What happened

At about 1830 Eastern Daylight‑saving Time^[1] on 14 October 2017, the flight crew of a Qantas Airways (Qantas) Boeing 737 boarded the aircraft at Sydney Airport, New South Wales. The aircraft was scheduled to operate a passenger flight to Melbourne, Victoria, with two flight crew, five cabin crew, and 174 passengers.

After boarding, the flight crew found the aircraft had no battery power, as the battery switch had inadvertently been left on. Consequently, another Boeing 737 aircraft, registered VH-VZZ (VZZ) was assigned for the flight. Catering had already been loaded on the originally assigned aircraft so a catering crew (driver and marshaller) were tasked to transfer the catering to VZZ.

At about 1910, a dispatch engineer (engineer) was assigned to the departure of VZZ, which was scheduled for 1930.

At about 1921, the engineer arrived at the aircraft, and received a handover from the other engineer who had been in attendance. The engineers discussed the aircraft status under the aerobridge as it had just started to rain. At this time, the catering vehicle (truck) was loading the forward galley through the right forward main entry door (Figure 1). The pushback vehicle’s (tug) towbar was already connected to the aircraft.

Figure 1: Catering truck loading via the aircraft’s right forward main entry door

Source: Qantas, annotated by the ATSB

At about 1922, the catering crew completed loading the forward galley. They then moved the truck to the right rear main entry door and began loading the rear galley.

The engineer completed his walk around of VZZ and stood under the wing waiting for the catering crew to complete loading. He saw the catering crew close the main entry door and then visually checked that the aircraft door was closed.

The engineer then proceeded towards the front of the aircraft. He put on his headset, which was connected to an external jack point, and contacted the flight crew who confirmed they were ready to depart. As it was still raining, the engineer entered the right side of the tug and sat in its cabin.

Meanwhile, the catering crew retracted the truck’s loading platform and began lowering the truck’s body.

At about 1930, air traffic control cleared VZZ for pushback, and its captain informed the engineer accordingly.

When the aerobridge had been retracted, the engineer leaned out of the tug cabin and completed a visual check of the left forward main entry door.

At 1932:23, the catering truck body had finished lowering and the stabilisers began to raise. The crew exited the truck body.

A few seconds later, the flight crew turned on the aircraft’s anti-collision light.

At 1932:43, the engineer looked left and right from the tug cabin to check for vehicles. He then gave the ‘thumbs up’ signal to the tug driver to commence pushback. When VZZ began reversing, the engineer approved the flight crew to start the right engine. The crew selected the engine start switch and the engine began rotating. The catering truck driver began reversing the truck at this time.

A few seconds later, the catering truck’s marshaller identified that VZZ was moving and tried to alert the truck driver. At the same time, the engineer saw that the catering truck was not clear and ‘yelled’ at the tug driver to stop. The tug driver immediately applied the brakes. The tug stopped but the pins in the towbar sheared and it separated from VZZ (Figure 2).

Figure 2: The catering truck behind the aircraft’s wing when the towbar separated

Source: Qantas, annotated by the ATSB

The flight crew heard a loud ‘bang’ and then saw VZZ moving away from the tug. The catering truck was reversing but still 5-7 m behind the aircraft’s right engine so the engineer asked the flight crew to apply the aircraft’s brakes. The captain applied the brakes as firmly as possible. The aircraft slowed but continued rolling back 3-4 m.

At 1932:53, the aircraft’s right wing collided with the truck (Figure 3) before it came to a stop. The flight crew then engaged the aircraft’s park brake and turned the right engine switch to OFF and the engine wound down as fuel had not been introduced.

Figure 3: Location of catering truck after the collision

Source: Qantas

By 2012, a new towbar was connected to VZZ and it was towed back to the bay. No one was injured in the incident and the passengers disembarked. The aircraft was inspected and found to have substantial damage to its right outboard flaps, wing structure between the flaps and aileron, and the aileron (Figure 4).

Figure 4: Damage to the aircraft’s right wing

Source: Qantas, annotated by the ATSB

Operator’s investigation

An investigation of this incident by Qantas included reconstructing the view of the catering truck from the tug’s location (Figure 5).

Figure 5: View of the catering truck (circled) from the tug in daylight

Source: Qantas, annotated by the ATSB

The investigation also reviewed the engineering dispatch procedures. The procedures stated that the dispatch engineer could conduct the pushback from the tug cabin or walking clear of the aircraft and tug. The procedures included the requirement to confirm that all ground equipment was clear of the aircraft, the aerobridge was retracted, the pushback path was clear and all doors and panels were secured and locked. Once those requirements were met, the engineer could then signal the tug driver to commence the pushback.

The investigation also looked at the sequence and the time usually taken for various ground support operations, such as catering and baggage loading. The baggage belt loader was normally the last ground support equipment to clear the aircraft before pushback, and typically that took less than 30 seconds. A catering truck took longer to move clear (as in this case) but was normally clear before the belt loader.

Safety analysis

The engineer made some checks before signalling the pushback to start. He thought the catering truck was clear but did not visually confirm that it was. In part, the engineer’s assumption that the truck was clear was based on the incorrect expectation that the time required for it to move away would be similar to the short time taken by a baggage belt loader. Additionally, the catering truck was not usually the last equipment to move clear.

There were a number of physical reasons why the engineer did not see the catering truck. He did not have his wet weather gear and, as it was raining, decided to sit in the tug’s cabin for pushback. Seated in the tug, the engineer’s view of the truck was largely obstructed by the aircraft’s wing and a panel door (Figure 5). These obstructions were white, the same colour as the truck and blended with the small, unobstructed parts of the truck. Additionally, these parts blended into white hangars in the background. The trucks lighting and reflective strips were not in view. The dark and rainy conditions with lights reflecting off the wet tarmac also made it difficult to see the truck.

By the time the engineer saw the catering truck a few seconds after pushback started, it was too late to stop it safely. Emergency action was taken but the towbar failed, and the aircraft rolled back and collided with the truck. Other than the truck’s marshaller, no one else was in a position, or had the opportunity, to identify the conflict.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The dispatch engineer assumed that the catering truck was clear and did not visually confirm it was before he cleared VH-VZZ for pushback. In part, this assumption was based on an incorrect expectation of the time required for the truck to move clear.
• The engineer’s view of the truck from the pushback tug’s cabin was largely obstructed by the aircraft. The dark and rainy conditions also made it difficult to see the truck, and the engineer saw it too late to prevent the collision.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas

As a result of this occurrence, Qantas advised the ATSB that it has taken, or proposed, the following safety action:

• Issued a safety information notice to all staff involved in aircraft dispatch activities highlighting the specific visual limitation issues associated with B737 aircraft pushback operations, and the importance of physically ensuring the pushback path is clear.
• Provided relevant training to the dispatch engineer involved in this occurrence.
• The engineering aircraft receipt and dispatch-training package will be revised to highlight the visual limitations and the risks which may be present during aircraft pushback operations.
• Lessons learned from aircraft pushback occurrences will be included in the human factors training program.
• Initiated a trial of cordless headsets to improve visibility during aircraft pushback.
• Conducted an assessment of the risk associated with the engineer sitting inside the tug during aircraft pushback.

Safety message

This accident illustrates the busy and dynamic environment of airport aprons with various visual limitations. While there is currently no substitute for visually confirming a clear pushback path for aircraft, aids to support available visual means in the complex environment can help reduce risk.

The ATSB conducted a study into Ground operations occurrences at Australian airports, which occurred over a 10-year period. Pushback occurrences represented about 26 per cent of the total, and the most frequent ones involved tug connection/disconnection. The report concluded that there were a variety of reasons for the occurrences, but the main theme was communication between the dispatcher, flight crew and pushback tug driver. Communication and a common understanding is vital between involved persons operating in the dynamic environment of an airport apron.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.

Safety summary

What happened

On the night of 28 September 2017, train 9T90 carrying about 1.67 million litres of sulphuric acid in GATX freight tanker wagons, derailed near Kimburra, Queensland. The train crew were initially unaware of the derailment as it had no noticeable effect on the performance of the train. Upon seeing sparks emanating from the derailed wagon, the driver applied the brake to stop the train gradually. The train stopped about 2,028 m from the derailment point. There were no injuries or sulphuric acid spill and the track and rolling stock sustained minor damage. The train was repaired and the rail line was reopened at about 1630 the following day.

On 15 August 2018, a second derailment involving the same type of train, train 9T92, occurred. The ATSB analysed evidence from the second derailment as part of the investigation. Both derailments were found to be the result of axle failure. The failed axles in both instances were of the same type (840P1), being used for the same operation and had similar failure locations on the axle shaft.

What the ATSB found

Detailed metallurgical examination of the failed axle identified that in‑service impact damage to the axle surface created a notch that led to the initiation of a fatigue crack. That crack propagated undetected until it reached a critical size, resulting in an overstress fracture of the axle. Fracture of the axle led to the separation of the axle halves and subsequent derailment of train 9T90.

The ATSB also identified that the fatigue crack existed and was of a detectable size at the time of the previous routine axle inspection. However, anomalies in the inspection procedures likely led to the crack not being identified prior to failure.

Finally, a review of past axle failures and in‑service defects identified that the GATX 840P1 axle was susceptible to fatigue cracking due to relatively minor damage that was not reliably detected prior to failure.

What's been done as a result

The organisation responsible for routine axle inspection advised that it had reviewed the inspection practices in all of its maintenance facilities, and raised awareness across its staff. The ATSB acknowledges the safety action taken to improve the effectiveness of the axle inspection however it was assessed that more could be done to ensure best practice. Consequently, a related safety recommendation was issued to the inspecting organisation.

Safety action was also taken to conduct more regular axle inspections while the axles are gradually replaced with an improved version. The ATSB will continue to monitor occurrences involving the GATX 840P1 axle but believes that, once fully implemented, this safety action will address the safety issue.

Safety message

Axles with undetected fatigue cracks that propagate to failure will usually result in a derailment. Recognising that axles should be resilient to fatigue cracking from in-service damage, effective axle inspection techniques that detect cracking prior to failure are fundamental to rail safety.

The occurrence

On the evening of 28 September 2017, train 9T90 carrying about 1.67 million litres of sulphuric acid in GATX freight tanker wagons, was travelling within Queensland, west from Townsville to Phosphate Hill, on the Great Northern Railway (Figure 1). At 2307 Eastern Standard Time,^[1] the leading wheel set of the trailing bogie of the fourteenth wagon in the consist (OSZY44795) failed and derailed, at a recorded speed of 72 km/h, near Kimburra in the Charters Towers to Pentland section. Evidence of wheel strikes to the track infrastructure were found west from the 216.460 km mark, measured from Townsville. The train crew were initially unaware of the axle failure and derailment as it had no noticeable effect on the performance of the train.

Figure 1: Derailment location

Source: Geoscience Australia, annotated by ATSB.

Consequently, the train travelled about 1,300 m further at up to 75 km/h. At 2308, just after passing the Campaspe River Bridge, the driver looked in the rear vision mirror and saw sparks emanating from the derailed wagon. The driver applied the brake to stop the train gradually. The train stopped at about 2309, about 685 m after brake application (and 2,028 m after the derailment).

At 2310, the driver contacted the network control centre (NCC) in Townsville to report the train had stopped. He also advised that the other driver had exited the locomotive to inspect the train and determine the source of the sparks. A short time later, the driver confirmed to the NCC that an axle on the train had fractured, allowing one wheel set on the fourteenth wagon to derail (Figure 2).

Figure 2: Failed axle in-situ from train 9T90

Source: Incitec Pivot Limited

There were no injuries or sulphuric acid spill. The track and rolling stock sustained minor damage. The train was repaired and the Mount Isa line was reopened at about 1630 the following day.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.

Context

Track information

Queensland Rail (QR) managed the railway where the derailment occurred, with the movement of rail traffic controlled from the QR Control Centre located at Townsville in Queensland.

The narrow gauge (1,067 mm) track at the derailment location consisted of 47 kg/m rail fastened to concrete sleepers by resilient clips with ballast to a nominal design depth of 200 mm. Heading west, approaching the derailment site, the track was largely tangent over undulating terrain.

Track condition

QR inspected the track regularly as part of its maintenance regime and no track anomalies were found that might have contributed to the broken axle.

QR applied a standard formula, known as track condition indices (TCI), to determine the overall condition of the track. The TCI was calculated by adding the condition index values of four track geometry parameters - top, twist, gauge and versine.^[2] The resultant number represents the condition of one length of track. Weighted averages for all TCIs over a line section are known as overall track condition index (OTCI). Figure 3 shows the OTCI for the line between Charters Towers and Pentland. The lower the score, the better the general condition of the track. The figure shows a consistently low index, below the designated maintenance intervention level of 58 (red line).

Figure 3: Charters Towers to Pentland section OTCI

Source: Queensland Rail

The OTCI of the Mount Isa line, (Figure 4) from June 2011 until December 2017 similarly identified that the general condition of the track was below the intervention level.

Figure 4: Mt Isa line OTCI

Source: Queensland Rail

Train and crew information

Train 9T90 was a freight service operated by Australia Eastern Railroad (Aurizon) between Sun Metals Townsville and Phosphate Hill. It consisted of Aurizon locomotives (2832 leading) hauling 52 freight tanker wagons (GATX strings 6, 8, 11, 10). Incitec Pivot Limited (IPL) owned the GATX freight tanker wagons and the consignment. The train was about 730 m in total length and had a mass of about 4296 t. The consignment contained dangerous goods, including about 1.67 million litres of sulphuric acid.

The train was crewed by two drivers. Both drivers commenced work at Townsville at about 0245 on 28 September 2017. They were to take control of train 9T90 at Townsville and drive through to Hughenden (Figure 1), where they would finish their shift. After the incident, the train crew submitted to drug and alcohol testing and returned zero readings.

Rolling stock – locomotives

Aurizon was an accredited Queensland rolling stock operator. It owned and operated the diesel electric locomotives hauling train 9T90. Aurizon was providing a hook and pull service^[3] to IPL for train 9T90 at the time of the derailment.

The locomotive was fitted with Ultra High Frequency (UHF) train control radio and a GPS. The GPS system enabled the monitoring of the locomotive location and speed by the NCO at the QR train control centre in Townsville. The following driver aids were also available:

• station protection device
• vigilance control system
• automatic train protection
• direct traffic control system.

Locomotive 2832 was also fitted with a data logger, which recorded various parameters including:

• time
• GPS position, speed and distance travelled
• throttle position
• driver vigilance
• motor current
• air reservoir/brake cylinder pressures.

There were no anomalies identified in the train speed, handling, or operational performance leading up to the derailment.

Rolling stock – tanker wagons

IPL was an accredited Queensland rolling stock operator and operated the United States‑designed, Australian‑made, GATX tanker wagons.

The tanker fleet comprised 145 wagons, classified as OSZY class wagons. The fleet operated as 11 13-wagon strings plus two spare wagons. A product hose interconnected each tanker wagon within a string. This configuration enabled the stabling of the strings at Phosphate Hill and decanting of product as required.

Each wagon, including the subject wagon OSZY44795, consisted of a tank mounted on two bogies with tare weight 22.26 t, gross weight of 80.66 t, and 12.9 m overall length. Each bogie consisted of two wheel sets. A wheel set was made up of two wheel discs, two roller bearings, and a solid axle shaft. The wheel discs were pressed onto the axle wheel seats and retained by an interference fit. Similarly, the bearings were pressed onto the axle bearing journals and retained by an interference fit.

Axles

The solid steel axles of the GATX fleet, designated as 840P1, are 1,879 mm long with a central barrel tapered from 154 mm in the centre to 170 mm towards the wheel seats, (Figure 5). Other operators also used rolling stock configurations with 840P1 axles.

The 840P1 axles are designed in accordance with Australian Standard AS1448, Carbon steel and carbon-manganese steels—Forgings (ruling section 300 mm maximum). The standard specifies minimum requirements in terms of chemical and mechanical properties of the steel.

Figure 5: 840P1 axle

Source: Incitec Pivot Limited, annotated by ATSB.

Wayside equipment

Wayside equipment was installed at several locations on the occurrence line. The equipment included dragging equipment detectors, overload imbalance load detectors, hot wheel and hot bearing detectors.^[4]

A review of data sourced from those detectors did not reveal a condition with wagon OSZY44795 that contributed to the axle failure, or subsequent derailment.

GATX fleet maintenance

The IPL maintenance program included three levels of periodic wagon inspection:

• Level one – a basic walk-around inspection that occurred at Mount Isa, Phosphate Hill and Townsville
• Level two – An annual visual inspection undertaken at the maintenance facility in Townsville
• Level three – a seven yearly inspection, including reline, undertaken at the maintenance facility in Townsville.

IPL engaged United Group Limited (UGL) to perform certain maintenance on the GATX fleet, which in turn engaged Aurizon for wheel set maintenance.^[5] IPL provided the ATSB with records detailing the inspections undertaken for the previous 12 months. There were no defects noted by IPL that may have contributed to the axle failure.

Wheel sets

In addition to the periodic inspections, IPL had a planned maintenance program for the GATX fleet. This program included procedures for operation and maintenance of wheels sets, axles, and bearings.^[6] In particular, the procedure detailed the operation and maintenance of axles, the relevant section being:

4 Operation and Maintenance - Axles

•  Magnetic particle inspection of axle wheel seats and bearing journals including transition radii shall be performed whenever the wheels are removed from the axle.

•  More frequent visual and ultrasonic inspection shall be carried out if necessary due to service conditions and axle designs.

•  Axle wheel seats found to contain cracks less than 3mm long may be reclaimed by machining. Otherwise, cracked axles shall be scrapped.

•  Visual inspection of the bearing journal fillets for corrosion, dents and cracking shall be performed whenever bearings are removed from the axle.

•  Prior to inspection, axles must be cleaned and particular care should be taken when inspecting the critical zone, 300mm either side of the centreline. Axles grooved or gouged more than 3mm in depth must be condemned. All nicks, scratches or stampings, less than 3mm in depth must be machined or ground to a smooth contour.

Aurizon, the contracted wheelset maintainer, inspected and overhauled the GATX wheel sets at their wheel shop facility in Rockhampton, Queensland. Aurizon used their standards, procedures, and work instructions detailed in the Aurizon Incoming Inspection Work Instruction, in conjunction with IPL requirements, to inspect and overhaul wheel sets.

The Aurizon inspection process required wheel sets to be:

• cleaned
• inspected, measured, tested, and recorded
• components repaired / replaced (if required)
• machined (if required)
• reassembled
• condemned (if required).

Aurizon last inspected and overhauled the failed wheel set on 7 and 8 June 2017. The inspection included ultrasonic and magnetic particle inspection of the axle. During the inspection process, observations were noted on the Wheelset Incoming Inspection Form. The form noted that the axle passed both ultrasonic and magnetic particle inspections. The form also noted that the wheel set had new bearings fitted and both wheel treads machined. The wheel set was certified to re-enter service and subsequently installed under wagon OSZY44795. Wagon OSZY44795 travelled about 32,000 km prior to the axle failure.

Post incident examination

Material failure analysis

Failure analysis of both parts of the wheel set was conducted at the Queensland University of Technology (QUT) Central Analytical Research Facility in Brisbane under the supervision of the ATSB.

That examination identified that the axle fractured about 341 mm and 526 mm from the in-board side of each wheel disc, (Figure 6).

Figure 6: Fracture location on axle barrel

Source: QUT Central Analytical Research Facility.

QUT noted that the fracture surfaces were intact with minimal secondary damage. There was a 70-mm long fine circumferential white line present at the fracture initiation region at a depth of up to about 3 mm (Figure 7).

Figure 7: White paint on fracture surface near origin

Source: QUT Central Analytical Research Facility.

A scanning electron microscope (SEM) with an energy dispersive spectrometer (EDS) was used to determine the elemental composition of the white line. The SEM EDS analysis indicated the white line residue was rich in titanium, a pigment used in white paint. During the magnetic particle inspection process, white paint is applied to the axle barrel.

Both bearings, from the failed axle, appeared to be in a similar condition with their outer races having sustained secondary damage, most likely as the result of axle failure. The raceways and roller surfaces of the bearings displayed minimal operation-related damage. It was therefore considered likely that the condition of the bearings did not contribute to the axle failure.

Examination of the axle fracture surfaces also identified a single, distinct mechanical notch on the surface of the axle from which faint beach^[7] marks originated (Figure 8).

Figure 8: Fatigue origin

Source: QUT Central Analytical Research Facility.

These beach marks indicated propagation of a fatigue crack. The fracture surface was flat and almost perpendicular to the axle barrel’s longitudinal axis. The fatigue fracture face displayed smooth texture indicating fatigue propagation. The fatigue area was relatively large, about 74 per cent of the fracture surface area, penetrating to a critical depth of about 94‑110 mm. Once the crack propagated that far, the remaining section could not support the load and failed rapidly due to overstress.

The mechanical notch measured about 1 mm in length and about 0.2 mm in depth (Figure 9). For this type of axle, the condemning limit is damage extending 3 mm deep or greater. IPL and Aurizon permitted repairs on notches up to 1.5 mm deep in the axle central area, and up to 2 mm deep elsewhere. There was no evidence that the coincident mechanical notch was detected or repaired during the last inspection on 7 June 2017. Although, given the shallow notch depth (0.2 mm), it may have been assessed as not requiring repair.

Figure 9: SEM image showing the initiating notch at the fatigue crack origin

Source: QUT Central Analytical Research Facility.

The microstructure of the axle material appeared banded and consisted predominantly of equiaxed pearlite and ferrite, indicating that it was likely in a normalised condition (correctly manufactured). Manganese sulphide inclusion stringers were observed in the sample. These stringers can contribute to corrosion fatigue, but would have a negligible effect on normal fatigue crack growth.

Non-destructive testing, consistent with the relevant Australian Standards, was conducted on the axle sections. Ultrasonic examination did not detect any major discontinuities within the axle body. Fluorescent magnetic particle inspection found small, isolated inconsequential surface flaws.

Samples taken from the axle were chemically analysed and found to be largely consistent with Australian Standard AS1448/K5.^[8] These results were compared to the manufacturer’s test certificate for axle steel batch used during its manufacture in July 1999 (Table 1).

Table 1: Chemical analysis

(C) Carbon, (Si) Silicon, (Mn) Manganese, (P) Phosphorus, (S) Sulphur, (Ni) Nickel, (Cr) Chromium, (Mo) Molybdenum, (Cu) Copper

The results showed that carbon was slightly low (0.34 per cent rather than 0.37 per cent) and manganese was low (0.38 per cent rather than 0.69 per cent) in the axle sample. The low carbon reading was negligible and likely did not affect the overall mechanical strength of the axle or notch resistance. Similarly, there is no evidence that the low manganese reading affected the mechanical strength of the axle, (Table 2).

Samples from the failed axle were also mechanically tested and found to meet, or exceed, the minimum mechanical property requirements of the Australian Standard AS1448/K5 (Table 2).

Table 2: Mechanical analysis

Magnetic particle inspection

Magnetic particle inspection (MPI) is a non-destructive testing process widely used to inspect ferromagnetic materials for surface cracks. The rail industry commonly uses MPI to inspect axles for cracks. IPL specified the use of applicable standards, including the Aurizon standards and work instructions. The Aurizon document suite also referred to the relevant Australian standards for axles and MPI, which included rail‑related standards.

The Rail Industry Safety and Standards Board is responsible for the development and management of rail‑related Australian Standards, rules, codes of practice and guidelines, all of which have national application. The Australian Standard AS7515:2014 Axles described the requirements for the design, manufacture and maintenance of rolling stock axles to prevent derailments caused by axle failures.

Part 7 of AS7515:2014 described the use of MPI during axle inspection and referred to Australian Standard AS1171:1998 Non-destructive testing – Magnetic particle testing of ferromagnetic products, components and structures. AS7515 stated that a risk‑assessed consideration of:

• previous failures
• service conditions
• high failure consequences
• axle designer recommendations.

may indicate that more frequent inspections were required.

AS1171 specified the requirements of magnetic particle testing for the detection of surface and near-surface discontinuities in ferromagnetic products, components and structures. The standard provided detail on:

• testing personnel requirements
• equipment and materials
• methods of test
• process control procedure and requirements
• test records and reports.

Qualifications

The effectiveness of magnetic particle testing depends on the technical competence of the personnel performing the tests and on their ability to interpret indications, as specified in AS 1171. The testing personnel at Rockhampton were appropriately qualified and medically fit, including meeting the visual acuity requirements, for the task.

Equipment testing

Before use, the alternating current electromagnetic yoke (AC yoke) used for the magnetic particle testing was required to be performance checked using Aurizon Work Instruction – Inspection and Reconditioning of Wheelsets WI/2016017. The work instruction reflected the testing requirements contained in AS1171, which stated that a dead weight and standard test piece were to be used. The dead weight test involved the use of not less than a 4.5 kg sample of mild steel with the AC yoke pole spacing between 75 and 300 mm. A standard test piece with known discontinuities was also specified.

Equipment testing in practice

During a site visit to the Aurizon Rockhampton wheel shop, the ATSB observed that only the dead weight test was conducted. A standard test piece with known discontinuities was not used. Additionally, the local work instructions did not reflect the Aurizon and AS1711 requirements to performance check the AC yoke using the standard test piece.

Figure 10: AC yoke

Source: AS1171 Figure 3.2 (b).

Process

Maintenance personnel at the Rockhampton wheel shop had access to the following documents when conducting MPI:

• Aurizon Heavy Maintenance – Rockhampton, In coming Inspection Work Instruction WI‑RO‑WAB-10-001
• Aurizon Rockhampton Work Instruction – Wheel Shop work instruction for MPI of axles WI‑RO-WAB-10-014
• Aurizon Inspection and Reconditioning of Wheelsets WI/2016017
• Australian Standard AS1171:1998 Non-destructive testing – Magnetic particle testing of ferromagnetic products, components and structures
• Australian Standard AS7515:2014 Axles.

Process in practice

During a site visit to the Rockhampton wheel shop, the ATSB noted that during the inspection/testing process, the magnetic ink media (Ardrox 800/3) was not reapplied in between AC yoke placements, nor was there the positional overlap between each test. Both of these processes were required and detailed in Australian Standard AS1171.

Figure 11: AC yoke measurement

The measured width of the AC yoke on the day of the site visit. Source: ATSB

The AC yoke poles are adjustable and the yoke used at the wheel shop had been set to a distance of about one third the length of the axle shaft. The AC yoke was placed on one end of the axle (perpendicular to the centre line), energy applied to create magnetic flux, checked for potential indications, and then moved to the next third and the process repeated. There was no overlap between consecutive tests observed during the ATSB site visit. Once one side of the axle was inspected, the work instruction specified that axle be rotated through 90° and the process repeated until the entire axle was tested (Figure 12). During the site visit, the ATSB noted that the axle was rotated 120° rather than 90°. This equated to nine tests for the axle instead of the required 12.

Figure 12: AC yoke placement

Source: Aurizon Heavy Maintenance – Rockhampton

Axle failures on the Mount Isa line

Between 2008 and 2013, 41 main line derailments occurred on the Mount Isa line. Due to the significant number of derailments, the then-rail regulator, Queensland Department of Transport and Main Roads (TMR) rail regulation unit, undertook a study titled Mount Isa Derailment Analysis 2008 -2013.^[9] The study examined the causes with the aim of reducing their frequency and increasing the availability and capacity of the corridor. In October 2015, the rail regulation unit published the report.

The report focused on the operating practices of the:

• rail infrastructure manager in terms of incident prevention, maintenance, repair and upgrade
• rolling stock operators who used the Mount Isa line with respect to the age and suitability of rolling stock, inspection, maintenance practices and incident investigation.

The examination of the 41 derailments relevant to the scope of the report found 35 of these occurred on the main line, five when travelling through passing loops, and one when traversing a yard.

The rail regulation unit assessed each derailment to identify the principal causal factor, identifying rolling stock as the most frequent contributor, followed by track‑related defects (Figure 13).

Figure 13: Principal causal factors

Source: Queensland Department of Transport and Main Roads. Mount Isa Derailment Analysis 2008 -2013 report attachment B

The number of rolling stock-related causal factors was broken down into occurrence and train types (Figure 14).

Figure 14: Defect by train type

Source: Queensland Department of Transport and Main Roads. Mount Isa Derailment Analysis 2008 -2013 report attachment B

The rail regulation unit cited legacy issues associated with rail infrastructure and rolling stock, together with loading irregularities, and identified a series of recommendations to the rolling stock and rail infrastructure managers for consideration.

In response to the identified rolling stock defects/failures, it was recommended that rolling stock operators should:

• improve record keeping and reporting of wheel set and bearing faults, including wayside alarms and derailment history
• review the process for disseminating information regarding the service history of wheel sets to the staff that undertake non-destructive testing of the wheel sets
• review their investigation practices and reporting to capture the history and types of wheel sets involved in catastrophic failures and derailments.

Following the release of the report, TMR established the Mount Isa Line Safety Working Group (SWG) in March 2016. A key objective of the SWG was to provide a platform to rail transport operators for jointly addressing specific recommendations. The SWG incorporated representatives from TMR and the rail transport operators that conducted rail safety work on the Mount Isa railway.

GATX axle failure analysis

In addition to this occurrence, IPL experienced four axle failures on the GATX fleet. Following each axle failure, IPL engaged a specialist consultant to determine the reason for each failure (Table 3).

Table 3: Axle failures, findings, and recommendations

Following the recommendations of each report, IPL implemented actions to address the failing axles. Notably, IPL commissioned a finite element analysis (FEA) of the 840P1 axle design.^[10] The organisation that conducted the FEA detailed the fatigue assessment in the 840P1 axle and proposed a new axle design ‑ 840P2. The new axle design had a central barrel tapered from 165 mm in the centre to 174 mm towards the wheel seats. The FEA, suggested the maximum von-Mises^[11] stresses at the centre of the axles were 28.26 and 15.45 MPa for the existing and proposed axles respectively. ^[12]

The stresses experienced by the axles were significantly lower than the 370 MPa yield strength of the material and the tensile strength of 574 MPa shown in Table 2. The endurance limit of steels is generally accepted to be 40 per cent of the tensile strength of the material. In this case, the calculated stresses were well below the endurance level for the material. Consequently, by that measure the axles had been designed appropriately and should have infinite life.

Fatigue crack size and growth rate

Based on the FEA report, the computed critical crack sizes^[13] at the centre of both axles was:

• existing 840P1 - 110 mm (consistent with the failed axles)
• proposed 840P2 - 130 mm.

The critical crack size for the existing axle design correlated with the observed crack sizes in failed axles. Additionally, the FEA report performed fatigue analysis using software based on fracture mechanics idealisation and Paris’ Law.^[14] The resulting fatigue lives are shown in Table 4.

Table 4: Computed fatigue lives

Notes: # Based on the assumption that the tanker wagon is travelling at 80 km/h and the wheel diameter is 800 mm.

^ Initial crack depth was 2 mm. Below this value resulted in no crack growth.

* Initial crack depth was 5 mm. Below this value resulted in no crack growth.

Based on the FEA report, and the average of two return trips per week, the existing axle design (840P1) with a 2 mm deep notch would be theoretically at critical risk of failure at 612 hours (26 weeks) of loaded operation. Additionally, the proposed axle design (840P2) with a 5 mm deep notch would be theoretically at critical risk of failure at 2,454 hours (100 weeks) of loaded operation.

The FEA report commented:

It has been shown that under normal operating loads the stress-levels in the axles (both the existing and proposed designs) are relatively low and indicate the axles are adequately designed. Therefore in an ideal environment these axles would not be expected to initiate defects, and therefore would not be expected to fail in the manner in which they have in the field.

Post-incident fleet-wide inspection

Following the derailment of train 9T92 at Hughenden on 15 August 2018, IPL performed in-situ MPIs on the entire GATX wagon fleet. By the end of September 2018, it had detected 17 cracked axles and removed them from service. IPL observed that the initiating notch in those instances was minimal (less than 2 mm) in depth.

Summary

In an operational environment, ballast and other objects can strike an axle possibly forming a notch. If the notch is more than 2 mm deep, it will likely initiate a fatigue crack and propagate to the critical size and fail, unless detected earlier. Conversely, based on the FEA report, notches less than 2 mm deep may not propagate. However, based on the results of fleet‑wide inspections, and given the depth of the coincident notch on the failed axle being 0.2 mm, it appears that in practice other stressors allow a notch less than 2 mm to initiate a crack and propagate until failure.

__________

2. Top is the vertical alignment of rails. Twist is the variation in the cross-level between two track locations. Gauge is the distance between the inside running faces of the two rails. Versine is a trigonometric function used to measure and calculate curvature.
3. Provision of the locomotive(s) and operating crew.
4. These detectors are not designed to, or capable of, detecting cracked axles.
5. The contract between UGL and Aurizon for wheel set services subsequently ended with the closure of Townsville, Redbank and Rockhampton Aurizon workshops.
6. GATX Acid Transport Wagons: Procedure for Operation and Maintenance For Wheel Sets, Axles And Bearings (79975 v4) 16/4/15.
7. Beach marks, or striations, are macroscopic features used to identify fatigue fractures and may be used to estimate the number of fatigue cycles.
8. Current at the time of the occurrence.
9. Mount Isa Line Derailment Analysis 2008 – 2013, Transport and Main Roads.
10. Quest Integrity Sulphuric Acid Wagon Axle FEA and Fatigue Assessment 110274 issued 31 October 2016.
11. Equivalent tensile strength.
12. The stresses at the centre of the existing and proposed axle designs when under self-weight (full tanker) and centrifugal loading.
13. The size of a crack in which propagation transitions to rapid overstress failure of the remaining material.
14. Paris’ Law is the relationship between the crack growth rate during cyclic loading and the range of the stress intensity factor.

Safety analysis

Train 9T90 derailed near Kimburra, as a result of a failed axle. There was no evidence that train speed, handling, or operational performance contributed to the derailment. Similarly, there was no indication that track condition played a part in the incident.

Incitec Pivot Limited (IPL) had four GATX axle failures in addition to this occurrence. Following each occurrence, IPL incrementally implemented safety actions. The following safety analysis will consider the axle failure mechanism, the susceptibility of the axle type to fatigue cracking and the effectiveness of risk controls to detect such cracks prior to failure.

Development of the occurrence

Failure mechanism

Detailed metallurgical examination of the failed axle identified that in-service impact damage to the axle surface created a notch that led to the initiation of a fatigue crack. That crack propagated undetected until it reached a critical size, resulting in an overstress fracture of the axle. Fracture of the axle led to the separation of the axle halves and subsequent derailment of train 9T90.

Fatigue crack detection

A magnetic particle inspection (MPI) was carried out on the axle three months prior to the failure/derailment. As part of that inspection, white paint containing titanium oxide was applied to the surface of the axle. Examination of the axle fracture surface found titanium oxide residue at a depth within the fatigue crack. That physical evidence indicated that the paint seeped into the fatigue crack during the last MPI and that therefore the fatigue crack was present at the time of the testing. Additionally, the length of the paint residue indicated that the size of the fatigue crack present at the time of the inspection should have been detectable under the MPI process.

A review of the magnetic particle procedure and practice found the following anomalies that likely led to the crack not being identified during the last axle inspection:

• non-overlap of the yoke pole placement
• non‑use of a standard test piece
• non-reapplication of the ink.

There were no work instructions detailing where to place the yoke during the inspection and the adjustable alternating current (AC) yoke was set for one-third the width of the axle. The observed practice was that there was no overlap between the pole arms from one yoke placement to another. This meant that potential indications near or beneath the AC yoke poles may not be sufficiently energised to create enough magnetic flux to accurately and reliably indicate a potential crack. Furthermore, the AC yoke pole placement may also have physically obscured or masked potential crack indications. In the case of the failed axle, the location of the fracture closely correlated with the overlap point of the AC yoke poles.

Although the lift test was performed, the omission of the standard test piece during the equipment testing did not adequately verify the overall system performance. As a result, a defect that may have affected the ability to observe the crack would have been more difficult to identify.

The magnetic ink media was not re‑applied between tests. This increased the risk that the media may become diluted and not indicate a potential crack as obviously as it would with a higher magnetic ink concentration. Consequently, the tester may overlook inconspicuous indications and not detect a crack.

Axle fatigue susceptibility

Rail axles are designed to have an infinite life, with peak stress loading remaining below the endurance limit of material. In the absence of damage that increases localised stresses above that limit, fatigue cracking should not occur.

The finite element analysis commissioned by IPL prior to this occurrence indicated that a notch at least 2 mm deep was required to initiate fatigue cracking. In this occurrence, the initiating notch was only 0.2 mm deep. Furthermore, since 2012, there have been five GATX 840P1 axle fatigue failures that have resulted in a derailment. Following the last of these derailments, at Hughenden in August 2018, IPL conducted an accelerated fleet wide inspection of GATX axles. Those inspections found 17 axles with fatigue cracks. The crack sizes varied but the initiating notch was usually less than 2 mm deep.

That analysis of past derailments and in‑service defects identified that the GATX 840P1 axle was susceptible to fatigue cracking due to relatively minor damage that was not reliably detected prior to failure.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 9T90 near Kimburra, Queensland, on 28 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• In‑service impact damage to the axle initiated a fatigue crack that propagated until failure and resulted in the derailment of train 9T90.
• Anomalies in the magnetic particle inspection procedures likely led to the crack not being detected. [Safety issue]
• The GATX 840P1 axle was susceptible to fatigue cracking due to relatively minor damage that was not reliably detected prior to failure. [Safety issue]

Other finding

• The fatigue crack existed and was of a detectable size at the time of the previous routine magnetic particle inspection.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Magnetic particle inspection

Safety issue number: RO-2017-013-SI-01

Safety issue description: Anomalies in the magnetic particle inspection procedures likely led to the crack not being detected.

Safety recommendation description: The Australian Transport Safety Bureau recommends that Aurizon addresses the non-use of standard test pieces during magnetic particle inspection.

Axle fatigue susceptibility

Safety issue number: RO-2017-013-SI-02

Safety issue description: The GATX 840P1 axle was susceptible to fatigue cracking due to relatively minor damage that was not reliably detected prior to failure.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Incitec Pivot Limited
• Aurizon
• Queensland Rail
• Office of the National Rail Safety Regulator
• Queensland Department of Transport and Main Roads (Rail Regulation)
• train crew of 9T90
• Queensland University of Technology Central Analytical Research Facility.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Incitec Pivot Limited, Aurizon, Queensland Rail, Office of the National Rail Safety Regulator, Queensland Department of Transport and Main Roads (Rail Regulation), and the train crew of 9T90.

Submissions were received from Incitec Pivot Limited, Aurizon, Queensland Rail, and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 1 October 2017, a Pacific National loaded grain train 8838N was travelling on the Australian Rail Track Corporation (ARTC) rail network from Nevertire to Manildra in north-western New South Wales. The train consisted of two locomotives and 23 wagons. The train was travelling south at Narwonah when 11 loaded grain wagons located at the rear of the consist derailed. An emergency brake application occurred due to the uncoupling, which brought the front portion of the train to a stand. There were no injuries but there was substantial damage to nine wagons and track infrastructure.

What the ATSB found

The ATSB found that the derailment occurred at a location with identified poor track condition around a rail joint on the down rail. This, and a short twist defect at the point of mount, contributed to the vertical unloading of wheels on the twelfth wagon in the consist (NGPF35911) and the subsequent derailment of that wagon and 10 trailing wagons.

Previously, there were track defects identified near the derailment site. The maintenance of defects in this section of track was not successful in preventing the defects from re-occurring. The train crew were operating the train at a speed of approximately 80 km/h; this was in excess of the 60 km/h specified by ARTC.

The measurement of three wagons, post-derailment, found that two of the three wagons were loaded in excess of the 81 t as recorded on the consist and that the grain was not loaded evenly in the three wagons.

What's been done as a result

Approximately 300 m of rail, fasteners and sleepers were replaced and 150 m of new formation was required around the derailment site. Thirteen 12-m track panels were constructed on site and lifted into place by cranes. The rail joints were welded and the track readjusted.

Changes have been made to the ARTC maintenance system to address systemic issues. ARTC have also commenced a work program titled ‘Asset Management Improvement Program’; this work focusses on improving the functionality of the Enterprise Asset Management System and its supporting business processes.

The rail infrastructure manager, in consultation with the rolling stock operator, reiterated the requirement for rolling stock to travel within the maximum speed as advertised in the relevant notices and to provide correct train manifest information.

Safety message

The incident highlights the importance of ensuring the track is free from any defects and that trains travel at or below the speed specified in the standards.

Derailed grain wagons

Source: OTSI

The occurrence

What happened

On 1 October 2017, a two-person train crew signed on at the Pacific National Parkes depot at 0650,^[1] the morning of the incident. They drove by car to Nevertire and relieved the train crew of 8838N. At the Nevertire siding, the locomotives were attached to the wagons. At 0920, 8838N departed Nevertire and proceeded towards Narromine. 8838N arrived at Narromine at 1025 and a run-around movement was conducted to reverse the locomotives to the opposite end of the train. This is normal practice for trains arriving from Nevertire and other locations on that line, and then proceeding towards Parkes.

Figure 1: Location map

This figure shows the path of 8838N from Nevertire to the location of the derailment at Narwonah and the intended path from Narwonah to Manildra.

Source: Geoscience Australia with annotations by ATSB

At 1055, the train departed Narromine and travelled approximately 20 km without incident. At 1123, in the section between Narwonah and Wyanga, at kilometrage 536.975,^[2] the assistant driver noticed what he called a ‘kink’ in the track ahead as 8838N passed a 40 km/h speed warning board.^[3] The train had partially travelled over the track irregularity when the driver noticed in his side mirror that there was dust coming from the rear of the train. A few seconds later, he saw derailed wagons (Figure 2).

Figure 2: Derailed wagons and grain spillage

Source: ATSB

At 1124, the driver of 8838N made a full emergency brake application and pressed the emergency button on the In-cab Communications Equipment (ICE) radio. This was to advise train control of the derailment. It is likely that due to uncoupling of the wagons, there was a loss of brake pipe pressure, which meant that an automatic emergency brake application had already commenced. A few minutes later, at 1126, the assistant driver called the Pacific National shift leader at Parkes to notify him of the derailment. The assistant driver then called the Pacific National integrated planning service.

At 1135, the driver secured the locomotive and joined the assistant driver in placing audible warning devices on the track to protect the front and rear of the train. Network control was advised that the audible warning devices had been placed on the track.

At 1145, the driver and the assistant driver inspected the derailment site and found the 12th to the 22nd wagon in the consist derailed. Nine wagons had derailed and were on their side and two wagons had derailed but remained upright. The last wagon, the 23rd wagon, did not derail.

The train crew were tested for drugs and alcohol following the derailment; all results were negative.

__________

1. The 24-hour clock is used in this report. Local time was Australian Eastern Daylight-saving Time.
2. NSW track kilometrage is measured from Central Station, Sydney.
3. This warning board was in place for a defect 2500 m ahead of the board.

Context

Location

Narwonah is a rural location in north-western New South Wales, approximately 537 km by rail from Sydney. The incident occurred in a rural area bounded by farm paddocks on each side of the rail corridor (Figure 3).

Figure 3: View to derailment site

Source: ATSB

Environmental information

At 1130, on the day of the accident, the temperature was recorded by the Bureau of Meteorology at Dubbo as 19°C.^[4] This temperature had increased from a low of 3°C shortly after 0700 that morning. Over the previous week, a number of days recorded temperatures in the mid-30s. Based on the temperature on the day of the incident and the previous days, it is not considered likely that any track defect was a result of high temperatures. There was no rainfall recorded in the previous 24-hour period and the previous week reported only trace amounts of rainfall.

Train crew

The train was operated by a crew of two: a driver and an assistant driver. Both had been driving with Pacific National since 2010 and were qualified and familiar with the route.

Train control

The ARTC managed the track where the derailment occurred, with the movement of rail traffic controlled by a network controller based at the ARTC Network Control Centre North at Broadmeadow in New South Wales.

Safety actions implemented

ARTC have advised that, in response to this incident, the following safety actions have been implemented:

• All damaged infrastructure was removed and approximately 300 m of rail, fasteners and sleepers were replaced.
• Approximately 150 m of new formation was repaired prior to establishing the bottom ballast on the capping layer.
• Thirteen 12-m track panels were constructed on site and lifted into place by cranes.
• The rail joints were welded and the track re-adjusted throughout the derailment site.
• Included the cause ‘train over speed transporting heavier axle loads than permitted’ into the strategic risk of train derailment.
• Reviewed Route Access Condition Notices 190007, 190008 and 190009. As a result, an amendment was made to the infrastructure assessment (below rail) section of procedures.

The ARTC consulted with Pacific National regarding:

• The requirements for rolling stock to travel within the maximum speed as advertised within the relevant Route Access Condition notices.
• The requirement for the operator to provide ARTC with the correct train manifest information prior to entering the ARTC network.

Also, as part of their strategic plan, ARTC have introduced a number of changes, including:

• The introduction of a new role within the maintenance provisioning centres titled ‘Asset Assurance Engineer’. This engineering role specialises in the track and civil disciplines. Two key components of this role are:
  • To ensure that quality maintenance is undertaken on ARTC’s assets by maintaining a level of oversight of work performed; and
  • To utilise network condition, operational performance and reliability data to support decision-making and prioritisation for maintenance and project works.

These objectives are targeted at addressing systemic issues identified during the Narwonah derailment investigation by:

• Ensuring that defect rectification work is undertaken to an acceptable quality;
• Ensuring that inspection activities are thorough and network issues are captured within ARTC’s Enterprise Asset Management System for planning and future rectification; and
• Interrogating network data to identify where reoccurring issues are developing and request project work to rectify.

ARTC has also commenced a work program titled ‘Asset Management Improvement Program’; this work focusses on improving the functionality of ARTC’s Enterprise Asset Management System and it’s supporting business processes. One of the key components of this program is the introduction of a review meeting at the maintenance provisioning centres. Here maintenance personnel, work coordinators and asset assurance engineers discuss network issues that have been raised or rectified since the previous meeting. This will provide an additional level of assurance that the appropriate priority has been assigned to network issues awaiting repair. It will also ensure that the repair works are scheduled to take place accordingly, and provides a forum where the asset assurance engineer is able to review work documentation to ensure quality maintenance is undertaken.

ARTC has continued to invest funding in the Central and North West areas of New South Wales in activities such as steel and concrete re-sleepering and rail joint removal programs. These upgrades are intended to improve the condition of the Central and North West track assets, as well as reducing the educed the likelihood of such defects that contributed to this derailment.

__________

4. Bureau of Meteorology observations at Dubbo were taken from the Dubbo airport automatic weather station. Dubbo is approximately 37 km from Narwonah.

Safety analysis

Introduction

The derailment initiated when train 8838N travelled over a section of track at 536.989 km at approximately 80 km/h. Track observations showed evidence of the rail pumping^[5] and movement of sleepers around a rail joint at this location on the down rail. Approximately 14 m further along the track, a short twist^[6] defect of 22 mm was also identified. This section of the report will examine the interaction between the track and the train that led to the derailment.

Track condition

This track was standard gauge (1435 mm), consisted of 47 kg/m long welded rail, and had a curve of 3567 m radius at the point of mount (536.975 km). It was a mixture of steel and timber sleepers. The sleeper pattern was predominantly an alternating pattern of one steel sleeper to one timber sleeper. Occasionally, two steel sleepers or two timber sleepers were inserted into the pattern. According to the ARTC usage and installation standard,^[7] variation in sleeper pattern is permitted as long as the pattern is generally maintained. In this case the pattern was generally maintained.

The steel sleepers were in good condition and were connected to the rail with standard resilient fasteners. Steel sleepers have inspection holes which allow for a visual or physical check of the level of ballast within the sleeper pod.^[8] Steel sleepers have a lower mass than timber or concrete sleepers and depend on ballast to provide vertical and lateral support. The tamping^[9] of ballast within the hollow section underneath the sleeper is an important aspect of steel sleeper performance. If the ballast is not tamped correctly, the result can lead to an inadequately filled pod or an unevenly filled pod.

A visual inspection was conducted of steel sleeper inspection holes on 75 steel sleepers leading up to the derailment. The majority (82%) of inspection holes showed ballast close to the top of the hole. The depth of ballast inside the other 18% appeared to be more than the required 50 mm from the top of the hole. The investigation determined the amount of ballast in the sleeper pods was unlikely to have contributed to the derailment.

The condition of the timber sleepers in the vicinity of the derailment was fair to poor. The tracks were supported by baseplates which were affixed to the timber sleepers with dog spikes. Some spikes were loose or missing from the timber sleeper fastenings (Figure 4). The poor condition of the timber sleepers was likely to have contributed to track instability in this area.

Figure 4: Track structure

This figure shows the track structure near the derailment at Narwonah.

Source: ATSB

The track was inspected and measured immediately following the derailment. The ATSB made the following observations at the rail joint on the down rail (536.989 km):

• Evidence of the down rail pumping vertically around the joint
• Movement of the timber sleepers around this joint
• Loose or missing dog and lock spikes
• Damage to the face of the joint
• A joint gap of approximately 20 mm.

An independent track inspector commissioned by Pacific National attended the site the day after the derailment. Post-derailment track measurements were taken using an 81-class locomotive representing an axle load of approximately 21 t. A summary of these measurements is shown in Appendix A.

This load testing revealed a short twist defect of 22 mm at the point of mount (536.975 km). At the rail joint on the down rail (536.989 km), the load testing also identified another short twist defect of 13 mm.

The derailment sequence likely commenced at the rail joint on the down rail. As the wheels on the rear bogie on the 14 th wagon traversed the rail joint, the wheels on the front bogie were approaching a 22 mm change in superelevation.^[10] This likely caused the wagon (NGFP 35911 S) to roll and the left wheel on the lead axle of the leading bogie to unload. Wheel marks on the rail head showed that the flange of this wheel climbed the up rail and travelled on the top of the rail head for approximately 8 m and then dropped to the left side of the up rail. The opposite wheel dropped into the four foot^[11] and the derailment of this wheelset precipitated the other ten wagons travelling behind to derail (Figure 5). The track defects, in the vicinity of this rail joint, likely contributed to the initiation of the derailment.

Figure 5: Derailment mechanism

This figure shows the expansion gap at the rail joint on the down rail at 536.989 km.

Source: ATSB

According to ARTC’s code of practice,^[12] short twists for the freight speed band of 60 km/h require a P1 maintenance response. The code of practice requires the track be inspected within 24 hours and repaired within 7 days. This action was taken.

According to the ARTC standard,^[13] a gap at a rail joint should be between 0 mm to 12 mm at a neutral temperature between 25°C to 35°C. A measurement taken on the afternoon of the derailment, with the temperature at approximately 19°C, showed a gap of approximately 20 mm on the down rail joint at 536.989 km (Figure 6). The ARTC Track and Civil response code for this measurement specifies an A7 response which is defined as a routine inspection.^[14]

Historical inspection records and track measurements were also provided by ARTC. The track had previously been inspected by an ARTC AK track geometry recording car and ultrasonic inspection vehicles; this took place on 6 September 2017, 22 days before the derailment. This electronic inspection revealed the presence of an 18 mm twist defect next to the rail joint on the down rail, and 11 m from the point of mount. This track geometry defect was notified to the track maintenance team who repaired the defect, with localised tamping, on the 7 September 2017.

ARTC track maintenance teams also patrol and inspect the track regularly to detect and repair defects. An ARTC track maintenance team had patrolled this section of track on 26 September 2017 and a track stability inspection was conducted on 28 September 2017. Both the track patrol and the track inspection recorded no defects in the section of track around the derailment.

The detailed track geometry inspection and the track patrols were conducted in accordance with ARTC’s Civil Technical Maintenance Plan ETE-00-03.

Figure 6: Rail joint

This figure shows the expansion gap at the rail joint on the down rail at 536.989 km.

Source: ATSB

Train information

The train involved in the incident was Pacific National freight service 8838N. The train consisted of 2 locomotives and 23 wagons, with a total mass of 1852 t. The total length of the train was 371 m. The two 81-class locomotives were positioned at the front of the train (locomotive 8132 and 8110) (Figure 7). Each locomotive had a total mass of approximately 129 t. Of the 23 grain hopper wagons, seven were NGKF-type with 16 wagons NGPF wagons (Figure 8).

Figure 7: 81-class locomotive at front of train 8838N

Source: ATSB

Figure 8: NGPF wagon

Source: ATSB

The wagons were inspected following the derailment. Apart from the damage sustained as a result of the derailment, the wagons, bogies and wheels were in good condition. The wheel rims of the first wagon to derail (NGPF 35911) were checked on site and no defects were observed. Wheel rim thickness, wheel tread and flange height were all within specification.

The dataloggers on both locomotives (8132 and 8110) were taken by the ATSB for examination. They were of the Hasler-type tape-recording device. They record the following parameters: time, speed, distance, power/idle for the brake handle position, vigilance, and brake pipe pressure.

The time trace on locomotive 8110 was not recorded. Minor alignment adjustments were required to correctly align the various traces for analysis. Wheel diameters were corrected to the diameters as measured on 3 October 2017. According to the recordings from the lead locomotive during the journey from Narromine, 8838N had a recorded maximum speed of 86 km/h. A speed of 82 km/h was recorded immediately prior to the brake pipe pressure dropping. Two seconds later, the power was reduced to idle. The brake pipe pressure began to drop 572 m before the train came to a stop.

According to the ARTC, notices are issued to operators on the network. These notices may advertise temporary or permanent changes to the standard. A Route Access Condition Notice issued on 27 April 2017 stated that operation of rollingstock to a maximum axle load of 21 t should travel at a maximum speed of 60 km/h between Dubbo and Goobang Junction.^[15] The train 8838N was travelling above the specified speed for the axle loading of the wagons.

In relation to the speed of a train and the effect on a derailment. The Railcorp derailment handbook highlights that:

The effect of speed in the presence of a track irregularity is to increase the impact forces between wheel and rail, and increase the instability of a vehicle excited by the track defect. Every vehicle has a natural rhythm or frequency for each of its normal movements (roll, pitch, bounce and yaw). The vehicle responds when the track condition disturbs or excites the vehicle. The vehicle will respond most when the exciting rhythm matches the vehicle's natural frequency. Speed and load limits are set to match what the track structure can sustain.^[16]

The train 8838N was travelling at 82 km/h immediately before the derailment, where the specified speed for this axle loading was 60 km/h. It is likely that this increased the risk of derailment. Also, if other wagons had travelled frequently over this track at increased speeds, this may have led to a more rapid deterioration of the track.

Following the derailment, the last three wagons were weighed on site by an independent contractor using a calibrated device. These three wagons had remained upright following the derailment. The axle loads and total weight for each wagons are shown below in Table 1.

Table 1: Static axle weights for last three wagons of 8838N

Source: ARTC

The actual weight for two of the three wagons was found to be higher than the recorded consist mass of 81 t (Appendix B). The consist shows wagon NGPF35997 as having a weight of 81 t while its actual measurement was 83.74 t. Wagon NGPF35941 was also over the recorded consist weight by one tonne, while NGPF36034 was approximately two tonnes under the consist weight. Variation between the wagon mass and the mass recorded on the train consist has been an issue in past rail investigations.^[17] As this was only a sample of three wagons, it is unknown if the other wagons had an issue with wagons being loaded more than the consist.

The measured weight of the last three wagons has a weight disparity between axles, from a minimum of 19.27 t to a maximum of 21.88 t. This axle loading was in excess of the 70 km/h speed requirement of the ARTC Route Access Standards. This constituted a difference of more than 2.5 t, indicating a possibility of uneven loading of the grain into the wagons or of the load shifting as a result of the derailment forces. As only three of the 23 wagons in the consist were weighed, it could not be determined if the other wagons had any uneven loading. A rail derailment handbook states that:

Improperly distributed loading or eccentric loading creates unbalanced forces which, when combined with the dynamic forces of a moving train can cause derailment.^[18]

Wagon loading imbalance, lateral or longitudinal, may be expressed as a percentage and too much of an imbalance can increase the risk of derailment. It has been found that: ‘longitudinal imbalance may also cause derailment. The bogie under the lighter end of the vehicle is more likely to derail when subjected to normal train action or cross level and profile irregularities than a bogie under a balanced load… an imbalance of 15% has been found to be the threshold of instability.’^[19]

Calculations of the longitudinal loading imbalance of the last three wagons was approximately 4%. This level of imbalance is well below the threshold where it would be considered likely a contributory factor to a derailment.

According to the train consist, the gross mass of the wagons ranged from 81 t to 79.50 t. The sample of three wagons weighed following the derailment showed that the recorded weights on the consist was inaccurate. The recorded weights were based on an estimate made by the load operator when loading the grain at the GrainCorp loading point at Nevertire.

__________

5. Pumping is a sleeper action where the sleeper moves vertically up and down as rail traffic passes over the sleeper. This movement often results in the degradation and contamination of the ballast structure.
6. Variation in cross level when measured at different points along the track (usually every 2 m for a short twist and every 14 m for a long twist.)
7. ARTC Steel sleepers – Usage and installation standard ETC-02-03, version 1.0, 4 May 2015.
8. The space under a steel sleeper below the sleeper deck and between the side walls of the sleeper.
9. Tamping is the process by which ballast is packed in and around the sleepers of a track. In the case of tamping steel sleepers, the ballast is squeezed to lift it into the pod.
10. Superelevation is the vertical distance that the outer rail is raised above the inner or grade rail.
11. The four foot is the area between the rails of a standard gauge railway.
12. ARTC Track and Civil Code of Practice Response Booklet ETW-00-01. Version 1.1 issued 21 April 2015.
13. ARTC Standard ETM-06-09 welded track stability analysis. Version 1.0 issued 22 March 2017.
14. This means it is subject to the normal scheduled inspection of 42 days with a 20% latitude.
15. TOC waiver Reference number 17046, Six month extension of trail operation of 21 tal wagons at 60 km/h on Central and North West Routes. Issued 27 April 2017, in force until 31 October 2017.
16. RailCorp Engineering Manual, Derailment Investigation – Track and Rolling Stock, TMC 213 V 1.0, Issued June 2011. p.94.
17. ATSB report RO-2017-001: Runaway of grain train 8960 Dombarton to Unanderra, NSW.
18. Queensland Rail course notes, Derailment Cause Analysis version 2.4, August 2006. p.103.
19. Rail Industry Safety and Standards Board Derailment Investigation and Analysis Guideline version 1.1, 27 November 2014. p.134.

Findings

From the evidence available, the following findings are made with respect to the derailment of grain train 8838N at Narwonah, New South Wales on 1 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The poor track condition around the rail joint on the down rail (536.989 km) and the short twist defect at the point of mount (536.978 km) contributed to the vertical unloading of wheels on the twelfth wagon in the consist (NGPF35911) and the subsequent derailment of that wagon and 10 other wagons of train 8838N.
• There were track defects identified in the vicinity of the derailment site prior to the derailment. The maintenance of defects in this section of track was not successful in preventing the defects from re-occurring. [Safety issue]
• The train crew were operating the train at a speed of approximately 80 km/h; this was in excess of the 60 km/h specified by ARTC.

Other factors that increased risk

• A post-derailment static measurement on the last three wagons revealed that the two of the three wagons were loaded in excess of the 81 t as recorded on the consist. One wagon, NGPF 35941, weighed 82.26 t and another wagon, NGPF 35997, weighed 83.74 t. It is possible that other wagons on train 8838N were also loaded in excess of the weight recorded on the consist.
• There was a difference in measured axle loads on the last three wagons on train 8838N. These post-derailment measurements indicate that the grain was not loaded evenly in the wagons. It is possible that other wagons on the train were also unevenly loaded, however the load shifting may have been a result of the derailment forces.
• There was no calibrated equipment to measure the weight of the commodity transferred to the wagons at the loading terminal at Nevertire. There was no other wayside point to determine the actual weight of the wagons. This means there was the potential to have overloaded wagons operating on the network.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Track maintenance

Safety issue number: RO-2017-014-SI-01

Safety issue description: There were track defects identified in the vicinity of the derailment site prior to the derailment. The maintenance of defects in this section of track was not successful in preventing the defects from re-occurring.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• ARTC
• Pacific National
• Office of National Rail Safety Regulator.

References

ARTC Route Access Standard (RAS I5).

ARTC Standard ETM-06-09 welded track stability analysis. Version 1.0 issued 22 March 2017.

ARTC Steel sleepers – Usage and installation standard ETC-02-03, version 1.0, 4 May 2015.

ARTC Track and Civil Code of Practice Response Booklet ETW-00-01. Version 1.1 issued 21 April 2015.

ARTC TOC Waiver 17046 Six month extension to 21-TAL wagons at 60 km/h on Central and North West Routes. Issued 27 April 2017.

ATSB report RO-2017-001: Runaway of grain train 8960, Dombarton to Unanderra, NSW on 22 April 2017.

Office of the National Rail Safety Investigator, Incident Field Report Derailment Narwonah 1 Oct 2019, Doc. ID. A805760. 8 November 2017.

Pacific National and Opus Rail, Derailment Track Inspection Parkes – Narromine branch line, 30 October 2017.

Queensland Rail course notes, Derailment Cause Analysis version 2.4, August 2006.

RailCorp Engineering Manual, Derailment Investigation – Track and Rolling Stock, TMC 213 V 1.0, Issued June 2011.

Rail Industry Safety and Standards Board – Glossary of Railway Terminology, Version 1.0, 3 December 2010.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the ARTC, Pacific National, the Office of National Rail Safety Regulator and Transport for New South Wales. Submissions were received from the ARTC, Pacific National and the Office of National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Post-derailment track measurements

Note: these measurements were taken using the static load of a locomotive.

Appendix B – Load diagram 8838N

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 30 September 2017, shortly after midnight, the Australian Border Force cutter Roebuck Bay (ABFC Roebuck Bay) grounded on Henry Reef in the Great Barrier Reef, Queensland. The cutter was on a passage from Saibai Island in the Torres Strait Islands archipelago bound for Lizard Island, located about 71 NM south-east of Cape Melville. The cutter sustained substantial damage to the keel, stabiliser fins and propellers, with hull breaches in way of the storage void and tank compartment spaces. There were no reported injuries or oil pollution. The cutter was subsequently towed off the reef, stabilised and towed to Cairns, arriving on 5 October 2017.

What the ATSB found

The ATSB found that ABFC Roebuck Bay’s route plan was amended during the passage planning process resulting in the route being inadvertently plotted across Henry Reef, a potential navigational danger. The cutter’s electronic chart display and information system (ECDIS) identified the reef as a danger to the planned route. However, the ship’s deck officers did not identify the danger, either visually or using the ECDIS. It was also likely that the ECDIS look‑ahead function did not encounter Henry Reef’s chart symbol and therefore, did not generate an alarm before the grounding. The look-ahead was set-up based on Australian Border Force (ABF) work instructions, which also included other settings that likely reduced the ECDIS's effectiveness.

The effectiveness of the officers’ visual check was likely influenced by a misinterpretation of chart symbology and possible obscuration of the reef's chart symbol and label. In addition, the officers’ expected that the ECDIS would not save a route plotted across a chart danger, and had a misunderstanding of the ECDIS safety checking functions. The investigation found that the cutter’s officers did not possess an adequate level of knowledge to operate the cutter’s VisionMaster FT ECDIS as the primary means of navigation. The type‑specific ECDIS familiarisation training, as undertaken by ABF deck officers, was not effective in preparing the cutter’s officers for the operational use of the ECDIS. There was also no consistent provision of ECDIS annual continuation familiarisation training, as required by ABF procedures.

The ECDIS on board most ABF cutters, including ABFC Roebuck Bay, operated on a non-type-approved naval software version, although DNV GL (Det Norske Veritas - Germanischer Lloyd) certified them as using type-approved ECDIS as the primary means of navigation.

The cutters’ ECDIS were also not up‑dated to the latest International Hydrographic Organization (IHO) standards at the time of the grounding, specifically, the S-52 standard Presentation Library 4.0. Consequently, enhanced safety features of the new presentation library, which could have potentially alerted the officers to the danger posed by Henry Reef, were not available.

The ATSB also identified a risk associated with the hydrographic use of point feature objects to represent physical features of relatively significant spatial extent on an electronic navigational chart. The ATSB found that this could increase the risk of the hazard posed by such features being misinterpreted by mariners and potentially reduce the effectiveness of the ECDIS safety checking functions.

What's been done as a result

The ABF have advised the ATSB of several proposed and implemented measures aimed at improving fleet knowledge of ECDIS functions and features. There is an increased focus on passage planning, watchkeeping and use of ECDIS during the annual maritime operational compliance audits of vessels. These audits will now include training and information sessions and watchkeeper assessments. The training package and requirements for ECDIS annual familiarisation training has been updated. Task books have also been implemented for each role to reduce the effects of incorrect information being communicated by trickle-down training. Specific training documentation for the navigation officer’s role has also been improved.

The ABF is also engaged in ongoing work with the ECDIS manufacturer to improve ECDIS type‑specific familiarisation training.

The ABF also advised that a review of navigation related procedures and work instructions was undertaken and completed. This resulted in several work instructions being updated and re-issued with the lessons learnt from the investigation incorporated into the instructions.

The ABF undertook a program of software and hardware upgrades to update all cutters to the IHO’s S-52 Presentation Library 4.0. This was completed in September 2018.

The Australian Maritime Safety Authority have reminded all Recognised Organisations of the requirement that an ECDIS is only compliant when installed and operated in accordance with the type-approval issued. The authority have sought DNV GL’s internal review of their vessel survey and certification processes and any corrective action taken. The Australian Maritime Safety Authority have also received confirmation that ABF vessel management plans captured the non-type-approved nature of ABF ECDIS units.

The Australian Hydrographic Office has identified about 2,200 point features on 243 Australian Electronic Navigational Charts potentially affected by the identified point feature safety issue. Commencing in December 2018, these point features were updated by encoding an obstruction area around the existing underwater, awash rock, obstruction or isolated danger symbols. In addition, the AHO has published an online supplement to the Seafarers Handbook for Australian Waters that will be fully incorporated as a new chapter into the new edition of the handbook (Edition 5), due for publication in 2019. The supplement addresses the dangerous effects of overscaled ECDIS displays near features such as isolated danger symbols. The supplement also aims to address a number of misconceptions amongst mariners regarding the accuracy of bathymetry within Electronic Navigational Charts and the impact that accuracy should have upon route planning and conduct. The content has also been offered to the IHO for publication as an IHO standard.

Safety message

The safe and effective use of ECDIS as the primary means of navigation depends on the mariner being thoroughly familiar with the operation, functionality, capabilities and limitations of the specific equipment in use on board their vessel. ECDIS type-specific familiarisation should be designed, delivered and undertaken so as to ensure the transfer of knowledge required to confidently operate the ECDIS as the manufacturer intended it to be operated. ECDIS, as a complex software based system, is subject to constant change and improvement. In order for mariners to always have the best possible advantage in conducting safe navigation, ECDIS needs to be maintained so as to be compatible with the latest applicable standards mandated by the appropriate organisations.

While the use of ECDIS and ENCs as an essential tool for navigation provides many safety benefits, navigation with ECDIS is fundamentally different from navigation with paper charts. The implementation of ECDIS and the replacement of paper charts has introduced certain risks to the conduct of marine navigation, as highlighted in this investigation. While the challenges faced by regulators, manufacturers, hydrographic offices and other concerned parties in resolving these risks is acknowledged, the ultimate goal must be to eliminate significant risks or at least reduce them to an acceptable level in terms of navigational safety.

The occurrence

On 30 September 2017, at about 0025 Eastern Standard Time,^[1] Australian Border Force cutter Roebuck Bay (ABFC Roebuck Bay) grounded on Henry Reef, a charted feature in the Great Barrier Reef, Queensland. The cutter was following a passage plan, with an amended route based on one that had been successfully used several times before. The amended route included a route leg plotted across Henry Reef.

Passage and grounding

Pre-departure activities

On 11 September 2017, the 38 m ABFC Roebuck Bay (Figure 1) was alongside in Cairns, Queensland, undergoing a routine crew change prior to commencing a 3-week patrol. Over the next 2 days, the crewmembers prepared the cutter for the patrol with several start-of-patrol and pre-departure checks being completed.

Figure 1: ABFC Roebuck Bay

Source: Australian Border Force

Start of patrol

On 13 September, ABFC Roebuck Bay departed Cairns to commence a patrol northward to the Torres Strait where it was to assume duties under the instructions of the Australian Maritime Border Operations Centre (AMBOC). The cutter was to remain in the strait until 29 September when it was to depart the area for Cairns for the conclusion of the patrol.

On 17 September, while underway, one of three electronic chart display and information system (ECDIS) and radar operation nodes^[2] on the cutter’s bridge malfunctioned and shut down while in use as a radar display. Attempts to re‑boot the system failed and the cutter continued its patrol with two operational bridge displays, capable of being used interchangeably as an ECDIS or radar display.

On 25 September, at about 1549, ABFC Roebuck Bay dropped anchor off Saibai Island in the Torres Strait Islands archipelago. While at anchor, the cutter’s officers and crew performed routine duties and maintained anchor watches.

Passage planning

On 26 September, the navigation officer began to work on the passage plan for the cutter’s return voyage to Cairns. The passage plan, based on a previously used plan, initially consisted of a passage from Saibai Island directly to Cairns with some standing operational taskings en route. The passage plan and associated briefs were completed and then presented to the cutter’s commanding officer (master)^[3] for approval.

The master reviewed the planned route on the ECDIS and made a few amendments. One of these amendments involved moving two planned course alteration positions (waypoints) in the vicinity of Wreck Bay in the Great Barrier Reef. One of the waypoints was moved about 0.2 NM south of its original position and designated waypoint 19 (W19) in the passage plan’s waypoint list. The other waypoint, designated waypoint 20 (W20), was moved about 1 NM west of its original position and resulted in the cutter’s route being inadvertently plotted across Henry Reef (Figure 2).

When the master tried to save the amended route, the ‘Errors’ tab in the route tab folder of the ECDIS’s ‘Edit Route’ menu turned yellow indicating an error in the route. The master advised the navigation officer of his desired amendments to the route and of the error encountered. The navigation officer reviewed the route’s waypoint list in the ECDIS’s route editor table and found the error to be an incorrect turn radius for one of the waypoints. The turn radius was amended, which cleared the error; the error tab reverted to its normal grey colour and changed to ‘No Error’. The master and navigation officer then reviewed the amended route visually and saved it.

Figure 2: Image from ABFC Roebuck Bay's ECDIS showing the section of the overall route with the amended route legs

Image from ABFC Roebuck Bay’s ECDIS display, taken after the grounding, showing the previously used route (orange) and the amended route (red) based on the changed waypoints, W19 and W20.
Source: Australian Border Force, modified and annotated by the ATSB

The passage plan was subsequently split into two routes with a brief stop at Lizard Island, Queensland before continuing on to Cairns for the end of the patrol. The two routes were then saved on the cutter’s ECDIS and named ‘Saibai to Lizard via Outer Reef’ (Figure 3) and ‘Lizard to Cairns’. No further changes were made to the route plan.

Figure 3: Section of navigational chart Aus 4620 showing ABFC Roebuck Bay's planned route and key locations

Source: Australian Hydrographic Office, annotated by the ATSB

On 28 September, a passage plan briefing was conducted. The cutter’s master, engineering officers and officers of the watch were briefed on the details and requirements of the proposed passage from Saibai Island to Lizard Island and then through to Cairns.

Departure from Saibai Island

On 29 September, at about 0953, ABFC Roebuck Bay weighed anchor and departed Saibai Island. The cutter had a maximum draught^[4] of about 1.85 m with the propellers and skegs drawing a further 0.2 m. The route plan ‘Saibai to Lizard via Outer Reef’ was loaded for monitoring on the cutter’s ECDIS. The cutter’s bridge watchkeeping teams comprised an officer of the watch (OOW) and an assistant OOW performing the duties of a designated lookout.^[5] The bridge watchkeeping teams maintained a rotational 4-hour watch roster between 2000 and 0800 and a 3‑hour watch roster between 0800 and 2000.

At about 2048, ABFC Roebuck Bay passed the location of a historic shipwreck, HMS Pandora, and finding nothing of concern, continued its passage south. The cutter’s standing tasks during the passage also included surveillance for unauthorised incursions and activities in the Great Barrier Reef Marine Park.

At about 2345, the OOW and lookout for the next watch (between 0000 and 0400 on 30 September) arrived on the bridge and took over the watch shortly after. The OOW was also the cutter’s navigation officer. The cutter was on autopilot on a heading of about 191º with a speed^[6] of about 16 knots.^[7] The night was partly cloudy with visibility recorded as 6 to 8 NM and the wind from the south-east at 20 knots with a 1 m sea and swell.

While on watch, the OOW was seated with the non-functioning display to his front and the ECDIS display his right. The lookout was seated in front of the radar display (Figure 4). The OOW used the ECDIS to review the cutter’s expected passage over their coming watch and briefed the lookout accordingly. The OOW confirmed with the lookout that the depth sounder’s shallow water alarm was set at 10 m. The lookout was also advised to switch periodically between the radar’s 6 NM and 12 NM range scales on node-2.

Figure 4: Location of bridge team members at the time of grounding

Source: Australian Border Force, annotated by the ATSB

On 30 September, at about 0004, the OOW altered ABFC Roebuck Bay’s heading^[8] to 132° when at waypoint 18 (W18) (Figure 5). A few minutes later, at 0012, the heading was altered to 107° when at W19. Each course alteration was performed by the navigation officer using the autopilot and was logged in the bridge logbook by the lookout. The ECDIS also alerted the OOW that the cutter was approaching a waypoint by displaying a waypoint approach ‘prompt’. These prompts were visual only as the ECDIS audible buzzer was silenced.

At about 0017, as ABFC Roebuck Bay approached W20 at a speed of about 16 knots, the OOW altered the cutter’s heading to 194°.

The grounding

At about 0025, with the cutter about 15 m to east of the planned route, the bridge team felt a bump and a shuddering sensation through the cutter’s hull. Almost immediately after, ABFC Roebuck Bay abruptly grounded on Henry Reef and came to a complete stop (Figure 5). The OOW and lookout were thrown out of their seats onto the display screens in front of them.

Figure 5: Grounding of ABFC Roebuck Bay

Source: Australian Border Force, modified and annotated by the ATSB

The master, who was in his cabin and was woken by the impact of the grounding, went to the bridge and activated the general emergency alarm. The cutter’s crewmembers mustered and were all accounted for. They established that the cutter was aground on a reef and immediately began implementing damage control measures. Initial damage reports indicated that there was water ingress to the storage void space and the tank compartment immediately aft of it, while other spaces and compartments appeared to be intact (Figure 6).

Figure 6: Section of general arrangement plan showing affected spaces

Source: Australian Border Force, modified by the ATSB

Emergency response

By about 0032, bilge pumping was underway and shortly after, at about 0038, an urgency signal^[9] and message was broadcast on the very high frequency radio channel 16, with no response received. A few minutes later, an urgency signal and message was broadcast on channel 14, the designated channel for vessels to contact REEFVTS.^[10] No response was received to either call.

At about 0047, the master called AMBOC by satellite phone and advised them of the grounding. The master requested that AMBOC notify the Australian Maritime Safety Authority’s (AMSA) Joint Rescue Coordination Centre and the designated person ashore at the Australian Border Force (ABF).

At about 0050, ABFC Roebuck Bay broadcast a distress^[11] alert over the cutter’s Inmarsat-C terminal and shortly after, the cutter’s anchor was lowered. Contact was also established with Joint Rescue Coordination Centre via satellite telephone and a situation report provided. Meanwhile, inspections by the cutter’s damage control party revealed hull breaches in the storage void space extending aft into the tank compartment. The damage control party also confirmed the integrity of the cutter’s fuel tanks and that there was no pollution. At the time, the cutter’s fuel tanks held about 18,000 litres of diesel.

At about 0115, the Joint Rescue Coordination Centre tasked AMSA’s emergency towing vessel Coral Knight to respond to ABFC Roebuck Bay’s distress alert. Coral Knight departed Normanby Sound, Queensland for Henry Reef about 15 minutes later with an estimated time of arrival of 1800 later that day. The merchant ship Toll Firefly and an Australian defence vessel were also tasked to divert and render assistance to ABFC Roebuck Bay.

By about 0514, Toll Firefly was on scene and standing by, with communications established. A few minutes later, the cutter started to shift and change heading as a result of the sea conditions and the imminent high water at about 0700. As a precaution, about ½ a shackle (14 metres)^[12] of anchor chain was walked out to allow the cutter to be kedged^[13] back onto the reef should it float into deeper water and start to sink.

At about 0605, shortly after first light, the cutter’s two tenders^[14] were launched to conduct a cursory survey of the waters in the immediate vicinity of the grounding. The survey indicated that there was deep water with depths of between 20 to 30 m at a distance of about 20 m astern of the cutter.

At 1127, an ABF aircraft conducted several passes over Henry Reef to obtain aerial photographs of ABFC Roebuck Bay aground (Figure 7). The weather remained relatively fair with the wind from the south-east at about 14 knots and a 1 m sea and swell.

Figure 7: ABFC Roebuck Bay aground on Henry Reef

Source: Australian Border Force

By about 1306 that afternoon, the Australian Defence Vessel Cape Inscription (ADV Cape Inscription) had arrived on scene. A damage control team with equipment was transferred to the cutter and Toll Firefly was released to resume their passage.

Re-floating of ABFC Roebuck Bay

At about 1730, Coral Knight arrived on location. A 250 m long fibre tow line was connected to a towing point on the cutter’s stern and at about 1820, ABFC Roebuck Bay was towed stern first, off Henry Reef. The cutter’s anchor was also walked out and eventually slipped at the bitter end.^[15] The anchor and chain were left on the reef with a marker buoy attached.

Coral Knight was manoeuvred alongside ABFC Roebuck Bay and made fast to it. Coral Knight used its anchor to arrest the drift of the two vessels while personnel and damage control equipment were transferred and consolidated between the two vessels. On board ABFC Roebuck Bay, the water level in the flooded storage void space appeared to be stable and the completely flooded tank compartment was sealed off. There were several other leaks in various spaces including the plant room and forepeak space, but these were controlled using the cutter’s built-in bilge system or available portable pumps.

Passage to Cairns

At about 2200, with the weather deteriorating to south-westerly winds at 20 knots and 2 m seas, a decision was made to commence towing ABFC Roebuck Bay immediately. By 2254, Coral Knight had weighed anchor and at about 2307, Coral Knight commenced towing ABFC Roebuck Bay in the general direction of Cairns. Regular rounds were conducted to inspect and pump affected spaces on board the cutter and shortly after midnight, all non-essential personnel were transferred to Coral Knight. The tow proceeded at an average speed of about 3.5 to 4 knots (Figure 8) and by midnight on 1 October, the tow had passed through LADS passage (Figure 3). Regular situation reports were provided by Coral Knight’s master at about 3-hour intervals to all involved parties including AMBOC, AMSA and ABF.

Figure 8: ABFC Roebuck Bay under tow by Coral Knight

Source: Master, Coral Knight

On 2 October, ABFC Roebuck Bay suffered a reduction in bilge pumping capacity with the failure of three pumps. The speed of the tow was immediately reduced while arrangements were made to reinstate the redundancy of the cutter’s pumping capability. At about 1400, a nearby vessel, Bhagwan Dryden, provided a portable electric pump and at about 1520, an AMSA aircraft airdropped two petrol driven pumps along with several lengths of hose. With the pumps tested and operational, the tow resumed.

Meanwhile, arrangements were made ashore for a vessel to deliver several submersible pumps and other damage control equipment to ABFC Roebuck Bay off Cooktown, Queensland the next day. Salvage and emergency response specialists from Ardent Global Marine Services (Ardent) were also engaged and scheduled to board the cutter off Cooktown.

On 3 October, at about 1820, personnel and equipment transfers were conducted off Cooktown. Two additional ABF personnel and a salvage specialist were embarked on board ABFC Roebuck Bay while two ABF personnel were disembarked for transfer ashore.

By about 1915, after an assessment by the salvage specialist, ABFC Roebuck Bay and Coral Knight’s masters agreed that it was safe to continue the tow to Cairns. AMBOC was advised and at about 2015, Coral Knight’s master was formally directed by AMBOC to proceed to Cairns.

At about 0847 on 5 October, ABFC Roebuck Bay arrived at a marine yard in Cairns and was lifted out of the water and transferred onto blocks ashore.

Damage

Damage to ABFC Roebuck Bay

ABFC Roebuck Bay sustained substantial damage as a result of the grounding rendering the cutter unseaworthy. The storage void space and tank compartment (Figure 9) were both breached and flooded in way of the keel section with significant seawater damage to all electrical fittings in the two spaces.

Figure 9: Damage to ABFC Roebuck Bay's keel

Source: ATSB

Externally, the port and starboard ride control fins were found holed and bent. Similarly, the port and starboard skegs were found breached with a loss of watertight integrity and both stern tubes had sustained misalignments. The port and starboard propeller blades were also found to have sustained extensive damage, especially to the blade tips, and both rudders showed minor deformation to the lower section of their trailing edges (Figure 10).^[16]

Figure 10: Damage to ABFC Roebuck Bay's propellers, rudders and skegs

Source: ATSB

Damage to Henry Reef

In October 2017, officers from the Great Barrier Reef Marine Park Authority and Queensland Parks and Wildlife Service conducted a site assessment of Henry Reef. The assessment found that the maximum extent of physical reef damage occurred within an area of about 990 m2 on the north-western aspect of Henry Reef.^[17] At the time of the assessment, ABFC Roebuck Bay’s 184 kg anchor and about 150 m of anchor chain remained on the reef (Figure 11).

Figure 11: ABFC Roebuck Bay's anchor and chain on Henry Reef

Source: Australian Border Force, modified by the ATSB

The assessment report concluded with recommendations to remove the anchor, chain and any other metal and anti-foul paint still on‑site and to stabilise coral debris on the reef. In November 2017, ABFC Roebuck Bay’s anchor and chain was removed from Henry Reef. There was no reported oil pollution as a result of the grounding.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. In this case, a console and associated computer system used to operate ECDIS and/or radar.
3. Under Australian Border Force nomenclature, the master of an ABF vessel is known as the commanding officer.
4. Draught is the vertical distance between the keel of the ship and the waterline at any position.
5. Under Australian Border Force nomenclature, a rating forming part of a navigational watch is known as an assistant officer of the watch.
6. All ship speeds referred to in this report are ‘made good/over the ground’.
7. One knot, or one nautical mile per hour equals 1.852 kilometres per hour.
8. All ship’s headings in this report are in degrees by gyrocompass with negligible error.
9. The urgency signal consists of the words ‘PAN PAN’ and indicates that the station sending it has a very urgent message to transmit concerning the safety of a vessel, aircraft or person.
10. The Great Barrier Reef and Torres Strait Vessel Traffic Service, operated by Maritime Safety Queensland as a Vessel Traffic Service (VTS) authority approved by the Australian Maritime Safety Authority (AMSA).
11. A distress alert or distress call indicates that a vessel or person is threatened by grave and imminent danger and requires immediate assistance.
12. One shackle equals approximately 27.5 m of chain.
13. Kedge: To move a ship or boat along by means of a hawser or chain attached to an anchor.
14. Tender: A small boat usually carried by a larger vessel for service or support, in this case, used for rescue, interception and the deployment of boarding parties.
15. The inboard end of the anchor cable that is secured to a strong point normally with some form of quick-release arrangement to allow the cable to be safely slipped in the event of an emergency.
16. The cutter has since been repaired and, after a period of sea trials, was returned to active service in September 2018.
17. Great Barrier Reef Marine Park Authority, 2017, Site assessment of damage report: Australian Border Force vessel Roebuck Bay – Henry Reef (12-053), GBRMPA, Townsville. Available at www.gbrmpa.gov.au

Context

Australian Border Force

The Australian Border Force (ABF) is an operationally independent agency under the Australian Government’s Home Affairs portfolio and is responsible for the protection of Australia’s border. The ABF was established on 1 July 2015, when the Australian Customs and Border Protection Service integrated with the Department of Immigration and Border Protection.

Australian Border Force (ABF) officers and assets form part of an enforcement body that patrol Australia’s air and seaports, remote locations, mail and cargo centres and Australia’s extended maritime jurisdiction. The ABF Marine Unit maintains an armed maritime capability around Australia’s coastline and responds to reported or suspected border incidents and illegal activity.

The ABF manages a fleet of patrol boats and specialist vessels that operate within and beyond Australia’s exclusive economic zone. The ABF marine fleet included eight Cape class patrol boats, two Bay class cutters, ABFC Ocean Shield, ABFC Thaiyak and about 51 other smaller vessels.

ABFC Roebuck Bay

ABFC Roebuck Bay was owned by the ABF and classed with DNV GL (Det Norske Veritas - Germanischer Lloyd). As an ABF vessel, ABFC Roebuck Bay was a regulated Australian vessel under the Navigation Act 2012.^[18]

ABFC Roebuck Bay was the first of eight 38-m Bay class cutters that saw service with the ABF. The cutter was built and delivered by Austal Ships in 1999. From March 2013, eight new Cape class patrol boats began to replace the Bay class fleet, which were progressively stood down.

ABFC Roebuck Bay was removed from service in 2014. However, the cutter, along with another Bay class cutter, was brought back into service in 2015. Since then, the cutter has primarily been deployed in the Great Barrier Reef and Torres Strait.

Equipment

As a regulated Australian vessel, ABFC Roebuck Bay was subject to the requirements of the applicable Marine Orders^[19] issued by the Australian Maritime Safety Authority (AMSA). Therefore, ABFC Roebuck Bay was required to comply with the navigation equipment requirements of Marine Order 27.^[20] The cutter’s bridge navigation equipment included:

• two differential GPS receiver units^[21]
• two radars with automatic radar plotting aid capability
• an automatic identification system transceiver
• depth sounder
• gyrocompass
• radio equipment
• a bridge navigation watch alarm system.^[22]

The cutter was not equipped with a voyage data recorder^[23] nor was it required to be.

ABF procedures included checks of all navigation equipment prior to the cutter commencing the patrol. The navigation officer completed the electronic chart display and information system (ECDIS) start-up checklist, the navigation pre-departure checklist, and the bridge departure checklist while alongside in Cairns on 12 September 2017.

As part of the checks, an accuracy comparison was conducted for the two bridge differential GPS units, which were confirmed to be accurate to within 50 m. The cutter also carried two handheld GPS units and a GPS unit in each of the two tenders, which were also compared and found to be satisfactorily accurate.

Charts

As a regulated Australian vessel, ABFC Roebuck Bay was required to carry adequate and up‑to‑date official nautical charts for the intended voyage. At the time of the grounding, ABFC Roebuck Bay’s primary means of navigation, as recorded in the cutter’s record of equipment attached to its certificate of survey, was an ECDIS (see Electronic chart display and information system for details). Therefore, on board ABFC Roebuck Bay, ECDIS was being used to meet the chart carriage requirements of the regulations. Consequently, the equipment was required to comply with SOLAS^[24] regulations and International Maritime Organization (IMO) standards for ECDIS, as referenced in Marine Order 27.

ABFC Roebuck Bay was using official Electronic Navigational Charts (ENCs) issued by the Australian Hydrographic Office (AHO).^[25] The cutter’s ECDIS units were updated on 23 September 2017 to the latest Australian ENC updates available at the time (Week 38-2017).

Operating crew

The cutter had a crew of 11 Australian nationals. The cutter’s complement of watchkeeping officers comprised the master, a deputy commanding officer, a navigation officer and a communications officer. Other crew included two engineering officers, four marine tactical officers and a cook.

The master held a valid Australian Master’s (Master less than 500 gross tonnage) certificate of competency. He had about 27 years’ experience at sea, initially with the Queensland water police and then, from about 2004, with the ABF and its predecessor. He had sailed as master primarily on Bay class cutters, since 2015, although he had acted in the role several times before. The master had completed a generic ECDIS training course in July 2014 and online type-specific ECDIS familiarisation training in December 2014 (see ECDIS training requirements for details).

The navigation officer held a valid Australian Master’s (Master Class 4) certificate of competency and had about 21 years’ experience at sea in various roles including fisheries investigations and compliance. He had been in the ABF for about 5 years and had sailed as an officer of the watch (OOW), primarily on Bay class cutters, since December 2015. During this time, he served in the roles of navigation officer, deputy commanding officer and communications officer on a rotating basis. The navigation officer had completed generic ECDIS training in May 2016 and online type‑specific ECDIS familiarisation training in June 2016.

Both of ABFC Roebuck Bay’s other watchkeeping officers also held appropriate certificates of competency and had completed generic and type-specific ECDIS familiarisation training.

Fatigue

The ATSB analysed the master’s, navigation officer’s and lookout’s recorded hours of rest in the days leading up to, and at the time of the grounding.

The passage planning process including planning, amendment, checking and approval was conducted by the navigation officer and master while the cutter was at anchor over a period of several days. The ATSB analysed their recorded hours of rest in the days leading up to the grounding and found that they were compliant with the minimum hours of rest as required by ABF procedures and the relevant AMSA Marine Order. The ATSB analysis also indicated that fatigue levels during the time at anchor likely fluctuated depending on factors such as time of day for the task, time on task, workload and environmental factors. However, there was no evidence to indicate a high likelihood of either officer experiencing levels of fatigue known to have a demonstrated effect on performance during the stages of the passage planning process.

Recorded hours of rest for the navigation officer and lookout, after departing Saibai Island and up until the grounding also appeared to comply with the minimum hours of rest requirements. Analysis of the navigation officer’s hours of rest indicated that there was a low likelihood that he was experiencing a level of fatigue known to have a demonstrated effect on performance at the time of the grounding.

Safety management system

ABFC Roebuck Bay operated under the ABF safety management system (SMS). The SMS was applicable to all ABF vessels and associated personnel. The primary aim of the SMS was stated to be:

…the promotion of the development and application of an organisational safety culture.

The SMS was structured to be compliant with the International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code)^[26] as well as AMSA’s National Standard for Commercial Vessels. The ABF also held a document of compliance^[27] issued by Lloyd’s Register and most ABF vessels held safety management certificates,^[28] on a voluntary basis. At the time of the grounding, ABFC Roebuck Bay did not hold a safety management certificate, nor was the cutter required to.

The SMS was divided into seven volumes. The first volume contained general policies, principles and documents called ‘work instructions’ applicable to all vessels and staff. These ‘work instructions’ were similar to standard operating procedures and provided instruction and guidance on the conduct of various vessel activities such as passage planning, use of ECDIS and the navigational standards expected of all ABF vessels. The other volumes contained forms and work instructions applicable to specific vessels or vessel classes.

ABF internal audits

ABF vessels were subject to annual internal audits by ABF auditors. They comprised a compliance audit of the vessel’s documentation followed by an operational assessment. The operational assessment was designed to assess the crew’s competency, skill, knowledge and understanding of compliance with relevant ABF policies, legislation, standards and practices. Internal audits focussed primarily on the assessment of the vessel’s operational readiness and emergency preparedness. There was little emphasis placed on specifically auditing vessel compliance with passage planning and navigational work instructions.

ABFC Roebuck Bay’s master and navigation officer were last audited while serving together on board ABFC Storm Bay in November 2016. At the time of the assessment, the navigation officer was acting in the role of OOW and therefore, not performing the duties of the navigation officer. The report concluded that the crew showed a high level of competency with regard to the execution of procedures, policies and the use of equipment on board the cutter.

Vessel management plan

A vessel management plan is a provision of the Navigation Act 2012 (Cth) that allows for situations where an ABF vessel or person would not otherwise comply with certain provisions of the Act, such as those related to the safety of navigation. It requires that a plan be developed with specific requirements to be met by the vessel or person and for this plan to be reviewed and accepted by AMSA. At the time of the grounding, ABFC Roebuck Bay did not have a vessel management plan in place.

Australian Maritime Safety Authority

As a flag State, AMSA maintains the responsibilities and obligations imposed by international conventions for vessels flying the Australian flag. As such, AMSA is responsible for ensuring that Australian vessels comply with the relevant legislation.

AMSA delegates certain flag State administration functions to recognised organisations. These recognised organisations, known as classification societies, take on certain survey and certification functions on behalf of AMSA for vessels registered in Australia. These recognised organisations include classification societies such as DNV GL and Lloyd’s Register.

ABFC Roebuck Bay, like many other ABF vessels, was classed with DNV GL. As a recognised organisation acting on behalf of AMSA, DNV GL surveyed and certified ABF vessels to ensure their compliance with the relevant legislation.

Electronic chart display and information system

An electronic chart display system is a general term for a configuration of electronic equipment, software, and nautical chart data that is capable of integrating position, speed and heading data to display the vessel’s position and movement through the water, superimposed on an electronic chart.

There are two classes of electronic chart display systems - an electronic chart display and information system (ECDIS) and an electronic chart system (ECS). ECDIS can be used to meet SOLAS chart carriage requirements whereas an ECS can be used to assist navigation but does not meet the chart carriage requirements of SOLAS.

ECDIS and its use as the primary means of navigation at sea, is a relatively new development. ECDIS was first recognised as being able to meet the chart carriage requirements of the regulations in 2002. By July 2018, the fitting of ECDIS became mandatory for almost all passenger vessels and merchant ships.

An ECDIS, as defined in the IMO ECDIS performance standards,^[29] means

a navigation system which, with adequate back-up arrangements, can be accepted as complying with the up-to-date chart required by regulations V/19 and V/27 of the 1974 SOLAS convention, as amended, by displaying selected information from a system electronic navigational chart (SENC) with positional information from navigation sensors to assist the mariner in route planning and route monitoring, and if required display additional navigation-related information.

The primary function of ECDIS is to contribute to safe navigation. Under the IMO’s performance standards, an ECDIS should offer the ability to execute all route planning, route monitoring and positioning as can be performed on paper charts and provide appropriate alarms or indications.

In general, where an ECDIS is being used to meet the chart carriage requirements of SOLAS, it must:^[30]

• be type-approved
• use up-to-date official electronic nautical charts
• be maintained so as to be compatible with the latest applicable International Hydrographic Organization (IHO) standards
• have adequate, independent back-up arrangements in place.

The type-approval process ensures that ECDIS equipment complies with the IMO ECDIS performance standards. Type-approval is conducted by testing an ECDIS against several test requirements developed by the International Electrotechnical Commission. These type-approval tests are normally conducted by recognised type-approval organisations or by marine classification societies and result in the issue of a type-approval certificate.

ECDIS software that is not updated to the latest version of the IHO standards may not meet the chart carriage requirements of the regulations. This is because an ECDIS that is not upgraded to read ENCs based on the latest version of the IHO standards may not be capable of displaying all the relevant digital information contained in the ENC. For example, the ECDIS may be unable to correctly display the latest chart features. In addition, symbols, alarms and indications may not be activated for features even though they have been included in the ENC.

ECDIS safety settings

ECDIS safety settings such as the safety contour and safety depth allow the ECDIS display to be to be set up to reflect the vessel’s specific circumstances and characteristics. It also allows the ECDIS’s in-built safety functions to compare the safety settings with ENC’s depth information and to generate an alarm or indication where the safety settings have been contravened. As such, ECDIS has the potential to increase situational awareness and safety, allowing the OOW more time to concentrate on a visual lookout.^[31]

The safety contour value, set by the user, is based on factors such as the vessel’s draft and required under-keel clearance. This is shown on the chart display as a bold black line, which marks the limit between navigable and non-navigable water for the vessel. Spot soundings shallower than the user‑entered safety depth value appear in a bold black font. There is a distinctive change in colour between waters that are deeper and shallower than the safety contour. When used in the four colour scheme, additional settings for ‘shallow’ and ‘deep’ contour values become available (Figure 12). Based on these settings, the ECDIS then displays waters between these contours in different colour shades allowing for an enhanced chart display. Other important ECDIS safety features such as conditional symbolisation and the chart dangers look‑ahead function also depend on appropriate safety depth settings to be effective.

Figure 12: ECDIS display in the two colour scheme (L) and four colour scheme (R)

Source: U.S. Chart No.1, National Oceanic and Atmospheric Administration and National Geospatial-Intelligence Agency, modified and annotated by the ATSB

ABFC Roebuck Bay’s ECDIS was set-up to use the four colour scheme and the safety depth was set at 5 m. The safety depth also provided the safety contour setting on ABFC Roebuck Bay’s ECDIS. The shallow contour was also set at 5 m and the deep contour was set at 10 m. Therefore, on ABFC Roebuck Bay’s ECDIS display, all waters deeper than 10 m would appear white, all waters between 5 and 10 m would appear grey, and all waters shallower than 5 m would appear dark blue. Based on these settings, there would have been no areas shaded light blue. The use of the same 5 m setting for the safety contour and shallow contour values removed any advantages offered by the four colour display scheme by reducing the ECDIS display to a three colour scheme. The 5 m contour (or the next deepest contour if there was no 5 m contour) would have appeared as a bold, black line. All spot soundings less than 5 m would have appeared in black while those deeper and unlikely to affect the vessel would have appeared in grey.

ECDIS display modes

ECDIS users can control the level of chart detail and features displayed using three different display modes common to all ECDIS. The three display modes are:

• ‘Base’ display: This is the minimum level of information required to be displayed on the ECDIS at all times. It is not intended to be sufficient for safe navigation.
• ‘Standard’ display: This display mode includes all features defined by the ‘Base’ display plus additional features. This display is usually considered to be the minimum information that should be displayed at all times. It should be possible to return to this display mode by a single key stroke.
• Other: This display mode presents all available ENC information on the ECDIS display. This can result in the ECDIS display becoming very cluttered. Most ECDIS manufacturers allow the display to be customised to display information relevant to the mariner’s needs. This can be done by adding feature categories to the ‘Standard’ display or by progressively removing feature categories from the ‘Other/All’ information mode.

ABFC Roebuck Bay’s ECDIS was required to be set-up on the ‘Other’ display mode with all information selected. Feature categories could then be selected or de-selected depending on circumstances.

ECDIS alarms and indications

The IMO ECDIS performance standards require that an ECDIS generate alarms or indications in defined circumstances. An alarm, announced by audible means or, audible and visual means, the existence of a condition requiring attention. An indication gave information about the condition of a system or equipment by means of a visual indicator only.^[32]

In the route planning stage, the standards required that the ECDIS provide an indication if a route was planned over the vessel’s safety contour or closer than a defined distance from certain areas or objects such as isolated dangers.

In the route monitoring stage, the ECDIS was required to provide an alarm if the vessel was going to cross the safety contour in a given time and an indication if the vessel was going to pass closer than a specified distance from a rock, wreck or obstruction.

Presentation Library

The actual appearance of an object on an ECDIS display is governed by the IHO standard S-52^[33] Presentation Library. The presentation library is a large electronic document containing the rules and information that define how an object or attribute is displayed on an ECDIS. It controls the graphical display of the ENC in ECDIS, including the symbols used to depict the features and colours.

Following investigations into operational anomalies in certain ECDIS, the IHO undertook a review of its ECDIS standards in 2012. The review found that certain requirements of the IHO ECDIS standards had been interpreted and implemented in different ways by various manufacturers. As a result of the investigations, a number of improvements were identified to reduce the risk of implementation irregularities and to improve standards. The review led to the development of three new editions of IHO ECDIS related standards—the IHO S-52 ECDIS Presentation Library – Edition 4.0 (PresLib 4.0), IHO S-63 Data Protection Scheme – Edition 1.2 and IHO S-64 test Data Sets for ECDIS – Edition 3.0.

The IHO issued PresLib 4.0 in September 2014. An eventual implementation date of 31 August 2017 was agreed upon to allow manufacturers time to develop software compliant with the new standard. The new standard was extensively updated to address display anomalies associated with the previous presentation library and improve ECDIS user experience. Among the principal benefits of the new presentation library was a reduction in alarms to address alarm fatigue^[34] and the introduction of an alert model to harmonise ECDIS alarm and indication behaviour. A number of new symbols were also introduced including symbology to highlight objects that posed a navigational hazard to the vessel.

In order to meet the chart carriage requirements of SOLAS, ECDIS needed to be maintained so as to be compatible with the latest applicable IHO standards. Therefore, the IHO S-52 standard Presentation Library – Edition 3.4 (PresLib 3.4) was to be replaced by PresLib 4.0 by 31 August 2017. After this date, PresLib 3.4 was no longer valid. Essentially, this meant that vessels with ECDIS running the old presentation library after 31 August 2017 might be unable to correctly display the latest ENC features and symbols or activate appropriate alarms and indications.

At the time of the grounding, ABFC Roebuck Bay’s ECDIS was operating on PresLib 3.4, although PresLib 4.0 was in force.

ECDIS on board ABFC Roebuck Bay

In the ABF marine fleet, the first use of ECDIS to meet the chart carriage requirements was on the Cape class cutters, which began to enter service in 2013. Prior to this, paper charts were the primary means of navigation. In addition, some cutters also carried an ECS as an aid to navigation.

In May 2017, ABFC Roebuck Bay was upgraded from using paper charts as the primary means of navigation (with an ECS as a navigation aid), to ECDIS. Like most other ABF cutters, it was equipped with a VisionMaster FT Naval ECDIS and radar system (VisionMaster FT) manufactured by Northrop Grumman Sperry Marine.

The VisionMaster FT system was installed and configured in a ‘Total Watch’ configuration. The system was operated as a multi-node system utilising four nodes and four associated multi‑function displays (three on the bridge and one on a deck below). The ‘Total Watch’ configuration allowed for redundancy and meant that each node could be presented either as an ECDIS or as a radar display, as required.

As the vessel’s owner, ABF had a responsibility to ensure that the installed equipment complied with the relevant ECDIS standards and regulations, including being type-approved, as referenced in Marine Order 27.

Survey and certification

Following initial installation of the ECDIS, DNV GL surveyed ABFC Roebuck Bay and the ECDIS was function tested during sea trials in June 2017. During the survey, a type‑approval certificate for the ECDIS, issued by Lloyd’s Register and listing software version 7.0.0, was presented to the surveyor. The survey statement recorded that a type-approved VisionMaster FT ECDIS operating on software version 7.0.0 had been installed on board, function tested and found satisfactory.

Consequently, on 16 June 2017, ABFC Roebuck Bay was certified by DNV GL as a vessel using a type-approved (commercial) ECDIS as its primary means of navigation.

ECDIS operating software

ATSB examination of ABFC Roebuck Bay’s ECDIS equipment after the grounding found that the ECDIS was operating with a naval software version (Ver. MA 1.10.0.62) that was not type‑approved. Evidence indicated that the VisionMaster FT system was installed on board ABFC Roebuck Bay pre-loaded with the non-type-approved naval software.

The manufacturer, Northrop Grumman Sperry Marine, advised that only commercial software versions were type‑approved. The naval software was then developed by adding naval features to the type-approved commercial software. The naval software retained the same functionality as the commercial ECDIS software with regard to chart display, safety checking, route planning and route monitoring. However, although based on the type-approved commercial software, these naval software versions were not type-approved, with no type-approval certificates available. The manufacturer indicated that this was because certain features of the naval software versions would not pass the tests required for type-approval. The additional naval features were largely tactical or operational features unrelated to navigational safety.

With regard to the cutter’s survey, the provision of correct information is understood to be a general obligation of classification. However, DNV GL advised that they were not informed that non-type-approved software, different to that listed on the type-approval certificate, was in use on the installed ECDIS. This discrepancy was also not identified during the survey on 16 June 2017.

Software updates

The naval software version in-use on board ABFC Roebuck Bay and the type-approved commercial software version it was based on (Ver. 8.0.0.2614) were first released by the manufacturer in March 2016. A new commercial software version (Ver. 9.0.0.390) was released by the manufacturer in May 2017. A key objective of this new software version was to introduce the new IHO S-52 standard and PresLib 4.0, which came into effect after 31 August 2017.

At the time of the grounding, the update to the naval software version introducing the new standard and PresLib 4.0 was not available from the manufacturer. Therefore, ABFC Roebuck Bay, and at least nine other ABF vessels, had not been updated and were still operating on PresLib 3.4. An updated naval software version (Ver. MA 2.0.0.60) was subsequently released in November 2017. This software and in some cases, necessary replacement hardware, became available to ABF vessels in May 2018.

AMSA required that ECDIS be maintained up-to-date and operate effectively in compliance with the latest applicable versions of the IHO standards. DNV GL recommended that vessel owners contact their ECDIS manufacturer to upgrade their ECDIS to ensure compliance with the new standards. Guidance from the manufacturer and other industry sources also emphasised the need for vessels to upgrade to the latest version of the IHO S-52 standard and PresLib 4.0 by 31 August 2017.

ABF ECDIS procedures

ABF work instructions^[35] covering the use of ECDIS comprised operating procedures common to all classes of ABF vessels fitted with ECDIS. The instructions noted that ECDIS navigation was fundamentally different from navigation with paper charts and identified that the safe use of ECDIS required appropriately trained officers and bridge procedures.

The ABF ECDIS work instructions consisted of operating procedures for the use of ECDIS and seven annexes, named A to G, comprising equipment familiarisation diagrams and checklists for the set-up and use of ECDIS.

Annex A of the work instructions comprised an ‘ECDIS Start-up Checklist’ intended for use at the start of every patrol and after every system restart (Appendix A). However, there was no specific reference to the checklist in the body of the work instructions and no guidance as to whether the checklist needed to be retained for record keeping purposes.

Annex B consisted of an ‘ECDIS Management Card’, which could be filled out to provide the OOW with a summary of environmental information and ECDIS system settings. The work instructions did not mandate its use, stating only that it ‘may be used’. There was no evidence of its use on board ABFC Roebuck Bay.

Annex C comprised a document called ‘ECDIS Recommended Information Layers – Port/Coastal/Open Ocean’ (Appendix B). The checklist provided different ECDIS settings based on the nature of the waters in which the vessel was navigating and was divided into three categories—restricted waters, coastal waters and open ocean. There was no specific guidance or instructions on the use of this checklist in the work instructions, whether it applied to Bay class vessels, and no clear definition of what constituted the three categories of waters.

The master and navigation officer’s interpretation of the three categories was that they were to be set-up as three separate user-profiles. The appropriate user-profile and its associated settings could then be applied to the ECDIS depending on the waters in which the vessel was navigating. However, this understanding of the use and applicability of this checklist was not supported by the ECDIS work instructions, training, or operational experience. In any case, there were no equivalent user-profiles set-up on board ABFC Roebuck Bay.

Annexes D, E, F and G comprised bridge equipment familiarisation diagrams for the various vessel types in use with the ABF.

ECDIS configuration and settings

ECDIS start-up checklist

ABFC Roebuck Bay’s ECDIS was reported to have been set up according to the ‘ECDIS Start-up Checklist’ in Annex A.

Key settings as provided under the Annex A—ECDIS Start-up Checklist were:

• node-3 un-silenced
• scale bar – set to ‘Compilation scale’ and ‘Auto-scale’
• chart settings – ‘Features’ set to ‘Other’ and select ‘All’
• overscale pattern – checked
• SCAMIN filtering – checked
• ‘Text’ – all boxes checked
• safety depth – 5 m
• shallow contour – 5 m
• deep contour – 10 m
• look-ahead span
  • look-ahead: time 3 minutes or distance 1 NM
  • proximity: added breadth 20 m
• alarm – ‘Alarm on cautions’ checked.

The settings in the ‘ECDIS Start-up Checklist’ most closely resembled the recommended settings for the ‘restricted waters’ category of the Annex C checklist, with a few key differences. The most significant difference between the two checklists concerned the lateral extent of the safety look‑ahead function setting. The ECDIS start-up checklist prescribed the VisionMaster FT ECDIS’s default look-ahead added breadth setting of 20 m while the ‘restricted waters’ category of the Annex C checklist recommended a setting of 0.1 NM (about 185 m) and was referred to as the ‘Look Ahead (Anti-grounding cone – XTE)’.^[36] While the Annex C checklist used a different term for the look-ahead added breadth setting, the fact that it pertained to the look-ahead function settings was clear. The effectiveness of the ECDIS look-ahead safety checking function could be significantly affected depending on the value of the setting.

Audible alert buzzer

At the time of the grounding, the audible alert buzzer on ABFC Roebuck Bay’s ECDIS was permanently silenced. The buzzer was silenced on the master’s orders to reduce alarm fatigue from ECDIS audible alerts and to prevent it distracting the officers during their watchkeeping duties. However, visual alerts would still be presented on the ECDIS. Other bridge equipment such as the depth sounder also contributed to the preponderance of audible alerts on the bridge. These alerts and possibly those from other equipment were likely replicated on the ECDIS thereby contributing to the number of audible alerts being generated and influencing the decision to silence the buzzer.

Compilation scale

The work instructions required that the primary ECDIS display node (node-3) should always remain in ‘compilation scale’ (See Electronic Navigational Charts below for details). Zooming and forward panning was only to occur on other display nodes. The ATSB could not establish the scale that was in use at the time of the grounding although the OOW reported that the ECDIS display was generally set to the compilation scale. However, this was sometimes increased to larger scales when navigating in relatively restricted waters such as those around Henry Reef.

The technical failure of node-1 meant that there were only two operational nodes on the bridge at the time of the grounding. Node-3 was being used by the OOW as the primary ECDIS display and node-2 was being used as a radar display. However, interview evidence and the ABF work instructions indicated that node-1 was normally used as a second radar display. Therefore, the unavailability of node-1 is unlikely to have influenced events on the night of the grounding.

Day-night mode

The preference as to whether the ECDIS display was used in the ‘day’ mode or ‘night’ mode was left to the OOW. At the time of the grounding, the ECDIS display was reported to have been in ‘day’ mode, but with the screen brilliance setting dimmed so as not to affect the watchkeepers’ (OOW and lookout’s) night vision.

ECDIS training requirements

The International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (The STCW Code)^[37] covers the minimum training and competency requirements for officers who carry out navigational tasks. The need for these officers to have a thorough knowledge of, and ability to use nautical charts and by extension, ECDIS, is clearly covered in Part-A of Chapter II of the Code. AMSA’s Marine Order 27 gives effect to these requirements. This means that masters and deck watchkeeping officers on vessels carrying ECDIS as the primary means of navigation must have completed an approved training course in its use. This requirement is usually met by the completion of an approved generic ECDIS training course.

The STCW Code also requires masters and officers to be familiar with the specific type of ECDIS fitted to their vessel. This requirement for equipment familiarisation is also recognised under the ISM Code and required by AMSA.

Generic ECDIS training

The objective of the generic ECDIS training course is to impart sufficient knowledge, skill and understanding of ECDIS navigation and ENCs to allow the mariner to undertake the duties of a navigational watchkeeping officer. AMSA-approved generic ECDIS training courses were based on, and conducted in accordance with the IMO Model Course 1.27.^[38]

The generic ECDIS training course is usually conducted in a classroom setting with an instructor, usually over a period of about 5 days (40 hours). The course comprised lectures, guided and independent practice on ECDIS simulators, and an evaluation. The IMO model course syllabus was divided into five main topics:

• elements of ECDIS
• watchkeeping with ECDIS
• ECDIS route planning and monitoring
• ECDIS targets, charts and system
• ECDIS responsibility and assessment.

The course syllabus then specified elements that were to be included within these five main topics. For example, the ‘Elements of ECDIS’ topic included an introduction to the purpose and value of ECDIS to navigation and the understanding of chart data, quality and accuracy. The ‘ECDIS route planning and monitoring’ topic covered the planning, checking and monitoring of routes on ECDIS. In particular, the syllabus covered the planning, checking and monitoring of routes for isolated dangers using ECDIS.

If the generic ECDIS training was conducted on the same make and model of ECDIS equipment installed on board, such training usually fulfilled the requirement for ECDIS type-specific familiarisation as well. However, where the shipboard ECDIS equipment was different, there was still a need for familiarisation specific to the type of ECDIS installed onboard.

Type-specific ECDIS familiarisation

At present, there are estimated to be more than 30 different makes and models of ECDIS available for use at sea. While most type-approved ECDIS can be expected to meet the minimum IMO performance standards, there can be significant variation in their design, operation, terminology and, most importantly, in the user interface used for reconciling route dangers to the user. It is a recognised fact that there are many different makes and models of navigation equipment, including ECDIS, each with differing displays, interfaces and controls. This variation poses a number of challenges for mariners. Apart from the need for familiarisation, the variation in equipment also has the potential to reduce efficiency, degrade situational awareness, hinder decision-making and jeopardise safety.^[39] Efforts to address this issue are now advanced with agreement for a standardised mode common across all ECDIS models.^[40]

Training and instructional experiences are always approached from a position of prior knowledge or skill. Trainees usually have existing mental models, which provide a basis for gaining new knowledge. However, these existing mental models can also be an impediment. Research shows that prior knowledge will not necessarily be discarded once new knowledge is provided. Instead, a combination of both may be retained, especially if experience is unlikely to yield any inconsistencies.^[41] A mariner, either through training or during service at sea, can be exposed to multiple ECDIS models.

Operational knowledge of a particular ECDIS, if applied to a different system can have negative consequences. ECDIS type-specific familiarisation is intended to ensure that officers are familiar with the specific make and model of ECDIS in-use on board their vessel. This relies on an effective, structured type-specific familiarisation process.

AMSA guidance on type-specific ECDIS familiarisation stated that it should follow a structured plan and cover the following areas:

• familiarisation with available functions
• familiarisation with the menu structure
• display setup
• setting of safety values
• recognition of alarms and malfunction indicators, and action to be taken
• route planning
• route monitoring
• changing over to backup systems
• loading charts and licenses
• updating of software.

AMSA guidelines also stated that ‘trickle-down familiarisation’ (for example, one officer training another) was unacceptable as it was unstructured and led to incomplete knowledge of the system.

ECDIS training for ABF personnel

ABFC Roebuck Bay’s master and navigation officer had intermittently served on cutters equipped with ECDIS since they were introduced into the ABF fleet in 2013. Although they had previously used electronic chart systems as a navigation aid, most of their seagoing experience was on vessels using paper charts as the primary means of navigation. Furthermore, almost all navigation training and studies undertaken in the course of gaining their seagoing deck officer qualifications were predominantly conducted on paper charts, as was also the case for most watchkeeping officers in general.

With the introduction of ECDIS into the ABF fleet, deck watchkeeping officers were required to complete generic ECDIS training and type-specific ECDIS familiarisation training. In addition, ABF procedures required officers to complete task books for their roles, and undergo initial and annual continuation familiarisation training.

Generic ECDIS training

ABFC Roebuck Bay’s master completed generic ECDIS training utilising Endeavour Navigator ECDIS software. The navigation officer completed generic ECDIS training using a Kongsberg K‑Bridge ECDIS. The Kongsberg K-Bridge ECDIS was also used in the delivery of the generic ECDIS training for both the other watchkeeping officers on board ABFC Roebuck Bay.

Therefore, all four watchkeeping officers on board ABFC Roebuck Bay, including the master and navigation officer, had completed AMSA approved generic ECDIS training courses that were largely aligned with the guidance in the IMO Model Course 1.27.

Type-specific ECDIS familiarisation training

To meet the requirement for ECDIS familiarisation, ABF deck officers underwent type-specific ECDIS familiarisation training. Type-specific ECDIS familiarisation training for the VisionMaster FT ECDIS was provided in the form of an online computer based training course delivered by Safebridge.^[42] The online course was approved by the manufacturer. The training was delivered using the manufacturer’s commercial ECDIS software rather than the naval version installed on ABFC Roebuck Bay, but the key navigational functions were identical in both software versions. The training course comprised a structured tutorial with guided learning content and a test. It also allowed the user a period of 3 weeks to familiarise themselves, and gain experience with, the use and operation of the ECDIS software in a ‘free play’ mode.

The tutorial phase consisted of several guided modules and sub-modules covering the operational use of the VisionMaster FT ECDIS including ECDIS display, route planning, route monitoring, alarms and the use of the look-ahead safety checking function. The training clearly distinguished between the route validation, route dangers and look-ahead safety checking functions. The route planning and route monitoring modules both described the correct use of the dangers tab folder to evaluate a planned route for dangers. In short, the tutorial reflected the correct use of the ECDIS, as intended by the manufacturer.

The course was structured to allow flexibility and to take into account each user’s existing level of familiarity with the equipment, allowing the user to skip or repeat steps in the tutorial as desired. This meant that, while the tutorial was designed to take 16 hours, it could be completed in less. The training, as undertaken by the master and navigation officer, did not require users to complete the tutorial or a percentage of the tutorial in order to progress to the test phase. The flexible nature of the course meant that the tutorial phase could be skipped entirely.

The test phase consisted of a number of interactive questions and required a minimum score of 70 per cent to pass. The test could be attempted twice in a 24-hour period with no limit on the total number of attempts.

Training records showed that the master did not undertake the guided tutorial phase of the training. He passed the test on his third attempt with a score of 71 per cent. The navigation officer completed 97 per cent of the guided tutorial and passed the test on his third attempt with a score of 71 per cent.

During interviews, the computer-based, online nature of the training was also raised as a possible factor that influenced the effectiveness of the training. The master completed the online familiarisation training on his personal computer and recalled his experience of the training as being very poor, convoluted and that although the test was completed successfully; little was gained from it. He also recalled that the system had been very slow with considerable lag between the user’s actions and the outcome on the screen, possibly due to poor internet connectivity. The navigation officer also described poor connectivity as a key recollection of the online type-specific training course.

Other ABF officers also noted that the training software was not user-friendly and that poor internet connectivity and the resulting lag hampered the effectiveness of the online training. The use of personal computers to undertake the training while at home may also have influenced the usefulness of the training. The general view among the officers interviewed was that, while the course was completed and the test passed, the online type-specific training course was of little practical value in learning to use the ECDIS.

ABF training requirements

ABF procedures required that every officer performing the role of a watchkeeping officer complete a task book and receive an endorsement for the position from a master. The navigation officer had successfully completed his task book and been endorsed to serve in the role of the OOW in February 2016 while on board ABFC Roebuck Bay. At the time, the cutter was not equipped with ECDIS and the task book reflected this. The master had not completed a task book, as the ABF requirement for one did not exist at the time of him gaining command.

ABF officers received varying levels of mentoring and shipboard training from dedicated training teams or from other officers considered proficient. Officers were mentored during the completion of their task books and when acting in their role prior to endorsement. Training processes and teams were also put in place to train personnel during the transition from the older Bay class vessels to the Cape class vessels.

The master and navigation officer both transitioned from the Bay class vessels equipped primarily with paper charts (and ECS) to Cape class vessels equipped with ECDIS, before returning to Bay class vessels in 2015.

During service on the Cape class vessels, the navigation officer, in training to become an OOW at the time, was mentored and trained by senior navigators in the use of the VisionMaster FT ECDIS and in watchkeeping. When the navigation officer transferred back to ABFC Roebuck Bay in the role of acting OOW, he was once again mentored by senior watchkeepers for about 12 months before being confirmed in the role of OOW. These periods of mentoring and training involved the navigation officer learning the operation of the ECDIS through observation and guided use while on the job.

Similarly, during ATSB interviews, the master emphasised on-the-job training and instruction, from his peers and other ABF officers, as the source of his understanding for the operational use of the ECDIS.

ABF annual continuation familiarisation training

ABF procedures required that all members of bridge teams undertake initial and annual continuation familiarisation training on their vessel’s specific type of ECDIS and radar. However, there was no evidence of such training being delivered to ABFC Roebuck Bay’s officers or to other ABF officers. ABF annual internal audits were reported as including an element of instruction and information delivery; however, this training delivery was not structured or consistent and was not documented.

ABF ECDIS work instructions also referred to a familiarisation checklist to assist with the provision of the annual ECDIS continuation familiarisation training. This checklist was found to contain incorrect guidance on the use of the ECDIS route dangers safety checking function. It described aspects of the ECDIS route validation mechanism, but used the term ‘dangers’ rather than ‘errors’.

Electronic Navigational Charts

An electronic chart is essentially a display of geographical and navigationally relevant information displayed on an electronic screen. There are two main types of electronic chart – raster charts and vector charts.

A raster navigational chart is essentially a passive, scanned image of an existing paper nautical chart. A vector chart is more sophisticated and, rather than comprising an image of a chart, it is a database containing the basic information of all the charted features in the chart. Often, both kinds of charts are produced by national hydrographic offices or other authorised government institutions, which then makes them ‘official’ charts. All other electronic nautical charts are, by definition, not official and are referred to as unofficial or private charts.

An ENC is an official, standardised, vector electronic chart conforming to IHO standards and issued for use with ECDIS. The chart information in an ENC is held as individual items (objects) in a database containing all the chart information necessary for safe navigation and possibly additional information to that contained in a paper chart. Most ECDIS convert the ENC dataset into the manufacturer’s internal ECDIS format known as a system electronic navigational chart, which is used for the generation of the chart display and other navigational functions.

The IHO standards are used by hydrographic offices to produce charts and their content, including ENCs. These standards are generally known by their publication reference numbers, such as the S-57^[43] standard, used for the production of ENCs for ECDIS, or the S-52 standard, containing the specifications for ENC display aspects within ECDIS.

The AHO is responsible for providing Australia’s national charting service under SOLAS and the Navigation Act 2012. The AHO is part of the Department of Defence and, as the relevant hydrographic authority; charts (paper or electronic) that are produced by the AHO meet the requirements of marine navigation and are known as official charts. The ENC in-use on board ABFC Roebuck Bay when the cutter grounded was ENC AU413143.

Compilation scale of an ENC

The compilation scale of the ENC is the scale at which the ENC was designed to be displayed.^[44] Hydrographic organisations compile ENC data for use at a certain scale for which the accuracy of the compilation is appropriate. The compilation scale is defined based on several factors, but will always take into account the scale at which the original source information was captured. ENCs are normally assigned to one of the recommended standard IHO scales as described in the IHO publication S-65.^[45] The compilation scale of an ENC is also related to the navigational purpose assigned to the chart.^[46] The compilation scale of ENC AU413143 was 1:90,000.

Unlike paper charts, which have to be used at a fixed scale, ECDIS allows the user to zoom in and thereby change the scale at which the ENC data is displayed. However, over zooming can give the user the impression that the chart data is more accurate than it actually is. This could result in the chart being inappropriately used for a purpose for which it was not intended. Zooming in introduces the further risk that any positional errors that may exist in the ENC data may be magnified to the point where the data becomes unsafe to use. To safeguard against this, the IMO ECDIS performance standards require that ECDIS provide an indication to the user if the information is displayed at a larger scale than that of the ENC.^[47] This indication is provided by a textual overscale warning. Additionally, if the display is compiled from ENCs at different compilation scales and part of the display is automatically grossly overscaled^[48] by the ECDIS, it is filled with an overscale pattern consisting of a series of parallel vertical lines. The overscale pattern should not generally appear when the operator manually zooms in. However, this is not necessarily the case for all ECDIS types.

On the VisionMaster FT ECDIS, depending on the display option, a ‘Primary Display Overscale’ or ‘Secondary Display Overscale’ prompt appeared in the upper right-hand corner of the display when the chart was displayed at a scale larger than its compilation scale (Figure 13). With regard to the overscale pattern, the VisionMaster FT user manual stated that the pattern was generated by the ECDIS if the scale of the display was more than double the compilation scale of any chart in the display.

Figure 13: Image of a VisionMaster FT ECDIS display overscale prompt and pattern

Image shows the overscale display prompt and overscale pattern demonstrated on a different ENC of the same navigational purpose code and compilation scale as ENC AU413143.
Source: Northrop Grumman Sperry Marine, modified and annotated by the ATSB

During tests on chart AU413143, conducted by the ATSB and the manufacturer, it became apparent that, while the overscale text prompt appeared when the chart was viewed at scales larger than the compilation scale, the overscale pattern was not generated regardless of the scale at which the chart was viewed (Figure 14). However, the pattern did appear on other charts of the same compilation scale and navigational purpose as ENC AU413143 (see Figure 13).

Figure 14: Image of ENC AU413143 showing no overscale pattern

Image of a VisionMaster FT ECDIS display showing ENC AU413143 at a scale of 1:5,000 and displaying no overscale pattern.

Source: Northrop Grumman Sperry Marine, modified by the ATSB

Chart features

The ENC database encodes each real world, physical feature in the form of ‘feature objects’, with about 170 object classes defined in the S-57 standard, each denoted by a six letter code (for example, UWTROC is the code for an ‘Underwater/Awash Rock’). Each feature object then has a defined list of ‘attributes’ used to describe it. For example, the attribute ‘NATSUR’ is used to describe the ‘nature of surface’ of objects (such as rock or coral). The other information needed about a feature object is its geographical location and spatial form. Spatial forms are either:

• a point feature such as a buoy or light
• a linear feature such as a boundary or depth contour
• an area feature such as a marine reserve.

Some object classes, such as wrecks, rocks and other obstructions including reefs, can be defined as points, lines or areas depending on the compilation scale of the ENC and other factors.

Point features only indicate that a certain feature object exists in a given location. This means that, unlike area features, the only positional information available for a point feature is its geographical position (a point represented by latitude and longitude coordinates).

A key difference to note between area features and point features on an ECDIS display is that, area features change size in proportion to the scale at which the ENC is being viewed whereas the symbols representing point features remain the same size (Figure 15). Unlike area features, the size or shape of the point feature’s symbol does not necessarily represent the size or shape of the physical, real-world feature it is depicting.

Figure 15: Comparison of area features and point features at different scales

The images demonstrate a key difference between area features, which change size proportionate to the scale at which the ENC is being viewed, and point features, which remain the same size regardless of scale. The top picture is at scale of 1:40,000 and lower picture is at 1:20,000.
Source: Electrotech, modified by the ATSB

Conditional symbolisation

In certain cases, the display of a feature on the ECDIS is dependent upon automatic settings or settings designated by the user. This is called ‘conditional symbolisation’. For example, the way in which point feature symbology for wrecks, rocks and obstructions can display depends on the user-defined safety depth and safety contour settings. When the feature is situated in water shallower than the safety contour value, it displays as the applicable ENC point feature symbol. However, when one of these features sits in deeper waters beyond the safety contour and is known to have a depth less than or equal to the user-defined safety depth value (or where the exact depth is unknown), the feature is displayed using a new symbol, unique to ENCs—the ‘isolated danger symbol’ (see Figure 19 in Charting of Henry Reef below).

The isolated danger symbol

The isolated danger symbol is applied to submerged rocks, wrecks and other obstructions when the feature is a hazard to navigation located in otherwise ‘safe waters’ (Figure 16). While the symbol usually represents a point feature, it sometimes appears in the centre of an area obstruction feature.

Figure 16: The isolated danger symbol

Source: United Kingdom Hydrographic Office

Where the defined depth value for an isolated danger is of lesser depth than the surrounding water, the vessel’s safety depth will drive the conditional symbology. Features with a defined depth less than the vessel’s safety depth (and in navigable water) will be displayed as the magenta isolated danger symbol, whereas those deeper than the vessel’s safety depth will be displayed as the applicable ENC point feature symbol.

Where a depth value is not defined or the chart producer has indicated that the feature is shallower than the surrounding water, the ECDIS will assume the value to be zero and display the magenta isolated danger symbol. All isolated danger symbols should therefore be treated with caution and the feature interrogated on the ECDIS to obtain more information and determine the danger posed by the feature.

Zone of confidence

ENC data is only as accurate as the original survey data from what it was derived and in most cases, this is the same as the data used to derive the equivalent paper chart. On paper charts, information to evaluate the relative accuracy of the chart data is provided by the means of a source data diagram. In ENCs, the primary means used to communicate this information is known as the ‘category of zone of confidence in data’ (CATZOC).

ENC data is divided into areas of differing quality based on criteria such as survey characteristics, position accuracy, depth accuracy and seafloor coverage. Of these criteria, the most important is seafloor coverage. Each area in an ENC is then assigned to one of six categories and allocated one of six CATZOC attribute values - A1, A2, B, C, D and U (Appendix C). On the ENC, these CATZOCs are graphically depicted by ‘star’ symbols. For example, a six star symbol (A1) denotes an area with high accuracy survey data and full seafloor coverage while a two star symbol (D) denotes an area with low accuracy survey data where large depth anomalies may be expected. CATZOC U (unassessed) is reserved for areas where the quality of bathymetric data has not been assessed.

CATZOC does not drive conditional symbology or any specific attribute within the automated route checking function in ECDIS. Rather, it is intended to allow the mariner to make an informed decision as to how far away they should plan to remain from certain potential hazards during the visual inspection phase of route planning, as well as prior to significant deviations from the planned route.

The waters in the vicinity of Wreck Bay through which ABFC Roebuck Bay’s route was plotted, were categorised as CATZOC B meaning that, although unidentified hazards might exist, none were expected. ABF navigational standards generally considered waters of CATZOC A1, A2 and B to be acceptable for passage planning.

It is important to note that the CATZOC system only applies to bathymetry^[49] such as depths, contours and submerged rocks and reefs. It does not apply to the accuracy of features such as the high water line, wharves, navigation aids and pipelines.

Henry Reef

Henry Reef (Figure 17) is located about 45 NM north-east of Lockhart River, Queensland on the south-western side of Wreck Bay in the outer Great Barrier Reef. The reef’s diameter ranges between 400 to 600 m and rises sharply out of the surrounding waters of a depth between 20 to 30 m. In places, the reef has a shallow shelf at a depth of about 5 to 8 m with the reef gently sloping up to the reef crest on the eastern flank at or about the lowest astronomical tide.^[50]

Figure 17: Henry Reef

Source: Australian Border Force, modified by the ATSB

Charting of Henry Reef

Henry Reef was an identified geographical feature that was charted on official charts of the Great Barrier Reef. The original survey data, obtained in 1977, was compiled at a scale of 1:50,000 and then used to compile the paper chart Aus 836 at a scale of 1:150,000 (Figure 18).

Figure 18: Survey data (left) and section of paper chart Aus 836 (right)

Image shows Henry Reef as surveyed (left) and Henry Reef represented by the ‘coral pinnacle’ symbol (right) on the paper navigational chart Aus 836.
Source: Australian Hydrographic Office, annotated by the ATSB

Based on the paper chart’s compilation scale and other factors, reefs of a certain size were represented as area feature objects while smaller sized reefs were represented by point feature objects. The AHO assessed that Henry Reef could be adequately represented by a point feature object. The symbol used to represent the reef was the ‘coral pinnacle’ symbol—a green, 5-pointed star-shaped symbol (Figure 18). The coral pinnacle symbol was used to represent coral reef point feature objects on Australian paper charts. This symbol was unique to Australian charts and has not been adopted into the IHO list of chart symbols and abbreviations.

Compilation of ENC AU413143

Data for the production of an ENC can be obtained in two ways. First, a survey can be conducted of the area to be charted and this data can be used to compile an ENC. The second method uses data from an existing paper chart, which is digitally converted to create a vector chart. The method used depends upon a number of factors including the nature and density of shipping in the area, time and commercial pressures involved, and the available survey resources and technology.

The AHO used data captured directly from the paper chart Aus 836 (1:150,000) to compile the ENC cell AU413143, based on rules and guidance in the IHO standards. ENC AU413143 was compiled by the AHO at a scale of 1:90,000.

In the course of compiling the ENC, area and point features on the paper chart were transferred as area and point features respectively to the ENC. Therefore, some reefs appeared as green area features while others were charted as point feature objects. There was no re‑assessment performed during the paper to electronic chart conversion process as to whether the form of feature objects continued to be suitable for the real world features they now represented on the ENC. However, there was also no expectation on the part of the AHO that mariners would routinely use ENCs at scales beyond the compilation scale.

The ENC was subsequently validated for distribution by the International Centre for ENCs, an independent organisation that provides validation services to national hydrographic offices to ensure ENC compliance with IHO standards.

Representation of Henry Reef on ENC AU413143

The IMO performance standards state that ECDIS should have at least the same reliability and presentation as the paper chart published by the government authorised hydrographic offices.^[51] However, this does not equate to a requirement for ECDIS symbology to be identical to paper chart symbology. As noted in IHO standard S-52:^[52]

The colours and symbols defined in this Specification are conceptually based on the familiar symbology of conventional paper charts. However, due to the special conditions of the ECDIS chart display as a computer generated image, the ECDIS presentation of ENC data does not match the appearance of a conventional paper chart closely. Instead, there are considerable differences in symbology in shape, colour and size, and in the placement of text in particular. The display of the ENC data and the conventional paper chart do not necessarily have to be identical in their appearance.

Henry Reef had been previously charted as a point feature object (coral pinnacle) on the paper chart. On ENC AU413143, the reef was charted using an equivalent ENC point feature object— an ‘underwater/awash rock’ (UWTROC). Additional information about Henry Reef was encoded as different attributes within the ENC and could be obtained by interrogating or querying the chart feature on the ECDIS (Appendix D).

As an ‘underwater/awash rock’, conditional symbology rules applied to the feature. Thus, when situated within the user-defined safety contour value, Henry Reef displayed as an asterisk-like symbol for an ‘underwater/awash rock’ (Figure 19 left). However, when situated in waters deeper than the safety contour, such as in otherwise ‘safe’ waters where one would expect to be navigating, Henry Reef’s symbol changed to an isolated danger symbol (Figure 19 right).

Figure 19: Henry Reef on ENC AU413143, displaying conditional symbology

Image on left shows Henry Reef displayed as a ‘rock awash’ symbol when lying within the user-defined safety contour. The image on the right shows Henry Reef displaying as an ‘isolated danger symbol’ when lying outside the user-defined safety contour.
Source: Australian Hydrographic Office, annotated by the ATSB

The IHO presentation library applicable at the time of the grounding, PresLib 4.0, mandated that the user be given the option of displaying the isolated danger symbol even for features in waters shallower than the safety contour value. However, some ECDIS operating on previous versions of the presentation library, including the ECDIS on board ABFC Roebuck Bay, always displayed the isolated danger symbol for applicable features regardless of their location in relation to the safety contour. Therefore, on ABFC Roebuck Bay’s ECDIS, Henry Reef always displayed as an isolated danger symbol.

A cursory analysis of AHO survey data^[53] obtained shortly after the grounding showed that, when superimposed on ENC AU413143 at compilation scale and, taking into account the position accuracy limits defined by the appropriate CATZOC, the isolated danger symbol appears adequately representative of the observed extent of Henry Reef (Figure 20). However, when viewed at scales progressively larger than the compilation scale, the symbol would progressively represent a smaller proportion of the reef on the ECDIS display.

Figure 20: AHO survey data (left), AU413143 (centre) and survey data overlaid on AU413143 (right)

Images show AHO survey data (left), section of ENC AU413143 (centre) and ENC AU413143 superimposed on survey data at compilation scale (right).
Source: Australian Hydrographic Office, modified, annotated and superimposed by the ATSB

As a point feature, Henry Reef was charted in position 12º 13.381’S 143º 49.126’E on the ENC. Visually, this meant that the symbol representing Henry Reef would always be centred on this position (Figure 21). However, with regard to the ECDIS route checking functions (see Point features and ECDIS safety checking functions), the use of a point feature meant that the only information available for the system to detect Henry Reef was the charted position, regardless of the area covered by the symbol. On the ECDIS display, the symbol always maintains an absolute size of about 7 mm in diameter regardless of the scale at which the ENC is viewed.

Figure 21: Charted position of Henry Reef point feature object on ENC

Image showing the charted 'point' position of Henry Reef as encoded in the ENC in relation to the actual reef. Note that the relative size of the isolated danger symbol to the reef is approximate only and that on the ECDIS display, the isolated danger symbol always displays at its standard size of about 7 mm regardless of scale.
Source: DigitalGlobe, Esri, modified and annotated by the ATSB   

The Great Barrier Reef

In 1990, the IMO declared the Great Barrier Reef as the first ever particularly sensitive sea area ^[54] recognising the unique and pristine environment of the reef and the need to protect it from pollution.

Navigation in the Great Barrier Reef can be particularly challenging. Navigational channels in the reef north of Cairns can be particularly narrow with relatively shallow water depths. In 1991, Australia introduced compulsory pilotage for certain vessels when transiting the Great Barrier Reef. To complement coastal pilotage and other navigational safety measures, a coastal vessel traffic service known as the Great Barrier Reef and Torres Strait Vessel Traffic Service (REEFVTS) was introduced in 2004. In addition, other measures to reduce the risk of a shipping incident in the Great Barrier Reef included a comprehensive network of aids to navigation and the implementation of ship routing and reporting measures.

The Great Barrier Reef Marine Park Authority (GBRMPA) was established by the Great Barrier Reef Marine Park Act 1975 to provide for the long-term protection and conservation of the environment, biodiversity and heritage of the Great Barrier Reef region. GBRMPA achieves this objective by the management of the park and the various activities that occur within it, the formulation of policies, establishment of partnerships and the enforcement of regulations.

The Great Barrier Reef Marine Park is divided into areas that fall into one of seven zones with different activities allowed and/or prohibited in each zone. GBRMPA has also established a designated shipping area (Figure 22) and this, along with the general use zones, make up the area within which navigation through the Great Barrier Reef Marine Park is allowed.

Figure 22: Chartlet showing designated shipping area in relation to Henry Reef

Source: Great Barrier Reef Marine Park Authority, modified and annotated by the ATSB

As partner agencies, GBRMPA worked closely with the ABF to achieve its objectives. As such, ABFC Roebuck Bay had several standing patrol tasks dedicated to the detection and deterrence of vessels operating illegally within the various zones of the marine park. The successful conduct of these tasks and others within ABFC Roebuck Bay’s remit required the cutter to operate in waters well outside the designated shipping area.

On the night of the grounding, ABFC Roebuck Bay was navigating in a remote area of the Great Barrier Reef, well outside the confines of the designated shipping area and recommended routes. ABFC Roebuck Bay was not required to carry a pilot when operating in the Great Barrier Reef. Further, very high frequency radio coverage in the area was poor and the cutter was not participating in, or required to participate in, REEFREP reporting.^[55] Consequently, REEFVTS were not monitoring the cutter and there were no limits set up in the REEFVTS monitoring system in the vicinity of Henry Reef.^[56]

Passage planning

A passage plan is a comprehensive berth-to-berth navigation plan developed and used on board a vessel as a means of achieving a safe and efficient voyage. IMO guidelines state that the development and use of a passage plan is of essential importance for safety of life at sea, safety and efficiency of navigation and protection of the marine environment. A detailed passage plan is necessary to allow the bridge team to arrive at a shared understanding of what ‘should’ happen during the voyage and ensures appropriate margins of safety are maintained at all times. The vessel’s master is required to develop a berth-to-berth plan for its safe and efficient passage.^[57] Detailed plans are needed to ensure appropriate margins of safety are maintained at all times.

ABF passage planning procedures

The ABF SMS required that passage planning on board ABF vessels be conducted in accordance with AMSA requirements^[58] and ABF work instructions.^[59] The general concept of passage planning in the ABF work instructions reflected the guidance on voyage planning provided by IMO,^[60] AMSA and The International Convention on Standards of Training, Certification and Watchkeeping for Seafarers.^[61]

ABF passage planning procedures placed a responsibility for passage planning upon the navigation officer, and upon the master for final approval of the plan. The procedures listed the minimum content to be included in the passage plan document. This included items such as planned track, courses and distances, wheel over positions, allowable off-track margins, under keel clearances, minimum expected depths and other information pertinent to the plan. While the plan for the passage from Saibai Island to Lizard Island included and documented most of this information, other information required by the procedures such as the minimum expected depths on each leg and expected under keel clearance was not. However, the requirement to record minimum depths and under keel clearances was stated to be the legacy of an older checklist applicable to paper charts and did not apply to ECDIS. It was reported that an equivalent safety outcome was achieved by the application of suitable safety depth and contour values, and compliance with ABF navigational standards.

The ABF passage planning work instructions used the term ‘validating the route’ to refer to the risk assessment of the route for possible dangers. This was inconsistent with the VisionMaster FT ECDIS route validation function, which only checked for errors not dangers (see Route planning on the VisionMaster FT ECDIS).

The work instructions also included a passage planning checklist, noting that it ‘…must be completed for every passage plan’. The checklist comprised a detailed list of checks covering the entire passage planning process. It included checks to ensure that relevant reference material such as the Admiralty Sailing Directions were consulted and that the route was checked, both visually and using the ECDIS route checking function. While it was reported that the checklist was used, its use was not documented nor was the completed checklist retained. However, other passage planning documents, such as the passage planning briefing card and departure briefing summary were retained.

Phases of passage planning

In general, passage planning is divided into four stages and this was reflected in the ABF work instructions:

• appraisal
• planning
• execution
• monitoring.

Appraisal

The ABF work instructions described appraisal as the process where all pertinent information was gathered and the foundation of the plan was built including an examination of the risks of the intended voyage. Information that needed to be considered included the vessel’s draught, operational taskings, availability of accurate and up-to-date charts of an appropriate scale, quality of chart data, information in sailing directions, and expected weather and tidal conditions. The work instructions included a list of reference materials that could be used to assist passage planning. The list comprised several publications including the Bridge Procedures Guide,^[62]Admiralty Sailing Directions,^[63]The Mariner’s Handbook and the Australian Seafarer’s Handbook.

The sailing directions provided information for safe navigation that was not available on charts or in other hydrographic publications. The sailing directions provided advice for small vessels on routes leading south through Wreck Bay (Figure 23). While the directions cautioned that these routes were not normally used, there were often operational reasons for ABF cutters to navigate in waters that would generally be beyond the scope of regular merchant vessels. The directions also advised that these routes could not be considered proven safe by regular use.

The directions also warned mariners that waters to the west and north of Wreck Bay were incompletely surveyed^[64] and that entrances on these sides should only be used in clear visibility and with extreme caution. However, the route leg leading into Wreck Bay and the amended sections of the cutter’s route were plotted entirely in waters categorised as CATZOC B and were therefore considered suitable for navigation by ABF standards.

However, the pre-existing route, upon which the amended route was based, had been used successfully several times before and was therefore considered a proven route on board ABFC Roebuck Bay. As this route was plotted clear of Henry Reef, this would indicate that the appraisal for the pre-existing route likely did consider the presence of the reef and took into account the sailing directions.

The master and navigation officer were using what they considered a safe, proven route in waters of an acceptable navigational standard. The potential risks of the subsequent amendments to the plan were to be managed by visual and ECDIS checks of the route in the planning and monitoring phases. Therefore, it was considered unlikely that further effort at the appraisal stage of the passage planning process would have influenced the outcome of the grounding.

Figure 23: Section of ENC AU413143 showing CATZOCs and ABFC Roebuck Bay's routes compared to advice in the Admiralty Sailing Directions

Source: Australian Hydrographic Office, annotated by the ATSB using information from the Australian Border Force and from Admiralty Sailing Directions (NP15)

Planning

The planning phase involves plotting the intended route of the passage on appropriate charts based on the information gathered in the appraisal stage. A key part of the planning stage involves checking every leg of the planned route prior to the commencing the passage.

The passage plan was based on a route that had been used safely a number of times before by the navigation officer and master. When presented with the plan for the passage to Cairns, the master decided to amend certain parts of the route for various reasons. One amendment involved shifting two planned course alteration positions (waypoints) in the vicinity of Wreck Bay—waypoint 19 (W19) and waypoint 20 (W20). W19 was moved south to skirt an area of relatively shallow water and W20 was moved to the west with crew comfort in mind. In the master’s experience, the cutter usually experienced relatively rougher weather conditions on that particular leg of the route as it temporarily ventured seaward of the Great Barrier Reef. The waypoint amendment aimed to reduce the amount of time that the cutter would be exposed to these conditions. The shifting of W20 to the west resulted in the route leg from W20 to waypoint 21 (W21) being inadvertently plotted across Henry Reef. Further changes after this point, including the creation of two separate routes to include a brief stop at Lizard Island, did not affect the segment of the route in Wreck Bay.

Execution and monitoring

The execution and monitoring phases of the passage plan occur concurrently. The planned route, which has been checked and approved, is executed and the vessel’s progress against the route is monitored. ABF work instructions for the monitoring phase of the passage plan required the OOW to consider whether the route being followed was safe and what the nearest danger to the route was. These instructions aligned with The International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (The STCW Code), which required the OOW to verify each leg of the route before following it.^[65]

On taking over the watch, the OOW reported visually reviewing the route that the cutter was expected to transit over the 4 hours of his watch. This check did not detect Henry Reef on the cutter’s route.

The OOW briefed the lookout on the expected navigation during their watch and confirmed the status, settings and operation of other bridge equipment. Course alterations at waypoints were made by autopilot and prompted by the OOW’s watchkeeping and ECDIS waypoint approach prompts. These prompts were visual only as the ECDIS audible buzzer was permanently silenced. Apart from the waypoint approach prompts, the watchkeepers could not recall any other ECDIS alerts in the time leading up to the grounding.

The depth sounder was set up to alarm if depths less than 10 m were encountered. However, the speed of the cutter and the steep nature of Henry Reef in relation to the surrounding waters meant it was unlikely to provide any useful warning of the grounding. The watchkeepers reported no significant radar return off the reef nor were there any audible or visual signs such as from breaking waves.

Route planning on the VisionMaster FT ECDIS

Route planning on the VisionMaster FT ECDIS was conducted using the ‘Edit Route’ function. This function’s menu allowed waypoints to be inserted, deleted or amended. The menu also allowed the user to define other parameters for the route such as turn radius and cross track distance (XTD). Apart from representing the limit at which an off-track alarm is activated, the XTD value is also used to define the vessel’s route safety region.^[66] The default setting for the XTD on the VisionMaster FT ECDIS was 100 m either side of the planned route.

The IMO performance standards for ECDIS required that an indication be given if the mariner planned a route across the ship’s defined safety contour or closer than a user-specified distance from a point object such as an isolated danger.^[67] In the case of the VisionMaster FT ECDIS, this user-specified distance was defined by the route plan’s XTD settings.

When a route was planned on the VisionMaster FT ECDIS, the system automatically performed two checks on the route—a route validation check and a route dangers safety check.

The route validation check examined the geometry of the route and if there were no errors, a tab displayed the words ‘No Error’. If an error was detected (such as an incorrect turn radius),^[68] the tab displayed the word ‘Errors’ with a yellow background (Figure 24). A route could be saved if it contained errors, but could not be loaded for monitoring until the errors had been rectified. The route validation process did not check the route for dangers

Figure 24: VisionMaster FT ECDIS route validation check displaying 'Errors'

Image shows a VisionMaster FT ECDIS displaying the ‘Errors’ highlighted in yellow due to an incorrect turn radius entered by ATSB investigators during testing. 
Source: Electrotech and ATSB

The route dangers safety check searched the chart database for dangerous objects or areas that intersected the route safety region. The identified dangers and cautions were listed in a directory tree against each leg of the planned route under the dangers tab folder of the ‘Edit Route’ menu. To check a route for identified dangers or cautions, the user was required to manually check each leg of the route in the dangers tab folder of the ‘Edit Route’ menu (see Detection of Henry Reef). Identified route dangers were not graphically highlighted on the chart automatically. To highlight an identified danger on the chart, the user had to select the danger in the dangers tab folder by clicking on it. A route could be saved and loaded for monitoring even if it contained dangers or cautions.

Route monitoring on the VisionMaster FT ECDIS

Once a route has been planned, saved and validated for errors, it can be loaded for monitoring. The ‘Monitor Route’ window allowed the user to monitor the vessel’s progress against all aspects of the planned route. The ‘Monitor Route’ window also contained a dangers tab folder that replicated the dangers and cautions identified in the ‘Edit Route’ menu’s dangers tab folder. A ‘Show Present Leg or Turn’ button enabled the user to view dangers and cautions identified on the current route leg in the ‘Monitor Route’ window’s dangers tab folder. The VisionMaster FT manual advised that the dangers tab folder of the ‘Monitor Route’ window should be checked whenever a new route was loaded and during the passage, when progressing to new legs.

Look-ahead safety checking function

The IMO performance standards for ECDIS require that an indication be given to the mariner if the ship, continuing on its present course and speed, over a specified distance or time set by the mariner, will pass closer than a user-specified distance from a danger such as a wreck, rock or obstruction.^[69]

The VisionMaster FT ECDIS provided a look-ahead safety checking function to meet this requirement. Based on the contents of the chart, this function generated alerts for shallow water or other dangers in an area around the vessel, based on settings defined by the user. The extent ahead of the vessel was defined in either time or distance while the lateral extent of the look‑ahead was defined as a distance (Figure 25).

Figure 25: ECDIS look-ahead safety checking function

Image shows the key settings of the look-ahead safety checking function on a VisionMaster FT ECDIS. The rectangle represents the safety region ‘box’.

Source: Safebridge

The ECDIS’s default look-ahead setting was 15 minutes or 0.5 NM ahead of the vessel. A further setting, with a default value of 20 m, allowed a safety region breadth to be added to either side of the vessel’s beam. Based on these settings, a rectangular safety region ‘box’ was defined around the vessel’s course over ground. As these settings were increased or decreased, the safety region increased or decreased the area that the system checked. The software took a snapshot of where the look-ahead box was every 30 seconds, checked that chart area for dangers or areas of concern to the vessel, and generated appropriate alerts.

At the time of the grounding, ABFC Roebuck Bay’s look-ahead safety region was reported to have been set up to check an area of the chart 3-minutes ahead of the vessel with an added breadth of 20 m either side of the vessel’s projected course over ground.

VisionMaster FT ECDIS alerts

Alerts on the VisionMaster FT ECDIS were classified into alarms, warnings and cautions. All three generated visual alerts in the ECDIS display’s ‘Alert Status Indicator’ box. Alarms and warnings also generated audible alerts whereas a caution did not (by default). However, the VisionMaster FT ECDIS (operating on PresLib 3.4) gave the user the option for cautions to be treated and audibly presented as alarms.

Audible alerts for unacknowledged alarms and warnings consisted of three ‘beeps’ repeated at defined intervals. The specifications for the audible alerts differed to emphasise alarms over warnings. The length of the ‘beeps’ for alarms were longer and, intervals between sets of beeps shorter, than for warnings.

When the VisionMaster FT ECDIS look-ahead function detected a chart danger such as an underwater/awash rock, an alarm was raised. An audible alert sounded and a visual alert was raised on the ECDIS display. The ‘Alert Status Indicator’ box of the ECDIS display would have turned red with the word ‘Chart Dangers’ and the ‘Chart Dangers’ icon to the right of it would also have turned red. It is important to note that only the look-ahead function generated alarms for chart dangers. Dangers identified by the ‘Edit Route’ and ‘Monitor Route’ functions on the planned route required the user to engage with the respective dangers tab folders to be appraised of the identified dangers.

Detection of Henry Reef

The shifting of W20 resulted in an unsafe passage plan with a route leg plotted across Henry Reef. The detection of this potential navigational danger relied on the ECDIS and visual checks of the route required by ABF passage planning procedures and the general practice of passage planning.

Visual check of the route

The master and navigation officer reported visually checking the route after amending it. Both officers recalled seeing the words ‘Henry Reef’ but not the isolated danger symbol that represented the reef. They believed that the name applied to other reefs to the north-west of Henry Reef.

ABFC Roebuck Bay’s master and navigation officer reported that they were not aware of the isolated danger symbol that represented Henry Reef until after the grounding, when they scrutinised the ECDIS display. However, when they subsequently checked the paper chart of the area (Aus 836), they reported an immediate awareness of the reef. They attributed this to the green, star-shaped, coral pinnacle symbol that represented the reef on the paper chart (see Charting of Henry Reef). This symbology and colour was familiar to them (probably due to their considerably longer use of paper charts in their careers) and was similar to the green symbology used for drying coral reef area features, both on paper charts and ENCs.

The officers’ understanding of the isolated danger symbol was that it represented a rock, wreck or obstruction but not necessarily one that was dangerous to the navigation of their cutter. However, Henry Reef displayed as an isolated danger symbol to warn the mariner that a potential hazard to navigation existed in waters that were otherwise considered ‘safe’. The conditional nature of the symbol may not have been apparent due to the VisionMaster FT ECDIS’s property of always displaying the isolated danger symbol regardless of the safety contour value. This may have influenced the officers’ understanding of the symbol’s significance.

The symbol representing Henry Reef was situated in waters shaded white indicating depths greater than 10 m. The officers expected that isolated danger symbols representing features hazardous to navigation, would be surrounded by blue shading and/or contours on the ECDIS.^[70] This likely reflected their knowledge of paper chart symbology, where rocks or wrecks considered hazardous to surface navigation were usually surrounded by blue shading when outside the safety contour. Nevertheless, the master and navigation officer agreed that sighting an isolated danger symbol on the planned route would certainly have triggered a chart query to assess the hazard posed by the feature. However, no such chart query of Henry Reef occurred. This indicated that neither officer sighted the isolated danger symbol during the visual check.

Clarity of symbols and labels

On a paper chart, symbology and text labels are positioned by the cartographer to allow for the best practical use of the chart based on its intended purpose. On ECDIS, the position of symbols and labels are determined by algorithms based on rules in the IHO standards. When only part of a large area feature (such as the Great Barrier Reef) is displayed on the ECDIS screen, the symbol and/or label defaults to the centre of the displayed area. At certain scales, when the ECDIS display was centred on Henry Reef, the reef’s symbol and label could be obscured by the symbols and labels for the ‘Great Barrier Reef’ and ‘nature reserve’ features present on the ENC (Figure 26). This effect could be exacerbated by the fact that the symbol and text label for the nature reserve were the same magenta colour as the isolated danger symbol representing Henry Reef.

Figure 26: Image of ENC AU413143 displaying text and symbol overlap

Image shows ENC AU413143 centred on Henry Reef, at a scale of 1:40,000 on a VisionMaster FT ECDIS, demonstrating text and symbol overlap. Note that all text is on display as required by the Annex A - ECDIS start-up checklist.
Source: Electrotech and ATSB

Point features and the visual check of the route

At compilation scale, the isolated danger symbol was reasonably comparable to the physical extent of Henry Reef (see Figure 20). A visual assessment of ABFC Roebuck Bay’s planned route at compilation scale showed the route passing over Henry Reef (Figure 27, left). However, when viewed at progressively larger scales, the reef’s isolated danger symbol appeared further away from the route. This could potentially give a false sense of sea room and safety.

While the ATSB could not determine the exact scale at which the visual check was performed, the navigation officer and master confirmed that the ENC was likely viewed at several scales including scales larger than the compilation scale (Figure 27, right). However, there was no evidence that the use of scales larger than the compilation scale influenced the visual check of the route.

Figure 27: ABFC Roebuck Bay's planned route on the ECDIS showing the relative position of the isolated danger symbol representing Henry Reef at different scales

Image shows ABFC Roebuck Bay’s amended route legs on the ECDIS at the compilation scale of 1:90,000 (left) and at the largest viewable scale, 1:500 (right). 
Source: Electrotech and ATSB

ECDIS check of the route

When the master saved the amended route, the route validation process identified an error in the route. This was indicated by the highlighted ‘Errors’ tab. The master and the navigation officer incorrectly believed that this route validation process also checked the route plan for dangers. Their understanding was that an identified danger on the route would generate an ‘Error’, which would prompt them to check the dangers tab folder. However, ‘errors’ and ‘dangers’ were presented in completely different ways on the VisionMaster FT ECDIS.

When the identified error (an incorrect turn radius) was rectified, the ‘Errors’ tab changed to ‘No error’. This led the officers to believe, incorrectly, that there were no chart dangers identified by the ECDIS on the planned route either. Therefore, the route was not checked in the dangers tab folder of the ‘Edit Route’ menu. The officers’ understanding was further supported by their incorrect belief that the VisionMaster FT ECDIS would not allow a route to be saved if it was plotted across a chart danger. ABFC Roebuck Bay’s other watchkeeping officers also appeared to share a similar understanding and expectation of the ECDIS’s functions.

On ABFC Roebuck Bay’s departure from Saibai Island, the passage plan for the route ‘Saibai to Lizard via Outer Reef’ was loaded for monitoring in the ECDIS. The route consisted of 42 waypoints and was planned with the VisionMaster FT’s default XTD of 100 m. The ECDIS applied this setting to the vessel’s beam^[71] and assigned a safety region of about 105 m on either side of the planned route. This meant that a route safety region, about 210 m in breadth, was checked by the ECDIS for route dangers and cautions. The charted position of the ‘underwater/awash rock’ point feature object that represented Henry Reef on the ENC lay about 55 m to the east of the planned route. Therefore, the isolated danger symbol fell well within the route safety region.

ATSB examination of ABFC Roebuck Bay’s ECDIS after the cutter’s arrival in Cairns confirmed that Henry Reef had been identified by the ECDIS and listed in the ‘Monitor Route’ menu’s dangers tab folder (Figure 28). As discussed previously, the ‘Monitor Route’ dangers tab folder replicates the dangers identified in the ‘Edit Route’ dangers tab folder. Therefore, it was almost certain that Henry Reef was identified as a danger by the ECDIS in the ‘Edit Route’ dangers tab folder as well. This was confirmed during ATSB testing (see Figure 29).

Figure 28: Image of ABFC Roebuck Bay's ECDIS showing the ‘Monitor Route’ window

Image of ABFC Roebuck Bay’s ECDIS showing an identified danger (Henry Reef) on the leg to W21 in the dangers tab folder of the ‘Monitor Route’ window. Selecting the danger highlights the reef graphically on the ECDIS display and provides available information on Henry Reef.
Source: ATSB

ABFC Roebuck Bay’s ‘Saibai to Lizard via Outer Reef’ ECDIS route plan contained about 151 cautions and nine dangers. Of the nine identified dangers, eight alerted the user to depth areas on the route where the range of depth values posed a potential hazard. The other identified danger was Henry Reef. ATSB tests, conducted on a VisionMaster FT ECDIS set-up based on ABF work instructions, found that the ECDIS detected Henry Reef as a route danger and listed it in the ‘Edit Route’ menu’s dangers tab folder (Figure 29).

Figure 29: Danger identified on the amended route leg in the 'Edit Route' menu during testing

Image shows a danger (Henry Reef) identified by the ECDIS route dangers safety checking function on the amended route leg during ATSB testing. Note that the danger is not automatically highlighted on the chart and that the route validation function does not show any errors.
Source: Electrotech and ATSB

Look-ahead safety checking function

Data logs were downloaded by the ATSB from ABFC Roebuck Bay’s ECDIS after the grounding. The logs contained position, course and speed data. Alarm and alerts data from the night of the grounding had been overwritten and were not available for analysis.^[72] In the absence of a voyage data recorder, there was no other recorded data available to help establish if an ECDIS chart danger alarm was generated before the grounding.

The ECDIS manufacturer’s analysis of the data logs concluded that, assuming the look-ahead function was active and no changes were made to the settings after the grounding, the data was consistent with a 20 m added breadth setting and a time-based look-ahead setting. This concurred with the interview and documentary evidence that look-ahead settings were as prescribed in the ‘ECDIS Start-up Checklist’. Therefore, it was highly likely that ABFC Roebuck Bay’s ECDIS look-ahead function safety region was set up with a time setting of 3-minutes and an added breadth of 20 m.

ATSB tests showed that the look-ahead function generated the appropriate alarms when it detected a chart danger. However, the tests also confirmed that it was possible, based on the settings applied, that the Henry Reef point feature fell outside the look-ahead safety region and that therefore, the look-ahead function did not encounter the isolated danger symbol representing the reef (Figure 30). The manufacturer’s analysis also concluded that it was conceivable that the look-ahead function did not encounter the isolated danger symbol.

Figure 30: Image showing Henry Reef, undetected by the look-ahead function during testing

Image from ATSB testing showing Henry Reef going undetected by the ECDIS’s look-ahead function when set up with a 20 m added breadth based on settings in the Annex A – ECDIS start-up checklist of the ABF work instructions.
Source: Electrotech and ATSB

ATSB tests using settings recommended in the ‘restricted waters’ category of the Annex C checklist in the ECDIS work instructions, namely the use of an added breadth of 0.1 NM (185 m), significantly increased the chances of the look-ahead function detecting the reef (Figure 31).

Figure 31: Image showing Henry Reef, detected by the look-ahead function during testing, based on the ‘restricted waters’ setting

Image from ATSB testing showing Henry Reef being detected by the ECDIS’s look-ahead function when set up with a 0.1 NM (185 m) added breadth based on settings in the Annex C – Restricted waters category checklist of the ABF work instructions. Selecting the danger highlights the reef graphically on the ECDIS display and provides available information on Henry Reef.
Source: Electrotech and ATSB

ATSB analysis also found the use of a 3-minute setting for the ECDIS’s look-ahead function would have left limited time to take action in the event it did alert the OOW to the approaching reef. Calculations show that, given the 30-second interval of the look-ahead function, the cutter’s speed of 16 knots and the actual extent of the reef in relation to its charted position (see Charting of Henry Reef); the OOW would potentially have had about 2 ½ minutes to take action before grounding.

Presentation Library 4.0

The new presentation library (PresLib 4.0) introduced changes to the way in which dangers and hazards were defined and presented to the mariner on the ECDIS.

As discussed previously, the VisionMaster FT ECDIS required the user to manually check the dangers tab folder of the ‘Edit Route’ window to gain an awareness of dangers identified on the planned route. In order to view an identified danger on the ECDIS display, the user had to select it in the dangers tab folder.

PresLib 4.0 introduced new ‘indication highlight’ symbology for objects that posed a potential threat to the vessel. On ECDIS upgraded to PresLib 4.0, all navigational hazards identified on the route by the ECDIS route safety checking function could be automatically highlighted on the chart with the appropriate ‘indication highlight’ symbology (Figure 32). Identified hazards on the planned route could be highlighted during route planning and monitoring without the need for the user to manually select them in the danger tabs folder.

Figure 32: Route danger emphasised by new 'indication highlight' symbol in ECDIS updated to Presentation Library 4.0

Source: International Hydrographic Organization, annotated by the ATSB

In addition, one of the goals of PresLib 4.0 was to address the issue of alarm fatigue. This was achieved by the introduction of changes intended to reduce the number of alarms generated by the ECDIS look-ahead safety checking function. Under safety contour detection rules in the previous presentation library (PresLib 3.4), objects such as rocks, wrecks and obstructions (shallower than the safety contour) raised alarms by default. PresLib 4.0 introduced a new category for such objects which defined them as ‘navigational hazards’ and raised the appropriate indications rather than alarms, as required by the IMO performance standards.

On an updated VisionMaster FT ECDIS, alerts generated by the look-ahead function for navigational hazards such as Henry Reef were presented as a caution (by default) with a visual alert and the ‘indication highlight’ symbol rather than as an alarm. The VisionMaster FT gave the user the option of being able to present the cautions audibly, if required. In that case, the caution would be presented as a warning (with an audible alert that was less disruptive than that of an alarm).

PresLib 4.0 also gave the user the option of choosing whether the isolated danger symbol displayed for rocks, wrecks and obstructions in waters shallower than the safety contour whereas previously, it displayed them as such by default.

At the time of the grounding, ECDIS onboard ABFC Roebuck Bay, and most other ABF cutters operated with the superseded PresLib 3.4. An upgrade to the new PresLib 4.0 would have allowed ABFC Roebuck Bay’s bridge team access to enhanced safety features that could have aided the planning and monitoring phases of the passage plan. The visual check of the route leg from W20 to W21 would have shown Henry Reef, automatically highlighted as a navigational hazard by the new indication highlight symbol (Figure 33).

Figure 33: Images of ECDIS operating on PresLib 3.4 (left) and ECDIS updated to PresLib 4.0 showing indication highlight feature demonstrated on the amended route plan (right)

Image shows the amended route plan as it probably appeared on board ABFC Roebuck Bay (left) and as it might have appeared had the ECDIS been updated to PresLib 4.0 (right).
Source: Electrotech and Northrop Grumman Sperry Marine, modified by the ATSB

The reduction in audible alerts resulting from the implementation of PresLib 4.0 may have influenced the master to reconsider his decision to silence the audible alert buzzer. However, given the re-classification of Henry Reef as a navigational hazard in PresLib 4.0, this would have made little difference because the detection of the reef by the look-ahead function would have resulted in a caution with no accompanying audible alert. However, if it had been assessed appropriate to present cautions audibly (similar to the ‘alarm on cautions’ setting in the work instructions), under the new rules, the system would have generated a warning. The audible alert for a warning was less disruptive than that of an alarm. Therefore, the updated ECDIS could still have alerted the officers to the reef audibly while also reducing alarm fatigue when compared to the previous presentation library.

Point features and ECDIS safety checking functions

The use of the route checking function to check a route for dangers is a fundamental safety benefit of ECDIS. The ECDIS route check complements the visual check of the route. Where passage planning is conducted on ECDIS, the use of the route checking function is a key component of the passage planning process.

The ECDIS route safety checking function checked the route safety region against the chart database for dangers. With regard to point features, the ECDIS route safety region could only be checked against the position of the point feature regardless of the actual extent of the physical feature it represented. Essentially, the ECDIS would only identify the feature as a danger to the planned route if its charted position in the ENC fell within the route safety region.

In the case of ABFC Roebuck Bay, the charted position of the ‘underwater/awash rock’ point feature representing Henry reef lay about 55 m to the east of the planned route and fell within the route safety region (Figure 34). The ECDIS accordingly detected the reef as a danger to the planned route and identified it in the dangers tab folder for the relevant route leg.

Figure 34: ABFC Roebuck Bay's planned route and route safety region

Figure showing ABFC Roebuck Bay’s approximate planned route and the ECDIS route safety region based on a 100 m XTD in relation to the ENC’s encoded position for Henry Reef. Note that the charted position of Henry Reef falls within the route safety region.
Source: DigitalGlobe, Esri, modified and annotated by the ATSB  

However, when a point feature represents a physical feature of relatively significant size, it is possible for a part of the ECDIS route safety region to be obstructed by the feature despite its charted position falling outside the route safety region. If a hypothetical route were plotted about 55 m further to the west, the charted position of the point feature would now fall outside the ECDIS route safety region. In this case, the ECDIS would not have detected the reef as a danger to the planned route and it would not have been identified in the dangers tab folder. Nevertheless, the planned route and a significant proportion of the route safety region would remain across the reef (Figure 35). In this situation, ABFC Roebuck Bay would have potentially run aground with the ECDIS showing no identified dangers on the planned route. A similar scenario, and associated safety implications, would equally apply to the ECDIS look-ahead function and safety region.

Figure 35: A hypothetical route and route safety region

Figure showing a hypothetical route laid about 55 m to the west of ABFC Roebuck Bay’s planned route and the ECDIS route safety region based on a 100 m XTD. Note that the charted position of Henry Reef now falls just outside the route safety region. In this case, the route is still laid across Henry Reef but the ECDIS will not identify the reef as a danger on the route leg.
Source: DigitalGlobe, Esri, modified and annotated by the ATSB

Similar occurrences

Over the past two decades, flag administrations and agencies with a responsibility to investigate safety occurrences have investigated several groundings with certain common recurring themes.

Kea Trader

On 12 June 2017, the Malta registered container ship Kea Trader grounded on Durand Reef in the Pacific Ocean while on passage from Tahiti to New Caledonia. The ship’s primary means of navigation was ECDIS using Japan Radio Company JAN 901-B ECDIS units. The ship’s passage plan was amended during the passage with one waypoint shifted. This resulted in the amended route passing over the isolated danger symbol that represented Durand Reef (a point feature) on ENC GB204637 at a compilation scale of 1:700,000. The ship was then navigated into shallow waters where it grounded on the reef. The ship remained aground while salvage efforts ensued. On 4 December 2017, Kea Trader broke in two after being struck by heavy weather. At the time of writing, the ship remained stranded on Durand Reef.

Malta’s Marine Safety Investigation Unit investigated the grounding and published marine safety investigation report 14/2018. The investigation concluded that the revised route passed virtually over the isolated danger symbol representing Durand Reef and that the ECDIS route check function had not been enabled. It found that the second mate’s observation of the symbol outside of the planned route’s cross track limit of 0.5 NM due to an overscaled ECDIS display led to an incorrect assumption of safe water within the cross track limit. It also found that the detection vector (look-ahead function) settings were inadequate; the isolated danger symbol was not queried on the ECDIS, the audible alarm on the ECDIS had been switched off and that an ECDIS caution for the ship’s passage into waters of CATZOC D were overlooked. The master and navigation officer had completed generic ECDIS training and online type-specific familiarisation training.

Universal Durban

On 13 May 2017, the Malta registered bulk carrier Universal Durban grounded on a shoal south of the island of Pulau Serasan in the Indonesian archipelago while on passage from Australia to Malaysia. The ship’s primary means of navigation was ECDIS using Furuno model FEA-2107 ECDIS units. The ship was subsequently refloated with minor damage and no pollution or injuries reported.

Malta’s Marine Safety Investigation Unit investigated the grounding and published marine safety investigation report 10/2018. The investigation concluded that a required ENC was inadvertently deleted while placing a chart order and that a small scale chart was being displayed on the ECDIS. The investigation found that the passage plan deviated from the designated Indonesian archipelagic sea-lanes and that there was no evidence of reference to Admiralty Sailing Directions during the appraisal stage of the passage planning. It also found that the OOW’s visual check of the route was cursory and that the ECDIS route checking function did not trigger any navigational warnings. Significant positional and depth anomalies were also noticed on an ENC for the area. The master, second mate and third mate had all completed generic ECDIS training and type-specific familiarisation training.

Muros

On 3 December 2016, the Spain registered bulk carrier Muros grounded on Haisborough Sand off the East coast of England while on passage from the United Kingdom to France. The ship’s primary means of navigation was ECDIS using MARiS ECDIS900 MK 10 ECDIS units. The ship’s passage plan was amended by the second officer under the master’s instructions about 3 hours before the grounding. This amendment resulted in the planned route passing across Haisborough Sands. The master did not check the amended passage plan and the ship followed the planned route and grounded. The ship was refloated 6 days later with damage to the rudder but no reported injuries or pollution.

The United Kingdom’s Marine Accident Investigation Branch (MAIB) investigated the grounding and published Report No. 22/2017. The investigation concluded that the visual check of the route was not performed on charts of an appropriate scale and that it failed to identify that the route passed over Haisborough Sand. It found that the ECDIS’s route checking function identified the danger but that the function was not utilised to check the route. The investigation also found that the ECDIS audible alarm and guard zone (look-ahead function) had been disabled. All bridge watchkeeping officers had completed generic ECDIS training and online type-specific familiarisation training.

Nova Cura

On 20 April 2016, the Netherlands registered general cargo ship Nova Cura grounded on Lamnas Reef in the Mytilini Strait between Turkey and the Greek island of Lesbos. The ship was on a passage between the Turkish ports of Eregli and Izmir when it was required to divert to Aliaga. The ship’s primary means of navigation was ECDIS. The ship’s route was amended by the master to pass through the Mytilini Strait but no appraisal or further planning performed. The ship subsequently grounded on the reef although the ECDIS indicated a chart sounding of 112 m in that position. The vessel was eventually re-floated and towed to Piraeus, Greece where it was declared a total loss.

The Dutch Safety Board investigated the grounding and released a report titled, ’Digital navigation: old skills in new technology—Lessons from the grounding of the Nova Cura’. The investigation found that Lamnas Reef was incorrectly marked on the Greek navigational charts. The report stated that the ENC of the area had been compiled using data from an existing paper chart and that the waters in which the ship grounded were designated CATZOC U (Unassessed). The investigation also found that sector lights warning of the reef were marked differently on the paper charts and ECDIS. The report recommended that shipping companies amend their procedures to ensure CATZOCs were consulted during voyage planning and that all relevant voyage preparations be repeated when a route is amended. It also recommended that the IHO impose conditions on the age and reliability of data used to compile ENCs and that the IMO evaluate the inherent safety risks of ECDIS and make its practical use a factor in future development of the system.

Ovit

On 18 September 2013, the Malta registered chemical tanker Ovit grounded on the Varne Bank in the Dover Strait while on passage from the Netherlands to Italy. The ship’s primary means of navigation was ECDIS using MARiS 900 ECDIS units. The passage plan passed directly over the Varne Bank in the English Channel. The ship refloated on a rising tide about 2 ½ hours after grounding with only minor paint damage.

The United Kingdom’s MAIB investigated the grounding and published Report No. 24/2014. The investigation concluded that the passage had been planned over the Varne Bank by an inexperienced, junior officer. The plan was not properly checked for navigational hazards using the ECDIS route checking function nor was it checked by the master. The investigation also found that the ECDIS audible alarm was inoperative and that several features of the MARiS 900 ECDIS were either difficult to use or appeared not to comply with international standards. All bridge watchkeeping officers had completed generic ECDIS training and type-specific familiarisation training but did not possess the level of knowledge required to operate the system effectively.

CFL Performer

On 12 May 2008, the Netherlands registered dry cargo ship CFL Performer grounded on Haisborough Sand off the East coast of England while on passage from Suriname to the United Kingdom. The ship’s primary means of navigation was ECDIS using Furuno FEA-2107 ECDIS units. The ship’s route was planned across Haisborough Sand, a shoal about 10 NM long and 1 NM wide, where the charted depth of water was considerably less than the vessel’s draught. The ship grounded about 29 minutes after the OOW adjusted course to follow the ship’s planned route. The ship was refloated shortly after with no reported injuries, damage or pollution.

The United Kingdom’s MAIB investigated the grounding and published Report No. 21/2008. The investigation concluded that the route plan was not adequately checked for navigational hazards in either the planning or monitoring stages of the passage plan process. The ECDIS’s route check page was not used to check each leg of the route for navigational hazards. The investigation also found that none of the ship’s bridge watchkeeping officers had been trained in the use of ECDIS and that the ECDIS’s watch vector (look-ahead function) was not activated.

Design, functionality and use of ECDIS

In its investigation report into the grounding of the bulk carrier Muros, the United Kingdom’s MAIB stated that there was increasing evidence to suggest that first generation ECDIS systems were designed primarily to comply with IMO performance standards, with insufficient attention being given to the needs of the user. It noted that, ECDIS systems were often not intuitive to use and lacked the functionality needed for accurate passage planning in confined waters. This has resulted in seafarers using ECDIS in ways which are at variance with the intended use of the system by manufacturers and/or regulators.

The effectiveness of complex technology like ECDIS depends, in large part, on the design of the technology’s human-machine interface. Examples of problems encountered with regard to human-machine interaction include a lack of equipment standardisation and usability, insufficient operator training and ignoring human factors aspects in the design of the technology.^[73] Standards can be too general or only establish minimum requirements. Usability means that operators who use the equipment can do so quickly and easily to accomplish the required tasks. On the other hand, operator training and support is needed to make sure users are aware of the capabilities and limitations of their systems.

The design of the VisionMaster FT’s route validation function, with its yellow ‘Error’ highlight indication, was demonstrated to be a practical and effective means of indicating the existence of errors in the route to a user. By contrast, there was no equivalent means of making the user aware of dangers on the route or of the introduction of a danger to a previously safe route. The dangers tab folder mechanism used for reconciling dangers identified on a route placed the responsibility solely on the user.

Similarly, while the ECDIS would not allow a route with errors to be loaded for monitoring, it would allow the loading and monitoring of a route with identified chart dangers. There was no system requirement for the dangers tab folder of a route to be checked before the route was released for execution and monitoring.

ECDIS safety study

As a result of several investigations into groundings, the United Kingdom MAIB, in collaboration with the Danish Maritime Accident Investigation Board, initiated a study designed to understand why operators were not using ECDIS as envisaged by the regulators and system manufacturers. The scope of the study included ECDIS development, implementation, training and lack of standardisation. The study aims to provide data that can be used to improve the design of future ECDIS systems. The findings of the study are expected in 2019, but preliminary observations^[74] released have much in common with factors identified in this investigation. While ECDIS was found to contribute to safe navigation by saving time, reducing workload and allowing real-time positioning, concerns included:

• issues with alarms and disabling of alarms to avoid distraction
• duplication and relevance of alarms
• variations in the way information was grouped in different ECDIS models
• differing menu structures between systems
• variation in the quality of training
• diminished traditional skills/mental agility due to reliance on ECDIS and automatic radar plotting aids
• significant variation among certified officers in the understanding of key features such as safety contour and safety depth
• gaps in knowledge of chart symbology.

__________

18. Section 15(2) of the Navigation Act 2012 (Cth).
19. Marine orders are legal instruments made by AMSA pursuant to powers under Commonwealth legislation. They are also described as regulatory instruments or legislative regulations.
20. Australian Maritime Safety Authority, 2016, Marine Order 27 – Safety of navigation and radio equipment 2016, AMSA, Canberra.
21. Differential global positioning systems are an enhanced form of GPS providing greater positioning accuracy than the standard GPS.
22. A mandatory system, the bridge navigational watch alarm system automatically alerts the master or another qualified officer if the OOW becomes incapable of performing the OOW’s duties for any reason such as falling asleep or becoming otherwise incapacitated.
23. A voyage data recorder is designed to collect and store data from various shipboard systems in compliance with SOLAS requirements.
24. International Maritime Organization, 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.
25. At the time of the grounding, the Navigation Act 2012 (Cth) referred to this agency as the Australian Hydrographic Service (AHS). In November 2017, an updated version of the Act referred to it as the Australian Hydrographic Office. This report uses the updated name.
26. International Maritime Organization, 2018, International Management Code for the Safe Operation of ships and for Pollution Prevention (ISM Code) as amended, IMO, London.
27. A document of compliance (DOC) is issued to a company (or organisation), which complies with the requirements of the ISM Code.
28. A safety management certificate (SMC) is issued to a ship to signify that the company and shipboard management operate in accordance with the approved SMS.
29. International Maritime Organization, 2006, Revised performance standards for electronic chart display and information systems (ECDIS), Resolution MSC.232 (82), IMO, London.
30. International Maritime Organization, 2017, ECDIS – Guidance for good practice, MSC.1/Circ.1503/Rev.1, IMO, London.
31. United Kingdom Hydrographic Office, 2016, Admiralty guide to the practical use of ENCs (NP 231), UKHO, Taunton.
32. International Maritime Organization, 1995, Code on Alarms and Indicators, Resolution A.830 (19), IMO, London.
33. International Hydrographic Organization, October 2014, Publication S-52, Specifications for Chart Content and Display Aspects of ECDIS, Edition 6.1(.1), IHO, Monaco.
34. Alarm fatigue occurs when a person is exposed to a large number of frequent alarms and becomes desensitised to them. This can lead to longer response times or crucial alarms being missed altogether.
35. Australian Border Force, 31 January 2017, Work Instruction NS 1007 – Use of ECDIS and RADAR on Australian Border Force Cutters V2.1, ABF, Canberra.
36. XTE – Cross track error, in this context, likely meaning the extent of the vessel’s look-ahead safety region measured laterally on either side of the vessel’s course over ground vector.
37. International Maritime Organization, 2011, Standards of Training, Certification and Watchkeeping for Seafarers (STCW) Code, IMO, London.
38. International Maritime Organization, 2012, Model Course on the Operational Use of Electronic Chart Display and Information Systems (Model Course 1.27), IMO, London.
39. Australia, Republic of Korea and other international organizations, 18 December 2015, IMO sub-committee on navigation, communications and search and rescue, NSCR 3/28/1, Agenda item 28, Submission on development of guidance on the Standardized (or S) Mode of operation of navigation equipment, IMO, London.
40. To address this issue, a concept known as ‘Standardized (or S) Mode’ of operation of navigation equipment was submitted to the International Maritime Organization under its e-navigation program. The concept of S-Mode envisions future navigation systems having a standard mode for display, control and monitoring. When activated, the system would default to a standard display and present a standard user interface for key tasks. In January 2019, as a result of work led by Australia, guidelines have been finalised and approved at the IMO that will contribute significantly to standardising navigation systems in areas such as terminology, icons, operator actions and user settings.
41. Rouse, WB and Morris, NM (1985). On looking into the black box: prospects and limits in the search for mental models (85-2). Arlington: Office of Naval Research.
42. Safebridge is an online maritime training, assessment and certification provider headquartered in Hamburg, Germany.
43. International Hydrographic Organization, November 2000, Special Publication No. 57, IHO Transfer Standard for Digital Hydrographic Data, Edition 3.1, IHB, Monaco.
44. International Hydrographic Organization, 2014, S-52 Specifications for chart content and display aspects of ECDIS, IHO, Monaco.
45. International Hydrographic Organization, 2017, Publication S-65, ENCs – Production, maintenance and distribution guidance, Edition 2.1.0, IHO, Monaco.
46. ENCs are compiled for various navigational purposes. These are indicated by the ENC’s navigational purpose code. On Australian ENCs, the first digit after the authorising nation code (AU) denotes the chart’s navigational purpose. Therefore, on ENC AU413143, the navigational purpose code ‘4’ denotes that it was intended as an ‘Approach’ chart.
47. 6.1.1 of IMO Resolution MSC.232 (82) - Revised performance standards for electronic chart display and information systems (ECDIS)
48. In this context, ‘grossly overscale’ means that the display scale is overscaled by more than twice the compilation scale.
49. The measurement of depth of water in oceans, seas, or lakes.
50. The lowest tide level, which can be predicted to occur under average meteorological conditions and under any combination of astronomical conditions. On all new Australian charts, the lowest astronomical tide is used as chart datum.
51. Paragraph 1.7 of IMO Resolution MSC.232 (82) - Revised performance standards for electronic chart display and information systems (ECDIS).
52. Paragraph c, Section 1.2 – Concept and limitations of ECDIS, Publication S-52, Specifications for Chart Content and Display Aspects of ECDIS, Edition 6.1(.1).
53. The survey data was collected in October 2017 by a laser airborne depth sounder; an aircraft based hydrographic surveying system used by the AHO.
54. An area of the marine environment that needs special protection through action by the International Maritime Organization (IMO) because of its significance for recognised ecological, socio-economic or scientific attributes where such attributes may be vulnerable to damage by international shipping activities.
55. The Great Barrier Reef and Torres Strait Ship Reporting System (REEFREP) requires that certain ships, such as ships over 50 m in length, tankers and gas carriers, report to REEFVTS when transiting the REEFVTS area.
56. REEFVTS conducts near real-time monitoring of ships within most of its coverage. To monitor this traffic effectively, limits representing areas within which it is safe to navigate have been set up on the REEFVTS monitoring system. When a ship breaches this limit, indicating for example that it is in danger of grounding, an alarm is triggered allowing REEFVTS to initiate contact with ship and provide it with navigational assistance.
57. International Maritime Organisation (IMO), 1974, The International Convention for the Safety of Life at Sea, 1974, as amended (SOLAS 1974), Chapter V, regulation 34 Safe navigation and avoidance of dangerous situations, IMO, London.
58. Australian Maritime Safety Authority, 2016, Marine Order 27 - Safety of navigation and radio equipment, AMSA, Canberra.
59. Australian Border Force, 14 September 2017, Work Instruction NS 1004 – Passage Planning V3.0, ABF, Canberra.
60. International Maritime Organization, 2000, Resolution A.893 (21) - Guidelines for voyage planning, IMO, London.
61. International Maritime Organization, 2011, Standards of Training, Certification and Watchkeeping for Seafarers (STCW) Code, IMO, London.
62. International Chamber of Shipping, 2007, Bridge Procedures Guide, Fourth Edition, Marisec Publications, London.
63. The Admiralty Sailing Directions – Australia Pilot, Volume 3 (NP 15) covered the waters of the Great Barrier Reef.
64. The unsurveyed waters to the west and north of Wreck Bay have since largely been surveyed and charted as part of a long standing survey program aimed at supporting surveillance activities within the Great Barrier Reef.
65. International Maritime Organization, 2011, Standards of Training, Certification and Watchkeeping for Seafarers (STCW) Code, IMO, London, Chapter VIII, Part 2-6 – Voyage planning, Verification and display of planned route.
66. The route safety region comprises a zone of width equal to the XTD plus half the vessel’s beam applied to both sides of the planned route.
67. 11.3.4 and 11.3.5 of IMO Resolution MSC.232 (82) - Revised performance standards for electronic chart display and information systems (ECDIS)
68. If a planned turn cannot be achieved based on the vessel’s handling characteristics set up in the system, the ECDIS will detect this as an error.
69. 11.4.6 of IMO Resolution MSC.232 (82) - Revised performance standards for electronic chart display and information systems (ECDIS).
70. Under IHO/AHO rules, there was no requirement for a contour to be encoded around Henry Reef given the compilation scale of the ENC and therefore, no blue shading. See section 5.3 – Soundings, Australian Use of the Object Catalogue, AHS.
71. ABF ECDIS work instructions mandated a beam of 10.8 m to be set up for the cutter in the ECDIS.
72. The manufacturer confirmed that alarm log data was not retained by the system for the same length of time as other logged data.
73. Grech, MR, Horbery, TJ, and Koester T (2008). Human factors in the maritime domain. Boca Raton: Taylor and Francis.
74. United Kingdom Marine Accident Investigation Branch (MAIB) and Danish Maritime Accident Investigation Board (DMAIB), 24 October 2018, IMO sub-committee on navigation, communications and search and rescue, NSCR 6/INF.5, Agenda item 22, Submission on safety study into use of ECDIS on board ships, IMO, London.

Safety analysis

Introduction

On 30 September 2017, shortly after midnight, Australian Border Force cutter Roebuck Bay (ABFC Roebuck Bay) grounded on Henry Reef, a charted feature in the Great Barrier Reef. The cutter sustained substantial damage but there were no reported injuries or oil pollution. ABFC Roebuck Bay’s officers held the appropriate qualifications for their positions and completed the mandatory ECDIS training required. Fatigue, workload, distraction and the loss of node-1 on the bridge were considered and discounted as factors that may have influenced the grounding.

As a vessel using an electronic chart display and information system (ECDIS) as the primary means of navigation, the functions, understanding and operation of the ECDIS were a central theme of this investigation. This analysis examines, among other factors, the passage planning process, the officers’ understanding of the ECDIS and properties of the ECDIS and Electronic Navigational Charts (ENC).

Amended route plan

The passage plan for the voyage from Saibai Island to Lizard Island was based on a pre-existing route. This route passed through Wreck Bay and had been successfully executed as part of several previous passage plans. However, amendments made to the route, in particular, the shifting of a waypoint resulted in the amended route being inadvertently plotted across Henry Reef, which was a potential navigational danger. The detection of this potential navigational hazard (Henry Reef) relied on the checking of the route, which was an integral part of the passage planning process.

Detection of Henry Reef

Once a route has been prepared on the ECDIS, it has to be checked for dangers to ensure that it is safe. This is done by inspecting the entire route visually and by using the ECDIS route safety checking function. The ABF passage planning checklist included checks to remind officers that the ECDIS check and berth-to-berth visual check of the route was required.

Visual check of the route

According to Wickens and Flach (1988), a person’s ability to gather information is critically influenced by that person’s knowledge state or mental model of a task.^[75] A mental model is the picture operators have in their heads of the way a system works.^[76] During the visual check, the officers searched the route for dangers and obstructions based on their mental model of the expected hazards.

The officers’ visual check focussed on looking for areas of green (indicating areas such as drying reefs) and areas of blue (indicating shallow water) on the amended route legs. The isolated danger symbol representing Henry Reef lay in waters shaded white indicating depths greater than 10 m.

The isolated danger symbol and its colour did not accord with ABFC Roebuck Bay’s master and navigation officer’s mental model of coral reef symbology. They expected reefs to be represented by green areas or to be surrounded by blue shading, similar to paper chart symbology. This interpretation of chart symbology likely influenced the focus of their visual check of the route.

The officers’ search focus and interpretation of chart symbology implied that the chances of them visually detecting the reef on the ECDIS would have been greatly increased had it been represented by an area feature shaded green or been surrounded by blue shading. Nevertheless, Henry Reef was a charted feature, represented by an accepted, standard, international symbol—the isolated danger symbol. Therefore, had the isolated danger symbol represented an obstruction other than a reef, it was likely that the outcome on board ABFC Roebuck Bay would have been no different. Furthermore, the officers understood that the symbol represented a potential hazard to safe navigation and agreed that sighting the symbol on the route would have triggered further checks. However, the isolated danger symbol was not sighted and the officers remained unaware of the presence of Henry Reef on the route until after the grounding.

Another factor that may have influenced the effectiveness of the visual check was the way in which symbols and text labels were positioned on an ECDIS display based on rules in the International Hydrographic Organization (IHO) standards. The ATSB analysis showed that the symbol and label for Henry Reef could be obscured on the ECDIS display when viewed under certain circumstances and ECDIS settings.

The visual monitoring of the route, which is part of normal watchkeeping practice, also did not detect the reef. It was highly likely that the same factors that influenced the visual check of the route during the planning stage also influenced the OOW’s visual monitoring of the route on the ECDIS.

ECDIS check of the route

ATSB tests and examination of ABFC Roebuck Bay’s ECDIS established that the cutter’s ECDIS detected and identified Henry Reef as a chart danger on the amended route plan. A check of the ‘Edit Route’ menu’s dangers tab folder would have shown that Henry Reef had been identified as a chart danger on the amended route leg from waypoint 20 (W20) to waypoint 21 (W21). Selecting the listed danger would have highlighted the isolated danger symbol representing Henry Reef and displayed it graphically on the ECDIS display.

The correct use of the ECDIS route dangers safety checking function would have alerted the master and navigation officer to the presence of Henry Reef on the planned route. However, the ECDIS route dangers safety checking function was not used. An inadequate knowledge of the ECDIS safety functions (see ECDIS knowledge below, stemming from ineffective training (see ECDIS type-specific training below), supported by the incorrect belief that the ECDIS would not allow an unsafe route to be saved resulted in a route being plotted across Henry Reef and the potential danger going undetected.

The failure in the planning phase to detect that the route was plotted across Henry Reef meant that an unsafe passage had been approved for use. The next opportunity to detect the reef would be during the monitoring phase of the passage plan process.

The dangers tab folder of the VisionMaster FT ECDIS’s ‘Monitor Route’ window replicated the information in the ‘Edit Route’ menu’s dangers tab folder. A check of the dangers tab of the ‘Monitor Route’ window at any time during the passage and especially before altering course at W20 would have alerted the officer of the watch (OOW) to the presence of Henry Reef. However, the OOW’s inadequate knowledge of the operation of the VisionMaster FT ECDIS and the use of its safety checking functions meant that the reef went undetected until the grounding.

This left the look‑ahead function as the last barrier to preventing the grounding.

Look-ahead safety checking function

It was very likely that ABFC Roebuck Bay’s ECDIS look-ahead safety checking function was set up according to the ‘ECDIS Start-up Checklist’, which prescribed a look-ahead setting of 3 minutes and an added breadth setting of 20 m.

Taking into account the 30-second interval of the look-ahead function, the charted position of the Henry Reef point feature and allowing for ABFC Roebuck Bay’s distance off the intended track, the 20 m added breadth setting could not guarantee the detection of Henry Reef. The manufacturer’s analysis and interview evidence supported this conclusion. It was therefore considered likely that the look-ahead function, as set-up based on ABF work instructions, did not encounter the isolated danger symbol representing Henry Reef and therefore, did not generate a chart danger alarm before the impending grounding. However, had the look-ahead function’s added breadth setting been wider, similar to the recommended setting for restricted waters in the Annex C checklist (0.1 NM or about 185 m), then it is very likely that Henry Reef would have been detected and a chart danger alarm generated.

The assessment that the look-ahead function likely did not detect the reef (and therefore, did not generate an alarm) is also consistent with watchkeeper recollections of the night and supported by the manufacturer’s analysis of the ECDIS data logs.

In addition, the ATSB also established that, based on the cutter’s speed, extent of the reef and charted position of the Henry Reef point feature, the 3-minute look-ahead setting would have offered limited time to take action in the event the system did alert the OOW to the reef.

The ECDIS audible alert buzzer

In the event the look-ahead function detected a chart danger, it would have generated an alarm with an audible and visual alert. However, the ECDIS audible alert buzzer on board ABFC Roebuck Bay had been permanently silenced thereby disabling audible alerts. This left the ECDIS’s visual alert indicator as the only means of alerting the OOW.

ECDIS knowledge

ABFC Roebuck Bay’s ECDIS identified a chart danger within the route plan’s safety region; however, this information could not be acted upon because the user was not aware of it. This was because their understanding and operation of the ECDIS differed from the manufacturer’s design and intended use of the system.

The cutter’s master and navigation officer understood that the ECDIS had the ability to alert them to the presence of a chart danger on a planned route. However, their understanding of how the ECDIS fulfilled this function was incorrect. They believed that the route validation process’ ‘Error’ function fulfilled this expectation. They expected that a danger identified on the route would generate a highlighted ‘Error’ message, which would prompt them to check the dangers tab folders. They also expected that the ECDIS would not allow them to save a route plotted across a chart danger, which likely provided a false sense of safety. ABFC Roebuck Bay’s officers did not have an adequate knowledge of the operation, capabilities and limitations of the VisionMaster FT ECDIS. Their expectations of the system’s capabilities were inaccurate and they depended on it to prevent them from having an accident in situations where the system was not capable of doing so.

The VisionMaster FT ECDIS met the minimum required standards for ECDIS. However, in this case, its design and usability did not meet the expectations of its users. A design taking into account the human factors of how mariners actually use the system in practice, including the user’s expectations can facilitate the interaction between the system and its users. This can significantly reduce the probability of erroneous actions thereby improving safety.^[77] The users in turn, were not equipped with adequate knowledge of the system’s capabilities and limitations, which would have allowed them to use the system as designed and intended by the manufacturer.

ECDIS type-specific training

The VisionMaster FT ECDIS type-specific familiarisation training provided by Safebridge included a tutorial phase, which covered the relevant aspects of the system’s route validation process and route safety checking functions. This training should have provided ABFC Roebuck Bay’s officers with the correct understanding and working knowledge of the ECDIS. However, the training, as undertaken by ABF officers, did not require the tutorial phase of the training to be undertaken prior to progressing to the test phase.

Further, the use of personal computers to undertake the training, in some cases outside of work hours, using poor internet connections, also likely influenced the effectiveness of the training. Evidence from almost all the ABF officers interviewed was consistent and indicated that the online type‑specific familiarisation training was poor and relatively ineffective. This meant that most officers, including ABFC Roebuck Bay’s master and navigation officer, relied on training and instructions from their peers (trickle down training) for their practical understanding of the use and functions of the ECDIS.

Consequently, the type-specific training provided to ABF officers was ineffective in transferring the knowledge required to operate the VisionMaster FT ECDIS safely and effectively at sea.

ECDIS continuation familiarisation training

The ABF ECDIS work instructions required that all members of the bridge team undertake initial and annual continuation familiarisation training on their vessel’s specific type of ECDIS and radar. However, there was no evidence of this training requirement being consistently implemented across the ABF fleet. Furthermore, the ECDIS route checking function was incorrectly described in the ECDIS continuation familiarisation training checklist. This appeared to indicate that the incorrect understanding of these functions likely extended beyond ABFC Roebuck Bay.

ECDIS start-up checklist

All ABF vessels were required to comply with ABF work instructions, which formed part of the organisation’s safety management system. The ECDIS work instructions applied to all ABF vessels using ECDIS as the primary means of navigation and was therefore, applicable to ABFC Roebuck Bay. Annexes to the ECDIS work instructions contained two checklists relating to ECDIS settings—an ‘ECDIS Start-up Checklist’ (Annex A) and an ‘ECDIS Recommended Information Layers’ checklist (Annex C).

At the time of the grounding, the cutter was reported to have been set up according to the ‘ECDIS Start-up Checklist’. There were no specific instructions or guidance in the work instructions as to the applicability, documentation or retention of this checklist for record-keeping purposes. The checklist was used by the navigation officer to assist with the set-up of the ECDIS at the commencement of the patrol and after a system restart. However, certain ECDIS settings in the checklist likely reduced the effectiveness of the ECDIS. For example:

• The use of the 5 m setting for both the safety depth (safety contour) and shallow contour values reduced the benefit of the ECDIS four colour display by reducing it to only three colours.
• The requirement for the ‘Alarm on cautions’ function would have increased the number of alarms generated by the ECDIS, and thereby increasing the likelihood of ‘alarm fatigue’ and the chance that the audible alert buzzer was silenced.
• The use of the default 20 m breadth setting in the look-ahead function (rather than a wider value) was likely to have influenced the effectiveness of the look-ahead function detecting Henry Reef (see Detection of Henry Reef above).

A separate checklist, in Annex C to the work instructions, comprised three lists of ECDIS settings categorised according to the navigational nature of the waters the cutter was operating in—restricted waters, coastal waters and open ocean. The work instructions contained no guidance on the applicability or use of this checklist.

The lack of guidance on the use of checklists in the ABF work instructions meant that there was no consistent means of interpreting or applying the annexed checklists. While certain settings in the ECDIS start-up checklist may have reduced the effectiveness of the ECDIS for this passage, the look-ahead settings in the Annex-C restricted waters checklist may have allowed for a more effective look-ahead safety checking function. However, there was no clear guidance or instructions on the adaptation of the ECDIS settings to suit the changing navigational conditions, as described in Annex C of the work instructions.

ECDIS survey and certification

The ECDIS onboard ABFC Roebuck Bay was installed and operated with a non-type-approved naval ECDIS software. After installation, the cutter was surveyed and subsequently certified by DNV GL, on behalf of the Australian Maritime Safety Authority, as using a type‑approved (commercial) ECDIS as its primary means of navigation. The type-approval certificate provided to DNV GL as part of the survey process was for a different software version to that installed on board. This meant there was a discrepancy between the ECDIS equipment installed on board and the ECDIS specifications based on which the cutter was certified. Further inquiries found that at least nine other ABF cutters were fitted with ECDIS operating on non-type-approved naval software, but were certified by DNV GL as using type-approved ECDIS to meet the chart carriage requirements of the regulations.

DNV GL were not made aware that non-type approved software was in use either during the survey or after. Nevertheless, the survey and certification process afforded an opportunity to identify that ABFC Roebuck Bay’s ECDIS did not meet the type-approval requirement of the regulations. Had this been identified, steps could have been be taken to determine the potential risks associated with the use of a non‑type-approved system. If it was determined that the naval ECDIS software was essential to the safe operation of ABF vessels, controls could have been put in place to ensure that the non‑type-approved naval ECDIS maintained on-going safety compliance equivalent to the commercial variant. One such possible mechanism might have been the use of an ABF vessel management plan. This would have allowed appropriate risk mitigation measures to be devised, documented and acknowledged by AMSA. However, ABFC Roebuck Bay did not have a vessel management plan in place until November 2017 and other ABF vessel management plans did not include any reference to ECDIS.

ECDIS software

PresLib 4.0 was introduced by the IHO in order to address display anomalies associated with the previous presentation library and to improve ECDIS usability at sea. Among the benefits of PresLib 4.0 were the addition of a number of new symbols, safety features and functionality as well as the introduction of a new alert model to address the issue of alarm fatigue while maintaining safety at sea.

When the ECDIS manufacturer released the Presentation Library 4.0 (PresLib 4.0) software update for the type-approved commercial VisionMaster FT ECDIS in April 2017, there was no equivalent update for the naval version. Guidance from the manufacturer indicated that only vessels required to comply with SOLAS were affected by the required upgrade to PresLib 4.0. It advised that naval systems and other non-type-approved products were not affected. However, as a regulated Australian vessel, the ECDIS onboard ABFC Roebuck Bay and other ABF cutters needed to meet SOLAS requirements, as referenced in the relevant AMSA marine orders. Therefore, the ECDIS needed to be type-approved and maintained to be compliant with the latest applicable standards of the IHO in order to meet the chart carriage requirements of the regulations.

The consequence of ABFC Roebuck Bay operating on the non-type‑approved naval version was that there was no update to PresLib 4.0 available by the compliance date of 31 August 2017. As a result, the cutter’s officers did not have access to the enhanced safety features offered by PresLib 4.0, such as the new ‘indication highlight’ symbol that could have aided the planning and monitoring phases of the passage plan. The visual check of the route leg from W20 to W21 would have shown Henry Reef, automatically highlighted as a navigational hazard by the indication highlight symbol (see Figure 33) and would likely have alerted the officers to the presence of the reef.

ENCs and hydrography

Paper charts were compiled at fixed scales with symbols, text and other information, placed by the cartographer to provide the best possible presentation for the various purposes of the mariner.

Advances in technology facilitated the development of electronic charts and chart display systems. While raster charts retained the familiar characteristics of paper charts, vector charts offered significant new features and functionality. ECDIS offered users the ability to monitor the position and progress of their vessel in real time. However, it also introduced new risks inherent to ECDIS that did not exist with paper charts.

The nature of the ECDIS chart display as a computer-generated image meant there were fundamental differences between the presentation of ENC data and the paper chart, particularly in the shape, colour, size and behaviour of symbols and in the placement of text. The ability to personalise the chart display also introduced the risk of vital information being lost if the system was not configured correctly.

The requirement for official charts also placed pressures on hydrographic offices to produce ENCs for their areas of responsibility. As a result, many ENCs were produced by a direct conversion from existing paper charts. While the use of such charts on ECDIS with electronic position fixing systems gave the impression of highly accurate navigation, the content and accuracy of these new ENCs still reflected that of the original paper charts. Further, the ability to zoom in while text and symbols stayed the same size could result in a false sense of safety that did not reflect reality.

Many of these risks are recognised but current control measures only extend as far as making the mariner aware of them, through system warnings, training or the use of barriers. Warning operators of the intrinsic risks or issues with a system is the least effective control measure. While training aims to implement best practice among crewmembers, it does not completely eliminate the problem and barriers can be bypassed, removed or subject to failures.^[78]

The ATSB acknowledges the challenges faced by hydrographic offices, ECDIS manufacturers, regulators and training providers in the transition to navigation with ECDIS. However, the ultimate aim must be to eliminate significant risk or at least reduce them to an acceptable level in terms of navigational safety. The goal must be to provide mariners with ECDIS and charts that are capable of being used as humans would expect to use them.

ENC AU413143

The ENC in use at the time of the grounding, AU413143 was compiled from data captured directly from the pre-existing paper chart of the area, Aus 836. The ENC was compiled based on rules in the relevant IHO standards and rules and was independently validated. Henry Reef was an identified, surveyed feature, represented on the paper charts and ENCs of the area albeit by different symbols. The reef was represented as a point feature on both chart formats—using the ‘coral pinnacle’ symbol on the paper chart and by the ‘underwater/awash rock’ symbol or the isolated danger symbol, on the ENC.

Point features and chart symbology

Henry Reef was represented by a point feature object on the ENC. This meant that an area on the earth’s surface was represented by a single point in the ENC database with a visual symbol.

The ECDIS’s ability to allow the ENC to be displayed at scales larger than the compilation scale is a function likely often used by mariners and provides additional advantages over passive paper charts. However, it also introduced an inherent risk that was not present in paper charts. At compilation scale, the visible size of the point feature’s symbol is generally representative of the size of the physical feature it depicts. However, when the ENC is viewed at scales larger than the compilation scale, point features representing rocks, wrecks and obstructions appear progressively smaller in relation to the physical size of the features they represent. During route planning, this can give the impression that the obstruction is clear of the route or further away from it than is actually the case. There was no evidence to suggest that this was a factor in the grounding of ABFC Roebuck Bay. Nevertheless, navigation and route planning on ECDIS near point feature objects representing rocks, wrecks and obstructions requires particular caution, especially when the ENC is being viewed at scales larger than the compilation scale.

Electronically, the ECDIS route checking function treats a point feature as a single point with no consideration of the area covered by the symbol at compilation scale. This can reduce the effectiveness of the ECDIS route checking and look-ahead functions. It can result in situations where a vessel’s planned route lies across an obstruction while the charted position of the point feature remains outside the route safety region and therefore, goes undetected by the ECDIS. In ABFC Roebuck Bay’s case, Henry Reef was within the ECDIS route safety region and was clearly identified by the ECDIS as a danger. Therefore, this factor did not influence the grounding. Nevertheless, the use of point feature objects to represent physical features on the earth’s surface can adversely affect the ECDIS’s ability to detect navigational hazards affecting the planned route and can increase the risk of the hazard posed by such features being misinterpreted by mariners.

While the above analysis focused on Henry Reef, the use of a point feature to represent any potential navigational hazard of significant size in any ENC increases the risk of grounding when mariners use those ENCs. As may be inferred from the investigation into the grounding of Kea Trader in the Pacific Ocean, the use of point features to represent reefs or rocks of significant area can be shown to be linked to a significant grounding elsewhere.

ECDIS overscale indications

The VisionMaster FT ECDIS user manual indicated that a display overscale prompt and pattern was displayed on the ECDIS whenever any chart on the display was viewed at more than twice its compilation scale. However, during ATSB testing, the prompt appeared but there was no overscale pattern displayed on ENC AU413143 regardless of the scale at which it was viewed.

There was no evidence to suggest that the absence of the overscale pattern influenced the passage planning or route monitoring on board ABFC Roebuck Bay. However, the absence of the pattern could potentially be misleading to users of the VisionMaster FT ECDIS who were guided by the manual and accustomed to the overscale pattern as a safety precaution.

Emergency preparedness and response

Accounts of ABFC Roebuck Bay’s grounding and of the immediate events that followed were indicative of a calm, well-drilled response to the emergency. Damage control measures implemented were effective in stabilising the vessel, controlling water ingress and preventing further damage to the cutter. The master, officers and crew demonstrated high standards of seamanship in their emergency preparedness and response to the grounding.

The subsequent response, re-floating and safe recovery of the cutter to Cairns involved the coordinated actions of several different organisations, vessels and aircraft. The tasking of assisting vessels, including Coral Knight, was timely and effective in the successful recovery of ABFC Roebuck Bay.

__________

75. Wickens, CD, and Flach, JM (1988). Information processing. In Werner EL and Nagel DC (Eds). Human factors in aviation (pp. 111-155). San Diego: Academic Press.
76. Wise, JA, Hopkin, VD, and Garland, DJ (2010). Handbook of aviation human factors. Boca Raton: CRC Press.
77. Abeysiriwardhane, Lützhöft, & Enshaei, 2014, Human factors in ship design; Exploring the bottom rung, cited in Oltedal, HA and Lutzhoft, M, 2018, Managing Maritime Safety (eds). Oxon: Routledge
78. Oltedal. HA and Lutzhoft, M (2018). Managing Maritime Safety (eds). Oxon: Routeledge.

Findings

From the evidence available, the following findings are made with respect to the grounding of ABFC Roebuck Bay on Henry Reef, Queensland on 30 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The amended route plan for the passage from Saibai Island to Lizard Island was inadvertently plotted across Henry Reef, which was a potential navigational danger.
• The deck officers did not visually identify Henry Reef as a navigational danger on the ECDIS display during the passage planning and monitoring processes. The effectiveness of the visual check was likely influenced by a misinterpretation of chart symbology and possible obscuration of the reef's chart symbol and label. In addition, although the ECDIS detected Henry Reef as a navigational danger, this system function was also not correctly utilised. This was in part due to an expectation that the ECDIS would not save a route plotted across a chart danger and because of a misunderstanding of the ECDIS safety checking functions.
• It was likely that the ECDIS look-ahead function, as set-up based on ABF work instructions, did not encounter the isolated danger symbol representing Henry Reef and therefore, did not generate a chart danger alarm before the impending grounding. Furthermore, the ECDIS audible alert buzzer was permanently muted leaving the ECDIS's visual alert indicator as the only means of alerting the officer of the watch.
• The deck officers on board ABFC Roebuck Bay did not have an adequate level of knowledge to operate the VisionMaster FT ECDIS as the cutter’s primary means of navigation.
• Although the online VisionMaster FT ECDIS type-specific familiarisation training included the relevant content, the training as undertaken by Australian Border Force deck officers was not effective in preparing ABFC Roebuck Bay's officers for the operational use of the ECDIS. [Safety issue]
• The ABF ECDIS start-up checklist included settings that likely reduced the ECDIS's effectiveness and contained no guidance on the adjustment of these settings to suit the changing navigational environment. These settings included:

-  a 20 m look-ahead added breadth setting
-  same depth value for safety contour and shallow contour settings
-  the requirement that cautions be presented as alarms.

• Most Australian Border Force cutters, including ABFC Roebuck Bay, were installed with ECDIS operating on non-type-approved naval software. Subsequently, DNV GL, acting on behalf of the Australian Maritime Safety Authority, incorrectly certified these vessels as using type-approved ECDIS to meet the chart carriage requirements of the regulations. This removed an opportunity to put in place controls to ensure ongoing safety compliance. [Safety issue]
• ECDIS on board most Australian Border Force cutters, including ABFC Roebuck Bay, operated with a non-type-approved naval software version that was not updated to the latest applicable standards of the International Hydrographic Organization. The ECDIS therefore did not comply with the minimum requirements of an ECDIS being used to meet the chart carriage requirements of the regulations. As a result, the enhanced safety features of the new presentation library, which would have potentially alerted the officers to the danger posed by the reef, were not available. [Safety issue]

Other factors that increased risk

• ABF officers were not consistently provided with annual ECDIS continuation familiarisation training required by ABF procedures. Training resources referenced in the procedures contained incorrect guidance for the use of the VisionMaster FT ECDIS's route checking functions.
• The hydrographic use of point feature objects to represent physical features of relatively significant spatial extent on an Electronic Navigational Chart can increase the risk of the hazard posed by such features being misinterpreted by mariners and potentially reduce the effectiveness of the ECDIS safety checking functions. [Safety issue]
• The ECDIS did not display a chart overscale pattern when Electronic Navigational Chart AU413143 was viewed at scales larger than twice the compilation scale, as stated in the ECDIS manual. However, the ECDIS did display a text prompt when the chart was viewed at scales larger than its compilation scale.

Other findings

• The Electronic Navigational Chart AU413143 was compiled by the Australian Hydrographic Office to International Hydrographic Organization standards and was based on data captured directly from the paper navigational chart Aus 836. Henry Reef was a charted geographical feature represented as a point feature object on both the paper and Electronic Navigational Charts of the area.
• The master, officers and crew of ABFC Roebuck Bay demonstrated high standards of seamanship in their emergency preparedness and response to the grounding. Subsequent response efforts involving the Australian Maritime Safety Authority, Coral Knight and other assisting vessels and aircraft were timely and effective in the safe recovery of the cutter.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

ECDIS familiarisation

Safety issue: MO-2017-009-SI-01

Safety issue description: Although the online VisionMaster FT ECDIS type-specific familiarisation training included the relevant content, the training as undertaken by Australian Border Force deck officers was not effective in preparing ABFC Roebuck Bay's officers for the operational use of the ECDIS.

Vessel survey and certification

Safety issue: MO-2017-009-SI-02

Safety issue description: Most Australian Border Force cutters, including ABFC Roebuck Bay, were installed with ECDIS operating on non-type-approved naval software. Subsequently, DNV GL, acting on behalf of the Australian Maritime Safety Authority, incorrectly certified these vessels as using type-approved ECDIS to meet the chart carriage requirements of the regulations. This removed an opportunity to put in place controls to ensure ongoing safety compliance.

ECDIS software

Safety issue: MO-2017-009-SI-03

Safety issue description: ECDIS on board most Australian Border Force cutters, including ABFC Roebuck Bay, operated with a non-type-approved naval software version that was not updated to the latest applicable standards of the International Hydrographic Organization. The ECDIS therefore did not comply with the minimum requirements of an ECDIS being used to meet the chart carriage requirements of the regulations. As a result, the enhanced safety features of the new presentation library, which would have potentially alerted the officers to the danger posed by the reef, were not available.

Hydrographic use of point features

Safety issue: MO-2017-009-SI-04

Safety issue description: The hydrographic use of point feature objects to represent physical features of relatively significant spatial extent on an Electronic Navigational Chart can increase the risk of the hazard posed by such features being misinterpreted by mariners and potentially reduce the effectiveness of the ECDIS safety checking functions.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Australian Border Force

The ABF have conducted a review of work instructions related to the use of ECDIS and radar, bridge watchkeeping and passage planning. The ECDIS work instructions have been updated to reflect the findings of the ATSB investigation into the grounding of ABFC Roebuck Bay and address the conflicting information in the annexes. The look-ahead added breadth setting has been increased to a setting of 200 m on either side of the ship. The updated work instructions were published in March 2019.

The ABF also advised that a navigation and ECDIS specific section has been included in the annual internal audit package.

Northrop Grumman Sperry Marine

In order to provide mariners more time to react to information, Northrop Grumman Sperry Marine has increased the frequency of the look-ahead danger checking function from every 30 seconds to every 15 seconds. This change was made in version 11 of the VisionMaster FT ECDIS (released in December 2018).

The ECDIS manufacturer advised the ATSB that a more recent software version showed the overscale pattern being generated on ENC AU413143 when viewed at scales larger than twice the compilation scale, as described in the ECDIS user manual.

General details

Ship details

Appendices

Appendix A – Annex A – ECDIS Start-up Checklist

Extract from the Australian Border Force Work Instruction NS-1007 Use of ECDIS and RADAR on Australian Border Force cutters.

Appendix B – Annex C – ECDIS Recommended Information Layers – Port/Coastal/Open Ocean

Extract from the Australian Border Force Work Instruction NS-1007 Use of ECDIS and RADAR on Australian Border Force cutters.

Appendix C – Categories of zone of confidence in data table (CATZOC)

Appendix D - Henry Reef ENC information

A chart query of the isolated danger symbol representing Henry Reef on ABFC Roebuck Bay’s ECDIS provided the following information:

• underwater rock/awash rock
• object type: Henry Reef
• latitude: 12º 13.381’ S
• longitude: 143º 49.126’ E
• database: SevenCs – S-57
• chart: AU413143
• scale minimum: 699999
• value of sounding: 0
• natural surface: coral
• exposition of sounding: shoaler than range of depth of the surrounding depth area
• object name: Henry Reef
• water level effect: covers and uncovers
• quality of sounding measurement: depth unknown.

Appendix E – Extract from supplement to the Seafarer’s Handbook for Australian Waters (AHP20)

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• ABFC Roebuck Bay’s deck officers
• Australian Border Force (ABF)
• Australian Maritime Safety Authority (AMSA)
• Northrop Grumman Sperry Marine (NGSM)
• Australian Hydrographic Office (AHO)
• Electrotech (ECDIS sales and service providers)
• DNV GL
• Great Barrier Reef Marine Park Authority (GBRMPA)
• REEF VTS
• Maritime Safety Queensland (MSQ).

References

Abeysiriwardhane, Lützhöft, & Enshaei, 2014, Human factors in ship design; Exploring the bottom rung, cited in Oltedal, HA and Lutzhoft, M, 2018, Managing Maritime Safety (eds). Oxon: Routledge

Australian Hydrographic Service, 2015, Australian use of the object catalogues (AUoC), AHS, Wollongong. Available at www.hydro.gov.au

Australian Hydrographic Service, 2016, Seafarers Handbook for Australian waters, Edition 4, AHS, Wollongong.

Australian Hydrographic Service, 2017, Australian chart & publication maintenance handbook (AHP 24), 4th Edition, AHS, Wollongong. Available at www.hydro.gov.au

Australian Maritime Safety Authority, 2014, Marine Notice 17/2014 – Sound navigational practices, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2015, Marine Order 28 – Operations standards and procedures 2015, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2015, Marine Order 31 – Vessel surveys and certification, 2015, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2016, Marine Order 27 – Safety of navigation and radio equipment 2016, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2017, Marine Notice 06/2017 – Official Nautical Charts, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2017, Marine Notice 07/2017 – Guidance on ECDIS for ships calling at Australian Ports, AMSA, Canberra. Available at www.amsa.gov.au

Dr. Norris, A. 2010, Integrated Bridge Systems Volume 2 – ECDIS and Positioning, The Nautical Institute, London.

Great Barrier Reef Marine Park Authority, 2017, Site assessment of damage report: Australian Border Force vessel Roebuck Bay – Henry Reef (12-053), GBRMPA, Townsville. Available at www.gbrmpa.gov.au

Grech, MR, Horbery, TJ, and Koester T (2008). Human factors in the maritime domain. Boca Raton: Taylor and Francis.

ECDIS Ltd, Approved ECDIS systems

International Chamber of Shipping, 2007, Bridge Procedures Guide, Fourth Edition, Marisec Publications, London.

International Hydrographic Organization, 1994, Special Publication No. 32, Hydrographic Dictionary, 5th Edition, IHO, Monaco. Available at www.iho.int

International Hydrographic Organization, 2000, Special Publication No. 57, IHO transfer standard for digital hydrographic data, Edition 3.1, IHB, Monaco. Available at www.iho.int

International Hydrographic Organization, 2013, Regulations of the IHO for International (INT) Charts and Chart Specifications of the IHO, Edition 4.4.0, IHB, Monaco. Available at www.iho.int

International Hydrographic Organization, 2014, Publication S-52, Specifications for chart content and display aspects of ECDIS, Edition 6.1(.1), IHO, Monaco. Available at www.iho.int

International Hydrographic Organization, 2017, Publication S-58, ENC validation checks, Edition 6.0.0, IHO, Monaco. Available at www.iho.int

International Hydrographic Organization, 2017, Publication S-65, ENCs – Production, maintenance and distribution guidance, Edition 2.1.0, IHO, Monaco. Available at www.iho.int

International Hydrographic Organization, 2017, Publication S-67, Mariner’s guide to accuracy of Electronic Navigational Charts (ENC), Edition 0.5, IHO, Monaco. Available at www.iho.int

International Hydrographic Organization, 2018, Publication S-66, Facts about electronic charts and carriage requirements, Edition 1.1.0, IHO, Monaco. Available at www.iho.int

International Maritime Organization, 1999, Guidelines for voyage planning, Resolution A.893(21), IMO, London. Available at www.imo.org

International Maritime Organization, 2006, Revised performance standards for electronic chart display and information systems (ECDIS), Resolution MSC.232 (82), IMO, London. Available at www.imo.org

International Maritime Organization, 2012, Model Course on the Operational Use of Electronic Chart Display and Information Systems (Model Course 1.27), IMO, London.

International maritime Organization, 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.

International Maritime Organization, 2017, ECDIS – Guidance for good practice, MSC.1/Circ.1503/Rev.1, IMO, London. Available at www.imo.org

International Maritime Organization, 2018, International Management Code for the Safe Operation of ships and for Pollution Prevention (ISM Code) as amended, IMO, London.

Kort and Matrikelstyrelsen, 2010, Behind the Nautical Chart, Danish Ministry of the Environment, Copenhagen.

Maps included in this report were created using ArcGIS® software by Esri. ArcGIS® and ArcMap™ are the intellectual property of Esri and are used herein under license. Copyright © Esri. All rights reserved.

National Oceanic and Atmospheric Administration and National Geospatial-Intelligence Agency, 2019, U.S. Chart No.1, 13th Edition, Maryland, United States.

Nautical Institute, 2012, Industry recommendations for ECDIS familiarisation, NI, London. Available at www.nautinst.org

Navigation Act 2012. Available at www.legislation.gov.au

Oltedal. HA and Lutzhoft, M (2018). Managing Maritime Safety (eds). Oxon: Routeledge.

Prince, M. 2012, Accuracy and reliability of charts, Australian Hydrographic Service, Wollongong. Available at www.hydro.gov.au

Prince, M. 2012, Getting the best from Electronic Navigational Charts (ENC) in the Great Barrier Reef, Australian Hydrographic Service, Wollongong. Available at www.hydro.gov.au

Rouse, WB and Morris, NM (1985). On looking into the black box: prospects and limits in the search for mental models (85-2). Arlington: Office of Naval Research.

State of Queensland (Department of Transport and Main Roads), 2017, Great Barrier Reef and Torres Strait Vessel Traffic Service (Reef VTS) – User Guide 2017, State of Queensland (Department of Transport and Main Roads). Available at www.msq.qld.gov.au

United Kingdom Hydrographic Office, 2015, Admiralty Sailing Directions - Australia Pilot Volume 3 (NP 15), 13th Edition, UKHO, Taunton.

United Kingdom Hydrographic Office, 2015, Guide to ENC symbols used in ECDIS (NP 5012), 2nd Edition, UKHO, Taunton.

United Kingdom Hydrographic Office, 2016, Guide to the Practical Use of ENCs (NP 231), UKHO, Taunton.

United Kingdom Hydrographic Office, 2016, The Mariner’s Handbook (NP 100), 11th Edition, UKHO, Taunton.

United Kingdom Hydrographic Office, 2018, Symbols and abbreviations used on Admiralty charts (NP 5011), 7th Edition, UKHO, Taunton.

Wickens, CD, and Flach, JM (1988). Information processing. In Werner EL and Nagel DC (Eds). Human factors in aviation (pp. 111-155). San Diego: Academic Press.

Wise, JA, Hopkin, VD, and Garland, DJ (2010). Handbook of aviation human factors. Boca Raton: CRC Press.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Australian Border Force, ABFC Roebuck Bay’s master, deck officers and lookout, Australian Maritime Safety Authority, Northrop Grumman Sperry Marine, Electrotech, REEF VTS, Maritime Safety Queensland, the Australian Hydrographic Office, DNV GL Det Norske Veritas - Germanischer Lloyd, the Great Barrier Reef Marine Park Authority, and Coral Knight’s master.

Submissions were received from Australian Border Force, ABFC Roebuck Bay’s master and navigation officer, Australian Maritime Safety Authority, Northrop Grumman Sperry Marine, the Australian Hydrographic Office, and DNV GL. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Glossary

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 26 September 2017, an instructor and student conducted a training flight in a Diamond Aircraft Industries DA40 aircraft, registered VH-MPM, from Archerfield Airport, Queensland. The flight training organisation was Aircrew Training and Support Pty Ltd, and the purpose of the flight was a simulated Recreational Pilot Licence (RPL) flight test to prepare the student for an upcoming RPL flight test.

The aircraft entered a developed spin during manoeuvres consistent with advanced stall recovery training which likely included intentional incipient spins. The spin continued until the aircraft collided with terrain. The instructor and student were fatally injured, and the aircraft was destroyed.

What the ATSB found

The ATSB found that the aircraft limitation prohibiting intentional spins was intended to include incipient spins. However, the manoeuvre was not defined and some operators considered that the manoeuvre was not an intentional spin. In addition, the aircraft was not certified for developed spin recovery, and the capability of the aircraft to recover from a developed spin had not been established nor was it required to be.

The ATSB also found that the instructor could not or did not prevent the aircraft from entering a developed spin, for reasons that could not be established.

The instructor’s flight records showed no evidence of spin training since his initial instructor training in January 2011. After this initial training, there was no requirement for an instructor to undergo any further spin training. However, a week before the accident flight, the student had mishandled the recovery from an incipient spin and the accident flight instructor had taken control of the aircraft and recovered, showing that he had the ability to recover from a spin at that stage of development.

What’s been done

The ATSB has issued a Safety Advisory Notice (AO‑2017‑096‑SAN-012) for training organisations conducting incipient spins in non-spin-permitted aircraft.

The Civil Aviation Safety Authority will review incipient spin recovery guidance provided in the Flight Instructor Manual.

Safety message

Although the reasons for the accident could not be fully established, the investigation identified varying interpretations of an ‘incipient spin’. Operators and pilots should clarify with manufacturers the extent to which the early stages of a spin are permissible and ensure that aircraft are always operated in accordance with limitations.

Furthermore, operators should have procedures, and instructors should take all steps, to ensure that they maintain the necessary skills to avoid unintentional spins and recover from both incipient and developed spins.

The New Zealand Civil Aviation Authority booklet, Spin Avoidance and Recovery provides valuable guidance for pilots in spin avoidance and recovery. The booklet provides the following advice for pilots regarding spin recovery:

To have a chance at recovery, the pilot must immediately recognise the spin, and its direction, know exactly what to do in the right order, and then execute the procedure correctly the first time.

VH-MPM accident site

Source: ATSB

The occurrence

What happened

On the morning of 26 September 2017, an instructor and student conducted a training flight in a Diamond Aircraft Industries DA40 aircraft, registered VH-MPM, from Archerfield Airport, Queensland. The flight training organisation was Aircrew Training and Support Pty Ltd, and the purpose of the flight was a simulated Recreational Pilot Licence (RPL) flight test to prepare the student for an upcoming RPL flight test.

At 0913 Eastern Standard Time (EST),^[1] the aircraft departed Archerfield. The aircraft tracked towards the Archerfield training area and climbed to about 3,000 ft above mean sea level (AMSL).

At 0927, the aircraft entered the training area and commenced sequences consistent with a RPL flight test at altitudes between about 2,600 ft and about 4,500 ft AMSL (Figure 1).^[2]

Figure 1: Overview of training area sequences

The figure shows the flight path of VH-MPM and location of accident site. Source: Google Earth and Airservices Australia, annotated by ATSB

From about 0939, radar data showed the aircraft conducted several short climbs followed by brief, rapid descents, which also included changes in heading. These manoeuvres were consistent with advanced stall^[3] recovery training (see Wreckage examination).

At 0943:08, radar data showed the aircraft commence a climb to about 4,500 ft with a reducing groundspeed, consistent with further stall recovery training. The data then showed the aircraft’s flight path to be a near vertical descent with an average descent rate of about 6,000 feet per minute.

At 0943:44, as the aircraft descended, the instructor made a MAYDAY^[4] broadcast on the area frequency stating ‘…the aircraft is in a sp…’ before the recorded transmission ended.

The descent continued until the aircraft descended below radar coverage with the last recorded radar position almost precisely above the accident site.

A witness, positioned 1.2 km west of the accident site, observed the aircraft turning and described the aircraft in a vertical, tight spiral descent with the aircraft’s nose slightly below horizontal, consistent with a spin (see Aircraft information). The witness described the spin continue for several complete turns until the aircraft collided with terrain.

Radar data indicates that the aircraft collided with terrain at about 0943:50. The instructor and student were fatally injured by impact forces and the aircraft was destroyed. There was no fire.

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. The ground level elevation over which the aircraft operated in the training area was about 100 ft to 400 ft above mean sea level. The accident site elevation was 167 ft.
3. Aerodynamic stall: occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack and results in reduced lift.
4. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.

Context

Pilot information

Instructor

General information

The instructor held an Air Transport Pilot Licence (Aeroplane), a flight instructor rating with a Grade 1 training endorsement and a Class 1 aviation medical certificate.

At the time of the accident flight, the instructor had over 3,200 hours of flying experience, of which over 170 hours were on the DA40.

Spin training and knowledge

The regulations required that an instructor complete training in developed spin recovery techniques prior to obtaining an instructor rating. After this initial training, there was no regulatory requirement for an instructor to undergo further spin training.

A review of the instructor’s training records showed he underwent developed spin recovery training on 18 January 2011, while training for his initial instructor rating. His employment records and logbooks show no subsequent spin training or assessment. However, there was no requirement to record spins or spin training in pilot logbooks.

Students of the flying school later reported that the instructor advised them of a recent incipient spin (see Spin classifications and recovery) occurrence. About a week prior to the accident flight, the same pairing of student and instructor as the accident flight entered an incipient spin during advanced stall recovery training. The instructor had described the student mishandling the recovery of the incipient spin which led to the aircraft entering an incipient spin in the opposite direction. The instructor then took control of the aircraft and recovered to stable flight.

On the day before the accident, the instructor conducted the ground school training of another pilot as part of the training for the issue of an instructor rating. During this training, the pilot presented a briefing on advanced stall recovery training to the instructor, which the instructor reviewed, took notes and provided feedback.

The ATSB assessment of the instructor’s feedback and notes indicated that the instructor’s knowledge of incipient spin recovery was consistent with established guidelines.

Student

The student was not required to hold, and did not hold, a flight crew licence. The student held a Class 2 aviation medical certificate and had 58 hours of flying experience, of which 19 hours were on the DA40.

Medical information

The ATSB found no indicators that increased the risk of either the instructor or student experiencing a level of fatigue known to have an effect on performance.

Witness reports from family and acquaintances indicate that the instructor and student were in good health and a good mental state prior to the flight. A review of the instructor and student’s medical history and the instructor’s mobile phone data found no indication that the health and or mental state of the instructor or student contributed to the accident. Post-mortem and toxicological examinations of the instructor and student did not reveal any medical issues that may have contributed to the accident.

Wreckage examination

The aircraft impacted terrain at an elevation of 167 ft above mean sea level. On-site examination of the wreckage and surrounding ground marks indicated that the aircraft impacted terrain left wing first, nose-down and rotating to the left at low forward speed. This was consistent with a left upright spin (Figure 2).

The forward fuselage separated at the engine firewall. The wings, centre fuselage, and rear fuselage all separated in a direction consistent with a left spin. Evidence from examination of the engine and propeller was consistent with the engine producing low power at the time of the accident. Although the throttle position could not be determined from the wreckage, evidence from the engine and propeller corresponds to the recommended power setting for spin recovery (idle).

The positions of the rudder, ailerons and elevator at the time of the accident could not be determined, however the wing flaps were retracted. Both fuel tanks were ruptured and the fuel selector was selected to the left fuel tank.

Figure 2: Wreckage comparison

The figure provides a comparison between the wreckage of VH-MPM and the expected wreckage pattern for a spin accident as described by Wood and Sweginnis (1995), Aircraft Accident Investigation.
Source: ATSB and Endeavour Books

Examination of the wreckage and maintenance documentation found no evidence of a pre-existing problem that may have contributed to the accident. The accident was not survivable.

Purpose of the flight

The purpose of the flight was to prepare the student for an upcoming RPL flight test. On the day before the accident, the instructor and student conducted a simulated RPL flight test in accordance with Civil Aviation Safety Authority (CASA) form 61-1486 - Recreational Pilot Licence – Aeroplane. During this flight, the instructor determined that the student was not ready for the test. For the flight on the day of the accident, the instructor and student intended to conduct a similar flight to revise the sequences requiring attention.

A handwritten note (Figure 3) was found in the cockpit and was determined to relate to the accident flight. The note listed the following sequences to be conducted in the training area:

• unusual attitudes
• steep turns
• stalls
• advanced stalls
• practice forced landing
• precautionary search and landing.

The order of sequences and markings on the note aligned with the aircraft movements captured by radar. The note indicated that the sequences up to and including stalls had been completed. At the time the aircraft entered the spin, the instructor and student were likely conducting the next incomplete item on the list, which was advanced stall recovery training.

Figure 3: Instructor’s note from accident flight

Source: Queensland Police annotated by ATSB

The advanced stall recovery training component of the simulated RPL test required a student to demonstrate recovery from incipient spins (see Aircraft information) and stalls conducted with different engine power settings, aircraft configurations and entry attitudes.

This sequence requires an instructor or student to configure and manoeuvre an aircraft in a manner that is conducive to an incipient spin. An instructor may also deliberately induce an incipient spin. A student must then demonstrate the correct recovery to stable flight.

The aircraft should not be permitted to enter a developed spin, however, slow recovery action or mishandling during the incipient spin recovery may lead to an aircraft entering a developed spin. If the student does not demonstrate prompt and correct recovery actions, an instructor should take control to prevent the aircraft entering a developed spin.

Aircraft information

General information

The Diamond Aircraft Industries DA40-180 is a four-seat, low-wing, fixed-tricycle-undercarriage aircraft with a glass and carbon fibre reinforced polymer construction. It has a single reciprocating engine driving a variable pitch two bladed propeller (Figure 4). The aircraft was equipped with dual controls for the student and instructor and Garmin G1000 instrumentation. It was not equipped with an aircraft parachute system.

Figure 4: VH-MPM

Source: Operator

VH-MPM was manufactured in 2006 and had a total time in service of 678 hours. It had a valid maintenance release showing no outstanding issues and the last scheduled maintenance was completed on 22 August 2017.

Weight and balance

The aircraft was loaded within weight and longitudinal balance limits for the duration of the flight.

Fuel system and distribution

The aircraft was fitted with a main and auxiliary fuel tank with a combined capacity of 92.5 L in each wing, providing a total fuel capacity of 185 L. A fuel tank selector, positioned on the centre console between the student and instructor, provided for the selection to use fuel from the left or right fuel tanks or to select the fuel off.

Fuel records indicated that the aircraft was loaded with 139 L of fuel prior to departure, sufficient for the planned flight.

The aircraft flight manual contained the following fuel limitation:

Maximum permissible difference between right and left tanks: 8 US gallons (approximately 30 L)

It was not possible to determine the fuel level in each tank prior to take-off or during the flight. The fuel tanks ruptured during the accident and a significant amount of fuel escaped from each tank. Therefore, the distribution of fuel on board at the time of the accident could not be determined.

Intentional spinning limitation

The aircraft flight manual included a limitation stating that intentional spinning was not permitted in the aircraft.

The manufacturer provided the following comment regarding the conduct of incipient spins in VH-MPM:

The DA40 used in this accident is not approved for intentional spins, incipient or otherwise. Inducing a spin is outside of the approved envelope of the DA40.

The manufacturer also advised:

Using rudder deflection to enter an incipient spin, even if the aircraft is immediately recovered from that incipient spin, is an intentional spin and therefore not allowed to be performed with a DA40.

Certification spin testing

The aircraft type was certified in the Normal and Utility categories in accordance with European Aviation Safety Agency (EASA) Joint Aviation Regulations (JAR) part 23.

The aircraft was not approved for intentional spinning, but had been evaluated to meet the requirements of JAR Part 23.221, namely:

a. Normal Category aeroplanes. A single engined, normal category aeroplane must be able to recover from a one-turn spin or a three-second spin, whichever takes longer, in not more than one additional turn, after initiation of the first control action for recovery. In addition –

1. For both the flaps-retracted and flaps-extended conditions, the applicable airspeed limit and positive limit manoeuvring load factor must not be exceeded;

2. No control forces or characteristic encountered during the spin or recovery may adversely affect prompt recovery;

3. It must be impossible to obtain unrecoverable spins with any use of the flight or engine power controls either at the entry into or during the spin; and

4. For the flaps extended condition, the flaps may be retracted during the recovery but not before rotation has ceased.

b. Utility category aeroplanes. A utility category aeroplane must meet the requirements of sub-paragraph (a).

The certification report stated that the aircraft exhibited prompt incipient spin recovery behaviour within the certification requirements. The manufacturer was not required to and did not test the aircraft for fully developed spin behaviour and recovery.

Developed spin recovery

While, the flight manual prohibited intentional spinning, the manual provided the procedure shown in Figure 5 to assist in recovery from an unintentional spin.

Figure 5: Unintentional spin recovery checklist

Source:  Diamond Aircraft

Aerodynamic spins

An aerodynamic spin is a sustained spiral descent in which an aircraft’s wings are in a stalled condition, with one wing producing more lift than the other. This difference in lift sustains the rotation and keeps the aircraft in the spin. The nose angle can also vary considerably. In a fully developed, upright, left spin, an aircraft will simultaneously roll^[5] to the left while yawing^[6] to the left, making a vertical corkscrew path through the air. A spinning aircraft will descend more slowly than one in a vertical dive and it will also have a lower airspeed, which may oscillate.

Spin classifications and recovery

The United States Federal Aviation Administration publication Airplane Flying Handbook, Chapter 4: Maintaining Aircraft Control: Upset Prevention and Recovery Training provides the following further information regarding spin classification and recovery:

Incipient phase
The incipient phase occurs from the time the airplane stalls and starts rotating until the spin has fully developed. This phase may take two to four turns for most airplanes. In this phase, the aerodynamic and inertial forces have not achieved a balance. As the incipient phase develops, the indicated airspeed will generally stabilize at a low and constant airspeed and the symbolic airplane of the turn indicator should indicate the direction of the spin. The slip/skid ball is unreliable when spinning.

The pilot should initiate incipient spin recovery procedures prior to completing 360° of rotation. The pilot should apply full rudder opposite the direction of rotation. The turn indicator shows a deflection in the direction of rotation if disoriented.

Incipient spins that are not allowed to develop into a steady-state spin are the most commonly used maneuver in initial spin training and recovery techniques.

Developed phase
The developed phase occurs when the airplane’s angular rotation rate, airspeed, and vertical speed are stabilized in a flightpath that is nearly vertical. In the developed phase, aerodynamic forces and inertial forces are in balance, and the airplane’s attitude, angles, and self-sustaining motions about the vertical axis are constant or repetitive, or nearly so. The spin is in equilibrium. It is important to note that some training airplanes will not enter into the developed phase but could transition unexpectedly from the incipient phase into a spiral dive. In a spiral dive the airplane will not be in equilibrium but instead will be accelerating and G load can rapidly increase as a result.

The New Zealand Civil Aviation Authority booklet, Spin Avoidance and Recovery provides further useful information. The booklet also provides the following guidance regarding developed spin recovery:

The minimum altitude loss for a textbook recovery will be about 1000 to 1500 feet.

The Australian Civil Aviation Safety Authority did not provide guidance defining the incipient spin manoeuvre.

During the investigation, the ATSB discussed the manoeuvre with the operator’s Head of Operations, the operator’s previous Head of Operations and the Head of Operations of the instructor’s previous employer.

• The operator’s Head of Operations described conducting ‘wing-drop’ manoeuvres in the DA40.
• The previous Head of Operations commented that incipient spins in the DA40 were risky as spins were prohibited for the aircraft type. This made training in the aircraft difficult.
• The Head of Operations of the instructor’s previous employer advised that the flight test requirement was to conduct ‘wing-drop stalls’ and that this did not constitute spinning.

Civil Aviation Safety Authority

Appropriate use of aircraft

CASA provided the following comment regarding training operations using aircraft which are not approved for intentional spins:

If the operator does not have a suitable type of aircraft for a particular kind of training, then CASA would expect the operator to make appropriate arrangements to acquire or loan a suitable aircraft. The Head of Operations of a training operator has the responsibility to ensure the proper allocation and deployment of aircraft.

Incorrect guidance

While the ATSB assessed that the instructor’s incipient spin recovery knowledge was consistent with established guidelines and did not contribute to the accident, the investigation identified incorrect incipient spin recovery guidance provided by CASA.

The CASA publication Flight Instructor Manual, provides the following guidance for incipient spin recovery:

RECOVERY FROM THE INCIPIENT STAGE

As soon as the aeroplane has stalled and commenced to yaw take the appropriate recovery action. Increase power, apply sufficient rudder to prevent further yaw and ease the control column forward sufficiently to un-stall the aeroplane. Point out that if power is to materially assist recovery action it must be applied before the nose of the aeroplane has pitched too far below the horizon otherwise its use will only increase the loss of height.

Increasing engine power prior to an application of sufficient rudder to prevent further yaw and applying sufficient nose-down elevator un-stall the wings as described is inconsistent with established guidelines and manufacturer guidance.

The United States Federal Aviation Administration publication Airplane Flying Handbook, Chapter 4: Maintaining Aircraft Control: Upset Prevention and Recovery Training provides the following guidance, consistent with established guidelines, regarding spin recovery:

To accomplish spin recovery, always follow the manufacturer’s recommended procedures. In the absence of the manufacturer’s recommended spin recovery procedures and techniques, use the spin recovery procedures in the spin recovery template. If the flaps and/or retractable landing gear are extended prior to the spin, they should be retracted as soon as practicable after spin entry.

Spin recovery template:

1. Reduce the Power (Throttle) to Idle
2. Position the Ailerons to Neutral
3. Apply Full Opposite Rudder against the Rotation
4. Apply Positive, Brisk, and Straight Forward Elevator (Forward of Neutral)
5. Neutralize the Rudder After Spin Rotation Stops
6. Apply Back Elevator Pressure to Return to Level Flight.

The handbook also provides further guidance regarding power use during spin recovery:

Reduce the Power (Throttle) to Idle. Power aggravates spin characteristics. It can result in a flatter spin attitude and usually increases the rate of rotation.

CASA advised the ATSB that this matter will be referred to Safety Education for review and correction as required.

Meteorological information

Data recorded by the automatic weather station at Beaudesert, Queensland, 7 km southeast of the accident site, was provided by the Bureau of Meteorology. The site recorded observations at 30-minute intervals. The recorded observations from 13 minutes prior to, and 17 minutes after the accident, indicated that light winds and clear conditions prevailed.

Video footage obtained from another aircraft operating in the Archerfield training area at the time of the accident showed smooth flying conditions, visibility in excess of 10 km and no cloud at, immediately above, or below 4,500 ft.

Flight data recording

The aircraft was not required to be, and was not, fitted with a flight data recorder.

The aircraft was equipped with Garmin G1000 instrumentation. When fitted with a data card in the relevant port, this system was capable of recording multiple parameters relating to the operation of the aircraft and its systems.

The aircraft did not have a data card installed in the relevant port during the accident flight, therefore no data was recorded.

Similar occurrences

A review of the ATSB occurrence database for the period 2009 to 2019 found the following occurrences involving incipient spin training in aircraft are not approved for intentional spinning:

Occurrence 201704820 – VH-YTE – S.O.CA.T.A. – Groupe Aerospatiale TB-10

At the end of the advanced stalling lesson, the instructor was intending to observe the student’s wing drop recovery. The instructor initiated a right wing drop, however the student’s incorrect use of full aileron during recovery led to spin entry to the right. The instructor took control and recovered the aircraft. The aircraft completed two full rotations and lost 1,200 ft during recovery.

Occurrence 201403058 – VH-EZT – Czech Sport Aircraft – PIPERSPORT

While practicing incipient spins, the instructor initiated a left wing drop. Once the aircraft stalled, the student was asked to recover. The student reduced power with slight delay and applied the incorrect rudder input. The aircraft then turned further left and the instructor directed the application of right rudder. The student did not respond and the instructor took control and initiated spin recovery. The aircraft continued to rotate before recovering about 20 to 30 seconds later. During the recovery the aircraft maximum design load factor was exceeded by 0.1G.^[7]

__________

5. Roll: the movement of an aircraft about its longitudinal axis.
6. Yawing: the motion of an aircraft about its vertical or normal axis.
7. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.

Safety analysis

Spin entry and non-recovery

The instructor and student were conducting a simulated Recreational Pilots Licence test in preparation for an actual test. This flight included a sequence of advanced stalls that increased the risk of spin entry and likely included intentional incipient spins.

The instructor’s note, found within the wreckage, along with radar data, indicated that they were conducting an advanced stall sequence at about 4,300 ft above ground level when the aircraft entered a spin.

Sufficient height was available for the aircraft to recover under normal conditions, however, the flight crew did not recover from the spin before colliding with terrain. Examination of the wreckage showed that the aircraft was in a left spin when it impacted the ground.

The absence of recorded data limited the ability of the investigation to determine how the aircraft entered and why it did not recover from a developed spin. It was not possible to determine whether correct recovery inputs were made during the spin without recovery, or other factors prevented recovery.

Examination of the wreckage and aircraft maintenance history found no outstanding issues or defects which may have contributed to the developed spin, or prevented recovery from an incipient spin.

Instructor spin recovery technique

During the advanced stalling sequence, an instructor initiates an incipient spin, or operates the aircraft in a way which may induce an incipient spin. A student then must demonstrate a prompt recovery to stable flight. Should the student not effect prompt recovery, an instructor should take control of the aircraft and effect recovery prior to entering a developed spin.

The ATSB were advised that a week before the accident flight, the accident flight student had mishandled the recovery from an incipient spin leading to an incipient spin in the opposite direction. The accident flight instructor had taken control of the aircraft and recovered, showing that he had the ability to recover from a spin at that stage of development. However, the aircraft movement or instructor and student actions may have been different on the accident flight.

Intentional incipient spinning not permitted in the aircraft

The flight was being conducted as a simulated Recreational Pilots Licence test. This test requires that a student demonstrate an ability to recovery from an incipient spin. Therefore, the flight requires that an intentional incipient spin be induced in order for the student to demonstrate that ability.

The aircraft flight manual included an operational limitation that prevented intentional spinning in the aircraft. The aircraft manufacturer clarified that this limitation includes intentional incipient spins, even if the aircraft is immediately recovered.

There was no clear and consistent definition of the point at which a manoeuvre becomes a spin (or incipient spin) for the purposes of flying training. Discussions with the operator and other flight training organisations, along with the instructor’s previous incipient spin training in the aircraft type indicated that different interpretations of the intentional spin limitation existed. The investigation found that the incipient spin manoeuvre has been considered at least by some in industry to not be an intentional spin, as prohibited by some aircraft types. Furthermore, the conduct of the incipient spin manoeuvre using non-spin-permitted aircraft types has been occurring in Australia.

Aircraft spin certification

The aircraft was not certified for and had not been tested for recovery from a developed spin. While test pilots had demonstrated the aircraft type’s prompt recovery from a spin of not more than one turn, the capability of the aircraft type to recover from a spin of more turns was not proven. Therefore, the possibility remains that recovery using correct inputs beyond about one full turn or three seconds may not have been not possible.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Diamond DA40, VH-MPM that occurred 42 km west of Southport Aerodrome, Qld, on 26 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The instructor could not or did not prevent the aircraft from entering a spin. The spin continued until the aircraft collided with terrain.

Other finding

• Immediately prior to the spin entry, the aircraft was conducting the advanced stalling sequence which likely included incipient spins. Intentional spins were not permitted in the Diamond DA40. The aircraft manufacturer stated that the intentional spin limitation included intentional incipient spins.
• The aircraft was not certified for developed spin recovery and the capability of the aircraft to recover from a developed spin had not been established.

Safety action

Safety advisory notice

Safety advisory notice to training organisations

The ATSB identified concerns relating to the conduct of incipient spin training in aircraft types for which spinning is prohibited.

The DA40 aircraft type is certified to recover from a one-turn spin or a three-second spin (whichever takes longer), and is not proven or certified to be recoverable from a longer spin. The aircraft’s manuals state that intentional spins are prohibited. During the ATSB investigation, the aircraft manufacturer clarified that this limitation prohibits any action that is intended to induce a spin, even if the aircraft is immediately recovered.

Aircraft types with similar limitations are currently in use throughout the world for flying training. In Australia, the Civil Aviation Safety Authority requires the demonstration of recovery from an incipient spin during flight tests. However, there is no clear and consistent definition of the point at which a manoeuvre becomes a spin (or incipient spin) for the purposes of flying training.

Crucially, the ATSB found that there can be varying interpretations of an ‘incipient spin’, and this has led to aircraft not approved for intentional spins being used for incipient spin training and assessment.

Action number: AO-2017-096-SAN-012

Operating an aircraft within the stated limitations is essential to the safe conduct of a flight. Training organisations are required to conduct incipient spin recovery training, which includes intentionally inducing a spin and recovering before it fully develops. Some organisations may be conducting this training in aircraft not approved for intentional spinning. The Australian Transport Safety Bureau advises these training organisations to clarify with aircraft manufacturers the extent to which the intentional entry into the early stages of a spin, including an incipient spin, is permissible.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Civil Aviation Safety Authority

CASA has advised the ATSB that they have taken the following safety action:

Guidance material review

CASA is reviewing the Spins and Spirals section of the Flight Instructor Manual for correction as required.

General details

Instructor details

Student details

Aircraft details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft manufacturer
• aircraft operator
• Civil Aviation Safety Authority
• air traffic radio recordings
• air traffic radar data
• witnesses
• Bureau of Meteorology
• Queensland Police
• other flying training organisations.

References

Wood RH, & Sweginnis RW 1995, Aircraft Accident Investigation pp.189 Casper, WY: Endeavor Books.

Civil Aviation Authority of New Zealand 2014, Spin Avoidance and Recovery.

Federal Aviation Administration of The United States 2016, Airplane Flying Handbook

Civil Aviation Safety Authority 2006, Flight Instructor Manual Aeroplane

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the instructor and student’s next of kin, the flight training organisation, the aircraft maintainer, the aircraft manufacturer, the Civil Aviation Safety Authority, the Austrian Safety Investigation Authority, the Transportation Safety Board of Canada, the Queensland Coroner’s representative and the Hong Kong Civil Aviation Department.

Any submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 19 September 2017, the pilot of a Cessna C208 aircraft, registered VH-SJJ, was operating from Toowoomba, Queensland to Ballina, New South Wales (NSW) then onwards to Nambucca Heads, NSW. The C208 pilot landed at Ballina Byron Gateway Airport (YBNA) and was clear of the runway at 1055 Eastern Standard Time (EST). Two Robinson R22 helicopters were also operating at YBNA at this time.

YBNA is a certified, non-controlled aerodrome utilising Common Traffic Advisory Frequency (CTAF) procedures^[1]. A Certified Air/Ground Radio Service Operator (CA/GRO)^[2] had been on duty since around 1030.

At 1104, the C208 pilot transmitted to the Brisbane Centre Air Traffic Control, announcing his intention to taxi to the runway for departure. Brisbane Centre advised that traffic was an inbound Airbus A320 aircraft due at YBNA at 1109 with additional VFR traffic^[3] in the circuit. The C208 pilot responded: ‘copied the inbound Airbus and helicopters in the circuit.’

At about the same time, one of the R22s, registered VH-JKH (JKH), was operating clear of the runway strip in an area known as the southern grass (Figure 1). The other R22, registered VH-MFH (MFH), was being used for circuit training on runway 06 with approach and landing to a point about two thirds along the runway. At 1105, the instructor in MFH broadcast on the CTAF that they were on a left base for runway 06 to the runway.

At 1106:24, the C208 pilot broadcast on the CTAF that they were taxiing for departure on runway 06. The CA/GRO acknowledged that the C208 pilot already had traffic information on the inbound Airbus and advised, ‘…on your right-hand side there is helicopter JKH, also…’ and following a four-second pause, ‘…conducting operations runway 06, helicopter MFH’. At 1106:55, the C208 pilot responded ‘thanks for that and SJJ is entering and rolling runway 06’.

At this time, MFH was on short final for runway 06 at approximately 200 ft above the runway and approaching a point that was about two thirds of the way along runway 06. The instructor realised that the C208 was departing and transmitted that MFH was ‘runway 06 for the runway’. That call partly over-transmitted on the C208 pilot’s response to the CA/GRO. The instructor took control of the helicopter and vacated the runway to the north followed by a call to advise their location at the ‘northern grass.’

The C208 pilot continued the take-off and departure to Nambucca Heads.

Figure 1: Approximate location of aircraft when the C208 pilot called entering and rolling

Source: Google Earth, annotated by the ATSB

Operational aspects

Certified Air/Ground Radio Service (CA/GRS)

A CA/GRS is an aerodrome radio information service providing traffic, weather and other operational information to all pilots. Its primary purpose is to enhance the safety of air transport operations by the provision of relevant traffic information. A CA/GRO is to maintain a vigilant watch on the changing positions of aircraft so that relevant traffic information can be provided. When the CA/GRS is operating, pilot procedures are unchanged from the standard non-controlled aerodrome operating and communication procedures.

In this case, the CA/GRO immediately responded to the C208 pilot‘s taxi broadcast but the traffic advice was broken by a four-second pause. He recalled that he hesitated as he attempted to relocate MFH in the circuit area to provide a specific position. The CA/GRO had lost sight of MFH after it turned onto the final approach due to the eaves of the cabin partially obscuring his view, requiring him to move from his desk to the cabin window. The CA/GRO was still able to advise that MFH was conducting operations to runway 06. The CA/GRO sighted MFH as it vacated the runway, which was moments after the C208 pilot called ‘entering and rolling’.

C208 pilot comments

The C208 pilot had operated at YBNA for the last 14 years and had always known the helicopters to operate on the grass areas. Although he stated he had a good view of the runway from the holding point, he did not see nor hear the helicopter. The C208 pilot could not recall all traffic information he had received except for the inbound Airbus A320, which was his focus due to a desire to depart prior to its arrival.

ATSB comment

The CA/GRO provided traffic information to the C208 pilot in accordance with standard procedures. This is an advisory service only and a pilot is expected to use that information to supplement standard operating and communication procedures.

The C208 pilot did acknowledge the traffic information provided but had not developed a complete traffic picture prior to entering the runway. This was probably due to his focus on departing prior to the arriving Airbus A320 and based on previous experience, not expecting the helicopters to be on the runway.

The instructor on MFH recognised the potential traffic conflict and took appropriate action.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The pilot of the C208 entered and rolled on the runway prior to positively identifying the helicopter on short final for the same runway.

Safety message

Pilots are reminded to apply effective see-and-avoid principles when operating at or near non-controlled aerodromes. While broadcasting on and monitoring of the CTAF is the key way for pilots to establish situational and traffic awareness, it is also important to maintain a constant visual lookout to validate any operating assumptions and avoid traffic conflicts.

One of the safety concerns relates to communication and self-separation in non-controlled airspace.

Traffic conflicts are among the most common occurrences at non-towered aerodromes. Further information is available in ATSB publication A pilot's guide to staying safe in the vicinity of non-controlled aerodromes (AR-2008-044(1)).

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Common Traffic Advisory Frequency (CTAF): A designated frequency on which pilots make positional broadcasts when operating at or in the vicinity of a non-controlled aerodrome. Standard positional broadcasts are made by pilots to achieve ‘alerted see-and-avoid’, increasing their situational awareness and allow them to self-separate from other traffic in a non-controlled environment.
2. Certified Air/Ground Radio Operator (CA/GRO): refer to section below for description.
3. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going. ‘VFR traffic’ refers to any aircraft operating under VFR.

What happened

On 26 August 2017, at about 1100 Western Standard Time,^[1] the crew of a Sikorsky S-92A helicopter, registered VH-IPE, were undertaking a winching exercise to a vessel offshore, near Broome, Western Australia. During the exercise, a fracture of the hi-line weak-link resulted in a near contact of the winch hook with the helicopter main rotor. There were no injuries and the helicopter was not damaged.

There were two flight crew, two aircrewman and one rescue crewman on board the helicopter and one rescue crewman on the vessel at the time of the serious incident. The flight crew were employees of Helicopters New Zealand (HNZ - Australia) and the technical crew^[2] were employees of Careflight Australia.^[3] The flight was a standardisation check flight for one of the aircrewman in his role of winch operator. The other aircrewman was the instructor conducting the assessment. At the time of the incident the operator was in the training and development phase prior to the commencement of a contracted search and rescue service.

The crew conducted a flight brief before departing Broome at about 1030 to rendezvous with a vessel for their deck winching evolutions.^[4] The brief included plans for dealing with major and minor helicopter malfunctions while winching, and concluded with an overall risk assessment score of low, which was calculated in accordance with the operator’s risk scoring system.

After they rendezvoused with the vessel, the crew set up for the first evolution, which was planned to be a stretcher winch using the hi-line (refer to section titled Role equipment).^[5] On the first winch, one rescue crewman, with the hi-line bag, was transferred to the vessel with the instructor acting as winch operator for his own currency. As soon as the winch operator received the signal from the rescue crewman that he was safely on deck and disconnected from the winch hook, the winch operator called to the pilot flying (captain in the right seat) that the helicopter was clear to move back to the rest position.^[6]

The helicopter started to move left, away from the transfer point. At the same time, the winch operator was slowly winching in and monitoring the line, which was paying out^[7] from the hi-line bag. When the helicopter was just clear of the deck, but still moving to the left, with about 30 ft (9 m) of winch cable still extended, a restriction of the line inside the hi-line bag occurred. The hi‑line bag flicked up from the deck around the rescue crewman’s waist and applied additional tension to the weak-link (the weak-link connected the line to the winch hook – refer to section titled Role equipment).^[8]

The weak-link immediately fractured and the release of the additional tension sent the winch hook on a near vertical trajectory towards the helicopter’s main rotor disc. The winch cable snatched out of the winch operator’s hand and the hook reached its apogee^[9] at about the height of the winch^[10] before falling down (Figure 1).

Figure 1: Winch hook near apogee

Source: Winch operator, modified by the ATSB

The pilot flying observed the hook appear at about the height of the winch before the winch operator had time to warn the rest of the crew.^[11] After the winch operator regained control of the cable the helicopter returned to the rest position. The winch operator was then able to inspect the cable and debrief the crew about the incident. On retrieval of the hook, the winch operator noted the weak-link had separated at the line end (Figure 2).

Figure 2: Weak-link point of separation

Source: Winch operator, modified by the ATSB

The crew completed an incident debrief clear of the vessel and elected to complete the flight with open water winching and discontinue further use of the hi-line.^[12] The flight was completed and the helicopter returned to Broome without further incident.

Post-incident management response

On completion of the flight, the captain submitted an incident report and Careflight’s chief aircrewman directed their personnel to remove the Priority 1 weak-link (refer to section titled Role equipment) from the operation. On 28 August, the operator’s head of flight operations directed a temporary halt to winch training pending an initial investigation and notified the Civil Aviation Safety Authority (CASA) of that decision. On that same day, Careflight removed the Priority 1 weak-link from their other operations.

On 6 September, the operator’s head of training and checking issued a training instruction to prohibit use of the hi-line and weak-link in winch training evolutions until the investigation could develop recommendations. That same day, the head of flight operations notified CASA of the decision to resume winch training in a limited form on 7 September. That limited form was for winch evolutions that did not require the use of hi-line equipment and would continue until such time that the main recommendations from the final investigation were implemented.

Operator’s procedures

The operator’s search and rescue operations manual, issue 1.1, was published on 25 July 2017. The transfer of the rescue crewman with hi-line to the vessel on the incident flight was in accordance with the operator’s procedure 7.7.4: Insertion/Extraction – Vessel Winching. The manual also included crew duties, responsibilities and qualifications.

Crew training and qualifications

The flight crew held the appropriate CASA type ratings for SK92 (S-92A) and low level ratings for helicopters and winching. The aircrewman instructor held a CASA approval to conduct training for helicopter winching for the operator in the S-92A in accordance with their procedures. The rescue crewman on the vessel was trained in accordance with the operator’s requirements. This included deck winching with hi-line on 15 August 2017, followed by a line-check for the operator on 17 August 2017, which included an unattended stretcher winch from a vessel.^[13]

Role equipment

The hi-line is a device used to assist in managing the helicopter’s winch hook to a specific area when the helicopter is unable to either position, or remain in position, directly over the transfer point. It is also used as an anti-spin/anti-swing device by a person on the deck of the vessel when a stretcher is winched down from, or up to, the helicopter.

The hi-line equipment comprised of a hi-line bag, a 300 ft x 15/64 inch (91 m x 6 mm) line (rope) inserted in the bag and a break-away weak-link, which connected the line to the winch hook. The weak-link consisted of a plastic buckle and webbing with plastic D-rings at each end. One end was connected to the line, and the other end was connected to a carabiner, which was connected to the winch hook (Figure 3 left). The incident weak-link had an advertised breaking strength of about 90 pound force (400 N). Figure 3 right depicts the fracture of the weak-link that occurred at the line end.

Figure 3: Hi-line with weak-link and carabiner (left) and fractured weak-link (right)

Source: Operator, modified by the ATSB

The weak-link was manufactured by Priority 1 Air Rescue. They provided training and role equipment for helicopter search and rescue services internationally. The role of the weak link was to break in the event of line entanglement. The low breaking tension on the incident weak-link was a design feature to allow personnel tending the hi-line to break it in an emergency.

The hi-line bag was manufactured by Lifesaving Systems Corporation and could be purchased on its own or with a 75 ft x 3/8 inch (23 m x 9 mm) safety line inserted for use as a water rescue throwline. The bag was provided to the operator by All Elements Protection, the Australian representative for Lifesaving Systems Corporation, to fulfil the need for a netted design to allow water to drain out. A 300 ft (91 m) line was inserted by the operator for the hi-line role. The S‑92A main rotor diameter is about 57 ft (17 m). A rest position of about two rotor diameters at 60 ft hover height would therefore require a minimum of 129 ft (39 m) of line. The operator assessed the bag as fit‑for‑purpose, but also recognised the preference for a larger bag with a wider throat (opening). Therefore, the bag was approved as an interim solution until new alternative hi-line bags arrived.

Following the incident, the instructor commented that he had reservations about the narrow throat on the bag and that internal clumps of rope could result in a restriction. The rescue crewman reported to the operator that it would have been easier to manage the hi-line bag if it had a larger throat, or was a larger bag, or had a shorter line inserted.

Previous incidents

The operator’s internal investigation found they had experienced a fracture of a Priority 1 weak‑link buckle about 2 weeks prior to the incident flight. This was considered to be due to mishandling and not related to a hi-line evolution. Another operator using the Priority 1 weak-link was contacted by the incident operator and they reported two previous incidents of weak-link fracture. They determined that these were likely the result of crew kneeling on the buckle. After directing their crew to avoid that practice they had not experienced any further fractures.

Management of change

The operator had an integrated management system in place prior to the incident. This comprised of their safety and quality management systems and included a ‘management of change’ process.^[14] The management of change process was used for the introduction of the search and rescue contracted capability, but did not capture risk assessments of the role equipment.

Safety analysis

Fracture of the weak-link

During the first winch evolution of the flight, the rescue crewman was transferred to the deck of the vessel with the hi-line attached. Once on the deck, the rescue crewman disconnected himself from the winch hook and prepared to pay-out the line as the winch was recovered. As the rescue crewman payed-out the line from the hi-line bag, the helicopter was moving slowly away from the transfer point to the rest position, about two rotor diameters from the vessel. At the same time, the winch operator was slowly retrieving the winch hook while monitoring the rescue crewman’s management of the hi-line.

When a restriction of the line inside the hi-line bag occurred, the weak-link was immediately placed under increased tension due to the relative motion of the helicopter and winch cable with respect to the vessel. The tension was sufficient to fracture the weak-link at the line end. The release of the downward tension when the weak-link fractured sent the winch hook on a trajectory towards the helicopter’s main rotor disc. The ATSB could not determine if the weak-link fractured at the advertised breaking force, but a notable amount of tension was required to be released to send the winch hook on its trajectory.

Management of change

The helicopter operator was in the training and development stage for their S-92A search and rescue contract, based at Broome. In preparation for the delivery of search and rescue services, they procured search and rescue role equipment from various manufacturers through a third-party agent in Australia. In accordance with their integrated management system, they completed a management of change process for the introduction of the search and rescue capability. However, their management of change did not capture risk assessments for their search and rescue role equipment.

The operator inserted a 300 ft line into a hi-line bag that was advertised as either a stand-alone item, or fitted with a 75 ft line. In addition, the hi-line bag was a sausage shaped bag with a narrow throat relative to the amount of line inserted. Therefore, when assembled, the hi-line equipment presented an increased risk for restrictions during a hi-line evolution and the equipment was no longer fit-for-purpose.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During the winching evolution with the vessel, the hi-line became restricted inside the hi-line bag, which, combined with the motion of the winch hook relative to the vessel, resulted in sufficient tension on the weak-link to fracture it and send the winch hook on a trajectory towards the helicopter’s main rotor disc.
• The operator's management of change for the introduction of the search and rescue contract capability did not capture risk assessments for their role equipment, which resulted in the use of a small hi-line bag with a narrow throat relative to the length of line required for the task.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

As a result of this occurrence, HNZ Australia has advised the ATSB that they are taking the following safety actions:

Management of change

They have removed the Priority 1 Air Rescue breakaway weak-link and hi-line bag from service, introduced new replacement equipment and initiated their management of change process for their search and rescue role equipment. The performance of the operator’s replacement weak-link will be monitored following the recommencement of hi-line winch evolutions.

Appointment of personnel

They have appointed an experienced search and rescue pilot into a new role of ‘SAR^[15] Lead’. A technical crew manager for search and rescue has also been appointed within HNZ Australia. This person is responsible for technical crew procedures, oversight and standardisation, and complement the work of the ‘SAR Lead’.

Review of documentation and procedures

Two reviews of operator documentation and procedures were commenced. One was an internal review and the other a contracted external review. The results of the reviews have been presented to the operator’s head of flight operations for consideration with a range of recommendations accepted and implemented.

Safety message

This serious incident highlighted the importance of change management processes and the unexpected nature of risk. The items of equipment, which comprised the hi-line (line, bag and weak-link) were individually fit-for-purpose, but when the hi-line was assembled it became susceptible to a restriction.

The International Civil Aviation Organization’s safety management manual (Doc 9859) highlighted that a management of change process should take into account the criticality of systems, equipment and activities, their operational environments and past performance. The manual indicated that design factors, including equipment and task design, should be considered in the hazard identification process.

Further guidance on hazard identification and management of change for Australian operators is available from the Civil Aviation Safety Authority’s Civil Aviation Advisory Publication, CAAP SMS-1: Safety management systems for regular public transport operations.

Detailed guidance on aviation operational risk management methodology is available from the United States Federal Aviation Administration in their system safety handbook, Chapter 15: Operational risk management. Hazard identification tools and examples are available in Appendix F: ORM details and examples.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Technical crew refers to aircrewman and rescue crewman (paramedics).
3. Reference to operator in this report refers to HNZ (Australia).
4. A winch evolution refers to the entire sequence of winching events to accomplish a goal, such as the recovery of an injured person. It may be performed for training, or assessment, or a real-world task.
5. A hi-line winch transfer involves the majority of the winching evolution being conducted with the helicopter clear of the vessel in the rest position. This requires personnel being on the deck to assist in the recovery.
6. The rest position may vary with the specific conditions and vessel, but for the incident flight was about two rotor diameters from the rear left quarter of the vessel.
7. Let out a rope by slackening it.
8. The purpose of the weak-link is to separate the winch cable from the line in the event that the line becomes entangled.
9. Highest point of the trajectory.
10. The helicopter was fitted with a dual winch (hoist). The outboard winch was in use for the incident evolution.
11. The flying pilot’s hover reference was the vessel and therefore the hook trajectory was within his field of view.
12. A second weak-link was carried on board the helicopter.
13. There were no specific competency certification requirements for the rescue crewman in the Civil Aviation Regulations (CAR) 1988. However, their role was that of a ‘crew member’, as defined in CAR 1988, and CASA considered them to be members of the ‘operating crew’ as defined in CAR 1988. Therefore, they did not require a certificate of competency under Civil Aviation Order 29.11, but their role, operating procedures, and training and checking requirements were required to be outlined in the operations manual in accordance with CAR 215 and CAR 217.
14. Change management is defined in the International Civil Aviation Organization safety management manual as: ‘A formal process to manage changes within an organization in a systematic manner, so that changes which may impact identified hazards and risk mitigation strategies are accounted for, before the implementation of such changes.’
15. SAR: Search and rescue.

What happened

On 19 September 2017, at about 1504 Eastern Standard Time,^[1] the pilot of a Piper PA‑28‑181 aircraft, registered VH-BDB (BDB), conducted a forced landing about 15 km west-south-west of Bankstown Airport, New South Wales. In addition to the pilot, there was one passenger on board. The pilot received minor injuries and the passenger was uninjured. The aircraft was substantially damaged.

On 15 September, the pilot made a booking to hire an aircraft from Bankstown Airport for a return flight to Wollongong with one passenger, for the time period 1200–1500. The booking was made with the flight school where the pilot had recently completed his private pilot licence and had flown the PA-28 aircraft type. The purpose of the planned flight was for the pilot to accrue command hours towards his commercial pilot licence.

On 19 September, after arriving at the flight school and finalising his flight plan, the pilot was advised that the booked aircraft was unserviceable and the booking was changed to 1230–1530 with an alternate aircraft. The alternate aircraft returned at about 1240–1250 from the previous booking and was then refuelled to full. The pilot conducted his pre-flight inspection and elected to start the flight with a few circuits at Bankstown Airport before departing to Wollongong with the passenger. While conducting the circuits, the aircraft became unserviceable and the pilot returned the aircraft to the flight school.

The school then offered the pilot BDB. The pilot agreed to take BDB, but decided to conduct a local training area flight due to the time delays associated with the aircraft changes. The pilot reported that he conducted a pre-flight inspection of BDB. He believed the aircraft had full fuel on board on departure and planned to fly for only 30–40 minutes. Therefore, he did not intend to change the fuel tank selector during the flight from the tank selected at take-off (refer to section titled Fuel management).

At about 1430, the pilot and passenger departed for a local training flight, with a planned return time of about 1500. At about 1500, as the aircraft was approaching the waypoint 2RN for return to Bankstown, the pilot noticed the engine was fluctuating a couple of hundred revolutions per minute. The pilot elected to track via Camden to avoid overflying built-up areas with what he believed to be an engine problem. After turning towards Camden, the pilot selected the electric fuel pump on, but the engine fluctuations became worse. The pilot then performed his engine failure immediate checks, which involved checking the fuel pump, mixture, oil temperatures and pressures, switches for the magnetos, and throttle for response.

After the pilot completed his immediate checks, there was a total loss of engine power, at which time the aircraft was at an altitude of about 700 ft above ground level. The pilot identified a field out to his left, made a MAYDAY^[2] call to Bankstown air traffic control, and briefed his passenger to secure himself for the landing.

There was moderate turbulence, which resulted in fluctuating airspeed and intermittent stall^[3] warning activations during the approach. Considering the conditions, low altitude and the location of the fuel tank selector, the pilot felt that attempting to change fuel tanks would have diverted his attention from flying the aircraft at a critical time. Therefore, the pilot focused his attention on not stalling the aircraft while executing the forced landing, and did not conduct any further checks.

After the aircraft touched down, the pilot concentrated on keeping it straight over the rough ground until it ran through a fence at the end of the field and stopped when the right wing struck a tree. The pilot activated the emergency locator transmitter and directed his passenger to stand about 30–40 m behind the aircraft. After the pilot exited the aircraft, he activated his personal locator beacon and made a phone call to emergency services as he could see fuel leaking from the right wing. Emergency services arrived within about 20 minutes and made the accident site safe.

Fuel management

Fuel system

The PA-28-181 aircraft has two fuel tanks, one in each wing, and a fuel gauge located in the cockpit for each tank. A three position fuel selector is located on the lower left side of the cockpit with the positions OFF, LEFT and RIGHT. The rate of fuel consumption in-flight is about 42 L/h and each tank held a total of 90 L. The last fuel system calibration was 19 February 2014.^[4] The calibration check found the fuel tanks were empty when the fuel gauges indicated zero. When the fuel gauges indicated 5 USG,^[5] the left tank held 17 L and the right tank held 16 L. When the fuel gauges indicated 10 USG, the left tank held 33 L and the right tank held 35 L.

Pilot’s instruction and practices

The pilot’s flying school reported that they teach pilots that fuel gauges are not always accurate. Therefore, if a fuel tank(s) was not full during the pre-flight inspection, a dip-stick located in the aircraft was used to check the tank(s) contents. For in-flight fuel management and aircraft balance, the pilot was taught to change the fuel selector between the LEFT and RIGHT tank at 30-minute intervals. Consequently, the pilot managed fuel in-flight based on flight time, rather than with reference to the fuel gauges.

In the event of a loss of engine power, the pilot was taught to complete the entire emergency checklist procedure provided there was sufficient height and/or time available. However, if he believed the loss of power had occurred in a time critical situation, then he should prioritise flying and safely landing the aircraft in lieu of conducting checks.

Operator’s report

The operator reported that, at the completion of the previous flight, BDB had about 25 L in the left tank and about 55 L in the right tank. The local fuel agent used by the operator also reported that BDB was not refuelled before the flight.

Aircraft inspection

A representative of the insurance company examined the aircraft about 3 hours after the forced landing. That examination found the fuel selector in the LEFT tank position (Figure 1) and no usable fuel in the left tank, which was not breached. The right tank, which was breached, was about one quarter full. The aircraft wreckage was recovered to facilities on 21 September and further inspections were conducted on 26 September. The inspections found no fuel in the engine fuel lines, and about 20 ml and 40 ml of fuel in the fuel filter bowl drain valve and carburettor respectively.

Figure 1: Aircraft fuel tank selector

Source: Insurance assessor, modified by the ATSB

Quick reference handbook

The flight school had a published quick reference handbook for the PA-28 aircraft, which included an abnormal procedure for engine roughness and an emergency procedure for engine power loss in flight. The engine roughness procedure started with carburettor heat on, followed by adjusting the mixture, electric fuel pump on, switching fuel tanks, checking engine gauges and magnetos. The engine power loss in flight procedure started with switching fuel tanks, electric fuel pump on, mixture to full rich, carburettor heat on, check engine gauges and fuel primer.

Safety analysis

Believing the aircraft had full fuel on board, the pilot intended to conduct the 30-40 minute flight on the left fuel tank. It was more likely than not that the pilot believed the fuel quantity on board was full at the start of the flight due to his inspection of another aircraft earlier in the day. However, BDB was not refuelled prior to the flight and had about 35 minutes of fuel available in the left tank and about 78 minutes in the right tank. Despite having sufficient fuel on board for the planned flight, when returning to Bankstown, the engine lost power due to fuel starvation associated with use of the left fuel tank. This resulted in a forced landing.

While the pilot conducted some initial checks before the engine completely lost power, he omitted to change fuel tanks, which likely would have prevented the subsequent loss of engine power. Once the aircraft experienced a total loss of power, the pilot found himself in a time-critical situation in challenging flying conditions and therefore prioritised flying the aircraft in lieu of conducting further checks.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The pilot had refuelled another aircraft to full earlier in the day, which he more likely than not misattributed to the fuel state of VH-BDB.
• The loss of engine power was due to fuel starvation associated with the left fuel tank, which resulted in the pilot conducting a forced landing.

Safety message

Fuel starvation and exhaustion events continue to be reported to the ATSB. It is therefore important for pilots to continue to educate themselves on the risks and controls associated with fuel management.

Methods for cross-checking fuel on board before flight are published by the Civil Aviation Safety Authority in Civil Aviation Advisory Publication 234-1: Guidelines for aircraft fuel requirements.

Case studies for pilots to learn about fuel management related accidents have been published by the ATSB in Avoidable Accidents No. 5 – Starved and exhausted: Fuel management aviation accidents. 

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
3. Aerodynamic stall: occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.
4. The calibration check interval is 48 months in accordance with Civil Aviation Order 100.5. The fuel quantity gauges must be checked with the aircraft positioned to simulate the normal level flight attitude, which may be different to the aircraft attitude on the ground. A placard must be displayed in the fuel gauge scale errors exceed +/- 5% of the nominal fuel tank capacity.
5. 1 United States Gallon (USG) = 3.8 L.

Safety summary

What happened

On 13 September 2017, the crew of a Boeing 737, registered VH-VUE and operated by Virgin Australia, were flying a scheduled passenger flight from Melbourne, Victoria to Adelaide, South Australia. Shortly before top of descent, air traffic control instructed the crew to perform a high-speed descent. The crew commenced descent with the first officer as pilot flying and the autopilot engaged, and intended to target a descent speed of 320 kt, which was higher than the normal descent speed of 280 kt.

During the descent, the first officer attempted to manage airspeed fluctuations by using changes in the autopilot modes and reductions in the target airspeed. As the aircraft descended through around 17,000 ft, the tailwind affecting VUE decreased suddenly and significantly. The reduction in tailwind caused the indicated airspeed to increase and approach the maximum operating speed limit of 340 kt.

The captain responded to the sudden increase in airspeed by abruptly pulling back on the control column, causing the autopilot to disconnect. The resulting control forces caused sudden changes to the aircraft’s pitch attitude and vertical acceleration. Two cabin crew who had been standing in the rear galley were injured, with one sustaining serious injuries.

What the ATSB found

The ATSB found that a sudden reduction in tailwind caused the airspeed to increase towards the maximum operating speed. The safety implications associated with this event related to the captain’s sudden control inputs to prevent an overspeed, and the consequent effects of vertical acceleration on the aircraft and its occupants. Although there was a resulting one knot overspeed from the sudden speed increase, it was not by an amount that required any structural inspections to ensure the ongoing airworthiness of the aircraft, according to the guidance provided by the aircraft manufacturer.

Even though the autopilot was operating correctly, when the aircraft was approaching and exceeding the maximum operating speed, the captain’s perception was that the autopilot was not controlling the aircraft and that urgent intervention was necessary. However, the captain did not follow the normal procedure for taking over control of pilot flying duties. The large pitch control inputs made by the captain were probably influenced by the captain’s perception of urgency.

The ATSB also found that the captain was highly concerned about avoiding an overspeed. This was partly because of a perception that Virgin Australia were also concerned about overspeed and wanted to avoid overspeed events, and partly because of a perception that minor overspeeds had significant implications for the safety of the aircraft. These factors contributed to how the captain responded to the sudden increase in airspeed towards the maximum operating speed.

The crew identified the risk of overspeed earlier in the descent, but did not discuss how they would manage that risk. This reduced the pilots’ ability to effectively respond to the overspeed situation, and probably contributed to the rapid, reflexive nature of the captain’s control inputs.

What's been done as a result

Virgin Australia have updated the training and information provided to pilots about overspeed and overspeed recovery. The intent of these actions was to reinforce the correct overspeed recovery technique, and to provide a greater opportunity for pilots to understand the negative safety implications of manual inputs to correct a minor overspeed. These actions have included an animation showing pilots mishandled and correct overspeed recoveries, and an update to manuals which explains that the 737 has been flight tested at speeds above V_MO.

Virgin Australia have also changed procedures for ground handling staff when responding to requests from emergency services.

Safety message

During this accident, the pilots accepted and targeted an air traffic control instruction to conduct a high-speed descent. Due to increased kinetic energy and reduced margins to placard speed limits, high-speed descents involve a higher level of risk, including increased risk of harm due to abrupt control input. Pilots are entitled to decline air traffic control instructions where they do not perceive they can safely comply.

This accident highlights the challenges pilots face when responding to sudden or unexpected situations. There will often be a reduction in safety when pilots perceive a situation is urgent and when they make decisions rapidly and reflexively. In these situations, pilots may not be able to effectively process information or make good decisions.

Wherever possible, pilots should take the opportunity provided in an earlier stage in flight to identify risks and take steps to reduce the likelihood of a critical situation developing. Potential threat identification and planning for their management should also involve considering, as a multi-person crew, what the implications of a perceived risk might be, and how to respond if the threat does develop. By taking steps in an earlier stage in flight, pilots can improve their ability to respond effectively to threats. The Federal Aviation Administration Aeronautical Decision Making material provides pilots with accessible guidance on these concepts.

The occurrence

On the afternoon of 13 September 2017, the crew of a Boeing 737-800 aircraft, registration VH‑VUE (VUE) and operated by Virgin Australia (VA), were operating a scheduled passenger service from Melbourne, Victoria to Adelaide, South Australia. The scheduled departure time for this flight was 1605 CST.^[1]

The flight crew comprised the captain and the first officer (FO), and these pilots had flown VUE together on the preceding flight. The cabin crew comprised the cabin supervisor (CS) and three other cabin crew. There were 151 passengers on-board.

In preparation for the flight to Adelaide, the flight crew reviewed various information relating to the en route and destination weather conditions. The captain briefed the CS, advising the expected flight time was 65 minutes and that the forecast weather was the same as local conditions in Melbourne, which the CS perceived as cloudy.

For the flight to Adelaide, the FO was pilot flying (PF) and the captain was pilot monitoring (PM).^[2] At 1610, VUE departed from Melbourne and climbed to flight level (FL) 360.^[3] The departure, climb and cruise were uneventful.

Crew instructed to perform high-speed descent

At about 1642, the aircraft was south-east of Adelaide, maintaining FL 360 and approaching top of descent. Air traffic control (ATC) issued the crew clearance to conduct a DRINA NINE ALPHA standard instrument arrival route^[4] (STAR) for an approach to runway 23, and when ready descend to FL 250. This STAR provided tracking information including a series of waypoints, altitude and speed restrictions, positioning the aircraft to the north-east of Adelaide to commence an approach to runway 23.

Figure 1 shows the flight path of VUE, with the DRINA NINE ALPHA STAR waypoints overlaid. The original STAR procedure is provided in Appendix A – DRINA NINE ALPHA STAR. This procedure required inbound aircraft track to the DRINA waypoint, then to pass overhead COMLY at or below 13,000 ft.

A few minutes after issuing the STAR, when VUE was 136 NM (252 km) south-east from Adelaide and 93 NM (172 km) from the DRINA waypoint, ATC cancelled all speed restrictions and instructed the crew to maintain maximum speed on descent, which the pilots understood as an instruction to make a high-speed descent. The FO said to the captain that they would ‘see how (the aircraft would) go’ with an airspeed of 320 kt, but that this might be too fast. The captain responded by saying ‘she’ll be right, don’t overspeed’.

Figure 1: Flight path of VH-VUE with DRINA NINE ALPHA STAR waypoints overlaid

Source: Google Earth, with aircraft track and Airservices Australia waypoint information overlaid by ATSB

Descent into Adelaide

Prior to commencing the descent, the crew set up the aircraft’s flight management system (FMS) based on the ATC clearance, and then commenced the approach briefing. The crew programmed a selected airspeed of 310 kt into the FMS.

At about 1652 the captain briefed the CS for the descent, advising that the aircraft would commence its descent to Adelaide in around 30 seconds, and that the expected arrival time was 15 minutes earlier than planned.

Soon after VUE began descending, airspeed started to increase. The FO made a number of changes to the autopilot mode and settings in order to prevent airspeed from increasing too much (see Recorded information). However, airspeed continued to increase. The crew remarked that the changes to the autopilot mode and settings did not help much, with the FO saying that the autopilot ‘doesn’t (manage airspeed) very well…it just doesn’t like to hold her steady’. The captain reminded the FO ‘don’t overspeed’.

Recorded data indicates the crew began increasing the selected airspeed on the mode control panel (MCP) incrementally during the early stages of the descent when approaching the start of the STAR. (Figure 11 in Appendix B – Flight data recorder data shows changes to the selected airspeed, actual airspeed, autopilot modes and other recorded parameters during the descent.)

At about 1654, when VUE was descending through FL 335, the flight crew made the ‘cabin crew prepare for landing’ announcement. Shortly after, the flight crew continued the approach briefing, including briefly reviewing threats (see Other flight crew procedures), then performed the descent checklist.

The crew selected the briefed descent airspeed of 320 kt at about 1656, when the aircraft was descending through FL 250, and the aircraft reached that speed soon after. VUE remained at 320 kt for the following few minutes.

About two minutes later, the aircraft was approaching waypoint DRINA descending through FL 220, when the FO saw the tops of stratocumulus cloud, which the FO thought were about at FL 150.

The FO suggested that it may be appropriate to activate the fasten seat belt sign. The captain responded that the conditions at the time were good, and the FO agreed with that assessment. The captain asked the FO if there were any reports or concerns of turbulence. The FO responded that there had been no reports and was not worried. The fasten seat belt sign remained off.

According to information provided in ATSB interviews after the accident, the captain also wanted to leave enough time for the cabin crew to complete their duties. The FO thought the clouds beneath VUE might be associated with turbulence later in the descent, but at that time the FO was comfortable with the seatbelts sign remaining off for ‘a bit longer’.

At around this time, the FO reduced the selected airspeed to 310 kt. Soon after, VUE commenced the turn towards COMLY.

Captain intervention

At about 1659, VUE was 15 NM (28 km) from COMLY and descending through FL 170. Airspeed reduced by around 10 kt to the selected 310 kt.

Airspeed then started to increase, first gradually, then more rapidly. The flight crew observed the indicated airspeed approaching V_MO (maximum operating speed), and the FO observed the airspeed trend indicator^[5] move past the lower band of the red bars on the primary flight display airspeed indicator. Both pilots expressed statements of concern and alarm.

The captain called ‘pull-up’ while also making two abrupt nose-up inputs on the left (captain-side) control column. The first was 49 lb (about 22 kg), which caused the autopilot to disconnect. The captain abruptly released the controls and then made a second control input of 28 lb (about 13 kg) about 4 seconds later.

The FO heard the autopilot disconnect audible alert and saw the captain pulling on the control column and acknowledged that the captain had control of the aircraft.

About 8 seconds after the captain’s initial nose-up input and autopilot disconnect, the captain prompted the FO to resume duties as pilot flying, and a normal transfer of control was performed. The flight crew perceived they had encountered severe atmospheric turbulence. Shortly after the FO resumed pilot flying duties, the captain said ‘better put the belts on’, to which the FO responded ‘check’.

The FO continued to fly the aircraft for around 30 seconds before re-engaging the autopilot. During this period, the FO made several nose-down inputs, peaking at 32 lb (about 15 kg) 10 seconds after the initial nose-up input. Shortly after the autopilot was re-engaged, cabin crew contacted the flight crew and reported that the cabin was not secure, and that one of the cabin crew members at the rear of the aircraft had broken their leg.

With the captain communicating with the cabin crew, the FO (who was pilot flying) notified ATC that VUE would not meet the height requirement for COMLY due to encountering turbulence. ATC advised the crew that they could cancel all height requirements and reduce their speed.

Around 90 seconds later, ATC contacted the crew of VUE to confirm their report of severe turbulence. The captain responded in the affirmative and added that the turbulence was associated with some cloud.

Events in the cabin

The cabin crew recalled that the flight had been smooth during the cruise and initial descent, with no turbulence experienced. At the time the flight crew made the ‘cabin crew prepare for landing’ announcement, the in-flight food and drink service had been completed and rubbish collected. Following this announcement, the cabin crew completed duties including securing the cabin for landing. The cabin crew then returned to the forward and rear of the aircraft, with the two cabin crew members in the rear of the aircraft standing in the galley eating a meal.

Cabin crew members recalled an abrupt upset in the cabin, which they perceived as sudden and without warning. One of the cabin crew members in the rear galley was thrown up towards the ceiling, then fell to the floor. The cabin crew member felt their leg snap on landing and was unable to move from the floor.

The sudden changes in pitch attitude also injured the other crew member in the rear of the aircraft. This crew member struck their jaw on the galley bench and had other minor injuries to their body and face.

The CS reported to the ATSB that they experienced muscular skeletal injuries from the accident and had sought out chiropractic care.

After the aircraft had stabilised, the cabin crew member who suffered a leg injury was given oxygen using a portable on-board cylinder.

At about 1704, the CS confirmed with the flight crew the requirement for an ambulance and that the injured cabin crew member was unable to move to a seat for landing and would stay on the galley floor.

The CS then made positional changes among the cabin crew, moving the uninjured cabin crew member from the forward cabin to the rear, and the cabin crew member who sustained minor head injuries to the front. The CS also briefed able-bodied passengers in the last seating row about what the cabin crew might request, to assist with disembarkation if the situation escalated or in case of another emergency. The cabin crew members took their assigned seats for landing.

Coordination and response at Adelaide Airport

At about 1702, the captain contacted VA ground personnel in Adelaide and notified them that a cabin crew member had been injured during turbulence and requested an ambulance on arrival.

The flight crew then notified ATC about the injured cabin crew member and requested Aviation Rescue Firefighting (ARFF) personnel to meet VUE at the arrival gate to provide first aid until the ambulance arrived.

Around the same time, VA personnel notified the SA Ambulance Service (SAAS) of the injury on-board VUE, and that an ambulance was required at the emergency gate at Adelaide Airport, to go airside.^[6]

At about 1709, ATC notified ARFF about the accident, and a crew were dispatched around two minutes later. An ARFF officer also contacted SAAS, to confirm an ambulance was en route. During this phone call, the ARFF officer directed the ambulance to the arrival gate via the upstairs sections of the main terminal.

VUE arrived at its bay at around 1719. ARFF personnel had pre-positioned at the bay and entered the cabin via the rear stairs soon after the aircraft arrived. A VA ground supervisor also came into the cabin to assist with the situation. The SAAS patient treatment record indicated the ambulance crew arrived at the Adelaide Airport terminal entrance at 1719, and proceeded to the arrival gate, commencing treatment at 1725.

There was extensive discussion between the ARFF, the SAAS and the VA ground supervisor about how to remove the injured cabin crew member from the aircraft. With a badly broken leg, the injured cabin crew member was not able to walk or to sit in a wheelchair, and the ambulance stretcher did not fit down the aircraft aisle. The emergency services personnel suggested using a scissor lift or catering truck appliance and asked the ground supervisor to assist with this. The ground supervisor advised that no scissor lift was available and declined the use of the catering truck.

After considerably more deliberation, the injured cabin crew member suggested that the ambulance officers conduct the extraction from the aircraft using a slide sheet. Emergency services personnel used the slide sheet to drag the injured cabin crew member along the aisle to the front of the aircraft, then placed the injured cabin crew member on a stretcher. SAAS records showed the ambulance departed the airport at 1845.

__________

1. All times in this report are expressed in terms of Central Standard Time (CST, UTC+9:30)
2. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. At altitudes above 10,000 ft in Australia, an aircraft’s height is measured in hundreds of feet above the standard atmospheric pressure datum of 1013.25 hPa. A height 35,000 ft above that standard pressure datum would be expressed FL 350.
4. A standard instrument arrival routes (STAR) is a designated arrival route linking a significant point, normally on an air traffic services route, with a point from which a published instrument approach procedure can be commenced.
5. The airspeed trend indicator is on the primary flight display, and shows the predicted airspeed in 10 seconds time. The context section of the report provides more detail about airspeed indicators in the 737
6. The term ‘airside’ means the restricted part of an aerodrome where aircraft movements occur, and where unauthorised personnel are excluded for security and safety reasons. This includes the aircraft parking apron and the runways.

Context

Flight crew information

The captain joined Virgin Australia (VA) as a Boeing 737 (737) first officer in 2003 and received command upgrade in 2012. The captain had a total flying experience of around 18,000 hours, including over 4,000 hours as captain and almost 6,000 hours as a first officer in the 737.

The captain reported being rested before starting work on the day of the accident. The captain woke at around 0530 for a 0930 sign on, had completed two short sectors prior to the accident flight and had one short sector scheduled afterwards. On the second sector, the captain had flown into Melbourne with the accident flight first officer (FO).^[7]

The FO joined VA as a Boeing 777 second officer in 2010, and qualified as a 737 FO in 2012. The FO had a total experience of around 8,500 hours, including around 3,500 hours in the 737.

The FO reported having a normal sleep on the night before the accident and was feeling alert at the top of descent into Adelaide. The FO recalled waking at 0500 on the day of the accident and leaving for work at 0645 for a 0830 sign on. The accident flight was the FO’s third of four scheduled short sectors that day.

Cabin crew information

The cabin supervisor (CS) joined VA in 2003 and became cabin supervisor in 2004. The CS was also involved in training other cabin crew, including instructing cabin crew non-technical skills.

The cabin crew member who sustained serious leg injuries had worked as a cabin crew member since 2002 and joined VA in 2005. The cabin crew member also had qualifications as an enrolled nurse, and was a first aid instructor at VA.

The cabin crew member who sustained minor head and facial injuries had only recently joined VA, and the accident occurred on this cabin crew member’s first day after paired ‘buddy’ training.

Aircraft information

VH-VUE was a Boeing 737-800. There were no indications that any mechanical issues with the aircraft were contributory to the accident. After the accident, maintenance personnel conducted a severe turbulence inspection which did not identify any damage or faults.

Airspeed indications

Figure 2 illustrates how airspeed indications are displayed to the crew on the 737 primary flight display.

Figure 2: Airspeed indications on the 737 primary flight display

Source: Boeing 737 Flight Crew Operating Manual (FCOM). Copyright Boeing.

• Item 1 and Item 5: Selected airspeed. The magenta numbers (Item 1) and speed bug (Item 5) display the targeted airspeed, set by the pilots. In the example shown, this is 250 kt.
• Item 2: Speed trend vector. The green arrow displays the predicted airspeed in 10 seconds time. This prediction is derived from the air data inertial reference system and is based on the current airspeed and acceleration. In the example shown, the green arrow predicts the airspeed increasing to about 258 kt.
• Item 3: Current airspeed. The white value displays the current calibrated airspeed. The value shown is between 242 and 243 kt.
• Item 4: Maximum operating speed. The lower of the red bars indicates the maximum speed as limited by lowest of the landing gear placard speed, flap placard speed, or V_MO/M_MO.

Prior to the autopilot disconnect, the flight crew observed the current indicated airspeed increase to near V_MO. The FO also observed the speed trend vector increase to within the lower band of the red bars, indicating that if not slowed the airspeed would exceed V_MO within the next 10 seconds. According to the captain’s interview with the ATSB, the captain did not specifically look at the speed trend vector prior to pulling back on the control column in response to the sudden speed increase.

Autopilot modes and airspeed management

Airspeed is the result of the balance between thrust and drag, both of which can be controlled by the automatic flight system (AFS) or the flight crew. The 737 AFS consists of the automatic flight director system (AFDS) and the autothrottle and can operate in multiple vertical and lateral navigation modes. When engaged, the vertical navigation modes control the vertical path and speed by adjusting engine thrust (through the autothrottle) and pitch attitude (through the AFDS). The vertical navigation modes seek to maintain waypoint altitude and speed crossing restrictions programmed into the flight management system in the vertical navigation path mode, or values input to the vertical speed and altitude controls on the mode control panel (MCP).

When the autothrottle is engaged in a mode to control airspeed, the airspeed is adjusted by increasing or decreasing the engine thrust. Alternatively, when the AFDS is in a mode that controls airspeed, airspeed is adjusted by changing the pitch attitude to increase or decrease the drag. To increase the airspeed, the pitch is reduced (nose down), and to decrease the airspeed the pitch is increased (nose up). Depending on the mode engaged, the AFS alters the pitch or thrust commands to attain and/or maintain either the airspeed selected in the flight management system or on the MCP.

Sudden changes in the magnitude of head/tailwind can have the effect of changing the airspeed. For example, a decrease in a tailwind can result in an effective increase in airspeed, all other factors being equal. In order to maintain the target airspeed, the AFS will either pitch the nose of the aircraft up or down, or increase/decrease thrust (depending on the selected mode).

Figure 3 shows the 737 MCP. Located on the glareshield panel, pilots use the MCP to select autopilot modes, and change autopilot target values such as airspeed and vertical speed. For example, pilots can use the IAS/MACH selector to change the MCP selected airspeed or use the vertical speed thumbwheel to change the target vertical speed.

Figure 3: 737 mode control panel

Source: Boeing 737 FCOM. Annotated and cropped by ATSB. Copyright Boeing.

For most of the descent into Adelaide, the pilots engaged the AFS in level change mode. In this mode, the autothrottle engages in the RETARD then ARM modes, meaning the autothrottle reduces the thrust setting to idle, and the pilots have manual thrust control using the thrust levers. The AFDS engages the speed mode, which means the AFDS commands adjustments to pitch attitude to maintain the speed set in the MCP IAS/MACH selector. The AFS system will not accept a selected airspeed greater than V_MO.

The FO, who was pilot flying (PF), also intermittently selected the vertical speed mode. In this mode, the AFDS commands pitch attitude adjustments to hold the target vertical speed entered using the MCP vertical speed thumbwheel. The autothrottle is engaged in speed mode to hold the selected airspeed. In descent, engine thrust will be at idle, meaning the autothrottle cannot reduce thrust to target a reduced airspeed.

The AFS mode reversion provides automatic controls which provide additional protections when the AFDS or autothrottle alone are insufficient to prevent exceeding a placard limit speed. In the case of V_MO, if the autothrottle is engaged in speed mode and the thrust levers are at idle, the engine thrust cannot be reduced further to prevent a speed increase. If the AFDS is in vertical speed mode, the AFS mode will automatically change to level change mode to provide speed control using pitch attitude changes.

Although different AFS modes automatically maintain the selected airspeed and prevent V_MO overspeed, the AFS is not capable of preventing temporary exceedances in certain circumstances. Where the aircraft encounters sudden environmental changes, such as severe windshear, this may exceed the performance capability of the AFS. This may result in temporary overspeed, particularly when the aircraft is operating close to V_MO or other limit speeds.

Control options for disconnecting the autopilot

Figure 4 shows the 737 autopilot disengage controls. The autopilot is typically disengaged by pressing the autopilot disengage button on either control wheel. A ‘disengage’ bar is also available on the MCP, which can be pulled down to disengage the autopilot. The position and design of these controls is such that they are accessible from the position of either pilot, and are simple to operate.

Figure 4: 737 Autopilot disengage controls

Source: Boeing 737 FCOM, Cropped and annotated by ATSB. Copyright Boeing.

The autopilot will also disengage if the pilot applies sufficient force to ‘breakout’ or ‘pull through’ the flight controls. After the autopilot has been disconnected, the pilot has full manual control of the aircraft’s pitch and roll attitude. An audible autopilot disconnect alert tone is produced whenever the autopilot is disconnected.

For this event, the captain pulled back on the flight controls, and did not report using either the disengage bar or switch. This action resulted in the autopilot disconnecting due to the breakout function.

Speed brakes

Pilots can extend the 737 speed brakes to increase drag, using the speed brake lever. The Boeing 737 Flight Crew Training Manual (FCTM) provided procedures for using the speed brakes in-flight. These procedures said that ‘the speedbrake may be used to correct the descent profile if arriving too high or too fast’. These procedures also noted that using speed brakes enabled the aircraft to decelerate up to 50 per cent more quickly.

For this event, the pilots did not use speed brakes to reduce airspeed prior to the overspeed or during the recovery.

Atmospheric conditions

Crew perceptions of weather conditions

In preparation for the flight, the pilots reviewed information about the forecast meteorological conditions. The information provided to the pilots included the significant weather charts for Australia for Flight Level (FL) 100-250 and FL 250-650, as well as the trend forecast, meteorological aerodrome report and aerodrome forecast for Adelaide. Other documents included the VA operational flight plan for the flight to Adelaide.

The significant weather charts (shown in Appendix C – Significant weather chart) forecast an area of moderate clear air turbulence from FL 100 to FL 250, which covered the planned route from around 95 NM (175 km) east of Adelaide. The aerodrome forecast for Adelaide was for westerly winds of 20 kt with gusts up to 30 kt, together with intermittent periods of reduced visibility in rain showers and small hail, and broken cloud at 2,500 ft.

The operational flight plan included a dispatcher note to the crew stating that the flight had been planned at FL 360 as this level had been reported ‘smooth’ by previous crews.

The captain reported considering that the overall weather conditions were mostly fine, although noting there was a chance of clear air turbulence en route. The FO identified that conditions may include gusty winds, and noted the forecast included small hail.

The crew reported that the actual conditions for the majority of the descent were smooth. At interview, the FO said that VUE was not in cloud at any time. At the time of the overspeed and sudden changes in pitch attitude, the FO recalled that that VUE was passing through thin wispy cloud.

The captain reported being surprised by the overspeed and perceived turbulence, because there had not been any returns on the weather radar, and that VUE was flying in light cirriform type cloud. The captain recalled the crew had not received any reports of turbulence from ATC or other aircraft. The captain’s initial notification of the accident to the ATSB stated that the overspeed and perceived turbulence occurred when VUE was in cirrus type cloud tops.

At 1645, a pilot of an aircraft departing Adelaide reported to the Adelaide approach controller that they had encountered light and occasionally moderate turbulence between FL 140 to 170. The crew on board VUE were not aware of this report.

Atmospheric data recorded by aircraft

The ATSB derived estimates of the instantaneous local wind speeds during the descent using the airspeed, groundspeed, track and heading information recorded by the flight data recorder (FDR).

The path that the aircraft travels over the ground is a combination its speed and direction through the air and the movement of the air through which it is travelling. As such, the local wind vector (speed and direction) is derived as the difference between the true airspeed and the groundspeed vectors, as shown in Figure 5.

Figure 5: Calculation of local wind vector (green) using the true airspeed (blue) and groundspeed (brown) vectors.

Source: ATSB

The wind vector may be illustrated as two components when referenced to the true airspeed. The component of the wind vector parallel to the true airspeed is the head/tailwind component, and the perpendicular component is the crosswind (Figure 6). The wind vector represents the direction that the wind is coming from, so with reference to the aircraft, a positive parallel component is a tailwind.

Figure 6: Wind components. The component of the wind that is parallel to the true airspeed is the head/tailwind and the perpendicular component is the crosswind.

Source: ATSB

Figure 7 shows the variation in the calculated wind vector and headwind components around the time of the autopilot disconnect. During that period, the wind component changed from almost no headwind component to a tailwind of about 25 kt, where it stabilised for about 10 seconds. Immediately before the overspeed, tailwind dropped by about 13 kt in around 2 seconds. This appears to have been due to a combination of a decrease in the wind strength and a change in the direction of the wind.

Figure 7: Plot of the calculated wind (light green), wind direction (yellow), headwind component (dark green), and aircraft heading (blue) during a two minute period around the autopilot disconnect.

Source: ATSB

Estimating wind information from FDR data is complex, and the reliability and validity of information recorded by aircraft sensors may be influenced by factors such as the sensor location and the sampling rate. Aircraft are also operating in a complex three-dimensional environment, where the aircraft body angles may not be aligned with the aerodynamic flight path vectors (for example, the vector directions may be effected by angle of attack and sideslip angles).^[8] The ATSB analysis was based on a simplified two-dimensional model of the aircraft environment.

While the ATSB’s analysis is appropriate for the purpose of estimating relative changes in the wind, analysis conducted by the manufacturer provided further certainty on the estimated wind changes. The manufacturer conducted a kinematic consistency analysis, which they describe as being ‘used to correct inherent inconsistencies often present in recorded data from different sensors because of the presence of instrumentation biases due to misalignment in inertial measurements, contamination of pressure and altitude measurements due to flow separation, and sample rate differences.’

The manufacturer’s kinematic consistency analysis also found that there was a sudden decrease in the tailwind component shortly before the airspeed rapidly increased towards V_MO. This change in tailwind component was of a similar magnitude to that calculated in the ATSB’s analysis.

Recorded information

Personnel from VA secured a copy of the quick access recorder (QAR) data for analysis and provided a copy of that data to the ATSB. The FDR and cockpit voice recorder (CVR) were also removed and sent to the ATSB laboratory in Canberra for analysis. The following describes the recorded sequence, changes to the aircraft autopilot modes and key flight data parameters during the descent into Adelaide:

• The flight crew commenced the descent with the autopilot engaged. Shortly after commencing the descent, the FO selected the level change AFS mode. There was a gradual increase in airspeed from around 1653:30, when VUE was descending through FL 340.
• At 1654:10, the FO briefly changed the AFDS command mode to vertical speed, with a setting of -650 ft/min, winding back to -450 ft/min. This was consistent with the pilots controlling the aircraft speed by reducing the descent rate. A few seconds later, the level change mode was re-engaged.
• The computed airspeed reached the selected target airspeed (320 kt) about 1656:30, as VUE was passing through FL250. For the next few minutes, airspeed was stable at around 320 kt.
• Figure 8 shows the changes to the autopilot modes and airspeed from 1658:00, when VUE was descending through around FL 200. Figure 9 shows changes to the flight controls and the aircraft vertical acceleration during that period.
• At 1658:18 the FO reduced the target airspeed to 310 kt. While the AFDS responded accordingly by adjusting the pitch angle, airspeed remained at about 320 kt.
• The FO selected the vertical speed mode again at 1658:38, with a vertical speed of -2,600 ft/min. The AFDS responded by adjusting the pitch angle to meet the new selected vertical speed. The FO then gradually wound back the selected vertical speed to -1,200 ft/min. The aircraft achieved the selected vertical speed, but airspeed remained at around 320 kt. At 1658:52, the FO re-engaged the level change mode.
• At about the same time, the autopilot commanded a turn towards the COMLY waypoint, as part of the STAR. The tailwind started to increase from around 20 kt to 38 kt, which contributed to the computed airspeed decreasing towards the target airspeed (310 kt). As the computed airspeed approached the selected airspeed, the autopilot decreased the pitch attitude.
• At 1659:05, the FO then selected the target airspeed to 300 kt. However, airspeed began to increase, from about 310 kt to 320 kt.
• The AFS and both pilots responded to the increase in airspeed. At 1659:10, the AFDS reduced the nose-down pitch angle. At about the same time, the FO engaged the vertical speed mode, quickly winding the selected vertical speed back from -1,200 ft/min to -400ft/min.
• At 1659:14, as the aircraft was descending through around 17,000 ft, the tailwind component quickly reduced from 23 to 12 kt and the wind direction changed (as described in Atmospheric data recorded by aircraft above). The airspeed quickly increased towards V_MO (340 kt).
• At 1659:16 (vertical purple dotted line in Figure 8 and Figure 9), the captain suddenly pulled back on the control column, with a maximum 49 lb backwards control force. This caused the autopilot to disconnect and resulted in a large increase in the aircraft pitch attitude.
• The captain suddenly released the controls after the autopilot disconnect, then pulled back on the controls again a few seconds later. The vertical acceleration rapidly increased to 2.3 g, before rapidly decreasing to 0.9 g. This was immediately followed by another rapid increase to 1.95 g, consistent with the second nose-up control input made by the captain.
• At 1659:19, the airspeed peaked at 341 kt, before declining quickly to around 280 kt.

Figure 8: Recorded data parameters including autopilot modes, pitch angle and vertical acceleration

Source: ATSB

Figure 9: Recorded data parameters including control column force

Source: ATSB

Windshear and autopilot performance

The ATSB considered the influence of wind changes on the changes to VUE’s airspeed during the descent. Figure 10 shows the changes in computed airspeed and headwind immediately before and after the overspeed and autopilot disconnect. This analysis indicates that there was a 10 kt speed increase between 1659:06 and 1659:13 that did not appear to be due to change in the headwind component. However, between 1659:14 and 1659:16 (when the autopilot disconnected), the rapid increase in the computed airspeed was consistent with a 12-14 knot change in the headwind component. The second rise in computed airspeed about 2 seconds later was also consistent with another change in the headwind component. This is consistent with a windshear encounter during the descent into Adelaide.

Figure 10: Comparison of the calculated headwind changes (green) and the computed airspeed (blue) in the two minute period around the autopilot disconnect.

Note on graph vertical axes: the left (wind component) and right (airspeed) are on the same relative scale (that is, a 10 knot change in the wind is the same as a 10 knot change in the airspeed). The computed airspeed scale is shifted to provide comparison.

Source: ATSB

When the FO engaged the vertical speed mode to respond to the speed increase, this automatically changed the autothrottle mode from ARM to MCP SPD. Because the thrust was already at idle, there was no capability for the autothrottle system to reduce the airspeed by reducing the thrust. Thus, when the AFS mode was changed, the AFS did not have an effective control over the airspeed, aside from mode reversion to level change mode.

The FCOM states that mode reversion occurs slightly before the aircraft reaches V_MO, but does not define the exact point of reversion. In this case, because the pull-through of the control column disengaged the autopilot, this prevented the mode reversion system from engaging. It is unknown to what extent the aircraft would have exceeded V_MO had AFDS continued to manage airspeed and the captain not intervened in this way.

The vertical speed selected by the FO was less than the current vertical speed, which would normally be expected to reduce the airspeed. However, the change in the headwind component was probably too rapid for this to be effective. In this instance, it may have been more effective to have left the AFS in level change mode, where the AFDS could provide management of the airspeed.

Handover and takeover procedures

Duties within the cockpit are normally allocated such that only one pilot, the pilot flying (PF), is responsible for manipulating the flight controls and providing input to the AFS. This delineation of responsibilities is important, for maintaining certainty of who is controlling an aircraft.

VA manuals described the procedures for handover and takeover of flying duties. The procedures stated that handover must always be done in a ‘positive manner’ using standard phraseology.^[9]

The captain noted that the intervention procedures normally included notifying the PF, and waiting for the PF to relinquish control. The captain identified not saying anything prior to pulling back on the control column, and described this as a reflex action. The captain implied that the decision to take control was rapid, and that a quick action was required given what they perceived to be the state of the aircraft.

The FO reported noticing that the captain had control when the autopilot disconnect audible alert was heard and the captain was observed making control inputs. The FO reported relinquishing control and immediately assumed the role of pilot monitoring (PM). The CVR recorded the autopilot disconnect tone, followed shortly by the FO saying ‘you got it’ then ‘you have control’. Shortly after, the captain said to the FO ‘you go, no you’re right’, and the FO responded ‘I have control’.

Safety systems for overspeeds

Safety implications of V_MO overspeed

The United States’ Federal Aviation Regulations (FAR) 25.1505 - Maximum operating limit speed defined V_MO as ‘a speed that may not be deliberately exceeded in any regime of flight (climb, cruise, or descent’. These regulations state that V_MO/M_MO must be sufficiently below the design dive speed of the aircraft, to make it highly improbable that the latter speeds will be inadvertently exceeded in operations.^[10] Other regulations provide further guidance on the calculation of the margins between V_MO/M_MO and these other limit speeds.

The FCTM described the concept of V_MO and the causes of V_MO overspeed:

V_MO/M_MO is the airplane maximum certified operating speed and should not be exceeded intentionally. However, crews can occasionally experience an inadvertent overspeed. Airplanes have been flight tested beyond V_MO/M_MO to ensure smooth pilot inputs will return the airplane safely to the normal flight envelope…Although autothrottle logic provides for more aggressive control of speed as the airplane approaches V_MO or M_MO, there are some conditions that are beyond the capability of the autothrottle system to prevent short term overspeeds

In a section related to procedures for rapid descent, the FCTM stated:

When descending at speeds near V_MO / M_MO with the autopilot engaged, short-term airspeed increases above V_MO / M_MO may occur. These are most often due to wind and temperature changes. These short-term increases are acceptable for this manoeuvre and the autopilot should adjust the pitch to correct the airspeed to below V_MO / M_MO.

The FCTM said that any time V_MO is exceeded, the maximum airspeed should be noted in the flight log. A VA Flight Crew Information Bulletin (FCIB) issued on 4 October 2016 similarly noted that pilots should make maintenance log entries and safety reports for any overspeeds.

The 737 maintenance manual required a structural examination of the aircraft if a V_MO exceedance was greater than 20 kt (that is, where airspeed exceeded 359 kt). There were no maintenance actions required for V_MO overspeeds less than 20 kt.

VA management of overspeed and flight crew understanding of overspeed implications

VA utilise a flight data analysis program (FDAP) to systematically analyse the flight data generated in each flight, in order to make comparisons between actual operations and company procedures, and to identify non-normal occurrences. VA’s internal investigation into the accident involving VUE noted that during the period 2014 to 2016 there was a tendency for pilots who exceeded V_MO to be made subject to operational clearance (SOC). The VA investigation report identified that these overspeed events were often unavoidable. Pilots declared SOC must cease flying duties until given formal notification that the SOC restriction was been removed. Pilots declared SOC typically underwent remedial training and re-assessment prior to resuming flying duties.

The VA internal investigation noted that in early 2017 (before the accident), VA management of minor exceedances shifted, which VA described as a shift in risk tolerance. After this change, the usual response involved reviewing recorded data from the flight, and no further action would typically be pursued if that review identified the crew action had been in line with procedures. After the accident involving VUE, VA provided education to pilots about the FDAP and the management of safety events during 2018 and 2019 (see Safety issues and actions).

The FO stated that it was ‘not a nice feeling’ when an aircraft exceeded V_MO. However, the FO also reported intending to let the aircraft overspeed prior to the captain’s intervention. The FO believed that if they had exceeded V_MO, the aircraft would be recovered to normal flight, and would require an engineering inspection and safety report.

During company interviews following the accident, the captain reported being mindful that a V_MO exceedance would flag in the FDAP. During interview with the ATSB, the captain reported perceiving it was very important to prevent the aircraft from exceeding V_MO, and that there was a recent significant focus within VA relating to avoiding overspeeds, which included extensive simulator and classroom training over a period of around 12 months, focussing on the correct use of the overspeed procedures described in the FCTM. The captain described being wary of avoiding overspeed if possible, because it was not good for the aircraft, and because the company did not want any overspeeds.

The captain also stated that VA pilots were generally wary about overspeeds. Although both pilots perceived that 320 kt was the standard or usual target speed for high-speed descent, the captain related that some company pilots would only target 300 kt during descent to avoid exceeding V_MO. The captain reported hearing informal rumours prior to the accident that having an overspeed would result in ‘the company wanting to have words with you’. The captain said that their preference for avoiding overspeed was probably influenced by the company’s preference to have less overspeed events.

Information the captain provided at interview indicated a limited awareness of the relationship between V_MO and the other aircraft limit speeds. The captain indicated not being aware that overspeeds less than 359 kt did not require maintenance inspection, and did not cause any other delay or significant consequence. When the captain saw the airspeed increasing towards V_MO, the captain thought this meant the autopilot was not controlling the aircraft.

Speed management and overspeed recovery

There were no specific procedures for the management of high-speed descents. As such, there were no procedures that described the target speeds pilots should adopt during high-speed descents, or how pilots should use autopilot modes or speed brakes to manage speed in these situations.

Other VA and Boeing procedures described the methods pilots should use to manage speed around V_MO, including recovering from overspeed. The 737 FCTM provided procedures for avoiding and recovering from overspeed, including in the descent stage of flight. In the section titled ‘Overspeed’ the FCTM stated that:

If autothrottle corrections are not satisfactory, deploy partial speed brakes slowly until a noticeable reduction in airspeed is achieved…

When encountering an inadvertent overspeed condition, crews should leave the autopilot engaged unless it is apparent that the autopilot is not correcting the overspeed. However, if manual inputs are required, disengage the autopilot. Be aware that disengaging the autopilot to avoid or reduce the severity of an inadvertent overspeed may result in an abrupt pitch change.

During climb or descent, if VNAV or LVL CHG pitch control is not correcting the overspeed satisfactorily, switching to the V/S mode temporarily may be helpful in controlling speed. In the V/S mode, the selected vertical speed can be adjusted slightly to increase the pitch attitude to help correct the overspeed. As soon as the speed is below V_MO/MMO, VNAV or LVL CHG may be re-selected.

VA sent company pilots a Flight Safety Notice in 2014, titled Exceedance of V_MO/M_MO and Assigned Altitude. Although this notice primarily related to overspeed associated with entry to Jetstreams on climb on in cruise, it highlighted that

V_MO/M_MO is the maximum operating speed and should not be exceeded intentionally, however small excursions of a short-term or transient in nature are within the design envelope of a jet transport aircraft. That is, there is minimal operational impact. Notwithstanding this, anytime V_MO/M_MO is exceeded the maximum speed and time above

V_MO/M_MO should be noted. V_MO/M_MO exceedance poses less risk generally than an excursion beyond a cleared altitude or Flight Level. A V_MO/M_MO exceedance is preferable to an altitude bust, or large abrupt control inputs.

Any V_MO/M_MO exceedance must be entered in the Maintenance log and a safety report must be submitted.

The Flight Safety Notice also highlighted relevant sections of the FCOM and FCTM.

In 2016, VA sent company pilots two FCIBs titled ‘Managing V_MO Exceedances and Wind Gradients near Jet Streams’ and ‘Assigned Altitude Overshoot and Overspeed Exceedances’. These bulletins provided further information about the risk of overspeed and how they should be avoided and managed, including:

• A number of VA crew had pulled back on the control column in an attempt to avoid overspeed. This had led to autopilot disconnection, large abrupt control inputs and significant g forces.
• The focus ‘needs to be on a preventative strategy and recovery technique’.
• High-speed descents need to be managed carefully, and this may include early descent at reduced speed to avoid potential overspeed.
• Level change or vertical navigation speed are the recommended modes for high-speed descents in conditions with steep wind gradients or turbulence.
• ‘It is preferable to accept a temporary overspeed (provided it is not excessive or sustained) rather than…large abrupt control inputs at high altitude’.
• The recovery technique for overspeeds is to ‘leave the autopilot engaged unless it is apparent that the autopilot is not correcting the overspeed. Be aware that disengaging the autopilot to avoid or reduce the severity of inadvertent overspeed may result in an abrupt pitch change and high ‘g’.’
• On descent, crews should command reduced airspeed and use temporary vertical speed mode selections to recover from overspeed.

Both the captain and the FO had passed simulator training sessions focusing on overspeeds, with the most recent session for each pilot occurring in 2014. The simulator scenario involved an overspeed during the cruise stage of flight, and pilots were evaluated based on their application of the procedures described in the FCTM.

The pilots recalled VA training and procedures for managing and recovering from overspeed. The captain recalled that VA training on overspeed recovery included using the vertical speed autopilot mode, and the speed brake. The captain also recalled that one VA training document stated that a small overspeed was better than an abrupt recovery. However, the captain noted that there was ambiguity in what was a small overspeed that could be allowed, as opposed to a larger overspeed, which was problematic. That is, the captain identified that the procedures did not define what a ‘small’ overspeed was.

The FO recalled pilots were taught to use the level change and vertical speed AFS modes and speed brake to recover from overspeed, and that if the aircraft was going to overspeed, to let it overspeed. The FO reported believing they would have applied the speed brake to recover from the overspeed situation, had the captain not intervened.

Control sensitivity at high-speeds

As a general principal, aircraft control systems are more sensitive in high energy states such as high-speed, high-altitude flight. This means that control inputs have larger effect when the aircraft is at higher speed. The FCTM noted the potential for over-control due to increased control sensitivity at high-speed, stating:

There have been reports of passenger injuries due to over-controlling the airplane during high altitude, high airspeed flight when overriding the control column with the autopilot engaged or after disengaging the autopilot with the disconnect switch.

Pilots should understand that, in general, the airplane is significantly more sensitive in pitch response (load factor) to column movement at cruise than it is at lower speeds associated with take-off and landing.

The captain reported not expecting to pull back very forcefully when taking manual control of the aircraft. However, reflecting on the development of the accident, the captain considered that their control inputs may have exacerbated what they perceived as the turbulence experienced by the aircraft.

Summary of overspeed safety systems

The ATSB considered the safety systems used by VA to reduce the risk of overspeed and unsafe interventions during overspeed events. Although no procedures specifically related to managing airspeed during high-speed descents, other procedures described the methods for managing airspeed around V_MO. Both pilots understood the procedures for managing airspeed on descent, and the FO reported planning to apply the speed brake prior to the captain’s intervention.

Within the safety system, there were controls that sought to reduce the likelihood of pilots unnecessarily taking manual control to prevent overspeed. The documentation suite instructed pilots that the autopilot should be left engaged. During post-accident interviews with the ATSB, both pilots exhibited a good understanding of those procedures.

The defences associated with preventing unsafe pilot interventions during overspeed were thus mainly procedural controls. This is understandable, as pilots should have the ability to take manual control of the aircraft if they perceive the need to do so. The defences within the safety system were associated with supporting effective decisions about intervening.

Pilots’ understanding of aircraft capabilities and limitations is informed by documentation and training. In this case, the documentation provided by VA and Boeing did provide a reasonable indication that minor overspeeds were not problematic. The FCTM advised that pilots sometimes inadvertently encounter overspeed during operations near V_MO, and this message was reinforced in the FCIB. The FCTM also contained emergency rapid descent procedures in which V_MO was intentionally targeted, and therefore it would be a reasonable inference that minor exceedance of V_MO would not risk the safety of the aircraft.

However, the documentation provided by VA and Boeing did not clearly express the tolerances of the 737 to minor overspeeds. VA documentation said that flight crews should document their airspeed any time airspeed exceeded V_MO, even though a maintenance inspection was required only for exceedances above 359 kt. In this regard, the documentation provided to pilots could be interpreted as any exceedance of the V_MO limit of 340 kt had safety implications.

Although the captain had concerns about an overspeed, this was probably not due to any systemic deficiencies in the documentation, or the training provided to flight crews. It is likely that all pilots, to some extent, have an aversion to exceeding defined limitations. The captain’s concerns about exceeding V_MO were probably a reflection of this. Additional context about tolerances beyond V_MO in documentation and training may reduce pilots’ concerns about minor overspeeds.

ATC speed control procedures

Air traffic control (ATC) instructions to arriving aircraft can include speed control. Speed control instructions may be based on considerations such as aircraft operational requirements and requirements for managing inbound aircraft traffic. The Airservices Australia Manual of Air Traffic Services (MATS) stated that when applying speed control, ATC should (among other responsibilities):

advise the pilot of future intentions; advise the pilot to resume normal speed as soon as the application of speed control is no longer necessary; and make speed adjustments judiciously in advance of the point at which the new speed is required, depending on the aircraft type and amount of adjustment involved.

MATS identified a speed guidance for Virgin 737 aircraft of 280 kt at 30 NM from an aerodrome. This documentation also identified that the maximum descent speed for these aircraft was 340 kt.

In November 2017 (after the accident), Airservices Australia published a revised MATS, which specifically advised controllers to ‘avoid cancelling published speed restrictions for arriving aircraft, except when necessary for traffic management or aircraft operational requirements’. Changes also included that controllers should not use the phrases ‘NO ATC SPEED RESTRICTIONS’ or ‘NO SPEED RESTRICTIONS’ when issuing speed control instructions to aircraft on a standard instrument arrival route. MATS was later revised to show a maximum descent speed of 320 kt for Virgin 737s.

VA advised that they had asked Airservices to review and change the MATS speed table to align the maximum descent speeds for the B737 for all operators. VA also advised the ATSB that they had asked Airservices to review the terminology ATC were using for issuing speeds on descent, to ensure that standard phraseology was being used.

Airservices advised the ATSB that there had been no internal reviews or investigations associated with this accident.

Acceptance of high-speed descent clearance

As a general principle, the captain of an aircraft has responsibility for ensuring the operational control of an aircraft, which includes accepting air traffic control requests for high-speed descent. The captain reported having no hesitation to deny an ATC request to conduct a high-speed descent, if the captain felt that was necessary.

The captain also reported not being able to recall if ATC instructed the aircraft to ‘make maximum speed’, or if the clearance was to target 320 kt. The FO recalled that ATC had issued the crew with a clearance for a high-speed descent but did not recall any details of the wording of that clearance. The implication, therefore, is that the pilots perceived the instruction issued by ATC as a clearance to conduct a high-speed descent; both pilots recalled that 320 kt was selected as a target speed in response to this clearance.

The ATSB did not find that the wording of the high-speed descent instruction by ATC had any influence on the target speed set by the pilots, or how the pilots managed their speed during the descent.

Other flight crew procedures

The descent procedures applicable to the crew of VUE were described in the 737 Flight Crew Operations Manual (FCOM). These procedures specified the requirement for crews to conduct an ‘approach briefing’ prior to the top of descent. The VA Operating Policies and Procedures Manual stated that flight crews should conduct a review of threats as part of the arrival briefing, which is equivalent to the approach briefing.

The procedures for the threat and error management review stated that the purpose was to review potential threats and determine the best management strategy. The procedure identified possible threats, including significant weather, and noted that the identified list of threats was not exhaustive. The procedures did not identify overspeed as a possible threat.

During the descent into Adelaide, the flight crew briefly conducted a review of threats. The FO noted the potential threats of turbulence and exceedances. The crew did not observe any indications suggesting turbulence. However, when the FO mentioned the threat of exceedances, the captain made a strong informal interjection saying ‘Don’t exceed anything…’ The crew did not discuss these threats any further, nor did they discuss a management strategy.

Cabin crew briefings

VA procedures required the flight crew to brief the cabin crew at different stages of the flight, including pre-flight and at the top of descent. The procedures stated that the pre-flight briefing should include information about the en route weather, any special considerations, and any deviation from normal conditions. Similarly, the top of descent briefing was required to include information about the possibility of turbulence, adverse weather, likelihood of the seatbelt sign being activated early, and ‘other anticipated special considerations for descent, approach and arrival’.

The captain briefed the CS pre-flight, and before top of descent into Adelaide. Neither briefing mentioned the forecast clear air turbulence, nor was the possibility of turbulence otherwise indicated. The top of descent briefing did not mention the planned high-speed descent.

The cabin supervisor (CS) reported that their prior experience was that captains usually advised the cabin crew about planned high-speed descents. The CS perceived this was best practice as it allowed the cabin crew to have awareness of the changed descent conditions.

The ATSB also spoke to a senior pilot from VA about cabin crew briefings for high-speed descents. That pilot reported that it was not typical for captains to brief cabin crew about a planned high-speed descent, and explained that in many cases, ATC issue clearance for high-speed descent after the top of descent. The procedures did not include a requirement to include planned high-speed descent in cabin crew briefings.

The ATSB does not draw an inference from the absence of information about the high-speed descent from the top of descent briefing. However, as expanded on in Unsecured cabin crew, cabin crew are reliant on the pilots for information about the descent conditions, and in this instance the cabin crew had no opportunity to modify their procedures during the descent.

Cabin crew procedures

Normal cabin preparation for landing

VA cabin crew procedures stated that the flight crew would make the ‘cabin crew prepare for landing’ announcement 10 minutes before the crew were required to be seated for landing, and that this would be at about 20,000 ft or higher for 737 aircraft. Cabin crew were then required to:

• cease all service involving carts
• secure their area of responsibility, including cabin and galley areas.

Toilets could still be used at this time.

The procedures required the PM to activate the fasten seat belt sign at transition level^[11] or 10,000 ft, whichever occurred first. After the PM had switched on the fasten seat belt sign, the procedures were for the cabin crew leader to then make the ‘seat belt sign for landing’ announcement. Cabin crew were then required to:

• check their area of responsibility and ensure passenger seat belts are fastened, toilets are locked, and personal electronic devices are away.
• return to their seat within one minute and be secured for landing including using a shoulder harness.

Prior to the sudden changes in pitch attitude, the ‘cabin crew prepare for landing’ announcement had been made, and the cabin crew had performed the duties required following that. The flight crew had not turned on the fasten seat belt sign, and there was no requirement for the cabin crew to be seated. The sudden pitch changes occurred about 7 minutes after the flight crew made the ‘cabin crew prepare for landing’ announcement.

The ATSB also sought to identify when the seatbelt sign was activated after the overspeed and sudden pitch changes. At interview, the captain reported believing the seatbelt sign was activated immediately after the sudden pitch changes. However, both the CS and the injured cabin crew member said that they observed the seatbelt sign remain off throughout the descent. The FO reported not being able to recall whether the seatbelt light was turned on immediately after the sudden pitch changes or later in the descent.

The illumination of seatbelt sign was not a parameter recorded on either the FDR or the QAR. However, when the seatbelt sign is turned on or off, a distinct audible tone is produced. The prescribed standards for Airborne Passenger Address Amplifiers are for the activation of the seatbelt sign to be associated with a single 494 Hz low tone (equivalent to musical note B). Other signals are associated with a high tone (587 Hz), and combinations of high and low tones.

The ATSB review of the CVR identified a single low tone, consistent with the activation of the seatbelt sign, at 1659:30. This was after the sudden pitch changes, and consistent with the pilots expressing the intent to turn the seatbelt sign on.

Cabin preparation in turbulent conditions

The VA Aircrew Emergency Procedures Manual described procedures for situations when pilots expected turbulence based on information from sources such as the Bureau of Meteorology, weather radar, ATC and reports from other aircraft. If the flight crew judged that turbulence was likely, they were required to inform the cabin crew during the briefings or another suitable time. The pilots were required to activate the fasten seat belt signs no later than one minute prior to the anticipated turbulence.

When turbulence was expected, the procedures instructed cabin crew to prioritise personal safety, and to not risk personal injury by continuing service. During actual turbulence, the procedures said cabin crew should secure themselves by sitting down or holding on to seat backs, evacuation handles or grab handles, where possible.

Because the descent conditions were smooth, and the captain did not perceive there was a risk of turbulence, the pilots did not turn on the fasten seat belt signs.

Stowage of oxygen bottles

The VA Aircrew Emergency Procedures Manual stated that on-board oxygen bottles could be used for a first aid situation. During landing, the procedures said that the oxygen bottles should be secured under a seat. These procedures also specified ‘precautions’ about the use of oxygen bottles, including ‘do not drop or bump oxygen bottle’.

The cabin crew related that their training had emphasised the importance of properly stowing portable oxygen bottles during approach and landing. However, they were unable to comply with the procedures on this occasion, because the injured cabin crew member was not able to move into a seated position. The injured cabin crew member reported maintaining a firm grip on the oxygen bottle during the approach and landing.

The ATSB sought information from the aircraft manufacturer in relation to securing oxygen bottles during landing. The manufacturer subsequently provided the following guidance:

• If the condition does not allow proper stowage, the oxygen bottles have shoulder straps that can provide some level of containment.
• For a condition where a cabin crew member could not be seated for landing, the crew member should position themselves against structure forward of their position for support in any deceleration condition associated with landing.
• The operator can evaluate their own configuration and determine the best course of action for the situation encountered in the occurrence.

Cabin crew incapacitation

The VA Cabin Crew Policy and Procedures Manual described procedures for managing cabin crew member incapacitation. Cabin crew were required to administer first aid, advise the CS and flight crew as soon as possible and place the crew member in a non-exit row passenger seat. The procedure was to then liaise with the captain on positional changes and alternate procedures for landing and reassign cabin duties based on the captain’s instructions. The procedures also included instructions for a single cabin crew member to operate two exit doors in these situations. The CS recalled VA cabin crew emergency procedures training was based on a single incapacitation. The CS said that scenario-based training for multiple incapacitation would have assisted the CS’ response to the accident.

Following the overspeed and cabin injuries, the CS advised the flight crew that the injured crew member was unable to move into an aircraft seat, and that the remaining crew would be repositioned to monitor the rear doors and the injured cabin crew member. The flight crew considered this information during the approach and landing, with the captain saying to the FO ‘Try to make it as smooth as possible. Try not to hit on the brakes too hard. I think (the injured cabin crew member) may still be on the floor’.

Management of injured persons at Adelaide Airport

Adelaide Airport Aerodrome Emergency Plan

The Adelaide Airport Aerodrome Emergency Plan (AEP) provided guidelines to co-ordinate response to and recovery from emergencies at the airport. The medical emergency procedures included that the SA Ambulance Service (SAAS) was the control agency. This means that SAAS were responsible for the overall direction of the activities associated with the response, including tasking and co-ordinating other agencies.

For medical emergencies, the AEP included procedures for notifying airport management, SAAS and Aviation Rescue Firefighting (ARFF). The AEP stated that ‘the plan is based on the assumption that each agency with a statutory responsibility has in place appropriate supporting procedures which deals with that agency’s response in accordance with this plan’.

Adelaide Airport also had procedures and plans related to co-ordinating ambulance access airside. In these procedures, airlines and the SAAS were to notify Adelaide Airport. An airport operations officer could then arrange for an escort from the airport emergency gate to the airside location.

Adelaide Airport advised that there were no entries made in their operations logs in relation to the accident, with the implication being that Adelaide Airport emergency operations personnel had not been alerted to the situation. Adelaide Airport personnel were not requested to arrange for airside ambulance access to VUE.

Relevant VA procedures and context

The VA Guest Services Procedures Manual contained procedures for medical emergencies ‘In Flight or Aircraft Not Parked at Terminal’. These included procedures for the flight crew to contact the medical information provider Medlink, so that Medlink could support the assessment and treatment of the affected persons. During this occurrence, the flight crew determined that it was appropriate to prioritise the descent and landing, so Medlink was not contacted at any stage.

The manual also included procedures for co-ordinating disembarkation, which were that:

The AMCO (Airport movement coordinator)/Airport Manager/attending medical personnel, in consultation with the pilot-in-command, will decide the method of disembarkation and which door the guests are to disembark from that will allow the medical team to, where required, gain immediate access to the person requiring medical assistance.

For this occurrence, the flight crew were not involved in consultation with the medical personnel about the extraction of the injured cabin crew. The captain perceived that with emergency services personnel, cabin crew and the ground operations supervisor in the rear cabin, there was not enough room for him, and also that the attending personnel were managing the situation.

VA advised the ATSB that in the event of a medical emergency response, once the ARFF personnel arrived on scene, VA personnel were no longer involved in the decision making around extraction of injured persons.

The ARFF officers asked the VA ground operations supervisor about access to a scissor lift or a catering truck. The ground operation supervisor identified that there was no scissor lift available and told the ARFF approval was not given for the use of the catering truck. In interview, the ground operations supervisor related that their concerns about using the catering truck included:

• The catering truck was not VA equipment and was operated by a contractor.
• The use of the catering truck was not part of VA ground handling procedures.
• The ground operations supervisor had never heard of the catering truck being used for the purpose of removing an injured person from an aircraft.
• The ground operations supervisor perceived that there was a significant fall from height risk. The normal operation of the catering truck involved the use of harnesses. The ground handling supervisor also said that from its ‘lowered’ position, there is around 1.5 m from the catering truck platform to the ground.

The ground operations supervisor perceived that working from heights risks were a main safety focus for VA ground operations. The ground operations supervisor had concerns about what would happen if the injured cabin crew member fell during a lift onto a catering truck, from the perspective of the injured cabin crew being seriously injured and also in terms of repercussions for the ground operations supervisor. The ground operations supervisor recalled a previous incident where someone was injured falling from an aircraft, which added to the concern about the fall from heights risk.

The ground operations supervisor also related that, at around the time the request to use the catering truck was made, the ambulance officers were on-board the aircraft. The ground operations supervisor perceived that the ambulance officers had control of the situation and the injured cabin crew member was in a stable condition. Also perceiving that the emergency services personnel were working towards a plan for the extraction from the aircraft, the ground operations supervisor did not consider it was necessary to explore further the option of arranging the catering truck.

Airport Rescue and Fire Fighting procedures

During an emergency response, ARFF provided first aid to injured persons until ambulance personnel arrive. Once the ambulance personnel are on-site, ARFF procedures were to hand over treatment and management of any casualties.

The ARFF personnel reported they had previously used scissor lift and catering truck appliances in similar situations, and perceived that this would be appropriate for removing the injured cabin crew member. However, this option was not given further consideration after the VA ground services manager denied the request.

ARFF reported that their officers did not assist with the removal of the injured cabin crew member. The ARFF officers handed over treatment and management of the injured cabin crew member to the SAAS and followed the direction of SAAS thereafter.

Previous occurrences

The ATSB reviewed recent accidents involving cabin crew injuries resulting from manual flight control inputs to prevent overspeed during descent. The following four examples were identified which show themes in the development and consequences in these accidents. This is not an exhaustive set of all similar accidents in the time period.

• AO-2014-032 In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72 aircraft, VH-FVR, 47 km WSW of Sydney Airport, NSW, on 20 February 2014. In this occurrence, a rapidly decreasing tailwind lead to an increase in airspeed towards V_MO. In response to the unexpectedly high airspeed trend indication and proximity to V_MO, the captain made nose-up pitch commands without following the take-over procedure. The aircraft pitched up and down suddenly, and a cabin crew member in the rear of the cabin suffered a broken leg.
• AO-2015-041 Flight path management occurrence involving Boeing 737, VH-YID, 55 km from Adelaide Airport, South Australia, on 9 May 2015. During a high-speed descent, the airspeed increased towards V_MO. The first officer responded to the unintended speed increase by pulling back on the control column until the autopilot entered a secondary mode. There was a sudden release of the control column, and one cabin crew member in the rear of the aircraft fell, sustaining a knee injury.
• AAIB investigation into Boeing 737-8AS, Serious injury to cabin crew, during descent to Manchester Airport, United Kingdom, on 14 January 2017. During a high-speed descent, a decrease in tailwind contributed to a V_MO overspeed. Because the captain perceived that the autopilot was not correcting the situation, the captain disengaged the autopilot using the autopilot disengage button, and pulled back on the control column. During the accident investigation, the captain reported pulling back with more force than intended. The aircraft experienced abrupt pitch changes and one cabin crew member in the rear of the aircraft suffered a fractured ankle.
• AO-2017-030 Flight path management occurrence involving Boeing 737, VH-VZZ, near Canberra Airport, ACT, on 13 March 2017. During a high-speed descent, a sudden decrease in tailwind contributed to an increase in airspeed towards V_MO. The pilot flying pulled back on the control column, causing the autopilot to disconnect. The aircraft experienced sudden pitch changes, and a cabin crew member in the rear of the aircraft suffered a fractured leg.

As this summary indicates, overspeed is a risk during high-speed descent, particularly if the aircraft encounters a sudden change in wind. Pilots have responded to overspeeds by making large pull-back control forces. As highlighted in this accident and the summarised previous occurrences, the application of large control forces to correct or prevent overspeed can cause significant injuries in the cabin.

Previous VA overspeeds and autopilot disconnects

The ATSB reviewed data from other overspeed events involving VA 737s in the years prior to the occurrence. VA provided summary details of flight data from all VA 737 flights from 2014-2017, where airspeed exceeded V_MO. This showed numerous overspeed exceedances, none of which involved a maximum airspeed above 359 kt, so none required a maintenance inspection.

VA also extracted data to describe 737 flights from the same period where the airspeed from top of descent to FL 50 was between 319 kt and 339 kt, to understand the actions of pilots attempting to control speed close to V_MO In its internal investigation report, VA observed that ‘the data demonstrates in the last three years B737 pilots have entered CWS Pitch or manual control in an attempt to avoid a V_MO/M_MO exceedance or to rapidly decelerate below it.’ The data did not indicate the portion of these events where the autopilot was disengaged using the dedicated controls compared to flight control pull-through.

__________

7. Both pilots were based in Melbourne. Expressed as local times for the pilots’ home base (UTC +10:00), the captain woke at 0600 for a 1000 sign on. The FO woke at 0530, left home at 0715 for a 0900 sign on.
8. See ‘The Answer is Blowin’ in the Wind - The Use of Recorded/Derived Wind Data in Investigations’ by Neil Campbell (2012), for an overview of the complexities in estimating wind information from FDR data.
9. The standard phraseology for transferring control is ‘I have control’ for the pilot taking PF duties, and ’you have control’ for the pilot relinquishing PF duties
10. The design dive speed of an aircraft is a more restrictive limit, designed to provide a margin between maximum cruise and operating speeds and the capabilities of the aircraft. For more information about design dive speeds and the calculations of airspeed margins see FAR 25.335 Design airspeeds and FAR 25.253 - High-speed characteristics.
11. The transition level represents the upper band of the transition layer, below which pilots much reference the local area QNH for altimetry. The transition level will be between 11,000ft and 12,500 ft, depending on QNH. For more information about these concepts, see the Aeronautical Information Package, published by Airservices Australia.

Safety analysis

Introduction

During a high-speed descent, the airspeed of VH-VUE increased unexpectedly and briefly exceeded the V_MO limit of 340 kt. This was contrary to the operating procedures provided by the manufacturer and the operator, and contrary to the intentions of the flight crew. The captain responded to the sudden increase in airspeed by pulling back on the control column causing the autopilot to disconnect. This caused pitch changes that resulted in large changes to vertical acceleration and injuries to cabin crew at the rear of the aircraft.

The recorded data showed the development of the pitch changes was sudden, and that the onset coincided with the autopilot disconnect. The pitch changes dissipated after the large control inputs had ceased. From this, the ATSB determined that it was highly unlikely that atmospheric turbulence caused the pitch changes.

Although V_MO was exceeded, it was not by an amount that required any structural inspections to ensure the ongoing airworthiness of the aircraft, according to 737 maintenance manual. The captain’s intervention probably reduced the magnitude of the eventual overspeed, and it is unknown to what extent the aircraft would have exceeded V_MO had the captain not intervened. However, the recorded data indicated that the autopilot was responding to the speed increase by raising the pitch of the aircraft. Furthermore, the pilots could have used the autopilot disengage controls rather than applying breakout force and could have reduced the aircraft speed using the speed brakes.

Therefore, the safety hazards involved in this accident were primarily associated with how the captain acted to prevent overspeed, and the consequent effects of vertical acceleration on the aircraft and its occupants.

Development of the overspeed

The flight crew accepted an instruction from air traffic control to perform a high-speed descent. Accepting a high-speed descent instruction was not unusual, and the ATSB did not find that the issuance or acceptance of a high-speed descent were factors that increased risk. However, targeting a higher descent speed reduces the margin between the target airspeed and airspeed limitations, and the risk of injury due to sudden control inputs will increase due to higher speed and increased kinetic energy.

The flight crew managed the descent using level change autopilot mode, with intermittent use of the vertical speed command mode. This was generally consistent with procedures and airspeed was generally stable at 320 kt during the early descent.

However, about 30 seconds after the turn towards COMLY, when VUE was descending through around 17,000 ft, a sudden decrease in tailwind associated with a windshear encounter led to a rapid increase in airspeed.

After observing the speed increase and trend towards the maximum operating speed (V_MO), the first officer (FO) changed the autopilot mode from level change to vertical speed. This is commonly used by flight crew to reduce the airspeed because, in a descent, reducing the vertical speed raises the nose of the aircraft, which consequently also reduces the aircraft’s airspeed. This was also consistent with the procedures in the Flight Crew Training Manual, and bulletins produced by the operator.

However, vertical speed mode does not directly control the aircraft’s speed, and if a windshear results in a large and rapid airspeed change, it may not provide sufficient speed control. Use of control modes that directly control the airspeed, such as the level change mode, allow the aircraft to respond directly to the airspeed changes. This is why the automatic speed protection will change from vertical speed to level change mode. Noting, however, that for very rapid wind changes, as was seen on this occasion, even the automatic flight director system (AFDS) may not be able to prevent an overspeed.

A few seconds later, the captain, who was pilot monitoring (PM) responded to the increasing airspeed by pulling back on the control column, which resulted in the autopilot disconnecting. Two seconds after the autopilot disconnect, the V_MO was exceeded by one knot.

Neither crew member applied the speed brakes to prevent the speed increase, nor during recovery from the overspeed. Although they need to be applied with care at high speed, the use of speed brakes would have reduced the likelihood of an overspeed without generating large flight loads and pitching motions.

Intervention to correct speed increase

The captain responded to the unexpected speed increase by pulling back firmly and abruptly on the control column to raise the pitch attitude of the aircraft’s nose. The captain took manual control of the aircraft without notifying the FO (who was pilot flying). This was not consistent with the normal process for handover and takeover. In situations where the pilot monitoring (not flying) perceives immediate action is required to avoid a hazardous situation, there will be a tendency for the transfer of control to happen more rapidly. However, it is still important for flight crew to formally identify who has control, to maintain clarity of the pilots’ roles.

Perceived urgency and lack of autopilot control

The large pull-back control input caused an autopilot disconnect and sudden changes in pitch attitude, resulting in injuries to the cabin crew.

The initial forceful pull back on the control column was in response to what the captain perceived to be a situation involving a nose-down attitude and an unexpectedly high airspeed indication. The sudden pull-back movement was a reflexive application of well-rehearsed basic flying principles, being consistent with an attempt to raise the nose of the aircraft, rather than an explicit attempt to disconnect the autopilot.

The captain indicated at interview that their pull on the control column was more forceful than planned. Consistent with this, the 49 lb backwards force applied by the captain is a large amount of force for a pitch up manoeuvre during high-speed flight and was not consistent with procedures that cautioned against making large control inputs during high-speed, high-altitude flight.

The ATSB considered the reasons for the captain’s large control input and the absent transfer of control. When the captain saw the airspeed increasing unexpectedly and approaching V_MO, the captain perceived that the autopilot was not controlling the aircraft, and that an urgent intervention was necessary. The captain related this response to a reflex, impulsive response, with the implication being the action was rapid and without conscious deliberation.

It is likely that the captain’s perception of urgency affected how the captain responded to the sudden speed increase, and contributed to the captain responding rapidly, with a low level of conscious analysis. Research shows that when individuals perceive they need to respond rapidly to a situation, they tend to consider fewer options and less information (Dismukes, Goldsmith, & Kochan, 2015) and typically use rapid, associative and unconscious information processing, which is primarily influenced by pre-existing knowledge and beliefs (Klein, 2008). Research summarised by Means, Salas, Crandall and Jacobs (1993) suggests that in real-world settings, there is a speed/accuracy trade-off between rapid intuitive decisions and more time-consuming analytical decision making.

Other research describes how individuals interact with control systems changes depending on the perceived time available. According to Hollnagel (1998), where the individual perceives there is a large amount of time, he or she is able to look ahead and think about higher level goals. The individual can sample a large amount of information, and feed-forward to test the effect of actions. However, when the individual perceives he or she has little or no time, the most obvious feature of the environment and the immediate needs of the situation will dominate the choice of action. There is no planning or analysis; the individual is essentially seeing and responding.

It was evident that the captain of VUE perceived there was no time to evaluate the sudden airspeed increase and needed to respond urgently because of a perception that the autopilot was not controlling the aircraft. While an overspeed event may not be desirable, this perception to respond urgently was inconsistent with the documentation provided by the manufacturer and the operator about the aircraft safety around V_MO. Overall, the documentation implied that minor exceedances of V_MO were not hazardous to the safety of the aircraft.

Concerns and beliefs about overspeed

The captain was highly concerned about overspeed, and this probably contributed to the captain’s assessment that the increase in airspeed towards V_MO meant the aircraft was not in a controlled state, and that urgent action was necessary. The captain was mindful of avoiding overspeed during the descent and made several comments to the FO along the lines of ‘don’t overspeed’.

The captain’s concerns about avoiding overspeed were influenced by a perception that Virgin Australia (VA) were also concerned about overspeed and wanted to reduce overspeed events. The captain reported hearing rumours that other VA crews had been subject to some form of management review after experiencing overspeeds. Although VA had changed their management of overspeed events prior to the occurrence, it is unknown how flight crew understood these changes. In this event, it is possible that the captain’s concerns about overspeed were a carry-over from the operator’s previous management of overspeed events.

The captain’s concern about the increase in airspeed towards V_MO was also influenced by perceptions and beliefs about the airspeed limits of the aircraft. The captain indicated not being aware that there was a margin between V_MO and the requirement for a maintenance inspection at 359 kt, or that there was a margin between V_MO and the structural limitations of the aircraft.

Influence of the speed trend vector

The speed trend vector is located on the same instrument display as the airspeed indicator. In this case, the FO reported observing the trend indicator moving towards the maximum operating speed (V_MO). However, the trend indicator is not a recorded parameter in the flight data recorder, so the ATSB was unable to determine what the speed trend vector showed during the development of the overspeed. The captain reported not specifically looking at the speed trend vector prior to making the abrupt control input. While it is possible the captain’s perception of urgency was influenced by a high airspeed trend projection while observing the airspeed indicator, there was no direct evidence of this effect.

A previous ATSB investigation (AO-2014-032) found that in that instance, the speed trend vector probably indicated a projected speed well above V_MO. The investigation found that the captain responded to the high trend airspeed indication by perceiving a need to intervene immediately and made pitch control inputs without following the normal take-over procedure.

Flight crew risk planning and descent preparation

As highlighted in this occurrence, pilots’ management of unexpected events or hazards during descent can be fraught with risk. The descent phase of flight is complex, and there are multiple considerations for the flight crew to manage. Pilots’ ability to manage threats is complicated by perceptions of urgency or threat to the aircraft. In these circumstances, pilots are more likely to use rapid, associative modes of response, rather than planned and analytical behaviours.

Explicit consideration and management of threats is likely to mitigate the known limitations of decision making in real-world settings. The value of formal threat review procedures, in which threats and their responses are deliberately considered ahead of encountering them, is that this removes the requirement to think and act in a time-pressured, tightly coupled setting. By considering potential threats at an earlier stage in flight, threat reviews also allow flight crews to make tactical adjustments, and to observe the effects. When pilots identify potential actions prior to being in a perceived emergency, they can also think through the implications of those actions as a crew. The FAA Aeronautical Decision Making (ADM) educational material provides further support for how threat identification and planning can help address some of these biases and tendencies in decision making.

In this occurrence, the flight crew did not effectively prepare for the risk of overspeed in the arrival briefing. Although the pilots identified overspeed was a potential risk during the high-speed descent, they did not discuss what the implications of an overspeed would be, or what actions they would take if speed started to increase unexpectedly. The crew did not elaborate about the risk of overspeed, apart from the captain saying ‘don’t exceed anything’. This was contrary to the intentions of the procedures, which indicated flight crews were to discuss threats and their management at the top of descent.

Other than the formal procedural control of the threat and error management review, there were other opportunities for the crew to think about the management of a potential overspeed at an earlier stage of the flight. The crew were evidently aware of the risk of overspeed throughout the descent, with the captain saying to the FO ‘don’t overspeed’ on several occasions, and the FO remarking that the autopilot was not very effective at holding the speed steady. Although the FO expressed a plan to reduce the target speed during the descent, there was no discussion of what the crew would do if that did not have the desired effect, or if the airspeed exceeded V_MO.

Overall, this was a lost opportunity for the flight crew to effectively manage the risk of overspeed. The pilots were in a position where they had time and space to think about a potential overspeed as a crew. At the top of descent, the pilots could consider the tolerances of the aircraft to airspeed exceedances, and how they could respond safely given the high-energy state of the aircraft.

However, as the aircraft continued the descent and operated close to V_MO, the time available to the flight crew reduced. When the captain saw the airspeed suddenly increase, the captain perceived the crew were in a position where there was no time to discuss the situation with the FO, to think about the implications of the overspeed, or to consider the consequences of the pull-back control action. In this way, the absence of planning at an earlier stage in the descent affected how the captain managed the risk of overspeed during the occurrence and increased the risk of unsafe intervention.

Unsecured cabin crew

Seatbelts are a very effective defence against injuries during events where cabin occupants are affected by upset forces. Analysis by the FAA shows that from 1980-2003, there were only four cases of serious injuries on United States carriers during turbulence accidents where the injured person was seated with seatbelts fastened.^[12] Conversely, the FAA says that around 58 people are injured each year by turbulence while not wearing seatbelts. Consequently, procedures that require the use of seatbelts, and other methods to secure cabin occupants, are the primary means of preventing injuries during these types of events. The cabin crew were not secured prior to the sudden change in pitch attitude, which increased the likelihood of injuries.

There is a regulatory requirement for cabin crew and passengers to be seated with seatbelts fastened in turbulent conditions,^[13] and procedures required the pilots to brief the cabin crew about expected turbulence during both the pre-flight and top of descent briefings. However, neither of the briefings included the forecast clear air turbulence.

Cabin crew briefings are important defences for the safe preparation of the cabin, to mitigate the risk of injury. The cabin crew do not have access to meteorological information or other indications about what is likely to happen in the descent, and therefore their ability to adequately prepare for turbulence is dependent on the information provided by the pilots. When cabin crew are adequately briefed, they can modify their duties and take other steps, such as ensuring they are seated as early as possible. Because the cabin crew were not aware of the forecast clear air turbulence, they had no ability to modify their procedures.

The ATSB considered the influence of the briefings on the injuries sustained by the cabin crew. Although the flight crew reported that they were aware of forecast moderate clear air turbulence during the descent, they perceived the conditions as smooth, and noted that there had been no returns on the aircraft weather radar. Based on the information available to him, the captain did not perceive that a turbulence encounter was likely. The injury to the cabin crew was not caused by a clear air turbulence encounter. Therefore, although the absence of briefing information about the forecast clear air turbulence was not helpful for the ability of the cabin crew to prepare for descent, this did not contribute to the injuries sustained in the accident.

During this occurrence, the ‘cabin crew prepare for landing’ announcement was made about 7 minutes before the sudden changes in pitch attitude, and the fasten seat belt signs had not been turned on. This meant that, based on normal procedures, there was no requirement or expectation from the cabin crew that they should be seated.

Delayed removal of injured cabin crew from aircraft

Defences that assist in the recovery from incidents and accidents form part of the overall safety systems for planned operations into aerodromes. For accidents involving injuries to aircraft occupants, an effective safety system should include the ability to extract casualties from aircraft. Although the use of the slide sheet was not typical, there was no evidence of any safety issues posed by this method. However, the ATSB did consider that the time taken to extract the cabin crew as indicative of a delayed response to the accident. After the arrival of VUE at Adelaide, it took over 90 minutes for the injured cabin crew to be removed from the aircraft and taken to hospital.

The communication between the crew, VA, Airport Rescue and Firefighting (ARFF) and SA Ambulance Service (SAAS) was generally effective and emergency services were notified promptly after the accident. The SAAS crew did not utilise the emergency gate to access the aircraft, because they were directed to the main terminal by ARFF. While the ARFF were at the gate when VUE arrived, the SAAS arrived shortly after. However, there was no evidence that the non-use of the emergency gate affected the timing of the response. As such, the delays associated with removing the injured cabin crew member from the aircraft were related to the on-board co-ordination of the extraction.

The main factor that complicated the extraction of the injured cabin crew was the decision by the VA ground operations supervisor to deny the request to use the catering truck. The ARFF utilise the available resources dependent on the needs of a situation, and the attending firefighters had experience using catering truck vehicles in situations like the occurrence. The ARFF had a reasonable expectation that a catering truck would be made available to them upon request.

The ground operations supervisor performs a defined role within the overall context of the normal airline operations, and the ground operations supervisor’s decision making authority is typically constrained to this role. It is not typical for the ground operations supervisor to make decisions or accept perceived risks relating to departures from procedures. In this context, it is understandable that the ground operations supervisor would be hesitant to grant permission to use equipment owned and operated by another company, which they had no experience using, and which they perceived involved a risk of injury.

On this occasion, the decision making about utilising the catering truck could have been supported by guidance from more senior personnel within VA operations, such as the flight crew. However, the flight crew did not enter the cabin after the aircraft landed, and the ground operations supervisor did not perceive there to be a need to seek their advice, as the ground operations supervisor considered the cabin crew’s condition was being managed by the ambulance officers.

Additionally, within the context of an emergency response, control agencies have a responsibility to exercise authority to task and direct individuals. There must be absolute clarity over who has control of an incident response, and the requirement of other personnel to follow directions. The Adelaide Airport Aerodrome Emergency Plan identified the SAAS as the control authority for a medical emergency. However, ambulance personnel are not likely to have extensive experience in working in and around aircraft, or to be familiar with the aerodrome emergency plans. Ambulance personnel will probably rely on the advice of ARFF and other aviation personnel to identify suitable and available equipment.

The ATSB considers that the overall response by attending personnel, including the response to the request for use of the catering truck, was indicative of a lack of clarity of control responsibility. Agencies involved in the aerodrome safety system at Adelaide Airport may consider additional methods to ensure a shared understanding of the structure of control and authority in medical emergencies.

With the ARFF and ambulance personnel on site, it is likely that the extraction of the injured cabin crew could have been escalated if there was a critical need. While the delayed extraction did not increase safety risk in this instance, the ATSB considers there are opportunities to improve how airside personnel work with emergency services.

__________

12. For further information on this dataset, see the FAA Advisory Circular ‘Preventing Injuries Caused by Turbulence’, AC 120-88A
13. Civil Aviation Order 20.16.3

Findings

From the evidence available, the following findings are made with respect to the overspeed and cabin crew injury involving Boeing 737, VH-VUE, 42 NM east-south-east of Adelaide Airport, South Australia, on 13 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During a high-speed descent, a sudden decrease in tailwind associated with windshear caused airspeed to approach and exceed the aircraft maximum operating speed (V_MO). The flight crew did not apply speed brakes to arrest the speed increase.
• In response to the airspeed rapidly increasing towards V_MO, the captain (pilot monitoring) perceived a need to immediately intervene and made pitch control inputs without following the normal take-over procedure and alerting the first officer (pilot flying).
• The magnitude of the captain's control input was probably greater than intended. This was influenced by a perception that the autopilot was not controlling the aircraft, so an urgent intervention was required. The magnitude of the control input caused sudden pitch changes, resulting in the injuries to the cabin crew.
• Although the flight crew identified the risk of overspeed during the high-speed descent into Adelaide, they did not consider steps for mitigating that risk, or how they would manage an overspeed during the descent. This reduced the likelihood of the crew effectively responding to the unexpected increase in airspeed.

Other findings

• Although the weather forecast included moderate clear air turbulence and the aircraft was making a high-speed descent, the pilots perceived that flying conditions were smooth and elected not to activate the fasten seat belt sign. The cabin crew briefings did not mention the forecast clear air turbulence. The cabin crew were not secured prior to the sudden pitch changes, which increased the likelihood of injuries.
• The ground handling supervisor assessed there was a significant fall from height risk associated with the unsecured use of the catering truck. For that reason, the ground handling supervisor did not agree to the emergency services request to use that equipment to remove the injured cabin crew.

Safety issues and actions

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The captain and the first officer (FO) of VH-VUE both underwent training and assessment after the accident. This included a review of the flight data from the accident flight, the autopilot management and other recovery techniques during that flight, as well as the correct recovery actions from an overspeed. Both pilots were assessed as having demonstrated a competent standard during these reviews.

Virgin Australia (VA) have provided pilots with additional training and information about overspeed, overspeed prevention and overspeed recovery:

• In 2018, VA pilots were shown animations demonstrating mishandled and correct overspeed recoveries. VA will also include the accident occurrence as part of future non-technical skills training for pilots and cabin crew.
• The Flight Crew Information Manual was updated to include a section on ‘Managing V_MO/M_MO Exceedances’. This section stated that aircraft have been tested beyond V_MO/M_MO, and that these speeds include a margin below the speeds that require maintenance action or threaten the structure of the aircraft. The manual also stated that it is acceptable to refuse an ATC instruction to perform a high-speed descent. The manual identified that disengaging the autopilot to respond to an overspeed may result in abrupt pitch change.
• A Flight Crew Information Bulleting (FCIB) was sent to VA 737 pilots identifying that there had been many instances where pilots had manually intervened to respond to an overspeed or possible overspeed, and that several of these events had resulted in serious injuries. The FCIB provided information to pilots including that V_MO/M_MO are not never exceed speeds, and that it is acceptable to refuse an instruction to conduct a high-speed descent. The FCIB emphasised that it is preferable to accept a temporary overspeed than to make large abrupt control inputs.
• An email was sent to all VA 737 flight crew, reiterating much of the information covered in the other material. This email also identified the actions pilots should apply if they allowed the autopilot to recover the overspeed, but perceived speed continue to increase or that the autopilot was not handing the situation. These procedures were to hold the control wheel and ensure there is no back pressure being applied to the controls, disengage the autopilot, then slowly raise the nose of the aircraft.

Virgin Australia have updated materials provided to ground handling staff and other personnel working airside. The updated procedures say that in situations where emergency services are in attendance, VA team members should follow reasonable directions from those agencies. Where VA team members are in doubt, the updated procedures say they should liaise with the captain, on-board cabin crew leader or airport manager, as applicable.

To respond to the perceptions within the pilot group and to further educate flight crew about management of flight safety events and the how the flight data analysis program (FDAP) worked, VA pilots undertook non-technical skills training on the FDAP during 2018/19, and senior members of the VA flight operations and safety team conducted roadshows on the management of safety events during the same period.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Interviews with personnel including the flight crew and members of the cabin crew
• Recorded information from on-board recorders
• Meteorological information from the day of the accident
• Records from emergency services operators
• Manuals and other documentation related to flight crew, cabin crew and ground crew procedures
• Expert analysis provided by the aircraft manufacturer.

References

Campbell, N. (2012), The answer is blowin’ in the wind” The use of recorded FDR wind data in investigations. International Society of Air Safety Investigators conference 2012. Retrieved from www.asasi.org
www.asasi.org/papers/2012/The Use of Recorded FDR Wind Data in Investigations - Neil Campbell.pdf

Dismukes, R. K., Goldsmith, T. E., & Kochan, J. A. (2015). Effects of Acute Stress on Aircrew Performance: Literature Review and Analysis of Operational Aspects. Moffett Field, CA: National Aeronautics and Space Administration.

Hollnagel, E. (1998). Context, cognition, and control. In Y. Waern, Co-operation in process management - Cognition and information technology. London: Taylor and Francis.

Klein, G. (2008). Naturalistic decision making. Human Factors, 50(3), 456-460.

Means, B., Salas, E., Crandall, B., & Jacobs, T. O. (1993). Training decision makers for the real world. In G. Klein, J. Orasanu, R. Calderwood, & C. E. Zsambok, Decision making in action: Models and methods (pp. 305-326). Norwood, NJ: Ablex.

Reason, J. (1990). Human Error. Cambridge: Cambridge University Press.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Virgin Australia, Boeing, Airservices Australia, Adelaide Airport, SA Ambulance Service, the Civil Aviation Safety Authority, the captain, the first officer, the cabin crew on board VH-VUE, and the Virgin Australia ground supervisor.

Submissions were received from Virgin Australia, Boeing, the cabin supervisor and the cabin crewmember who sustained the broken leg. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – DRINA NINE ALPHA STAR

Figure A: DRINA NINE ALPHA STAR

Source: Airservices Australia

Appendix B – Flight data recorder data

Figure 11: Selected parameters during descent

Source: ATSB

Appendix C – Significant weather chart

Figure C: Significant weather chart for Australia, FL 100-250. This chart was valid 0600 UTC and used for operations three hours either side of that time. The red line shows the flight planned route of VH-VUE. A body of clear air turbulence is indicated by the long-dash line, and affects the planned route, to the west of the 140° meridian of longitude.

Source: Virgin Australia, originally produced by Bureau of Meteorology

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At about 0945 Eastern Standard Time^[1] on 26 August 2017, Queensland Rail (QR) suburban passenger train 1A21, travelling to Shorncliffe on the out-bound suburban line, approached Bowen Hills station.

The signal prior to the station (ME19) displayed a restricted indication (double yellow aspect)^[2] for the driver. The Automatic Warning System (AWS)^[3] generated an in-cab alert to the driver of the restricted signal indication ahead. The driver acknowledged the AWS and readied the train for the station stop at No.2 platform Bowen Hills.

Mid-way along the platform, the AWS activated again, indicating the next signal at the end of No.2 platform (ME25) was also displaying a restricted indication (single yellow aspect).^[4] The driver acknowledged the AWS, but at about that time his attention shifted to a person standing near the end of the platform. The driver, who had previously been exposed to people attempting self-harm, recalled experiencing an anxious moment as the train neared the person.

The driver stopped the train at the platform, but reported that he did not apply the required ‘Start on Yellow’ (SOY) procedure (brake controller to full service and reverser to neutral). This procedure compels the driver to re-check the departure signal indication prior to starting from the platform.

Following the receipt of ‘right-a-way’ from the guard, the driver started from the platform without checking the departure signal (ME25), overlooking the single yellow aspect warning that the next signal ahead (ME45) was displaying a red indication. After accelerating the train to the designated track speed of 30 km/h, the driver noticed temporary stop signs erected on both the adjacent in‑bound and out-bound main lines.

As the train traversed a sweeping right hand curve, the driver then observed maintenance staff working on the main lines (Figure 1). To warn the workers of the approaching train, the driver sounded the train horn on two occasions before one of the workers acknowledged him. As the train neared the workers and signal ME45, the AWS activated, warning the driver of the restricted signal indication (red aspect) ahead. The driver acknowledged the AWS, but did not respond to the signal. After passing the workers, the driver recalled looking ahead, sighting other maintenance staff in the distance, and then observing the red aspect of signal ME45. The driver responded by fully applying the train brake.

At 0948, as the train passed signal ME45, an alarm activated at the QR Rail Management Centre at Mayne. The network control officer overseeing that particular area broadcast an emergency radio message calling for the driver of 1A21 to stop.

On-board CCTV footage indicated the train was travelling at 32 km/h when the brakes were applied, with the train coming to a stop approximately 40 m beyond the signal. Due to the removal of the train’s event recorders for repair, there was no on-board data recording available to capture vehicle parameters, other than the CCTV footage.

In passing signal ME45, train 1A21 had entered into the limits of a Track Occupancy Authority (TOA). At the time of the occurrence, track workers were clear of the danger zone and the TOA was in the process of being suspended.

Figure 1: CCTV footage from the driving compartment of train 1A21
 

Image shows maintenance staff working on the Main Lines and signal ME45 in the foreground. Image supplied by Queensland Rail – Annotated by the ATSB.

Safety analysis

While perhaps influenced by the driver’s focus on a person near the end of the platform, not applying the ‘Start on Yellow’ procedure removed the requirement to assess signal ME25 (which was displaying a yellow indication) prior to departure. That in turn removed an opportunity for the driver to expect that signal ME45 would be displaying a red indication.

As the train traversed the sweeping curve, it is likely the driver’s attention was diverted from the primary task of observing signals toward other activities adjacent to the track. That may have influenced the driver’s inappropriate response to the AWS indication and led to the train passing the signal at STOP.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Due possibly to distraction, the driver did not apply the applicable procedures relevant to the restricted indication displayed at signal ME25 prior to departing the platform, therefore missing vital information concerning the aspect status of signal ME45.
• The driver’s attention was likely focussed on peripheral trackside activity as the train approached signal ME45, distracting him from the primary task of observing signal indications.

Safety message

Train drivers are reminded that distraction while operating trains is a hazard which increases risk. To appropriately manage the risk, drivers are required to follow a robust risk-based approach. This includes applying applicable procedures and control measures.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Caution – proceed to find the next signal at caution.
3. The AWS is part of the signalling system and the in-cab system warns the driver whether the next signal is clear or restricted.
4. Caution – expect the next signal to be at STOP. Proceed, prepare to STOP prior to the next signal.