific track section may be reduced if it is subject to rail creep (see Rail creep below), lateral shift, track disturbing work (such as re-ballasting) or an extended period of hot weather. As the stress free temperature is lowered, the compressive forces present in the rail increase and the track section may become vulnerable to buckling.
Continuous welded rail that has been disturbed is returned to the required stress free temperature by restressing. Rail anchors and fasteners are removed, and if the rail is in tension it is cut and a new section of rail is added. If the rail is in compression it is cut and a section of rail is removed.
Rail creep
Rail creep is the longitudinal movement or migration of rail in one direction, due to temperature changes, train operations, maintenance activities or inherent rail stresses from manufacture or construction. It occurs when thermal and train dynamic forces exceed the longitudinal resistance provided by the rail anchors and resilient fasteners that secure rails to the sleepers.
Compressive rail stress may accumulate over time as a direct result of creep, at the bottom of descending grades where heavy train braking occurs and in track sections adjacent to fixed points such as level crossings, bridges and turnouts.
Rail creep can be monitored by marking datum points on a fixed structure (such as an overhead line equipment mast) and the rail adjacent to that structure, and comparing that initial position with its position several weeks or months later. Movement of the datum point on the rail away from its initial position indicates that creep has occurred.
Environmental conditions
The closest Bureau of Meteorology weather station to the derailment site was located at Blackwater, about 85 km west of Duaringa. On the day of the derailment, the maximum temperature recorded at Blackwater was 37.0 °C. There was no rainfall recorded in the 24-hours preceding the derailment.
At the time of the derailment (1347), the weather was fine and hot. The minimum overnight temperature was 22.8 °C, and for the week preceding the derailment, the weather was dry and hot with every day exceeding 34 °C.
A maximum rail temperature of 43 °C was recorded while the ballast cleaning work was conducted between 1110 and 1505 on 23 January 2018. The next day at 1600, more than 2 hours after the derailment, the rail temperature was 48 °C and the ambient temperature at the derailment site was 34 °C.
Preparation for ballast cleaning work
Under the Rail Safety National Law (Queensland), part 3 Regulation of rail safety, sections 99 and 100, a safety management system must provide risk management systems and procedures for eliminating, reducing, identifying and assessing risks, and a register of risks.
A site survey was conducted on 10 November 2017, more than 2 months before the ballast cleaning work began. Workers from the ballast cleaning and drainage team located overhead line equipment cables, bond wires and stay wires, signage, drains and old signal mast bases that would impede the operation of the ballast cleaning machine, and assessed the ballast profile, prepared a site hazard map, identified waterways near the work site and made provision for the disposal of waste.
The presence of rail stress at the work site was not considered, and the maintenance superintendent responsible for this track section was not asked to provide the ballast cleaning team with information on any rail stress issues or track buckle history at the work site.
Hazard location register
Aurizon’s Civil Engineering Track Standards – Track Stability CETS 10 stipulated that hazard locations on the rail network must be recorded in its Hazard Location Register. The rail infrastructure manager is required to identify locations where track instability had been recorded previously, where monitoring had demonstrated that the potential for instability exists, and where there were increased longitudinal forces and other destabilising factors that reduce the lateral resistance or strength of the track.
The track stability standard noted that hazards may exist at locations where the stress free rail temperature is unknown, at the bottom of descending grades, near fixed structures such as turnouts, and where track disturbing work has been conducted.
Track instability had not been recorded previously on the down line at the eastern end of Duaringa yard and the track section did not appear in Aurizon’s Hazard Location Register.
Other track misalignment occurrences
The ATSB has investigated nine previous derailments attributed to track misalignment or buckle events, including:
RO-2015-025 – Derailment of iron ore train ND575 near Tom Price, Western Australia, 15 December 2015
RO-2014-003 – Derailment of grain train 9130 at Emu, Victoria, 12 February 2014
RO-2013-006 – Derailment of train 3MC1 near Locksley, Victoria, 12 February 2013
RO-2013-002 – Derailment of intermodal train 3PS6 at Yunta, South Australia, 17 January 2013
RO-2010-015 – Derailment of train 1MP5 at Goddards, Western Australia, 28 December 2010
RO-2009-004 – Derailment of freight train 6MB2 at Tottenham, Victoria, 30 January 2009
RO-2008-012 – Derailment of train 3DA2 near Katherine, Northern Territory, 4 November 2008
2006001 – Derailment of freight train 3AB6 at Yerong Creek, New South Wales, 4 January 2006
2005002 - Derailment of train 6MP4 at Koolyanobbing, Western Australia and train 6SP5 at Booraan, Western Australia, 30 January 2005 (two different events on the same day).
Although these occurrences involved a variety of track owners and rail operators, and were unique in their details, there are some common factors. These factors should be considered in mitigating the risk of derailment from track buckling events. For example:
Trains travelling along a track, particularly in one direction, can result in a redistribution of longitudinal rail stresses along the track. Fixed points, such as level crossings, turnouts, or bridge structures, can further compound the risk of longitudinal rail stress redistribution, resulting in increased track-buckling risk. Signals located on falling grades may also contribute to rail creep, as rolling stock braking and wheel/rail forces induce additional longitudinal rail stress.
During hot weather, the effects of track disturbing works require prudent management.
Ballast quality and profile is essential for providing resistance against lateral track movement.
To assist maintenance workers in determining the potential risk of track buckling events, effective creep monitoring points should be considered, particularly at high-risk areas such as curves, and near fixed points, such as railway crossings, turnouts and bridge structures.
Track owners should consider heat speed restriction strategies during periods of high ambient temperature to reduce the risk of track buckling and derailments.
Management and quality assurance processes need to be robust to ensure that track work is conducted in accordance with prescribed standards.
Safety analysis
Introduction
The completed ballast cleaning, track resurfacing and dynamic track stabilisation work conducted on the down line at Duaringa complied with Aurizon Network’s Civil Engineering Track Standards. In addition, there was no evidence to suggest that train handling or a rolling stock defect caused the derailment. Consequently, the investigation focused on the management of track stability and rail stress.
Track buckle and derailment
On sections of track laid with continuous welded rail, track buckles usually form when high ambient temperatures, excessive compressive forces, track disturbing work and train dynamics compromise the stability of the track structure.
At Duaringa, these factors acted together upon the short section of track between the end point of the ballast undercutting work (102.800 km) and the fixed point associated with the 11 A/B turnout (102.693 km). A track buckle was seen by the driver to begin to form as loaded coal train EF01 approached (Figure 4).
Figure 4: Track buckle, point of derailment and last derailed wagon (46 in consist)
Source: ATSB
As the train passed over it, the amplitude of the buckle increased. The lead locomotive and first 11 wagons ran over the track buckle without derailing before the wheels of wagon 12 were unable to steer through it. The right-hand wheel of the leading wheelset of the leading bogie climbed over the head of the rail and derailed at 102.782 km.
The buckle developed laterally and assumed a full ’S’ shape. Wagons 33 to 45 were subject to extreme lateral forces as they passed over it and derailed completely.
Risk assessment
The conditions at this location were conducive to the accumulation of compressive rail stress and the track buckled less than 12 hours after dynamic track stabilisation work had been completed. Those conditions (temperature and falling grade ending at a fixed point) presented operational hazards that, if identified, could have been planned for and mitigated. It is likely that the rail was in a compressive state[9] before ballast cleaning work began.
The risk assessment conducted for the maintenance activities considered a range of factors. However, it did not consider any risks to the operation of trains.
If compressive rail stress had been identified as a hazard at the site, it is likely that arrangements would have been made to impose a temporary speed restriction on the track section on completion of the ballast cleaning work. A temporary speed restriction would have reduced the risk of a train derailment.
Hazard location register
Track instability had not been recorded previously on the down line at the eastern end of Duaringa yard and the track section did not appear in Aurizon’s Hazard Location Register. In the Ballast Cleaning Operational plan, compressive rail stress was not considered a hazard at this location, and it was not included on the site hazard map. Stress testing was not conducted before the ballast cleaning work began, and it was not performed after the work had been completed.
It seems likely that the Hazard Location Register was primarily a record of occurrences, rather than a resource used proactively during planning for work, comparing and analysing locations on the network with similar characteristics and identifying common hazards.
After the work on the down line at Duaringa had been completed, the site was not treated as a hazard location. Dynamic track stabilisation partially restored the track’s stability after the ballast cleaning work, but it was the only remedial measure applied to the track.
Indicators of rail stress
Aurizon’s track stability manual advised that track prone to rail creep problems included track adjacent to fixed structures such as turnouts, areas with steep grades and areas where high braking occurs. This is consistent with the area where the track buckle developed just before the Duaringa 11 A/B turnout on a falling 1 in 50 grade.
Rail creep markers and rail stress monitors had been trialled on Aurizon’s Central Queensland coal network at Edungalba (approximately 20 km east of Duaringa) between 2010 and 2012, but they had not been installed at Duaringa. Aurizon engineering staff advised the ATSB that there was no history of track buckling at the eastern end of Duaringa yard and the track section was not regarded as high-risk for track buckling.
Aurizon engineering personnel involved in conducting the ballast cleaning work advised that the stress free temperature[10] of the down line rail at the eastern end of Duaringa yard was not known.
From the evidence available, the following findings are made with respect to the derailment of Aurizon coal train EF01 between Duaringa and Aroona on 24 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
A track buckle formed on the down line at the eastern end of Duaringa yard due to the combined effect of a high ambient temperature, excessive compressive rail stress, recent track disturbing ballast cleaning work and dynamic uplift from an approaching train. The magnitude of the buckle was sufficient to derail the train as it passed over it.
The risk assessment conducted before ballast cleaning work began on the down line between Duaringa and Aroona addressed immediately observable hazards, but it did not consider compressive rail stress to be a hazard at this location.
When planning track disturbing work, Aurizon’s normal practice was to use its Hazard Location Register as a record of past occurrences at a specific location. Aurizon did not use the Hazard Location Register as a resource to consider the situational characteristics of a location that may increase risk, such as continuous welded rail, track gradient and proximity to fixed points such as turnouts or level crossings. [Safety issue]
A variety of techniques to indicate and record rail stress at specific locations are available, however Aurizon had not used any of these techniques in some locations with elevated risk of rail stress, such as tangent track on steep grades. As a result, Aurizon could not readily determine the presence or absence of compressive rail stress at these locations.[Safety issue]
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Safety issue description: When planning track disturbing work, Aurizon’s normal practice was to use its Hazard Location Register as a record of past occurrences at a specific location. Aurizon did not use the Hazard Location Register as a resource to consider the situational characteristics of a location that may increase risk, such as continuous welded rail, track gradient and proximity to fixed points such as turnouts or level crossings.
Safety issue description: A variety of techniques to indicate and record rail stress at specific locations are available, however, Aurizon had not used any of these techniques in some locations with elevated risk of rail stress, such as tangent track on steep grades. As a result, Aurizon could not readily determine the presence or absence of compressive rail stress at these locations.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
During the investigation, Aurizon advised that it had taken the following safety actions:
The Duaringa-Aroona down line (on the approach to the point of derailment) and the Aroona-Duaringa up line (adjacent to the point of derailment, on both sides of the 11 C/D turnout) were de-stressed to relieve any remaining compressive forces.
Sites on which ballast undercutting work has been performed had a temporary speed restriction (TSR) of 40 km/h applied. The restriction was required to remain in place until rail adjustment or stress testing had been completed and the rail stresses were confirmed as being within acceptable limits.
In addition, Aurizon advised that it was also implementing the following additional actions such as:
Review the planning, prestart and handback processes for works involving heavy machinery, mechanised production or large ballast removal works and include a process for the identification of track buckle risks and appropriate controls.
Review and align SAF/STD/0075/CIV/NET Hot Weather Precautions for Track Stability, SAF/STD/0077/CIV/NET Module 10 – Track Stability and the Track Stability Manual (AZN NA MAN 12 6170 005) to establish clear guidelines for instances in which ballast is removed or renewed, and the actions taken to protect the track asset from the risk of a stress-related derailment.
Discuss with Network Operations the risks associated with completing work in hot weather and the management of rail stress.
Review and amend the current checklist, used to hand back completed work sites, to cover all aspects of track-related disturbance work in hot weather.
Develop a program to train, certify and guide those workers handing track assets back into service, taking into consideration minor and major works, light and heavy axle load tracks and appropriate levels of qualification.
Develop and implement a local process to improve communication between the superintendents responsible for works and maintenance.
Consider fitting outward-facing video recording equipment to locomotives.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Aurizon
Personnel involved in planning and conducting the ballast cleaning work.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Aurizon, key personnel involved in planning the work and the Office of National Rail Safety Regulator (ONRSR).
Submissions were received from ONRSR and Aurizon. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 23 January 2018, at about 0015 Eastern Daylight-saving Time,[1] the fishing vessel Saxon Onward (Figure 1) collided with the container ship Beijing Bridge (cover) about 3 nautical miles (NM) south-east of Gabo Island, Victoria. Saxon Onward was bound for Eden, New South Wales while Beijing Bridge was en route to Melbourne, Victoria from Taiwan.
Figure 1: Saxon Onward, alongside in Hobart, Tasmania, 2010
Source: Theo Van Loon
At about 2030 on the evening of 22 January 2018, the 294 m container ship Beijing Bridge was about 29 NM off the southern coast of New South Wales bound for Melbourne with arrival expected late the next evening. The ship’s master had retired to his cabin for the night and the third officer was the officer of the watch (OOW) and sole lookout on the navigational bridge (bridge). The ship was on autopilot maintaining a heading[2] of about 206º with a speed of about 17 knots. The night was clear with good visibility and the seas calm, with a south-westerly wind at about 5-10 knots and little swell.
Meanwhile, Saxon Onward, a 32 m long trawler, was northbound for the port of Eden to discharge its catch having completed a few days fishing off the coast of Tasmania. The trawler was on autopilot maintaining a heading of about 038º with a speed of about 8.5 knots.[3] At about 2200, the skipper handed over the watch to the 2200-2400 watchkeeper. The fishing vessel Rubicon, also bound for Eden, was on a parallel course about 3 NM away on the starboard bow, slowly being overtaken by Saxon Onward.
Sometime between 2320 and 2330, Saxon Onward’s watchkeeper sighted the masthead lights and green sidelight of an approaching ship (Beijing Bridge) on the starboard bow. The ship was also detected on radar but was not acquired for tracking at that time.
Shortly after, at about 2335, with the ship on a heading of 209º, Beijing Bridge’s OOW sighted two approaching vessels (Saxon Onward and Rubicon) on the starboard bow. The two vessels were also detected and subsequently acquired on the ship’s radar by the OOW. By about 2352, the two fishing vessels were about 10 NM from Beijing Bridge. The OOW continued to monitor the two vessels, both visually and by radar, while making small adjustments to the heading to maintain the ship on the planned track.
At about 2356 (Figure 2), with Beijing Bridge now on a heading of 216º, the OOW commenced a course alteration to starboard about 3.2 NM in advance of a planned course alteration position (waypoint). Over the next 10 minutes, the OOW made a succession of small heading alterations that took the ship further to starboard, away from the planned track.
Figure 2: Section of navigational chart Aus 395 showing times of key events
Source: Australian Hydrographic Service, modified by the ATSB
Meanwhile, at about midnight, Saxon Onward’s 2400-0200 watchkeeper made his way to the vessel’s wheelhouse to take over the watch. The previous watchkeeper stayed on for a few minutes to handover before retiring to his cabin. After taking over the watch, the 2400-0200 watchkeeper immediately acquired Beijing Bridge on the radar and noted that the approaching ship on the starboard bow was about 6.5 NM away on a south-westerly course with a speed of about 17.5 knots. He also noted that Rubicon was now about 1.5 to 2 NM away on the starboard beam.
At about 0005 on 23 January, with Beijing Bridge about 4 NM away, Saxon Onward’s watchkeeper left the wheelhouse and walked the short distance to the trawler’s bow to better assess the situation. He sighted Beijing Bridge fine on the starboard bow with the ship’s two masthead lights (nearly in a line), green sidelight and deck lights visible. He then returned to the wheelhouse and continued to monitor the approaching ship visually and by radar while maintaining Saxon Onward’s course and speed.
By about 0008, Beijing Bridge was steady on the new course with a heading of 241º and was about 0.75 NM to starboard of the ship’s planned track with Saxon Onward fine on the ship’s port bow. About a minute later, the OOW[4] altered the ship’s heading to port with the intention of passing between the two trawlers and increasing the distance at which Saxon Onward’s closest point of approach (CPA)[5] would occur. The ship eventually settled on a heading of 228º at about 0012 with Saxon Onward, now on the ship’s starboard bow.
Shortly after, Saxon Onward’s watchkeeper commenced a rapid turn to starboard at a distance of about 1 NM from Beijing Bridge.
In response, Beijing Bridge’s OOW altered the ship’s heading to port from 228º to 225º and flashed the ship’s Aldis lamp[6] at Saxon Onward followed by a long blast on the ship’s whistle. Woken by the whistle, the ship’s master called the OOW on the bridge telephone to find out what was happening and was told that he was needed on the bridge. The OOW then continued to sound long blasts on the ship’s whistle. At about 0014, the OOW changed the steering over from autopilot to hand steering and placed the wheel hard to port.
A few seconds later, the master arrived on the ship’s bridge and saw the lights of the trawler, on the starboard side, rapidly closing on the ship. He also immediately ordered ‘hand steering’ and ‘hard to port’ and confirmed that the ship was beginning to turn to port. The master ordered the OOW to continue blowing the whistle and then went out on to the starboard bridge wing.
Meanwhile, on Saxon Onward, the watchkeeper realised that the trawler was in danger and shouted to alert the skipper and crew. At about 0015, as the skipper arrived in the wheelhouse, Saxon Onward collided with Beijing Bridge (Figure 3). The trawler’s port bow impacted the ship’s starboard side in the region of cargo hold number 3, about 94 m aft of the ship’s bow. As the trawler then scraped down the ship’s side, the skipper stopped the engine and the crew mustered in the wheelhouse. The trawler heeled over sharply to starboard and took on some water before it righted itself, passed the ship’s stern and drifted away to the north-east.
Beijing Bridge continued turning to port with a corresponding reduction in speed. The master then ordered ‘hard to starboard’ and shortly after, ‘stop engine’. At about 0017, the master called Saxon Onward on the radio and requested a damage report. At about the same time, Rubicon passed clear to port of Beijing Bridge at a distance of about 0.5 NM and continued its passage to Eden.
In the following minutes, as Saxon Onward’s crew inspected the trawler for damage, the skipper advised Beijing Bridge of the trawler’s name and that they did not require assistance. Beijing Bridge’s master then made contact with their company superintendent and designated person ashore to brief them on the situation and obtain advice. He also ordered a damage assessment of the ship and initiated the save procedure for the ship’s voyage data recorder (VDR).[7]
Figure 3: Section showing detail of collision
Source: ATSB (using electronically recorded data)
At about 0035, after seeking advice from the company superintendent and designated person ashore, Beijing Bridge’s master made two attempts to contact Saxon Onward on the radio with no response received. Shortly after, Beijing Bridge’s main engine was restarted and the ship’s heading was gradually altered to resume its original course. At about 0039, analysis of VDR data from Beijing Bridge shows that Saxon Onward turned around and began slowly to make its way back towards Beijing Bridge. A few minutes later, the trawler’s skipper broadcast a call on the radio with no response received. As Beijing Bridge resumed its south-westerly course, Saxon Onward increased speed in an attempt to catch-up with Beijing Bridge. However, at about 0047, with Beijing Bridge steadily increasing speed and moving away, Saxon Onward also turned back onto a north-easterly course and resumed its passage to Eden.
Beijing Bridge berthed at Melbourne later that night and was attended by Australian Maritime Safety Authority (AMSA) surveyors the next day (24 January). The ship sustained minor damage, including indentations to the hull and scratch marks down most of the ship’s starboard side (Figure 4). Beijing Bridge was detained while the authorities conducted inspections and collected evidence before being released to continue its voyage on 25 January.
Figure 4: Beijing Bridge showing surface damage to the hull on the starboard side
Source: Australian Maritime Safety Authority (AMSA)
Saxon Onward arrived safely in Eden at about 0600, six hours after the collision and was attended by AMSA later that afternoon. The trawler sustained substantial damage to the port bow (Figure 5), structural cracks and displacement of the port side A-frame arm and structural damage to deck fittings. The trawler also lost a net overboard and sustained seawater damage to an auxiliary engine, a generator and to cabin fittings.
Figure 5: Saxon Onward, alongside in Eden
Source: Australian Maritime Safety Authority (AMSA)
Beijing Bridge
Beijing Bridge’s master joined the ship in November 2017 and held a Bulgarian master’s certificate of competency with at least 14 years’ experience in the rank of master. The third officer joined the ship in July 2017 and held a Philippines watchkeeping deck officer’s certificate of competency with at least 8 years’ experience as an OOW.
The ship was fitted with the required navigational equipment including electronic chart display and information systems, radar with automatic radar plotting aid capability, automatic identification system (AIS),[8] VDR and radio equipment as required by SOLAS.[9]
Lookout
International regulations and Beijing Bridge’s company procedures both specified that the OOW could be the sole lookout on the bridge only during daylight hours. However, there was no lookout posted on the bridge during the 2000-2400 watch, at the time of the collision and for several weeks preceding. The ship’s master had the 2000-2400 lookout re-assigned to day work duties in an effort to direct more manpower towards maintenance and repair activities. Repairs of the ship had been ongoing since it had re-entered service in July 2017 after being laid-up for 18 months. Safety and maintenance related deficiencies had been identified by an AMSA inspection during the ship’s port call at Melbourne in September 2017 resulting in the ship being detained and issued with two prohibition notices. AMSA inspections during subsequent port calls at Melbourne in November and December also resulted in the issuance of prohibition, improvement or direction notices to the ship.
Following the collision, AMSA detained the vessel in Melbourne based on several identified deficiencies such as the lack of a bridge lookout on the 2000-2400 watch. The nature of the identified deficiencies indicated that the ship’s safety management system (SMS) as implemented, did not ensure compliance with procedures for critical shipboard operations such as navigational watchkeeping. The AMSA report of inspection also noted that the ship’s last internal audit in September 2017 identified similar SMS related deficiencies indicating ineffective internal audit processes.
Collision avoidance
Beijing Bridge’s company procedures and master’s standing orders required early and effective action be taken to avoid collision, in accordance with the International Regulations for Preventing Collisions at Sea, 1972, as amended, (COLREGs). The procedures and standing orders specified that course alterations were to be clear and made in sufficient time so as to leave no doubt as to the ship’s intentions. The procedures and standing orders also required the action to result in the ship keeping a minimum CPA of at least 1 NM from other vessels. If the OOW’s action did not have the desired effect and the minimum CPA could not be maintained, the master was to be called.
Saxon Onward
Saxon Onward’s skipper held a skipper’s certificate of competency with about 33 years’ experience in the fishing industry. The 2400-0200 watchkeeper had recently obtained his deck watchkeeper’s certificate of competency and had about 4 years’ experience in the fishing industry.
The trawler was equipped with the required navigational equipment for a vessel of its class including radar with automatic radar plotting aid capability, chart plotter, echo sounder and radio equipment. The trawler was not equipped with, nor was it required to be equipped with AIS or VDR.
Collision Regulations
The International Regulations for Preventing Collisions at Sea, 1972, as amended (COLREGs) provide internationally agreed rules to prevent collisions and generally apply to all vessels at sea. The COLREGs lay out requirements for every vessel to maintain a lookout, to take action to avoid collision in accordance with the rules and to exhibit specific lights (navigation lights) from sunset to sunrise.
Beijing Bridge and Saxon Onward both exhibited the navigation lights required by the COLREGs for power-driven vessels of their size. In addition, both vessels also had some of their deck lights on.
The COLREGs also provide rules detailing the actions required of vessels in specific situations involving risk of collision such as head-on situations, crossing situations and overtaking situations. Rule-14 requires vessels meeting in a head-on situation involving risk of collision to each alter their course to starboard. The rule also makes it clear that in the event a vessel is in any doubt as to whether a head-on situation exists, they are to assume that it does and act accordingly.
The rules also state that any action to avoid collision should, among other things, be positive, be large enough to be apparent to an observing vessel (while avoiding a succession of small course and/or speed alterations) and be made in ample time. More specifically, the rules require that any alteration of course to avoid a close quarters situation should be made in good time, be substantial and not result in another close-quarters situation.
Finally, Rule-2 of the COLREGs allows that in special circumstances, it may be necessary for vessels to deviate from these rules in order to avoid immediate danger.
Safety analysis
While Beijing Bridge was on its planned track, the traffic situation was relatively benign with neither Saxon Onward nor Rubicon posing a risk of collision. Beijing Bridge’s officer of the watch (OOW) then commenced a course alteration to starboard more than 3 NM in advance of the planned waypoint in the vicinity of Gabo Island, Victoria. The OOW, believing it was safe to do so, commenced the course alteration early to effect a ‘short-cut’ and indicated that it was common practice for him to do so. While it is not unusual for ships to make minor departures from the passage plan, in this instance, the decision to alter course in advance of the planned waypoint resulted in a close quarters situation with risk of collision developing with Saxon Onward.
Beijing Bridge's company procedures and master's standing orders required early and effective action be taken to avoid collision in accordance with the COLREGs. They also specified that course alterations were to leave no doubt as to the ship's intentions. Shortly before the collision, at a range of about 3 NM from Saxon Onward, Beijing Bridge’s OOW carried out a 13° course alteration to port in an attempt to increase the distance at which Saxon Onward’s closest point of approach (CPA) would occur. This action was based on the OOW’s assumption that Saxon Onward would cross the ship’s bow from port to starboard and pass clear down the ship’s starboard side. However, this action failed to resolve the close quarters situation and would have resulted in a CPA that was less than the minimum distance required by the procedures. The action also increased the risk of a collision in the event Saxon Onward decided to take action in accordance with the COLREGs, as subsequently occurred. Further action, taken in response to Saxon Onward’s course alteration to starboard, including the final turn to port, was not effective in avoiding the collision either. Furthermore, the master was not called during the developing situation and was only alerted to the impending collision by the ship’s whistle. Consequently, he arrived on the bridge too late to affect the outcome of the situation.
Saxon Onward’s 2400-0200 watchkeeper had acquired Beijing Bridge on radar and then continued to monitor the situation, including Beijing Bridge’s succession of course alterations, both visually and by radar. The watchkeeper then assessed the trawler and the ship to be in a head on situation with risk of collision. In response, and in accordance with the COLREGs, the watchkeeper then initiated a bold alteration of course to starboard. However, this action, taken at the relatively close range of about 1 NM, was too late to have a positive effect on the situation and resulted in the collision.
On board Beijing Bridge, the re-assignment of the bridge lookout to day work duties left the OOW as the sole lookout on the bridge during the hours of darkness of the 2000-2400 watch on the night of the collision and for several weeks preceding. This was in contravention of the company’s procedures and international regulations. While in this case, the absence of the bridge lookout did not affect the OOW’s ability to detect Saxon Onward, it increased the risk of vessels going undetected over a period of several weeks prior to the collision.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Beijing Bridge's planned alteration of course, to starboard, executed in advance of the passage plan waypoint, placed the ship in a developing close quarters situation involving risk of collision with Saxon Onward.
Beijing Bridge's subsequent alteration of course was neither substantial nor made in good time and was inconsistent with the master's standing orders, company procedures and the International Regulations for Preventing Collisions at Sea, 1972, as amended, (COLREGs). The action failed to remove the ship from the existing close quarters situation and increased the risk of a collision.
Saxon Onward's alteration of course to starboard was made in response to the head-on situation that the watchkeeper assessed the vessel to be in. The alteration, while substantial, was not made in sufficient time to have a positive effect on the situation and resulted in the collision.
Beijing Bridge's officer of the watch was the sole lookout on the bridge during the 2000‑2400 watch on the night of the collision and for several weeks preceding the collision. The absence of the bridge lookout during hours of darkness increased risk and was in contravention of company procedures and international regulations.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
V.Ships (Germany)
As a result of this occurrence, Beijing Bridge’s management company, V.Ships (Germany), have advised the ATSB that they have taken the following safety actions:
Circular letter
V.Ships (Germany) issued a circular requiring all managed ships to hold a safety meeting at the earliest opportunity to discuss the collision and its lessons. The circular required the ship’s masters and bridge watchkeeping personnel to review compliance with the COLREGs and the ship’s SMS with particular emphasis on the following:
statutory requirement to have a lookout on the bridge during hours of darkness and restricted visibility
calling the master in good time
safe speed and the use of main engines to avoid collision
areas of likely concentrations of fishing vessels to be taken into consideration during passage planning.
The company also mandated that passage plan tracks were to be laid at least 10 NM from the shoreline where possible.
Saxon Onward
As a result of this occurrence, Saxon Onward’s master has advised the ATSB that they have taken the following safety actions:
Watchkeeping
The master has implemented a policy of maintaining two watchkeepers on duty in the wheelhouse when transiting through high traffic density areas.
Automatic identification system (AIS)
The vessel has installed AIS equipment and has since reported an improvement in traffic awareness. The system enables AIS-equipped vessels and shore based AIS stations to send and/or receive identification and navigation information that can be displayed on a chart plotter, compatible radar or a standalone display unit. This provides the watchkeeper with an additional means of making a full appraisal of the situation and of the risk of collision.
Safety message
The ATSB continues to see collisions between small vessels and trading ships on the Australian coast with at least 65 such collisions reported and 39 investigated since 1990. Safety investigations into several of these collisions have shown that taking early and effective avoiding action and the keeping of a proper lookout in accordance with the COLREGs could have prevented most of these collisions.
Planned course alterations at waypoints should be risk assessed taking into account the traffic situation and movement of vessels in the vicinity. Course alterations at waypoints should be conducted so as to minimise the risk of the alteration generating close quarters situations or risk of collision. While an alteration of course, for whatever purpose, may be logical to an officer on their own ship, the action may be confusing and open to interpretation by observing vessels.
The safety of fishermen and people in small boats continues to be a concern in terms of safety at sea. When fishing in waters off the Australian coast, fishing vessels regularly encounter large trading ships carrying a variety of cargoes to and from Australian ports. When these vessels collide, a fishing vessel, being smaller than a ship, will almost always come off worse after a collision, often with potentially serious consequences to the lives of those onboard. The ATSB has published safety bulletins, Safety Bulletin 01 - Ships and Fishing vessels and Safety Bulletin 05 - Fisherman and Safety Awareness at Sea, aimed at highlighting the risks faced by fishing vessels and raising awareness of the common contributory factors present in these collisions.
General details
Ship details
Name:
Beijing Bridge
IMO number:
9292230
Call sign:
H8FE
Flag:
Panama
Classification society:
Korean Register of Shipping
Ship type:
Container ship
Builder:
Hyundai Heavy Industries Company – Ulsan, Republic of Korea
Year built:
2005
Owner(s):
Beijing Bridge S.A, Republic of Panama
Manager:
V.Ships, Germany
Gross tonnage:
54,519
Deadweight (summer):
65,038 t (4,738 TEU)
Summer draught:
13.5 m
Length overall:
294.12 m
Moulded breadth:
32.2 m
Moulded depth:
21.8 m
Main engine(s):
Hyundai MAN B&W 8K98MC-C MK6
Total power:
29,413 kW
Speed:
21.5 knots
Damage:
Minor damage to starboard side shell plating
Ship details
Name:
Saxon Onward
IMO number:
5314987
Call sign:
VJT5748
Flag:
Australia
Classification society:
N.A.
Ship type:
Fishing vessel - Trawler
Builder:
Grimsby, United Kingdom
Year built:
1960
Owner(s):
Seafood Specialists, New South Wales, Australia
Manager:
Voyager Seafoods, New South Wales, Australia
Gross tonnage:
209.8
Length overall:
32.16 m
Moulded breadth:
7.03 m
Moulded depth:
3.81 m
Main engine(s):
Cummins K-38
Total power:
464 kW
Speed:
11 knots
Damage:
Structural damage to port bow, A-frame, deck fittings and water damage to cabins and generator.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 January 2018, a Sydney Trains passenger train (A42) failed to stop as intended at the Richmond Station platform, and collided with the buffer stop at the end of the platform at a speed of about 26 km/h. There were 26 people on board the train (including the driver and a guard). Sixteen people were injured and treated at the scene, some with serious injuries.
What the ATSB found
The ATSB’s investigation found that the driver of A42 did not slow the train at a crucial time when approaching the buffer stop at the end of Platform 2 at Richmond Station. A number of possibilities for the driver’s inaction were examined during the course of the investigation, these included: the driver blacking out, the driver experiencing a microsleep due to fatigue impairment, or the driver being distracted / inattentive. The investigation was unable to conclusively determine what caused the driver to have no control system input for 22 seconds shortly before impact.
The ATSB concluded that the buffer stop withstood the impact of the collision and prevented the train from crossing onto a main road. It further concluded that the two hydro-pneumatic rams on the front of the buffer stop did not perform as designed, due to non-alignment with the crash energy management system on the front of the Waratah train, and Sydney Trains’ risk-management procedures did not rectify deficiencies in the buffer stop design at Richmond before the incident. The crash energy management system on A42 reduced the impact force of the collision but not all components performed as designed.
What's been done as a result
The buffer stops for Platforms 1 and 2 at Richmond were redesigned. The new buffer stops are compliant with the NSW buffer stop standard. The NSW Asset Standards Authority (ASA) has reviewed and updated their buffer stop standard.
Other measures which may have prevented the collision, such as the installation of an intermediate train stops and automatic train protection, were not present at the time of the incident. Intermediate train stops, previously identified and recommended as a risk control, have been installed at Richmond since the incident. Automatic train protection which, if installed on A42, may have prevented the incident, was still in trial stage at the time of the incident. Transport for New South Wales (TfNSW) have scheduled automatic train protection to be operational on most Sydney Trains electric rolling stock by May 2021.
Computer modelling and analysis of the crash performance of the A-set and its crash energy management system has been undertaken. This will provide better understanding for future rolling stock specification and design.
Safety message
Rail operators should ensure that multi-layered defences are in place against over-speeding. This should include infrastructure design, rolling stock design and train crew health management. They need to ensure that identified risk controls are implemented, and that these control measures are effective in their performance.
The occurrence
Events prior to collision
The crew of the accident train, run 150-E, consisted of a driver and guard who had commenced duty in the early hours of 22 January 2018. The driver signed on at the Blacktown Depot at 0312[1] to commence his shift. He was due to finish at 1111. At the start of his shift, he first prepared a train in the Blacktown siding and then operated run 149-B from Blacktown at 0515, arriving at Richmond at 0552. Afterwards, he operated a return service to Blacktown arriving at 0645, and then travelled as a passenger on this same train to Central Station, arriving at 0729. The driver commenced a break until 0806 when he relieved another driver and operated run 286-D to Blacktown, arriving at 0843. The driver then had a meal break, walking into the main street of Blacktown to purchase and consume some food. He returned to the station, waiting on Platform 2 for run 150-E to arrive. Run 150-E had departed Central Station at 0834 and was due to arrive at Blacktown at 0917 where a crew changeover occurred (Figure 1).
Figure 1: Location Map
This map shows the path of run 150-E from Central to Richmond Station and the major railway lines in the Sydney metropolitan area.
Source: Geoscience Australia, modified by the ATSB
The train arrived at 0917, as per the timetable. The outgoing driver verbally provided information about the state of the train. There were no faults reported by the outgoing driver. The driver took his seated position in carriage (car) 1, closed his cabin door, then received a ‘proceed’ bell signal from the guard. The train departed 2 minutes late, but was on schedule by the time it reached Clarendon, eight stations later.
The guard of the accident train had signed on at Richmond Station at 0243 and worked two Richmond to Blacktown return services and then a Blacktown to Schofields service before returning to Blacktown Station at 0851. The guard waited at the city end of Platform 2 for run 150‑E to arrive. He did not speak to the driver while waiting for the train, nor at any time throughout the trip to Richmond. The guard received a handover from the outgoing guard and took his position in the compartment at the rear of the train, car 8.
After departing Blacktown Station at 0920, the train made eight stops before arriving at the last station before Richmond, East Richmond at 0950:10. The driver said the train was operating normally throughout the journey and that, up to this point, he was feeling fine and had no indication of any problem with his health. A tabular summary of the journey from Blacktown to Richmond is shown in Table 1.
Table 1: Tabular summary of journey of 150-E, Blacktown Station to Richmond Station
Station
Timetable
Max speed in section
Time of door opening
Time of door closing
Time driver powered on
Blacktown
0917- 0918
0919:27.4
0920:05.6
0920:09.9
92 km/h
Marayong
0920
0922:47.1
0923:01.5
0923:02.5
83 km/h
Quakers Hill
0924
0925:41.9
0926:00.0
0926:02.5
107 km/h
Schofields
0926 - 0927
0928:38.1
0928:56.2
0928:57.5
99 km/h
Riverstone
0930 - 0932
0932:07.1
0933:03.0
0933:06.4
91 km/h
Vineyard
0937
0937:11.6
0937:27.0
0937:28.4
100 km/h
Mulgrave
0940
0940:45.1
0940:57.4
0940:58.5
78 km/h
Windsor
0944
0944:07.6
0944:31.0
0944:33.0
85 km/h
Clarendon
0947 – 0948
0946:53.4
0947:07.4
0947:08.4
92 km/h
East Richmond
0951
0950:10.6
0950:25.0
0950:27.0
52 km/h
Richmond
0952
0951:46
Source: Sydney Trains
The maximum speed was exceeded, momentarily, on two occasions. Between Mulgrave and Windsor, the maximum allowable track speed is 75 km/h and the train reached a speed of 78 km/h for a short period of 4.7 seconds. Between East Richmond and Richmond, the maximum allowable track speed is 50 km/h and the train reached a speed of 52 km/h for a brief period of 1.9 seconds.
Run 150-E departed East Richmond approximately 30 seconds ahead of timetable at 0950:27. The driver received a ‘proceed’ bell signal from the guard and, using the power/brake handle, increased power demand to 85% at 0950:29 (maximum power is 90%). This power level was maintained for 19.5 seconds until the train had reached a speed of 48 km/h. The driver then reduced power demand to 50% at 0950:48.5.
At 0950:48.9, the driver operated the train’s town horn for 260 milliseconds on approach to the Bourke St level crossing. Due to the slight downhill track gradient of 1:77, the train increased speed to 52 km/h. The driver said that he could see the caution signal ahead and Richmond Platform 2 in the distance. He said he was aiming for a smooth stop before the buffer at Richmond Station (Figure 2).
Figure 2: Richmond Station and train path of 150-E
Source: Google maps with annotations by ATSB
At 0951:06.1, the driver applied the power/brake control handle from 50% to brake (39%) just above the minimum brake demand level. The train was travelling at 52 km/h and the distance to the buffer stop was 270 m.
Somewhere past the home signal RD5, which displayed a green over red (caution) indication, but sometime after the action of applying the brake, the driver reported that he ‘felt dark, dizzy and powerless, and that my body had no control over me. I felt complete black, dark. I don’t know what happened to me after that.’ According to event recorder analysis from other similar trains, drivers usually make a number of brake applications during this time, which change the rate of deceleration.
The distance from the end of East Richmond platform to the start of Richmond platform is approximately 506 m; run 150-E took 46 s to travel this distance. As the train approached Richmond Station, the guard, who was preparing to finish his shift, had packed his bag and was standing near the door on the platform side of the train. He said he was looking at the internal CCTV screen as the train entered the platform. This screen displays multiple views from various cameras located in the passenger areas and on the train’s exterior.
Meanwhile, the passengers inside the train were preparing to disembark at this end-of-the-line stop. Many had left their seat and were making their way to, or were already in, the vestibule area near the doors. There was no announcement of the impending collision and the passengers had no warning that the train was about to collide with the buffer stop. There were 24 passengers and two crew members on board the train at the time of the collision. The majority of the passengers were in the front half of the train. There were seven passengers in car 1 and seven in car 2, two passengers in car 3, five passengers in car 4, two passengers in car 5 and one passenger in car 6.
The collision
At 0951:15.6, the leading car of A42 passed the Sydney-end of Platform 2 at Richmond Station at a speed of 47 km/h. The train was timetabled to arrive at 0952. A42, under the effect of electro-dynamic braking with brake cylinder pressure at zero, was decelerating slowly (~0.2 m/s2) as it travelled the approximate 168 m-length of Richmond Station.
The driver stated that when he regained his senses he reacted by applying the emergency brake. At 0951:28.1, the power / brake control handle was moved to the maximum brake position. There had been no control system input by the driver since 0951:06.1, 22 seconds before. The train’s speed at this point was 36 km/h and the distance to the buffer stop was 27 m.
It was approximately a car length before the buffer stop that the guard realised there was a problem. This would have given him less than 2 seconds to activate the emergency brake, which meant that even if it was activated, the train would have still collided with the buffer stop. There were no early clues to alert the guard that there was a problem with the driver. The train had entered the platform at a normal approach speed and the train was decelerating slightly. In this situation, the investigation determined that there was insufficient time for the guard to react by applying the emergency brake in his compartment.
At 0951:29.5, the driver moved the power/brake control handle to emergency. The train’s speed at this point was 34 km/h and the distance to the buffer stop was 17 m.
The first indication of the impact with the buffer stop is at 0951.31.1, when the Emergency Door Release Terminal Door Seal was recorded as having opened. This is the emergency door at the front of the train, which opens to the driver’s compartment. The train’s speed at impact was 26 km/h. The buffer stop stopped the progress of A42 and the impact sent a high deceleration shock pulse down the train.
After the impact with the buffer stop, the front of the train came to rest approximately 3 m from the buffer stop and the rear carriages recoiled further due to the partial recovery of the energy absorption elements that are distributed throughout the train. The impact caused all cars to concertina together, with some wheels lifting from the track. A post-incident inspection found, on the rear wheelset of the rear bogie on the third position car one wheel suspended above the rail, the other wheel derailed and all wheels of the rear bogie (No.1 end) on the fifth position car derailed.
There was damage to the front of the train, particularly the head of the Sharfenberg coupler (No.2 end of motor driving carriage D6342), the lower section of the front nose cone and the undercarriage. There was significant damage to the interconnecting areas between cars, the associated door systems and the coupling systems between cars. There was no visible damage to the interior of the driver’s cab or to the internal passenger saloon areas. The emergency door at the front of the train had become ajar during of the collision. The exterior stainless steel skin of the carriages, apart from the areas between carriages, sustained no visible damage.[2] All carriage windows and exterior doors were undamaged. The exterior doors and opening systems were all functioning following the collision.
The collision caused substantial damage to the end-of-track buffer stop with a significant transverse crack opening at the corner of the base and the upright. The two hydro-pneumatic rams positioned on the front of the buffer stop also sustained damage (Figure 3).
Figure 3: Platform 2 buffer stop and front of A42
This figure shows the post-collision damage to the buffer stop on Platform 2 and the front of A42.
Source: ATSB
The guard was standing near the closed exterior door of the rear driver’s / guard’s compartment as the train entered the station. He said he was watching the train’s CCTV surveillance screen. He became aware that the train braking was not slowing the train as it usually would. At the same time as he was thinking to apply the brake himself, the driver applied the power/brake handle to full brake application. The guard was thrown forward into the handrail on the leading bulkhead. The guard said he fell to the floor and had trouble breathing due to sustaining cracked ribs.
Post-collision events
By 0951:38, the train had come to a complete stop. CCTV showed the guard at the open door of his compartment who then opened the passenger doors a few seconds later. The guard stumbled out onto the platform and crouched on his haunches clutching his ribs. He returned to his compartment and emerged later.
The driver stated that he was dazed but conscious following the collision. He remained in the lead driver’s compartment until 0952:25, when he emerged to walk around the platform and then returned to the cab. When interviewed, he stated ‘I was very shocked, disorientated and traumatised. I was trying to recollect and compose myself … but I was in so much pain’. He sustained injuries to his arm, hip and head. His injuries were mainly on the right-hand side of his body.
The triple zero emergency line first received a call about the incident at 0952:52. At 0953:40, the station manager called the Rail Management Centre to inform them of the accident and request assistance. The station manager was on the platform, next to the buffer stop, at the time of the collision. All three branches of emergency services attended this event. NSW Ambulance were first to arrive on scene at 1002. Shortly afterwards, a NSW Police inspector assumed command of the site.
At 0953:44, the driver called the Rail Management Centre and informed them that his train had struck the buffer stop. He gave a coherent account of the situation. A relieving guard who had been waiting on the platform checked to ensure that the driver did not require immediate treatment and then left to help injured passengers.
Richmond Station staff and other Sydney Trains employees who were already on the platform were first to attend to the injured passengers and train crew. Some passengers emerged from the train after the train doors were opened by the guard. Others, too injured to move, were stretchered out by emergency services.
A total of 16 persons were injured as a result of the collision. Many were assessed and received treatment in Richmond Park, across the road from the station. Five persons were assessed as requiring immediate transfer to hospital. NSW Ambulance confirmed that 15 persons were transported to hospital for further treatment and assessment. The driver and guard were breath tested by police, both returned a negative result.
At 1045, the driver, after being treated for his injuries, was interviewed by NSW Police. Later he was transported to Blacktown hospital for observation and drug and alcohol testing. The results were negative.
Site examination, recovery and repair
At 1145, once emergency services had completed evacuation of the injured, the ATSB formally took control of the site from NSW Police for the purpose of conducting safety investigations. The ATSB then inspected the train, the track, and the adjacent infrastructure including the buffer stop.
On 24 January 2018, the ATSB took possession of the event recorders and digital video recorders from the train while it was still at Richmond Station. Sydney Trains successfully relocated the cars to the storage siding where further assessment and temporary repairs of the cars occurred.
The train remained at Richmond until 2 February 2018 when the three rear cars (D6442, N5442, N5642) were coupled to a locomotive and hauled to the Downer[3] maintenance facility at Cardiff, Newcastle, New South Wales, approximately 150 km by rail from Richmond. Two more cars (T6642, T6542) were moved on 14 February 2018. The remaining 3 cars (D6342, N5342, N5542) were moved on 21 February 2018.
The initial response, recovery and transfer of A42 to Cardiff were coordinated between all parties including Downer, Sydney Trains and Transport for New South Wales. Sydney Trains is the operator of the train, Downer is the maintainer of the train, and TfNSW through the Asset Standards Authority sets standards for rolling stock and infrastructure.
At Cardiff, a number of non-intrusive inspections took place in which the damage to A42 was photographed and documented. Downer engineering specialists assessed the options for repair. All major components were removed and individually assessed for damage. Comprehensive testing and commissioning was undertaken by Downer with support from Sydney Trains.
A42 recommenced revenue service on 28 March 2019 following a 14-month repair effort. The total repair cost for A42 was approximately $4.8 million.
Richmond is a suburb of Sydney, located approximately 52 km northwest of the CBD. Richmond Station is a terminating station located 60.761 km by rail from Central Station. Behind the buffer stop was a pedestrian ramp, an overhead catenary stanchion, a pedestrian footpath and a four-lane road (Market St) (Figure 4).
Figure 4: Richmond Station
This figure shows the street entrance to Richmond Station and the location of A42 post-collision in proximity with the pedestrian footpath on Market Street.
Source: ATSB
Organisation
Sydney Trains is the operator of rail services across metropolitan Sydney, operating passenger services in an area bordered by Berowra, Emu Plains, Macarthur, Richmond and Waterfall. It controls train movements on its network using signal control complexes and the Rail Management Centre. The Richmond rail line has passenger services at about 30-minute intervals during the peak period.
Sydney Trains started train operations as a legal entity on 1 July 2013 and was accredited as both a rail operator and infrastructure manager under the Rail Safety National Law (NSW) No. 82a. It inherited a number of staff, documents, systems, assets, responsibilities and duties from the previous operator, RailCorp. RailCorp, as an entity, remains the owner of real property, rail infrastructure and rolling stock, but its functions as operator and maintainer of metropolitan and interurban rail passenger services were transferred to Sydney Trains and another government agency, NSW TrainLink, for regional services.
Environmental information
At 0900, on the day of the accident, the temperature was recorded at Richmond as 23.1°C. The overnight minimum temperature was 16.3°C. The nearest Bureau of Meteorology automatic weather station (AWS) was located at RAAF Base Richmond, about 3 km east of Richmond Station.
The previous four days all recorded a maximum temperature over 35°C and the temperature on the day of the accident eventually reached 42°C (five hours after the accident).
Sunrise on the day of the incident was at 0539 and it was a fine morning. The sun was behind and on the right-hand side of the train. The position of the sun was determined not to have affected the driver’s visibility.
There had been no rain recorded at Richmond Station in the 11 days prior to the incident.
Train crew
The train crew were both Sydney Trains employees. The driver was based at the Blacktown depot while the guard was based at the Richmond depot. Both lived in nearby suburbs and drove to work with less than 20 minutes’ travel time to work.
The driver was an experienced driver who started as a guard in 2005 and progressed to become a metropolitan train driver in 2007. He had been as passed as medically fit in February 2014 and was not due to be reassessed until 2019. He was familiar with the route and had been qualified to drive Waratah sets since 2013.
The guard was an experienced guard, having started as a guard in 1985 and became a trainer guard in 2003. He was familiar with the route, being based at Richmond for 20 years, and had been qualified on Waratah sets since 2014.
Train information
The train involved in the incident was called a Waratah train, also known as an A-set. Each 8-car Waratah set has a designated number, all beginning with the letter A. The train involved in the incident was A42. Sydney Trains operate the A-sets which are leased to Sydney Trains by Reliance Rail Pty Ltd under a Rolling Stock Manufacture Contract with Reliance Rail, a Downer/Hitachi Joint Venture was responsible for the design, manufacture and commissioning of the Waratah trains and train simulators. Under a Through Life Support Contract with Reliance Rail, Downer is responsible for the through life support of the Waratah trains, the Auburn maintenance centre and train simulators (Figure 5).
There are 78 A-sets in total, all are maintained at Auburn, in western Sydney. These trains first entered service on the NSW rail network in 2011, and the final set was delivered in May 2014. A42 came into service in May 2013.
A42 was a double-deck electric multiple-unit train, consisting of an eight-car set. It had a driving car at each end, two motor cars located next to each driving car, and two trailing cars in the centre of the train (Figures 6 and 7).
Figure 6: A42 at Richmond Station post-collision
Source: ATSB
Figure 7: Waratah A-set car types
Source: Sydney Trains with annotations by ATSB
An eight-car Waratah set has a seated-passenger capacity of 896. The train width is 3035 mm, the height is 4410 mm, and each car is approximately 20 m in length. The total length of the train is approximately 163 m. It has a tare mass of approximately 407 t, a gross mass of 558 t. The Waratah was designed to be able to be operated at 130 km/h, although its maximum speed is restricted to 115 km/h. The train has a regenerative braking system with blended electro-pneumatic wheel-mounted disc brakes. The bodies of the cars are stainless steel with composite train ends.
The previous 30-day train examination was conducted on 27 December 2017 and the train was deemed fit for service. The train preparation certificate for A42 issued by Downer at the Auburn Maintenance Facility on 22 January 2018 stated the train was functioning as designed, and found the train fit for service.
Track and infrastructure information
The track structure between East Richmond and Richmond consisted of 60 kg/m rail fastened to concrete sleepers with a bed of rock ballast. The track approaching Richmond Station had a falling gradient of 1:77 from about the RD 5 signal to just past the start of Platform 1, where the track grade transitioned to 1:660 into the buffer stop.
Track inspections showed no evidence of obvious track defects or misalignments. The track geometry measurements carried out before and after the collision found the track to be within tolerances and of sound alignment.
Richmond Station is the terminal stop on the Blacktown to Richmond single bi-directional line. This standard gauge railway line was opened in 1864. It is a branch line of the Main Western line. This electrified line is predominantly used by passenger trains and is a single track for much of its length. The line is duplicated at multiple positions along the track. Passing loops also exist at various stations, allowing for trains to pass.
Train movements on the Richmond line are controlled by Sydney Trains under network rule NSY 500 Rail Vehicle Detection system. This system of safeworking prescribes the rules used in axle counter territory and continuously track-circuited territory on the network. Train movements on the metropolitan network, including the Richmond line, are authorised by a Train Controller from the Rail Management Centre in Sydney. These movements are controlled in conjunction with local signal control rooms. At the time of the incident, the movements for Richmond were controlled by the Area Controller located in the Blacktown signal box. Both the Rail Management Centre and the Blacktown Signal Box are now in the Rail Operations Centre at Green Square.
Richmond Station consists of an island platform, incorporating Platform 1 and 2, which has an effective length of approximately 168 m[4]. A dead-end line runs on each side of this island platform. A third dead-end siding line (The Up[5] storage siding) is used to stable trains for storage purposes. All three lines were terminated with an identical buffer stop involved in the incident.
The single line from East Richmond Station to Richmond Station curves to the right for 160 m before straightening after the Moray Street pedestrian crossing. Once past this crossing, the line diverges into three separate lines to Platform 1, Platform 2 and the Up storage siding line. There is a clear line of sight to the buffer stop for Platform 2. The buffer stop also had a functioning light signal, which displayed a red light, centrally located on top of the buffer stop (Figure 8).
Figure 8: Platform 2 buffer stop of Richmond Station
This diagram shows the post-collision damage to the buffer stop on Platform 2, details at Richmond Station, and the light signal attached to the buffer stop.
Source: ATSB
A signal, RD5, and an interlocking set of points permits trains to travel straight ahead along the Platform 2 line, as was the case the morning of the incident, or to be diverted onto one of the other two lines.
The permissible posted speed for trains travelling in the section from East Richmond Station to Richmond Station is 50 km/h. At the time of the accident, there were no temporary speed restrictions in place in the section from East Richmond to Richmond.
The three buffer stops at Richmond Station were all of the same energy-absorbing design. Sydney Trains indicated that the buffer stops were installed in the early 1990s. They all had bodies constructed from steel-reinforced concrete with two oleo-type 15 MMO-2000-0104 hydro-pneumatic rams bolted to the face of the buffer stop. These rams were designed to assist in absorbing the energy of a collision with a train.
This type of buffer stop was a minority type on the Sydney Trains network, with the majority being of a fixed timber design. A high percentage of critical locations utilise energy-absorbing designs.
The last examination done on the Richmond Platform 2 buffer stop was by Sydney Trains on 2 April 2017. The buffer stop examination report did not list any defects or make any comment about its condition. The next scheduled examination was on 16 November 2020.
The overall dimensions of the L-shaped buffer stop was 6.45 m long, 3.5 m wide and 4.1 m high. The end stop portion of the buffer stop was steel-reinforced concrete, protruding 1.6 m vertically from the ground. The majority of the mass of the buffer stop was below ground level. The engineering approval drawing for the buffer stops at Richmond Station was dated 26 February 1991.
The hydro-pneumatic rams had a metal tag affixed to the end plate dated 3 September 1991 (Figure 9). These rams extend approximately 1.1 m from the face, with a hollow tubular area cast into the concrete behind the rams so that under impact they can collapse into this tube.
Figure 9: Buffer stops, Platform 1 and Up storage siding, Richmond Station
This diagram shows the buffer stops at Richmond Station on the Up storage siding line (right) and Platform 1 line (left), the insert shows the identification tags on one buffer stop.
Source: ATSB
Rail head and train wheel inspection
Leading up to the platform and under the train, the rail head was inspected for evidence of contaminants such as woody or leaf material, oils, grease, corrosion products, metals and other particles. The railhead appeared to have no significant degree of contaminants present.
There have been previous buffer stop collisions where contaminants have caused poor adhesion at the contact point between the train’s wheels and the railhead. The investigation determined this was not the case at Richmond.
Previous incidents
There have been a number of serious incidents involving passenger trains colliding with buffer stops, both in Australia and overseas.
The most significant recent Australian incident occurred on 31 January 2013, where a passenger train, T852, failed to stop at the Cleveland Station platform, in Brisbane, Queensland. The train collided with the buffer stop, the platform, and the station building at a speed of 31 km/h. A number of people were treated for minor injuries and transported to hospital for further examination.
The ATSB’s investigation into the Brisbane accident found that local environmental conditions had resulted in the formation of a contaminant substance on the rail running surface. This caused poor adhesion at the contact point between the train’s wheels and the rail head. The braking effectiveness of train T842 was reduced as a result of reduced adhesion and the train was unable to stop before hitting the buffer stop. It was found that Queensland Rail’s risk management processes prior to the accident had not adequately assessed, recorded, managed and communicated the risks associated with operating trains on their network under low adhesion conditions.[6]
Later that year, on 16 September 2013, an eight-car V-set interurban passenger train collided at low speed with a buffer stop at Platform 10, Sydney Terminal. As the driver approached the buffer stop at the end of the platform, he misjudged the brake application. This brought his train to a stand just prior to the buffer stop. The driver then engaged power and increased the train speed to 10 km/h. Due to the close proximity of the buffer stop and the driver’s application of the slower-acting automatic air brakes, the train collided with the buffer stop. There were no injuries to the passengers or the driver. An investigation found that the contributing factors to the collision was train management by the driver and electro pneumatic (EP) braking abnormalities. These abnormalities were experienced earlier on the trip and prompted the driver to switch off EP braking and run under the conventional air brake system.
On 6 December 2016, Sydney Trains’ passenger service 625H collided with the buffer stop at the end of No.2 Platform at Cronulla when terminating. The Tangara train pushed the friction-type buffer stop back approximately 2 m. There were no injuries to the train crew or passengers on board the train. The investigation found that low adhesion caused by wet weather and rail lubricator grease contributed to the train not stopping as the driver expected.
Other buffer stop collisions have occurred at Sydney Terminal on 27 October 2017, 22 December 2017, and 18 February 2018. These three collisions all occurred at low speed with drivers misjudging the approach to the end of the platform. No injuries occurred and minor to nil damage was reported as a result of these incidents.
Overseas, in the US, two significant buffer stop incidents occurred: one in 2016 and one in 2017. On 29 September 2016, at Hoboken, New Jersey, an accident on the New Jersey Transit railroad killed one person, injured 110, and resulted in major damage to the station. On 4 January 2017, an accident on the Long Island Rail Road at the Atlantic Terminal in Brooklyn, New York, injured 108 people. Both accidents involved passenger trains that struck buffer stops and crashed into stations. The US National Transportation Safety Board (NTSB) investigation determined that the major contributory factor in both accidents was driver fatigue resulting from undiagnosed severe obstructive sleep apnea.[7]
On Monday 22 January 2018, train A42 approached Richmond Station with a train crew comprising a driver and a guard and with 24 passengers on board. The train entered the platform under the posted speed limit of 50 km/h but did not slow as expected and collided with the buffer at an estimated speed of 26 km/h. The evidence obtained from the train’s event recorders confirm that the driver did not have any input to the controls for the period of 22 seconds from 0951:06 to 0951:28.
The buffer stop collision was the result of a lack of braking input by the driver as the train approached the buffer stop on Platform 2 at Richmond Station. The analysis section of this report explores the human factors surrounding the driver’s performance and likely reasons for his lack of braking input.
The buffer stop withstood the impact of the collision and prevented the train from continuing into the street. The two hydro-pneumatic rams positioned on the front of the buffer stop were not aligned with any structural element on the front of the train, this meant they had little or no effect in the absorption of energy from the collision.
Other elements discussed in the analysis section include:
driver safety systems
buffer stops
crashworthiness and crash energy management systems (CEMS)
emergency response management
management of safety risks.
The following elements were excluded from further analysis:
the train’s braking and control system
track adhesion and track-related issues
signalling and train control issues
the actions of the guard.
Driver issues
There is a risk with the operation of any vehicle that the operator may perform in a sub-optimal way. On passenger trains, there are many procedural and engineering defences put in place to mitigate this risk. These defences include: training, rostering, vigilance devices, operator enable (deadman) systems, train stop/trip gear systems, and the guard. The introduction of technology such as Automatic Train Protection in future will provide an additional defence.
The driver of A42 was interviewed by the ATSB on two occasions and was questioned closely about the events of that day, his previous shifts, and any aspect that may have potentially affected his behaviour on the day of the collision. The driver stated that he was feeling well and everything was normal leading up to, and during, the shift. He said he was well-rested, had slept well before his shift, had eaten normally, was hydrated and was feeling comfortable in the cab of the train. The driver had just had a break at Blacktown station less than an hour before the incident.
The driver was certified as medically fit in accordance with the National Standard for Health Assessment of Rail Safety Workers (Health Assessment). Under this standard, rail safety workers such as the driver must have a valid certificate of fitness to perform rail safety work. The driver last had his category 1 medical assessment in February 2014. He was passed as ‘Fit for Duty – unconditional’. This certificate was valid until April 2019. In addition to this compulsory medical, the driver said he had a voluntary annual medical check with his local general practitioner. At the initial ATSB interview in February 2018, the driver stated that he was a person in good health, using no medication, with no previous history of blackouts or sleep disorders.
The health assessment standard covers a wide range of medical conditions that may impact on safe working performance. It seeks to provide guidance to support consistent assessment and decision-making. It is reviewed approximately every 5 years to ensure the medical criteria are up to date with the latest knowledge and research. The areas of interest to this investigation are contained in part 18 of the standard – ‘Conditions causing sudden incapacity or loss or situational awareness’. The following are the sub-headings for this part:
The investigation considered the following were the most likely reason for the driver’s lack of input to the braking controls as he approached the buffer stop:
the driver experienced a blackout
the driver had a microsleep due to fatigue impairment
the driver was inattentive or distracted.
Due to the lack of any CCTV inside the cab, the investigation could not conclusively determine what happened to the driver. The following is an analysis of the likely reason for the lack of braking input by the driver as the train approached the buffer stop.
Blackout due to an undiagnosed medical condition
A blackout is described as an unpredictable, spontaneous loss of consciousness. The National Standard for Health Assessment of Rail Safety Workers states that ‘blackouts or pre-syncope may indicate an underlying medical condition (e.g. seizures, diabetes, cardiovascular condition, a sleep disorder)’.[11] It is possible that the blackout was related to the obstructive sleep apnea that the driver was diagnosed with after the incident. As described previously, the medical testing conducted on the driver after the event found no abnormalities with the driver’s cardiological or neurological condition.
One type of blackout is termed ‘syncope’. This temporary loss of consciousness is usually related to insufficient blood flow to the brain. It is commonly referred to as fainting or passing out. It often occurs when blood pressure is too low and the heart does not pump enough oxygen to the brain.
‘Fainting is a common problem, accounting for 3% of emergency room visits and 6% of hospital admissions. It can happen in otherwise healthy people. A person may feel faint and lightheaded (pre-syncope) or lose consciousness (syncope).’[12]
The driver’s original description of the event leading up to the collision was similar to that which can occur with low blood pressure. In the crucial time approaching the station the driver stated that he ‘felt dark, dizzy and powerless, and that my body had no control over me. I felt complete black, dark. I don’t know what happened to me after that.’ He also said that when he regained his senses he saw the buffer stop about one car-length away, and applied the brakes to maximum.
It is considered possible that the driver experienced a pre-syncope or syncopal episode. It is reported that up to 50% of the population will lose consciousness at some point in their life due to a syncopal episode.[13] Sydney Trains agrees with an independent medical assessment that, considering all of the medical information, the most likely diagnosis was a blackout of undetermined cause.
Microsleep due to fatigue impairment
In the context of human performance, fatigue is a physical and psychological condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep.[14] Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission.[15] Transport accident investigation agencies have identified fatigue impairment as a contributory factor in many accidents and incidents.
Extensive medical tests, including neurological and cardiology tests, were conducted on the driver following the incident. One test detected a problem. A sleep test (a home polysomnography sleep study) conducted in July 2018 led to the driver being diagnosed with moderate obstructive sleep apnea. This was followed by an in-clinic test on 8 October 2018 that showed mild obstructive sleep apnea and a maintenance of wakefulness (MWT) test conducted on 9 October 2018 that was normal, with no suggestion of sleepiness. He was advised by his medical practitioner to use a continuous positive airway pressure (CPAP) machine. In December 2018, the driver reported that since using the CPAP machine, his overall feeling of well-being had improved. He was unable to say if he was feeling more alert although he had not resumed train-driving duties.
Research has shown that sleep apnea increases the accident rate in motor vehicle drivers between two and seven times due to sleepiness and/or due to altered blood gases and hypoxia affecting mental function.[16] Obstructive sleep apnea involves repetitive obstruction to the upper airway during sleep. Throughout the sleep period, the breathing of a person can stop from a few seconds to over a minute. These episodes, which can occur many times during the night, are known as apneas. The person can be unaware that it has happened during the night but will frequently wake feeling tired. An increase in sleepiness can result from obstructive sleep apnea.[17]
It is possible that the driver was fatigued and experienced a microsleep. A microsleep is a very short period of sleep when the brain disengages from the environment and slips uncontrollably into light non-REM sleep.[18] Microsleeps have been shown to correlate with periods of low performance and they occur most frequently during conditions of fatigue.[19] It is possible the driver experienced a microsleep due to an increased level of fatigue due to a combination of obstructive sleep apnea, a cumulative lack of sleep, and an early morning shift start.
Even though the driver stated that he felt normal on the day of the incident, research has shown that patients with sleep disorders may not be aware of an impending sleep episode[20] and that there may be a lack of realisation by a sleep-deprived person as to how fatigued they actually are.[21] This driver had not reported any clinical features of sleep apnea prior to the incident and had no high-risk factors, such as a body mass index greater than 40, which would trigger a referral for a sleep study.
Sydney Trains, like other Australian rail operators, is not required to automatically send all employees in safety-sensitive positions for a sleep study. The National Health Standards for Health Assessment of Rail Safety Workers specifies certain criteria for sleep study referral and the driver of A42 did not meet these criteria. [22]
Another factor that increased the likelihood of a microsleep was that the driver had been awake since 0215, more than 7 ½ hours prior to the time of the incident. It has been reported that both feelings of fatigue and the occurrence of microsleeps increase as duty time progress.[23] The National Transport Commission recognises that the duration of a duty period is a contributor to fatigue-impaired work performance. [24] Early morning shifts are associated with high levels of fatigue and this can affect performance for the duration of the shift.[25] Also, some research has shown that shifts ending around the time of this accident show an increase in mental tiredness for train drivers.[26]
The driver was rostered to have 3 days off (Friday, Saturday and Sunday) before the incident day, Monday. Instead, he was phoned on Friday by the roster clerk and asked to work an overtime shift the next day, Saturday. He said he worked from 1500 to 2300 on Saturday and went to bed at 0200 in the early hours of Sunday morning. He awoke at 0830, having slept approximately 6 ½ hours.
The driver said he was used to early morning shifts and he would rather have not worked the afternoon/evening shift on Saturday. This change in shift meant that he changed his sleeping pattern from going to bed in the late evening (2130-2200) for the previous 5 days, to going to bed in the early hours of Sunday morning.
On Sunday, instead of resting at home and taking the opportunity for an afternoon nap, the driver went shopping with his family from approximately 1300-1630. Originally, the driver thought that he had napped that afternoon but an analysis of mobile phone records showed otherwise. The driver went to sleep Sunday evening at 2000 and set an alarm for 0215. The driver had the opportunity for approximately 6 hours sleep the night before the accident, and 6 ½ hours sleep in the previous 24-hour period. Research has shown that limiting sleep to six hours or less over successive nights can result in a deficit in performance[27] and that sleep of only six continuous hours is associated with an elevated likelihood of a fatigue-related incident.[28] It is suggested that the average amount of sleep required per 24-hour period for most people is approximately 8 hours.
There were two opportunities for the driver to increase his sleep hours. Firstly, after he completed his Saturday shift at 2300 when he did not go to bed until 0200. It is accepted that often people need a period of time to wind down after work before going to bed, but the 3 hours taken this evening may have been detrimental. Secondly, during the day on Sunday, he did not take the opportunity to have an afternoon nap as he was in the habit of doing. Prophylactic napping has been shown to be beneficial in supplementing sleep time and reducing the effects of fatigue.[29]
Rostering
Sydney Trains’ rostering, fatigue-management and health policies were examined to determine if they contributed to the incident. The investigation found that while Sydney Trains had policies and systems in place to ensure that drivers were fit for duty and rostered in a manner to manage their fatigue levels, there were some inconsistencies with the rostering of this driver and Sydney Trains’ operating procedure for managing shift work and rostering.
Sydney Trains’ operating procedure was to ‘make sure there are adequate breaks between shift cycles. Days off should be a minimum of two consecutive days’. Prior to the incident the driver had worked 5 consecutive days and then had a break of one day, worked another day, then had a one day break.
Another rostering principle inconsistent with the driver’s roster was that start times should be consistent and move in a forward rotation. This driver had start times that moved from a regular morning start (0600-0700), to a single overtime shift that started at 1500, then to a very early morning start of 0312.
Sydney Trains’ management systems provide guidance for management and employees to ensure there is an awareness of countermeasures in this area. The procedures are detailed and cover eventualities such as shift changes.
Sydney Trains use a bio-mathematical fatigue modelling program known as the Fatigue Audit Interdyne (FAID) to assess the suitability of the roster for managing fatigue risk. Bio-mathematical models attempt to predict the effects of different working patterns on subsequent job performance, with regard to the scientific relationships between work hours, sleep and performance.[30] The FAID score predicts the risk of fatigue associated with the opportunities provided by the organisation for an individual to obtain restorative sleep.[31] Guidance suggests that scores between 80 and 100 have a high fatigue likelihood. The FAID score for the driver on the day of the incident was 51. Other bio-mathematical scores were also calculated for the driver’s shift. These also indicated that the driver was in the low range for being at risk of fatigue. However, any bio-mathematical model cannot account for the hours of sleep actually achieved by individuals, nor for the quality of that sleep.
Driver distraction / inattention
Driver distraction and inattention are major contributing factors in accidents. While there are many differing definitions for distraction and inattention, for the purposes of this investigation the following definitions will apply:
‘Distraction: a diversion of attention from the driving task that is compelled by an activity or event inside the vehicle.’[32] External events outside the vehicle can also provide a distraction.
‘Inattention: insufficient or no attention to activities critical for safe driving.’[33]
It may be possible to be inattentive even where there is no distracting event.
The driver said that he was not distracted by any radio calls or external events and was paying attention as he approached Richmond Station. He said that he had driven into this station on hundreds of occasions and knew that the approach to the buffer stop was a critical time to apply the brakes in order to come to a smooth stop. He said that he was not using his mobile phone, and the phone records confirm that no messages or calls were made or received in the time leading up to the event. There was no one else in the cabin with the driver.
There is no evidence of distraction to the driver and in the absence of any in-cab CCTV footage, the investigation could only rely on the testimony of the driver and the recorded actions on the event recorder. On all occasions, from his initial conversations with the replacement guard, the train guard, and the police, to his formal interviews, the driver’s recollection was consistent: that he did not know what happened to him but experienced some kind of blackout.
Previous driving behaviour
The driver’s operation of the train and the performance of the train were analysed for the duration of the journey from Blacktown to Richmond. The driver’s actions were found to be generally in line with the performance standards set down by Sydney Trains. The only area of concern was the previously described over-speeding events where the driver exceeded the maximum speed for the section of track on two occasions. These infractions were for a few kilometres per hour above the limit for a few seconds.
The driver’s train driving history was examined for any previous similar incidents since commencing driving trains. Since starting as a driver in November 2007, there were eight recorded incidents where the driver has either failed to stop at a station, overshot the platform or passed a signal at stop. A variety of reasons are recorded for these lapses: distracted, misjudged, lost situational awareness and lost concentration. On each occasion, Sydney Trains has counselled or coached the driver to be more vigilant and to maintain situational awareness. Sydney Trains was unable to say if this was an above-or below-average error rate for drivers. This investigation made no determination on the driver’s recorded error rate but includes it in the report for completeness.
Driver safety systems
Rail operators use a range of measures to reduce the risk of driver error. This section will focus on the technology-based devices that may have prevented or mitigated the effects of this collision. These devices include:
a vigilance control system
an operator enable system
a train stop and trip gear system
an automatic train protection system.
The first three measures were already in use on the Sydney Trains network and on A42 at the time of the collision at Richmond. The last measure, automatic train protection, was not in use on the network at the time of the collision.
ASA have published a standard for train (driver) safety systems.[34] This standard applies to Sydney Trains and rolling stock operating on the Sydney metropolitan rail network. The standard covers onboard safety systems that protect train safety in the event of a failure in the manual functions of train operation, such as the driver becoming incapacitated approaching a buffer stop. Another ASA specification for passenger rolling stock driver safety systems provides greater detail for the application of these systems.[35]
Vigilance control system
This system supports driver alertness and is in place to ensure the driver is maintaining vigilance at the controls. The standard for train (driver) safety systems defines a vigilance control system as a ‘system that will react by bringing a vehicle or train to a stand if an acknowledgment input is not received within a specified time increment. On conventional vehicles with an automatic brake, the vigilance system will bring the train to a stand by directly venting the brake pipe to atmosphere’.[36]
All Sydney Trains passenger trains have onboard task-linked vigilance devices which are set up to warn the driver and apply an automatic brake application if there is no acknowledgement by the driver in the vigilance time cycle. The acknowledgement tasks include: pressing the vigilance button, applying the horn, operating the windscreen wiper, operating the power/brake control handle, operating the headlights/fog lights and also depressing the operator enable pedal. For each of these tasks there are parameters applied to the detection. For example, if the control input for the vigilance is the headlights or the foglights, it can only be used for one reset of the cycle then another type of input must be used.
The vigilance system is operational only at the active end of the train, so is only available for the driver and not the guard. It commences operation only when the power/brake control handle is moved out of the isolate position and when either the brake cylinder pressure is below 75% full service brake cylinder pressure or the speed is greater than 5 km/h.
The vigilance system has a 30-second cycle; if the driver does not perform one of the tasks within the cycle then the vigilance penalty sequence begins. Firstly, a warning light flashes on the control board in front of the driver and on the vigilance button itself, the driver is required to acknowledge the visible warning within 5 seconds or the sequence will progress to the next stage. Then, during the next 5-second period, a bell also sounds and the driver is required to acknowledge within the 5-second period or the sequence will progress to the automatic brake application. If no action is taken by the driver, an automatic brake application is initiated which cannot be released until 3 seconds after the train comes to a stand.[37] Following this, within the next 30 seconds, the driver can release the automatic brake by pressing the vigilance button. In the event of the driver failing to press the vigilance button within 30 seconds of the reset indicator, a distress message will be sent via the train’s radio to train control and the train’s park brakes will be applied (Figure 10).
Figure 10: Vigilance control system timing sequence
This figure shows the timing sequence of the train’s vigilance system.
Source: ASA Passenger rolling stock driver safety system, modified by ATSB
Following the incident, the vigilance system on A42 was tested by a Sydney Trains brake engineer. This test was witnessed by ATSB investigators. The vigilance control system cycles were timed and tested and performed as designed. All elements of the vigilance control system were operational and the event recorder showed that the driver was using the system throughout the journey from Blacktown that day.
The critical time that the driver was inactive on approach to the buffer stop was approximately 22 seconds. The investigation determined that this period of inactivity by the driver, with a possible loss of consciousness, occurred between a 30-second vigilance cycle.
Operator enable system
Another driver safety system is the operator enable system. Its main function is to detect that the driver is at the controls while the train is operating. An advance design on what in the past was known as a ‘deadman’ system which refers to its purpose of braking the train if the driver became incapacitated or deceased. The standard for train (driver) safety systems defines an operator enable system as ‘a device that applies emergency brakes and disables traction power if a continuous control input required of the driver or operator is interrupted or not detected’.[38]
The Special Commission of Inquiry’s report into the Waterfall train derailment in 2003 discussed the deadman system. It found that: ‘in New South Wales, prior to the Tangara, there were no electric trains with a deadman foot pedal device. The then-existing electric train fleet had a single deadman feature on the power / brake handle that required downward pressure to be applied to maintain it in the set position.[39] The current operator enable systems have advanced to a more sophisticated level than those used in the past and are designed to minimise circumventions.
The functional and performance requirements for operator enable systems installed on passenger trains in New South Wales are outlined in an ASA specification.[40] These specifications require that while a driver is driving a train, in either the sitting or standing position, the automatic brake application be suppressed by an operator enable pedal (OEP) operated in the normal operating range (or in vigilance acknowledge range), or by the rotation of an operator enable handle (OEH) (Figure 11).
Figure 11: Driver safety systems
This figure shows the location of the driver safety systems on A42. The insert shows the power / brake handle and the twist grip which acts as part of the operator enable system.
Source: ATSB
The operator enable system on Waratah trains consists of both an OEP and an OEH. The presence of both handle and pedal allows drivers to alternate between arm and leg muscle groups and give drivers the option to stand while driving.
The OEP is also used as the driver’s footrest. The height of the pedal and surround can be raised or lowered by the driver. The angle of the surround is approximately 28° from horizontal which slopes towards the driver. The pedal has a normal operating position range of approximately 26° to 30° from horizontal.
In order to enable traction and release the brakes, either the OEP must be depressed or the OEH power / brake handle twist grip turned approximately 20° clockwise. The power / brake handle needs to be in the forward or reverse position for this to operate. To operate the OEH a force of 8 N (± 10 N) is required. The force specification is such that the force required to be applied shall not cause injury or discomfort taking into account the shift length the drivers are required to operate.
There are three main stages to the OEP (Figure 12):
Released range: here the pedal is in the fully released position where no force is applied.
Normal operating range: the driver depresses the pedal into this range which activates the system and suppresses the automatic brake application. The force required to depress the pedal from the released range to the normal operating range is 50 N (±10 N). In order to hold the pedal in-line with the surround a force of less than 80 N is required. (This equates to a mass of approximately 8 kg).
Vigilance acknowledgement range: when the driver further depresses the pedal it links to the vigilance control system, vigilance is acknowledged and the automatic brake application suppression is maintained. The force required to depress the pedal from the normal to vigilance acknowledge range is 120 N (± 10 N). If the pedal is held in this range for more than three seconds, a second stage vigilance activation will occur and give an audible warning. This mean the driver has 5 seconds to acknowledge using the vigilance button before an automatic brake application occurs.
After East Richmond, the system did not detect a change in the driver’s application of the operator enable system. It is likely that once the driver applied the power/brake control handle to brake (39%) at 0951:06.1, he did not need to use the OEH and simply maintained pressure on the OEP. About 30 m before the train impacted the buffer stop, at 0951:28.5, the OEP indicated an increased force being applied to the pedal; this remained high until after the collision. It is likely at this point that as the driver of A42 realised the train was about to collide with the buffer stop, he braced himself for impact by increasing his leg force on the OEP.
Figure 12: Operator enable pedal operating ranges
This figure shows the side view of the main operating positions of the operator enable pedal on A42.
Source: ASA Passenger rolling stock driver safety system, modified by ATSB
Research has shown that it is possible to be in a semi-conscious state and still perform simple tasks. An investigation into a rail collision between two coal trains at Beresfield, New South Wales in 1997, discussed the issue of a driver not responding to signals. The report highlighted research into Automatic Behaviour Syndrome. The discussion of this syndrome may also explain the actions of the driver at Richmond.
‘There are various forms of sleep on the sleep-wakefulness continuum, ranging from a state of drowsiness (stage 1 sleep) as a person transitions from wakefulness to sleep, through to deep sleep. Generally, a person woken from stage 1 sleep will not be aware that they have been asleep. Stage 1 sleep can occur as ‘microsleeps’, or may involve longer episodes of lowered alertness, referred to as Automatic Behaviour Syndrome (ABS). The Transportation Safety Board of Canada defines Automatic Behaviour Syndrome as:
‘A state of fatigue in which we are essentially sleeping with our eyes open. While able to perform simple or familiar tasks, we are unable to respond quickly to more critical tasks and situations. In sleep lab studies, participants experiencing ABS show brain waves characteristic of sleep’.
The potential for vehicle drivers to ‘sleep with the eyes open’ was referred to as long ago as 1929 (Miles W. Scientific American June 1929, pp. 489-492). Recent scientific studies have confirmed that fatigued drivers can continue to drive while being asleep with the eyes open (Horne and Reyner 1998). In a US study, truck drivers were monitored for signs of sleep while driving normal deliveries on US public roads. Electroencephalogram (EEG) readings indicated that some drivers were continuing to drive while in stage 1 sleep for periods of up to 20 seconds (Mitler 1998).’ [41]
Tests conducted following the incident confirmed that A42’s operator enable system, both the OEP and OEH, was functioning. The driver continued to operate the operator enable system possibly due to automatic behaviour where he was still able to maintain with the required force on the OEP in the normal operating range.
Train stop systems
A train stop system involves a trip cock on the vehicle and a trip arm located trackside which, when engaged, directly initiates an emergency brake application (Figure 13).[42] In NSW, train stop systems are fitted to multiple-unit passenger trains operating on the electrified lines.
Figure 13: Signal train stop system
This figure shows the trip arm next to signal RD5 at Richmond (left) and the trip cock on A42 (right).
Source: ATSB
There are three main categories of train stops:
Fixed train stops: at terminal platforms these operate as a permanent upright lever arm which trigger the emergency brake when struck by a train’s trip cock.
Signal train stops: located adjacent to a signal, the lever arm elevates when the signal is at stop and returns horizontal when the signal clears.
Intermediate train stops: located at a determined distance from a known location where a reduction of speed is required. A speed detection device controls the lever arm so that if the train speed is not reduced to the required level before reaching a predetermined point, the lever arm remains raised.
The ASA standard for train (driver) safety systems defines the purpose of train stops and trip gear: ‘to intervene and stop a train or vehicle fitted with trip gear if it fails to stop for a signal at stop (red signal aspect). When the train stop arm engages the trip cock, the associated valve directly vents the train or vehicle brake pipe to atmosphere, initiating the removal of (a cut in) traction power and an automatic (emergency) brake application on all vehicles within the train. The train stop is used at signals in conjunction with a red signal aspect and in areas where train speed is required to be externally controlled.’ [43]
The operating standard for rolling stock states that multiple unit passenger trains operating within the Sydney metropolitan rail network shall be fitted with trip gear equipment.[44] All Sydney Trains passenger trains are fitted with trip gear at the front of the train.
In 2005, an external engineering consultancy was commissioned by RailCorp[45] to investigate and review overrun protection in the Sydney greater metropolitan area. RailCorp had identified 35 terminal track locations that could involve passenger trains in overrun incidents.
The 2005 report investigated and reviewed what overrun protection was in place and what options were available, and made recommendations to reduce risk. Richmond Station was one of these locations and, amongst other recommendations; the report recommended that intermediate train stops be installed at Richmond Platform 2. The report stated:
‘the worst case scenario at this platform would be the brakes failing and the train impacting the buffer stop at a probable worst case speed of 40 km/h, …the current buffer would be overloaded and not survive impact.’
The report stated that one of the options to reduce risk at Richmond Platform 2 was ‘to install two intermediate train stops, rated at 15 km/h and 8 km/h.[46] The completed report was provided to RailCorp and there is documentation which suggests that a risk workshop was held by RailCorp on 8 April 2005. There is no record of any actions being undertaken as a result of this workshop and it appears that the recommendations pertaining to Richmond were not acted upon.
In 2008, the same external engineering consultancy was commissioned by RailCorp to review the previous 2005 report and to assess the performance of overrun protection specifically at two stations: Richmond and Carlingford. The review found that a risk assessment model was applied to each station and ‘Richmond Platform 2 was rated as highest risk of injury and fatality due to train overrun’.[47] The report stated: ‘the worst case scenario at this platform would be the brakes failing and the train impacting the buffer stop at a probable worst case speed of 25 km/h, the current advertised approach speed. The current buffer would be overloaded and not survive impact.’ The report recommended that one of the options to reduce risk at Richmond Platform 2 was ‘to install two intermediate train stops, rated at 25 km/h and 15 km/h.[48]
Sydney Trains provided these reports to this investigation. It appears that the details and safety recommendations from these reports were not included as part of Sydney Trains' program for asset improvement. The actions to improve the risk profile by installing intermediate train stops at Richmond and Carlingford were not implemented before the collision.
Following the collision, Sydney Trains has reviewed the signal system at Richmond and implemented a signal control upgrade utilising two intermediate train stops and one fixed train stop to reduce the risk of a train overshooting the platform at Richmond Station. The installation occurred in April 2019, 15 months after the collision. This train stop would trigger a brake application if a train speed exceeds 25 km/h approaching the train stop.
On the day of the collision, at signal RD5, the approximate speed of A42 was 47 km/h. The shortcoming of an intermediate train stop is that it is still possible for a driver to increase speed once past the signal and also for the driver to become incapacitated past the train stop. Another system to control train speed, Automatic Train Protection, was planned to be implemented at the time of the Richmond collision.
Automatic train protection system
The Automatic Train Protection system (ATP) is a system that monitors the train’s speed against the trackside target speed. It alerts the driver of a braking requirement and automatically applies train brakes if its speed significantly exceeds line speed parameters. It consists of on-train and trackside equipment that act independently of drivers and signallers (Figure 14).
Figure 14: Automatic Train Protection
This figure shows the functionality of the ATP system as the train approaches a buffer stop.
Source: Transport for NSW
The implementation of ATP on the Sydney passenger rail network was one of the recommendations of the Special Commission of Inquiry’s report into the Waterfall train derailment in 2003. It recommended that: ‘RailCorp should progressively implement, within a reasonable time, level 2 automatic train protection. Level 2 ATP systems provide automatic enforcement (slowing/braking) of authority (speed/location) if a train is behaving in an unauthorised way.’[49]
The ATP project was first commenced by RailCorp in 2006 and was progressed until June 2012 when responsibility for the delivery of the project was transferred to TfNSW.
All recommendations from the Special Commission of Inquiry were tracked, initially by the NSW rail regulator, the Independent Transport Safety Regulator (ITSR), and since 10 March 2017, the national rail regulator, the Office of National Rail Safety Regulator (ONRSR). ONRSR reports publically on open recommendations.
The report into the implementation of the NSW government’s response, published in April 2018, provided a comprehensive update of the progress of the installation of ATP (Table 2). It stated: ‘With the exception of the Tangara fleet, the forecast completion date for the delivery of TfNSW’s ATP project is December 2020 and full deployment is expected in May 2021 with the anticipated completion of the Tangara fleet upgrade’.[50]
Table 2: Forecast completion dates for Automatic Train Protection
Source: ONRSR
The installation of ATP on Waratah (A-sets), if installed at the time of the buffer stop collision, would likely have prevented the train colliding with the buffer stop at Richmond. The system would have detected that the train was approaching the buffer stop at unauthorised speed and applied the train’s brakes automatically.
In-cab audio and video recording
The cause of the driver being unresponsive at the controls for a period of time leading up to the collision may have been resolved if the driver’s cab was fitted with an inward-facing camera recording the driver’s actions. The video may have shown what the driver was doing and his state of consciousness leading up to the collision. The presence of a camera would not have prevented the collision, but would have assisted in the post-incident analysis. An audio recording, synchronised with the camera, may have provided additional information about the driver’s actions, and possible alarms or sounds inside the cab. Having audio and video recording allows investigators to eliminate, early in the investigation, potential contributory factors such as mobile phone-use or other distraction-type events.
Waratah trains are fitted with 64 internal and 34 external cameras (including 16 cameras on each side plus one camera at each end). Only one of the end cameras faces forward (at any time) with the other rearward. They both record. The guard cannot select to view the images from the end of set cameras. At approximately 250 m prior to the station, the guard’s surveillance screens automatically switch to display external side camera views to display entry into the platform. The forward-facing cameras have proved especially useful for investigators in determining what has happened during events such as: derailments, SPADs, level crossing incidents and collisions. Forward-facing video of the buffer stop collision was available and proved useful in analysing the event.
There is no current requirement for rail operators to fit inward-facing cameras or voice-recording devices in driver’s cabs. In NSW, there is rail safety compliance code for data loggers which sets out minimum requirements for data loggers fitted in rolling stock.[51] While it does not specify inward-facing cameras, it does mention that operators may consider cab-based forward-looking video recording. Many rail operators have already fitted, of their own volition, forward-looking video cameras.
A precedent for in-cab recording of drivers exists in the NSW bus transport environment where inward-facing cameras and audio-recording microphones are installed to record driver’s actions. Metropolitan bus operators are required under the Passenger Transport Regulation 2017 to ensure each bus in the fleet is fitted with an approved security camera system.[52] The requirement is that, along with other cameras, a camera is installed in the driver’s cabin and is directed towards the driver, including one microphone in the vicinity of the driver. These requirements are specified under Transport for NSW bus procurement contracts. Protections against use for unauthorised purposes exist in the regulation. The use of these recordings has proved invaluable in determining the cause of many accidents, particularly driver incapacitation incidents, and has played an important role in improving operational safety.
In the USA, the NTSB have long advocated the use of recording devices inside locomotive cabs as an aid in accident investigations and for use by transportation management in efficiency testing and performance monitoring programs. Their initial recommendation for voice recorders came as a result of their investigation of a 1996 accident between a Maryland Rail Commuter train and an Amtrak train near Silver Spring Maryland. There were 11 fatalities including three operating crew.[53]
The NTSB have reiterated and enhanced this recommendation in numerous accident investigations since. In 2010, the NTSB, in a safety recommendation report, made a recommendation to the Federal Railroad Administration (FRA) to require the installation, in all controlling locomotive cabs and cab car operating compartments, of inward- and outward-facing audio and video recorders capable of providing recordings to verify train crew actions and train operating conditions.[54] In 2015, US federal legislation[55], required inward- and outward-facing cameras on all passenger locomotives (when leading). According to the FRA, most larger freight operations and a few passenger operations have already installed inward-facing cameras in anticipation of regulation.
In 2013, the Transportation Safety Board of Canada (TSB) recommended ‘The Department of Transport require all controlling locomotives in main line operations be equipped with in-cab video.’[56] Since that time, the TSB have continued collaborative efforts to move the issue forward, and in May 2017, legislation was introduced in the Canadian House of Commons to mandate locomotive voice and video recording (LVVR) in locomotive cabs. Transport Canada has been conducting pre-consultation and drafting of its new regulations relating to the introduction of LVVR.
The following table shows recent Australian rail investigations where in-cab audio and video recording of the driver, if available, would likely have assisted in determining the actions of the train crew and would likely have provided an accurate record of the events in the driver’s cab (Table 3).
Table 3: Australian rail incidents where in-cab audio and video recording may have assisted the investigation
Location
Date
Title and brief summary
Hurlstone Park, NSW
30 Jan 2013
Multiple SPAD by freight train 9837 – train crew, both possibly asleep, passed two signals at stop while track workers were on the track ahead.
Kilbride, NSW
22 May 2014
Near hit with detrained passengers on track at Kilbride - the crew of V938 detrained passengers onto the track without having arranged the required train protection.
Mt Druitt, NSW
12 Mar 2015
Wrong running direction involving passenger train 165-S – a driver drove an empty cars passenger train in the wrong direction for 761 m.
Hornsby, NSW
17 Dec 2015
SPAD and derailment of empty Tangara service 109D – driver was distracted by another driver in the cab and passed two signals.
Muswellbrook, NSW
2 Dec 2016
Disabled Xplorer passenger service NP23. Driver reacted to fire alarm from auxiliary engine and over 200 passengers stranded on board train.
Unanderra, NSW
22 Apr 2017
Runaway of grain train 8960 – a fully loaded grain train ranaway down Illawarra mountain reaching a speed of 107 km/h.
Petrie, Qld
12 Oct 2017
SPAD by train 2552 – a driver, driving an empty suburban passenger train, passed a signal at stop and did not recall acknowledging the onboard Automatic Warning System.
Bowen Hills, Qld
10 Jan 2018
Signal ME45 passed at danger resulting in a near-miss between suburban passenger trains TP43 and TR50. The driver was unaware of the SPAD occurrence and continued to operate the train as if the signal was not displaying a stop indication.
Wagga Wagga, NSW
1 Mar 2019
Pacific National grain train 5KC3 passed a series of signals at danger. The train came to a halt approximately 3 km from train 5BM9 which was travelling in the down direction on the same line.
In many investigations, having in-cab audio and video recordings from the driver’s cab would have provided unequivocal primary evidence to assist in determining the contributory factors to an incident.
It would be beneficial if the relevant Australian agencies would commence the process of consultation with key stakeholders regarding a requirement for Australian rail operators to install in-cab audio and video recorders in driver’s compartments.
Buffer stop issues
Buffer stops are infrastructure items at the end of rail tracks or sidings which are used to prevent rolling stock from running off the end of the track or colliding with adjacent structures. In the event of a train colliding with the buffer stop, another main function is to reduce the impact forces transmitted through the rolling stock in order to minimise injury to train crew and passengers and to minimise damage to the rolling stock itself.
Energy-absorbing and fixed buffer stops are the two most common types used by railways in Australia. The purpose of an energy-absorbing buffer stop is to progressively transform a train’s energy into heat through friction elements that move together with the buffer stop frame along the track or through the displacement of hydraulic rams or springs. Fixed buffer stops generally consist of a frame or block rigidly fixed to the rails or in the ground. A rigid buffer stop has a limited ability to dissipate a train’s kinetic energy and is generally only effective in low-speed collisions (10 km/h or below).
The ASA buffer stop standard specifies that the energy-absorbing buffer stops may be of the following types:
Friction – used where there is sufficient distance for the friction shoes to slide along the rails (Figure 15)
Hydraulic – dissipate energy where hydraulic rams slow the train (Figure 16)
Combination of friction and hydraulic – initial impact taken by the hydraulic rams with residual energy transferred to the buffer frame (Figure 17).[57]
Figure 15: Friction buffer stop
This shows an energy- absorbing friction buffer stop. It has sliding friction shoes, anti-climbers and a coupler-compatible arrangement at the front.
Source: TfNSW with annotations by ATSB
Figure 16: Hydraulic buffer stop
This figure shows an energy-absorbing hydraulic buffer stop. It has hydraulic rams, a buffer beam and a coupler-compatible arrangement at the front.
Source: TfNSW with annotations by ATSB
Figure 17: Combination hydraulic and friction buffer stop
This figure shows an energy-absorbing combination of hydraulic and friction buffer stop. It has friction shoes designed to stop or slow the train upon impact. The front of the buffer stop has a hydraulic arm with a rubber face coupling arrangement.
Source: TfNSW with annotations by ATSB
The buffer stop at the end of Platform 2 at Richmond Station (the Richmond buffer stop) did not absorb the energy of the collision with A42 as was expected. The reason is that the hydro-pneumatic rams on the buffer stop were not aligned with the crash energy management system at the front of the Waratah train. Instead of the rams aligning with a solid surface and absorbing energy, they penetrated the cavity on either side of the automatic coupler at the front of the train and were bent downward and inward. The buffer was designed for rolling stock operating at the time of installation such as the K-set, introduced into service 1981-85. These were not operating on the Richmond line at the time of the accident.
As a result of these energy-absorbing rams not performing as intended, the force of the collision was instead transferred to the crash energy-management system of the train and the concrete body of the buffer stop. The front of the coupler collided with the vertical face of the reinforced concrete end stop of the buffer stop. This activated the crash energy management system associated with the coupler which features gas-filled chambers and crash tubes. It should be emphasised that, ideally, the rams on the buffer stop act in conjunction with the train’s crash energy management system to absorb impact energy (Figure 18).
Figure 18: Richmond buffer stop and front CEMS of A42
This figure shows the plan view and side view of the Richmond buffer stop and the front of train CEMS of A42 just before contact.
Source: Downer with annotations by ATSB
The buffer stop at Richmond has an energy capacity of 896 kJ which represents approximately 8% of the total collision energy associated with an impact speed of 26 km/h. This type of buffer is suited for low-speed collisions of approximately 10 km/h.
The latest buffer stops installed on the Sydney metropolitan rail network are compliant with the current ASA buffer stop standard. The current ASA buffer stop standard states that buffer stops should be designed to suit the range of couplers on the rolling stock operating on that track.[58] The energy-absorbing aspect of the Richmond buffer stop was not compatible with this Waratah train which operated regularly on the Richmond line and had done so for more than 5 years. The Richmond buffer stop was not compatible with most other Sydney Trains rolling stock.
As discussed earlier, an external engineering consultancy was commissioned by RailCorp in 2005 and 2008 to review the effectiveness of overrun protection.
The 2005 report investigated and reviewed what overrun protection was in place in the Sydney greater metropolitan area. It made recommendations to reduce the risk of overrun in 35 locations. Richmond was one of these locations and the report recommended the installation of a friction-type buffer stop, as well as extending the platform length by 1 m.
The 2008 report focussed only on the two identified high-risk locations, Richmond and Carlingford. It reported that the existing buffer arrangements at Richmond would not survive an impact of a 500 t train with an approach speed of 26 km/h or above.[59] This assessment was incorrect, as was demonstrated in the collision with the buffer stop on 22 January 2018. The collision showed that in fact the buffer stop would stop a 500 t train at 26 km/h (despite the energy-absorbing arms not performing as designed). The train was successfully stopped, and then recoiled approximately 3 m. The buffer stop survived largely intact and was moved approximately 12 mm backward.
The 2008 report recommended a number of improved buffer stop options for Richmond platform 2. Like the 2005 report, one option recommended was the installation of a friction-type buffer stop and the extension of the platform by 1 m. Another option recommended was the installation of a combination hydraulic and friction buffer stop. As stated previously, there was no evidence provided to indicate that RailCorp acted upon any of the recommendations regarding overrun protection at Richmond or Carlingford stations, nor could any reasons be provided for the inaction.
Neither the 2005 or the 2008 report mentioned the potential ineffectiveness of the hydro-pneumatic rams on the Richmond buffer stop. Also, the reports did not discuss the compatibility of the buffer stops with the crash energy management systems on the newer rolling stock. At the time the reports were written, both the T-set (Tangara) and M-set (Millennium) trains, which are fitted with the Scharfenberg coupler and a form of crash energy management system, were in operation.
Design of the replacement buffer stop at Richmond
Following the collision, Sydney Trains assessed the damage to the buffer stop at Richmond Platform 2 and conducted an internal investigation. They also convened meetings with internal and external stakeholders, including the ASA and the original engineering manufacturer of the hydraulic rams. After considering a range of options, Sydney Trains decided to demolish the existing Richmond buffer stop and replace it with a redesigned buffer stop that is compliant with the ASA buffer stop standard (Figures 19 and 20). This design may be used for replacement of other buffer stops on similarly highly length-constrained passenger terminating site on the Sydney metropolitan rail network.
Due to the proximity of a major road, Market St, situated behind Richmond Station, it was determined that it was not feasible to extend the length of the track past the platform. This restricted the type of energy-absorbing buffer stop that could be installed at the western end of Richmond Platforms 1 and 2 to a hydraulic buffer stop. The extension of the platform to the east was also problematic due to the track and infrastructure configuration. This means there was not the requisite activation length[60] for a friction buffer stop or a combination hydraulic and friction buffer stop at Richmond Platforms 1 and 2.
The replacement buffer stop design includes a buffer beam design where the dimensions are adjusted to suit the rolling stock operating in that area. The design complies with the standard which states that the buffer face should be designed for the automatic coupler (Sharfenberg type 10) but should also be capable of stopping a train fitted with an automatic (AAR 10A) interlocking coupler. The buffers also incorporate anti-climber contact areas to reduce the risk of a train overriding the buffer stop upon collision at a speed above the design speed.
Figure 19: Redesigned buffer stop
This diagram shows the design for an energy-absorbing hydraulic buffer stop that was the basis for the replacement buffer stop at Richmond.
Source: Sydney Trains with annotations by ATSB
Figure 20: Redesigned buffer stop for Waratah and Millennium trains
This elevation drawing shows the differences in design of the front buffer beam for the Waratah and Millennium trains.
Source: Sydney Trains
Risk assessment of buffer stops
Sydney Trains indicated that there were a total of 167 buffers stops in the Sydney metropolitan network. According to a network-wide review of buffer stops undertaken by Sydney Trains, following the incident, none of buffer stops, at the time of the collision, met the ASA buffer stop standard Specification ASA T HR TR 25000 ST V1.0, 10 July 2017. The majority of these are at the end of sidings and stabling yards where passengers would not be expected to be on board the service. For example, at Richmond, only two of the three buffer stops are at the end of a regular passenger line. The other line, the Up storage siding, has no platform for passenger access.
The most safety-critical buffer stops are positioned where approaching trains have passengers on board. These are typically at the end of a regular passenger line, examples of which are at Carlingford, Cronulla, Richmond and at Sydney Terminal (Central). An additional function of many of these buffer stops is that they prevent the train from running off the track and entering another environment.
The Carlingford buffer stop, when inspected in March 2019 (14 months after the Richmond collision), still had the standard Department of Railways NSW, Way and Works Branch, 1963-designed timber fixed buffer stop bolted to the track (Figure 21). Reviewing the effectiveness of this buffer stop, the 2008 report calculated that timber buffer stops are unable to resist a force of 1000 kN and would break away. The report stated that ‘the current fixed timber buffer stop would not be able to arrest any train effectively at any speed.’[61]
Figure 21: Fixed buffer stop at Carlingford station
This figure shows the buffer stop at the end of the line at Carlingford station on the Sydney rail network.
Source: ATSB
Following the collision, Sydney Trains conducted an end-of-line risk prioritisation of the safety-critical buffer stops on its network. The review rated 23 buffer stops with a category 1 level hazard rating and a further 15 with a ranking range from 2 to 5. The following four locations achieved a top prioritisation for mitigation measures to be put in place: Central Platform 9, Richmond Platform 2, Macarthur turn-back road, and Carlingford.
The buffer stops at Richmond Platforms 1 and 2 have been redesigned and are scheduled for replacement in 2020. The buffer stop at Richmond Up storage siding line will retain the old design buffer stop as this line is not used for passenger services.
Sydney Trains have notified this ATSB investigation that no planned upgrades to the Carlingford line will be undertaken. This line will be relinquished from Sydney Trains’ control from the end of 2019. A proposed light rail service is planned to operate in this rail corridor.
Crashworthiness and crash energy management
The aim of designing for crashworthiness is to mitigate the consequences of collisions in a controlled manner and to reduce the risk of injury to the occupants.[62] The British and European standard for crashworthiness requirements for railway vehicle bodies states that it is impractical to design for all possible crash scenarios. Therefore, the design collision scenarios chosen represent the most common collision situations and those that might result in most casualties.
These are:
A front-end impact between two identical train units
A front-end impact with a different type of rail vehicle
Train unit front impact with a large road vehicle on a level crossing
Train unit impact into low obstacle (e.g. car on a level crossing, animal, rubbish).
The general principles are:
Reduce the risk of overriding
Absorb collision energy in a controlled manner
Maintain survival space and structural integrity of the occupied areas
Limit the deceleration
Reduce the risk of derailment.
The crashworthiness requirements for the Waratah were specified in a RailCorp specification,[63] and no dynamic modelling of buffer impact scenarios was conducted during the design phase of the Waratah contract.
T-sets (Tangara) introduced into service between 1988 -1995 have a lower level crash energy management systems (CEMS), incorporating anti-telescoping columns designed to withstand a static end load of 700 kN. CEMS is not present on earlier model rolling stock such as the S-sets, K-sets or C-sets.
A feature of newer Sydney Trains passenger rolling stock is the presence of a CEMS. This feature is present on M-sets (Millennium) and A-sets (Waratah), however, the newer A-sets can accommodate a significant increase in energy absorption capacity in CEMS over the M-Sets. Although not explicitly specified in any standard, the M-set was the first to use anti-climbers between carriages. The design energy absorption capacity on the leading car is 3.215 MJ at 50 km/h which exceeds the British Standard Railway Group requirement of 1 MJ.[64] The collision energy of the train at this impact was calculated as approximately 10 MJ.
The design of the A-set enhances the crashworthiness performance by limiting vertical and lateral movement and has crush zones at the end of each car. The crush zones of unoccupied areas are intended to collapse in a controlled progressive manner, which assists to keep the cars in-line. The A-set CEMS was not designed to interface with the buffer stop arrangement installed at Platform 2 Richmond Station.
An ASA standard exists for the structural integrity and crashworthiness of passenger rolling stock. This standard covers the minimum requirements that passenger rolling stock shall meet over its design life. [65] It adopts the requirements from national and international standards including European standard EN 15227: 2008.
The Australian Rail Industry Safety and Standards Board have developed an Australian Standard (AS 7521:2017) which includes a section on collision energy management. It states that the rolling stock collision energy management strategy shall be supplied by the rolling stock designer. This strategy shall include the design of the interior elements and how they integrate with the exterior crashworthiness.[66]
Crashworthiness design for A-set
In 2009, on behalf of Downer, a specialist consulting firm called Delta Rail undertook a theoretical review of the crashworthiness risk of the A-set fleet as part of the public-private partnership (PPP) acquisition process. The review was to compare the crashworthiness design of the train against a train built to UK Railway Group Standard GM/RT2100 Issue 3. It stated that the collision management system was optimised for collisions between similar trains and was supported by a range of modelling and simulation. It covered the risk for collision with a buffer stop and stated:
‘In the event of a buffer stop collision, the train’s energy management system will provide some degree of mitigation, however, the level of protection will depend on the effectiveness of the contact and engagement between the coupler, anti-climbers and the buffer stop, together with the energy absorbing properties of the buffer stop. Some buffer stop types have very little likelihood of utilising the energy absorption capacity of the coupler because the coupler head cannot be restrained laterally under longitudinal loading, or is too low to contact the buffer stop, or there is no contact face in the region of the coupler. If the coupler does slip laterally on the buffer stop face, there may be considerable damage to the vehicle in the coupler pocket area without corresponding benefit in terms of controlled energy absorption.
‘However, the PPP train will be no different in this respect from a GM/RT2100-compliant train. The remaining cars in rear of the leading car will retain the benefit of the energy management system. In the UK, Railway Group Standards GC/RT5033 and GC/RC5633 recommend that if the rolling stock on a route is to be changed, there should be a review of buffer stops by the infrastructure owner, and a risk assessment methodology is provided. It is therefore recommended that closure of this risk should be formally transferred to Railcorp.’[67]
This recommendation that the review of buffer stops be undertaken if the rolling stock on the route is changed was not completed by RailCorp.
The Waratah Train crashworthiness performance was verified with respect to the requirements specified in the Train Performance Specification. This included:
Dynamic impact testing on the couplers (both automatic and semipermanent couplers) [68]
Verification testing on car end structure, vertical end crash barriers columns and anti-climbers[69]
Design mass estimation and centre of gravity locations [70]
VAMPIRE[71] simulations of the static twist test [72]
Finite element analysis of energy-absorbing crash boxes [73]
It should be noted that verification of the A-set crashworthiness capabilities is based upon numerical simulations in conjunction with physical testing of the energy absorption elements. There was no physical testing of the overall set. The crash simulations are mathematical studies of the expected behaviour of the rail vehicles’ response in various collision scenarios under particular conditions, the actual performance of the train in a real world collision may differ.
CEMS features on A-set
As stated previously, the presence of a CEMS is a feature of the A-sets. The following are the key design elements of the A-set’s crashworthiness methodology:
The couplers consist of couplers at the end of the terminal cars and semi-permanent couplers between cars on an 8-car set. The coupler system is a standard design and the coupler head is fitted with a Scharfenberg (Voith) 10 coupler. The couplers incorporate both regenerative and non-regenerative energy-absorbing devices in the form of a gas-hydraulic ram (for elastic deformation) and a deformation tube (for plastic deformation). The gas hydraulic ram absorbs energy at varying amounts depending on the speed of collision. It reduces deceleration and recoil and also delays the point of structural deformation. It is designed to absorb the energy of an 18km/h symmetric collision without activating the deformation tubes.
The deformation tubes, if activated, consist of a mandrel which is forced into a tube of a slightly smaller diameter. This interference fit means that the mandrel deforms the tube and increases the tube diameter as it passes along the tube. The plastic deformation dissipates energy from the collision. Each tube is designed to arrest the design force at specified locations along the train set. It also withstands vertical loading which may assist in prevention of overriding.
On the end-of-train couplers there is up to 250kJ elastic deformation energy and 700kJ of plastic deformation energy-absorption capacity. On the semi-permanent couplers there is up to 480kJ elastic deformation energy and 1350kJ of plastic deformation energy-absorption capacity.
Two crash boxes, one on each side of the car, are located at both ends of all cars of the train. The crash boxes use a sacrificial deformation zone of an aluminium honeycomb core with a piston and ram arrangement (Figure 22). This absorbs a higher speed collision energy at a constant force level.
Figure 22: CEMS elements on leading end of A-set driving (or terminal) car
This figure shows the parts of the crash energy management system on the driving car of an A-set.
Source: Downer with annotations by ATSB
Located on the front of the crash box rams are devices called anti-climbers (Figure 23). Anti-climbers consist of horizontal rib-like arrangements which are aligned to mesh with a coinciding anti-climber on the adjacent car (or buffer stop). The aim of the anti-climbers is to prevent vehicle overriding in the event of a collision impact and reduce the risk of telescoping of car bodies.
Figure 23: CEMS parts on intercar end of A-set driving car
This figure shows the parts of the crash energy management system on the intercar end of the driving car of an A-set.
Source: Downer with annotations by ATSB
Two collision pillars (posts) are also fitted to both ends of all cars (Figure 23). These provide additional strengthening to the end wall of the car to protect occupants. At the cab end of the train they terminate at window sill-height but otherwise extend from floor to ceiling height.
There are also a number of improvements to the A-set design that improved its strength and crashworthiness capability. These include:
The behaviour of any train during a collision is dependent upon many factors including the track geometry (straight or curved), how the colliding cars interact, the coupling between cars, and the crush performance of the cars. If overriding of cars occurs, this can cause shearing or crushing of the lower car with the consequent serious risk to passengers. Another negative interaction caused by a collision can be lateral deflection in which the coupled cars form an accordion pattern when viewed from above. This escape from the track envelope creates additional risk, such as collision with a train on an adjacent track. An effective crash energy-management system will limit the vertical and lateral motions of the cars and lead to a controlled collapse of crush zones. Research has shown that this is effective in assisting to keep cars in line. A controlled deformation and collapse of designated sections also reduces the deceleration on passengers and crew.
The crash energy management system on an A-set is optimised to minimise force levels. The crash response sequence of the CEM is designed to be progressive in nature, with the initial contactor deforming first, followed by the next structural component, and progressively along the train. Each section should exhibit sufficient resistance so that the plastic deformation of the previous section can dissipate energy.
It is anticipated that the leading car (Car 1) would be the first contact point of most collisions. In this case the following sequence should occur:
At the front of Car 1, the coupler engages, pushing back the gas-hydraulic ram for a stroke of 125 mm. Then, at the end of the stroke of the ram, the force build-up causes the deformation tube to activate for a 300 mm stroke.
At the front of Car 1, on each side of the coupler, the anti-climbers engage (minimising vertical movement to prevent intrusion into the passenger area) and the crash boxes on each side are activated for a stroke of 750 mm.
Between Car 1 and Car 2, the semi-permanent coupler gas-hydraulic buffer engages for a stroke of 125 mm. Then, at the end of the stroke of the ram, the force build-up causes the deformation tube to activate for a 125 mm stroke.
Between Car 1 and Car 2, on each side of the coupler, the anti-climbers engage with each other and the crash boxes on each side are activated for a stroke of 300 mm in conjunction with the remaining stroke of the deformation tube.
The between-cars energy transfer by the semi-permanent couplers and the crash boxes is repeated for the rest of the cars progressively along the train.
A42 damage description following collision
The initial observation of the train revealed that damage was mainly confined to the front of the train and the areas between the cars. The body of the cars and interior passenger areas showed little visible damage or deformation. Predictably, the further from the impact zone, the lesser damage level.
More comprehensive and intrusive inspections of the train and its components were carried out in the months following the collision. These inspections found that the front of the train, car D6342, sustained damage to the coupler, anti-climbers, the emergency door, the tread plate, the cab canopy, the GRP panels, wiring and piping. The intercar areas between all cars sustained some damage; this included couplers, anti-climbers, crash boxes, gangways, door panels and electrical connecting cables. Various cars sustained damage to their end walls and collision pillars. A more detailed summary of damage is shown in Table 4.
Damaged gangway, severely damaged and bent coupler, damaged intercar jumper cables, damaged GRP and end wall structure, anti-climber engagement, coupler indented into draft gear pocket.
Intercar 2
Damaged gangway, severely damaged and bent coupler, damaged intercar jumper cables, damaged GRP and end wall structure, damage to 1500V DC junction box, N5542 intercar door jammed.
Intercar 3
Damaged gangway, severely damaged coupler and drift ring fractured, N5542 sitting atop T6542 anti-climbers, damaged intercar jumper cables, T6542 intercar door jammed.
Intercar 4
Damaged gangway, damaged coupler, damaged gangway GRP and end panel.
Intercar 5
Damaged gangway, damaged coupler, damaged gangway GRP and end panel.
Intercar 6
Damaged coupler, gangway roof collapsed.
Intercar 7
Gangway roof collapsed.
Source: Downer
Performance of A42 CEMS
The CEMS on Waratah passenger train A42 reduced the impact force of the collision but did not perform optimally. It did not perform as the design or modelling predicted. It should be noted that collision energy was reduced by the presence and performance of a CEMS, which likely lessened the injury level of passengers. The type of collision with a buffer stop, like the Richmond buffer stop, was not one of the scenarios specified in the original train performance specification.[75]
Downer evaluated the impact speed from a number of data sources and concluded that the impact speed was in the range of 26 km/h ± 2 km/h. A small variation in velocity has a significant effect on the impact energy. For instance, the impact speed at 28 km/hr has a kinetic energy of 12 MJ while the impact speed of 24 km/hr has a kinetic energy of 9 MJ.
According to calculations by Downer, a simulation of the Richmond collision predicted that 7.5 MJ (or approximately 70%) of the collision energy would be absorbed by the CEMS. The remainder of the energy would be absorbed by the eight-car body structure.[76] It was estimated that 4.5 MJ (or approximately 40%) of collision energy was actually absorbed by the CEMS during the Richmond collision. There were inconsistencies between predicted and actual behaviour of the CEMS:
The predicted forces and decelerations experienced by the cars were significantly greater than the design load cases.
There was inconsistency between simulation results and post-collision observations where the actual structural damage is considered to be minor with no failure at equipment mounts.
There were significant portions of unaccounted energy.[77]
The rapid deceleration of A42 on impact caused pitching on the suspension in relation to the car’s centre of gravity, because the CEMS did not activate properly and fully activate, due to the incompatibility between the CEMS and the Richmond buffer stop. A meeting, attended by representatives from Downer, Sydney Trains and TfNSW, discussing A42’s performance recorded:
‘The vehicle pitching meant that coupler angular displacement exceeded the 8-degree service limit, inducing significant bending in the shanks and in some cases preventing the couplers from fully stroking.
The induced bending of the coupler shanks is quite likely the reason why some of the intermediate couplers collapse tubes did not activate.
Vehicle pitching of approximately 308 mm relative vertical displacement on some vehicle ends resulted in the anti-climbers being vertically misaligned between the car ends.’[78]
Following the incident at Richmond, Downer, in consultation with Sydney Trains and TfNSW, have commissioned a third party to 3D model the collision. The results of this 3D modelling were inconclusive and Downer have completed their own linear modelling.
Downer conducted a comprehensive examination of the performance of each component of the CEMS. The table below lists the CEMS components for the eight cars, the calculated load absorption level (for estimated speed impact of 26 km/h), their maximum stroke displacement and the actual Richmond stroke displacement (Table 5).
Table 5: CEMS components and force level, maximum stroke displacement and actual Richmond stroke displacement
LOCATION
COMPONENT
FORCE (kN)
MAX STROKE (mm)
RICHMOND STROKE (mm)
LEAD END
Coupler (Gas Hydraulic)
2325
125
124
Coupler (Deformation tube)
2325
300
115
Crash boxes
2600
800
Left 0, Right 50
INTERCAR 1
Coupler (Gas Hydraulic)
2250
250
247
Coupler (Deformation tube)
2250
2250
300
300
215
39
Crash boxes
600
300
Left 168, Right 175
INTERCAR 2
Coupler (Gas Hydraulic)
2125
250
250
Coupler (Deformation tube)
2125
2125
300
300
0-3
41
Crash boxes
550
300
Left 194, Right 38
INTERCAR 3
Coupler (Gas Hydraulic)
1950
250
248
Coupler (Deformation tube)
1950
300
300
Crash boxes
2425
300
Left 4, Right 1
INTERCAR 4
Coupler (Gas Hydraulic)
1800
250
250
Coupler (Deformation tube)
1800
300
300
Crash boxes
1950
300
Left 10, Right 4
INTERCAR 5
Coupler (Gas Hydraulic)
1950
250
247
Coupler (Deformation tube)
1950
300
115
Crash boxes
2425
300
Left 0, Right 0
INTERCAR 6
Coupler (Gas Hydraulic)
2125
250
249
Coupler (Deformation tube)
2125
2125
300
300
0
9
Crash boxes
550
300
Left 0, Right 0
INTERCAR 7
Coupler (Gas Hydraulic)
2250
250
223
Coupler (Deformation tube)
2250
2250
300
300
0
8
Crash boxes
600
300
Left 0, Right 0
Source: Downer
A few examples of the performance of A42’s CEMS are shown below.
The front edge of both anti-climbers contacted the buffer tube flange on the face of the concrete buffer stop (Figures 25 and 26). The driver’s side crash box activated and deformed rearwards by 50 mm; this damaged the fibreglass canopy and floor. The guard’s side crash box did not activate despite the anti-climber also contacting the buffer tube flange (Figure 27). The maximum stroke for the crash box rams behind the anti-climber was 800 mm. It is possible the edge contact transferred angular force to the anti-climber, this did not allow the ram to slide and deform as designed.
Figure 25: Position of anti-climbers on leading car
This figure shows position of the anti-climbers on the leading car of A42 and the edge which contacted the buffer tube flange.
Source: ATSB
Figure 26: Damage from impact with anti-climbers
This figure shows the damage to the buffer stop tube flange (Right side) following contact with A42’s RHS anti-climber (Left side) and the corresponding damage to the RHS anti-climber edge.
Source: ATSB
Figure 27: Crash box ram from left side of A42 leading car
This figure shows the crash box ram being removed from A42. This ram did not activate during the collision as the contact area on the anti-climbers was at the side of the crash box on the radius of the outside corner of the anti-climber teeth. The anti-climber teeth fractured or sustained plastic flow under the extreme contact pressure and lost the force on the front of the crash box.
Source: Downer with annotations by ATSB
The semi-permanent coupler between the first and second cars (Figure 28), and that between the second and third cars were bent and damaged. The vertical angular movement of the semi-permanent coupler is limited to 8 degrees (by design). This vertical limit was exceeded by the excessive pitching due to the CEMS not properly activating. The other four semi-permanent couplers also sustained damage. The anti-climbers between the third and fourth cars did not engage and instead one anti-climber damaged the 1500V DC junction box on the other car (Figure 29). The only semi-permanent coupler not to sustain damage was the semi-permanent coupler between the seventh and eighth cars.
Figure 28: Bent semi-permanent coupler
This figure shows the bent coupler between the first and second cars (D6342 and N5342) and also the contact witness marks on the anti-climbers.
Source: ATSB
Figure 29: Anti-climber into junction box
This figure shows the No. 1 end of motor car N5542 overriding the No. 1 end of trailer car T6542, between the third and fourth cars. The anti-climber has damaged the 1500V DC junction box.
Source: ATSB
The bending of the couplers between the first two car interfaces, and the derailment of all wheels of a bogie (Figure 30), is indicative of vertical pitching that occurred because of the forces being transferred along the train not in a line of action close to the centreline through the couplers. This affected the alignment of the anti-climbers, which reduced their effectiveness in containing vertical movement (Figure 31).
Figure 30: Derailed wheels
This figure shows the derailed wheels on the bogie on the No.1 end of the fifth car (T6642) (non-platform side).Source: ATSB
Figure 31: Normal configuration of anti-climbers
This figure shows the anti-climbers in their normal configuration between the seventh car (N5442) and the eighth car (D6442).
Source: ATSB
The existence of CEMS on A-sets meant that the force experienced by the passengers was less than if they had been on another, older type of Sydney Trains rolling stock. It was estimated that the CEMS absorbed approximately 40% of the collision energy. The train bodyshell showed no gross deformation and the seating fixtures and handrails all remained intact. All exterior passenger doors remained closed and windows unbroken. The passenger and crew blunt trauma injuries were likely caused by secondary impact with interior fittings or surfaces. None of the fittings contributed excessively to the injury toll. The impact inertia feature of the seats performed as designed, where the moveable seats locked under the impulsive collision force. Potential injury-causing mechanisms such as crushing, ejection, penetration or burns did not occur.
Emergency response management
The notification of the incident to Triple Zero and the Rail Management Centre occurred within two minutes following the collision. Within ten minutes, NSW Fire & Rescue, NSW Police and NSW Ambulance were on site. At 1004, eleven minutes later, NSW Police took control of the site. During this time, paramedics, Sydney Trains staff and uninjured passengers assisted in evacuation and provided first aid to injured persons.
In accordance with his training, the station duty manager performed the notification task by placing a call to network control. Following the collision, the station customer service staff and other Sydney Trains employees present provided ongoing relevant information, directed and controlled the events on-site until the arrival of emergency services personnel.
The incident occurred at a staffed suburban station close to major facilities, which meant that staff were already on hand and the location did not present difficulties in terms of emergency services accessing the site. Triage of injured persons was conducted promptly and all services performed well in the stressful environment of the accident site. Open access to the accident site was required, especially during the initial evacuation and treatment period. Afterwards, a police demarcation tape and security personnel on Platform 2 kept the site partially secure from contamination by non-involved persons. The investigation determined that the emergency response at Richmond was effective.
An examination of Sydney Trains emergency management documents found that Sydney Trains have detailed emergency management guidance for staff involved in responding to major emergencies such as occurred at Richmond. Prior to the incident, the station duty manager at Richmond had completed training in responding to a workplace emergencies, fire incidents and evacuation of a station.
According to Sydney Trains, since 2014 up to the time of the incident, they had conducted 38 evacuation exercises at various stations across the Sydney Trains network. These exercises involved conducting live evacuation drills with the objective of testing Sydney Trains' capability in responding to and managing incidents on stations across the Sydney Trains network.
The evacuation exercises were conducted across the network and at times involved over a hundred individuals at a time, mostly in conjunction with emergency services. The scenario in each of these exercises was similar and usually involved a bomb threat, utilising the fire management system, manipulating points and hand signalling at failed signals.
Other exercises conducted at regular intervals included:
NSW Fire & Rescue train lift and rescue exercises
Bushfire preparation
Counter-terrorism exercises with Australian Defence Forces
Bridge, train and tunnel evacuation
Train and track familiarisation.
In addition, a local station desktop exercise was conducted at Richmond Station in October 2018 as part of the monthly station team briefing. The desktop exercise scenario related to a station power failure. No emergency preparedness exercise, desktop or otherwise, could be identified that included a passenger train collision with another train or a collision with a buffer stop.
Organisational risk management
Sydney Trains manages operational risks through a safety management system that comprises 20 elements. These elements include: safety responsibilities, asset lifecycle management, and engineering and operational standards. This system contains a series of interconnected documents that describe what must be done to manage safety, who is responsible, and how certain tasks must be done. The element of ‘Manage Operational Safety Risk’ describes a cascading series of risk documents that identify and assess operational risks, assign control, monitor, and review the implementation of the controls.
Identified in the Sydney Trains safety risk register was the hazard of a passenger train overshooting a designated stop point at a station. The incapacitation of a rail vehicle driver was also identified as one of the potential causes of a passenger train overshooting a designated stop point at a station. Six causes for this incapacitation were listed: ill health, influence of drugs and/or alcohol, stress, fatigue, distraction and confusion. The relevant preventative controls for a rail vehicle driver incapacitation, and the status at the time of the incident, were given as:
Automatic train protection (not operational at the time of the collision).
Driver safety system (installed on A42 but did not detect the driver’s incapacitation).
Rail safety worker health assessment program.
The relevant mitigative controls for a rail vehicle driver incapacitation, relevant to the Richmond incident, were given as:
Buffer stop design satisfies integrity requirements for absorbing an impact.
Crashworthiness design of passenger train.
Intermediate train stop (recommended for Richmond but was installed only after the collision).
The buffer stop at Richmond did not absorb the impact as expected.
Sydney Trains, like all rail transport operators, is required to ensure, so far as is reasonably practicable, the safety of its railway operations.[79] So far as is reasonably practicable, Sydney Trains should have ensured the buffer stop at Richmond was designed, constructed, and maintained to appropriate standards that ensured safety on the day of the collision.
Sydney Trains responded in regards to whether the buffer stop at Richmond was suited to purpose and able to function as designed for the newer types of electric passenger rolling stock (such as the Waratah) at the time of the collision: ‘Sydney Trains owns a large number of legacy equipment, which it acquired as part of the network infrastructure. The process of assessing this legacy equipment against present standards has been occurring on a priority-based system, due to the large number of items that require such an assessment. The buffer stop type at Richmond has not undergone the assessment process.’
The buffer stop at Richmond was one of 23 buffer stops identified as a high priority during an end-of-line risk prioritisation. The site had previously been identified as a high priority for additional safety measures in reports commissioned by RailCorp in 2005 and 2008. The integrated safety management system and the risk evaluation process, since the commencement of Sydney Trains in 2013, had not verified that the Richmond buffer stop was compatible with the rolling stock running on the Richmond line.
Once controls are in place, verification must be undertaken to ensure that the controls are effective at mitigating the risks to an acceptable level. A cohesive approach to risk management needs to ensure that no gaps exist in the verification of the control of safety risks.
Downer conducted risk assessments for a variety of scenarios including a collision between two trains or with buffer stop, due to adverse weather conditions (low adhesion) and inadequate crashworthiness of train. The controls for these identified risks included:
VAMPIRE software used to address the crashworthiness requirements to verify the structural integrity of the design.
Checks that the centre of gravity of the completed car was as low as reasonably practicable.
A trade-off study on crashworthiness taking account of deformation tubes, gangway length, crumple zones and repair zones to confirm that an optimum crashworthiness design was achieved.
All crashworthiness/assembly type testing was completed before the cars were manufactured, in order to eliminate any issues for train testing and commissioning.
Ensured that checks for satisfactory condition of energy absorption components of the coupler and those incorporated in the car body structure.
Reviewed the adequacy of crashworthiness design against the following prescriptive requirements:
Structure to not fail by horizontal shearing between the car body shell and headstocks during the process of collapse.
Not collapse in a way which might initiate overriding and/or telescoping of cars or derailment of cars.
Be constructed as to mitigate the possibility of injury to occupants and other persons from such causes as detachment of components from, or deformation of, the car body structure and the formation of sharp or jagged fracture edges.
From the evidence available, the following findings are made with respect to the collision of Waratah passenger train, A42, with the buffer stop that occurred on number 2 platform at Richmond Station, New South Wales on 22 January 2018.These findings should not be read as apportioning blame or liability to any particular organisation or individual.
A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The driver of A42 did not brake at a crucial time as the train approached the buffer stop at the end of Platform 2 at Richmond Station. There was a 22-second period where no inputs were made to the train’s control system.
It is possible that the driver of A42 experienced a loss of consciousness during this 22-second period as the train approached the buffer stop. A number of possibilities during the course of the investigation were examined, these included: the driver blacking out, the driver experiencing a microsleep due to fatigue impairment, or the driver being distracted / inattentive. It could not be conclusively determined what occurred during this period.
Other factors that increased risk
When A42 collided with buffer stop at Richmond Station No. 2 platform, the reinforced concrete end stop of the buffer stop withstood the impact of the collision and prevented the train from crossing into a pedestrian and main road precinct. The two hydro-pneumatic rams on the front of the buffer stop did not perform their intended function. They were not aligned with the front of the Waratah train and instead of absorbing energy from the collision, they penetrated the cavity either side of the front-of-train coupler.(Safety issue)
The crash energy management system on the Waratah passenger train A42 reduced the impact force of the collision but not all components performed as designed.The performance of the crash energy management system was significantly limited by the buffer stop at Richmond being incompatible with the front of the Waratah train. (Safety issue)
Sydney Trains’ risk management procedures did not sufficiently mitigate risk to the safe operation of trains in circumstances when there were deficiencies in the buffer stop design at Richmond and at other locations.(Safety issue)
Sydney Trains’ risk management procedures did not sufficiently mitigate risk to the safe operation of trains in circumstances where the presence of anintermediate train stop at Richmond may have reduced the risk of trains approaching the station at excessive speed. (Safety issue)
The rostering of the driver in the days leading up to the incident was inconsistent with Sydney Trains' rostering procedures. (Safety issue)
Other findings
The train's vigilance control system did not activate in the period where the driver experienced a possible loss of consciousness. The vigilance control system cycles were timed and tested and performed as designed.
The operator enable system continued to be operated by the driver, despite the driver experiencing a possible loss of consciousness.
The passenger areas on the Waratah passenger train A42 remained intact and free from deformation following the collision with the buffer stop.
The driver was certified as medically fit to drive the train, in accordance with category A of the National Standard for Health Assessment of Rail Safety Workers, and had passed all previous medical assessments. Following the incident, he was subjected to further medical tests which could not identify any health issue apart from being diagnosed 8 months after the incident with moderate obstructive sleep apnea.
The investigation determined that there was insufficient time for the guard to react and apply the emergency brakes. There were no clues for the guard that there was anything amiss until approximately 2 seconds before the collision. The train had entered the platform at a speed that was normal and the train was decelerating slightly under the influence of the electro-dynamic braking system.
There was no fault found with the train's braking and control system.
It was determined that the emergency response at Richmond was effective.
The introduction of ATP will significantly control the risk of overrun incidents using engineering controls to supervise the train speed and enforce braking when necessary.
The absence of inward facing in-cab audio and video recording meant that the investigation was unable to verify the driver’s actions as the train approached the buffer stop at the end of Platform 2 at Richmond Station. It would be beneficial if in-cab audio and video recorders were installed in driver's compartments.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Crash energy management system did not perform as designed
Safety issue description: The crash energy management system on the Waratah passenger train A42 reduced the impact force of the collision but not all components performed as designed. The performance of the crash energy management system was significantly limited by the buffer stop at Richmond being incompatible with the front of the Waratah train.
Safety issue description: When A42 collided with buffer stop at Richmond station No. 2 platform, the reinforced concrete end stop of the buffer stop withstood the impact of the collision and prevented the train from crossing into a pedestrian and main road precinct. The two hydro-pneumatic rams on the front of the buffer stop did not perform their intended function. They were not aligned with the front of the Waratah train and instead of absorbing energy from the collision, they penetrated the cavity either side of the front-of-train coupler.
Management of risk associated with buffer stop deficiencies
Safety issue description: Sydney Trains’ risk management procedures did not sufficiently mitigate risk to the safe operation of trains in circumstances when there were deficiencies in the buffer stop design at Richmond and at other locations.
Management of risk associated with intermediate train stop installation
Safety issue description: Sydney Trains’ risk management procedures did not sufficiently mitigate risk to the safe operation of trains in circumstances where the presence of an intermediate train stop at Richmond may have reduced the risk of trains approaching the station at excessive speed.
Rostering of the driver inconsistent with rostering principles
Safety issue description: The rostering of the driver in the days leading up to the incident was inconsistent with Sydney Trains' rostering principles.
Safety recommendation description: The Australian Transport Safety Bureau recommends that Sydney Trains take safety action to ensure that existing procedures regarding adequate rest breaks between shift cycles and start time rotations are reinforced to safeguard against fatigue impairment of train crew.
Safety actions implemented
A number of organisations have advised the ATSB that, in response to this incident, the following proactive safety actions have been implemented:
Sydney Trains
Richmond Station
A temporary speed restriction of 20 km/h, from East Richmond (60.200 km) to the buffer stops was put in place after the incident. Circuitry alterations were implemented so that the train stop on RD5 would provide a speed check at that point. Buffer stop redesign measures have been completed to meet compliance with the NSW Asset Standards Authority (ASA) buffer stop standard.[8]
The new Platform 1 buffer concrete block was installed in April 2019. The Platform 2 buffer concrete block is planned for installation in January 2020. The buffers are planned for installation in February 2020.
Sydney Trains has completed a signalling upgrade at Richmond, including intermediate train stops to control the approach speed. Planning has commenced for a platform extension at Richmond. Construction is expected to be completed in 2020.
Other locations and network-wide recommendations
The remaining high-risk category locations (Central Platform 9, Macarthur, Carlingford) were assessed and speed reductions have been introduced in the short term to reduce the level of risk at these locations. Further control measures including intermediate train stops are being evaluated for installation at Macarthur and Central Platform 9 as part of the annual works program for 2019-2020. No further risk mitigation measures have been implemented at Carlingford due to the imminent closure of this line in January 2020.
Sydney Trains’ Asset Management Division has incorporated a program to assess and where appropriate upgrade buffer stops in its Annual Works Program, utilising the Buffer Stop Risk Index Prioritisation modelling for implementation sequence. Liaised with ASA to improve the process for issuing new infrastructure and rolling stock standards, adding a process where, through stakeholder consultation and risk assessment, existing equipment and its interfaces to the new standard/strategies are reviewed.
Sydney Trains have created a centralised database for equipment concession against the issued ASA standards.
Downer
Downer have undertaken investigations into the performance of the A-set in the Richmond incident. They have also completed mathematical crash modelling to provide better understanding of the Richmond collision with respect to the design’s ability to manage crash energy levels.
Transport for NSW
A network-wide Automatic Train Protection project is underway. This, among other features, will provide speed control for electric passenger trains approaching buffer stops.
The ASA reviewed their buffer stop standard and updated it with a technical note[9] to include the following amendments:
An explanation of the speed-related risk criteria to be considered during the buffer stop design stage.
Amendments to the maximum allowable deceleration rate for lighter weight rolling stock while complying with the allowable impact force requirements.
Amended maximum allowable impact force requirements that the newer generation trains can withstand with minimal damage or injury.
Glossary
Anti-climbers – plates attached to the leading and intercar ends of the train to prevent overriding in a collision.
Asset Standards Authority (ASA) – the ASA, as part of Transport for NSW, is the network design and standards authority for NSW transport assets. The ASA’s functions encompass all transport modes alongside organisational management systems, safety systems and environmental policy.
Automatic Train Protection (ATP) – a system which supervises train speed and target speed, alerts the driver of the braking requirement, and enforces braking when necessary. The system may be intermittent, semi- continuous or continuous according to its track-to-train transmission updating characteristics.
Buffer stop – mass concrete block or energy-absorbing device to stop train overrun – usually located at the end of the line (terminating station, sidings or train servicing facility roads).
Buffer stop rams – energy-absorbing hydraulic devices positioned on a buffer stop to contact with train impact point.
Coupler – the mechanism for joining two rail vehicles together.
Crash boxes – box fitted to the leading and intercar ends of the train to absorb energy in the event of a collision. (The anti-climber plate is attached to the face of the crash box.)
Crash emergency management system (CEMS) – a system integrated into a vehicle body design for controlling the energy absorbed, deceleration and structural deformation during crashes, in particular collisions.
Crashworthiness – ability to mitigate the consequences of a collision in a controlled manner and reduce the risk of injury to the occupants.
Fixed Train Stop – a device for applying train brakes if the driver exceeds the limit of authority; either at a red signal or dead end stopping point, by the means of a lever on the train striking a trackside arm.
Intermediate train stops – mechanical trackside arms, spaced intermediately on approach to a risk point, and designed to apply the emergency train brakes if the speed of the train exceeds the safe stopping speed as measured by the signal timing of the train speed in the section.
Operator Enable System (OES) – a device that applies emergency brakes and disables traction power if a continuous control input required of the driver or operator is interrupted or not detected. On conventional vehicles with an automatic brake, the emergency brake is achieved by directly venting the brake pipe to atmosphere.
Overriding – an undesirable outcome of a train collision when the end of a train car lifts vertically relative to the adjoining car.
Overrun – where a train passes a designated stopping point such as a platform or signal.
Train stop and trip gear system – a system involving a trip valve on the train or vehicle and a trip arm located track side which when engaged, directly vents the brake pipe on the train or vehicle to atmosphere. The train stop is used at signals in conjunction with a red aspect and in areas where train speed is required to be externally controlled.
Vigilance control system – a system that will react by bringing a vehicle or train to a stand if an acknowledgment input is not received within a specified time increment. On conventional vehicles with an automatic brake, this is achieved by directly venting the brake pipe to atmosphere.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Downer
NSW Police
NSW Ambulance
The Office of the National Rail Safety Regulator
Sydney Trains
Train crew of A42
Transport for NSW – Asset Standards Authority
The Transportation Safety Board of Canada
The National Transportation Safety Board (USA)
The Federal Railroad Administration (USA).
References
Australian Transport Safety Bureau. Rail investigation report (2013). RO-2013-005, Collision of passenger train T842 with station platform at Cleveland, Queensland. Published 20 December 2013.
Australian Standard (2018). AS 7521:2018 Interior crashworthiness.
Battelle Memorial Institute (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle. Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.
British Standard (2010). BS EN 15227:2008 +A1:2010 – Railway applications - Crashworthiness requirements for railway vehicle bodies.
Dawson D., Noy YI, Harma M, Akerstedt T, Belenky G. (2011). Modelling fatigue and the use of fatigue models in work settings. Accident Analysis and Prevention. Vol 43.
Desai AV, Ellis E, Wheatley JR, Grunstein RR. (2003). Medical Journal of Australia. Vol. 178. Fatal distraction: a case series of fatal fall-asleep road accidents and their medicolegal outcome.
Downer (2009). Static Twist Test Simulation, CEC00594 – CN01, 23 April 2009.
Downer (2009). Engineering Report – FEA of energy absorbing crash boxes, 15 May 2009.
Downer (2010). Rolling Stock PPP Sets – Mass Estimation, CEC00523, 8July 2010.
Downer (2010). Dynamic Crash Test, PAU817-012, 15 July 2010.
Downer (2011). Engineering test report, CTR00710-001, 5 November 2011.
Downer (2011). PPP Trains crashworthiness risk Review Delta Rail Report - Body crashworthiness risk assessment 2009 p.14. 8 November 2011.
Downer (2019). Meeting minutes 21 January 2019.
Downer (2019). CEC00903 Engineering calculation vehicle deceleration, 8 February 2019.
Federal Government of the United States (2015). Fixing America's Surface Transportation Act – Public Law. 114th Congress Public Law 94, 2015, Sec. 11411.
Folkard S, Robertson KA, Spenser MB (2006). The development of a fatigue / risk index for shiftworkers.
McInerney, PA. (2004). Interim Report of the Special Commission of Inquiry’s report into the Waterfall rail accident.
National Transport Commission (2008). National Rail Safety Guideline. Management of Fatigue in Rail Safety Workers.
National Transport Commission (2017). National Standard for Health Assessment of Rail Safety Workers. p.72.
National Transportation Safety Board (2019). Most Wanted List of TransportationSafety Improvements 2019-2020. www.ntsb.gov/mostwanted
National Transportation Safety Board (2017). Special Investigation Report, End-of-track collisions at Terminal Stations Hoboken, New Jersey, 29 September, 2016 and Atlantic Terminal, Brooklyn, New York, 4 January 2017. NTSB/SIR-18/01.
New South Wales Passenger Transport Regulation 2017 cl. 82.
New South Wales Department of Transport. Independent Inquiry Report, Coal Train Collision, Beresfield, NSW, 23 October 1997.
Office of the National Rail Safety Regulator (2011). Rail Safety Compliance Code – Data Loggers. Section 4.
Office of the National Rail Safety Regulator (2018). Implementation of the NSW Government’s response to the Final Report of the Special Commission of Inquiry’s report into the Waterfall rail accident.
Office of the National Rail Safety Regulator Asset management guideline s52 (1).
Pack A, Pack AM, Rodgman E, Cucchiara A, Dinges DF, Schwab CW. Accident Analysis and Prevention. Vol. 26. (1995). Characteristics of crashes attributed to the driver having fallen asleep.
Rail Industry Safety and Standards Board (2010). Glossary of Rail Terminology.
RailCorp Rolling Stock PPP – Double Deck Trains Train Performance Specification v21, 22 December 2015.
Regan MA, Strayer DL. (2014). Towards an understanding of driver inattention: taxonomy and theory. Journal of the Association for the Advancement of Automotive Medicine.
Senders JW. (2013). Driver distraction and inattention: a queueing theory approach. Driver distraction and inattention. Advances in Research and Countermeasures. Ashgate.
Sinclair Knight Merz (SKM) (2005). Report on existing overrun protection at terminal tracks and proposals for upgrades.
Sinclair Knight Merz (SKM) (2008). Buffer stops at Richmond and Carlingford.
Stichting Elilpesie Instellingen Nederland (SEIN) (2019). The blackout checklist.
Stutts JC, Wilkins JW, Osberg JS, Vaughn. (2003). Driver Risk Factors for Sleep-related Crashes, Accident Analysis and Prevention.
Sydney Trains / Downer, Brakes RTM00001-100B. p.61 (Undated).
Transport for New South Wales – Asset Standards Authority (2017). Standard T MU RS 01000 ST Structural integrity and crashworthiness of passenger rolling stock.
Transport for New South Wales – Asset Standards Authority (2017). Standard T HR TR 25000 ST Buffer Stops, Version 1.0, Issued: 10 July 2017.
Transport for New South Wales – Asset Standards Authority. Standard RSU 100 Series – Minimum Operating Standards for Rolling Stock – General Interface Requirements 7.5.1.
Transport for New South Wales – Asset Standards Authority (2016). Train (Driver) Safety System, T HR RS 00840 ST, v2.0, issued 4 November 2016.
Transport for New South Wales (2018). TOC Waiver TW 203-629, Locomotive Hauling of Waratah cars from set A42. Issued 1 February 2018.
Transportation Safety Board of Canada (2014). Guide to investigating sleep-related fatigue.
Transportation Safety Board of Canada (2013). TSB Recommendation R13-02.
UK Rail Safety and Standards Board (2004). Human Factors study of fatigue and shift work. Appendix 1: Working patterns of train drivers: implications for fatigue and safety.
US National Transportation Safety Board (1997). Safety Recommendation RAR-97/02 from Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation Amtrak Train 29 Near Silver Spring, Maryland, on February 16, 1996.
US National Transportation Safety Board (2010). NTSB Safety Recommendation R-10-001.
WedMD - Brain and nervous system – Understanding fainting www.webmd.com (accessed 1 December 2018).
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Downer, the Office of National Rail Safety Regulator, Sydney Trains, Transport for NSW and the train crew of A42.
Submissions were received from Downer, the Office of National Rail Safety Regulator, Sydney Trains, and Transport for NSW. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 08/03/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 22 January 2018, at about 0834[1] Eastern Daylight-saving Time,[2] a Sydney Trains passenger train, A42, crewed by a driver and guard, departed Central Station (Central) on run 150-E to Richmond Station, New South Wales.
The train stopped at 19 stations on its way from Central to Richmond Station. Richmond Station was the train’s final stop for the run, located 60.680 km by rail from Central (Figure 1). The stop before Richmond Station was East Richmond Station, located 60.000 km by rail from Central (Figure 2).
The train was running about one minute ahead of schedule when it stopped at East Richmond Station at 0950:10. It departed the station at 0950:29. The train then travelled the approximate 506 m between stations, taking 46 s at an average speed of 40 km/h. The leading carriage (car) entered the Sydney-end of Platform 2 at Richmond Station at 0951:15. It was scheduled to arrive at 0952.
The train travelled the 169 metre length of Richmond Station at an estimated average speed of 35 km/h. The train subsequently collided with the end-of-line buffer stop at the country end of Platform 2 at 0951:32. After the impact with the buffer stop, the train recoiled backwards approximately 3 m before coming to a complete stop at 0951:37.
The impact caused all cars to concertina together, with some lifting from the normal position. A post-incident inspection found the rear wheelset of the rear bogie on the third position car had raised above the rail and all wheels of the rear bogie on the fifth position car derailed. There was damage to the front of the train, the interconnecting areas and coupling systems between cars. The passenger saloon areas appeared to have sustained minimal damage.
There were 24 passengers on board the train at the time of the collision. As the train entered Richmond Station, some of the passengers on board rose from their seats in anticipation of getting off at this final stop. The passengers were unprepared for the impact, and many of the resulting injuries were consistent with them not holding onto handrails or fixtures. There was no announcement or warning before the collision.
The first call to 000 was recorded as being received at 0952:52. A total of 16 people were treated at the scene by NSW Ambulance. All injured persons were from the train; no persons on the platform were injured as a consequence of the incident. The driver, seated in the front driver’s compartment at the time of collision, sustained minor injuries and received first aid before being tested for drugs and alcohol. The guard, who was standing at the door of the driver’s compartment at the rear of the train, sustained facial and chest injuries. Another Sydney Trains employee was injured; a cleaner who was travelling in the passenger area of one of the cars. NSW Ambulance treated him at the scene. In total, fifteen persons were transported to hospital for treatment; this included some passengers with suspected fractures.
Figure 1: Train journey path from Central to Richmond Station
Source: Sydney Trains, modified by the ATSB
Figure 2: Site diagram, East Richmond Station to Richmond Station train path
Source: ATSB
Train crew information
The driver was based at the Blacktown depot while the guard was based at the Richmond depot. Both lived in nearby suburbs and both had less than 20 minutes travel time to work.
The driver was experienced, starting as a metropolitan train driver in 2007. He was familiar with the route, fully qualified and had been passed as medically fit.
The guard was also experienced, having started as a guard in 2006. He was familiar with the route, qualified and had also been passed as medically fit.
Train information
The train was a double-deck electric multiple unit train, consisting of an eight-car Waratah set, designated as A42. It was operated by Sydney Trains. It had a driving car at each end (Figures 3 and 4), two motor cars located next to each driving car, and two trailing cars in the centre of the train. Waratah trains first entered service on the NSW rail network in 2011, and the final set was delivered in May 2014. This set came into service in May 2013.
The Waratah sets are leased by Sydney Trains from Reliance Rail Pty Ltd. EDI Rail PPP Maintenance Pty Ltd maintains the Waratah fleet of trains on behalf of Reliance Rail. The 626 Waratah cars are maintained at Auburn, in western Sydney.
The train has a seated-passenger capacity of 896. The train width is 3035 mm, height 4410 mm and each car is approximately 20 m in length. The total length of the train is approximately 160 m. It has a tare mass of approximately 402 t, a gross mass of 558 t, and a maximum operating speed of 130 km/h. The train has a regenerative braking system with blended electro-pneumatic wheel-mounted disc brakes. The bodies of the cars are stainless steel.
Figure 3: A-set driving car
Source: Sydney Trains
Figure 4: Sydney trains Waratah train, A42, at Richmond Station post-collision
Source: ATSB
Track and infrastructure information
Richmond Station is the terminal stop on the Blacktown to Richmond single bi-directional line. This standard gauge railway line was opened in 1864, it is a branch line of the Main Western line. This electrified line is predominantly used by passenger trains and is a single track for much of its length. The line is duplicated at multiple positions along the track. Passing loops also exist at various stations, allowing for trains to pass.
Train movements on the Richmond line are controlled by Sydney Trains under network rule NSY 500 Rail Vehicle Detection system. This system of safeworking prescribes the rules used in axle counter territory and continuously track-circuited territory on the network. Train movements on the metropolitan network, including the Richmond line, are directed from the Rail Management Centre in Sydney. These movements are controlled in conjunction with local signal control rooms.
Richmond Station consists of an island platform with two dead-end lines on either side (Figure 2). A third dead-end siding line (The Up storage siding) is used to stable trains for storage purposes. All three lines have a buffer stop at the country end to prevent trains overshooting onto the busy four-lane road, East Market Street.
The line from East Richmond Station to Richmond Station curves to the right for 160 m before straightening after the Moray street pedestrian crossing. Once past this crossing there is a clear line of slight to the end-of-line buffer stop for Platform 2. A signal, RD5, and an interlocking set of points permits trains to travel straight ahead along the Platform 2 line, as was the case on 22 January 2018, or be diverted onto one of the other two lines.
Once past signal RD5, there were no train stops or derailing devices (catch points) for trains travelling in the Down direction[3] into the platforms at Richmond Station. In the Up direction, for trains leaving Richmond Station, there are intermediate train stops and catch points for each of the three lines merging into the single line to East Richmond Station.
The permissible posted speed for trains travelling in the section from East Richmond Station to Richmond Station is 50 km/h. At the time of the accident, there were no temporary speed restrictions in place in the section from East Richmond to Richmond stations.
The end-of-line buffer stops at Richmond Station all have a light signal indicator light, which display a red light, centrally located on top (Figure 5). The light signal indicator light on the Platform 2 buffer stop was operational at the time of the collision. This was observed from the forward-facing CCTV camera downloaded from the train’s digital video recorders after the accident.
The buffer stops at Richmond Station were constructed from steel-reinforced concrete with two hydraulic arms that are designed to dissipate the energy of a collision (Figure 5 and 6).
Figure 5: Post-collision damage to the Platform 2 buffer stop of Richmond Station
Source: ATSB
Figure 6: Buffer stops, Platform 1 and Up storage siding, Richmond Station
Source: ATSB
Environmental information
The nearest Bureau of Meteorology automatic weather station (AWS) was located at Royal Australian Air Force Base Richmond, about 3 km east of Richmond Station. At 0900 on the day of the accident, the Richmond AWS recorded the temperature as 23.1°C. The overnight minimum temperature was 16.3°C.
The previous four days all recorded a maximum temperature over 35°C and the temperature on the day of the accident eventually reached 42°C (five hours after the accident).
Sunrise was at 0539 and it was a fine morning. The train was travelling in a west-north-west direction and the sun was behind and on the right-hand side of the train. The altitude of the sun was 44° and its position was determined not to have affected the driver’s visibility.
There had been no rain recorded at Richmond Station in the 11 days prior to the incident.
Site examination and recovery
Once emergency services had completed evacuation of the injured, the ATSB formally took control of the site and investigators from the ATSB examined the train, the track and the adjacent infrastructure including the buffer stop. At 1510, the ATSB issued a protection order specifying that the train not be interfered with except by those involved in recovery operations (Figure 7). That evening and on the following day, Sydney Trains unsuccessfully attempted to move the train from its position alongside Platform 2 to the Up storage siding on the other side of Richmond station. Sydney Trains did subsequently successfully relocate the cars to the Up storage siding alongside Richmond Station where further assessment and temporary repairs of the cars occurred to allow Sydney Trains to safely move the cars to the Downer EDI Rail maintenance facility at Cardiff in the Hunter Valley of NSW for further assessment and (if required) repair.
On 24 January 2018, the ATSB took possession of the event recorders and digital video recorders from the train while it was still at Richmond Station. Following a final inspection, at 1500, the ATSB revoked the protection order.
The train remained at Richmond Stationuntil 3 February 2018 when the three rear cars were coupled to a locomotive and hauled to the Downer EDI maintenance facility at Cardiff. Two more cars were moved on 14 February 2018 and the remaining three cars moved on 21 February 2018. A ‘train operating condition’ (TOC) waiver was issued by the NSW Asset Standards Authority on 1 February 2018, specifying a number of conditions to allow this movement to occur.[4]
Figure 7: Recovery operation at Richmond Station post-collision
Source: ATSB
Initial examination of A42 and Richmond Station indicated the following:
all cars of the train were intact
no evidence of contaminants was found on the rail running surface
event recorders and digital video recorders were intact and operational
the driver’s and guard’s compartments were clean and clear of any objects, with no personal effects present
the driver’s windscreen was free from cracking and provided adequate visibility
the driver’s front emergency access door was in the partially open position (post collision)
the passenger saloon areas sustained minimal damage
there was damage to the front of the train, the interconnecting areas and coupling systems between cars
the buffer stop and hydraulic arms sustained collision damage
the surrounding station structure, paths and wall showed minor cracking as a result of the impact of the collision
station CCTV cameras were functioning at Richmond Station and at other stations along the route.
The event recorders and digital video recorders have been retained by the ATSB for further examination and analysis.
Sydney Trains safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. Sydney Trains has advised the ATSB that, in response to this incident, the following proactive safety actions have been implemented:
A 20 km/h temporary speed restriction is in place on the approach to Richmond Station until a permanent 25 km/h speed restriction can be applied.
The train stop located with signal RD5 has been modified to trigger a brake application if train speed exceeds 25 km/h.
Ongoing investigation
The ATSB investigation is continuing and will include consideration of the following:
train, track and infrastructure examinations
collision sequence
obtaining and evaluating event recorder, signalling and CCTV information
train maintenance history
train crashworthiness including override prevention performance
train brake performance
train vigilance, deadman and warning systems
train operations including signalling
train communications
train crew qualifications, experience and medical information
train crew performance
train crew rostering
track and infrastructure condition
performance of buffer stop
automatic train control measures
operator policies and procedures
environmental influences
emergency response
similar occurrences in Australia and internationally.
Acknowledgements
The ATSB acknowledges the support of the New South Wales (NSW) Police Force, NSW Ambulance, Sydney Trains and EDI Rail PPP Maintenance Pty Ltd.
___________________ The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1250 Eastern Daylight Time on 21 January 2018, a Schleicher ASH-25E (AMT Jet) experimental powered glider, registered VH-GOA (GOA), was launched from the Bathurst Soaring Club facilities (Piper’s Field) New South Wales. The experienced pilot intended to conduct a cross-country flight, and was the sole occupant.
Eight minutes into the flight, the glider had climbed to about 2,200 ft in a thermal. Shortly after, it abruptly started to descend and track back towards the airfield. Witnesses saw smoke or liquid trailing from the glider and flames in the area behind the cockpit.
At about 1300, when at about 1,100 ft AGL, the pilot jettisoned the front-seat canopy but did not exit the glider. Fire engulfed more of the rapidly descending aircraft’s fuselage before it collided with the ground in a nose-down attitude. The pilot was fatally injured, and the aircraft was destroyed.
What the ATSB found
The glider caught fire in-flight, with flames seen near the engine housing. However, due to the severe post‑impact fire damage, the ignition source of the fire could not be determined. The pilot was probably attempting to return the burning glider to the airfield when it departed controlled flight and collided with terrain. The loss of control was probably due to the effects of fire incapacitating the pilot and/or affecting the aircraft’s flight controls.
The ATSB found that the pilot had the necessary equipment to make an emergency egress from the glider to escape the effects of the fire. He jettisoned the glider's canopy but possibly due to incapacitation, did not exit.
Finally, the glider’s cockpit and engine housing were not separated by a firewall. That resulted in limited containment of smoke and fire, and reduced the available time to make an emergency exit.
What’s been done as a result
Following the occurrence, the Gliding Federation of Australia published an Airworthiness Directive and Airworthiness Advice Notice, both entitled Engine Compartment Fire Containment and Retardation, which provide guidance regarding fire safety. The Airworthiness Directive requires all powered glider operators to inspect and repair fire retardant paint, fit ‘in case of engine fire’ cockpit placards, and ensure there is no flammable material on the cockpit side of any firewalls.
Safety message
Although not an airworthiness requirement, pilots of powered experimental gliders are strongly encouraged to install fire protection between themselves and the engine housing. The ability to exit a glider relies on avoiding incapacitation that can happen quickly in the event of in-flight fires.
The occurrence
At about 1250 Eastern Daylight‑saving Time[1] on 21 January 2018, a Schleicher ASH-25E (AMT Jet) experimental powered glider, registered VH-GOA (GOA), launched from the Bathurst Soaring Club’s facility at Piper’s Field, New South Wales (Figure 1). The glider was launched by an aero‑tow aircraft from runway 21 with the pilot as the sole occupant. The purpose of the flight was for GOA and another glider to conduct a cross-country flight. The other glider launched about 5 minutes before GOA.
Figure 1: Bathurst Soaring Club facilities at Piper’s Field
Source: Bathurst Soaring Club, with permission, modified by ATSB
Witnesses at the airfield reported that, after departing, (Figure 2, item 1), GOA tracked out for about 1.5 NM. The pilot released from the aero-tow aircraft at 800 ft above ground level (AGL)[2] (Figure 2, item 2), made a radio call on the Soaring Club frequency that he had disengaged from the aero-tow. On-board GPS position and altitude information showed that by 1258:58 GOA had climbed to 2,205 ft AGL in a thermal situated to the south of the airfield. The glider then abruptly departed the thermal and started to descend and track back towards the northern end of the airfield (Figure 2, item 3).
Witnesses reported seeing something trailing from GOA, which they thought was smoke or a liquid, while the glider was in a steep nose-down attitude. They then saw flames emanating from the top and bottom of the airframe, behind the cockpit (Figure 3). The pilot jettisoned the front seat canopy at 1259:52, at a height of about 1,100 ft AGL (Figure 2, item 4), but despite wearing a parachute, he did not exit the glider.
Figure 2: Aircraft track as recorded by the on-board GPS and as recalled by witnesses
Source: GPS data overlaid on Google earth, annotated by ATSB
Figure 3: Photograph of GOA after the front canopy was jettisoned
Source: Witness photograph, modified by ATSB.
At this stage, GOA was seen maintaining a steep nose-down attitude and high speed with a bank angle of about 15°. Witnesses also recalled that there did not appear to be any discernible control inputs after the canopy was jettisoned and by the time the glider descended to about 500 ft AGL, more of the fuselage was engulfed in fire. At about this time, at least one of them called emergency services.
The soaring club’s closed-circuit television camera recorded that the glider banked left just prior to impact (Figure 4). A witness similarly reported that the glider’s left wing tip impacted the ground first, before it came to rest in an inverted position. The wreckage continued to burn after impact, and a fire spread to the surrounding grass.
Some witnesses moved to the accident site with handheld fire extinguishers to control the fire. About 10 minutes later, fire services arrived on the scene and extinguished the fire before it spread to neighbouring properties.
The pilot received fatal injuries and the aircraft was destroyed.
The pilot held a valid Glider Pilot Certificate issued by the Gliding Federation of Australia (GFA) in October 2017. He also held a Private Pilot (Aeroplane) License that was issued in July 1977. In addition to holding all necessary qualifications for gliding operations, his endorsements included:
carriage of private passengers
cross-country/touring (self-launching sailplane)
low level finish
self-launching sailplane.
At the time of the occurrence, the pilot had accrued between 8,000 and 11,000 hours of gliding experience over more than 2,000 flights. The pilot also held a maintenance authority to conduct specific powered glider and airframe maintenance.
The pilot held a valid medical Certificate of Fitness issued by a Medical Practitioner as required by GFA. The criteria for issuing a Certificate of Fitness were based on the medical standards that Austroads set for issuing a driver’s license medical certificate for a private motor vehicle. He had previously held a class 2 aviation medical certificate, which expired in 2012.
Evidence to assess the likelihood of the pilot experiencing fatigue was gathered, including available information on sleep obtained, any factors potentially affecting his ability to maintain adequate alertness during the flight, and other aspects that affects sleep opportunity. However, there was insufficient evidence to ascertain whether the pilot was likely to have been experiencing a level of fatigue known to affect performance.
Aircraft information
The Alexander Schleicher ASH-25E is a two-seat, mid-wing, powered sailplane with camber changing flaps, t-tail unit, retractable landing gear, and provision for water ballast. The aircraft also has a retractable engine pylon that accommodates a Rotax 275 engine, designed for self‑sustaining flight. The engine pylon extension/retraction mechanism was powered by a 12 V lead-acid battery. The glider had front and rear canopies, each of which could be separately jettisoned in-flight by the pilot.
The major construction materials for the ASH-25E airframe included carbon fibre-reinforced polymer rebar in the wings and winglets, carbon and aramid fibres in the fuselage, hard foam sandwich in the fin, wings and control surfaces, and fibreglass in the winglets. The flight control cables were steel ropes, the long push rods were aluminium alloy, and the shorter push rods were steel.
VH-GOA was manufactured in Germany in 1988. In 2010, the pilot removed the Rotax engine and propeller and replaced them with two diesel‑fuelled Titan AMT gas turbine engines. Two 25 L collapsible fuel cells were installed into the wing root to supply the replacement engines. Information about the design standards, the cockpit and canopy, the engines, fire protection and maintenance is summarised below.
Design and airworthiness
Following the engine modification, the glider was re-classified as experimental, and listed as an ASH-25E (AMT Jet). This re‑classification meant there was no regulatory requirement for GOA to comply with existing design standards.
A special Certificate of Airworthiness (CoA) was issued in 2014 under the Civil Aviation Safety Regulations (CASR) Part 21.191 (i) Private Operation of a Prototype Aircraft for the purposes of research and development, showing compliance with regulations, exhibition and air racing. Under the CoA, the glider was expressly limited to using the jet engines for ‘sustainer flight’[3] only. Once the glider was listed as an experimental aircraft, the aircraft could be modified, but operated under the GFA under Civil Aviation Orders (CAO) 95.4 Power-assisted sailplanes, powered sailplanes and sailplanes.
The Gliding Federation of Australia published the Manual of Standard Procedures (MOSP) Volume 3 Airworthiness Procedures and, under Section 2.6 Experimental Certificate, it outlined that:
Flying in an aircraft under an [Experimental Certificate] is entirely on the basis of voluntary acceptance of risk by the persons who elect to do so [and that person] should ensure they have sufficient knowledge to understand the nature of the risk...GFA promotes innovation and some member’s desire to build, modify and service their own aircraft.
EC’s may only be issued in accordance with CASR Part 21.191 to 21.195B. All ECs will clearly list the terms and limitations applicable to the allowed flight(s)…
Cockpit and canopy
The cockpit of GOA contained two seats, one behind the other. The pilot operated the glider from the front seat on solo flights. In addition to the standard instruments, installed equipment included two engine control unit (ECU) displays, a rear-facing camera (to see the engines when operating) and an ‘LxNav’ flight recorder.
A placarded canopy jettison release handle was positioned on the top right side of the instrument panel (Figure 5).
Figure 5: View from front seat in GOA’s cockpit
Source: Flight Manual, amended by the ATSB
Engine start system
The two vertically-aligned Titan AMT Netherlands gas turbine engines were installed on the existing dual-sided pylon. The Titan was constructed from a single radial compressor and an axial flow turbine stage (Figure 6). Fuel attachments on the front cowl of the engine, with Teflon tubing and push-in Polytetrafluoroethylene (PFTE) fittings were used. The engines were housed in the engine bay when not in use, and were raised as part of the one-switch start sequence.
The Titan engines’ fuelling and operating speed were controlled by the two electronic control units (ECUs), which also regulated performance, and were each powered by a lithium polymer battery. The ECU displays were fitted inside the cockpit (Figure 5). The engines’ ignition system was designed in a manner to prevent start-up when the pylon was lowered. In the event of an emergency, the flight manual recommended lowering the pylon, which would cause the fuel flow to stop immediately.
The ignition system for the engines comprised a disposable propane gas bottle installed in the engine bay. The specially developed ASH-25J Flight Manual for GOA contained further information on the propane system:
A disposable canister of propane connects to two solenoid operated valves which are controlled by the ECU. These valves are open only during the start up phase. PFAN tubing is used to carry the propane gas...Since the valves are open only during the start phase of the engine, the risk of gas release through ruptured hoses is minimised.
The engines were started sequentially. An electric starter would spin up the turbine, a glow plug activated, and propane was then fed into the engine. If the propane ignited successfully, the EGT would start to increase and the fuel pump would switch on. The solenoid valve to the propane was then closed.
Figure 6: Images of the engines fitted to GOA
Source: ASH-215J Flight Manual
The ATSB conducted a bench test on the fuel system plumbing, constructed from plastic tubing to confirm the product was fire-resistant. The test results showed that the tubing had high temperature resistance and did not support combustion.
ECU batteries
A dedicated rechargeable lithium polymer (LiPo) battery powered each engine’s running circuit. The batteries were situated at the rear of the cockpit along with the other ECU components, the lead‑acid battery, fuel lines, and other electrical leads and components (Item B in Figure 7). The fuel lines from the wing fuel cells were situated next to the batteries.
Thermal runaway describes an accelerating process whereby increased temperature releases energy that in turn further increases temperature. If defective, or handled improperly, some rechargeable batteries with sealed cells can explode during thermal runaway. The ASH-25J Flight Manual noted that ‘LiPo batteries are potentially dangerous’, and that it was important to ensure that they were protected from mechanical forces and the effects of heat due to their ‘high energy density’. The GFA investigation report for this occurrence stated that:
[LiPo batteries] can undergo thermal runaway…due to overcharge, over-discharge, over-temp, short circuit, mechanical damage…
Witnesses reported seeing the pilot removing the LiPo batteries after a flight the day before, and recharging them.
Fire protection
Sealed firewalls reduce the spread of fire and prevent the leakage of flammable substances, like propane gas or diesel, reaching the cockpit.
When lowered, the engines were accommodated within the fuselage tail boom (Figure 7, item A). Regarding the aircraft design, Schleicher confirmed that the ‘ASH-25E was not [originally] equipped with a forward firewall’ and it appeared that during the subsequent modification, one was not added. Schleicher also confirmed that ‘the factory-made engine compartment was primed with a fire protection paint’.
Between the engine housing and the shelf in the cockpit, there was an unobstructed opening through to the timber particle shelf (Figure 7, item B and C). In their investigation report, GFA stated that ‘it is likely that when the two stroke engine removal [was done], the electronic shroud cover and carbon fibre electronics bay were removed from the aircraft and not refitted.’ An inspection of the images of the particle shelf, and remnants of fuel lines, indicated that there did not appear to be any heat protective sleeves used.
Figure 7: Engine housing and cockpit (A. Engines – rear view, B. Cockpit area – rear view, C. Area between engine housing and particle shelf)
Source: Gliding Federation of Australia, with permission
The European Aviation Safety Agency (EASA) Certification Specification CS-22 Sailplanes and Powered Sailplanes (introduced in 2003) set design specifications applicable to the manufacturing of Schleicher gliders. Under Power-Plant Fire Protection, it outlined that:
The engine must be isolated from the rest of the sailplane by a firewall, shroud or equivalent means.
The firewall or shroud must be constructed so that no hazardous quantity of liquid, gas or flame can pass from the engine compartment to other parts of the sailplane…The firewall and shroud must be fireproof...
The materials accepted as fireproof included stainless steel (0.38 mm thick), mild steel sheet (0.5 mm thick), and/or steel or copper-based alloy firewall fittings.
The CASR 1988 Part 22 Airworthiness standards for sailplanes and powered sailplanes stated that the standards set out in EASA CS-22 were in force. The engineering report to support the experimental CoA stated that there was little risk of fire in the engine bay, as the engines were only able to operate in a raised configuration. That report did not document any specific consideration of compliance with the firewall requirements outlined in CS-22, although due to its experimental classification there was no regulatory requirement to comply.
Aircraft maintenance
General information
The special CoA stipulated that glider maintenance was to be conducted in accordance with the manufacturer’s recommendations, the requirements of the GFA Manual of Standard Procedures (MOSP) 3 and the Maintenance Manual ASH 25-J Turbo Engine Project. A review of the aircraft’s maintenance documentation indicated that there was no history of issues associated with the fuel system, batteries or engines.
Pre-flight maintenance issues
On the day before the occurrence, the pilot was observed performing ground testing on the glider’s engines. A video was also taken of the tests. Significant observations included:
fuel pouring out of the lower engine on lowering (Figure 8, item A)
significant engine flaming (Figure 8, item B)
white smoke billowing from the lower engine (Figure 8, item C)
After shutting down the engines, the pilot was heard on the video commenting that the exhaust gas temperature (EGT) read 906C. The maintenance manual for the engines listed an EGT of 700 C as normal. Following the engine testing, the pilot took a passenger for a flight. The passenger reported that the pilot did not start the engines during the flight. After landing, the passenger helped the pilot with further engine testing.
The ATSB considered how the recorded fuel leak from the lower engine may have occurred, and consulted with gliding experts and the manufacturer. They advised that there may have been a leak within the fuel lines, or at the connection point between the PFTE tubing and the engine cowling. It was the manufacturers’ opinion that this can occur when the lines are roughly cut (for example using pliers).
It was evident from the video taken that the radial compressor on the lower engine was not rotating. Therefore, another possible source of the leak may have been the way the fuel flow was initiated. The system was designed to engage the fuel pump only when the engine speed reached a certain level. Therefore, it should not have been possible for fuel to flow while the compressor was not rotating.
Figure 8: Photographs from engine testing
Source: witness, with permission
Operational information
The ASH-25E flight manual listed operating limitations, including a ‘never exceed speed’ (VNE) of 151 kt. The normal operating speed range for the glider was between 52‑97 kt.
Pre-flight checks
According to the ASH-25J flight manual, a pre-flight inspection of the engines was required, including raising the engine pylon, inspecting all hoses for leaks, all electrical cables and connections for integrity, and checking the security of restraining wires and the engine bay floor for leaks. The GFA Inspector’s handbook for powered sailplanes stated that a daily walk-around was required, which included an inspection of the battery installation, instruments and radio, oxygen bottle and systems and powerplant, and a ‘check [that] there are no fuel or oil leaks’.
Witnesses, and others who knew the pilot, reported that he would often perform an engine run prior to departure, but they did not see him do so on the day of the occurrence.
In-flight engine use
In order to deploy and operate one or both of the engines in-flight, the pilot needed to:
turn on the key switch
activate the master circuit breaker
move the engine pylon switch forward and wait till it had raised (which the pilot could see via a rear-facing camera) then, after seeing START CLEARANCE on the ECU,
move one or both of the engine control switches forward to START/RUN and then open up the throttle once the ECU displayed STARTED UP.
The ASH-25J Maintenance Manual outlined that the engine’s pylon circuit was powered from the glider’s 12V battery, and triggered the START CLEARANCE on the ECU, without which the engines could not be started.
Stopping the engines in flight was achieved by selection of a POWER DOWN switch. In an emergency, selection of the STOP/OFF position or movement of the pylon switch rearwards would instantly stop the fuel.
Recorded data
The ATSB recovered data from a flight recorder unit that the pilot had fitted to the canopy of GOA. The device was a LxNav Nano flight recorder, which is a 66-channel GPS receiver, altimeter and effective noise level sensor. The standard recording rate is once per second, and the unit was configured to automatically start recording once movement above 1 m/s was detected.
Medical and pathology
Post-mortem/toxicology reports and consultation with aviation medical experts identified that:
With regard to possible smoke inhalation, examination results ‘suggest that the deceased may not have had the chance to inhale the smoke related to the fire’.
The pilot suffered from advanced stage coronary artery disease at the time of the occurrence but there was insufficient evidence to determine if that may have influenced the development of the accident.
Survivability
Egress assist cushion
The pilot had designed his own egress assistance cushion to allow an easier in‑flight exit from the glider, particularly if the occupants needed to egress in the case of a mid-air collision. It consisted of two hermetically-sealed carbon dioxide cartridges from commercially-available life jackets that fed the gas through to an inflatable bag via a manifold and flexible hose (Figure 9). Using it required both hands – one to steady the pouch, and the other to manipulate a lanyard.
In the case of an emergency that required abandoning the aircraft, the pilot would jettison the canopy first, undo the seat harness, open the flap of the pouch to reveal a lanyard attached to the actuators, and then pull the lanyard to activate the flow of gas.
Due to the extent of fire damage, it could not be determined whether the pilot deployed the egress assistance cushion.
Figure 9: The components of the egress assist cushion
Source: ATSB
Pilot parachute
Glider pilots typically wear a parachute to exit a glider in an emergency. The passenger that the pilot had taken flying the day before recalled that they both wore a parachute, and the egress assistance cushions (described above) were in both the front and rear seats on the glider. Images from the wreckage indicated the pilot was wearing a parachute.
The most common minimum deployment height of parachutes typically worn by glider pilots was 500 ft AGL.
Site and wreckage
Wreckage location
The aircraft wreckage was located in a large burnt patch of grass on the property of Bathurst Soaring Club, about 445 m away from the threshold of airstrip runway 03. The wreckage trail was spread across about 125 m. Ground scars and evidence from the wreckage indicated that GOA impacted the ground in a nose-down, left wing configuration in a northerly direction, then rolled or tumbled after the initial impact and came to rest inverted. It was determined that the impact sequence was likely not survivable. The in-flight fire continued and spread to the surrounding area (Figure 10).
The shattered components of the canopy, as well as the GPS unit and flight recorder, were found on private property adjacent to Piper’s Field, about 440 m away from the fuselage.
Figure 10: Location of the wreckage on the Bathurst Soaring Club property
Source: ATSB
On-site examination
On-site examination of the severely fire‑ and impact-damaged fuselage, wings (Figure 11) and engines did not identify any obvious pre-existing faults that could have contributed to the accident. The wings, although destroyed in the post-impact fire, had all carbon fibre structures accounted for. The flap position at time of impact could not be determined. The engine pylon appeared to have been lowered at the time. A propane canister was found, but damage from the fire meant that it was not possible to determine whether it had contained any gas. The landing gear mechanism was found in the extended position, suggesting it had been lowered prior to the impact. The pilot was located within the wreckage around the area of the cockpit, although it could not be determined if he was secured in his seat.
A small number of components were retained for further examination and testing. The shattered components of the canopy’s Perspex were also examined. There was evidence of smoke residue on some of the shards (Figure 12) on the internal side of the canopy. There was also some residue on the forward third on the external side of the canopy’s ‘clearview’ hatch. These indicated that there was some smoke inside the cockpit, and it had passed through that hatch.
Figure 11: Wreckage of VH-GOA
Source: NSW Police
Figure 12: Canopy in-situ (in a field adjacent to the Bathurst Soaring Club)
Source: ATSB
Related occurrences
The pilot and the same glider were involved in a previous occurrence reported to GFA. On that occasion, during the launch of the glider, the pilot ‘noticed abnormal engine readings and saw flames coming from the jet engine via the monitor.’ In response, the pilot shut down and then lowered the engine and continued the flight.
Other related occurrences
In 2007, GFA completed its investigation into an occurrence involving a Stemme model powered glider S-10, registration VH-ZVT involved in in-flight fire, which resulted in two fatalities. The investigation identified that at some stage before impact, the pilot jettisoned the canopy. The GFA also determined that the complex nature of the fuel systems on board, and the use of fuel lines that were not fireproof, would have allowed any leaking fuel to come into contact with engine‑related heat sources.
The United States National Transport Safety Board investigated an accident involving a Stemme S10-VT in Wisconsin on 14 July 2001. The pilot took off using the engine in its self‑launching capacity. Shortly after, the engine began running rough and smoke entered the cockpit. The pilot shut down the engine, initiated an emergency landing and exited the glider. Within five minutes of the engine failure, the aircraft was engulfed in flames. The fire originated in or around the engine compartment. Following that occurrence, it was recommended that certification standards require the evaluation of the engine compartment such that liquids, smoke and gases cannot pass freely between it and the cockpit, and for extinguishing systems be installed.
In 2017, the Air Accident Investigation Branch in the United Kingdom issued a special bulletin relating to a battery fire on board an HPH Glasflugel 304 eS powered sailplane. It was determined that there was insufficient warning to the pilot of a fire in the front electric sustainer (FES) battery compartment, and that fires behind the pilot are difficult to see. This reduced the time available for a pilot to make a decision about abandoning the aircraft by parachute. One of the recommendations was for the European Aviation Safety Agency to require manufacturers to install a FES warning system in all powered sailplanes to alert the pilot to fire or smoke.
From the available information, in-flight flames were first seen near the engine housing, at the rear of the cockpit. Therefore, the ATSB considered potential ignition sources associated with the engines and the lithium polymer (LiPo) batteries.
Engine‑related ignition source
Normal operation of the engines only provided an ignition source during the start sequence or when operating. The design of the engine systems prevented the engines from starting while lowered and stowed. Specifically, the START CLEARANCE on the ECU was not displayed until the pylon was fully raised, and an interlock prevented engine start in the lowered position. While a malfunction that bypassed these mechanisms could not be ruled out, it was considered unlikely that the start sequence initiated while the engines were housed inside the fuselage.
The pilot had experienced an in-flight engine fire on VH‑GOA (GOA) in the past, and had reportedly lowered the engine into the housing to extinguish it. While it was therefore likely that he would have performed the same action if faced with another in‑flight fire, the ATSB could not find any supporting evidence that the pilot attempted to start the engines in flight. Specifically:
The pilot did not run the engines on the ground before the occurrence flight. Given his reported past practice, this indicated that he was not intending to use them.
Witnesses reported that they did not hear the distinctive sound of the engines either before or after the departure of GOA. It was also not possible to discern from the witness photos whether the engines were raised.
The rate of climb that GOA achieved in the thermal was possible without the engines.
The engines were likely lowered at the time of the impact (although it was not possible to determine what their position was at all times during the flight).
The ATSB was therefore unable to determine if the source of the fire was related to an attempt (successful or not) to raise and start the engines. However, given the recorded engine operation the previous day - fuel leakage and excessive flaming, similar in-flight behaviour during the accident flight could have resulted in an airborne fire. Additionally, as propane ignites at lower temperature than the diesel fuel, a propane leak could also have plausibly ignited.
Prior to the installation of the jet engines in 2010, the ASH-25E had a forward shroud and fire protection paint within the engine housing, but it appears the shroud was removed with the original engine. Based on several sources of evidence, there was no effective fire protection between the engine housing and the cockpit on GOA.
Thermal runaway
The pilot had charged the batteries on the evening before the occurrence. If a battery experienced thermal runaway, the resulting heat would be sufficient to ignite any diesel or propane nearby, as well as causing the fuselage to combust. However, due to the intense post‑impact fire, the battery was not identifiable within the wreckage, so it was not possible to assess the likelihood that it was the source of ignition.
Summary
The investigation found that the in-flight fire probably started near the aircraft’s engine housing. However, the extent of fire damage precluded identification of the specific ignition source.
Despite that, the circumstances of this accident (and previous occurrences) clearly illustrate the importance of having a sealed firewall to prevent, or at least delay, the effects of fire reaching the cockpit area. In that context, the ATSB recommends that any modifications to powered gliders are conducted with reference to the European Aviation Safety Agency Certification Specification CS‑22 Sailplanes and Powered Sailplanes.
Loss of control and collision with terrain
After disengaging from the aero tow aircraft, the glider started to climb in a thermal. The other glider that departed a few minutes before GOA climbed to about 10,000 ft in the same thermal, indicating that it would likely have supported the continuation of a positive climb for GOA. Therefore, when the pilot of GOA broke off from the thermal, this was probably a result of identifying the fire behind the cockpit. The glider then tracked back towards the direction of the airfield.
The subsequent high rate of descent indicated that the pilot probably deployed the glider’s air brakes to expedite the descent. The glider passed by the threshold of runway 21 when in the continuous nose-down, left-bank attitude, a configuration that could indicate the pilot was no longer in control. It collided with terrain in this same configuration at a relatively high speed.
The ATSB assessed that the control loss was probably due to the effects of fire incapacitating the pilot and/or affecting control of the glider.
It is possible that the pilot became incapacitated, for the following reasons:
exposure to smoke, fumes or fire (there was evidence that smoke entered the cockpit)
a medical event, possibly linked to the stress of the in‑flight fire and/or his coronary heart disease
the canopy or associated airflow may have impacted the pilot as it was jettisoned.
Based on the available evidence, the ATSB was not able to determine whether the pilot became incapacitated prior to the impact with terrain. However, as discussed further below, the apparent partial completion of the egress sequence could support that conclusion.
Images of GOA just prior to impact indicated that the glider was structurally intact prior to impact however, it is possible that the flight control cables and/or pushrods were damaged by the in‑flight fire. Due to the severity of the post-impact fire, it was not possible to ascertain if the flight controls were fire‑damaged before the ground impact.
Glider egress
The ATSB established that the pilot was wearing a parachute, which probably had a minimum deployment height of 500 ft, and that he was probably sitting on his egress assist cushion. He therefore had the necessary equipment to be able to exit the glider.
The time between the pilot breaking off from the thermal and then jettisoning the canopy was about 54 seconds, and it appeared as though the glider was under control. However, witnesses reported the fire visibly became more intense over that time. There was smoke residue on the inside of the canopy, which indicated that the pilot was exposed to at least one incapacitating factor before jettisoning the canopy. Fire smoke contains a mixture of narcotic and irritant gases, and incapacitation results from exposure to this combination, where ‘incapacitation’ encompasses a range of possible conditions, including unconsciousness, severe physical distress, or inability to determine how to escape (Gann, 2004).
Jettisoning the canopy required the pilot to pull a handle in the cockpit. This indicated that he was not incapacitated up to that moment. However, it is possible that after jettisoning the canopy, the pilot was not able to exit due to incapacitation. Alternatively, he may have assessed that he was now too low to exit the aircraft, or made a conscious decision to land the glider.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain on the experimental ASH-25E glider, registered VH-GOA that occurred 13 km west‑north‑west of Bathurst Airport (Piper’s Field) on 21 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
Shortly after launch, an in-flight fire commenced near the engine housing. The ignition source of the fire could not be determined due to severe post-impact fire damage.
The pilot was probably attempting to return the burning glider to the airfield when it departed controlled flight and collided with terrain.
The pilot had the necessary equipment to make an emergency exit from the glider and escape the effects of the fire. He jettisoned the glider's canopy but possibly due to incapacitation, did not exit.
Other factors that increased risk
The glider's cockpit and engine housing were not separated by a firewall. This limited containment of the in-flight fire, resulting in greater exposure of the pilot to fire/smoke and reduced egress time.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The Gliding Federation of Australia
As a result of this occurrence, and others throughout the gliding and recreational aviation sectors, GFA advised the ATSB that on 11 March 2019, GFA published an Airworthiness Advice Notice (AAN), and on 15 March 2019 published an Airworthiness Directive (AD), both entitled Engine Fire Containment and Retardation. The affected aircraft types included all self-launching and power‑assisted sailplanes, including those fitted with jet engines.
The AAN stated that:
…many instances have been found of potential fire hazards in the form of fuel leaks, oil leaks and deficient exhaust systems. Instances found of fires starting, then self-exhausting. Adding to the mix are some powered sailplane types that may not fully meet the fire protection standards…’
The AAN outlined the fire protection standards from EASA publication CS-22 (summarised in the Context section of this report), the engine installations of key concern (including the ‘fully buried’ engine such as GOAs), and the risks of defects in any fire retarding paint. Intumescent paint was suggested for use, which is ‘a paint cover which, when heated, expands [to shelter] the material it is covering, from heat and combustion...’ Glider pilots were also encouraged to consider the effects of airflow on fire propagation, and used a diagram of the ASH 25E (Figure 13). Lastly, the AAN covered pilot actions in the case of an engine fire, with the key advice being to shut off the fuel supply and contain the fire.
Figure 13: ASH 25E diagram displaying pressure, airflow in and out of the airframe
Source: Gliding Federation of Australia
The AD provided pilots with inspection guidelines and procedures to meet a minimum standard for fire containment and retardant. Before 30 June 2019, all glider operators and inspectors needed to complete a Form 2 inspection, inspect the condition of fire retardant paint, determine the configuration of the firewall(s), and provide the Inspection Schedule to GFA. By 30 November 2019, all paint deficiencies were required to be rectified. All subsequent inspections then needed to include a paint inspection, and also an assurance that no flammable material is attached to the cockpit side of the firewall. If the glider cannot be fitted with a firewall, a ‘strong case for non compliance’ must be made to GFA.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Alexander Schleicher
the AMT Netherlands
Bathurst Soaring Club and its members
the Civil Aviation Safety Authority
the Gliding Federation of Australia and members of the gliding community
New South Wales Police
Witnesses and neighbours of the Soaring Club.
References
AAIB, Special Bulletin S3/2017 on HPH Glasflugel 304 eS, G-GSGS, 25 September 2017, Air Accidents Investigation Branch United Kingdom
CASA, CASR Part 22 – Airworthiness standards for sailplanes and powered sailplanes, Civil Aviation Safety Authority
EASA 2003, Certification Specification CS-22 – Sailplanes and Powered Sailplanes, European Union Aviation Safety Agency
NTSB, Docket CHI01LA216, accident involving a Stemme S10-VT in Wisconsin on 14 July 2001, National Transport Safety Board
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Gliding Federation of Australia and the Civil Aviation Safety Authority.
Submissions were received from the Gliding Federation of Australia and the Civil Aviation Safety Authority. The submissions were reviewed and, where considered appropriate, the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2018-009
Occurrence date
21/01/2018
Location
Pipers Field, 13 km west-north-west of Bathurst Airport
On 20 January 2018, the pilot of a Cessna 182P aircraft, registered VH-TSA, departed The Vale Airstrip, Sheffield, for a private airfield at Tomahawk, Tasmania. On arrival, the pilot conducted a number of orbits prior to approaching the runway. The aircraft touched down more than halfway along the runway before bouncing several times. In response, the pilot commenced a go‑around but the aircraft collided with a tree beyond the end of the runway and impacted the ground. The passenger was fatally injured, and the pilot sustained serious injuries. The aircraft was substantially damaged.
What the ATSB found
The ATSB identified that the selected approach direction exposed the aircraft to a tailwind that significantly increased the groundspeed on final approach and resulted in insufficient landing distance available. Additionally, the final approach path was not stable. In combination with the tailwind, that resulted in the aircraft being too high and fast with a bounced landing well beyond the runway threshold.
Finally, the go-around was initiated at a point from which there was insufficient distance remaining for the aircraft to climb above the tree at the end of the runway in the landing flap configuration and tailwind conditions.
Safety message
The ATSB reminds pilots of the importance of obtaining all relevant information about the local conditions, including wind direction and strength, prior to commencing an approach to an aerodrome. While a windsock is not required for all aircraft landing areas, it provides a simple visual means for pilots to assess the wind direction and strength.
This accident highlights the importance of conducting a standard approach to an aerodrome. This enables assessment of the environmental and runway conditions and allows checks to be completed in a predictable manner. When approaching a non-controlled aerodrome, pilots are required to join a leg of the circuit and, if joining on final, to establish the aircraft on final approach at least 3 NM from the runway threshold to ensure a stable approach path. If a safe landing cannot be assured, a pilot should initiate a go-around early, and ensure the aircraft is configured in accordance with the operating handbook.
The occurrence
On 20 January 2018, at about 1645 Eastern Daylight-saving Time,[1] a Cessna 182P aircraft, registered VH-TSA (TSA), departed The Vale Airstrip, Sheffield, Tasmania for a private airfield at Tomahawk, 146 km to the east‑north‑east (Figure 1). The private flight was conducted under the visual flight rules[2] at 3,500 ft above mean sea level (AMSL). On board were the pilot occupying the front left seat and a passenger (also a qualified pilot), seated in the front right seat.
The pilot broadcast on the multicom frequency (126.7 MHz) when the aircraft was 10 NM (19 km) from, and inbound to, Tomahawk. Recorded data showed that the aircraft commenced descent from its cruising altitude at 1712. The pilot stated that airfield was hard to identify visually and that he sighted it after descending to about 1,000 ft AMSL. There was no windsock at the airfield to identify the wind speed and direction. The pilot reported that he anticipated that the wind would be from the same north‑westerly direction encountered during the flight, and therefore decided to land towards the north-west.
On arrival at Tomahawk, the pilot conducted a number of orbits to the right and left in the vicinity of the airfield (Figure 2). He reported that he manoeuvred the aircraft in that manner prior to approaching the runway because the aircraft was too high, and its groundspeed was faster than normal, for the approach.
Figure 1: Recorded aircraft track
Source: AvPlan data – annotated by ATSB
The pilot stated that he felt some pressure to land due to the weather, with clouds at about 1,400 ft and light showers of rain in the area. Additionally, it was later than their original estimated arrival time of 1700. He was aware that the passenger had advised the airfield owner that their arrival time would be closer to 1730.
At about 1720, the airfield owner saw and heard the aircraft operating south-east of the airfield. A second witness, who was standing between the house and airfield, saw the aircraft approaching the runway heading in a westerly direction.
The airfield owner was working outside at the time the aircraft arrived. He was also a pilot, and reported that he was concerned that the pilot of TSA was attempting to land the aircraft towards the west, which would result in a tailwind he estimated to be about 15 kt. In response, the airfield owner drove his vehicle onto the runway towards the approaching aircraft, with headlights on and hazard lights flashing, in an attempt to communicate to the pilot to abort the landing. The pilot reported that he thought the driver was indicating where to land, and so he continued the approach. Having determined that the pilot intended to continue the landing, the airfield owner vacated the runway.
Tyre marks on the grass identified that the aircraft first touched down 433 m beyond the runway threshold, with 284 m of runway remaining. Subsequent wheel marks showed that the aircraft then bounced several times, with the last wheel marks visible on the runway 161 m before a 7 m high tree, located on rising terrain 36 m beyond the end of the runway. The pilot reported that, following the bounced landing, the passenger instructed him to initiate a go‑around. In response, he applied full power and recalled that the engine appears to have responded normally.
The aircraft started to climb, however it collided with a branch of the tree 5.6 m above the ground. The impact damaged the right wing, and the aircraft then collided with terrain and came to rest on its right side (Figures 2 and 3). The passenger sustained fatal injuries and the pilot was seriously injured. The aircraft was substantially damaged.
Figure 2: Accident site facing west, showing the tree branch struck by the aircraft’s right wing and the rising terrain in the background
Source: Tasmania Police
Pilot information
The pilot held a current Private Pilot (Aeroplane) Licence issued by the Civil Aviation Safety Authority on 17 February 2016, a single‑engine aeroplane class rating and a manual propeller pitch control design feature endorsement, as required for operation of VH‑TSA.
The pilot also held a Class 2 Aviation Medical Certificate valid until 8 November 2019 with the restriction of vision correction. In conjunction with a flight review conducted on 18 December 2017, the pilot had successfully completed an operational check of his vision following eye surgery.
The pilot had about 560 hours total aeronautical experience and 46.7 hours on the Cessna 182P.
The passenger also held a current Private Pilot (Aeroplane) Licence and Class 2 Aviation Medical Certificate, and had about 1,280 hours total aeronautical experience.
The pilot and passenger had conducted many flights together around Australia. Although the passenger had been the pilot in command for the majority of those flights, both had exposure to operating at remote and unfamiliar airfields. They had also completed a bush pilots training course. Additionally, at his flight review two months prior to the accident, the pilot had conducted a simulated forced landing, in which he demonstrated his ability to select an appropriate landing site.
Aircraft information
The Cessna Aircraft Company 182P is a four-seat, high‑wing, single-engine aircraft equipped with fixed tricycle landing gear. The aircraft was powered by a Teledyne Continental Motors O-470-S engine and fitted with a McCauley two-blade, constant-speed propeller, model 2A34C203.
VH-TSA was a 1976-model 182P aircraft, recorded as being manufactured in the United States in 1977. It was first registered in Australia in 1978 and registration was transferred to the current operator in 2012. The aircraft’s total time in service was 6,160 hours. The engine had exceeded the manufacturer’s recommended time between overhauls but was permitted to continue in service and was assessed by the maintainer as serviceable at the last 100-hourly scheduled maintenance at 6,064 hours on 15 February 2017.
The aircraft was operated in the private category and was loaded within its weight and balance limitations on the day of the occurrence.
Aerodrome information
An aerodrome is defined as an area of land or water that is intended for use for the arrival, departure or movement of aircraft. The airfield in Tomahawk was a privately owned, non‑controlled aircraft landing area and met the definition of an aerodrome. The prepared grass surface of the east-west runway was 717 m long, orientated in a direction of 281° magnetic, and had a short grass surface. The runway sloped down towards the west at an average slope of 1.5° for the first 500 m, and was then level. There was rising ground at both ends of the runway and a tree about 7 m high on the rising ground at the western end (Figure 3).
A shorter runway heading 050°/230° magnetic intersected the main runway just east of its midpoint. White plastic markers indicated the eastern and western thresholds and the crossing runway intersection.
There was no windsock at the airfield and one was not required to be there. The Civil Aviation Safety Authority (CASA) Civil Aviation Advisory Publication CAAP 92-1(1) – Guidelines for aeroplane landing areas paragraph 8.7 stated:
A method of determining the surface wind at a landing area is desirable. A windsock is the preferred method.
Although there was no windsock, other means were available by which the pilot could assess the local wind. These included the ability to observe the water surface pattern on several waterholes in the circuit area, including the dam adjacent to the runways depicted in Figure 3, or a comparison of airspeed versus GPS groundspeed during the final approach.
The CAAP referred to the requirements of Civil Aviation Regulation 92 (1), which detailed that a pilot shall not land an aircraft unless, having regard to all circumstances, including the prevailing weather conditions, the aircraft can land at the place in safety.
A document containing information pertaining to the airfield was found in the cockpit. The document depicted the runways as 11/29 725 m in length and 24/06 400 m in length. There was no text adjacent to the ‘windsock’ section, nor was there any mention of rising terrain or a tree to the west of the runway, reducing the runway’s effective length. The following text was under ‘Special procedures and remarks’:
runway 29/11 slopes down to the north-west
pilot to ensure the landing area is suitable
taxi on marked runways
slight undulations on runways
short strip 400 m rising to the north slightly
both strips are ok for use in each direction.
Figure 3: Airfield looking in the landing direction (west) from runway threshold, showing dam surface. Note: image was taken 2 days after the accident, in a westerly wind
Source: ATSB
Landing distance required
CAAP 92-1(1) stated that ‘a runway length equal to or greater than that specified in the aeroplane’s flight manual…is required’. Additionally, paragraph 5.2 of the CAAP recommended that a 15 per cent factor safety factor be applied to required runway lengths.
Based on the landing distance chart in the Pilot’s Operating Handbook (POH), the total distance required for the Cessna 182P to clear a 50 ft obstacle when landing at sea level pressure altitude in nil wind, on short dry grass at 30°C was 1,648 ft (502 m). Therefore, in nil wind conditions, there was sufficient length available for a landing on the runway used by the pilot.
While landings are normally conducted into wind to reduce the groundspeed and landing distance required, it is possible to conduct landings with a limited tailwind. The POH stated that a 50 per cent increase in landing distance was required with a tailwind up to 10 kt. In this instance, that equated to a required distance of 2,472 ft (753 m). Therefore, if the POH guidance was followed, the longest available runway length at the airfield was too short for landing with a 10 kt tailwind.
Approach to land
A stabilised approach is one in which the pilot maintains a constant descent angle to the aiming point for landing on the runway. The advantages of conducting such an approach is that it enables the pilot to:
configure the aircraft for landing and complete all checks
assess the local environmental and runway conditions, including the wind speed and direction
reduce their workload, particularly at unfamiliar aerodromes.
CAAP 166-01 Operations in the vicinity of non-controlled aerodromes, stated that:
The turn onto final approach should be completed 500 ft above the aerodrome elevation. This will allow sufficient time for the majority of aircraft to fly a stabilised approach and landing.
Where a pilot is unfamiliar with the aerodrome layout, or when its serviceability, wind direction, wind speed or circuit direction cannot be ascertained prior to arrival, an overfly procedure should be used.
Aircraft must join the circuit (or avoid the circuit – i.e. when overflying).
When conducting a straight-in approach, the aircraft must be established on final not less than 3 NM from the runway threshold.
Pilots are required to determine the wind velocity and runway in use prior to conducting a straight-in approach.
Only minor corrections to speed and flight path, to maintain a stable approach, should be required within 3 NM on final.
CASA recommends that pilots join the circuit on crosswind (midfield) or downwind leg.
Pilots who choose to join on base should do so only if they have determined a number of factors including the wind direction and speed.
Analysis of the recorded flight track information identified that the pilot of TSA did not join a leg of the circuit or establish the aircraft on final approach from at least 3 NM.
Conduct of a go-around
The POH stated that for a go‑around or 'Balked Landing', the wing flap setting should be reduced to 20° immediately after full power is applied.
The pilot reported that the passenger stated she ‘would get the flaps,’ during the go‑around and he assumed that she had selected the flap lever to the 10° position. Examination of the wreckage identified that, while the flap lever was in that position in the cockpit after impact, measurement of the flap actuator showed that the flaps were still in the fully extended position. Given that discrepancy, the ATSB concluded that either the lever had not been selected up for sufficient time to enable the flaps to start to retract before the aircraft collided with the tree, or the lever moved during the accident sequence.
The aircraft is required by Civil Aviation Order 20.7.4.9.1 to climb at a minimum of 3.2 per cent in the landing configuration, that is, with the flaps extended 40°. To out-climb the tree, the top of which was 7 m high, at that minimum gradient with the flaps extended, the pilot would have had to commence the go‑around 224 m before the tree in nil wind conditions. A go-around conducted with a tailwind reduces the angle of climb and therefore increases the distance required to out‑climb obstacles. The last wheel contact marks were 160 m before the impacted tree.
Data provided to the ATSB by the aircraft manufacturer identified that the aircraft type was capable of out-climbing a 7 m tree from 160 m in nil wind when flown in the landing configuration (full flap) and within 3 kt of the aircraft’s best angle of climb speed (59 kt indicated airspeed). However, with a 15 kt tailwind, the remaining distance was insufficient to climb 7 m in the landing configuration at any airspeed.
Weather information
Weather forecast
A report provided to the ATSB by the Bureau of Meteorology (BoM) detailed that several layers of cloud were forecast in the Tomahawk area around the time of the accident. These included scattered[3] altocumulus and altostratus above 10,000 ft, scattered cumulus and stratocumulus with bases between 2,500 and 4,000 ft, and broken stratus with bases between 1,000 and 2,000 ft with isolated showers of rain.
The BoM also identified that, due to a strong temperature inversion at about 4,500 ft AMSL, there were westerly winds above that level, with an easterly sea breeze below it. An extract of the forecast grid point wind and temperature chart valid for the flight is depicted in Figure 4.
The Tomahawk area is located in the top right grid and shows the wind at 1,000 ft above mean sea level (AMSL) was forecast to be from 110° true[4] at 19 kt and temperature 16°C. In the top centre grid, where the aircraft was en route from Sheffield to Tomahawk at 3,500 ft, the forecast wind at 5,000 ft AMSL was from 280° true at 23 kt and temperature 18°C.
The terminal aerodrome forecast (TAF) for Devonport Airport, 124 km from Tomahawk on a north-facing coastline, indicated a northerly wind of 9 kt.
Figure 4: Grid point wind and temperature chart showing en route and destination forecast
Source: Bureau of Meteorology annotated by ATSB
Actual conditions
The actual conditions at Tomahawk around the time of the accident were consistent with the forecast. Witnesses reported an easterly wind of 15 to 20 kt at the time of the accident. There was high overcast cloud and the pilot reported encountering some lower-level cloud with a base of about 1,400 ft and some showers in the vicinity of the destination airfield. An experienced pilot who had operated numerous times at the airfield reported that the location was frequently affected by a sea breeze.
Pilot’s weather assessment
The pilot reported having obtained the weather forecast prior to departure, including the area forecast and the TAF for Devonport. He reported that he did not identify the forecast difference in wind direction between 5,000 and 1,000 ft and commented that he found the grid point wind and temperature graphical information provided by the BoM more difficult to interpret than the text format used until November 2017. Information about interpreting the new format forecasts is available on the BoM website.
Recorded flight data
The aircraft was not equipped with a flight data or cockpit voice recorder and neither was it required to be. However, the aircraft was fitted with a GPS capable of recording flight data. The aircraft’s track was also recorded on a personal device carried in the aircraft. A review of the data recorded on the device identified that the aircraft cruised on a direct track from The Vale to Tomahawk at 3,500 ft AMSL at a groundspeed between 136 and 150 kt.
During the descent from 3,500 ft, the groundspeed reduced in a manner consistent with both a reduction in power and the aircraft passing through a wind change from a westerly to an easterly direction. After the aircraft descended to about 900 ft AMSL, the pilot conducted a number of orbits on approach to the airfield. While conducting those orbits during the last 4 minutes of the flight, the aircraft’s altitude and groundspeed varied before the descent to land.
To estimate the aircraft’s airspeed from the recorded groundspeed, the ATSB applied a 15 kt easterly wind to the approach data. This showed that the airspeed varied between about 60‑100 kt throughout the approach (Figure 5).
The last data for the flight was recorded at 1731.
Figure 5: Approach data showing altitude, groundspeed and derived airspeed based on a 15 kt easterly wind
Source: ATSB
Wreckage and impact information
Examination of the accident site and aircraft wreckage indicated that the aircraft’s right wing struck the branch of a tree 5.6 m above, and about 36 m beyond, the end of the runway.
The right wing strut fractured on contact with the tree and separated from the aircraft. The wing failed, but remained connected to the fuselage. The aircraft subsequently rolled to the right and pitched nose-down. The propeller and the front of the engine struck the ground and the aircraft rotated about the impact point before coming to rest on its right side. During the impact sequence, the left wing strut fractured at the fuselage and the left wing came to rest on top of the right wing (Figure 5).
Fuel leaked from aircraft’s ruptured wing fuel tanks, but there was no fire.
Examination of the aircraft did not identify any pre-existing faults and the pilot reported that the aircraft, including the engine, was operating normally at the time of the accident. The bending and impact marks on the propeller blades indicated that the engine was producing significant power when the blades struck the ground.
The right flap detached following impact with the tree and the left flap was extended. The flap actuator extension indicated that the flaps were in the fully extended position of 40°.
The lap sash and shoulder strap of both seatbelts were fastened at impact.
Figure 5: Damage to VH-TSA
Source: ATSB
Survivability
The passenger’s seat was found in the fully forward and raised position, and the occupant was seated with a supplemental cushion (also called a booster seat) behind her back and one on the seat base. The United States Federal Aviation Administration (FAA) reported that as supplemental cushions are considered ‘carry-on’ items, they are not regulated.
When the FAA certifies a seat, a specific seat reference point (SRP) is identified, which relates the seat structure to the Anthropomorphic Test Dummy position during certification. If a manufacturer wants to alter the cushion on the seat it must maintain the SRP within an established tolerance, otherwise the seat will have to be re-certificated. When the occupant adds a supplemental cushion it moves them away from the nominal position, which changes how they flail with respect to their surroundings, as well as where their body is relative to the installed restraints.
In this accident, the effect of the supplemental cushions moved the occupant’s body upwards and forwards. This put her at an increased risk of impacting the surrounding structure during the accident sequence. The use of supplemental cushions can also affect the occupant’s vertical acceleration relative to the seat structure increasing the risk of spinal injury. It could not be determined if this alteration from the nominal seating position increased the severity of the injuries sustained.
By adding supplemental cushions, a short-statured pilot increases their flail envelope,[5] which increases their injury potential. However, without the supplemental cushion they may have reduced visibility or may not be able to operate the flight controls effectively.
The pilot identified the predominantly westerly tailwind at the cruising altitude while the aircraft tracked east‑north‑east towards an airfield in Tomahawk. However, the easterly local surface wind at the airfield, although forecast, was not identified.
The pilot reported that before landing at an aerodrome, he normally overflew and assessed the windsock then joined the circuit depending on the direction of the wind. However, on this occasion there was no windsock available. While a windsock provides a simple visual means to assess wind strength and direction (and is the preferred method recommended by the Civil Aviation Safety Authority), there were a number of other means by which the pilot could have assessed the wind prior to commencing the approach. These included:
interpretation of the wind‑effect on the surface of a nearby dam or vegetation
a comparison of the airspeed with the GPS‑derived groundspeed during a stabilised segment of flight associated with either an upwind or downwind circuit leg or long final approach.
The pilot had previously demonstrated his ability to assess local wind conditions, without a windsock, while conducting a simulated forced landing as part of a flight review. On this occasion however, the landing runway was selected in anticipation of a similar westerly wind direction to that encountered during cruise. The resultant approach direction exposed the aircraft to about a 15 kt tailwind, which significantly increased the groundspeed on final approach and resulted in a manufacturer‑calculated landing distance in excess of that available. It also significantly reduced the available climb gradient in the event of a go-around.
The pilot was unfamiliar with the airfield and also reported the presence of low cloud and reduced ambient lighting conditions on arrival at Tomahawk. He also stated that arrival time was later than planned. It is possible that these factors may have influenced the approach preparation and conduct.
Unstable approach and go‑around
On arrival at Tomahawk, the pilot conducted a number of orbits south-east of the airfield at varying height and airspeed rather than joining the circuit or conducting a straight-in approach. This manoeuvring reduced the stability of the final approach and the opportunity for the pilot to assess the local wind conditions via a comparison of airspeed and GPS groundspeed.
The pilot recalled realising just prior to landing that the groundspeed was higher than the airspeed – indicative of a tailwind. Despite that, a go-around was not conducted at that point and the aircraft touched down over halfway along the prepared runway surface, with insufficient remaining runway to come to a stop.
Following a number of subsequent bounces, the pilot assessed that the aircraft was not going to be able to stop before the end of the runway. In response, he increased the power and raised the aircraft’s nose to go-around but the flaps were not altered from the landing configuration. This reduced the aircraft’s climb performance and, combined with the tailwind, led to insufficient distance remaining for the aircraft to climb above the tree at the end of the runway. The aircraft’s wing struck the tree and was damaged to the extent that the aircraft became uncontrollable. The aircraft then rolled to the right, pitched nose-down and collided with the terrain.
Findings
From the evidence available, the following findings are made with respect to collision with terrain involving Cessna Aircraft Company 182P, registered VH-TSA, that occurred at Tomahawk, Tasmania on 20 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The selected approach direction exposed the aircraft to a tailwind that significantly increased the groundspeed on final approach and resulted in insufficient landing distance available.
The pilot did not conduct a stabilised approach, which combined with the tailwind, resulted in the aircraft being too high and fast and a bounced landing well beyond the runway threshold.
From the point at which the go-around was initiated, there was insufficient distance remaining for the aircraft to out-climb the tree at the end of the runway in the landing flap configuration and tailwind conditions.
Other factors that increased risk
There was no windsock at the airfield to enable a simple visual assessment of the wind strength and direction.
Sources and submissions
Sources of information
The sources of information during the investigation included
the pilot of VH-TSA
several pilots operating in the local area
the airfield owner
AvPlan
Airservices Australia
the Civil Aviation Safety Authority
the United States National Transportation Safety Board
Textron Aviation
References
Rolfe ST& Barsom JM 1977, Fracture and fatigue control in structures, applications of fracture mechanics, Prentice-Hall New Jersey, pp. 414-440.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot, the airfield owner, the aircraft manufacturer, the Civil Aviation Safety Authority and the United States National Transportation Safety Board and Federal Aviation Administration.
Submissions were received from the airfield owner and the Federal Aviation Administration. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 23/02/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 20 January 2018, at about 1645 Eastern Daylight-saving Time,[1] a Cessna 182P aircraft, registered VH-TSA, departed The Vale airstrip, Sheffield, Tasmania, for a private flight to a private airstrip at Tomahawk, Tasmania. The flight was a distance of 79 NM, tracking to the east‑north‑east at 3,500 ft above mean sea level (AMSL) and was conducted under the visual flight rules.[2] On board were the pilot occupying the front left seat and a passenger (also a qualified pilot), seated in the front right seat.
The pilot broadcast on the Multicom frequency when the aircraft was 10 NM from, and inbound to, the destination airstrip. Recorded data showed that the aircraft commenced a descent from its cruising altitude of 3,500 ft at 1712. The pilot reported that he sighted the airstrip after descending to about 1,000 ft AMSL. There was no windsock at the airstrip. The pilot anticipated that the wind would be from the same north‑westerly direction they reported encountering during the flight, and therefore decided to land towards the north-west.
The pilot conducted a number of orbits (Figure 1) and later reported manoeuvring the aircraft prior to approaching the runway because the aircraft was too high and its groundspeed was faster than normal for the approach.
Figure 1: Recorded aircraft track
Source: AvPlan data – annotated by ATSB
At about 1720, a witness at the property saw and heard the aircraft operating south-east of the airstrip. A second witness, who was standing between the house and airstrip, then saw the aircraft approaching the runway heading in a westerly direction.
One of the witnesses was concerned that the pilot was attempting to land the aircraft towards the west, with a tailwind estimated to be about 15 kt. He drove his vehicle onto the runway towards the approaching aircraft, with headlights on and hazards lights flashing, in an attempt to communicate to the pilot to abort the landing.
The pilot thought the driver was indicating where to land and continued the approach. As the aircraft continued towards him, the driver vacated the runway.
Tyre marks on the grass showed that the aircraft first touched down 433 m beyond the runway threshold, with 284 m of runway remaining. The aircraft bounced several times along the airstrip before the pilot initiated a go-around, applying full power, to which the engine appears to have responded normally. The pilot reported raising the aircraft’s nose and the aircraft commenced climbing, however it collided with a tree and terrain beyond the end of the runway. The aircraft came to rest on its right side (Figures 2 and 3).
The passenger sustained fatal injuries and the pilot was seriously injured. The aircraft was substantially damaged.
Figure 2: Accident site of Cessna 182P aircraft, VH-TSA
Source: ATSB
Pilot information
The pilot held a current Private Pilot (Aeroplane) Licence issued by the Civil Aviation Safety Authority on 17 February 2016, a single‑engine aeroplane class rating, and a manual propeller pitch control design feature endorsement, as required for the flight.
The pilot also held a Class 2 Aviation Medical Certificate valid until 8 November 2019 with restrictions, including that vision correction must be worn and reading correction was to be available while exercising the privileges of the licence. In conjunction with a flight review conducted on 18 December 2017, the pilot had successfully completed an operational check of his vision following eye surgery.
The pilot had about 560 hours total aeronautical experience.
The passenger also held a current Private Pilot (Aeroplane) Licence and Class 2 Aviation Medical Certificate. The passenger had about 1,280 hours total aeronautical experience.
Aircraft information
The Cessna Aircraft Company 182P is a four-seat, high‑wing, single-engine aircraft equipped with fixed tricycle landing gear. The aircraft was powered by a Teledyne Continental Motors O-470-S engine and fitted with a McCauley two-blade, constant-speed propeller.
VH-TSA, serial number 182-64969, was a 1976-model 182P aircraft, recorded as being manufactured in the United States in 1977. It was first registered in Australia in 1978 and registration was transferred to the current operator in 2012. The aircraft’s total time in service was 6,160 hours.
The aircraft was operated in the private category.
Airstrip
The runway was 717 m long, orientated in a direction of 281° magnetic, and had a short grass surface. The runway sloped down towards the west at an average slope of 1.5° for the first 500 m, and was then level. A shorter runway heading 050°/230° intersected the main runway just east of its midpoint. White plastic markers indicated the eastern and western thresholds and the crossing runway intersection. There was no windsock at the airstrip.
Weather
The aircraft tracked east-north-east to Tomahawk, and the pilot reported having a westerly tailwind of 18 kt during the cruise. At the landing airstrip, witnesses reported an easterly wind of about 15 kt at the time of the accident. There was high overcast cloud.
Recorded data
The aircraft was not equipped with a flight data or cockpit voice recorder, nor was it required to be. However, the aircraft was fitted with a GPS that could record data. The aircraft’s track was also recorded on a personal device carried in the aircraft (Figure 1). The last data for the flight was recorded at 1731.
Wreckage and impact information
Examination of the accident site and aircraft wreckage indicated that the aircraft’s right wing struck the branch of a tree 5.6 m above and about 36 m beyond the end of the runway.
The right wing strut fractured and separated from the aircraft and the wing failed, but remained connected to the fuselage. The aircraft subsequently rolled to the right and pitched nose-down. The propeller and the front of the engine struck the ground and the aircraft rotated about the impact point before coming to rest on its right side. During the impact sequence, the left wing strut fractured at the fuselage and the left wing came to rest on top of the right wing (Figure 3).
Fuel leaked from aircraft’s ruptured wing fuel tanks, but there was no fire.
Examination of the aircraft did not identify any pre-existing faults and the pilot reported that the aircraft, including the engine, was operating normally at the time of the accident. The bending and impact marks on the propeller blades indicated that the engine was producing significant power when the blades struck the ground.
The right flap detached following impact with the tree and the left flap was extended. The flap actuator extension indicated that the flaps were in the fully extended position – 40° flap.
The lap sash and shoulder strap of both seatbelts were fastened at impact.
Figure 3: Damage to VH-TSA
Source: ATSB
Continuing investigation
The investigation is continuing and will include examination of the following:
electronic data
aircraft and site survey data
forecast and actual weather conditions
pilot qualifications and experience
survivability.
___________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 18 January 2018, a Malaysia Airlines Berhad (MAB) Airbus A330-323 aircraft registered 9M‑MTM was operating a scheduled passenger flight designated MH122, which departed from Sydney, New South Wales, for Kuala Lumpur, Malaysia. On board were two flight crew, 10 cabin crew and 243 passengers. During the flight, the left engine malfunctioned, necessitating a diversion to Alice Springs where the aircraft landed safely.
What the ATSB found
The left engine, a Pratt & Whitney PW4170, had a third stage outer transition duct (OTD) segment liberation, which created a rise in exhaust gas temperature and significant turbulent airflow within the engine. That in turn led to low pressure turbine blade failure, high vibration and compressor stall/surge events. There have been a total of 16 similar events globally within the past 4 years that were all attributed to an engine modification, including five involving MAB aircraft. The modification increased the gas path temperature at the outer diameter of the flowpath, which led to distortion and liberation of OTD segments.
What's been done as a result
The engine manufacturer Pratt & Whitney had ceased production of PW4000-100 series engines for the Airbus A330 in July 2017. They have also redesigned the OTD to withstand higher temperatures. The newly designed hardware will be available for purchase from November 2019 and recommended by service bulletin for installation at the customers’ discretion in affected engines when they are next scheduled for disassembly at an overhaul facility. Engines that have scheduled overhauls and repairs before the redesigned OTDs are available will receive a full new set of current OTDs. This will remove ducts that were potentially exposed to elevated temperatures.
While the ATSB welcomed the availability of the redesigned OTD, as their fitment is not mandatory, safety recommendations were issued to Pratt & Whitney and the United States Federal Aviation Administration (FAA) to maximise fitment of the improved components.
MAB has implemented scheduled borescope inspections that are designed to identify precursors to an OTD failure. One of the five MAB events was identified while conducting a borescope inspection.
Safety message
This incident is an example of an engine modification that had undesirable consequences. The negative effect of the redesign was identified by the engine manufacturer during analysis of a previously unseen failure mode in the PW4000-100 series engine.
The engine manufacturer has taken timely and significant safety action to redesign the outer transition duct. If fleet‑wide replacement is implemented, the safety issue is expected to be addressed.
Finally, while the crew's response to the elevated temperature was in accordance with the required procedure, this occurrence highlights that significantly abnormal indications are often symptomatic of a developing problem. In such circumstances, the safest course of action is to discontinue the flight as soon as possible.
Pratt & Whitney PW4170 gas turbine engine
Source: Pratt & Whitney, modified by the ATSB
The occurrence
What happened
On 18 January 2018, a Malaysia Airlines Berhad Airbus A330-323 (A330) aircraft, registered 9M‑MTM, was operating a scheduled passenger flight designated MH122, from Sydney, New South Wales, to Kuala Lumpur, Malaysia. On board were two flight crew, 10 cabin crew and 243 passengers.
The aircraft departed Sydney at 1306 Eastern Daylight-Saving Time[1] and while passing an altitude of about 1,500 ft, the flight crew received an electronic centralised aircraft monitoring (ECAM) exhaust gas temperature (EGT) 1 OVERLIMIT message, which indicated a fault with engine number 1 (left engine). The crew performed the checklist actions and reduced the left engine thrust to maintain the EGT within limits.
The aircraft continued to climb, and the left engine was restored to full climb thrust at flight level[2] (FL) 240. The EGT of the left engine was observed by the crew to be about 70°C higher than the right engine EGT, however it did not exceed its limits during the climb and cruise phase.
About four hours into the flight, while cruising at FL 360 about 37 km north of Curtin Airfield, Western Australia, the crew received an ECAM notification, ENG 1 STALL[3], with corresponding ‘bang’ sounds heard emanating from the engine on three or four occasions. The engine vibration monitor indicated significant vibration increases during the engine stalls. The flight crew carried out the ECAM action and thrust was reduced to flight idle. A PAN-PAN[4] call was made and the aircraft turned left and initiated a descent to the single engine flight altitude of FL 240.
During the descent, an attempt was made to restore thrust to the left engine, however this had a corresponding effect of increased vibration. Consequently, the engine thrust was reduced back to flight idle, and the descent was continued to FL 240. The engine was not shut down. The flight crew reviewed the nearest suitable airport to conduct a landing. With the weather at Darwin, Northern Territory (NT), assessed as unsuitable, a decision was made to land at Alice Springs, NT.
During the diversion to Alice Springs, the cabin crew were told to prepare the cabin for an emergency landing. That request was later revised following a reassessment of the situation and several passenger announcements were made to inform passengers to expect a normal landing. The aircraft landed safely at Alice Springs at 1746 Central Standard Time[5] and taxied to the parking apron under its own power.
An engineering inspection conducted on the day of the incident found that despite the left engine operating at flight idle until it was shut down on the apron at Alice Springs, the N1 rotor (fan) was unable to be rotated by hand. Molten debris was found in the exhaust, and the last turbine stage had numerous nicks and dents. The following day, when the engine had cooled, the fan was able to be turned by hand. The engine was deemed to be unserviceable, removed from the aircraft and shipped to a suitable engine overhaul facility so that a detailed disassembly and inspection could be conducted by the engine manufacturer.
Engine history
The Pratt & Whitney PW4170 high by-pass turbine engine serial number 735135 had not been removed from the aircraft since it was fitted during the aircraft’s manufacture in 2013. It had accumulated 22,591 hours and 3,415 cycles in service.
Advantage 70™ engine
The engine was an upgraded version of the PW4168 engine, called the Advantage 70™. It was specifically redesigned to increase the Airbus A330’s maximum take-off weight. The modifications could be retrofitted to legacy engines, and was introduced as standard in the A330 fleet from 2010. The modifications included:
the inclusion of high-pressure turbine technology with new thermal barrier coatings
a redesigned combustor
a redesigned ring compressor case
software enhancements.
The effects of the modifications were:
a 1 per cent decrease in fuel consumption and 2 per cent increase in thrust
an increase in the gas path outer end wall temperature.
Engine disassembly and inspection
The engine disassembly and inspection identified that a third stage outer transition duct (OTD) segment had separated at the gas path entry point of the low-pressure turbine. (Figure 1).
Figure 1: Cutaway view of the PW4170 showing outer transition duct location
Source: Pratt & Whitney, modified by the ATSB
Specifically, the OTD at the number 5 position distorted, partially released from the front retaining hook and fractured so that a large section moved to a position that lay across the gas path of the low-pressure turbine nozzle guide vanes (Figure 2). That partial blockage created turbulent airflow within the engine, and caused an increase in exhaust gas temperature. Downstream engine damage, including separation of some low-pressure turbine blades, was attributed to the turbulent airflow and impact damage from sections of the OTD and released turbine blades.
Various components, including the OTDs, were sent to the manufacturer’s materials analysis facility for further examination.
Figure 2: Front view of low-pressure turbine section showing the outer transition duct segment separation and movement into the low-pressure turbine airflow path
Source: Pratt & Whitney, modified by the ATSB
Material failure analysis
A material analysis report was supplied to the ATSB by the engine manufacturer on 12 February 2019. The summary and conclusions stated that:
Review of the low-pressure turbine outer transition duct segments found that the segment identified as #5 had fractured. Examination of the fracture surfaces found that the features appeared dendritic [microstructure affected by heat]; no evidence of fatigue was observed.
Metallographic sections were prepared through two outer transition duct segments selected based on the condition of the corresponding high pressure turbine 2nd stage blade outer air seals and dimensional inspection of the segments. Examination of the sections found evidence of microstructural changes indicative of exposure to elevated temperatures.
Figure 3 shows the fractured and recovered sections of the number 5 OTD that were examined.
Figure 3: Non gas path side of the failed number 5 outer transition duct sections
Source: Pratt & Whitney
The ATSB asked the engine manufacturer if they were aware of the reason why there appeared to be degradation of the OTD due to elevated temperatures. The engine manufacturer stated that:
The elevated temperature exposure of the OTD identified during the failure analysis activity is attributed to the OD [Outer Diameter] of the gas path being hotter in engines configured with the Talon IIB-combustor (includes all Advantage70 engines). Spallation of the 2nd Stage Blade Outer Air-seals (BOAS) immediately upstream of the OTD is an additional contributor.
Similar occurrences
At the time of drafting this report, the PW4000-100 series engines with the Talon IIB combustor or configured as PW4170 Advantage 70™ (as fitted to the Airbus A330-300) have had 16 OTD separation events dating back to 2015, including this incident. A further two engines were identified following a shift in engine parameters requiring borescope inspections and unscheduled engine removals.
There have been a total of 306 modified engines produced, with the 16 engine events representing 5.22 per cent of the entire fleet requiring unscheduled removal due to this issue within the last 4 years.
The consequence of these events have been EGT increases, engine surges and diversions or air turn-backs, with two in-flight engine shut‑downs. None of these events were uncontained engine failures, but all resulted in engine damage which necessitated unscheduled engine removal for repair. All of the OTD liberations occurred within 3,104 to 8,887 flight cycles since installation at manufacture or incorporation of the Advantage 70™ modification.
Five of the 16 events occurred on the incident operator’s aircraft, with one being identified during a borescope inspection following a shift in engine parameters.
Flight data
Data from the incident flight showed a significantly elevated temperature on the left engine from take-off, four hours before the engine vibration and surging occurred.
The operator supplied engine trend data for the failed engine. That data did not show any increase or exceedance in engine exhaust gas temperature, or any other parameter in the 18 months preceding the incident.
Safety analysis
Occurrence event
The flight crew handled the engine malfunction in accordance with the non‑normal checklist, reducing the engine’s thrust to idle, and safely diverting and landing the aircraft at the closest suitable location. Recognising that the crew's response to the elevated temperature shortly after take‑off was in accordance with the electronic centralised aircraft monitoring procedure, this occurrence highlights that significantly abnormal indications are often symptomatic of a developing problem. In such circumstances, crews should give serious consideration to returning and landing the aircraft rather than continuing with the flight.
Engine failure analysis
The engine manufacturer identified that the outer transition duct (OTD) distorted over a period of time to a point where the axial length was reduced enough for the front hook to disengage. Once disengaged, the OTD partially moved into the gas path which elevated its temperature. The temperature and gas path loads fractured the OTD, and the rear section rotated and came to rest on the low-pressure nozzle guide vanes. That created significant turbulent airflow within the engine which led to low pressure turbine blade failure, high vibration and the compressor stall/surge events (Figure 4).
There had been a total of 16 OTD liberations in service since 2015, with all but one occurring within the Advantage 70™ modified engine. The engine that did not have the modification did have the newer Advantage 70™ Talon IIB combustor fitted. Those figures represented over 5 per cent of all modified engines requiring unscheduled removal for repair. The modifications had an effect of increasing the outer duct gas path temperature. This increase in temperature led to the distortion and degradation of the OTD’s, which ultimately led to the failures. It is likely that OTD liberations will continue in Advantage 70™ engines until modifications are made to rectify the issue. Refer to the Safety action section for the engine manufacturer’s proactive safety action.
Figure 4: Plan view of the low pressure outer transition duct, front and rear attachment points, the fracture point, the engine gas path and the low pressure nozzle guide vane.
Source: Pratt & Whitney, modified by the ATSB
Findings
From the evidence available, the following findings are made with respect to the engine malfunction involving Airbus Industrie A330-323 registered 9M-MTM that occurred near Curtin Airfield, Western Australia, 18 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
While in the cruise the left engine experienced surging and increased vibration, which necessitated a power reduction and diversion for a precautionary landing.
The engine malfunction was a result of a third stage outer transition duct segment liberation that partially blocked a stage of the low-pressure turbine vane inlet, creating a rise in exhaust gas temperature, turbulent internal engine airflow, and consequent failure of the low-pressure turbine blade/s.
There were a total of 16engine malfunction events globally over a 4-year period attributed to modification of the Advantage 70™ engine. The modification increased the engine outer duct gas path temperature, which led to distortion and liberation of the outer transition duct segments. [Safety issue]
Safety issues and actions
The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: There were a total of 16 engine malfunction events globally over a 4-year period attributed to modification of the Advantage 70™ engine. The modification increased the engine outer duct gas path temperature, which led to distortion and liberation of the outer transition duct segments.
Safety recommendation description: The ATSB recommends that Pratt & Whitney, together with the United States Federal Aviation Administration, take action to maximise incorporation of the redesigned outer transition duct as detailed in Service Bulletin PW4G-100-A72-261.
Safety recommendation description: The ATSB recommends that the United States Federal Aviation Administration, together with Pratt & Whitney, take action to maximise incorporation of the redesigned outer transition duct as detailed in Service Bulletin PW4G-100-A72-261.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Malaysia Airlines Berhad (MAB), the aircraft operator advised they have:
implemented scheduled borescope inspections that will identify precursors to an outer transition duct (OTD) failure. The MAB fleet will be upgraded in stages once the new designed OTD is introduced in November 2019.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
aircraft operator
engine manufacturer
National Transport Safety Board
Federal Aviation Administration.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Malaysia Airlines Berhad, National Transportation Safety Board, Pratt & Whitney, Bureau d’Enquêtes et d’Analyses, Airbus Industries and the Civil Aviation Safety Authority.
Submissions were received from Malaysia Airlines Berhad, National Transportation Safety Board, Pratt & Whitney, Bureau d’Enquêtes et d’Analyses, Airbus Industries and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 16 January 2018, a container on freight train 2BM9 collided with station infrastructure at Maitland, New South Wales (NSW). The collision damaged gutter retaining brackets on platform 1 at Maitland Railway Station. Train 2BM9 continued its journey with the crew unaware of the incident, until contacted by the network control officer.[1]
Train 2BM9 was a scheduled service owned and operated by SCT Logistics (SCT) and was transporting general freight and containerised freight from Brisbane, Queensland (QLD) to Melbourne, Victoria. The train consisted of two locomotives hauling 18 single and multi-platform wagons, and it was 795 m long with a total mass of 1,690 t. The train manifest recorded that 23 containers on this train were empty, including the container involved in this incident (MGCU7810161), which was loaded on the 18th wagon (PQQY50015).
Train 2BM9 was marshalled, loaded and examined in the SCT Terminal at Bromelton, QLD. The train examination[2] certificate was recorded as completed at 1745 on 15 January 2018, the day of departure, and did not record any anomalies.
At about 1901[3] train 2BM9 departed SCT Terminal at Bromelton. The train travelled on the ARTC[4] North Coast rail network from Bromelton to Maitland, NSW. The journey included crosses[5] with other rail services at Glenapp, Kyarran, Kungala, Nana Glen, Nambucca Heads, Stroud, and Dungog (Figure 1). This journey took place without incident or out-of-gauge[6] advice from crossing train crews undertaking roll-by[7] inspections of 2BM9.
Figure 1: ARTC North Coast rail line between Maitland and Bromelton
Image shows ARTC North Coast rail line between Bromelton and Maitland shown in red. Locations between Bromelton and Maitland where freight train 2BM9 passed other rail services are also indicated.
Source: ARA Railways of Australia Map 2014, annotated by ATSB.
Train 2BM9 passed through Maitland Railway Station at approximately 0748 on 16 January 2018. At about this time, the trailing edge of container MGCU7810161 placed on the fifth platform of PQQY50015 collided with the verandah gutter mounting brackets on platform 1 at Maitland Railway Station (Figure 2).
Figure 2: Maitland Railway Station layout
Image shows Maitland Station Platform 1 with 2BM9 path shown by yellow line, point of collision with station infrastructure, and train 2BM9 direction of travel.
Source: Google Earth annotated by ATSB.
At 0753, the Sydney Trains Station Master at Maitland reported the collision to the ARTC network control officer. The network control officer contacted the 2BM9 train crew at 0755 and organised for them to undertake an inspection of their train at Hexham, NSW. The train crew confirmed at 0829 that a container on wagon PQQY50015 was not secured by the two trailing twist locks (see Load restraint below) and was out of gauge (Figure 3).
Figure 3: Out of gauge container MGCU7810161 placed on wagon PQQY50015
The left Image shows out of gauge Container MGCU7810161 on wagon PQQY50015. The right image shows the miss-located twist lock. Photos taken at Hexham siding NSW, shortly after collision.
Source: SCT, annotated by ATSB.
As a result of the collision, two lengths of the verandah gutter dropped to the surface of platform 1 at Maitland Railway Station (Figure 4). Although there were some people on the platform at this time, the immediate area of the collision was unoccupied, and no injuries were reported.
Figure 4: CCTV event recordings from Maitland Railway Station at the time of collision
The first image shows container MGCU7810161 out of gauge prior to the collision and the gutter collapsing. The second image shows the detached guttering shortly after the collision prior to 2BM9 departing the scene.
Source: Sydney Trains annotated by ATSB.
Context
Train handling
The ATSB explored the possibility that train handling had contributed to this incident. To establish this, a review of the lead locomotive (SCT014) event recorder was undertaken. The ATSB concluded that train 2BM9 was handled in a manner consistent with normal train operations. There was no evidence to suggest that train handling contributed to the two twist locks on wagon PQQY50015 releasing container MGCU7810161.
Track infrastructure
ARTC manage the standard gauge rail infrastructure between Bromelton and Maitland. The ATSB undertook a review of ARTC’s track condition and track defect records to determine if the rail infrastructure condition may have contributed to the load shift of container MGCU7810161. The review also considered the amount of rail infrastructure geometry deviation needed to create the forces required to release a container from a TFAD automatic twist lock. The ATSB found no evidence of track geometry with sufficient deviation to dislodge a properly secured container. Consequently, the ATSB concluded it was unlikely that track condition contributed to the two twist locks releasing container MGCU7810161.
Rolling stock
Freight wagon
The wagon involved in this incident, PQQY50015, is a 5-pack[8] wagon designed to carry containerised freight. The PQQY class wagons were manufactured by CSR[9] in 2014.
The last maintenance inspection on wagon PQQY50015 was a scheduled inspection undertaken on 23 November 2017. The maintainer undertaking this inspection recorded that no repairs were required. The ATSB found that there was no evidence to suggest that the wagon condition contributed to the incident.
Load restraint
The fifth platform of wagon PQQY50015 was fitted with four TFAD type automatic twist lock load restraints manufactured by Celtec Rail Pty Ltd (Figure 5).
Figure 5: TFAD automatic type twist lock
Photo shows an automatic TFAD type twist lock, the same type as in use on platform 5 of wagon PQQY50015 at the time of this incident.
Source: Celtec Rail Pty Ltd.
The twist lock’s purpose is to restrain freight containers to a rail wagon. The twist lock works by the twist lock head turning within an elongated corner casting on a freight container, thereby restraining the container by its corner casting. The automatic type twist lock applies a spring force to the twist lock head. As the container is lowered onto the rail wagon, the downward force turns the twist lock head, which springs back into its initial position to automatically restrain the container. Conversely, the lifting of the container applies an upward force to release the twist lock from the container corner casting.
The scheduled maintenance inspection of wagon PQQY50015 (23 November 2017) included checks of the twist locks for correct operation, and wear or damage. The maintainer undertaking this inspection recorded that no repairs were required.
After the infrastructure collision at Maitland, train 2BM9 was directed into a siding so that container MGCU7810161 could be re-secured to platform 5 of wagon PQQY50015. The container was re-secured to the wagon without a need to replace the twist locks. Train 2BM9 continued its journey to Melbourne without incident.
Upon arrival in Melbourne an inspection was undertaken on the twist locks. This inspection reported that:
all containers on wagon PQQY50015 were positioned correctly and securely locked with twist locks
all four automatic twist locks on container MGCU7810161 were securely locked
there were no gaps present between container MGCU7810161 and the twist locks
there were no abnormalities in the removal process of container MGCU7810161.
Considering the performance of the twist locks after the collision, the ATSB concluded that a mechanical failure of the twist locks was unlikely to have been the reason container MGCU7810161 shifted on its wagon and collided with the Maitland Railway Station verandah.
Environmental conditions
In the days preceding the journey of 2BM9, high winds had been forecasted between Bromelton and Maitland.
Weather station data was obtained from the Bureau of Meteorology (BOM) for nine weather station sites adjacent to the ARTC rail network between Bromelton and Maitland.
The ATSB examined the weather station data for 15 and 16 January 2018 during the times 2BM9 travelled through the area. The ATSB compared the data with the calculated wind severity required to provide sufficient lifting force to release an empty 48-foot container secured with twist locks. The ATSB analysis concluded that the recorded wind speeds were unlikely to have been of sufficient magnitude to lift container MGCU7810161 from its twist locks.
In addition, there was no evidence of twist lock release for any other empty containers loaded on 2BM9. The ATSB found that it is unlikely that environmental conditions were severe enough to have released container MGCU7810161 from its twist locks.
Train loading and examination
SCT is required to have systems in place to manage the hazards associated with its rail operations. One of the hazards that SCT has identified is equipment/freight falling from a train due to an unsecured load. The SCT risk assessment had identified wagon specific loading instructions, the training of these instructions to loader operations staff, and qualified train examiners as controls for managing this hazard.
Container loading
The loading operator stated that his duties while loading train 2BM9 involved the loading and unloading of containers from trucks, and the loading of containers on to train 2BM9. These duties included applying checks to ensure that containers were square to the wagon when loading and unloading. The loading operator did not observe any issues or malfunctions in the process of loading container MGCU7810161 onto wagon PQQY50015.
In accordance with SCT’s training needs analysis, the loading operator held the required SCT competencies for the task of loading containers onto rail wagons.
The ATSB reviewed the SCT risk controls, namely, wagon specific loading instructions and their training arrangements with respect to the loading checks expected from SCT loading operators.
SCT had established a loading instruction WI 048 for its PQQY class wagons. This instruction provided guidance on the loading requirements and limits. However, it did not specify any loading checks required from loading operations staff when securing containers to wagons. Further to this, the SCT training materials also did not specify any loading checks expected from loading operations staff.
From this, although it is likely that the requirement for loading checks was informally communicated to the loading operator involved in this incident, the ATSB found that SCT had not documented its process for loading checks expected from SCT loading operations staff when securing containers to wagons.
Train examination
The pre-departure train examination of SCT trains from an originating terminal required a full mechanical examination in accordance with ROA Section 5.[10] The ROA Section 5 full mechanical examination, with respect to this incident, included a visual examination of twist locks, plus checks that loads were secured and within gauge.[11]
The train examiners reported that, when 2BM9 departed Bromelton on 15 January 2018, all wagons and containers were within specifications, secured, and safe to travel towards Melbourne.
The train examiners involved in the pre-departure and roll out examination of train 2BM9 held current competencies for this task.
Station infrastructure
ATSB investigators noted that the platform 1 verandah at Maitland Railway Station verandah protruded further into the rail corridor than the station platform, potentially increasing the possibility of collision. Consequently, the ATSB examined the design and actual clearances between rolling stock and infrastructure at Maitland Railway Station.
ARTC has defined maximum loading dimensions and outlines[12] for their rail network to ensure adequate clearances and prevention of collisions between rolling stock and static trackside infrastructure. The clearance standards take into consideration infrastructure conditions such as track curvature and track geometry tolerances, plus allowances for the dynamic movement of rolling stock.
The ARTC documentation defines the following:
Maximum container loading – the maximum container loading dimensions inclusive of rail vehicle that are permitted on a defined corridor.
Structure outline – the outline that determines which structures on a line section should be included in a clearance register, and become subject to maintenance intervention.
Static rolling stock outline – the cross-sectional outline of a maximum sized rail vehicle at rest, and the base point for determination of the dynamic or kinematic rolling stock outline. ARTC documentation specifies a number of static rolling stock outlines for various rolling stock loadings, including the network routes that each static rolling stock outline is permitted.
Kinematic rolling stock outline – the outline that includes the effects of rail vehicle centre and end throw, track curvature and geometric tolerances and dynamic rolling stock limits on the static rolling stock outline. An infringement of this outline is treated as a track obstruction.
Base operating standard for structures – the outline derived from a 100 mm increase from the kinetic rolling stock outline. This outline may be infringed only in special circumstances and subject to there being no exceedance of the appropriate track tolerances.
Maintenance intervention standard for structures – the outline derived from a 200 mm increase from the kinetic rolling stock outline. This outline provides the first limit where maintenance intervention will be required for structures that infringe.
The ARTC documentation considers an infringement of the kinematic rolling stock outline to be a track obstruction. As the normal practice is to locate platforms as close as possible to the train for passenger safety, ARTC requires that, subject to approvals, new platforms may be built to the kinematic rolling stock outline defined for that route. From this, it is reasonable to conclude that the kinematic rolling stock outline is the absolute boundary for any station infrastructure.
The maximum container loading permitted for travel between Bromelton and Maitland has a height limit of 4,050 mm and width of 2,500 mm. For train 2BM9, container MGCU7810161 on wagon PQQY50015 had an estimated height of 4,040 mm and a width of 2,500 mm. To examine clearance conditions at Maitland station, the ATSB overlayed these dimensions on to the largest static rolling stock outline that ARTC has permitted for travel on that corridor, rolling stock outline plate D[13] (Figure 6).
Figure 6: Clearance outlines for ARTC rolling stock outline type D to track side infrastructure for straight track between Bromelton and Maitland rail corridor
The image compares the applicable clearance outlines for trains hauling containerised freight between Bromelton and Maitland on straight track.
Source: ARTC Route Access Standard – General Information, and ARTC Engineering (Track and Civil) Code of Practice – Section 7 Clearances, annotated by the ATSB.
When including the rail infrastructure design for platform 1 at Maitland Railway Station, it can be seen that the verandah gutter coincides with the kinematic rolling stock outline. For a maximum container loading, this provides for a vertical design clearance of approximately 70 mm and a horizontal design clearance of approximately 150 mm (Figure 7).
Figure 7: Maitland Railway Station Platform 1, designed clearance outlines
The image depicts the design clearance outlines for platform 1 at the Maitland Railway Station for a correctly secured container loaded on a PQQY class wagon. Note that verandah height is above container.
Source: ATSB.
However, post-collision measurements showed that the measured track height through platform 1 had increased from the design height. Because of the change in track height, the station verandah encroached on the kinematic rolling stock outline, effectively becoming a track obstruction. With respect to a correctly secured container load, the change in track height removed the vertical clearance (previously 70 mm), with the remaining safety margin only provided by the horizontal clearance of approximately 150 mm (Figure 8).
Figure 8: Maitland Railway Station platform 1, actual clearance outlines
The image depicts the measured clearance outlines for platform 1 at the Maitland Railway Station for a correctly secured container loaded on a PQQY class wagon. Note that verandah height is now at same height as container, and infringing on kinematic rolling stock outline.
Source: ATSB.
Track inspection and maintenance
It is common practice for rail infrastructure managers to monitor track movement adjacent to fixed structures such as railway station platforms, to ensure compliance with design clearances and ultimately control infrastructure collision hazards. The ATSB examined the ARTC inspection and assessment arrangements adopted for managing clearances at platform 1 of Maitland Railway Station.
The ARTC had scheduled and undertaken inspections of clearances for the railway station on a yearly cycle prior to this incident. These inspections required the measurement of the vertical and horizontal clearance between the closest rail and physical measurement plaques fitted to the platform wall (Figure 9).
The image shows a measurement plaque on the Maitland Railway Station platform 1 wall, with inset graphic showing where scheduled clearance measurements were undertaken prior to the collision.
Source: ATSB.
The horizontal and vertical clearance inspection records for platform 1 at Maitland showed that over time the vertical clearance measurement had reduced due to an increase in the track height through platform 1. The change in vertical clearance exceeded the limits defined by the ARTC management of clearance specification, and the platform 1 design measurements.
The increased track height and consequential decrease in vertical clearance measurement at Maitland railway station was not identified (or corrected) by ARTC.
Safety analysis
Train loading and examination
The container fitted to wagon PQQY50015 was an empty container. It is known that a downward force is required to overcome the spring tension on an automatic twist lock to effect the securing of a container. In consideration of this, and the absence of a more probable reason, it is possible that there was not enough downward force applied to container MGCU7810161 to overcome the twist lock spring tension to effect load restraint on wagon PQQY50015.
In further support of this, the ATSB explored train handling, track condition, rolling stock/twist lock serviceability, and environmental conditions as potential contributing factors to this incident. From this, the ATSB concluded that it is likely that none of these contributed to the incident. Therefore, the ATSB considers it reasonable to conclude that:
It is likely that container MGCU7810161 was not secured to the two trailing twist locks of wagon PQQY50015 correctly at Bromelton.
It was almost certain that the departing train examination at Bromelton did not detect the partially unsecured container MGCU7810161.
Maitland Railway Station infrastructure
On 16 January 2018, container MGCU7810161 had shifted laterally on wagon PQQY50015 by approximately 150 mm, exceeding the permissible ARTC static rolling stock outline for that rail corridor. The ATSB found that the reduction in structure clearances due to the raised track height (relative to the documented design for platform 1), combined with the out-of-gauge container on wagon PQQY50015, contributed to the collision with the Maitland Railway Station verandah. (Figure 10).
Figure 10: ARTC rolling stock clearance outline in respect to Platform 1 at Maitland Railway Station, with container load shifted towards station verandah
The image depicts the dimensions of the rolling stock, with an estimated amount of load shift based on witness observations. Note that the magnified portion of graphic shows the container infringing on the ARTC Rolling Stock Outline, and station verandah infringing on the ARTC Kinematic Rolling Stock Outline.
Source: ATSB.
The horizontal and vertical clearances of the track at Maitland were inspected yearly to ensure compliance with limits. However, although the vertical clearances had reduced over the years, it had not been recognised that they had exceeded both the ARTC management of clearance specification, and the platform 1 design measurements.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
It is likely that container MGCU7810161 was not secured to the two trailing twist locks of wagon PQQY50015 correctly prior to its departure from Bromelton, Queensland.
SCT had not documented its process for loading checks expected from SCT loading operations staff when securing containers to wagons.
It was almost certain that the departing train examination at Bromelton, Queensland did not detect any partially unsecured containers on train 2BM9.
The reduction in structure clearances due to the raised track height, combined with the out-of-gauge container on wagon PQQY50015, contributed to the collision with the Maitland Railway Station verandah.
The increased track height and consequential infringement on both the ARTC management of clearance specification, and the platform 1 design measurements at Maitland Railway Station, was not identified and corrected by ARTC.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
SCT Logistics
As a result of this incident, SCT has advised the ATSB that it is taking the following safety actions:
SCT published a National Safety Alert advising terminal staff of the SCT protection process to be employed when checking that containers are correctly secured to rail wagons.
SCT counselled the loader operator involved in loading train 2BM9 and arranged for further training.
SCT consulted with loading, shunting, and train examination personnel in the development of a documented procedure to describe SCT expectations in relation to inspections and checks that are to be undertaken when loading containers on to rail wagons.
Australian Rail Track Corporation
As a result of this incident, ARTC has advised the ATSB that it is taking the following safety actions:
ARTC have communicated to all ARTC teams that no further work is to occur at Maitland Railway Station which will impact on track geometry.
ARTC has installed new physical plaques at Maitland Railway Station and amended track design documentation to indicate that track height must not be raised at this location.
ARTC has undertaken a detailed survey of the clearance at platform 1, Maitland Railway Station.
ARTC has committed to lowering the track height through Maitland Railway Station back to the design levels. An interim 20 km/hour speed restriction will apply for coal and freight traffic until this work is completed.
Safety message
Rail infrastructure managers and maintainers must satisfy themselves that maintenance activities and subsequent infrastructure clearance inspection results are properly analysed against design specifications, and that appropriate corrective action is taken when infrastructure clearance inspection measurements exceed design specifications.
Rail operators should satisfy themselves that the human reliant risk controls for ensuring that loads are secured have been documented, communicated and understood by workers required to implement them.
Rail safety workers involved in the loading and examination of train services are reminded of their responsibilities for ensuring loads are secured to their respective wagons before the transit of trains.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
In the evening of 17 January 2018, a Professional Helicopter Services Robinson R44 helicopter, registered VH-HGX, departed the Yulara Town helipad, Northern Territory, for a 15-minute scenic flight with the pilot and three passengers onboard. Shortly after take-off, the rotor RPM began to decay and the low rotor RPM warning activated. The rotor RPM continued to decay to a level from which the pilot could not recover. The pilot attempted a forced landing, but was unable to arrest the rate of descent, resulting in a hard landing. The pilot and two passengers were seriously injured, and the remaining passenger experienced minor injuries. The helicopter was substantially damaged.
What the ATSB found
The ATSB found that the take-off was conducted at a high density altitude[1] at near maximum weight. Therefore, a high engine manifold pressure (MAP) would be expected for the take-off. However, passenger video evidence indicated the rotor RPM (revolutions per minute) decay started at a relatively low MAP, and that the MAP increased slowly as the RPM steadily decayed. The ATSB found that the engine was producing the published rated take‑off power earlier on the day of the accident and that the pilot had flown the same departure with a full load of passengers on three previous flights. The rotor RPM decay was consistent with the low observed MAP. As such, the ATSB concluded the helicopter's rotor RPM steadily decayed due to a likely limited opening of the engine throttle during take-off. Fine-tuning of the engine throttle is controlled automatically by the engine governor, but it can be manually overridden by the pilot. The reason for the limited opening of the throttle could not be determined.
Following activation of the low rotor RPM warning, the pilot initially did not apply full throttle (for at least 5 seconds), and the helicopter maintained a positive rate of climb. At the time, the pilot was conducting the departure procedure low over the tree tops with an early left turn, which required visual attention outside of the helicopter for the majority of time. As a result, it was likely that the pilot had no spare attentional capacity at this time to immediately comprehend and respond to the deteriorating situation. In consideration of the potential power margin available at the time, if the pilot had applied full throttle in the first 5 seconds, and then lowered the collective lever sufficiently to prevent the helicopter from climbing, the low rotor RPM was likely recoverable.
The helicopter continued flight for about another 90 seconds, during which it climbed to about 200 ft at a low airspeed. This resulted in the rotor RPM decaying further to a level from which the pilot could not recover (likely below 80 per cent).
The ATSB further established that the pilot had inadvertently adopted a practice of conducting the rotors running turn-around (for passenger transfers) with the governor switched off. This was not in accordance with the Robinson Helicopter Company R44 checklist requirement for the governor to remain on from start until shut-down, nor the operator’s procedure for the governor to be selected on for the engine run-up. Although the pilot reported that the governor was selected on and checked before lift-off, this practice increased the risk of an inoperative governor not being detected before take-off.
The operator used individual passenger weights for their loading calculations, which was considered best practice. However, it was found that the operator’s passenger scales were not calibrated and were under‑reading the actual occupant weights. This resulted in the helicopter operating at a higher weight than planned, but less than the maximum weight. While the operating weight was within the published limits, the under-reading scales increased the risk of their helicopters not achieving their take-off performance.
The ATSB also found that the Robinson Helicopter Company’s R44 pilot operating handbook emergency procedure for low rotor RPM recovery did not include reference to the minimum power airspeed. Knowledge of this as a subsequent consideration to the immediate actions could assist pilots in the recovery from this safety-critical condition.
What has been done as a result
The operator temporarily suspended their tourist flights at their Uluru Base (including the Yulara Town helipad). Their chief pilot then conducted check flights with the local base pilots to ensure they could safely resume operations. In addition, the operator completed an audit of the helipad and updated their helicopter landing site register in accordance with the latest recommendations from the Civil Aviation Safety Authority (2014), and introduced a calibration schedule for their passenger scales.
The ATSB have issued a safety recommendation to the Robinson Helicopter Company to review the R44 pilot's operating handbook low rotor RPM recovery procedure for consideration to include a reference to the minimum power airspeed (Vy) for pilot awareness. Robinson reported that this will be reviewed by their engineering staff for possible revision to the pilot operating handbook.
Safety message
The intent behind checklist actions is not always apparent when learning procedures. Pilots should ensure they understand the purpose behind all checklist items, and if any doubt exists, seek clarification to reduce the likelihood of misunderstanding the requirements.
Low rotor RPM may develop in various flight conditions, but it is the low airspeed-low height condition, which is most likely to result in an accident. Helicopter pilots should ensure they are familiar with the power curve, the associated airspeeds for their particular helicopter, and be prepared to respond immediately to a low RPM warning.
Robinson Helicopter Company reported that pilots of their piston-engine helicopters should roll on throttle while lowering the collective lever, as per the low RPM recovery procedure, so that the throttle remains open. There is an overtravel spring in the throttle linkage that may, or may not, compress during the recovery. Pilots should not be concerned if the spring is, or is not, compressed, they should continue to roll the throttle on and lower the collective lever until the RPM is recovered.
In addition, the Robinson Helicopter Company website provides training videos for higher risk flight conditions that have resulted in fatal accidents. They include several presentations on energy management, tailored specifically for Robinson helicopter pilots, which could be beneficial to pilots during their initial training, upgrades and flight reviews.
On 17 January 2018, at about 1828 Central Standard Time,[2] a Professional Helicopter Services Robinson R44, registered VH-HGX, sustained a rotor revolutions per minute (RPM) decay on take-off from Yulara Town helipad, Northern Territory (NT), resulting in a hard landing about 0.63 km south of the helipad (5 km south of Ayers Rock Airport, NT) at about 1830.
Background
In the month of January 2018, the accident pilot became aware of an upcoming large charter group visit (115 people). The flights were scheduled to be from the operator’s Uluru Base[3] Yulara Town helipad. On 17 January, the pilot started the day with ground duties until lunchtime. Ground duties included passenger safety briefings and bus driving. At 1300, the area manager and deputy area manager held a meeting with staff to brief them on the charter group operation, which was scheduled to start at 1500. The staff briefing included the passenger manifest and scenic route to be flown to separate the helipad departures with arrivals.
After the charter group arrived at 1500, the pilot conducted two short flights in another R44 and then about 40 minutes of ground duties. The pilot then took over VH-HGX from another company pilot, who had been operating the helicopter on scenic flights since about 1000. According to the run sheet, the pilot took one load of three passengers on the scenic flight before flying to Ayers Rock Airport to refuel. The helicopter departed the airport at 1727 with 100 L of fuel. The pilot reported that the fuel loading was predetermined from the staff meeting and believed the helicopter would be within the weight and balance requirements for the passenger manifest.
After returning to the Yulara Town helipad, the pilot took two groups of three passengers on the scenic flight. Ten litres of fuel consumption was recorded for the return flight from the airport and for each of the scenic flights.
Accident flight
At about 1827, the helicopter was loaded with three passengers from the Yulara Town helipad for a planned 15-minute scenic flight, with 70 L of fuel on board. This was the third scenic flight for the pilot in the accident helicopter since the last refuel earlier that afternoon. After the passengers boarded, the pilot accelerated the engine and rotor RPM from idle to 90 per cent, conducted a low RPM warning horn check (90 to 98 per cent RPM), selected the governor on (extinguishes the governor off light), and checked the engine and rotor indications were stable.
The pilot reported conducting a confined area[4] take-off[5] profile to clear some low trees in the departure path, which provided a headwind component for the departure. Passenger phone footage and helicopter tracking data indicated lift-off from the helipad was at about 1828. The departure consisted of the helicopter climbing about 17 ft vertically before the pilot applied forward cyclic[6] about 5 seconds after lift-off to accelerate forwards for take-off while continuing to climb. Helipad surveillance camera and passenger phone cameras recorded the departure of the helicopter. The pilot reportedly checked the instruments were in the ‘green’ (normal operating range) in the hover prior to take-off, and the passenger videos indicated the ‘governor off’ light was extinguished for the departure.
About 3 seconds after take-off, and just prior to passing overhead the first trees in the departure path, the helicopter’s low rotor RPM warning horn and caution light activated (Figure 1). This indicated that the rotor RPM had decayed from 101–102 per cent (normal operation) to 97 per cent. The engine and rotor RPMs were matched and decreasing. The engine manifold pressure (MAP) was at 22.5 in Hg[7] and the airspeed at 25 kt; both were increasing. Based on estimates from a combination of the helipad surveillance video and passenger video of the flight instruments, the low rotor RPM warning occurred at approximately 37 ft above ground level (20 ft climb above take-off height).
Figure 1: Activation of low rotor RPM warning
Source: Passenger, annotated by the ATSB
The helicopter continued to climb and increase forward airspeed, and the rotor RPM decayed to 90 per cent. A left turn was commenced shortly after take-off to avoid a no-overfly zone (Yulara Resort and Township) and join the scenic flight traffic pattern. During the left turn, the airspeed reached a maximum of about 38 kt before the helicopter pitched up slightly, resulting in a decay in airspeed as the helicopter continued to climb.
About 15 seconds after take-off, the engine and rotor RPM had decayed to 80 per cent, with a MAP of 26 in Hg, airspeed of 33 kt, height of about 87 ft above ground and vertical speed of 300 ft/min (Figure 2).[8] The onset of vibrations became noticeable in the final seconds of the passenger video of the departure, which ended about 17 seconds after take-off. The helicopter continued to turn left onto a southerly track, instead of following the planned scenic flight departure pattern to the west.
Figure 2: Rotor RPM decay
Source: Passenger, annotated by the ATSB
The pilot initially reported that they applied full throttle in response to the low RPM warning horn, and that there was ‘not enough height to do much else’. This initial recollection was associated with the warning activating at a height of 300 ft, after the left turn, with 22–23 in Hg MAP. In response to the draft report, the pilot submitted that they had been taught to ‘open throttle and lower the collective’ in response to the low RPM warning, and that is what they would have done regardless of the height. Helipad footage indicated the helicopter was at a height of about 200 ft when it was abeam the helipad and in relatively level flight until it passed out of the camera view 42 seconds after take-off.
About 91 seconds after take-off, the pilot broadcast an emergency radio call ‘going down’. The deputy area manager immediately responded with a radio call to the pilot to ‘put it [helicopter] into wind’, and the pilot attempted a forced landing to what appeared to be a clear patch of sand. The pilot was unable to recall any other actions, but that there was a ‘couple of kicks’ of the helicopter just prior to the final descent. The front left seat passenger reported that the helicopter was climbing and descending during the flight, and then a ‘big shudder’. Both rear seat passengers reported that the helicopter started shaking from side to side (vibrations) at about 15 seconds after take-off and that the intensity of the shaking increased from moderate to extreme until the final descent.
During the descent, the rotor RPM was too low for the pilot to be able to arrest the helicopter’s rate of descent to a safe vertical speed, resulting in a hard landing. The landing area was a small knoll with a steep bank, which resulted in the helicopter rolling over. The pilot and two passengers were seriously injured, and the remaining passenger experienced minor injuries. The helicopter was substantially damaged.
The rear right seat passenger’s phone camera was activated intermittently in video mode several times during the flight. The low rotor RPM warning was audible throughout the recordings, which included the ground impact, and was reported by the passenger as sounding continuously throughout the flight. Figure 3 depicts the accident site. Figure 4 depicts the accident flight path, based on tracking data provided by the operator. The flight track was about 1.0 NM (1.85 km) at an average ground speed of about 40 kt.
The pilot held a Commercial Pilot (Helicopter) Licence with about 300 hour’s total flying experience and a Class 1 Aviation Medical Certificate with no restrictions. The pilot’s training was conducted on the Robinson R22 and R44 helicopters with the operator. The pilot was offered a job at the operator’s Uluru Base on completion of training. After passing a company check flight in the R44 on 12 July 2017, the pilot moved to the Uluru Base and started work the same month.
The pilot was initially employed in-command-under-supervision. On 21 September 2017, the pilot was cleared by the operator as pilot in command for passenger flights after successfully completing the operator’s line training for the local airport procedures, helipad procedures, scenic flight patterns, radio procedures and no-fly zones. The pilot had accumulated about 180 hours on the R44 from July 2017 until the accident flight.
72-hour history
The pilot had a couple of rest days prior to starting work at 0930 on 17 January and had been on duty for about 8 hours and 52 minutes at the time of the accident. The pilot had completed six scenic flights, which was about 1 hour and 30 minutes of flight time, plus a return flight to the airport for refuelling (about 5 minutes each direction). When asked about fatigue management, the pilot reported that it was a good work-rest schedule and that it was a comfortable work arrangement. Business was normally performed with a morning and afternoon crew. The morning crew would start at sunrise, if required, and end at 1400 when the afternoon crew would take over. The pilot reported being well rested and fit for duty on the day of the accident.
Helicopter information
General details
The Robinson Helicopter Company (RHC) R44 Raven 1 is a four-seat piston-engine helicopter, powered by a Lycoming O-540-F series six-cylinder carburetted engine. VH-HGX was manufactured in 2000 and registered in Australia in May of the same year. The last 100‑hourly maintenance inspection was completed on 15 January 2018, at which time it had accumulated 3,489.5 airframe hours. That inspection included an engine governor system functional check and cylinder compression check. They were all assessed serviceable.[9] In addition, the engine air filter was ‘replaced for company convenience’.
Engine power and drive
The engine take-off power (TOP) is rated at 260 horsepower (hp) at 2,800 revolutions per minute (RPM), which can be maintained up to a pressure altitude of 800 ft. Maximum continuous power (MCP) of 235 hp can be maintained up to a pressure altitude of 4,000 ft.[10] Robinson provide pilots with the de-rated figures of 225 hp and 205 hp for TOP and MCP respectively at 2,718 RPM. This allows the helicopter to maintain engine performance on a climb from sea level to several thousand feet before the power available will start to decay below their published TOP.
The rotors are driven by the engine with a V-belt drive system and gearboxes. The drive system reduces the engine RPM of 2,718 to the main rotor RPM of 408. The engine and rotor RPM are both presented to the pilot as a percentage on the cockpit tachometer gauges, so that they are matched under normal operating conditions. An engine governor system is installed to provide automatic control of engine RPM, which will control the rotor RPM via the associated drive-train.
Engine throttle control and governor system
RHC reported that there are three ways the engine throttle can be manipulated, via the same mechanical input at the carburettor, as follows:
The correlator: a linkage between the collective lever[11] and the throttle. As the collective is raised, the throttle is opened and as the collective is lowered, the throttle is closed. This performs the majority of the throttle control in-flight. Provided the throttle is already partially open to achieve 102 per cent RPM on the ground, full throttle can be achieved by the correlator.
The governor: an electronic throttle control using a controller unit and motor to fine tune the engine RPM through a friction clutch, which applies a twisting force to the pilot’s throttle grip. The further away from the target speed (102 per cent), the faster the controller will move the throttle to return to the target, but for the most part, it is very small, slow movements.
The pilot: in normal flight the pilot is not required to manipulate the throttle, but more aggressive manoeuvres or demanding environments may require the pilot to make manual adjustments. The governor can be overridden by the pilot gripping the throttle (twist grip located on the end of the collective lever) and turning as needed.
The MAP sensor measures air pressure downstream of the throttle, which is less than atmospheric pressure when the engine is running. The MAP will increase if the throttle is opened, or if the engine RPM decays, or combination of the two.
The engine throttle control is depicted in Figure 5. The engine right magneto (RM) senses engine RPM, which is sent to the governor controller. The governor controller provides the correction signal to the engine throttle via the governor motor, friction clutch and pilot’s twist grip on the collective lever. This provides a closed-loop system to maintain RPM. Figure 5 shows the components in green that were tested during the investigation, the components in yellow are the cockpit gauges and those in blue represent the air intake path.
Figure 5: R44 engine throttle control
Source: ATSB
In Figure 5, the governor switch is represented in the off position, which will illuminate the ‘governor off’ light. The governor switch is located at the end of the collective lever and was not visible in any videos. When the switch is closed (on position) by the pilot, the ‘governor off’ light will extinguish to indicate the controller is receiving electrical power - the light does not provide a fault indication.
If there is a fault with the right magneto points, a faulty signal will be sent to the controller, which will respond accordingly. The engine tachometer in the cockpit receives a signal from the same source as the controller (RM). Therefore, irregular engine RPM indications (erratic movement) will be present if the points are producing a faulty signal. This was not observed on the passenger video or reported by the accident pilot.
The governor controller is active from 79–111 per cent engine RPM. Within the active range there is a 1 per cent wide dead-band from 101.5–102.5 per cent where it will not take action provided the RPM is steady. At 101.5 per cent there is a step change in the controller output voltage, followed by a ramp increase to maximum voltage output at about 97 per cent, which is maintained to the cut-off at 79 per cent. The controller dead-time[12] was not published, but the advice received from RHC was as follows:
From the pilot’s perspective, the output response is typically immediate, but the result may not be. For example, if the throttle is half open and the collective is aggressively raised, causing the RPM to drop, the governor will immediately open the throttle aggressively, but if the load on the engine is greater than power available (at that lower RPM), the RPM will be slow to increase.
Overtravel spring
During the ATSB’s examination of the wreckage (refer to section titled Post-accident tests and inspections), the overtravel spring assembly was found bent (Figure 6), most likely as a result of the ground impact. Robinson reported that, from the overtravel spring to the engine throttle valve, the system can be considered to be a purely mechanical link and extension or compression of the overtravel spring does not occur during normal flight regimes, only at the extremes of throttle travel.
With reference to Figure 6, the arm connected to the collective lever assembly and overtravel spring assembly can move vertically or in rotation. When the collective lever is raised or lowered, it will move vertically to increase or decrease engine throttle. When the pilot rotates the twist grip, or driven by the governor motor, it will rotate to increase or decrease engine throttle.
Figure 6: VH-HGX collective lever assembly and overtravel spring assembly
Source: ATSB
Post-accident tests and inspections
The ATSB did not conduct an on-site visit to inspect the wreckage and impact. However, from the various video recordings, the ATSB and RHC noted the engine operation ‘sounded good’ until the sound of the engine RPM being retarded by the decaying rotor RPM became noticeable.
The pilot who flew the accident helicopter earlier on the day reported that it was achieving the pilot’s operating handbook (POH) published TOP range of 24.2–25.8 in Hg MAP and that the movement of the twist grip could be felt as the governor adjusted the throttle to maintain RPM. In addition, the accident pilot reported that the helicopter was ‘operating correctly’ at take-off. As a result of this information, the ATSB was primarily interested in the helicopter information related to the engine power and RPM control.
Right magneto, light bulb and switch
Following the accident, at the request of the ATSB, the right magneto was removed from the helicopter by the insurance surveyor. An inspection and test of the right magneto and associated wiring was conducted. No fault was found with the right magneto tachometer points used for the engine tachometer and the governor controller, and the magneto tested serviceable. No fault was found with the associated wiring. The ‘governor off’ light bulb and governor switch were later tested and also found to be serviceable, but with the limitation that each item was tested in isolation as the instrument panel was already removed from the airframe.
Governor controller test
Following the inspection of the magneto and wiring, the governor controller was removed and sent to RHC to perform an inspection and functional test of the unit under the supervision of the United States National Transportation Safety Board. There were no indications of tampering or thermal damage, and the unit’s electrical connector was clean and pins straight. A functional test was performed in accordance with the RHC process. The test results were observed to be within specifications and no fault was found.
ATSB post-onsite wreckage examination
Following the serviceability assessment of the governor controller, the ATSB examined the stored wreckage to inspect and test the governor motor, friction clutch and pilot’s throttle twist grip, in accordance with RHC’s procedures. After removal of the damaged surrounding structure, and disconnection of the deformed overtravel spring, the components were found to be in a satisfactory condition to be tested in situ.
Each test was repeated with no fault found and assessed to be serviceable. The ATSB noted the governor motor was capable of rotating the pilot’s twist grip from full closed to full open in about 8 seconds. The friction clutch operated as designed when hand pressure was increased on the twist grip, which provided override of the governor motor and full manual control of the arm in both vertical and rotational movement.
The governor switch was in the off position when the ATSB attended the wreckage. The operator reported a witness at the accident site noted the switch was in the off position, but this was only observed after the occupants had been removed from the wreckage. Therefore, it was possible that the switch was disturbed after impact.
The governor circuit breaker and low RPM light and horn circuit breakers were in. The warning lights’ circuit breaker (includes ‘governor off’ light) was out. However, several other circuit breakers for systems that were observed to be working during the flight were also out, which indicated that some circuit breakers tripped during the accident.
Robinson helicopters have been subject to isolated cases of obstruction to the air induction systems from a deterioration of components, such as air filters. This has resulted in several service defect reports in Australia, including reports of loss of power, and several RHC service bulletins on the subject of air filter deterioration.
The R44 maintenance manual low power troubleshooting checklist included inspecting the air induction system for obstructions. Therefore, the ATSB reviewed post-accident images of the condition of the air filter fitted to VH-HGX. The air filter was found to have been pushed up through the carburettor by the ground impact while the engine was running, resulting in considerable damage to the air filter and the carburettor ingesting sand and debris. As such, the ATSB was unable to determine the condition of the air filter prior to impact.
Engine performance study
According to the R44 POH, the MCP limit was 24.2 in Hg MAP at 2,000 ft pressure altitude and 40 °C (205 hp). An additional 1.6 in Hg can be added to MCP for a 5‑minute TOP rating of 25.8 in Hg MAP (225 hp). Passenger footage of the previous flight revealed the helicopter climbed to about 3,500 ft pressure altitude at 22–23 in Hg MAP, which indicated the engine was producing 187–197 hp at an elevation about 1,700 ft above the helipad. This was consistent with the performance of the engine as reported by the pilot who operated the helicopter earlier on the day of the accident.
The right rear seat passenger’s video provided an uninterrupted view of the cockpit instruments during the first 8 seconds of the departure, which was sufficient time for the MAP to indicate a response from either governor or pilot throttle input. Therefore, the video recording period of t=0 to t=8 was chosen for the engine performance review. The video indicated the low rotor RPM warning started about 3 seconds after take-off (t=3).
Cockpit instrument indications
The cockpit instrument indications for vertical speed (VSI – ft/min), airspeed (ASI - kt), MAP (in Hg) and engine RPM (%) were plotted (Figure 7). The measurements were based on passenger video footage of instrument readings using 1 second time intervals. Therefore, the accuracy of any individual data point should be treated with caution. As the engine and rotor RPM decayed together (within the tolerance of 1 per cent of each other), the rotor RPM trend can be inferred from the engine RPM trend.
The top left graph of Figure 7 shows that the vertical speed reduced after the low rotor RPM warning activated but remained positive (climbing). A number of factors could have accounted for this change, such as a loss of ground effect, increase in forward cyclic or reduced collective setting. The top right graph shows the airspeed steadily increased after it started to provide a reliable indication. The bottom left graph shows the MAP steadily increased and the bottom right graph shows the RPM steadily decreased.
Figure 7: Data plot of instrument indications
Note: The data plots of instrument indications include a red vertical line for the low rotor RPM warning at t=3 seconds. The dashed line at the start of the airspeed indicates unreliable indications.
Source: ATSB
Engine power
Using the RPM, MAP, environmental conditions and the Lycoming O-540-F series performance chart, the ATSB plotted the engine horsepower from t=0 to t=8 seconds (Table 1). The lowest RPM on the chart was 2,500 (93.8 per cent RPM), therefore, the results for t>=6 were based on extrapolated data but considered to provide a reliable trend based on the helicopter’s increasing airspeed and positive rate of climb. As the RPM continued to decay, data points beyond t=8 did not appear to change the trend but resulted in the need for greater extrapolation of the charts, which increased uncertainty in the results obtained. Therefore, these have not been included.
Although engine power is proportional to RPM, it is also proportional to mechanical and volumetric efficiency, which may improve as the RPM decays. This can result in a relationship between power and RPM that is not strictly linear. The engine manufacturer was unable to provide a power (or torque) curve for the engine, so it could not be determined at what RPM the engine power would start to decay, but the ATSB accept that the power available would have reduced at some stage during the departure as the RPM decayed.
The Table 1 figures indicate that MAP and engine power were increasing during take-off, but at a decreasing rate. The engine manufacturer’s fuel consumption charts indicate that the same throttle setting will produce a higher MAP at a lower RPM. Therefore, a MAP equivalent to the MCP throttle setting did not appear to have been achieved in this period. Figure 8 depicts the trend in engine power as a percentage of 205 hp (MCP) and the trend in RPM decay.
Table 1: Engine power
Time (s)
RPM (%)
MAP (in Hg)
Power (hp)
Percent 225 hp
Percent 205 hp
0
2,691 (101)
20.5
164
73
80
1
2,665 (100)
21.0
169
75
82.5
2
2,638 (99)
22.0
180
80
88
3
2,585 (97)
22.5
181
80.5
88.5
4
2,531 (95)
23.0
184
82
90
5
2,531 (95)
23.0
184
82
90
6
2,478 (93)
23.5
187
83
91
7
2,425 (91)
24.0
189
84
92
8
2,398 (90)
24.0
189
84
92
Figure 8: Trend in engine power and RPM
Note: The trend in engine power and RPM includes a red vertical line for the low rotor RPM warning at t=3 seconds.
Source: ATSB
Airflow restriction
The low MAP and power during take-off indicated the engine was producing good suction power but receiving inadequate airflow. Therefore, the limited power output from the engine during take‑off was considered by the ATSB to potentially be the result of a partial obstruction of the intake airflow or restriction of the throttle butterfly valve (stuck throttle), upstream from the MAP sensor. This would produce a low MAP and decay in RPM when the collective lever was raised. However, engine power increased during take-off at the same time that the RPM was decaying, which indicated that the throttle was opening and intake airflow was able to increase. Passenger footage of the helipads revealed they were clean and free of debris, and that the passengers were escorted to and from the helicopters on the pad. This suggested the RPM decay was unlikely to be the result of a foreign object obstruction or stuck throttle.
Overpitching
Overpitching is a phenomena that happens when the collective pitch is increased to a point where the main rotor blade angle of attack creates so much drag that all available engine power cannot maintain or restore normal operation rotor RPM.[13]
There are two commonly understood mishandling techniques, which can result in a pilot overpitching the helicopter during take-off. If a pilot raises the collective lever to a point beyond the full throttle position (where full throttle was required to maintain RPM), then there will be more power required by the rotors than power available from the engine, resulting in a rotor RPM decay. However, during the accident flight, the rotor RPM started to decay when the MAP was below the published MCP rating. There was also an indication that power increased after the decay started. Therefore, a rotor RPM decay as a result of the pilot raising the collective lever beyond the full throttle position was considered very unlikely.
A second mishandling technique involves a pilot raising the collective lever at a rate that is faster than the rate at which the correlator and governor open the throttle, and the pilot does not compensate by adding more throttle. In this case, the rotor RPM may rapidly decay to a level that is too low for the engine power available to recover. According to RHC, the further away from the target RPM, the faster the governor will move the throttle, and for the R44, the engine power response to a throttle input is almost instantaneous. Therefore, as the engine RPM decays the throttle setting should increase and provide a corresponding increase in the MAP as the governor attempts to recover the engine RPM.
The rotor RPM decayed at a relatively steady rate of 11 per cent over 8 seconds. During this period, the MAP did not increase to a value representative of full throttle. Therefore, the decay in RPM as a result of the pilot raising the collective lever at a rate faster than the governor could immediately respond to, was considered unlikely.
Summary
The instrument indications, and subsequent plots of power and throttle, were consistent with the pilot raising the collective lever during the initial climb and acceleration phase of the take-off. This indicated there was mechanical continuity between the collective lever and the engine throttle. In addition, the engine run-up from idle prior to lift-off indicated there was mechanical continuity from the pilot’s twist grip to the engine throttle.
As the helicopter was operating at near maximum all-up-weight and a high density altitude environment, a high collective lever setting, requiring a high engine power, would have been expected for this phase of flight. Therefore, it was concluded that, as the power required by the rotors increased during take-off, the engine throttle position did not increase by a corresponding amount to produce sufficient power to maintain RPM. In addition, there was no MAP indication of a corrective input to the throttle, equivalent to MCP–TOP, in response to the RPM decay in the initial 8 seconds of the video.
Operational information
Yulara Town helipad
The Yulara Town helipad was part of the operator’s Uluru Base, which included scenic flight operations from Kings Canyon and a maintenance facility at Ayer’s Rock Airport. The Uluru operations were managed by an area manager and deputy area manager. The Yulara Town helipad comprised two concrete pads and a building located on the west side of the Yulara Resort facility. In support of the operation, the operator published local ‘PHS Town Helipad Procedures’. The local procedures included housekeeping, general safety and operational rules, flight procedures and record keeping.
Oversight
The operator’s senior management reported that their oversight of the Uluru Base included regular phone calls with the area manager and deputy area manager, and site visits. The site visits included conducting company check and training flights, and holding staff meetings.
In the 2017 calendar year, the chief pilot visited the base for pilot training, supervision and staff meetings in April, May, August and September. The general manager operations visited the base in April, May, July and August. In addition to the visits made by senior management, the operator reported there were multiple visits by their instructors throughout the year for training and check flights to ensure standardisation against company procedures.
Charter group weights
On the day of the accident, the area manager was involved in the flying activities for the afternoon charter group and the deputy area manager was responsible for managing the ground operations. Prior to the activity day, the operator sent the charter group organiser a blank manifest for them to fill in the names and weights of the passengers. This was returned to them with names only and no weights recorded. Therefore, when the passengers arrived at the helipad on the day, they were individually weighed using the operator’s scales.
After weighing, the passengers were divided into groups and allocated to helicopters on the manifest in a manner to ensure the maximum weight limits were not exceeded. The operator used one Aerospatiale AS350 helicopter and three R44 helicopters for the operation. The practice of weighing individual passengers for a flight was in accordance with best practice for aircraft with small seating capacities, rather than using standard weights.[14] However, at the time of the accident, the operator’s passenger scales were not subject to a calibration schedule.[15]
The passengers on board the accident helicopter and on other flights reported that the scales under-recorded their weights. Personal reports of weights indicated an error of 6–9 per cent, and hospital records indicated an error of 11.8–12.2 per cent for the pilot and one passenger. The overall error for the occupants on the accident flight was an under-estimation of 9.6 per cent.
Running turn-around procedure
The passenger boarding and disembarkation from the helicopters was conducted as a running turn-around (RTR) procedure. There is no RTR procedure in the normal procedures section of the POH, therefore the operator developed their own procedure. According to the operator, the RTR procedure was for the pilot to run the engine down to idle and turn off the governor prior to passenger disembarkation. After passenger boarding, the pilot should turn on the governor and run the engine and rotors up to 102 per cent RPM. There was no requirement during the RTR to check the low rotor RPM warning.
Turning the governor on before running the engine up from idle during the RTR was consistent with the RHC R44 ‘starting engine and run-up’ checklist. The operation of the governor can be checked by allowing it to accelerate the engine from 79 to 102 per cent. Robinson reported that ‘the pilot should ensure the governor is operating properly when rolling the throttle open during the start-up checks’.
During the RTR, the accident pilot would run the engine down to idle and turn off the governor for the passenger disembarkation. However, after passenger boarding the pilot would run the engine up manually, with the governor off, check the operation of the low rotor RPM warning from 90 to 98 per cent RPM, then turn the governor on, make a radio call, and check indications were in the ‘green’[16] in the hover after lift-off.
Passenger phone footage of the pilot’s previous flight RTR revealed the low rotor RPM warning check was being conducted with the governor off, consistent with the pilot’s reported practice. The pilot submitted that they were trained to check the governor was on and working before take-off, and that they were confident this was done after the low rotor RPM horn check. The passenger footage of the accident flight departure indicated the ‘governor off’ light was extinguished, which would have provided a visual indication to the pilot that the governor was selected on.
The Civil Aviation Safety Authority (CASA) reported that this practice was not in accordance with the POH procedures, which indicated that the governor should be on prior to engine start and remain on until shut-down. Robinson safety notice 36, issued in 2000, required ensuring the governor was selected on before increasing RPM above 80 per cent. The Civil Aviation Safety Authority also reported that if the ‘governor off’ light globe had extinguished without the governor being selected on, the pilot may not have been alerted to the possibility that the governor was off.
Take-off procedures
The operator had published normal (in-ground-effect[17] - IGE) and confined area (out-of-ground-effect - OGE) take-off procedures in their operations manual. In addition, they had published a local departure procedure for the Yulara Town helipad, which required their pilots to avoid overflying the Yulara Resort on departure and approach. The operator’s take-off procedures were as follows:
Normal take-off profile:
Adopt a 3 foot hover at take-off RPM and note the power being used. For passenger carrying charter operations the power margin[18]MUST BE sufficient to ensure there is no height loss during the initial take-off phase. Conduct the pre take off checks. Lower the nose slightly and wait for the helicopter to move. As the speed builds up, keep gradually lowering the nose until you get an accelerating attitude that is NOT excessive. This ensures that you are in the best possible configuration to handle an engine failure during this phase of take-off.
As you pass effective translational lift[19] (ETL) speed maintain the selected attitude and raise the collective slightly to commence climbing. Don’t use excessive power prior to reaching the BROC [best rate of climb] speed, as this is the most critical part of the take-off. This ensures that you remain outside the height/velocity curve [avoid area].[20]
Confined area / Steep (when obstacles preclude the use of a normal take-off profile):
Before lifting off, check for obstructions around the helicopter and plan to make maximum use of the available space for take-off. Before commencing the take-off, check for overhanging trees ABOVE THE HELICOPTER and ALONG THE TAKE-OFF PATH. For passenger carrying charter operations, there MUST BE sufficient power to maintain an OGE hover before commencing the take-off.
Commence a vertical climb and check the RPM and power before moving forward. If these parameters are not acceptable, descend vertically back to the pre take-off position and re-assess the situation. Aim to clear the obstacles by a minimum of 15 ft. Do not climb higher than necessary to achieve this.
The normal take-off profile allowed the helicopter to accelerate forward at a height of typically less than one rotor diameter until it reached its best rate of climb speed before initiating a positive rate of climb. The confined area take-off required the helicopter to climb vertically and initiate the take‑off from a height greater than one rotor diameter, and therefore the helicopter required OGE performance. The operator reported that their confined area take-off procedure was designed to ensure there is sufficient power available to clear obstacles by 15 ft, while minimising exposure to the avoid area of the height-velocity diagram.
Accident flight take-off
Helipad camera video footage captured the accident helicopter arrive at the far pad (pad 2), and change passenger loads for what would be the accident flight.[21] The footage showed the helicopter lift-off and continue to climb vertically to a height of about half a rotor diameter (16.5 ft)[22] before transitioning into forward flight 5 seconds after lift-off, while continuing to climb. The take-off direction selected by the pilot required the helicopter to clear smaller trees closer to the pad and then larger trees beyond the smaller trees (Figure 9).
Figure 9: Departure path from pad 2
Source: Passenger footage from previous flight
At the start of the passenger video, the helicopter had started to transition forward. The altimeter then indicated a climb of about 20 ft in the 3 seconds from the start of the recording to the activation of the low rotor RPM warning. The airspeed increased from no positive indication to about 25 kt in this period, which was consistent with a take-off into wind. Consequently, it was likely the helicopter had reached a height of about 37 ft, and accelerated through translational lift, when the low rotor RPM activated (Figure 10). The proximity of the trees at the time of the low rotor RPM warning did not permit a safe abort.
Figure 10: Approximate position of the low rotor RPM warning
Source: Operator, annotated by the ATSB
The operator noted that the MAP at the start of the passenger video indicated the helicopter had sufficient power margin for the take-off profile, and that the observed profile complied with their procedural requirement to ‘not climb higher than necessary’.
Helicopter performance
Meteorological information
Ayers Rock Airport is at 1,626 ft in elevation. On the day of the accident at 1830, the recorded airport weather was temperature of 38 °C, QNH[23] 1007 hPa and wind of 9 kt from 080° (the pilot reported the helipad windsock indicated about 5–10 kt).[24][25] This resulted in a pressure altitude of 1,788 ft and density altitude of 4,936 ft. Based on the Ayers Rock Airport weather and helicopter tracking data provided by the operator, the ATSB estimated the pilot’s take-off direction included about a 6 kt headwind component and 7 kt cross wind component from the right. However, the increase in airspeed on take-off suggested the local wind above tree height might have been stronger.
Take-off weights, profiles and power
The helicopter’s published maximum weight was 1,089 kg. The planned weight for the flight (group 9) was 1,046 kg.[26] Using the actual weights provided by the passengers following the accident and hospital records for the pilot and right rear seat passenger, the ATSB calculated the take-off weight was about 1,080 kg.[27] The two previous flights for VH-HGX were at the planned weights of 1,038 kg (80 L fuel – group 8) and 1,073 kg (90 L fuel – group 7) respectively. Applying the error from the accident flight to the occupants of the two previous flights produced estimated weights of 1,067 kg and 1,105 kg, 22 kg below and 16 kg above the maximum weight of the helicopter.
The accident flight take-off weight was within the helicopter’s published weight for an IGE take-off, but it exceeded the weight for an OGE take-off, which was about 1,025 kg. The deputy area manager reported that the traffic pattern for the flights permitted either an IGE or OGE take-off option, noting the OGE was more into wind. He also commented that the accident flight departure looked similar to the pilot’s previous departures, and that none of the pilots had provided a reduced operating weight for OGE performance.
It was initially unclear to the ATSB why the pilot reported following the procedure for the confined area take-off, but had not provided a reduced OGE operating weight. The operator explained that the OGE chart is used for a flight planned to a confined area to ensure there will be an adequate power margin for the arrival and departure. The Yulara Town helipad was not a confined area and there was no requirement to use the OGE chart. In addition, the operator had recommended that a confined area take-off could be conducted/continued if the IGE MAP during the hover power check was 2 in Hg below TOP, which the passenger video indicated the accident flight had.
Although the pilot reported following the confined area procedure, the helipad and passenger video indicated the take-off started from IGE and translational lift was likely achieved at, or close to, a height equivalent to OGE. The operator described this as a steep profile, rather than a confined area profile. The Civil Aviation Safety Authority (CASA) reported that there is no strict definition for a confined area and that the avoid area of the height-velocity diagram (used for a steep or OGE take-off) for this category of operation is a recommendation and not mandatory.
The Civil Aviation Safety Amendment (Part 133 – Australian air transport operations – rotorcraft) Regulations 2018 are scheduled to commence in December 2021. They will see the introduction of performance class operations, which CASA reported will provide greater regulatory effect to the avoid area in the height-velocity diagram and take-off weight performance criteria, similar to the current standards for this type of operation in the United States[28] and Europe.[29]
Low rotor RPM recovery procedure
Immediate actions
According to the R44 POH, the recommended procedure to recover from a low rotor RPM warning condition (warning horn and caution light) was as follows:
To restore RPM, immediately roll throttle on, lower collective and, in forward flight, apply aft cyclic.
Lowering the collective lever will reduce the power required by the rotors to aid the recovery of rotor RPM. However, in the R44 helicopter the correlator will decrease the throttle when the collective is lowered and reduce engine power unless the pilot rotates the twist grip to roll throttle on. This is a standard response, irrespective of the operational state of the governor system, because the pilot can apply throttle faster than the governor.
The operator reported that if the collective lever is lowered in an attempt to recover RPM in the R44 Raven 1 with the throttle already fully open, then the pilot must hold the twist grip open against overtravel spring pressure to keep the engine throttle fully open and prevent a loss of engine power during the recovery.
Robinson reported that if the throttle is fully open and the collective is lowered, the correlator linkage will decrease the throttle accordingly. If the pilot rolls on throttle while lowering the collective, as per the procedure, the throttle will remain open and may, or may not, compress the overtravel spring. Pilots should not be concerned if the spring is compressed or not, they should continue to roll the throttle on and lower the collective until the RPM is recovered.
A pilot may not necessarily know if the throttle is fully open or not, when the low RPM warning is activated. If the throttle is not fully open and the collective is lowered, followed by the pilot instantly rolling on throttle enough to compress the overtravel spring, an overspeed is probable.
The ATSB and Robinson noted that lowering the collective lever from level flight may result in a descent, and therefore this action may be inappropriate when the helicopter is close to obstacles. However, in the accident flight, the helicopter continued to climb on departure and Robinson indicated that, ‘if the pilot performed the recovery procedure, reducing collective just enough to stop the ascent [climb] and acceleration, the RPM would most likely have recovered and increased immediately’.
Minimum power airspeed (Vy)
The minimum power airspeed (Vy) for the R44 is 55 kt. This will provide the greatest power margin in‑flight (lowest collective lever position to maintain airspeed and altitude), and correspondingly the best rate of climb (maximum excess power). However, there was no reference to this airspeed in the POH low rotor RPM recovery procedure. Robinson reported the reason for this as follows:
The recovery procedure is designed for immediate correction of low RPM, it would be the pilot’s responsibility to determine the best course of action to prevent a recurrence depending on the circumstances. The power margin would be a consideration.
With respect to airspeed and the immediate actions for low rotor RPM recovery, CASA reported the following:
Aft cyclic should only be applied with substantial forward speed. When at slower speeds, which is when low rotor RPM is dangerous, forward cyclic should be applied very gently to gain airspeed.
The ATSB discussed low rotor RPM recovery with one of the operator’s Robinson helicopter flight instructors who had viewed the passenger video footage. The instructor noted from the footage that the MAP appeared to be low for the departure and that, after initially increasing airspeed, the helicopter pitched up in the turn and the airspeed decayed. Consequently, the helicopter remained on the ‘back-end of the power curve’.
The instructor suggested that the recovery technique, while departing over obstacles where there is no suitable landing, should be to ‘apply full throttle, get speed on and reduce the collective to reduce pitch as speed increases… [to attain the] bottom of the power curve’. This will increase the power margin to facilitate RPM recovery. The instructor reported that the techniques for RPM recovery are taught and assessed in the ‘governor malfunctions’ element of the operator’s pilot training syllabus.
The pilot who flew the accident helicopter earlier in the day reported that they were taught to increase throttle and lower the collective lever to regain rotor RPM. Following the accident the pilot ‘learned…some [pilots] would increase airspeed to gain lift to overcome RPM droop [decay]’. The ATSB reviewed various online training videos for R44 low rotor RPM recovery and noted there were references to 55 kt as a target speed during the recovery, but that recovery would occur as soon as there was a sufficient power margin available.
Robinson have produced a series of instructional videos to support the training of R22 and R44 pilots in several subject areas, which are associated with high risk flight conditions. They include the following:
These videos are publicly available from their company website.[31] In their training video: Energy Management, RHC reported that the three forms of energy available to a pilot are rotor RPM, airspeed and height. The minimum power airspeed is highlighted as providing the greatest power margin. The ‘back side’ of the power curve is described as the situation where the helicopter will require more power to fly slower, which makes it an unstable region for power and airspeed. They reported that one of the most common causes of helicopter accidents is the situation where the pilot allows the rotor RPM and airspeed to decay.
Figure 11 depicts a generic power curve for a helicopter in stable level flight. As airspeed increases, the power required to produce lift reduces, and the power to overcome fuselage drag increases, producing a bucket-like curve. A reduction in engine power and/or increase in weight will reduce the power margin available. At low airspeeds, a combination of high weight, high density altitude and low RPM could result in the power required becoming greater than the power available. To recover rotor RPM, a positive power margin is required. That is, the power produced (normally limited by the power available) must exceed the power required.
Figure 11: Generic power curve for stable level flight
Source: ATSB
To accelerate the helicopter in level flight, the pilot applies forward cyclic control, which tilts the main rotor disc forward. This increases the power required, which is why CASA advise to apply forward cyclic ‘very gently’ if at slower airspeeds. Hence, any loss of airspeed below Vy will result not only in an increase in the power required for level flight, but also a further increase in the power required if an attempt is made to accelerate to regain Vy.
The flight envelope power requirements for many light helicopters, such as the R44, are not published. However, RHC reported that the Vy power requirement would be approximately 60 per cent of the zero airspeed (OGE hover) power. The ATSB applied a correction for half a rotor diameter height to the accident flight helicopter’s power, taking 164 hp as the hover power prior to the pilot initiating take-off. The correction for ground effect provided an approximate zero airspeed power of 188 hp.[32],[33] This resulted in a Vy power of approximately 113 hp. Therefore, the power produced on departure would have provided a margin of about 76 hp to the power required at Vy.
The R44 POH emergency procedures section includes references to recommended airspeeds for pilots to fly in various emergency situations. They include the autorotation airspeeds for the minimum rate of descent and for the maximum range. The ATSB selected another light helicopter, the Aerospatiale AS350, certified to similar standards as the R44, and reviewed the emergency procedure checklists for evidence of recommended airspeed information. It was noted that there were numerous references to recommended airspeeds to assist a pilot in either their immediate or subsequent emergency procedure recovery actions.
Pilot’s training
The pilot was trained by the operator on a commercial pilot licence (helicopter) course from the period June 2016 to June 2017. In consideration of the pilot’s performance during training, the operator offered the pilot a job at their Uluru Base.
The pilot’s training records indicated that handling governor failures in the R22 was covered in July 2016, for which the instructor recorded ‘good RPM recovery and monitoring’. The ATSB discussed the pilot’s throttle handling with two of the pilot’s instructors. They reported that the technique of a pilot over-riding the governor input with a tight grip on the collective lever twist grip was well known throughout the industry (known as ‘strangling the throttle’). This was a focus point for students at the beginning of their training and was not identified as an ongoing problem for the accident pilot. There was no report of this problem in the pilot’s training records to indicate otherwise.
During the pilot’s company check flight on 12 July 2017 the governor failure sequence and limited power were assessed. The check pilot reported that the pilot’s ‘general flying was excellent’, limited power was ‘very good’ and confined area operations were ‘all ok’, but included a focus point for the pilot to ‘check PWR/RPM [power margin, engine and rotor RPM] before rolling out of a confined [confined area]’.
Calculating IGE and OGE performance was captured in the pilot’s training, which included confined area flying training. However, according to one of the pilot’s line training instructors,[34] it was not specifically assessed during the line training at the Uluru Base, where the pilot was cleared to fly the line on 21 September 2017. The line training sign-off flights for the helipads were conducted without passengers, but with an emphasis on the safest departures and approaches. The pilot’s training report included out-landings, confined area, weight and balance, and flight planning.
A minimum of three take-offs and landings were flown to each pad during the line training. The instructor did not note any problems, which would have prevented a recommendation for the pilot’s release to line, and there was no indication the pilot was ‘strangling the throttle’. The pilot’s grip on the collective lever was not visible in the passenger video of the accident flight take-off, but it was noted that the pilot appeared to hold the cyclic with a light grip in the video of the accident flight and an earlier flight.
Survival factors
The helicopter came to rest inverted with significant damage to the landing gear, airframe and seating. The rear left seat and front left seat passengers were able to exit from the wreckage, but the pilot and rear right seat passenger required assistance to exit from the wreckage. A company AS350 helicopter tracking behind VH-HGX provided first response with the operator’s personnel. On arrival at the accident site, they assisted the remaining occupants to egress from the wreckage.
After the occupants of VH-HGX were removed from the wreckage, the AS350 was used to ferry emergency response personnel and equipment to the accident site. The Yulara Clinic Manager triaged the occupants based on the assessment of the nature of their injuries and administered medical assistance to stabilise them before their evacuation. They were subsequently evacuated to the local medical clinic by helicopter and emergency services vehicles when last light precluded further flights to the accident site.[35]
The iBrace Survivor Questionnaire[36] was completed for the pilot and passengers with the following results:
The pilot, seated in the front right seat, was wearing a 3-point harness and was unable to exit unassisted from the wreckage. The pilot suffered a broken back, spinal cord injury and a wound to the right arm.
The front left seat passenger was wearing a 3-point harness and was able to exit unassisted from the wreckage. The passenger suffered multiple fractures, which included back, ribs, chest, pelvis and heel, and a laceration to the elbow. The passenger did not recall being shown a brace position, and reported that the pilot did not make a ‘brace’ call prior to impact, but did announce ‘we are going down’.
The rear right seat passenger was wearing a 3-point harness, which reportedly broke during the accident. The passenger reported that they were not provided with a ‘brace’ warning prior to impact and that they were unable to exit unassisted from the wreckage. The passenger suffered an eye injury, broken back, spinal cord injury, and fractures to the chest, abdomen and pelvis area, and a deep cut to the ankle.
The rear left seat passenger was wearing a 3-point harness and was able to exit unassisted from the wreckage. The passenger suffered cuts and bruises to the head and face, and bruising and soft tissue injuries to the torso. The last announcement the passenger heard from the pilot was that they were ‘going down’. The passenger braced for impact, but was not shown a brace position and reported that the pilot did not make a ‘brace’ call prior to impact.
The helicopter’s certification standard for emergency landing conditions was based upon providing the occupants with a reasonable chance of escaping serious injury in a minor crash. This was based on the helicopter absorbing the landing loads with an ultimate descent velocity of five feet per second.[37] The damage to the underside of the helicopter (refer Figure 3), suggested that the landing was outside of the certification standard to prevent serious injuries.
Previous occurrences
Governor malfunctions
A review of the CASA service defect reporting system revealed three prior reported incidents of R44 governor malfunctions, dated 26 May 2017, 23 October 2014 and 7 September 2012. No part number information was provided for the report dated 7 September 2012, but the other two reports indicated the governor controllers had the same part number as the accident helicopter, D278-1.
The report dated 23 October 2014 stated: ‘Pilot reported the governor was not functioning correctly. Governor was replaced with serviceable item. AC [aircraft] tested serviceable.’
The report dated 26 May 2017 stated: ‘While in cruise, pilot noticed the main rotor RPM decayed and low rotor horn activated. Pilot maintained RPM by manually opening the throttle and established that the governor controller was u/s [unserviceable]. The helicopter was flown manually on the throttle per the approved flight manual. The Governor controller was replaced with an overhauled item per RHC MM [maintenance manual].’
Low airspeed-low rotor RPM accidents
A review of previous ATSB investigations, which involved low airspeed-low rotor RPM conditions in the R44, was conducted. The review found two fatal accidents involving low experience commercial pilots, operating their helicopters in a high-density altitude environment with a full load of passengers on board.
200600979: A commercial pilot and three passengers were fatally injured while conducting aerial work – survey. The helicopter had insufficient performance to hover or operate at slow speed OGE and collided with terrain following an over-pitching event. The pilot had 327.8 hours total helicopter flight time, which included 143.9 hours in the R44.
AO-2008-062: A commercial pilot and three passengers were fatally injured during a scenic charter flight. The investigation found the helicopter was operated OGE in the hover or at slow speed with marginal performance for the purpose of photography. The pilot had recorded about 477 hours flight time, which included 346 hours in the R44.
Previous related safety issue
In response to the AO-2008-062 accident sequence of events, the ATSB raised, and closed, safety issue AO‑2008-062-SI-01: Robinson-specific training, on 7 July 2010.
Safety issue
There was no Australian requirement for endorsement and recurrent training conducted on Robinson Helicopter Company R22/R44 helicopters to specifically address the preconditions for, recognition of, or recovery from, low main rotor RPM.
Proactive action by the Civil Aviation Safety Authority
The Civil Aviation Safety Authority (CASA) has advised that it will review the requirements for initial pilot training and endorsement and recurrent training on all helicopters. This will include a review of the Helicopter Flight Instructors Manual.
Civil Aviation Safety Authority update to safety issue
The Civil Aviation Safety Authority reported that as a result of the review into helicopter pilot training, they undertook to conduct all flight tests for the initial issue of helicopter instructor ratings and their renewals in an effort to raise the standard of flight training activities. The CASA Helicopter Flight Instructors Manual was amended in 2012 to include a new section 25: Hazards.
A project to develop a Civil Aviation Advisory Publication (CAAP) 5.14-3(0): Helicopter Flight Instructor Training, was started, but not completed due to work commitments to the Civil Aviation Safety Regulations 1998 Part 61: Flight crew licensing - Manual of Standards. The Part 61 Manual of Standards incorporated aeronautical knowledge and practical flight standards to address the risks identified in AO-2008-062-SI-01. The current training standards for the Commercial Pilot Licence (Helicopter) were transferred from the previous licensing scheme to Part 61, including the competency standards from the previous day visual flight rules syllabus to the Part 61 Manual of Standards.
The introduction of Part 61 required pilots of R22 and R44 helicopters to complete initial flight training and a flight review on each type. In addition, it is a condition for pilots operating the R22 or R44 to complete a flight review on either type within the preceding 24 months.
Cockpit image recording equipment
The absence of recording equipment can result in limiting fatal accident investigations to the basic mechanics of the accident, without insight into the operational and human factors. In the event of a non-fatal accident with serious injuries, the physical and psychological trauma may adversely affect the memories of the occupants, resulting in a limited and, or erroneous recollection of events. This severely limits the ability of the investigation to communicate safety lessons to the industry and provide policy makers with informed safety recommendations.
The Robinson family of helicopters, including the R44, do not currently have the option for flight data, cockpit voice or image recorders. However, RHC reported they are in the final phases of getting United States Federal Aviation Administration approval for a cockpit video system and expect to begin deliveries in 2020. There are versions available for all their helicopter models. The system will start recording on helicopter start-up and record video and audio for the entire flight and will capture the final seconds before power is lost.
Robinson are also certifying a new governor for their piston-powered helicopters. The governor has recording capabilities, which include multiple parameters (including rotor RPM) that will be available for maintenance and accident investigation purposes. The new governors will be standard on all R22s and R44s ordered since late January 2020. In addition, RHC is finalising a control position recorder, which will record limited information on cyclic and collective position, rotor and engine RPM, and global positioning system location. Robinson are installing prototype units on their eight company-owned helicopters, which are flown regularly, to collect reliability data before the units are provided to owners. The product is intended to become standard on all models of RHC helicopters.
The Civil Aviation Safety Regulations 1998 Part 133 will introduce the regulatory requirement for flight data and cockpit voice recorders into rotorcraft air transport operations in Australia. However, the requirement will not include light helicopters, and it is this sector of the industry that comprise the vast majority of the ATSB’s fatal helicopter accident investigations. The need to introduce cockpit image recorders has been recognised and advocated by several investigation bodies. These include:
United Kingdom Air Accidents Investigation Branch: Report on the accident to AS332 L2 Super Puma helicopter, G-WNSB on approach to Sumburgh Airport on 23 August 2013. Safety Recommendations 2016-014 and 2016-015 issued to the European Aviation Safety Agency.
New Zealand Transport Accident Investigation Commission: Aviation inquiry AO-2015-002 Mast bump and in-flight break-up, Robinson R44, ZK-IPY, Lochy River, near Queenstown, 19 February 2015. Safety Issue 014/16 issued to the Secretary of Transport.
US National Transportation Safety Board: Loss of control at take-off, Air Methods Corporation Airbus Helicopters AS350 B3e, N390LG, Frisco, Colorado, July 3, 2015. Safety Recommendations A-13-12 and A-13-13 issued to the Federal Aviation Administration.[38]
During the departure from the Yulara Town helipad, Northern Territory, VH-HGX experienced a rotor speed (revolutions per minute - RPM) decay at a point from which the take-off could not be safely aborted. The rotor RPM continued to decay to a level from which the pilot could not recover, resulting in a hard landing when the pilot attempted a forced landing. The pilot and two passengers were seriously injured, and the remaining passenger experienced minor injuries. The helicopter was substantially damaged.
This analysis will discuss the pilot’s running turn-around, the most likely reason for the rotor RPM decay, and the pilot’s response to the low rotor RPM condition. It will further discuss the increased risk to the flight associated with inaccurate passenger scales, an opportunity to improve the helicopter’s emergency procedures for a low rotor RPM recovery, and the benefits and limitations of the recordings.
Running turn-around
The operator reported that the governor would be turned off during the turn-around procedure for transferring passengers, and then selected on for the engine run-up. However, the pilot had adopted a practice of manually running the engine from idle, with the governor turned off, until completion of the low rotor RPM warning check at 98 per cent engine RPM. The ATSB considered that this practice could have inadvertently resulted in the pilot running the engine up into its green operating range (101–102 per cent engine RPM) before the governor was turned on.
The pilot submitted that they were confident the governor was on and working before take-off. However, any movement of either the twist grip throttle or the collective lever by the pilot after engine run-up that produced an RPM response could have been mistaken for a governor response. Therefore, an RPM indication in the green operating range, combined with the ‘governor off’ light extinguished, could have provided a false positive confirmation that the system was operating before take-off.
The extinguished ‘governor off’ light only indicated that the circuit for the light was open. This occurs when the governor switch is selected to the on position to provide electrical power to the controller but will also occur if the light’s circuit breaker trips. It did not provide an indication that the controller was operative. If the governor is not functionally checked from its low RPM operating range to 102 per cent, then a take-off may occur with an undetected problem.
Therefore, the pilot’s practice of engine run-up with the governor off increased the risk of an inoperative governor (either selected off or with a fault) not being detected prior to take-off. Since it was the operator’s procedure to turn the governor off during the running-turn-around, the ATSB considered it likely that the pilot had adopted this practice inadvertently.
Rotor RPM decay
The engine performance study used manifold pressure (MAP), engine RPM, the local environmental conditions and the engine manufacturer’s charts to determine the engine power and throttle movement. The passenger phone footage started at about the time of the take‑off (start of forward flight), at which time the RPM was at about 101 per cent. That review concluded that the engine throttle and power initially increased while the engine and rotor RPMs decayed during the departure.
The take-off was conducted at a high-density altitude at near maximum weight. Therefore, a high MAP would be expected on departure under these conditions. However, the passenger video indicated the RPM started to decay at a relatively low MAP, which increased slowly, as the RPM steadily decayed to 90 per cent over an 8 second time period. The decay continued to 80 per cent over the following 7 seconds.
The engine was operated in the maximum continuous power (MCP) to take-off power (TOP) range on the day of the accident. The pilot had flown the same departure with a full load of passengers on three previous flights (including one at a higher planned operating weight), which indicated it was capable of flying the departure. The decay in RPM at a relatively low MAP indicated that it was likely associated with insufficient airflow to the engine to enable it to produce the power required. Therefore, the ATSB evaluated the evidence against the scenarios of (1) overpitching, (2) air induction obstruction, (3) inoperative governor and (4) throttle mishandling. An inoperative governor or throttle mishandling were considered the most likely scenarios.
The increase in power during take-off indicated the engine was capable of producing more power than it did initially produce and found no evidence of a corrective throttle response from the governor system in the first 8 seconds of the engine and rotor RPM decay. Therefore, an overpitching event, in which the governor system would attempt to recover RPM, was considered unlikely.
The increase in MAP and power during take-off, as the RPM decayed, indicated the engine throttle was not stuck and that there was unlikely to be an obstruction of the air induction system preventing engine power from increasing. Therefore, an obstruction of the engine air induction was also considered unlikely to be the reason for the RPM decay.
Inoperative governor
The engine run-up and increase in power on take-off indicated there was mechanical continuity between the pilot’s controls and the engine throttle. The throttle opening is increased by the correlator when the pilot raises the collective lever and by the governor if it detects the engine RPM is low. Both inputs will result in an increase in MAP and power, but the correlator is an open loop process that does not monitor or manage engine RPM. It is the governor system that provides the closed loop process to correct for excursions in RPM by adjusting the engine throttle. Without a corrective input from the governor, as the pilot introduces control inputs via the collective, cyclic or tail rotor pedals, the engine throttle may not open to a position where the power produced is sufficient for the power required. This may produce an RPM decay at a low MAP, which was consistent with the observed indications.
The rise in MAP from 20.5 to 22.5 in Hg was in the same period that the vertical speed and airspeed increased, which was consistent with the pilot raising the collective lever for take‑off. The RPM decayed during this period from 101 to 97 per cent and engine power increased, which suggested the rise in MAP was a result of the correlator increasing the throttle opening as the pilot raised the collective lever. After the low rotor RPM warning, there was a continued decay in RPM from 97 to 90 per cent in the following 5 seconds, with only a small increase in MAP and engine power. This period provided no indication of a corrective throttle response from the governor in terms of a rise in MAP to a value equivalent to a full throttle setting.
The governor system was tested serviceable at the previous 100‑hour maintenance inspection 2 days before the accident, and it was reported to be working on the day. Robinson (RHC) testing of the governor controller found no fault and ATSB testing of the governor motor, friction clutch and pilot’s twist grip indicated that the governor system should have been capable of producing full throttle within the first 8 seconds.
Although, the ATSB and RHC found no faults with the components that were tested following the accident, the governor system could not be tested in its entirety under the accident conditions due to the damage sustained. Therefore, in consideration of the possibility that the governor operation was not verified before lift-off, the ATSB could not rule-out the possibility of a rotor RPM decay as a result of an inoperative governor.
Throttle mishandling
The pilot can inhibit the governor input to the throttle if the twist grip is held with a firm grip (known as ‘strangling the throttle’). This will provide the same instrument indications (and result) as an inoperative governor. The correlator will still increase and decrease the throttle when the collective lever is raised and lowered, providing a power response, but the pilot’s grip will inhibit corrective input from the governor to the throttle if an RPM excursion (over-speed or under-speed) occurs.
In consideration of the potential for mishandling the throttle, the ATSB reviewed the pilot’s training records and interviewed several of the pilot’s instructors. The phenomena of ‘strangling the throttle’ was well known, but there was no evidence of this problem in the accident pilot’s training records or from interviews. On review of the passenger video footage, the ATSB was unable to sight the pilot’s grip on the collective throttle twist grip, and therefore could not determine what technique was employed on take-off. However, as no individual governor system component was found to be unserviceable during post-accident testing, the ATSB could not rule-out the possibility that the pilot’s grip inhibited the governor input to the throttle.
Low rotor RPM response
The low rotor RPM warning activated when the helicopter was climbing over trees in the departure path. The RHC published low rotor RPM recovery procedure required the pilot to ‘immediately roll throttle on, lower collective and, in forward flight, apply aft cyclic’.
The pilot initially reported that when the low rotor RPM warning activated, they opened the throttle, but ‘could not do much else’. Although the pilot’s recollection was that this occurred at 300 ft, video evidence indicated the helicopter was at about 37 ft, and there was no significant increase in throttle for at least 5 seconds after the warning activated.
In the 5 seconds following activation of the low RPM horn, the MAP had only reached 24.0 in Hg and therefore the throttle position was likely still below the full throttle setting. The collective lever twist grip was found to be serviceable in post-accident testing. The engine run-up before lift-off, and the increase in power on departure indicated there was mechanical continuity from the pilot controls to the engine throttle. Therefore, it was likely that the pilot did not apply full throttle prior to the rotor RPM decaying to 90 per cent, as this action would have resulted in a rapid rise in MAP to a value in the vicinity of 25–26 in Hg.
The pilot later submitted that they would have applied full throttle and lowered the collective lever, irrespective of the height available. In addition, the operator submitted that the simultaneous action of opening the throttle and lowering the collective lever might have produced the observed MAP indications. However, the steady decay in RPM on departure indicated there was no significant change in the difference between power delivered and power required by the rotors.
If the power margin changes, then the RPM rate of decay will also change, reaching zero when the power applied to the rotors is equal to the power required by them. As there was no reduction in the engine power produced (as indicated by MAP) when the RPM decayed from 97–90 per cent during the departure, the steady decay in rotor RPM indicated that there was no significant reduction in the power required by the rotors. This, in combination with the continued climb to about 200 ft, suggested the collective lever was not lowered.
It is possible that during the early stages of the rotor RPM decay the pilot’s attentional resources were consumed with the departure over the treetops, and an early left turn to avoid a no-overfly area. This manoeuvre required the pilot’s visual attention outside of the helicopter for the majority of time. As a result, while the pilot may have perceived the low RPM warning, it was likely that they did not have the spare attentional capacity to immediately comprehend and respond to the warning in the early stages of the decay.
Allowing the helicopter to climb and lose airspeed during the take-off resulted in the power margin decreasing, at a time when the opposite was required. The passenger video of the take-off ended before the helicopter levelled off, and it continued flight for about another 70–80 seconds. This suggested the engine was continuing to produce power. As the rotor RPM had reached 80 per cent at about 87 ft above the ground, and the helicopter was still indicating a climb of 300 ft/min, it was likely that the rotor RPM continued to decay below 80 per cent, resulting in less engine power available for RPM recovery.
The front seat passenger’s report of the helicopter climbing and descending suggested the pilot may have lowered the collective lever in an attempt to recover rotor RPM. This section of the flight was not recorded, and the pilot had no recollection of it, so it could not be determined exactly what was occurring. However, it was likely that there was insufficient height, airspeed and engine power to recover from the low RPM condition that had developed on departure, resulting in the need for a forced landing.
With minimal height available above obstacles at the time the low rotor RPM activated, the optimum flight condition for RPM recovery was full throttle with the lowest collective lever position. For the R44, the lowest collective lever position in level flight is achieved at 55 kt, which would have provided a power margin of about 76 hp to the power produced on departure. In consideration of the potential power margin available, if the pilot had applied full throttle in the first 5 seconds and then lowered the collective lever sufficiently to prevent a climb, the low rotor RPM was likely recoverable.
Hard landing
Tracking of the main rotor blades and balancing of the main rotor system is conducted to minimise in-flight vibrations that occur at the normal operating speed of the main rotor. However, as RPM decays, the rotor blades will lose their rigidity, allowing them to flap up and down with greater amplitude. Excessive flapping of the main rotor blades may result in the blades rotating out‑of‑track and the rotor system operating out‑of‑balance. According to Kroes et al. (2013), incorrect tracking of rotor blades will produce a vertical vibration and an unbalanced main rotor system will produce a lateral vibration.
The development of low frequency vibrations (main rotor vibrations) associated with low RPM, as described by the passengers, may be a precursor to a main rotor blade stall event if corrective action is not taken immediately. Whether or not these vibrations precede a stall is situational dependent – a main rotor blade stall could occur without this warning if the RPM decay is rapid. According to the R44 pilot operating handbook, a main rotor blade stall will either ‘cut off the tailcone’ or the helicopter will ‘just stop flying and fall at an extreme rate’. A video review of other R44 low RPM incidents suggested the vibrations reported by the passengers were consistent with an RPM of 70–80 per cent.
Either due to the lack of identified suitable landing sites, a belief that the low rotor RPM was recoverable, or a combination of the two, the pilot continued to fly the helicopter for about 70–80 seconds after the RPM had decayed to 80 per cent. The continued decay of the RPM below 80 per cent at low height and airspeed meant that recovery was not going to be possible. At the time the pilot made a distress call and selected a forced landing site, the RPM was likely too low for it to be recovered and used to arrest the rate of descent before touchdown, resulting in a hard landing and serious injuries.
Passenger scales
On the day of the accident, the passengers were weighed on arrival at the helipad with the operator’s scales. Their weights were entered into a spreadsheet along with the helicopter empty weight, pilot weight and planned fuel load for each flight.
When the ATSB compared the recorded occupant weights on the accident flight with their actual weights, it was noted that the individual recorded weights for the accident flight were underestimated by about 9.6 per cent.
This discrepancy was also noted for passengers on other flights, in addition to those on the accident flight. Consequently, while the helicopter was likely operating below the maximum weight, it was operating at a higher weight than the planned weight and was potentially overweight on an earlier flight. The under-reading of the passenger scales was likely due to them not having a calibration schedule.
A high weight in favourable environmental conditions could result in a pilot incorrectly assessing the helicopter’s power margin in the hover as adequate for take-off. If unfavourable conditions subsequently develop during take-off, such as a change in the wind conditions, then the observed power margin from the hover could prove to be insufficient to safely continue.
The under-reading scales increased the likelihood that the helicopters would be operated overweight, which could have resulted in the power required being in excess of the power available. This condition increased the risk that the operator’s helicopters would not achieve their expected take-off performance.
Pilot operating handbook
The R44 pilot operating handbook emergency procedure for low rotor RPM recovery required the pilot to ‘immediately roll throttle on, lower collective and, in forward flight, apply aft cyclic’. These factors will maximise the likelihood of the pilot successfully recovering rotor RPM, but are dependent on the energy available, in the form of height or airspeed, to convert to rotor speed.
While these actions are listed in the handbook as immediate actions, lowering the collective lever may not always be practicable, such as low flying over obstacles. Further, the application of aft cyclic to use the forward airspeed as a driving force for the main rotor disc will also decelerate the helicopter. Therefore, the power required will increase if this is performed on the back-end of the power curve. In these situations, there is little energy available in terms of height or airspeed to convert to rotor speed. Consequently, there may be more benefit in allowing the airspeed to gently increase to the minimum power airspeed to reduce the power required for level flight, which will allow the pilot to progressively lower the collective lever and increase the power margin.
The minimum power required airspeed of 55 kt was published in the pilot operating handbook – normal procedures, as the recommended airspeed for maximum rate of climb. It was also included in the emergency procedures section of the handbook for the minimum rate of descent procedure with a power failure, but there was no reference to this airspeed in the low rotor RPM recovery procedure. However, there was reference to 55 kt as a target airspeed to recover from overpitching events in on-line educational videos. This suggested that it was a known and recognised target airspeed within the industry.
The ATSB selected another light helicopter and reviewed the emergency procedure checklists for evidence of advisory airspeed information. It was noted that there were numerous instances throughout the various checklists of advisory airspeeds to assist a pilot in their recovery actions. These included immediate actions and subsequent considerations.
The ATSB noted that the low airspeed-low RPM accidents were often associated with operations at low heights where lowering the collective lever may not be an option. These circumstances may require a variation to the published procedure, such as an overshoot (known as an escape manoeuvre) with full throttle to increase airspeed so that the collective lever can then be lowered to reduce the power required. If a pilot has not been exposed to this in a risk managed training environment, and their response to this scenario is instead based upon rote learning the procedure, they may not have the knowledge and handling skills to apply to the situation.
Therefore, the ATSB considered that the inclusion of the minimum power airspeed as a subsequent consideration to the immediate actions for low rotor RPM recovery could improve the safety-critical information available to pilots. In addition to making less experienced pilots aware of this airspeed, the inclusion of it in the procedure may lead to the promotion of broader discussion and understanding of the power curve, the risks associated with low airspeed-low rotor RPM conditions, and how to adapt the emergency procedure actions to the various scenarios in which it might be encountered.
On-board recordings
In this investigation, it was fortunate that the operator and passengers volunteered video recordings of the accident flight. This enabled the ATSB to focus on the relevant technical and human factors, without expending resources on unnecessary inspections and tests in an attempt to rule-in or rule-out out potential contributing factors. However, several key pieces of evidence from the accident flight, such as the pilot’s grip on the throttle twist grip and attempts to recover rotor RPM, were not recorded. The development of the low rotor RPM condition on take-off was captured by chance alone.
The availability of the helipad and passenger video recordings assisted the investigation in the identification of operational factors that were not all apparent from the various interviews and statements obtained. This enabled the ATSB to focus the safety lessons on the actions needed to reduce the risk of future similar accidents.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the rotor RPM decay and hard landing involving a Robinson R44 helicopter, registered VH-HGX, 5 km south of Ayers Rock Airport, Northern Territory, on 17 January 2018.
Contributing factors
During take-off, the helicopter's rotor RPM steadily decayed due to a likely limited opening of the engine throttle, which resulted in the engine power produced being less than the power required. The reason for the limited opening of the throttle could not be determined.
Following activation of the low rotor RPM warning, the pilot initially did not apply full throttle and lower the collective lever to avoid a climb, which resulted in the rotor RPM decaying further to a level from which the pilot could not recover.
While attempting a forced landing, the rotor RPM decayed to an extent that the pilot was unable to arrest the rate of descent sufficiently to prevent a hard landing, resulting in serious injuries to the occupants.
Other factors that increased risk
The pilot had inadvertently adopted a practice of running the engine up manually with the governor off during passenger transfers, which increased the risk of an inoperative governor not being detected prior to take-off.
Professional Helicopter Services did not have a calibration schedule for their passenger scales, which were under-reading. This increased the risk of their helicopters not achieving their expected take-off performance. [Safety Issue]
The Robinson R44 pilot’s operating handbook low rotor RPM recovery procedure did not include reference to the minimum power airspeed for the helicopter as a consideration, which may assist a pilot to recover from a low rotor RPM condition. [Safety Issue]
Other findings
The passenger and helipad video recordings of the flight provided essential data to understand how the accident developed. However, this investigation would have benefited from flight data recorder or image recorder data to maximise the safety lessons for industry.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Professional Helicopter Services did not have a calibration schedule for their passenger scales, which were under-reading. This increased the risk of their helicopters not achieving their expected take-off performance.
Safety issue description: The Robinson R44 pilot’s operating handbook low rotor RPM recovery procedure did not include reference to the minimum power airspeed for the helicopter as a consideration, which may assist a pilot to recover from a low rotor RPM condition.
The ATSB makes a formal safety recommendation, either during or at the end of an investigation, based on the level of risk associated with a safety issue and the extent of corrective action already undertaken. Rather than being prescriptive about the form of corrective action to be taken, the recommendation focuses on the safety issue of concern. It is a matter for the responsible organisation to assess the costs and benefits of any particular method of addressing a safety issue.
Safety recommendation description: The ATSB recommends that the Robinson Helicopter Company reviews the R44 pilot's operating handbook low rotor RPM recovery procedure for consideration to include a reference to the minimum power airspeed (Vy) for pilot awareness.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Professional Helicopter Services
As a result of this occurrence, Professional Helicopter Services has advised the ATSB that they have taken the following safety actions:
Check flights
They temporarily suspended commercial operations at their Uluru Base in order to enable the chief pilot to conduct several check flights with each pilot before resuming operations.
Helipad procedures
They completed an audit of the Yulara Town helipad and amended the published departure and approach procedures to align with designs recommended, but not mandated, by the Civil Aviation Safety Authority in Civil Aviation Advisory Publication 92-2(2): Guidelines for the establishment and operation of onshore Helicopter Landing Sites.
General details
Pilot details
Licence details:
Commercial Pilot (Helicopter) Licence, issued 20 June 2017
Endorsements:
Gas turbine engine
Ratings:
Single-engine helicopter
Medical certificate:
Class 1, valid to 26 May 2018
Aeronautical experience:
Approximately 300 hours (approximately 180 hours R44)
Last flight review:
12 July 2017
Aircraft details
Manufacturer and model:
Robinson Helicopter Company R44 Astro
Year of manufacture:
2000
Registration:
VH-HGX
Operator:
Professional Helicopter Services
Serial number:
0762
Total Time In Service
3,489.5 (as of last 100 hourly)
Type of operation:
Charter - Passenger
Persons on board:
Crew – 1
Passengers – 3
Injuries:
Crew – 1 (serious)
Passengers – 3 (2 serious; 1 minor)
Damage:
Substantial
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Civil Aviation Safety Authority
Insurance Senior Surveyor
Northern Territory Police
Professional Helicopter Services
witnesses
Robinson Helicopter Company.
References
Australian Transport Safety Bureau 2017. AO-2016-172: Forced landing involving Robinson R44, VH-SJK, 16 km S of Sydney Airport, NSW, on 17 December 2016. Canberra.
Australian Transport Safety Bureau 2010. AO-2008-062: Collision with terrain – 6 km NE Purnululu ALA, Western Australia – 14 September 2008, VH-RIO, Robinson Helicopter Company R44. Canberra.
Australian Transport Safety Bureau 2007. 200600979: Collision with terrain – 10 km west of Gunpowder Mine, Qld – 21 February 2006, VH-HBS, Robinson Helicopter Company R44. Canberra.
Civil Aviation Safety Authority 2015. Advisory Circular 21-35(1.1): Calibration of inspection and test equipment. Canberra.
Civil Aviation Safety Authority 2014. Civil Aviation Advisory Publication 92-2(2): Guidelines for the establishment and operation of onshore Helicopter Landing Sites. Canberra.
Civil Aviation Safety Authority 1990. Civil Aviation Advisory Publication No. 235-1(1): Standard passenger and baggage weights. Civil Aviation Publications Centre. Carlton, Victoria.
Davies JM, Wallace WA, Colton CL & Yoo KI (in press). Two aviation accident investigation questionnaires for passenger & crew survival factors & injuries. Aviation Medicine and Human Performance.
Hayden JS 1976, The effect of the ground on helicopter hover power required, in 32nd AHS Annual Forum, Washington DC, cited in Filippone A 2006, Flight performance of fixed and rotary wing aircraft, American Institute of Aeronautics and Astronautics Inc., USA.
International Civil Aviation Organization 2011, Manual of Aircraft Accident and Incident
Investigation Part III: Investigation, Doc 9756, ICAO, Montréal.
Kroes MJ, Watkins WA, Delp F & Sterkenburg R 2013, Aircraft maintenance and repair, 7th edn, McGraw-Hill, USA.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the operator, pilot, passengers, Civil Aviation Safety Authority, Insurance Senior Surveyor, Northern Territory Police, Robinson Helicopter Company and United States National Transportation Safety Board.
The submissions from those parties were reviewed and were considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
