Safety summary

What happened

On 20 March 2019, the pilot of an Airbus Helicopters AS350B3e, registered VH-SZS (SZS) was performing aerial work on Pernatty Station, South Australia, approximately 60 km east of Woomera Airfield. The task involved helicopter powerline stringing from the Mount Gunson South substation to the Carrapateena mine site, a total distance of 51 km. The stage being conducted on the morning of 20 March was from pole 159 to pole 179, a distance of 4.8 km. Stringing operations continued normally for poles 161, 162 and 163. However, while approaching pole 164, at about 1017, witnesses reported seeing the helicopter collide with the pole and impact terrain near the base of the pole. The pilot, who was the sole occupant, received fatal injuries.

What the ATSB found

The ATSB found that shortly after the pilot was trained in powerline stringing, for unknown reasons they modified the taught stringing methodology. The new methodology placed the helicopter at low level in the vicinity of the powerline poles, increasing the risk of a collision. It also exacerbated the uptake of dust which, in combination with the position of the sun and the rearward attitude of the aircraft likely reduced the pilots’ visibility of pole 164 and their situational awareness of it.

These factors, combined with the short distance and large elevation gain between pole 163 and 164, led to the pilot inadvertently colliding with pole 164. It was also found that the indirect supervision provided to the newly trained pilot was ineffective in identifying that a modified stringing method was being used.

What has been done as a result

The helicopter operator has advised the ATSB that they have made the following changes to their operations manual. The changes relate specifically to the supervision and review of newly authorised pilots in specialist tasks, and includes:

• Mandated and expanded In Command Under Supervision time requirements for pilots as part of initial task training for relevant specialist tasks.
• The introduction of consolidation flight checks at key points for pilots newly authorised in relevant specialist tasks.
• The mandated extension of time that pilots newly authorised in relevant specialist

tasks are mentored by an experienced pilot.

Safety message

This investigation shows that experience alone will not always prevent a pilot from having an accident. In this case the pilot was a very experienced deputy chief pilot with nearly 6,500 flight hours. The ATSB research publication AR-2012-035 provides some insight as to why experience does not always provide a safeguard:

• Experience alone can never compensate for high risk activity.
• Sound decision-making and experience do not necessarily go together.
• Using pilot experience as mitigation for potential operational risks is inadvisable. If the risks are unacceptable for a qualified and competent pilot, there should be no reason for an experienced pilot to accept them.

The investigation also highlights the value of direct supervision of pilots who have recently been trained in a new task.

The occurrence

On 20 March 2019, the pilot of an Airbus Helicopters AS350B3e, registered VH-SZS (SZS) was performing aerial work on Pernatty Station, South Australia, approximately 60 km east of Woomera Airfield (Figure 1).

Figure 1: Accident location

Source: Google Earth, annotated by ATSB.

The helicopter operator (Aeropower) had been contracted to conduct powerline stringing operations (see the section titled Power line stringing methodology) for a new 132 kV electrical transmission line from the Mount Gunson South substation to the Carrapateena mine site (operated by OZ Minerals). The task involved stringing draw wire^[1] and optical ground wire. The total length of the stringing operations, 51 km, was divided into twelve stages that were identified with reference to numbered transmission poles. The stage being conducted on the morning of 20 March was from pole 159 to pole 179, a distance of 4.8 km.

On the morning of the accident the Aeropower pilot and refueller rose at about 0430 Central Daylight‑saving Time.^[2] After breakfast, at about 0630 they attended the first of three morning briefings. The first briefing was run by Ventia, the primary contractor for the powerline operation (see the section titled Operational information). All workers were breath-tested for alcohol during this briefing. After the Ventia briefing, the Aeropower duo then attended the Powerlines Plus (PLP) briefing at about 0700. After the PLP briefing, at about 0730, the refueller drove the pilot to the nearby Carrapateena Airport.

At 0842 the pilot took-off from Carrapateena Airport. After about two minutes of flight, the pilot returned the aircraft to the airport due to what was later described as a warning light in the cockpit. After about seven minutes on the ground, the pilot took-off again and flew to pole 179 (the last pole of the stage) for a radio check with the stringing team ground-crew. The pilot then flew the length of the stage to the start point (pole 159) for a fly-by inspection of the job site. The pilot then flew to the refuelling point, nick-named the ‘Turkey’s nest’, landing at about 0858 (Figure 2). Here the pilot rendezvoused with the refueler and the stringing team for the last pre-start briefing for those workers directly involved with the helicopter operations.

During this meeting the pilot briefed one of the ground crew, supplied by the powerline company, on how to hook-up the draw wire to the helicopter as they had not performed this task previously. The aircraft was also refuelled. Afterward, the stringing team proceeded to their assigned work positions and at about 1000 the pilot took off and proceeded to pole 159 to commence stringing operations.

Figure 2: ADS-B^[3] derived flight data for VH-SZS on 20 March 2019.

Figure 2 Shows the ADS-B flight data for VH-SZS on the day of the accident.

Source: FlightRadar24 and Google Earth, annotated by ATSB.

In preparation for helicopter stringing operations, the draw wire had previously been strung to a pulley on pole 159 using an elevated work platform. Just after 1000, when SZS reached pole 159, ground crew attached the draw wire to a remote hook fitted to the helicopter at the end of a 30 ft longline. SZS then pulled the draw wire out from a Tesmec S.p.A.^[4] (Tesmec) stringing machine and proceeded to pole 160 to clip the draw wire into the pulley. Stringing operations continued normally for poles 161, 162 and 163.

While approaching pole 164 at about 1017, witnesses reported seeing the helicopter collide with the pole and impact terrain near the base of the pole. Several ground crew from the stringing team that were near the helicopter came to assist. They extinguished a small post-impact fire and removed the pilot from the aircraft to a safe distance. A short time later emergency services and paramedics from the mine site attended the scene and confirmed that the pilot, who was the sole occupant, had received fatal injuries.

________

1. The draw wire is thinner (13 mm) and lighter (0.55 kg/m) than the conductor wire (31.5 mm, 1.96 kg/m). After the helicopter strings the draw wire, a ground-based winch is used to pull the conductor wire through.
2. Central Daylight‑saving Time (CDT): Coordinated Universal Time (UTC) +10.5 hours.
3. ADS-B: Automatic Dependent Surveillance–Broadcast is a surveillance technology in which an aircraft determines its position via satellite navigation and periodically broadcasts it, enabling it to be tracked.
4. Tesmec S.p.A. are an Italian manufacturer of stringing machines. In this case, a diesel-powered hydraulic winch/brake, provides tension while the helicopter is drawing wire out and then acts as a winch to pull the final conductor wire back though.

Context

Pilot information

General information

The pilot held commercial pilot licences for both aeroplanes and helicopters, issued on 17 November 2000 and 20 November 2009 respectively. The pilot was rated for both single‑ and multi-engine fixed wing aircraft, as well as single‑engine helicopters. Design feature endorsements that the pilot held included manual propeller pitch control, tail wheel, gas turbine and retractable undercarriage endorsements. Additionally, the pilot had a low-level endorsement for helicopter sling operations issued on 17 November 2009 and an aeroplane aerobatic endorsement, issued on 8 January 1998. The pilot was also a licenced aircraft maintenance engineer.

A review of the pilot’s Air Maestro^[5] logbook showed that at the time of the accident the pilot had accumulated a total flying experience of approximately 6,370 hours. About 45 of those hours were in the previous 30 days and about 77 hours were in the last 3 months. Most the pilot’s flying experience (5,280 hours) was in helicopters, and the majority of that (4,537 hours) was in the MD500, a single‑engine light utility helicopter. The pilot had 240 hours on the AS350, the same type flown on the day of the accident, with about 49 hours in the last 3 months on that type. The pilot’s licence book indicated that the pilot had last completed a single-engine helicopter flight review on 24 Jan 2019 that was valid for 12 months.

Powerline stringing training

The pilot, who was the deputy chief pilot (DCP) for Aeropower Pty. Ltd., had been with the company since the late 1990s. In that time, the pilot had accrued about 2,400 hours in powerline operations. This included about 1,343 hours in powerline patrol and inspection, 643 hours insulator washing and nearly 400 hours in platform work.

The DCP had observed powerline stringing operations in December 2018, on a job in Wollongong, New South Wales. However, all the DCPs formal powerline stringing training was conducted during the three days of the first tour at Carrapateena.

The training involved the:

• DCP observing the chief pilot (CP) from the ground
• DCP observing in the aircraft
• CP observing the DCP while flying dual
• DCP stringing solo with the CP observing from the ground.

The DCP was deemed satisfactory in all requirements and on 7 February 2019 the CP signed-off the DCP for powerline stringing operations. The training comprised a total 7.2 hours with 1.4 hours of those with the DCP in command. At the time of the accident the pilot had a total of 25 hours experience in powerline stringing.

Medical information

The pilot held a Class 1 Aviation Medical Certificate that was valid until 2 Oct 2019 with no restrictions. The pilot was reported to be very fit and active and displayed normal behaviour on the morning of the flight and was well-rested. He was not reported to be taking any prescription medications and had no reported medical condition that could have affected his ability to operate an aircraft that day.

A post-mortem examination identified no significant background natural disease, which could have contributed to the accident. Toxicological analysis concluded that the toxicology was also non‑contributory to either the accident or cause of death.

Aircraft information

Overview

VH-SZS (SZS) (Figure 3) was an Airbus Helicopters^[6] AS350B3e Écureuil (Squirrel) light utility helicopter manufactured in 2012. The aircraft was a single-engine helicopter with six seats in the basic configuration. The primary structure of the aircraft was constructed of sheet metal, while the canopy, underside access cowling, transmission and engine cowlings were made of composite materials. The cabin area was accessible through four doors, two hinged pilot doors and two sliding rear doors.

Figure 3: Image showing VH-SZS

Figure 3 shows VH-SZS, a single turboshaft‑powered Airbus Helicopters AS350B3e Squirrel.

Source: Supplied

Engine and rotors

The main rotor system comprised of three composite main rotor blades constructed of a fiberglass spar with a composite skin over a foam core. The blades were attached to a composite semi-rigid, bearingless starflex hub. The two-blade tail rotor was also manufactured of composite materials moulded onto a fibreglass spar. The tail rotor was mounted to a lightweight sheet metal tail boom. All flight controls were hydraulically boosted, with hydraulic power supplied by a single hydraulic pump which was belt driven by the engine-to-transmission driveshaft. SZS was powered by a Turbomeca Arriel 2D engine, which was a free turbine^[7] turboshaft engine. The engine was controlled by a dual-channel, full authority digital engine control (FADEC) system.

Engine Data recorder

The aircraft was fitted with a Sensorex Engine Data Recorder (EDR). The EDR was a light recorder that exclusively records data sent by the FADEC system for maintenance purposes. For both FADEC channels, engine parameters and failure flags were recorded. Engine parameters were recorded continuously at a sample rate of 1 second and at a sample rate of 20 ms for a limited duration when a failure occurs.

Maintenance

The helicopter was built in 2012 and operated in New Zealand before being imported to Australia in 2016. A Certificate of Airworthiness inspection was completed 11 March 2016, and the certificate of registration was transferred to the current owner on 13 December 2018. SZS had a current maintenance release, issued on 19 October 2018 which was valid for a period of 150 hours or 12 months, whichever was sooner. At the time of the accident the aircraft had accrued 100.4 hours since the maintenance release. The maintenance release was not in the helicopter, as required, it was located in the pilot’s belongings in the accommodation area.

The helicopter was maintained in accordance with the manufacturer’s documentation. At the time of the accident, there were no known maintenance deficiencies with the helicopter.

Aircraft weight and Balance

A weight and balance was performed on 16 January 2019 with an expiry date of 15 January 2022. Additionally, weight and balance calculations indicated that the aircraft was below maximum take‑off weight and within the centre of gravity limits for the duration of the flight

Mack Pull

To facilitate stringing operations, the helicopter was fitted with a Mack Innovations (Australia) Pty Ltd (Mack Pull) bidirectional line stringing system. The Mack Pull provides a hard point located under the belly and to the side of the aircraft that is designed to carry a standard cargo hook. It assists with aerial work applications that require sideways flight and was specifically designed for power cable stringing work as it helps to keep the cable within the pilots’ field of vision.

A 30 ft longline was attached to the cargo hook on the Mack Pull and a Mechanical Specialties 301 remote hook was attached to the other end of the 30 ft longline. A cockpit mounted load meter gave a visual indication to the pilot of the load placed on the system. The load rating on both the remote hook and the 30 ft longline was 3,000 lbs (1,360 kg).

Flight recorders

The aircraft was not fitted with a flight data recorder or a cockpit voice recorder, nor was either required by regulations.

Meteorological information

Graphical Area Forecasts (GAF)^[8] for the area of operations, as well as aerodrome forecasts (TAF), meteorological aerodrome report (METAR)^[9] and Automatic Weather Station (AWS) reports from Woomera Airfield were obtained from the Bureau of Meteorology. The forecasts (GAF and TAF) predicted no significant weather in the area of operations for the duration of the accident flight.

The METARs for Woomera Airfield (about 60 km west of the accident site) at 0930 indicated that the surface wind was 160° (True) at 9 kt. At 1000 the wind was 170° at 10 kt and at 1030 the wind was 160° at 9 kt. For all times the QNH^[10] was 1015 hPa and the conditions were CAVOK.^[11]

At the time of the accident the Woomera AWS recorded the temperature at 24.4 °C, 8 knots of wind (with maximum gusts of 10 kt) from 166°, and a QNH of 1015.8.

Weather data measured at the Carrapateena mine showed that at 1010 (about 7 minutes before the accident) the temperature was 27.5 °C and the wind was 1.7 kt from 128°. There were no significant changes in those conditions on the morning leading up to the accident.

On-site observations

Observations of the conditions on the day were consistent with the meteorological reports. It was reported that during the last pre-flight briefing the pilot commented that the conditions were good for flying. Other witnesses described the conditions as sunny and a little bit windy. Several witnesses noted both the strength and position of the sun, which was reported to be in the direction that the aircraft was travelling. Geoscience Australia data showed that at the time of the accident the azimuth^[12] of the sun was 65° and its altitude was 35°. The bearing from pole 163 to pole 164 was 49°.

Additionally, the presence of a large amount of dust in the vicinity of the aircraft was noted by several witnesses. This can be seen in Figure 4, which shows a sequence of images of the aircraft traversing from pole 163 to pole 164.

Figure 4: VH-SZS traversing between pole 163 and 164.

Figure 4 shows VH-SZS traversing between pole 163 and 164. Pole 163 is visible in the image, while pole 164 is out of the frame to the right. The direction of travel is from left to right in this image.

Source: Witness

Wreckage and accident site information

Accident site

The accident site was located about 60 km east of Woomera South Australia, on the OZ Minerals Carrapateena mine site (Figure 1). The mine is located on Pernatty Station, a 2,147 km² livestock station about 136 km north of Port Augusta. The start of the stringing stage (pole 159) was about 5 km south-west of Carrapateena Airport and the aircraft had traversed about 1 km to pole 164.

Wreckage examination

Site and wreckage examination did not identify any aircraft defects or anomalies that might have contributed to the accident. Markings on pole 164 (Figure 5) indicated that the helicopter collided with the pole about 17 m above the ground. The main rotor blade (MRB) contacted the pulley mounted on the insulator, the ladder and pole during the accident sequence. The pulley fractured from its mounting bracket and came to rest on the access road, 15 m from the pole. The ladder was struck and bent toward the direction of the pulley, consistent with the direction of rotation of the MRBs. The pole had a number of MRB strikes, which progressed in a downward direction as the helicopter descended (inset in Figure 5).

Figure 5: Impact marks and damage to pole 164.

Source: ATSB

After impacting the pole, the helicopter came to rest on its right side approximately 2 m from the base of the pole (Figure 6). The aircraft had rotated approximately 90° to the left of its direction of travel.

Figure 6: The accident site near pole 164. The direction of travel of the helicopter was from pole 163 to pole 164.

Source: ATSB

The cockpit and fuselage roof were substantially disrupted from impact forces. The tail boom had almost entirely detached at the fuselage junction and fractured forward of the horizontal stabiliser, due to ground impact. Two of the MRBs had separated from the rotor head and came to rest side‑by‑side next to the fuselage. The third blade remained attached and had become entangled around the main rotor gearbox.

The longline, which had separated from the Mack Pull, was found a short distance away toward Pole 163. The draw wire was also found to have separated from the remote hook on the longline. The ATSB recovered a number of components from the accident site for further examination.

Engine

The engine assembly was examined and found to be complete with no evidence of pre-accident defects. All engine plumbing and wiring looms were connected to their respective components. The chip detector and magnetic plugs were examined and found to be clear of particles. The engine fuel and oil filters were examined and found to be clear of contaminants.

Recorded engine data

The engine data recorder (EDR) was shipped to France and downloaded by the of Bureau d’Enquêtes et d’Analyses (BEA). The BEA analysed the data in consultation with the aircraft manufacturer (Airbus Helicopters) and the engine manufacturer (Safran Helicopters Engines). The analysis showed that the engine was performing in a satisfactory manner until contact with the pole, when the EDR recorded a torque overlimit. The BEA report concluded that;

No anomaly was found prior the impact with the ground/pylon.

Fuel

SZS was fully fuelled on the morning of the flight from an intermediate bulk container (IBC), which was owned and maintained by the operator. The amount of Jet A1 taken aboard was 315 litres, which was sufficient to carry out the planned work for that morning.

A fuel sample was taken from the aircraft post-accident and from the IBC. Both series of testing indicated that the fuel was clean and clear of any contaminants.

Instruments and Avionics

The instrument panel fitted to SZS was the basic panel with added turn and slip and glideslope indicators. An air conditioning control panel and hour meter was also installed.

Emergency Locator Transmitter (ELT)

SZS was fitted with a KANNARD 406 AF-H ELT. The ELT, with part number S1822502-02 and serial number LX1100019317, had an expiry date of November 2024. The ELT activated automatically during the accident sequence and was deactivated by an attending police officer.

Flight controls

All flight controls were examined, and control continuity was established for both main and tail rotor systems. A number of control tubes displayed bending damage due to contacting the surrounding structure during the accident sequence.

Mack Pull and longline

An examination of the Mack Pull and cargo hook did not reveal any defects. Company standard practice was to install the longline with a shackle at both ends however, the draw wire did not have a shackle fitted for the connection to the remote hook. The upper end connected to the helicopter hook did have the shackle installed as required.

The remote hook and longline detached from the aircraft cargo hook during the accident and were located a short distance from SZS, drawn backwards by the retracting load of the draw wire. It could not be determined how it unhooked from the Mack Pull cargo hook. After detaching from the Mack Pull, the remote hook struck a large rock, indicated by orange paint transfer from the hooks’ outer cage. The hook then bounced to another location, shown by a ground scar. The draw wire was found detached from the remote hook. On-site testing indicated it was likely the uncoupling of the draw wire occurred during the impact with the rock.

Post impact fire

A small post impact fire occurred at the engine exhaust. Responders used hand-held fire extinguishers to prevent the spread of fire to the airframe. The resulting damage was minimal and did not show evidence of a fire outside of the engine exhaust.

Additional information

Operational information

The pilot, who was the deputy chief pilot (DCP) for Aeropower and the chief pilot (CP) mobilised to Adelaide on 31 January 2019 in preparation for operations at Carrapateena. The intention was that the CP would use this job as an opportunity to train the DCP in powerline stringing operations, then once signed-off, the DCP would complete the rest of the job solo. On 3 February both pilots mobilised to Port August and arrived at Carrapateena on 4 February for an all-stakeholder briefing for the stringing operation. The key stakeholders present were:

• OZ Minerals – the mine site operator
• Ventia – Principal contractor
• ElectraNet – Contracted to build, own, operate and maintain the powerline infrastructure
• Powerlines Plus (PLP) – sub-contracted by Ventia to build the powerline
• Aeropower – contracted by PLP for the helicopter stringing operations.

Later that day the Aeropower pilots were audited by an independent safety auditor contracted by ElectraNet to assess their capability to safely undertake the job. At this point Aeropower were already contracted to do the work. The next day, 5 February, flying operations began.

Summary of stringing operations

Tour 1 of the helicopter powerline stringing operations started on 5 February and continued until 7 February. During these 3 days, stages 5 and 6 were completed. Stage 5 comprised 22 poles while stage 6 comprised 21 poles. Each stage was completed thrice, once for each of the three wires suspended by the poles. At the end of tour 1, on 7 February, the DCP was signed-off on powerline stringing and the CP departed the site.

Stringing for tour 2 started on 18 February and was conducted by the DCP solo, without the CP on-site. Stage 7 (15 poles), was completed on 18 February and stage 8 was completed on 19 February (19 poles). Again, all stages were conducted three times.

Tour 3 stringing operations commenced on 10 March with the 20 poles of stage 4. This was followed the next day with stage 9 (21 poles). Again, all stages were completed three times by the DCP flying solo. Tour 4 started 9 days later, on 20 March. Including the 4 poles strung on the morning of the accident, the pilot had strung 122 poles, all but the last 4 were strung 3 times.

Accident span gradient

The span width between poles 163 and 164 (the accident span) was 174 m, one of the shortest the pilot had undertaken at Carrapateena. Indeed, of the 122 spans that the pilot had strung at Carrapateena, only 4 were shorter than the accident span. In addition, the elevation gain between pole 163 and 164 was 12.86 m. This was the largest elevation gain of any span the pilot had undertaken at Carrapateena. As a result of the span length and elevation gain, the accident span between pole 163 and 164 had the greatest gradient of any span the pilot had conducted at Carrapateena.

Use of load rings

In response to an ATSB investigation (ATSB report 200300011), the Civil Aviation Safety Authority (CASA) airworthiness bulletin AWB 25-006 was issued (and has since been revised). The bulletin applies to all rotorcraft engaged in underslung load / non-human external cargo. It highlights the importance of using a primary load ring and shackle on cargo hooks to prevent both an inadvertent release or a jammed hook.

The Aeropower operations manual was consistent with this regulatory guidance, with sections 9.1.3 and 9.1.4 stating;

9.1.3. DO NOT put a rope of any kind directly onto the cargo hook. It can twist and hang up preventing release if required.

9.1.4. DO use a shackle or primary load ring to attach directly to the hook to ensure smooth release. Make sure it is large enough to fall free without becoming trapped by the dropping tongue of the hook.

On the day of the accident a Powerlines Plus ground staff was assigned to hook up the draw wire to the helicopter. As they had not performed the task before, during the pre-flight briefing, the pilot instructed the ground staff on the procedure. It was reported that the use of a load ring or shackle was not mentioned, and that the instruction given was to connect the draw wire directly to the remote hook. Other ground staff reported never seeing a load ring or shackle between the draw wire and the remote hook at any time during the Carrapateena operations.

Power line stringing methodology

The purpose of powerline stringing is to attach electrical conductor wire to pulleys that are suspended on towers (or poles). Light-weight conductor wire on smaller poles can be strung using an elevated work platform (‘cherry-picker’) and pulled through with a small winch. While heavier gauge wires, such as that used at Carrapateena, necessitates the use of heavy machinery to pull the conductor between towers. Helicopters can also be used for powerline stringing. The advantage of using helicopters are;

• Much faster than pulling a conductor wire with a bulldozer.
• Minimised disruption to ecologically or culturally sensitive land (the Carrapateena site had cultural sensitivities).
• The ability to traverse rugged terrain that would be inaccessible to ground-based heavy machinery.

One of the limitations of using a helicopter is the weight carrying capacity of the aircraft. For jobs that require a heavy conductor wire, a lighter weight draw wire is strung by the helicopter. Then, a fixed position ground-based winch uses the draw wire to pull the heavier conductor wire back through the pulleys.

Taught methodology

Between 5 and 7 February 2019, the DCP received instruction in helicopter powerline stringing methodology. The stringing method taught by the CP had several key features, these included:

• A straight-line flight path is maintained between each pole.
• The helicopter hovers and traverses at an angle of about 90° (sideways) to the path of the wire. This ensures that visibility of both poles in maintained. The strung pole should be visible through the right cockpit door/window and the target pole should be visible through either the left cockpit door/window or the open rear left door (Figure 7).

Figure 7: Orientation of helicopter relative to path of travel during stringing operations.

 Source: Aeropower work instruction AS350 – Mack Pull

• After clipping in the draw wire to the pulley, height is maintained for a short distance to ensure there is enough weight in the line to hold it down on the pulley.
• As the helicopter traverses to the next pole, altitude is gained to a height greater than that of the next pole.
• The helicopter traverses directly over the top of the target pole. Visibility of the pole is maintained by use of aircraft mounted mirrors.
• Once clear on the other side of the pole, the helicopter descends to the height of the target pulley to clip the wire in.
• The process continues until the stage is complete.

Observed methodology

The DCP was deemed competent in the stringing method and signed-off by the CP at the end of tour 1 on 7 February 2019. All subsequent stringing operations were conducted by the DCP solo.

Nothing unusual or untoward was observed regarding the stringing methodology during the two days of flight operations of the second tour. However, the Aeropower refueller, who was experienced in stringing operations, never observed the stringing operations due to the location of the refuelling site. During the third tour a different Aeropower refueller was on-site and took photographs and video of the stringing operations. Some of the key points observed were;

• After clipping in the draw wire to the pulley the helicopter traversed out to the side (left side relative to direction of travel) en-route to the target pole.
• The aircraft did not gain altitude while traversing in-between poles.
• The helicopter pulled the draw wire in a pronounced tail-back attitude, with respect to the direction of the pull (Figure 4).
• Rather than traversing directly over the target pole, the helicopter came back in from the left side and came over and around the pole.

This modified technique continued into tour 4 and was observed by a number of witnesses on the day of the accident. Witnesses stated that the helicopter never came above the height of pole 164 before colliding with it.

ADS-B data (Figure 8) from the day of the accident shows a flight path consistent with what was described by witnesses. The data shows that the aircraft maintained a low altitude between poles. Only once in close proximity to the next pole did the aircraft rise above the height of the pole. The data also shows the aircraft tracking to the left of the direct path and traversing around the pole rather than directly over it.

Figure 8: ADS-B data of the flight path from pole 159 to 164

Source: FlightRadar24 and Google Earth, annotated by ATSB.

Regulatory oversight

Other than the low level and sling operations endorsements, there are no other specific Civil Aviation Safety Authority (CASA) requirements for undertaking powerline stringing operations. Additionally, there are no recommendations or requirements from CASA regarding the training requirements for operators training pilots in powerline stringing. Nor are there any requirements for any supervision post-training. It is up to the individual operators to provide what they determine to be an appropriate syllabus of training and supervision.

The pilot was provided the training required by Aeropower procedures and satisfied all CASA and Aeropower requirements to conduct powerline stringing. Although there was no requirement in Aeropower procedures for post-training supervision, the CP did try to provide indirect supervision after they had left Carrapateena. The CP stated they were in regular contact with the DCP during tours 2 and 3 to check up on how the DCP was going. It was reported that the DCP did not raise any concerns regarding the job or the stringing methodology.

Related occurrences

A review of the ATSB’s national aviation occurrence database revealed only one other occurrence reported to the ATSB in the 20 years between 2000 and 2019 involving helicopter powerline stringing operations. That accident, also involving an Aeropower aircraft, was investigated by the ATSB (Investigation report AO-2008-025). A summary is below.

On 9 April 2008, the crew of a McDonnell Douglas Helicopter Company MD369ER helicopter registered VH-PLU, experienced a substantial loss of engine power while conducting low-level powerline stringing operations. The helicopter impacted the ground and was seriously damaged. The two occupants were seriously injured.

The investigation determined that the pilot in command was operating the helicopter with a fuel tank quantity that did not guarantee continuous operation of the engine at the flight attitudes experienced during the powerline stringing operation.

As a result of the accident, the operator revised its fuel management procedures for powerline stringing operations.

In the same 20-year period Aeropower was involved in the following five accidents that were investigated by the ATSB (this includes AO-2008-025, previously mentioned):

• 200505332: Loss of tail rotor authority – 9 km north of Warwick Queensland, VH-SUV
• AO-2008-025: (Summarised above) Fuel-related event 16 km south-east of Townsville Airport, Queensland 9 April 2008
• AO-2008-078: Wirestrike - McDonnell Douglas 369D, VH-PLJ, 13 km north of Murray Bridge, South Australia, 19 November 2008
• AO-2012-082: Collision with terrain - Schweizer 269C-1 helicopter, VH-LTO, Redcliffe Aerodrome, Queensland, 18 June12
• AO-2016-078: Fuel exhaustion and collision with terrain involving McDonnell Douglas Corporation 369, VH-PLY, 36 km north‑west of Hawker, South Australia, on 17 July 2016

Of note, the wirestrike fatal accident in 2008 (AO-2008-078) involved a pilot that was recently instructed in a new task (platform work – joint-testing). The accident occurred the day after training had completed on the pilot’s first unsupervised joint-testing job. Although experienced, with 3,744.2 total flight hours, at the time of the accident the pilot had a total of about 27 hours on platform work.

The report stated:

Had the chief pilot been able to supervise the task on the day of the occurrence as planned, it was possible that he may have detected one or more of the earlier mid-span transpositions and alerted the crew to the hazard. That would probably have forewarned the crew to anticipate other mid-span transpositions along the line, and increased the likelihood that they would detect the transposition between towers STR0031 and STR0032.

One of the safety factors identified by the investigation was;

There was no direct supervision of the joint-testing operations [Minor Safety issue].

_______

5. Air Maestro is a cloud-based Pilot Management Software which includes an electronic pilot’s logbook.
6. Since the helicopter was manufactured, the type certificate of the helicopter was changed from Eurocopter to Airbus Helicopters.
7. A free-turbine turboshaft is a form of turboshaft or turboprop gas turbine engine where the power is extracted from the exhaust stream of a gas turbine by an independent turbine, downstream of the gas turbine and is not connected to the gas turbine.
8. Bureau of Meteorology.">Following requests from the aviation industry, the Bureau of Meteorology changed the format of Area Forecasts (ARFORs) from text based to graphical on 9 November 2017. The new format is known as a Graphical Area Forecast (GAF). More information regarding GAFs is available from the Bureau of Meteorology.
9. A METAR is a routine report of meteorological conditions at an aerodrome.
10. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean seal level.
11. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather.
12. Bearing of celestial body measured clockwise from true north.

Safety analysis

Introduction

While stringing powerlines to the Carrapateena mine about 60km east of Woomera Airfield, South Australia, Airbus Helicopters AS350B3e Écureuil (Squirrel) registered VH-SZS, pulled draw wire towards pole 164. Witnesses observed the aircraft traverse slowly up the gradient of rising terrain towards the pole in a near backwards attitude toward the morning sun and in the presence of substantial dust. As the aircraft approached the pole it was observed to continue to fly in a controlled manner until it collided with the pole and fell to the ground.

Site and wreckage examination did not identify any aircraft defects or anomalies that might have contributed to the accident. The recorded engine data also showed no anomalies with the engine prior the impact with the pole. Additionally, no evidence was found to suggest any medical, fatigue related or physiological issues that would have affected the pilot’s performance on the day of the flight. Therefore, this analysis will focus on the operational and environmental factors that led to an experienced helicopter pilot inadvertently colliding with a known obstacle.

Development of the accident

Altered methodology

The pilot received 7.2 hours of training in helicopter powerline stringing in the 3 days of the first tour between 5 February and 7 February 2019. By the third tour (March 10-11) video and photographs taken of the stringing operations showed that the pilot had altered the methodology from that which was taught. Witnesses on the day of the accident also described the same modified method being used. The new method placed the helicopter at a lower operating height above the ground, in a tail-rear attitude, while tracking out to one side before climbing around the pole.

It is not known when exactly the pilot began altering the stringing method, only that it was in use during the third tour and on the accident day. It is therefore likely that the pilot had successfully strung dozens of poles using the new method before the accident, possibly re-enforcing the validity of the method to the pilot.

Span length

By 20 March, the pilot had strung 122 poles (almost all of which were strung 3 times). The length of these spans varied from 156 m to 351 m. The vast majority (85 per cent) of the spans were between 200‑300 m in length, with the average being about 250 m. The accident span was
174 m, one of the shortest of the 122 the pilot had done. Only 4 spans were shorter, and they were all strung on March 10, 10 days prior to the accident. Additionally, the span immediately prior to the accident was 253 m. The accident span was nearly 80 m shorter than the average span, and 79 m shorter than the penultimate span. Based on the pilot’s previous experience, it is possible the pilot’s expectation was that pole 164 was still some distance away at the time on the collision. Compounding this risk was the gradient of the accident span. With an elevation gain of 12.86 m, the span between poles 163 and 164 had the greatest gradient of any the pilot had flown at Carrapateena.

Visibility of pole 164

A feature of the taught stringing method was that both the recently strung pole and the next target pole are both visible at all times. Maintaining a straight-line path between the poles with the aircraft at 90° (sideways) to the relative track ensures visibility of both poles is maintained. The method also places the aircraft at an altitude higher than the target pole, therefore safeguarding against collision. The pilot’s altered methodology placed the helicopter both at lower altitude and in a pronounced tail-rear attitude.

The low altitude exacerbated the amount of dust in the air around the helicopter. Witnesses described a plume of dust higher than the nearby poles. Although the perspective of observers on the ground may not accurately represent that of the pilot, it is clear from observations and photographs taken on the day (Figure 4), that there was significant dust in the vicinity of the helicopter as it approached pole 164.

Analysis of the sun position and observations made on site indicated that the sun would have been in the general direction of the pilot’s vision of pole 164. Although the pilot was wearing a helmet mounted visor at the time of the accident, sun glare, particularly in combination with dust, may have reduced visibility of the pole.

Additionally, several witnesses, as well as photographs, show that the helicopter was being flown in a near backwards attitude as it traversed towards pole 164. Although it is difficult to determine the exact proportional effect of each element in isolation, it is likely that in combination, the near backwards attitude of the aircraft, significant dust and the position of the sun would have led to a reduction of the pilot’s visibility of pole 164 and the ground. In the absence of visual cues of the pole it is likely that the pilot’s situational awareness of pole 164 was degraded leading to the pilot inadvertently colliding with it.

Supervision

The operator did not have any documented requirements for supervision after the pilot was signed-off for powerline stringing, nor were they required to by regulations. Despite this, after the chief pilot left Carrapateena on 7 February 2019, they were in contact with the deputy chief pilot by telephone several times to check-in and see how the job, and the pilot, were going. Unfortunately, this indirect supervision relied either on the pilot being aware there was a problem with their methodology, or the pilot disclosing that they had intentionally altered the methodology.

The investigation could not determine why the pilot modified the stringing methodology. It is possible it was a result of an unperceived degradation of a newly taught skill, or the intentional modification of the technique. In either case, it is highly likely that ongoing supervision by an experienced powerline stringing operator would have identified the modified methodology and the associated risks.

Findings

From the evidence available, the following findings are made with respect to the Collision with terrain involving Airbus Helicopters AS350B3e, VH-SZS 60 km east of Woomera Airfield, South Australia, on 20 March 2019.

Contributing factors

• The pilot was using a stringing technique that was different to that instructed by the chief pilot. The modified method resulted in the aircraft operating at a lower height above the ground, which led to the pilot colliding with pole 164.
• Due to a combination of the attitude of the aircraft, dust and the position of the sun, it is likely that the pilot lost situational awareness of pole 164, leading to the collision with it.

Other factors that increased risk

• There were no requirements in Aeropower procedures to provide any post-training supervision for powerline operations. What supervision was provided was ineffective in identifying that a modified stringing method was being used by the pilot. [Safety issue]

Safety issues and actions

Safety issue: Aeropower post-training supervision

Safety issue number: AO-2019-015-SI-01

Safety issue description: There were no requirements in Aeropower procedures to provide any post-training supervision for powerline operations. What supervision was provided was ineffective in identifying that a modified stringing method was being used by the pilot.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Aeropower Pty. Ltd.
• OZ Minerals
• ElectraNet
• Civil Aviation Safety Authority
• South Australian Police Service
• Bureau of Meteorology.
• Airservices Australia
• accident witnesses
• video footage and photographs of the accident flight and other photographs and videos taken on the day of the accident and prior to the accident.
• recorded data from the Engine Data Recorder unit on the aircraft.

References

Aeropower work instruction AP-WI 2653 – Cable Stringing – AS350 – Mack Pull

Aeropower operations manual AP-OM 0610 – Powerline stringing (Electrical pylon cable laying)

ATSB investigation report (200300011)

Civil Aviation Safety Authority (CASA) airworthiness bulletin AWB 25-006

ATSB research publication AR-2012-035

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Civil Aviation Safety Authority
• Aeropower Pty. Ltd.
• The chief pilot
• OZ Minerals
• Ventia
• Powerlines Plus
• ElectraNet
• BEA

Submissions were received from the Civil Aviation Safety Authority, Aeropower, the chief pilot and OZ Minerals. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 23 October 2018 a Cessna U206G registered YJ-AL5, was being operated on a charter flight from Tanna Island to Port Vila, Vanuatu, with one pilot and four passengers onboard. While abeam Erromango Island, in cruise at 6,500 ft, the engine failed.

Following unsuccessful attempts to restart the engine, the pilot diverted to Dillon's Bay Airport, on Erromango Island, where the aircraft landed short into trees. The Civil Aviation Authority Vanuatu (CAAV) is conducting an investigation into this occurrence.

As part of its investigation, the CAAV requested technical assistance from the ATSB. The ATSB was asked to oversee the engine examination from the accident aircraft.

To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003. That work is now complete.

The CAAV is responsible for and will administer the release of the final investigation report into this accident.

Safety summary

What happened

On 13 March 2019, a Robinson R44 helicopter, registered VH-ZWK and operated by Helifarm, was conducting aerial spraying operations at Bool Lagoon, around 20 km south of Naracoorte, South Australia.

While spraying along a drainage channel, the helicopter pilot momentarily forgot about the location of a powerline spanning the channel, as he manoeuvred the helicopter over a bridge. The helicopter collided with the powerline, then crashed into the ground. The helicopter was destroyed, and the pilot sustained minor injuries.

What the ATSB found

The helicopter pilot momentarily lost awareness of the powerline as he manoeuvred over the bridge. Nearby vegetation, which reduced the pilot’s ability to see the power poles and visually identify the powerline, probably reduced the pilot’s ability to maintain this awareness. The operator had a number of policies and procedures to support pilots’ powerline awareness, and it may not be possible to completely mitigate the risk of wirestrike during repeated low-level flying near powerlines.

As a result of this momentary loss of awareness, the helicopter collided with the powerline, which led to a collision with terrain. The bladder-type fuel tank installed in the accident helicopter, as compared to an all-aluminium fuel tank, probably reduced the risk of a post-accident fire.

What's been done as a result

The operator has implemented new policies and procedures to increase pilots’ awareness of powerlines during spraying operations, particularly spraying of drains. These include improved maps and other planning documents for drain spraying operations involving flying near powerlines, and increased training of helicopter pilots engaged in these operations.

Safety message

This accident provides another reminder of the dangers posed by powerlines during low-level spraying operations.

The ATSB has released, in association with the Aerial Application Association of Australia (AAAA), an educational booklet, Wirestrikes involving known wires: A manageable aerial agriculture hazard (AR-2011-028). This booklet contains numerous wirestrike accidents and lessons learned from them. The AAAA has now launched its Powerline Safety Program that aims to encourage and facilitate power companies to improve aviation safety. The program includes marking of powerlines by powerline network operators (with a marker in accordance with Australian Standard AS 3891-2) wherever it is requested by a pilot, aviation company or landholder.

As this accident highlights, there may be limits to the extent to which operators can mitigate the risk of wirestrike during repeated low-level operations near powerlines. Helicopter wirestrike protection (WSPS) can provide a last line of defence in the event of a wirestrike. Some aircraft selected for aerial agriculture operations can be configured to include WSPS. However, this technology is not currently available on smaller helicopters such as the R44.

Pilots and operators involved in low-level spraying are also reminded that flight helmets can reduce the risk of serious injury in the event of an accident.

The occurrence

What happened

On 13 March 2019, a Robinson R44 helicopter, registered VH-ZWK and operated by Helifarm, was conducting aerial spraying operations at Bool Lagoon, around 20 km south of Naracoorte, South Australia. The operations involved spraying weeds in Bool Lagoon, then in the drain at the western edge of the lagoon. The pilot was the sole occupant of the helicopter.

At the start of the day, the pilot met with a representative of the client organisation, the operations manager of Helifarm, and the Helifarm ground crew who would be in charge of loading the helicopter with spray. Discussions included reviewing the planned spraying job, maps of the area, and a job safety analysis for the spraying work. The risk of colliding with powerlines was noted during the meeting.

Spraying operations involved loading the helicopter with spraying chemicals from a loader vehicle. The pilot would then conduct spray flights before returning and reloading.

After spraying the lagoon in the morning, the loader was relocated in preparation for the remaining work around the drain. The pilot flew towards the new loading point and, prior to landing, conducted a brief reconnaissance flight around the drain. During this flight, the pilot sighted several hazards, including a weir bridge and a single-wire powerline spanning the drain.

After landing at the new loading site, the pilot rested for around 15 minutes before resuming operations at around 1400 Central Daylight-saving Time (CDT). The pilot then conducted another reconnaissance flight and sprayed two loads of chemicals in the drain area. The pilot passed under the powerline on three occasions during the two spray flights.

The pilot commenced another spray flight at around 1430. The pilot started the spray run from a public road at the eastern end of the drain section, flying west towards the weir bridge and the powerline (Figure 1). The pilot recalled that, as he commenced this run, he reminded himself of the presence of the powerline further along the drain. The pilot turned on the spray nozzles, then looked at the nozzles and spray pressure gauge to confirm the spraying equipment was functioning as expected.

As ZWK flew along the drain, the pilot engaged in a visual scan both inside and outside of the helicopter. This included looking outside at where the helicopter was going, monitoring the track of the helicopter using a satellite track display, and monitoring the spraying equipment. This scan reflected the pilot’s normal practice and he had no particular concerns about the performance of the aircraft or the equipment.

When ZWK was around 50-100 m before the weir bridge, the pilot looked at the spray nozzles, as part of his scanning sequence. When the pilot looked up and outside the helicopter, he noticed that ZWK was slightly lower than intended, in terms of achieving adequate clearance over the bridge.

The pilot manoeuvred the helicopter in order to pass over the weir bridge. The control inputs caused the helicopter to ‘balloon’ over the bridge. The pilot reported that this manoeuvre meant the helicopter was higher than it would otherwise have been as it passed over the weir bridge. The pilot then applied control inputs to move the helicopter back down to the desired altitude. The pilot characterised these control inputs as ‘smooth’, noting that it was his preference and normal practice to not manoeuvre the aircraft aggressively unless necessary.

The pilot reported that it was his plan was to fly over the weir bridge and under the powerline. However, as he adjusted the flight path of ZWK over the bridge, he momentarily forgot about the powerline. The pilot noted that if he had been aware of the powerline at that moment, he would have descended more aggressively.

Figure 1: Accident location

The image shows the track of ZWK, the location of weir bridge, and the location of power infrastructure. 
Source: Google Earth, modified by ATSB

Shortly after passing the weir bridge, ZWK struck the powerline. The helicopter’s ground speed was around 60 kt at the time of impact.

The initial impact occurred around the centre of the front windscreen, just above the helicopter’s headlights. The powerline wire then cut into the helicopter, slowing its forward movement. The wire cut up into the helicopter cabin and the control instruments.

The pilot reported that that he retained some control of the aircraft following the impact, and was able to partially cushion the landing. However, the helicopter landed hard on the bank of the drain. The pilot exited the helicopter with minor injuries. There was no fire, but the helicopter was destroyed (Figure 2).

Figure 2: Helicopter wreckage

The image shows the helicopter wreckage, drainage channel and weir bridge. 
Source: SA police, modified by ATSB

Context

Pilot information

The pilot of ZWK was experienced in agricultural spraying operations at low levels, including using the R44. In the 90 days prior to the accident, the pilot had conducted around 150 hours flying, including 36 hours in an R44.

The pilot had conducted spraying operations in the area previously, including the drain where the accident occurred. The most recent time was around a year before the accident.

The pilot had all required approvals for conducting agricultural spraying operations. The pilot had conducted SpraySafe training, and had current accreditation issued by the Aerial Application Association of Australia.

The pilot did not wear a helmet during flying operations that day. The pilot reported he would typically wear a helmet. However, he was wearing a standalone headset due to problems with the headset in his helmet.

Powerline information

The powerline struck by ZWK was a single-wire earth return (SWER) line, which consisted of a single line of intertwined narrow-gauge steel wires. The powerline spanned 244 m, and the approximate point of contact was 60 m from the nearest power pole. At the approximate point of contact, the powerline was about 8.9 m high, above the edge of the drain bank. There were no markers or other devices installed on the powerline to enhance its visibility, nor was there any requirement to install such devices.

Location information

The drainage channel was about 30 m wide, with a further 10-15 m clear bank on each side before a tree-lined boundary. This tree-lined boundary obscured visibility of the power poles from within the drainage channel (Figure 3). It is likely that this reduced the ability of the pilot to use the power poles as visual cues for the position of the powerline.

The weather the time of the accident was clear, a temperature of about 20 °C, and a light breeze from the north-west. The pilot described the conditions as fine and said that wind had no effect on the handling of the helicopter.

Figure 3: Powerline and drain boundary

Shows powerline in profile view, and vegetation obscuring power pole beyond edge of the drain. 
Source: SA Power Networks. Annotated by ATSB

Helicopter information

The Robinson R44 helicopter is a single-engine, four-seat light helicopter produced by Robinson Helicopter Company.

For this accident, there was no evidence to suggest any defects or anomalies were contributory to the wirestrike.

Helicopter operators who routinely engage in low-level operations can have wirestrike protection systems (WSPS) installed on the helicopter. Helicopter WSPS commonly include cutting blades, which can provide a recovery defence when helicopters come into contact with wires. There was no WSPS installed on ZWK and no commonly available system available for the R44. The nature of these systems is such that their fitment on the outside of an aircraft is not typically possible for smaller helicopters, such as the R44.

R44 helicopters with all-aluminium fuel tanks are susceptible to post-accident fuel leaks increasing the risk of a potentially fatal post-impact fire following a collision with terrain. In 2012, the manufacturer issued a service bulletin requiring R44 helicopters with all-aluminium fuel tanks be retrofitted with bladder-type tanks as soon as practical. The ATSB issued a Safety Advisory Notice on 9 March 2012, advising of the potential dangers of the all-aluminium fuel tank. This followed from ATSB Safety Investigation Loss of control involving Robinson R44 helicopter (AO-2012-021).

ZWK had been fitted with a bladder-type fuel tank.

Helifarm risk management procedures

Helifarm utilised several procedures and other defences in order to manage the risks associated with low-level aerial application flying, particularly risks related to wirestrike. These included a requirement for:

• Pilots engaged in aerial application to have current ‘SpraySafe’ accreditation with the Aerial Application Association of Australia, as well as other licences, ratings and endorsements.
• Pilots to study maps and note the location of wires and other hazards.
• Pilots to conduct reconnaissance flights prior to commencement of operations and prior to any clean up runs.

Helifarm and the pilot associated with this accident had complied with these procedures.

Related occurrences

The ATSB has reviewed trends in wirestrike accidents in several research reports, including Under Reporting of Aviation Wirestrikes (AR-2011-004) and Wire-strike Accidents in General Aviation: Data Analysis 1994 to 2004 (B2005/0055). This research has shown that many wirestrike accidents involve aerial agriculture operations.

The ATSB has also released, in association with the Aerial Agriculture Association of Australia, an educational booklet, Wirestrikes involving known wires: A manageable aerial agriculture hazard (AR-2011-028). This booklet contains numerous wirestrike accidents and lessons learned from them.

Reduced visibility of powerlines due to nearby vegetation has been noted in other wirestrike accident investigations. An investigation of an accident involving a Bell 206B JetRanger found that power poles were obscured by nearby trees, reducing the ability of the pilot to identify the powerline.^[1] Similarly, an investigation of a wirestrike accident involving an Eagle DW1 found that a line of trees obscured vision of power poles.^[2]

__________

1. ATSB Safety Investigation Report AO-2016-027 Collision with terrain involving Bell 206B helicopter VH-WHU near Carmila, Qld. on 25 March 2016
2. ATSB Safety Investigation Report AO-2015-087 Wirestrike involving an Eagle DW1, VH-FHP, 77 km SE of Townsville, QLD on 27 July 2015

Safety analysis

Loss of awareness of powerlines

While the pilot knew about the location of the powerline spanning the drainage channel and had flown under it earlier that day, while manoeuvring over a bridge, he momentarily forgot and lost awareness of the powerline. As a result of this momentary loss of awareness, the pilot unintentionally flew the helicopter into the powerline, resulting in ZWK colliding with terrain.

Immediately before the wirestrike, the pilot’s attention was diverted towards flying and other equipment for the spraying activity. This was normal and required.

Native vegetation near the power poles obscured additional visual cues for the presence of the powerline. The powerline was narrow-gauge and had no markings. Due to the limits of the human eye, powerlines can be very difficult to see, particularly in low level flight.^[3]

Humans have a limited capacity for working memory. Situational requirements to attend and respond to immediate and/or unexpected demands can mean that awareness and memory of other hazards can be lost. Other ATSB published wirestrike occurrence briefs and investigation reports have shown how awareness of powerlines can slip when pilots respond to demands such as unexpected obstacles^[4] and checking a GPS display.^[5]

Flying at low altitudes, particularly around powerlines, means that pilots must contend with many demands on their attention. The nature of low-level operations also means that there are very low margins for recovery from even momentary losses of awareness.

For this accident, once the pilot lost awareness of the powerline as he manoeuvred the helicopter over a bridge, it was difficult for him to regain awareness visually, as there were limited prompts for the position of the powerline.

Defences against wirestrike accidents

The operator’s defences against wirestrike sought to reduce the likelihood of aircraft colliding with powerlines by supporting pilots’ awareness of powerlines. The nature of spraying around powerlines is such that demands on attention are high and the ability to recover from any lapse in awareness is relatively low. It may not be possible to completely mitigate the risk of collision in this context. However, there may be some control measures that might reduce the potential consequence.

WSPS can provide an effective last-line of defence in the event of a wirestrike accident,^[6] reducing the likelihood of a subsequent crash. However, these systems cannot typically be fitted to smaller helicopters, such as the R44. Helmets provide another valuable defence in the event of a crash, reducing the risk of more serious injury.^[7] The ATSB noted in this accident, that the pilot was not wearing a helmet.

R44 Bladder Tank

Although the helicopter in this accident collided with terrain and was destroyed, there was no post impact fire. The helicopter had been fitted with a bladder-type fuel tank, and there was no indication of a fuel leak. The bladder-type fuel tank probably reduced the likelihood of a fuel leak and post-impact fire following the collision.

__________

3. For analysis of the difficulty detecting powerlines in flight, see ATSB Safety Investigation Report AO-2014-068 Wirestrike involving Maule M-5, VH-HOG, 50 km WSW of Casino, NSW on 12 April 2014
4. ATSB Occurrence Brief AB-2018-041 Wirestrike involving Robinson R44, Whitton, NSW, on 24 March 2018
5. ATSB Safety Investigation Report AO-2015-087 Wirestrike involving an Eagle DW1, VH-FHP, 77 km SE of Townsville, QLD on 27 July 2015
6. For an example of the effectiveness of WSPS, see ATSB Occurrence Brief AB-2018-039 Wirestrike involving Bell Helicopter 206L, Pappinbarra, NSW, on 19 March 2018
7. For an example of the effectiveness of flight helmets, see ATSB Safety Investigation Report AO-2017-115 Collision with terrain involving PZL Warszawa-Okecie M-18A Dromader aircraft, VH-WHR, near Emerald Airport, Queensland, on 1 December 2017

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The helicopter pilot momentarily lost awareness of the position of an overhead powerline as he adjusted the track to navigate over a bridge during low-level aerial agriculture flying. It is likely that nearby vegetation contributed to the pilot’s reduced awareness of the powerline.
• The helicopter collided with the overhead powerline, which led to a collision with terrain.
• The installation of a bladder-type fuel tank in the R44 helicopter reduced the risk of a post-impact fire.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.

Safety action by Helifarm

Helifarm advised that as a result of this accident, they have implemented the following actions in order to reduce safety risk:

• Discussing the accident in team meetings, in order to increase focus on key hazards and risks.
• Providing pilots conducting future spraying operations at the Bool Lagoon with georeferenced maps of the area.
• Introducing additional company documentation for drain spraying to further document site-specific hazards prior to the start of each job.
• Making human factors training mandatory for pilots conducting aerial application. This training intends to increase pilot awareness in the wire and low-level environment.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Overview of the investigation

At 0504 Eastern Daylight-Saving Time on Friday 1 March 2019, Pacific National (PN) grain train 5KC3 passed signal 04 26 at stop at Wagga Wagga while on a journey from Ararat, Victoria to Cootamundra, New South Wales. The train continued its journey north, passed another two signals at stop and through a set of points in Wagga Wagga yard. The train was stopped after the Australian Rail Track Corporation (ARTC) Network Controller contacted the train crew by radio and informed them of the signals passed at danger events. The train crew consisted of two persons, driver 1 and driver 2.

Train 4BM9 had departed Bomen and was heading towards Wagga Wagga to cross train 5KC3 when train 5KC3 passed the signals at stop. Train 5KC3 passed the up direction starting signal for the Wagga Wagga to Bomen section and was heading into a potential collision with train 4BM9. The two trains were around 2.5 km apart by the time they were both brought to a stand.

The investigation found that the crew of train 5KC3 did not react to the signal indications within Wagga Wagga yard limits that were set, at first to restrictive indications, and then stop indications. These signals were set to cross train 4BM9 at Wagga Wagga. The reason for the crew of train 5KC3 not responding to the signal indications could not be conclusively determined.

The data logger of the leading locomotive of train 5KC3 indicated the driver was successfully responding to the demands of the vigilance control system.

There was no evidence either of the crew of 5KC3 were affected by any medical or other health episode. Neither of the crew members can recall their journey beyond the southern entrance to Wagga Wagga yard limits until the notification of the signal passed at danger (SPAD) events by the ARTC Network Controller. Both crew members commenced their shifts at about 2000 the previous evening and their recent shifts were not regarded as being outside the normal rostering parameters for the operator.

The reasons for the train crew not responding to the signals may have been determined if the driver’s cab was fitted with an inward-facing camera recording the actions of the train crew. The video may have shown what the train crew were doing leading up to the SPAD. The presence of a camera would not have prevented the SPAD but may have assisted in the post-incident analysis. An audio recording, synchronised with the camera, may have also provided additional information about the train crew’s actions, and possible alarms or sounds inside the cab. Having audio and video recording allows investigators to eliminate potential contributory factors early in the investigation.

The Office of National Rail Safety Regulator (ONRSR) has consulted with key stakeholders regarding a requirement for Australian rail operators to install in-cab audio and video recorders in driver’s compartments. The finalisation of this process would be beneficial to the understanding of in-cab interactions of train crew and may lead to the development of new or improved risk mitigation measures.

Another ATSB investigation, involving a collision between freight trains 7MP5 and 2K66, at Jumperkine, Western Australia, on 24 December 2019, is currently examining vigilance control activation issues. In that investigation, the driver of 7MP5, operated by Pacific National, continued towards Jumperkine, without appearing to undertake any driver control changes that would have reset the vigilance time count. This investigation is expected to be completed in Quarter 4 2021.

The issue of drivers’ being unresponsive to signals while continuing to acknowledge vigilance alerts has been identified in previous rail investigations including Beresfield^[1] and Hurlstone Park.^[2] It may be beneficial if the effectiveness of vigilance control systems is explored as part of a separate safety study, and this is currently being considered by the ATSB.

Reasons for the discontinuation

The contributing factors to this SPAD highlight the need for a positive train control system to provide additional control in the prevention of SPAD events and their subsequent consequences.

In response to the investigation, ARTC has advised their Advanced Train Management System (ATMS) is a project underway that will provide additional protection from the risk of SPAD. The ATMS can detect and intervene when a train is not being managed in accordance with speed and proceed authority instructions.

According to the ARTC, the ATMS provides the following features:

• increased rail capacity, by allowing operations with smaller inter-train distances
• increased safety, through limit of authority and speed limit enforcement and protection for trackside workers
• improved reliability, through better on-time performance
• improved efficiency and flexibility in network use
• reduced operation and maintenance cost for trackside infrastructure
• a modern platform capable of extension to meet future demand.

Based on this information, it was considered unlikely that further investigation would identify any systemic safety issues or additional opportunity for the enhancement of transport safety beyond the introduction of a positive train control system. Consequently, the investigation is discontinued.

__________

1. New South Wales Department of Transport. Independent Inquiry Report, Coal Train Collision, Beresfield, NSW, 23 October 1997.
2. ATSB Rail Investigation (RO-2013-003) Multiple SPAD by freight train 9837, at Hurlstone Park, New South Wales, on 30 January 2013.

Safety summary

What happened

On 16 March 2019, two passengers were seriously injured when the basket of a Kavanagh B‑400 hot‑air balloon tipped over during vehicle-assisted deflation.

Prior to the accident, the balloon, operated as a scenic charter flight, landed without incident at a private property near Coldstream, Victoria.

Due to a lack of wind and the large size of the envelope, the crew elected to use the retrieval vehicle to assist by pulling the envelope over (by the crown line) during the deflation.

During this process, with 16 passengers and the pilot on board, the vehicle assisting inadvertently pulled the basket over, seriously injuring two passengers.

What the ATSB found

The ATSB found that the operator had not conducted a risk assessment around the use of a vehicle to assist in the deflation process. Although not required by regulations, the lack of a risk assessment likely left the operator and crew unaware of the risks associated with the vehicle-assisted deflation, and without appropriate procedures to control those risks. Consequently, a communication breakdown between the pilot and vehicle driver led to the basket tipping, and the passengers were unprepared and not in landing positions during the deflation process - increasing their likelihood of injury.

The ATSB also found that the Civil Aviation Safety Authority had not provided guidance to commercial balloon operators concerning the risks associated with vehicle‑assisted deflation. This likely contributed to the limited awareness commercial operators had of the risks associated with vehicle‑assisted deflation. Further, with substantial growth in the number of large, Australian-registered balloons requiring vehicle-assisted deflation, this is an ongoing safety risk.

What's been done as a result

The operator has updated their procedures to reduce the probability of a communication breakdown during the deflation process and is requiring the pilot to instruct passengers to assume landing positions during any vehicle-assisted deflations.

CASA has indicated they will publish an advisory circular, which will include guidance on deflation of hot air balloon envelopes using a vehicle to assist.

The ATSB has released a safety advisory notice (AO-2019-014-SAN-014) to all commercial balloon operators about the risks associated with vehicle‑assisted deflation, as identified in this report.

Safety message

This investigation highlights that gradual changes to operational procedures, while possibly perceived as inconsequential, have the potential to conceal new or emerging safety risks. A thorough assessment of any introduced changes should identify these new risks and allow their mitigation or reduction to an acceptable level.

This investigation also highlights that an increase in the number of aircraft and occupants (passengers and crew) exposed to a hazard has a compounding effect that, in a relatively brief period, can increase the overall risk significantly.

The occurrence

What happened

On 16 March 2019, at about 0700 Eastern Daylight‑saving Time,^[1] a Kavanagh B‑400 hot‑air balloon, registration VH‑LNB and operated as a scenic charter flight by Picture This Ballooning, was being prepared for departure from a private property near Dixons Creek, Victoria.

The balloon operating crew conducted passenger safety briefings:

• at the meeting point (including equipment that can be carried on board and what to expect during the flight)^[2]
• on the bus during the transit from the meeting point to the launch site (including conditions at the launch site and the inflation procedure), and
• at the launch site prior to the passengers entering the basket.

Prior to take‑off, with the passengers positioned in the basket, the pilot also conducted a safety briefing which included the risks associated with a layover landing in windy conditions, and having all the passengers demonstrate they could correctly assume the landing position.^[3] The two ground crew assisted the pilot by checking the passengers had understood the briefing and could physically adopt the landing position.

At around 0720, after the pilot and ground crew conducted pre‑flight and radio checks, the balloon lifted off with 16 passengers and the pilot on board.

During the flight, the ground crew were in communication with the pilot by radio to coordinate arrival at the planned landing site. At the landing site, prior to the arrival of the balloon, the ground crew launched a pibal^[4] and observed that there was nil wind below 300 ft above ground level. This information was communicated to the pilot.

About 10 minutes prior to landing, the pilot conducted another passenger briefing concerning safety during landing. This included the requirement for the passengers to assume the landing position.

The balloon landed without incident at a private property near Coldstream, Victoria at about 0820, with the passengers all satisfactorily adopting the landing position.

Following the landing, the pilot began to shut down the burner system and waited for the two-ground crew to prepare to deflate the envelope. Due to a lack of wind and the large size of the envelope, the crew elected to use the retrieval vehicle to assist by pulling the envelope over (by the crown line) during the deflation. Then, by radio, the pilot instructed the driver in the vehicle to drive forward. The vehicle started to slowly move forward, at less than walking pace, pulling the envelope. The driver’s vision of the balloon’s basket was obstructed by the collapsing envelope. During this process, the second ground crew member (located next to the basket) and the driver could not see each other.

The pilot then put down the handheld radio to operate the vent line, which required both hands. The envelope began to deflate faster than anticipated and the fabric started to collapse directly on top of the basket and burners. The second ground crew member assisted by lifting the fabric away from the burners and passengers. The pilot picked up the radio and instructed the driver to ‘drive a little bit faster’. The pilot then put the radio back down on the top of one of the fuel tanks and proceeded to operate the vent line and talk with the passengers. The driver proceeded for another 5 to 6 m then started to slow down.

Shortly after, at around 0830 (10 minutes after landing), the basket began to tip (Figure 1). The pilot instructed the passengers to ‘hang on as best they could’ and did not have the opportunity to use the radio to command the driver to stop.

The second ground crew member jumped out of the way of the tipping basket. The pilot’s radio landed at second ground crew member’s feet. The second ground crew member then communicated with the driver to stop and quickly get back to assist.

The driver, unaware of what was happening with the basket, heard unintelligible sounds from the radio and decided to stop the vehicle.

Two of the 16 passengers were seriously injured^[5] when they were propelled out of the basket as it tipped over. One of the passengers sustained two broken ribs and another was knocked unconscious for around 10 minutes.

The pilot and second ground crew member, who had both received first aid training about 8 weeks prior, began administering first aid to the injured passengers and called an ambulance. The driver, also trained in first aid, took control of the injured passengers and continued to administer treatment. Around 15 minutes after the basket tipped, an ambulance arrived, and the injured passengers were taken to Maroondah hospital. Both were discharged later that day.

Figure 1: VH-LNB basket final resting position

Source: Victoria Police. Annotated by ATSB

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. RACV club in Healesville, Victoria
3. The landing position is designed to reduce the likelihood of injury from a layover or hard landing. Occupants face away from the balloon’s landing direction, holding onto rope holds with their feet flat and knees together but slightly bent.
4. An abbreviation of ‘pilot balloon’, which is a small, helium-filled free balloon with a light that is realised and visually tracked to determine the wind at different altitudes.
5. A serious injury is an injury that requires, or would usually require, admission to hospital within 7 days after the day when the injury is suffered. Transport Safety Investigation Regulations 2003 Part 1.

Context

Balloon deflation

All hot air balloons have a load ring known as a crown ring at the top of the envelope. Attached to the crown ring is a crown line, which is long enough to reach to the balloon’s basket. During envelope deflation, a vent at the top of the balloon is opened progressively to release hot air. To prevent the envelope collapsing on top of the basket in light wind conditions, a force is applied to the crown line to pull the envelope down and away from the basket.

For smaller balloons (generally less than 350,000 ft³), one or two persons can provide enough force by pulling on the crown line and walking away from the basket. For large balloons, the crown line can be attached to the rear of a vehicle that then drives slowly away from the basket pulling the envelope as it deflates.

Crew experience

The pilot obtained a private balloon pilot certificate in 1997 and commercial balloon pilot licence in 2000. At the time of the accident, the pilot had just over 2,000 hours (10 hours in the previous 90 days) as pilot in command.

The ground crew member driving the vehicle during the deflation had around 20 years’ experience as a ground crew member for Picture This Ballooning (PTB). The other ground crew member had been working in this position for the operator for around 4.5 years.

Aircraft information

VH‑LNB was a Kavanagh Balloons B‑400 hot‑air balloon designed and manufactured in Australia with an envelope air capacity of around 400,000 ft³. The balloon was certified to carry up to 22 passengers and the basket had capacity to accommodate 20 passengers within four passenger carrying compartments, and a pilot in the central compartment (Figure 1). Heat was produced by a four‑burner liquefied petroleum gas system.

Meteorological information

The pilot reported reviewing several weather forecasts for the intended flight time, on the night before the flight and again on the morning before the flight. In addition, prior to, and during the flight, the ground crew launched pibals (pilot balloons) to check the prevailing wind speed at different altitudes. This information was communicated to the pilot.

The ATSB obtained weather data from the Bureau of Meteorology for Coldstream Airport (approximately 5 km from the accident site). It included observations recorded at 1‑minute intervals between 0700 and 0900 on 16 March 2019 (at ground level). Across that period, the winds were calm (0 kt) with no gusts.

Organisational information

Picture This Ballooning

Picture This Ballooning (PTB) was a charter balloon operator that had been operating for around 22 years. It had 15 balloons in their fleet, of which 11 were used for passenger charter operations. The operator had two balloons (one Kavanagh B‑350 and a B‑400) with envelope sizes of 350,000 ft³ or more. Sizes below this were less likely to require a vehicle to assist during deflation. PTB began using a vehicle to assist with in the deflation of their two large balloons about 12 months prior to the accident.

Communications procedures

The operator’s Operations manual (OM) contained the following procedure for radio communications:

Communication with retrieve crew will be via UHF radios with mobile phones as back up. Prior to launch the pilot must conduct a UHF radio check with the crew to ensure two-way communication is possible. During flight both parties shall maintain a continuous watch.

The operator’s crew procedures and training manual contained additional information regarding radio failure:

Use of mobile phone as back up

Recognise that the radio is not working if you are not receiving instructions

Pilot has a crew number and vise [sic] versa

Stay near the balloon and do not get too far in front

Try a second radio

It’s not that big a deal so long as you think what the pilot would want you to do.

Although not documented prior to the time of the accident, the process during vehicle‑assisted deflation, as reported by the pilot and the ground crew member driving, was that once the instruction to drive forward was given, the driver would continue until the pilot commanded them to stop.

Following the accident, the pilot identified that putting down the handheld radio and not maintaining communication throughout the entire process was a likely contributor to the accident.

Passenger safety briefings

The operator’s procedures contained in the OM required the pilot in command to conduct passenger briefings:

as to correct inflation procedures

inside basket on landing positions prior to lift off.

The OM also contained the following information regarding briefing of passengers:

Passengers are to be briefed on the ballooning experience in general and safety aspects of ballooning (e.g. the fan, landing positions, exiting the basket, etc). Pilots should make use of the PTB checklists and briefing cards found on board all PTB balloon basket.

Further, the OM contained the following information regarding the positioning of passengers in basket:

A physical demonstration of landing positions by the passengers must be conducted before take-off on each flight.

The pilot and a passenger reported that a safety briefing was conducted, upon arrival at the launch site, primarily regarding the hazards associated with the inflation fans (pre-boarding). Another briefing was conducted in the basket prior to launch (pre-flight) which included passengers demonstrating they could correctly assume landing positions. A final briefing, primarily concerning landing positions, was also conducted by the pilot around 10 minutes prior to landing (pre-landing).

In addition to the safety briefings, the balloon had safety cards on board that also contained safety information including a pictorial representation of the body position when in the landing position (Figure 2).

Figure 2: Picture This Ballooning’s on-board safety briefing cards

Source: Picture This Ballooning

Landing position

The Kavanagh Balloons Flight Manual contained procedures for fast landings, including:

When a high horizontal landing speed is expected, passengers should be made aware that the basket will tip forward and they should take a lower-than-normal landing positions to avoid being thrown out of the basket.

The pilot reported that during the vehicle‑assisted deflation the passengers were not in the landing position.

Crew’s awareness of the risk of tipping during vehicle‑assisted deflation

The pilot reported that at the time of the accident not noticing that there was a problem until the basket began to tip. In addition, while having previously observed baskets tipping due to wind, the pilot had not considered that the deflation vehicle could produce the same outcome. Further, the ground crew member driving the vehicle also reported not expecting anything to go wrong during the deflation process.

Civil Aviation Safety Authority

The Civil Aviation Safety Authority (CASA) is an independent statutory authority with the primary functions of conducting safety regulation of civil air operations in Australia and the operation of Australian aircraft overseas.

Passenger safety briefings

CASA’s Civil Aviation Advisory Publication: Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators (CAAP 253-02 V2.0), included specific guidance for balloon operators regarding passenger safety briefings during pre‑boarding, pre‑flight, pre‑landing final approach and landing.

The guidance did not contain information regarding passenger safety briefings during the deflation process.

Safety management system

CASA regulations did not require operators of balloon aerial work and charter operations to have a safety management system (SMS).

CASA have proposed Civil Aviation Safety Regulation (CASR) Part 131, which was available as an exposure draft until 30 September 2019, and scheduled to commence on 2 December 2021. Part 131 would have required balloon transport operators (currently charter operations) to have an SMS that is ‘…appropriate for the size, nature and complexity of the operator’s balloon transport operations’. The SMS must include:

…a safety risk management process, including:

(i) Hazard identification processes; and

(ii) Safety risk assessment and mitigation processes

In addition, the proposed Part 131 also contained the requirement for balloon transport operators to have a safety manager with

…sufficient relevant safety management experience to capably lead, manage and set standard to enable the operator to safely implement the operator’s safety management system…

and the responsibility for

…managing the operation of the safety management system including managing corrective, remedial and preventative action in relation to the system…

In a 22 November 2019 update, CASA provided a summary following the consultation period for Part 131:

To provide additional time to consult with industry on the requirements related to safety management systems and training and checking systems, CASA has removed the proposed regulations related to safety management systems (SMS) and training and checking systems for balloon transport operators (including the requirement for the two associated key personnel – the head of training and checking and the safety managers).

Large balloons in Australia

Multiple ground crew and pilots reported to the ATSB that the use of the vehicle‑assisted method is only used for balloons with envelope sizes of 350,000 ft³ or greater (some reported 400,000 ft³ as the minimum size). Balloons with smaller envelope sizes are more likely to be collapsed by hand in low wind conditions.

Figure 3: Number of large VH-registered balloons on 30 June between 2000 and 2019

Source: Civil Aviation Safety Authority

The ATSB conducted an analysis of the trend in the risk associated with vehicle‑assisted deflation. This was based on vehicle-assisted deflation only being used for balloons with a capacity of 350,000 ft³ or greater.

Over the period mid‑2015 to mid‑2019, the number of large balloons registered in Australia increased by around 8-9 more balloons each year (Figure 3).

Given this trend, it is likely that the use of vehicles to assist during deflation will continue to increase over the period 2020–2022. In addition, the average size of these balloons (350,000 ft³ or greater) has also increased and accordingly, the average number of passengers per larger balloon flight has also increased.^[6] It follows then, that, the number of passengers potentially exposed to injury associated with vehicle‑assisted deflation per flight will also probably increase.

Related occurrences

A review of the ATSB occurrence database found the following ground handling occurrences involving the use of a vehicle to assist in the deflation process:

Occurrence 201600589

At 0700 on 22 April 2016, the pilot of a Kavanagh Balloons B‑425 was seriously injured when the basket tipped during a vehicle‑assisted deflation. During the deflation, the pilot dropped the radio resulting in a communication breakdown with the driver of the vehicle. The pilot was then unable to command the driver to stop, resulting in the vehicle driving too far, causing the basket to tip. At the time of the accident, there was probably only one passenger still on board the balloon.

Following that occurrence, the operator involved implemented new procedures intended to reduce the likelihood and consequences of a communication breakdown during vehicle‑assisted deflation. This included the following information:

Communication needs to be very clear not only on the radio but visually as well. This is where the second crew member is vitally important, if for whatever reason radio comms are lost between the PIC [pilot in command] and vehicle this crew member needs to be able to convey information between basket and vehicle. Whilst anyone is pulling over an envelope, please limit radio transmissions in other balloons and retrieve vehicles, multiple people using the same channel will cause cancelling of transmissions, PIC and driver only to use radio during the pull-down procedure with the vehicle driver “reading back” instructions, this ensures the information is correct and understood. If multiple balloons are about to begin collapsing their envelopes using mobile phones is preferred to ensure continuous communication. Discuss hand signals between crew members before commencing procedure and if at any-time communication either visual or verbal is lost STOP and wait until comms are restored.

The new procedure also contained information intended to reduce the consequence of a similar accident:

While collapsing envelope the pilot is to remain inside basket and passengers are to adopt landing positions.

Occurrence 201809492

At 0630 on 31 December 2018, a passenger on board a Kavanagh Balloons B‑400 sustained a minor injury when the basket tipped during a vehicle‑assisted deflation. During the deflation, radio interference resulted in a communication breakdown between the pilot and the driver of the vehicle. The driver was unable to hear the pilot’s command to stop, resulting in the vehicle driving too far, causing the basket to tip. At the time of the occurrence there were 18 passengers on board the balloon.

__________

6. Generally, the larger a balloon’s envelope size the more passengers the balloon can carry. Balloon with envelope sizes of 450,000 ft³ or greater are more likely to carry 20 or more passengers.

Safety analysis

This analysis will discuss how and why the basket tipped over during the vehicle‑assisted deflation and the effect of the passengers not being in the landing position. The risk management of vehicle-assisted deflation will also be analysed from both the balloon operator’s perspective and the commercial balloon industry and regulator more broadly.

Communication breakdown and procedures

During the vehicle-assisted deflation, the driver did not have vision of the basket and the pilot (in the basket) put the hand-held radio down. Subsequently, the pilot was unable to pick up the radio in time to order the driver to stop the vehicle when it became apparent that the basket would tip. In addition, the second ground crew member was not in a position to effectively communicate with the driver during the deflation. The scenario collectively meant that no one could quickly communicate with the driver to prevent the basket tipping.

Picture This Ballooning (PTB) did not have specific procedures for vehicle-assisted deflation or communicating during the process. The general loss of communication (radio failure) procedure was not suitable during vehicle‑assisted deflation because there was no time in which to access an alternative means of communication in the event of a communication breakdown.

The normal communication practice for vehicle-assisted deflation was for the driver to continue until the pilot instructed them to stop. However, the pilot could have a very short time to instruct the driver to stop if they approached the point where the basket tips. This would require continuous radio communication between the pilot and the driver, which was lost when the pilot put down the radio to open the vent. While the communications procedure in the company’s operations manual required pilot and ground crew to ‘maintain a continuous watch’ during flight, it did not stipulate the same during deflation. However, if the pilot needed two hands to open the vent, an alternative means of communicating with the driver was required.

The vehicle-assisted deflation process did not effectively utilise the second ground crew member and that person was not required to be in a position to be able to communicate with the driver by an alternative means such as shouting or signalling.

The pilot and ground crew did not use standard communication phraseology during the vehicle‑assisted deflation. The lack of standard phraseology can increase the likelihood of miscommunication or delayed actions.

Use of passenger landing position

The landing position was designed to reduce the likelihood and severity of injury during layover landings. ATSB analysis concluded that the injury profile of passengers within a basket that tips during a vehicle‑assisted deflation would be similar to when a basket tips during a fast landing.

PTB did not have specific passenger positioning procedures for vehicle-assisted deflation, nor was there a specific passenger briefing for this process. In addition, the pilot was unaware there was a risk of the basket tipping, and accordingly, did not instruct the passengers to assume the landing position during the vehicle‑assisted deflation. As such, most of the passengers were not in the landing position during the deflation and were thus exposed to a greater risk of injury when the basket tipped.

Awareness of tipping risk

The pilot and ground crew was unaware that there was a risk of the basket tipping during the vehicle‑assisted deflation. A greater awareness of the risks associated with vehicle‑assisted deflation would likely have prompted greater vigilance during the process and thus a reduced probability of the basket tipping. Further, the pilot would have been more likely to brief passengers on the risk and instruct on use of the landing position.

Operator’s safety risk management processes

Before the accident, the operator had not conducted a safety risk assessment of deflation techniques, nor were they required to by current regulations or their own management processes and practices. As a result, the operator had not properly considered the risks of vehicle-assisted deflation and so had not considered writing specific safety procedures to ensure it was done safely and the crew was aware of the risks.

Following a similar accident, another operator working under similar conditions developed a new procedure for deflation. This included measures to reduce the likelihood of a communication breakdown^[7] during vehicle‑assisted deflation and having passengers in the landing position during the process. This further indicates that if a risk assessment had been conducted by PTB, it is probable they would have identified communication breakdown and the risk of injury to passengers (if the basket tipped) as key operational risks requiring mitigation.

CASA guidance material

Guidance material produced by CASA did not contain information regarding passenger safety briefings during the deflation process.

Prior to the subject event, there had been two related accidents with similar contributing factors. More generally, the ATSB found limited awareness of any risks associated with vehicle‑assisted deflation in the commercial ballooning industry. It is likely that if guidance material had been issued by CASA on the risks associated with vehicle‑assisted deflation, it would have increased awareness of the associated risks with operators introducing large balloons to their charter operations.

As balloon charter operators are not presently required by regulation to have a safety management system (SMS), there was, and remains, a lower likelihood of these operators conducting risk assessments for changes in operations. Given another operator involved in a similar accident reported that they had not conducted a formal risk assessment of vehicle‑assisted deflation prior to the accident, guidance material from CASA could have drawn attention to the risks for these operators.

With the increase in the numbers of larger balloons registered in Australia, it is expected that the use of the vehicle-assisted deflation practice will similarly increase and will likely be used by a greater number of operators over time. Further, with larger envelope and basket capacities comes an increase in the numbers of passengers exposed to injury risk in the event of a basket tipping during a vehicle-assisted deflation. As such, this guidance will be important for helping educate other operators as they move to larger balloon operations in the future.

__________

7. Driver ‘reading back’ pilot’s instructions; use of mobile phones if radio interference is anticipated; second ground crew member to stand in a position visible to both pilot and the driver; and, if visual of verbal communications is lost, the driver is to stop and wait until communication are restored.

Findings

From the evidence available, the following findings are made with respect to the ground handling event involving a Kavanagh B‑400 balloon, registered VH-LNB, near Coldstream, Victoria on 16 March 2019. Two passengers were seriously injured when, during deflation, the balloon’s basket was inadvertently tipped by the vehicle assisting with deflation of the envelope. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The pilot put down the handheld radio to operate the vent line, and the second ground crew member was not in an observable position for the driver, which led to a communications breakdown and limited their opportunity to promptly command the driver to stop to avoid the basket tipping.
• The majority of the passengers were not in the landing position when the basket tipped, increasing their probability for injury.
• Picture This Ballooning did not have any procedures for conducting vehicle‑assisted deflation. [Safety issue]
• The pilot and ground crew were unaware of the risk of the basket tipping from the vehicle pulling the envelope during vehicle-assisted deflation.
• Picture This Ballooning's safety risk management processes and practices were not sufficient to facilitate the identification of key operational risks associated with vehicle‑assisted deflation. [Safety issue]

Other factors that increased risk

• The Civil Aviation Safety Authority provided no guidance for operators concerning the risks associated with vehicle‑assisted deflation. [Safety issue]

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Vehicle-assisted deflation procedures

Safety issue number: AO-2019-014-SI-02

Safety issue description: Picture This Ballooning did not have any procedures for conducting vehicle-assisted deflation.

Risk management processes

Safety issue number: AO-2019-014-SI-01

Safety issue description: Picture This Ballooning's safety risk management processes and practices were not sufficient to facilitate the identification of key operational risks associated with vehicle-assisted deflation.

Guidance on vehicle-assisted deflation risks

Safety issue number: AO-2019-014-SI-03

Safety issue description: The Civil Aviation Safety Authority provided no guidance for operators concerning the risks associated with vehicle‑assisted deflation.

Additional safety actions

ATSB safety advisory notice to all commercial balloon operators

Safety Advisory Notice number: AO-2019-014-SAN-014

To accompany this report and encourage proactive safety action, the ATSB has released a safety advisory notice to all commercial balloon operators informing them of the risks associated with vehicle‑assisted deflation.

The ATSB advises all commercial balloon operators utilising vehicle‑assisted deflation methods to review their current operational practices in light of the findings in the ATSB investigation report AO-2019-014 with the aim of mitigating the risks associated with the procedure. This review should be conducted with emphasis on:

• reducing the risks associated with a communications breakdown between the pilot and vehicle driver, and
• include a review of the positioning of occupants within the basket to minimise the likelihood of injury if the basket tips during the vehicle‑assisted deflation.

Future study proposed by Picture This Ballooning

Action number: AO-2019-014-NSA-015

Picture This Ballooning has informed the ATSB that, at the earliest practical date, they intend to study the forces present during the vehicle‑assisted deflation process and to pass these results to other commercial ballooning operators.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Picture This Ballooning
• The Civil Aviation Safety Authority
• The Bureau of Meteorology
• Witnesses
• Victoria Police.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Picture This Ballooning and the Civil Aviation Safety Authority.

Submissions were received from Picture This Ballooning and the Civil Aviation Safety Authority. There submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At about 0931 Eastern Daylight-saving Time on 25 February 2019, Train TD 6591, an empty Comeng passenger train operated by Metro Trains Melbourne (MTM) collided with the end of line protection (buffer stop) at Newport siding, Victoria. The collision damaged the buffer stop and the front of the train. The leading carriage (333M) derailed, and the train driver (the only person on board) was hospitalised with minor injuries.

What the ATSB found

Recorded data showed that the driver applied the brakes 1.5 seconds prior to impact, which was after the train had passed the required stopping point. There were no driver inputs in the preceding 25 seconds, although no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. While the train was equipped with a safety system (a pilot valve as part of the master controller) that was designed to apply the brakes in situations such as driver incapacitation, it was not activated to apply the brakes during the sequence of events. The recorded data indicated that sufficient pressure was maintained on the pilot valve (master controller). The driver may have been incapacitated for a period of time before the collision, however, the ATSB could not determine any details of incapacitation including duration and cause.

Although it was not identified as a contributory factor due to a day off prior to the accident, as a result of rostered work it is likely the train driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident (but not on the day of the accident).

Safety message

This investigation highlights the importance of train safety systems to protect against driver error and incapacitation. In addition, drivers should maintain their health and fitness for work to reduce the likelihood of driver incapacitation, including adequate nutrition and hydration as well as consideration of the potential impact of fatigue. The ATSB SafetyWatch information on fatigue provides resources and guidance.

The occurrence

What happened

On 25 February 2019, Train TD 6591, a six-car Comeng passenger train, operated by Metro Trains Melbourne (MTM), travelled from Flinders Street Station to Newport Station, Victoria, where all passengers disembarked. The driver commanded the train to depart the station once receiving an indication that the train was empty, with the intention to stable^[1] it at Newport siding, 810 m from the station. CCTV footage showed the train transiting to the siding with the driver visible and appearing alert.

While approaching the stabling location, for about 25 seconds from 0930:35 Eastern Daylight-saving Time,^[2] there were no recorded inputs from the driver. At about 0931, the train collided with the end of line protection (buffer stop) and derailed. Recorded data showed a brake application about 1.5 seconds prior to impact, which was after the train had passed the required stopping point. The collision resulted in substantial damage to the front of the train and the buffer stop, and the driver was hospitalised with minor injuries (Figure 1).

Figure 1: Front of Comeng train TD 6591, showing collision with buffer stop and derailment

Source: ONRSR, annotated by the ATSB

The train driver reported losing consciousness for an unknown period of time. The last thing that the driver could remember was noticing the track points were set correctly on entering the siding, with the next memory being after the collision.

Train driver

The driver had been driving MTM trains and based out of Newport for over 3 years, was suitably qualified and held a Category 1 medical (assessed as fit for duty unconditional in accordance with the medical standards contained in the National Standard for Health Assessment of Rail Safety Workers). Following the collision, the driver was tested for drugs and alcohol and returned a negative result for both.

The driver was admitted to hospital due to injuries sustained and examined by medical professionals. The driver reported that after extensive testing the medical professionals categorised the incapacitation as a vasovagal syncope (a common faint), possibly due to dehydration and lack of nutrition. The driver reported having a coffee and a banana but no water on the morning of the accident. The maximum temperature on the day was recorded to be above 30 °C, and the driver reported that the drivers cab was warm prior to the loss of consciousness and that there was no way to control the temperature as it was pre-set through the train. The driver also reported that the sun felt hot coming through the window.

Train controls and pilot valve

The brake controller (Figure 2) commanded the train’s pneumatic brakes through driver inputs.

The train was also equipped with a pilot valve system which was designed as a fail-safe mechanism such that the brakes would apply if there was no pressure applied by the driver (such as from incapacitation). When the pilot valve was ‘opened’ the brake pipe pressure would release and the brakes would apply. In order to keep the pilot valve ‘closed’, pressure was required to be maintained by the driver through either a foot pedal or hand controller. The hand controller for the pilot valve (hand pilot valve) formed part of the master controller (Figure 2).

The driver was using the hand pilot valve at the time of the accident. The hand pilot valve required a minimum downward pressure of 0.6–1 kg be maintained on the master controller handle to keep the valve in a closed position, preventing the brakes from applying.

Post-accident testing of the train’s braking system and hand pilot valve found no faults that would have contributed to a failure to stop.

Figure 2: Comeng driver’s cab of 333M, showing location of the brake controller, and combined master controller with hand pilot valve

Source: MTM, annotated by ATSB

Logged data

Each driving cab of the train was fitted with a Vigilance Control Event Recorder System (VICERS) data logger that recorded the speed, acceleration and operational status of the driving controls. The data logger from the leading cab (333M) was reviewed as it was the active cab and also the first carriage to impact the buffer stop. The logged data showed the following:

• The train’s speed was maintained below 15 km/h during the stabling operation and the driver used several brake and throttle modulations to do so.
• Driver inputs stopped at 0930:35 and there were no further inputs for about 25 seconds, with a brake application at 0931:00
• The brake application about 1.5 seconds prior to impact (at 0931:00) was consistent with an emergency brake application commanded by movement of the brake controller.
• There was no recorded change of state of the pilot valve system until impact.

Additional safety systems

The train was equipped with two additional safety systems to assist in protecting against driver error and incapacitation: a trip-lever and a task-based vigilance system.

Trip-lever

A trip-lever would initiate emergency braking if the train passed a signal requiring the train to stop. In this accident, the train was entering a siding and did not pass any signals requiring the train to stop. Therefore, there was no requirement for the trip-lever to activate the brakes.

Task-based vigilance system

The task-based vigilance system monitored driver control inputs and if there were no inputs for a certain amount of time, a warning would sound. If the driver did not respond to that warning, the brakes would apply. The timer would reset when certain tasks were performed, such as operation of the master controller or brake controller.

At the time of the accident, due to the train’s speed, the system was operating on a 45-second interval. The 25-second time period which elapsed without driver inputs was therefore too short to activate the system.

Fatigue

The driver’s rosters for the three months prior to the accident and reported 72-hour history were reviewed as part of a fatigue analysis, which included the use of biomathematical modelling. The roster was input into two biomathematical modelling software programs, FAST^[3] and FAID.^[4] Biomathematical modelling forecasts the effects of circadian rhythms and sleep on performance, but cannot determine fatigue (or predict errors caused by fatigue) due to individual and situational circumstances.

Both models’ outputs indicated that the predicted levels of fatigue on the day of the accident were not in a range known to have a significant impact on performance. This was likely due to the driver having a day off work two days prior, which would have impacted the biomathematical modelling outputs.^[5] However, in the week preceding the accident, before the day off, both biomathematical modelling outputs predicted that the driver was likely experiencing levels of fatigue shown to have an effect on performance.

Safety analysis

The driver may have been incapacitated in the period prior to the accident and therefore temporarily lost awareness of the driving task, leading to the train not stopping at the designated stopping point as the driver did not apply the brakes in sufficient time. While it is possible the driver was incapacitated in the period before the collision, due to limited and conflicting evidence the cause, duration and presence of incapacitation could not be determined. Although dehydration was raised as a possible reason for why the driver may have fainted, the available evidence could not confirm this. In addition, although the logged data showed no driver inputs for 25 seconds followed by a brake application, the duration of any incapacitation could not be confirmed as no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. However, the recorded brake application occurred after the train had passed the required stopping point (and therefore was not effective in stopping the train).

The pilot valve was part of the overall train safety system, including the trip-lever and vigilance system. In this situation, the pilot valve was the only aspect of the safety system that could have activated and applied the brakes to protect against driver incapacitation. The hand pilot valve required minimal pressure to prevent the brakes from applying. It is very likely that adequate pressure was maintained on the pilot valve (master controller) during the period when no driver inputs were made, and therefore this part of the safety system was not triggered to activate the brakes and stop the train.

The driver’s rosters for the previous three months were reviewed through a fatigue analysis, including the use of biomathematical modelling software. This analysis indicated, due to the number of rostered days worked and the timing of shifts, the driver was likely experiencing a level of cumulative fatigue known to have an effect on performance in the week preceding the accident, before the day off. However, aspects such as the time of day, the driver’s 72-hour history including a day off work, and the driver reporting being very alert, suggests that fatigue was a not contributing factor in this accident.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The driver did not apply the brakes at the required time to stop the train, nor did the pilot valve brake activate, resulting in the train colliding with the buffer stop and derailing.
• Due to rostered work it is likely the driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident, but not on the day of the accident.
• The ATSB could not confirm the presence or length of any driver incapacitation before the accident.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. To leave rail traffic unattended and secured, usually in a siding.
2. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11 hours.
3. Fatigue Avoidance Scheduling Tool (FAST®). FAST predicts fatigue based on actual sleep and work schedules, and critical event scenarios using a model of human fatigue and circadian variation in cognitive performance and alertness.
4. Fatigue Audit Interdyne (FAID) Quantum. FAID predicts sleep opportunity, and as a proxy, estimates fatigue due to work-related causes.
5. For FAID, a recovery value is assigned depending on the length of non-work periods and the time of day that they occur.

Overview of the investigation

On 12 February 2018, the ATSB commenced an investigation into a loss of tractive effort on train 8466 at Ardglen, New South Wales (NSW), which occurred on 10 February 2019.

Train 8466, operated by Qube Logistics, was planned to transport mineral concentrate from Cobar, NSW, to Port Waratah, NSW. During the journey, 10 wagons were added. This required the addition of another locomotive, which was attached at Werris Creek.

The train departed Werris Creek with three diesel-electric locomotives (QBX005, QBX004 and QBX001) hauling 61 wagons with a total length of 961 m. The train crew consisted of two drivers.

After pausing briefly at Chilcotts Creek, the train made its way up the 1 in 40 grade to the Ardglen Tunnel, until its speed dropped and it came to a stop near the distant signal on the approach to Ardglen. The driver inspected the locomotives but did not identify any problems.

The driver restarted the train, but soon after locomotive QBX001 began to perform erratically, intermittently losing tractive effort. The locomotive began to provide tractive effort again, and the train accelerated to 18 km/h and entered the northern portal of the tunnel at 11 km/h.

About 2 minutes after entering the tunnel, locomotive QBX005 derated to produce no tractive effort, and within another minute, the other two locomotives also derated to produce no tractive effort. The tunnel was filled with exhaust smoke, which entered the lead locomotive QBX005’s operating cab and reduced the drivers’ visibility.

When the driver sensed the train was moving again, he assumed the locomotives were producing tractive effort, but the train was actually rolling backwards towards the northern portal of the tunnel. When the train approached the tunnel’s exit, the driver realised the problem and made a full service brake application. The second driver made an emergency call to train control, who advised the track behind the train was clear and the points were set correctly to protect the train movement. Ultimately, the train rolled back a total distance of 982 m. Although this was an unplanned event, communications between the train crew and train control at all stages ensured protection was in place.

As part of its investigation, the ATSB interviewed the drivers, reviewed the train’s event recorder data and obtained loading records for the train and other trains used by the operator. The ATSB also obtained and reviewed the operator’s investigation report on the occurrence.

Based on this information, it was identified that:

• The train’s initial documentation, prepared by the train crew, indicated that the 61 wagons weighed 4,636 t (76 t per wagon). A subsequent calculation by personnel in the operator’s customer service centre, and entered into the operator’s transport management system prior to the train’s departure, was 4,392 t (72 t per wagon). This latter weight was erroneous, and after the occurrence the actual weight was determined to be 4,608 t. However, the operator reported that the locomotive capability for the planned route was 5,148 t (1,716 t per locomotive), in excess of the actual weight.
• The locomotives were manufactured in 2015. Locomotive QBX001 had previously experienced derating issues due to its exhaust sensor not operating consistently to deliver accurate temperature readings to the locomotive management system. It had recently been repaired and certified by an external contractor, which involved a temporary repair of a wiring harness. However, during the occurrence sequence, the locomotive continued to experience intermittent faults with the exhaust sensor.
• Ardglen Tunnel had no exhaust or gas ventilation or artificial illumination. When in the tunnel, exhaust gases from the locomotives surrounded the locomotive bodies and were forced forward of the locomotives, resulting in the ingestion of exhaust gases into the locomotives’ engine air intakes.
• There was no requirement for an operator to carry oxygen self-rescue units in the lead locomotive of a train passing through the Ardglen Tunnel, although such units were required for operating through the Ulan Tunnel (which the train normally operated through). Such oxygen self-rescue units were on board locomotive QBX001, but the crew had not transferred them to the lead locomotive QBX005 (nor were they required to do so).
• The driver was presented with ambiguous and incomplete information when the three engines derated. He saw that the lead locomotive had derated, but there was no visual indication that both the trailing locomotives had derated, and no audible indication that the trailing locomotives derated. While in the tunnel, the driver sighted the speed indicator consistently displaying a speed above 0 km/h, but the indicator did not differentiate between forward and reverse speed.
• The operator identified several proposed actions to improve the safety of its operations.

ATSB comment

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

Safety summary

What happened

On 21 January 2019, freight train 6BM9 was to travel from a logistics terminal in Barnawartha in northern Victoria to Altona, in Melbourne. The train consisted of two locomotives and 31 freight wagons. The train departed Barnawartha at about 1400 and travelled in a south-westerly direction through Wangaratta, Benalla and Euroa.

At 1530, the train passed through Creighton travelling at about 100 km/h. About 0.5 km after crossing Creighton Siding Road, the leading bogie of the third-last wagon derailed. The wagon derailed a short distance before a rail bridge. The train was brought to a stop with minor damage to the wagon and track, and no injuries.

What the ATSB found

The ATSB found that the wagon probably derailed as a result of the lateral misalignment of the track. The track misalignment was not evident to the locomotive crew when the train entered the location and developed under the dynamic loading of the train.

The track misalignment was probably primarily the result of track lateral instability. A mud hole at the derailment location had resulted in poor ballast support of sleepers, reducing the track’s resistance to movement. A combination of this degraded support and compressive forces within the rails created conditions for track instability. The longitudinal compressive forces were due to the hot conditions of that day, and possibly localised low stress-free-temperatures in the rails near the rail bridge.

The Australian Rail Track Corporation’s (ARTC) systems for managing track lateral stability did not lead to the location being managed as a special location potentially vulnerable to instability. Although the reduced ballast profile at the mud hole had been identified and monitored in accordance with the ARTC code of practice, more significant levels of response were available to manage the risk of instability. These included repair or imposing a temporary speed restriction when temperatures reached a predetermined limit.

What has been done as a result

ARTC advised that its Track Stability Management Plan (TSMP) for the section containing Creighton has been reviewed. As a result, the 2019/20 TSMP included Stress Free Temperature testing at several sites, and 13 sites were identified as special locations for the monitoring of track stability, including the Creighton derailment site.

ATSB has made a safety recommendation for ARTC to review its systems for the identification and management of track vulnerable to instability, considering the findings of this report.

Safety message

It is important for rail infrastructure managers to have systems in place to identify track sections vulnerable to lateral instability during the summer period.

The occurrence

Events prior to the derailment

On the afternoon of 18 January 2019, SCT Logistics container service 6BM9 departed Bromelton in Queensland to travel to Altona in suburban Melbourne, Victoria (Figure 1). The train consisted of two locomotives hauling 18 wagons.

Figure 1: Intended route of train 6BM9 from Bromelton, Queensland to Altona, Victoria

Source: Google earth annotated by Chief Investigator, Transport Safety (Victoria)

The train arrived at Taree, New South Wales (NSW) at 0324 on Saturday 19 January, where there was a change of crew. The train then travelled to Leightonfield, for another crew change at about 1210 the same day. The next crew change was at Wagga Wagga at 1950, also on the same day. The next stage of the journey, between Wagga Wagga in NSW and Barnawartha in Victoria, was also uneventful, the train arriving just after midnight on 20 January.

Due to capacity constraints at its final destination in Melbourne, the train was held at the SCT Logistics terminal in Barnawartha for about 38 hours. During this stop, 13 wagons were added to the consist to give a total of 31. The train crew for the next leg joined the train on 21 January at about 1230. The train was inspected, and departed Barnawartha at about 1400.

The derailment

The train travelled in a south-west direction through Wangaratta, Benalla and Euroa. It was handling as expected out of Euroa, and crested Creighton Bank at a speed of about 95 km/h. On the downgrade following the crest, the train’s speed increased to about 108 km/h.^[1] The driver progressively reduced the throttle setting from Notch 8 to Notch 2 before crossing Creighton Siding Road at a speed of about 102 km/h. The train then crossed two short bridges before a wagon derailed immediately ahead of a third bridge at about 1540. The crew reported that they had not noticed any track irregularities prior to the derailment.

The driver stated that he saw a plume of dust towards the rear of the train in the rear view mirror and he also observed a loss of brake pipe (BP) pressure. The End-of-Train device (EOT)^[2] registered a reduction in BP pressure, followed by a reduction of pressure in the locomotive electronic air brake (EAB)^[3] system.

The train came to a stop with the lead locomotive just past the 141 km post. After stopping, the crew initiated an emergency call to network control. One of the crew then inspected the train and identified that the leading bogie of the third-last wagon (CTQY 666T) had derailed (Figure 2).

Figure 2: Derailed bogie of wagon CQTY 666T

Source: Australian Rail Track Corporation (ARTC).

Observations following derailment

Immediately following the derailment and prior to the drop in temperatures that evening, the track at the derailment location was inspected by the rail infrastructure manager, the Australian Rail Track Corporation (ARTC). The track exhibited a significant lateral misalignment (Figure 3).

Figure 3: Track misalignment photographed at 1710 on 21 January, after derailment

Source: Australian Rail Track Corporation

This photograph was taken soon after the derailment in temperatures similar to those existing at the time of the derailment, and prior to the track cooling overnight. It shows a significant track misalignment ahead of the rail bridge.

__________

1. Train speeds provided are as recorded on the data logger from locomotive SCT004
2. End-of-Train device measures brake pipe pressure on the last wagon and displays it on the driver’s console.
3. Electronic Air Brake (cab controls)

Context

Track information

Track location

Creighton is located in the rural municipality of the Strathbogie Shire Council in north central Victoria, about 143 rail-km from Melbourne (Figure 4).

Figure 4: Track between Violet Town and Avenel, indicating incident location Creighton

Source: e-way street directory, Melway 2017, annotated by Chief Investigator, Transport Safety (Victoria)

This rail corridor extends between Melbourne and Wodonga in northern Victoria and is part of the interstate standard-gauge^[4] rail connection between Melbourne and Sydney. Since July 1998, the standard-gauge network in Victoria has been managed by the Australian Rail Track Corporation (ARTC).^[5]

The corridor continues to receive significant investment. The North East Line Upgrade^[6] project commenced planning in 2018, started works in 2019 and is due for completion in 2021. The scope of the project includes the removal of mud holes, drainage improvements, replacement of ballast and resurfacing including packing and compacting of ballast.

The standard-gauge track on the north east corridor has a history of mud hole formation and rough ride. In 2011, the ATSB conducted an investigation to examine the safety of rail operations on the Melbourne to Sydney line.^[7] ATSB found that train forces on a weakened formation, as well as the effects of highly fouled ballast, poor drainage and heavy rainfall during 2010 and 2011, contributed to the development of mud-holes and poor vertical alignment on this corridor.

Typical track construction

The structure of a track consists of a number of components, including the rail, sleepers, ballast and the formation (Figure 5).

Figure 5: Track structure

Source: Chief Investigator, Transport Safety (Victoria)

The formation is the earthworks upon which the ballast is laid and typically consists of the sub-grade (earth fill on top of the natural earth) and a capping layer of compacted material that provides a sealing layer to the sub-grade. The ballast covers the capping and distributes the loads to the formation while also providing the necessary support to the sleepers to maintain track geometry under vertical, lateral and longitudinal loads. Sleepers and their fastenings support and locate the rail.

Track at Creighton

There were two parallel, standard-gauge bi-directional tracks at Creighton—an east and west track. The incident train was travelling towards Melbourne on the east track. The maximum permitted speed for this line segment was 130 km/h and there were no temporary speed restrictions in force at this location, nor had any speed restrictions been imposed due to heat. The authorised speed for the class of train that derailed was 115 km/h.^[8]

The east track through Creighton was constructed using 60 kg/m Continuous Welded Rail (CWR)^[9] affixed to 250 mm deep concrete sleepers using Pandrol ‘fastclip’ resilient fasteners. Concrete sleepers were at a nominal spacing of 667 mm.^[10] Construction standards specified ballast at a depth of 250 mm and a shoulder width of 300 mm.^[11] The standard stated that the ballast shoulder height be determined by the sleeper design.

Creighton Siding Road is located 143.276 rail-km from Melbourne.^[12] Travelling towards Melbourne, there were seven rail bridges over a relatively short distance. They were located at 142.944 km, 142.852 km, 142.710 km, 141.827 km, 141.505 km, 141.161 km and 140.880 km (Figure 6). The derailment occurred a short distance before the bridge at 142.710 km, and the train came to a stop just prior to the bridge at 140.880 km.

Figure 6: Incident track section

Source: Pass Assets, Public Transport Victoria, Annotated by Chief Investigator, Transport Safety (Victoria)

Rail bridge construction

The point of derailment was between the short rail bridges at 142.852 km and at 142.710 km. Both bridges were transom bridges, with timber sleepers fixed to I-beam girders supported at each end by concrete abutments. Rails were secured to sleepers with Trak-Lok type fastenings that had a design toe load of approximately 9 kN for each fitting. The rail bridge at 142.710 km was about 7.4 m long and in good condition (Figure 7).

Post-incident track inspection

An examination of the track following the derailment identified misaligned track up to the 142.710 km rail bridge and associated lateral displacement of sleepers. Significant ballast fouling was observed from 16 to 27 m before the rail bridge. The most severe fouling and loss of ballast profile was from about 20 to 24 m prior to the rail bridge (Figure 7). A dip in the track through this mud hole location was observed.

Site evidence indicated that the initial derailment was of a single wheelset that had derailed to the left of the track before the bridge at 142.710 km. The point of mount of the left-hand wheel and the drop-off points of both wheels could not be determined with certainty. There was some indication of the right-hand wheel having dropped inside the right rail about 10 m before the rail bridge. There was further evidence indicating that the second wheelset (of the same bogie) derailed prior to the next bridge at 141.827 km.

Figure 7: Mud hole and track buckle on east track before bridge located at 142.710 km.

Source: Chief Investigator, Transport Safety (Victoria)

This photograph was taken in the early morning of the day following the derailment. The rails had contracted in the cooler overnight temperatures and the magnitude of the track misalignment had reduced from its peak. The photograph shows the heavy fouling of the ballast about 20-24 m ahead of a short rail bridge.

At the location of the mud hole there was severe contamination of the ballast and a loss of ballast between sleepers, and at sleeper ends (Figure 8).

Figure 8: Mud hole at the derailment location

Source: Chief Investigator, Transport Safety (Victoria)

Post-derailment rail stress free temperature measurements

Following the derailment, ARTC reinstated the track during cooler temperatures, and without the need to cut rail. Following track restoration, the stress free temperature (SFT) of each rail was measured by ARTC.^[13] Measurements were made at 142.760 km on the evening of 23 January 2019, with rail temperatures at about 23°C. The ARTC measurements estimated an SFT in the Up rail (left rail looking towards Melbourne) of 34°C, and an SFT in the Down rail of 36°C. It is not known the extent to which stress in each rail may have been equalised along their length as a result of the derailment and the subsequent restoration works.

Pre-derailment track inspections

Track patrols and inspections

The ARTC Track and Civil Code of Practice detailed the requirements for track patrols, general inspections and detailed inspections.^[14]

ARTC undertook track patrols every 7 days or as specified in their Track Maintenance Plan (TMP). These patrols were typically performed from road-rail vehicles. Unscheduled inspections were also carried out in response to ‘defined or abnormal events’ and included those required at special locations where defects were more likely.^[15]

ARTC conducted a range of other general and detailed track inspections to monitor the condition of track infrastructure, ranging in frequency from 6 to 24 months. ARTC standards specified that the general inspection of track stability be conducted as temperatures started to increase after the cold season, normally the end of August, and as close as possible to, or in conjunction with, the ballast general inspection.

Inspection outcomes

Previous inspections had identified the presence of the mud hole on the Creighton (Down) side of the 142.710 km rail bridge, and this was recorded within the ARTC’s Routine Maintenance – Defect Work Orders. Defect Work Orders for at least the previous two years indicated that the mud hole was monitored fortnightly but no remediation was undertaken.^[16] The same inspection finding and response was made in all prior inspections with the report closed-out on the maintenance management system with the note ‘remove mud hole, PO^[17], supervisor, excavator, tamp, undercutter bar 36 tonne ballast’. The most recent track patrol inspection at the location prior to the derailment was conducted by road-rail vehicle on 14 January 2019.

There were no other specific findings or outstanding actions identified from previous general or detailed inspections at this location.

Track geometry

Track geometry was measured every four months using the ‘AK-Car’^[18] to assess geometry against maintenance standards. Parameters measured included track gauge, cant, twist and rail vertical and lateral variation.

The most recent geometry measurements at the derailment location were made on 10 October 2018. The TOP^[19] recorded by the AK car in the vicinity of the mud hole just before the bridge at 142.710 km indicated rapid changes in TOP measurement but was within permitted tolerance. As there was no exceedance of standards, no outstanding actions were recorded. The deviation in LINE^[20] recorded by the AK car was no more than 5 mm in the vicinity of the mud hole, and was within permitted tolerance.

Management of lateral stability of track

Introduction

A track buckle occurs when the longitudinal expansion of rails in hot conditions leads to high compressive forces, and the track structure is unable to prevent the track from moving laterally to relieve the stresses developed within the rails. Managing the lateral stability of track therefore involves both the management of rail stress, and the design and maintenance of track support structures including ballast.

Management of rail stress

Continuously Welded Rail (CWR)

The ARTC code of practice for Track Lateral Stability specified a rail stress-free temperature (SFT) of 38°C in track with CWR. The SFT is the temperature at which there are no temperature induced stresses in the rail.^[21] An SFT is chosen to minimise the potential for track buckle (in hot conditions) and for a rail break (in cold conditions). The SFT of a rail can change over time if there is longitudinal creep of the rail. CWR affixed to concrete sleepers using resilient fasteners has an enhanced ability to resist longitudinal creep forces.^[22]

Rail fastenings

Rail fasteners generate a toe load on the rail flange, providing resistance to longitudinal movement, and to rail roll and lateral shift. High toe loads mean that rail and sleeper are more likely to act as a single assembly.^[23] The resilient fastenings used on track at this location were Pandrol ‘fastclip’.^[24] For concrete-sleepered track, the ARTC standard required a minimum designed toe load per rail seat (two fastening clips per rail seat) of 15 kN for track with axle loads not exceeding 25 t. Although toe load is related to longitudinal creep resistance, there is no direct and consistent relationship.

Monitoring of rail stress free temperature

ARTC track standards specified that rail creep monitoring and control measures would not usually be necessary at locations with CWR with concrete sleepers and resilient fastenings.^[25] The standard noted that this arrangement was known to provide good resistance to longitudinal rail movements, but that ‘practices for the measurement of rail creep should be considered and take into account the influence of fixed points in the track’. ^[26] There were no creep monitoring facilities through the Creighton location.

Changes in a rail SFT are not easily observed in CWR.^[27] ARTC did not check SFT in CWR affixed to concrete sleepers unless it was identified during detailed inspection that the SFT may have lowered. In such cases, ARTC measured rail SFT using VERSE testing.^[28] This testing involved unfastening 30 m of rail and lifting the rail by hydraulic jack. By measuring the lifting force and height, and the rail temperature at the time of the measurement, it was possible to estimate the temperature of the rail at which it would be stress free (the SFT). The ARTC Track Stability Management Plan for the Sydney to Craigieburn corridor for the 2018-2019 high temperature season did not require the SFT of rail to be measured through the Creighton location.

Ballast requirements for lateral resistance

Ballast performs a critical function in maintaining track stability. The ARTC standard^[29] for ballast specified the required ballast profile, and the required corrective action should the profile be diminished (Table 1). Pictorial definitions of the reduced ballast profile are provided at Appendix A.

Table 1: ARTC Ballast Profile Condition - Response Codes

The data was for track with concrete sleepers and curvature >400 m radius, and freight line speed of 115 km/h.

Source: ARTC

The response code table notes^[30] state that ‘in concrete sleepers the responses apply where height and width deficiencies occur over 10 m or greater.

Standard for special locations

ARTC procedures for managing track stability stated that a location that has an increased risk of track stability were defined as a special location.^[31] Further, special locations are defined as areas:^[32]

• potentially vulnerable to instability
• with a history of instability, or
• where the SFT is ‘suspect’.

These procedures stated that special locations may require rectification work or more detailed inspections prior to the high temperature season and typically, special locations may include:

• track sections with a history of lateral instability or pull-apart failures
• bunching points
• areas with non-conforming ballast profile
• sites with localised initiators (e.g. mud holes).

The procedures specified that sites required to be monitored as special locations shall be determined and are to be recorded in the Asset Management System (AMS) and a register attached to the Track Stability Management Plan (TSMP).

Track Stability Management Plan

The Track Stability Management Plan (TSMP) was designed to be regularly updated and included actions to be undertaken to manage track lateral stability in accordance with ARTC standards and procedures.

The TSMP covering the Creighton location applied to defined sections of concrete-sleepered track between approximately 30 and 200 rail-km from Melbourne. It was last updated (prior to the derailment) on 24 September 2018,^[33] and was endorsed by the Corridor Manager Sydney to Craigieburn. The plan included results of Stress Free Temperature (SFT) measurements since the previous plan review, and a schedule of planned SFT measurements. There were no ‘previous’ or scheduled SFT measurements at the derailment location.

The plan noted that after establishment of concrete sleepers between 200.614 and 99.305 km in 2016, inspections had indicated that there had been little or no evidence of creep. Creep measurements were no longer taken and SFT measurements were taken in locations identified during track inspections.

The plan detailed ‘Buckling Resistance Management’ and the requirement to define locations with ballast deficiencies that required temporary speed restrictions when forecast temperatures reached or exceeded 38°C.^[34] There were no such locations identified within the plan.

The plan included a special locations register, although there were no locations listed on the plan provided.

Track buckling predictor

In 2017, ARTC published a document^[35] on the use of a predictor model to assist with the prediction of instability by estimating the rail temperature at which the track was likely to buckle.

The ARTC buckling predictor was based on the Schramm^[36] and Bartlett^[37] models developed in the 1960s. The Schramm model is an empirical model based on field data whereas the Bartlett had a combined empirical and theoretical basis. The output of the predictor model was an estimate the temperature of the rail at which the track may buckle.

The train

Locomotive crew

The drivers for this sector were suitably qualified and had been assessed as medically fit.

Locomotives and wagons

SCT Logistics container service 6BM9 from Barnawartha consisted of two locomotives SCT004, SCT012 and 31 wagons. The first 25 wagons were carrying containerised goods. Wagons 26 to 29 each carried two empty containers, while wagon 30 carried one empty container. The last wagon was not carrying any containers. The train was about 991 metres long and had a trailing tonnage of 2072 t.

The derailed wagon CQTY666T (wagon 29) was a two-slot container flat wagon loaded with two empty containers, each weighing about 2.28 t (Figure 9).

Figure 9: Derailed wagon CQTY 666T

Source: Advisian, Worley Parsons Group.

The wagon was travelling with its B-end leading with the lead bogie CAYE 6300 derailing. The wagon was fitted with AAR 2E, three-piece ride control bogies of nominal capacity 23 tonne axle load. The bogies were fitted with Stucki type constant contact side bearers and conventional AAR 4:1 brake rigging.

Post-incident inspection of wagon

Post-incident inspection of the wagon and the bogies revealed minimal wheel tread wear with moderate operational spalling damage. The light to moderate bolster gibb contact indicated either extended operation on poor track or bogie hunting.

Components of the friction wedge system such as wear plates, friction wedges and bolster pockets were all partially worn, while the wedges and side frame column wear plates were in good condition. The most likely cause of this wear would be inadequate attention to friction wedge pockets in the bolster at overhaul (Figure 10).

Figure 10: Bogie components

Source: Advisian, Worley Parsons Group, annotated by Chief Investigator, Transport Safety (Victoria).

Weather conditions

Around the time of the derailment, the temperature at Shepparton was approximately 38 °C. Shepparton is about 39 km from Creighton and it is probable that conditions at Creighton were similar. From 19 January, the Bureau of Meteorology had forecast a maximum temperature of 39 °C for Shepparton on 21 January 2019.

__________

4. 1435 mm gauge.
5. ARTC is incorporated under the Corporations Act, with all shares owned by the Commonwealth of Australia,
6. Managed by ARTC.
7. RO-2011-015 – Safety of rail operations on the interstate rail line between Melbourne and Sydney
8. Individual trains may be limited in speed depending on their class, rolling stock classification and other criteria.
9. Rail lengths welded end-to-end into strings greater than 400 m.
10. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Sleepers and fastenings, Section 2, Version 2.0.
11. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Ballast, Section 4, Version 2.4.
12. All chainage figures used in this report are based on the asset records maintained by Public Transport of Victoria. There are small differences between these figures and those used by ARTC.
13. Using VERSE system
14. ARTC, Track Patrol, Front of Train, General and Detailed Inspections ETE-00-02
15. Ibid.
16. The mud hole location is identified at ARTC chainage 142.688 – 142.700, that varies slightly from asset system chainages. This mud hole is the same mud hole as that identified on site immediately prior to the point of derailment.
17. Protection Officer.
18. The AK car is a track inspection vehicle also known as a track recording car used to test several geometric parameters of the track without obstructing normal railroad operations. The cars use a variety of sensors, measuring systems, and data management systems to create a profile of the track being inspected.
19. TOP is the up or down variation (vertical) from the mean alignment of the rail and is measured by the AK car.
20. LINE is the variation on a horizontal plane from the mean alignment of the rail and is measured by the AK car.
21. At the SFT, if a small section of rail was removed, the gap would remain constant. It would neither close nor widen unless the rail temperature was to change.
22. Australian Railway Infrastructure standard AS7639:2013 Track Structure & Support.
23. Nafis Ahmad, Shah Sanjar & Mandal, Nirmal & Chattopadhyay, Gopinath & Powell, J. & Micenko, P. (2011). Improvement of rail creep data to measure the stress state of a tangent continuously welded rail (CWR) track
24. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Resilient Rail fastenings for medium Duty Concrete Sleepers – Design ETD-02-02.
25. Fastenings that exert a toe load on the rail foot inhibiting creep.
26. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Track Lateral Stability, Section 6, Version 2.5.
27. By comparison, in jointed track the expansion and contraction of rail can be observed and simple measurements taken at joints to estimate the stress condition of the rail at temperature extremes.
28. VERSE is a proprietary device used for non-destructively measuring the Stress Free Temperature in rail, and is marketed by Pandrol Australia Pty Ltd.
29. ARTC Engineering (Track & Civil) Code of Practice, Section 4 Ballast, 5 September 2012
30. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Ballast, Section 4 - Note 2 to tables 4.3, 4.4 and 4.5.
31. Australian Rail Track Corporation, Managing Track Stability, ETM-06-08, Version 1.1.
32. Australian Rail Track Corporation, Managing Track Stability, ETM-06-08, Version 1.1, Section 3.8.
33. Seymour Track Stability Management Plan
34. In accordance with ARTC Code of Practice – Section 4
35. Track Buckling Predictor ETI-06-06, Version 1.0, 16 March 2017.
36. Schramm, G. (Trans. Lange, H.). Permanent Way Technique and Permanent Way Economy. 1st Edition. 1961.
37. Bartlett, D.L.(1960) The Stability of Long Welded Rails, Civil Eng. and Public Works Review Vol. 55, No. 649, 1033-1035, NO. 650, 1170-1171, No. 651, 1299-1303, No. 653, 1591-1593.

Safety analysis

Lateral Track Stability

When rail temperatures exceed the stress free temperature (SFT) of continuously welded rail (CWR), the rail will be in longitudinal compression. This scenario occurs regularly over the summer period. In this instance, the ambient air temperature was around 38°C. Rail, particularly when exposed to direct sunlight, reaches temperatures considerably higher than the ambient. In this instance, the rail temperature was probably of the order of 57°C.^[38] This rail temperature is about 20°C above the nominal design SFT^[39] and so rails would have been in a state of longitudinal compression in the environmental conditions at the time of the derailment.

Under such conditions, maintaining track stability relies on rail fastenings and track support, including ballast, to resist the forces acting to laterally misalign (buckle) the rails. Ahead of the rail bridge at 142.710 km, there was a mud hole and a loss of ballast profile around sleepers. This reduced resistance to track lateral movement and increased the potential for track instability at this location.

Site evidence was also consistent with a loss of track stability through this location. Deformed track formed an ‘S’ buckle that ended at the rail bridge. The bridge had probably acted as a fixed point.

Inspection of the derailed bogie did not identify defects or out-of-tolerance items, although there was some evidence of bogie hunting. The locomotive driver did not observe the misalignment ahead of the train, meaning the buckle developed under the dynamic loading of train 6BM9. It is possible that bogie behaviours influenced the magnitude of the load on the track. The wagon that derailed was carrying empty containers, probably making it more vulnerable to flange-climb derailment than the loaded wagons earlier in the consist.

Consequences

In this case, one bogie on the freight train derailed, resulting in minor track damage. However, had the bogie of train 6BM9 not derailed on the misalignment that had formed under the train, the XPT passenger service travelling from Sydney to Melbourne may have encountered the track misalignment. It was expected to pass through the location about 80 minutes after the derailment, at 1650.

Factors contributing to track instability

Methodology

In 2017 ARTC published a model for predicting the temperature at which track in a given condition may buckle. The prediction tool was based on older models developed by Bartlett and Schramm.

For this investigation, the part of the ARTC prediction tool that draws on the Bartlett model has been used to examine the potential for track buckle at the Creighton derailment location. Bartlett attempted to quantify the relative importance of rail, fastenings and ballast and developed a quasi-theoretical model.^[40] It is recognised that the model provides an indication only of buckling temperature and sensitivity to key parameters, rather than definitive prediction. The sensitivity to buckling of three parameters are considered; ballast profile, the amplitude of a lateral defect acting as a buckle initiator, and the stress free temperature of the rails.

For modelling using the ARTC buckling predictor, a number of parameters were fixed based on the conditions at site, and with some assumptions (Table 2).

Table 2: Input parameters used in predictor model

Sensitivity to reduced ballast profile

The potential influence of a loss of ballast profile on the predicted track buckling temperature was examined for a range of ballast shoulder widths,^[45] and model predictions made for different values of initial misalignment, and rail stress free temperature (Table 3).

Table 3: Variables used in modelling sensitivity to ballast profile

The predicted buckling temperatures for a range of scenarios was compared to the estimated rail temperature at the time of the incident. The results of the prediction model indicate that at ballast shoulder widths of under 100 mm, track misalignment was plausible, particularly in the presence of a higher initial misalignment and/or lower rail stress-free-temperatures (Figure 11).

Figure 11: The influence of ballast shoulder on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Local misalignment acting as buckle initiator

Ballast through the mud hole was significantly degraded. The potential impact of such a loss of support was two-fold. It resulted in a loss of lateral resistance to track buckle, and also the potential for the development of a lateral ‘initiator’ for track buckling. The most recent track geometry measurement was taken in October 2018, and indicated no lateral defects over 5 mm. However, the measurement was taken prior to the summer period before the derailment. The development within the mud hole of a buckle initiator of increased amplitude either over time, during the passage of other trains prior to train 6BM9, or under train 6BM9, are all possible scenarios. The sensitivity to the magnitude of an initial misalignment was modelled for a range of rail stress free temperatures and a fixed ballast shoulder width of less than 100 mm (Table 4).

Table 4: Variables used in modelling sensitivity to ballast profile

The predicted buckling temperatures for a range of scenarios was compared to the estimated rail temperature at the time of the incident. The results of the predictor model indicate that the magnitude of the buckling initiator is a significant factor in the predicted magnitude of the lateral buckling force and the potential for a heat-induced buckle. The model suggests that with an initial lateral misalignment of over 10 mm, track buckle was plausible, particularly in the presence of lower rail stress-free-temperatures (Figure 12).

Figure 12: The influence of rail misalignment on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Variation of stress-free-temperature over a track section

The SFT of a rail can change over time, either by the rail moving through its fastenings or the track (rail with sleepers) creeping longitudinally. Research has found that SFT can vary considerably over a section of track, particularly near track features such as turnouts, crossings and bridges.

Esveld^[46] reported on research commissioned by the International Union of Railways (UIC) to improve knowledge of forces in CWR track. This work included conducting simultaneous day and night measurements of longitudinal and lateral rail displacements, longitudinal forces in rails as well as temperature of rails in straight-line sections, sharp curves, turnouts and adjoining zones.

Figure 42 from this research (reproduced as Figure 13) shows the longitudinal distribution of stresses (shown as Neutral Rail Temperature (NRT) or SFT as used in this report) measured simultaneously across a 350 m section of tangent track through a complete day-night cycle. Esveld showed that for the rail section studied, the average SFT was approximately 33°C but the actual SFT varied along the length of rail due to two effects. Firstly a variation of about 7°C with a change in actual rail temperature as rail cools and heats during a 24 hour period and secondly, a variation from 27 to 40°C along the length of the rail during the hottest part of the day (in each case disregarding the readings at the extremities of the test section). Therefore, understanding the distribution of stress as well as the variation with ambient temperature is important to understand the risk of buckling.

Figure 13: Typical short-term track response on the straight section of CWR track when the lateral movements reach a few millimetres.

Source: C Esveld (1998) Improved Knowledge of CWR Track, ERRI Committee D202 paper on study commissioned by the International Union of Railways (UIC.

The ARTC standard for installing CWR on concrete sleepers specified an SFT of 38 ± 5 °C. Following this incident, the rails were unfastened, straightened and the SFT of each rail estimated using VERSE testing. The measurements were taken approximately midway between the bridges bounding the section of track in which the derailment occurred. There was not a large difference between the two rails, with their estimated SFT being 35 ± 1 °C.

This instance presented an unusual scenario with bridges at end of a section of about 140 m in length. The extent to which there may have been localised creep towards the bridge at 142.710 km prior to the derailment cannot be ascertained or estimated. By way of example, a localised additional compression of 2 mm over a 20 m length of rail equates to a reduction of about 8°C in the rail’s SFT. This in turn would have the effect of heightening the likelihood of track instability.

Using the ARTC predictor tool, the sensitivity to a localised reduction in rail SFT was predicted for a range of initial lateral misalignments (initiators) and a fixed ballast shoulder width of less than 100 mm (Table 5).

Table 5: Variables used in modelling sensitivity to rail stress free temperature

A localised reduction of SFT of 5-10°C on the measured post-incident 35 °C ‘average’ for the section (to an SFT of 25-30°C) would have resulted in heightened likelihood of track buckle, particularly in the presence of an initial lateral misalignment of more than 10 mm (Figure 14).

Figure 14: The influence of rail SFT on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Summary

It is not feasible to determine the extent to which each facet of the track condition contributed to its instability and vulnerability to misalignment under loading from rail traffic. However, it can be concluded that a reduced ballast profile through the location contributed to track instability either through a broad loss of lateral resistance, or a localised loss of resistance that resulted in an increased value of initial misalignment (buckling initiator).

Any localised reduction in SFT in the rails abutting the rail bridge would also have increased the likelihood of a track buckle forming at this location.

Management of lateral stability at mud-holes

Standards for managing stability

Track ballast

To support management of track stability, ARTC specified maintenance requirements for track ballast, and associated response measures for reduced ballast shoulders. Maintenance records indicate that the mud hole was being monitored (response code A6) and the mud hole listed on the Routine Maintenance – Defect Work Orders. This response was probably in compliance with the ARTC code of practice that specified response codes for a shoulder deficiency over at least 10 m. While the localised ballast profile deficiency in the more severely contaminated area was probably consistent with the profile identified for an A5 or A4 response, this deficiency did not extend the 10 m required by the Code to trigger such a response.

Special locations and treatment

ARTC procedures for managing track stability categorised locations that had an increased risk of track instability as special locations. This potentially included sites with localised initiators like mud holes. The mud hole at Creighton had been identified by ARTC but had not been categorised as a special location. The procedures did not provide clear guidance to field staff on facets of ballast condition within a mud hole that might trigger its designation as a special location. Such criteria may have included mud hole severity, length or proximity to a fixed point that may heighten the track’s vulnerability to lateral instability.

Special locations required rectification work or more detailed inspections prior to the high temperature season. As the Creighton location was not identified as a special location, it was not remedied in line with the special location process.

Track Stability Management Plan

The Track Stability Management Plan (TSMP) was designed to be regularly updated and included actions to be undertaken to manage track lateral stability in accordance with ARTC standards and procedures. The plan detailed ‘Buckling Resistance Management’ and the requirement to define locations with ballast deficiencies that required temporary speed restrictions when forecast temperatures reached or exceeded 38°C.^[47] There were no such locations identified within the plan for the 170 km section that included Creighton.

The plan noted that after establishment of concrete sleepers in 2016, inspections had indicated that there had been little or no evidence of creep. Creep measurements were no longer taken by ARTC and therefore the evidence base for this commentary within the TSMP is unclear.

SFT measurements were taken at locations identified as those where SFT may have been compromised. Evidence suggests identified locations were mostly those areas that had been affected by track disturbance. The criteria for the selection of other sites for SFT testing, that had no clear trigger such as disturbance or compromised geometry, were not clearly defined.

Rail stress management

In those areas on this corridor with established concrete-sleepered CWR track, ARTC did not have a program of network-wide monitoring of rail stress. This maintenance policy appears based on the position that this type of track construction was less likely to creep, and lead to variation in rail SFT of a magnitude that would trigger track buckle or rail breaks. Monitoring of variation in SFT was limited to those sites identified by inspection or following track disturbance, typically from maintenance activity.

The regime established by ARTC for the management of rail stress may not identify all locations in the network with potentially problematic variation in SFT. It could not be established whether the suite of standards and procedures used by ARTC to manage rail SFT, and its implications on track stability, adequately managed this risk.

__________

38. Rail temperatures may be fifty per cent more than ambient. Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010. In this instance the rail was exposed to direct solar radiation.
39. The nominal SFT of rail on this corridor was 38 ± 5 °C.
40. ARTC document ETI0606T-01 Track Buckling Predictor, version 1.0, 16 March 2017, Technical notes.
41. This value is set by the predictor model.
42. A nominal figure has been used consistent with the Schramm model set value of 10m.
43. The model specified options for a factor of 0.1 (Smooth riding wagon), 0.2 (Slightly hunting wagon), 0.3 (Moderately hunting wagon) or 0.4 (Badly hunting wagon). The factor 0.3 was used for all modelling based on the wagon inspection that suggested some hunting behaviour.
44. The model provides a range of 0 and 250000 for tonnes of traffic since resurfacing. This is a measure of interlocking and support of the ballast, and accounts for recent disturbance. Given the fouling and degradation of ballast in the vicinity of mud holes, a nominal, intermediate tonnage value of 100,000 has been has been used to minimise the impact of use of extreme values for this parameter.
45. The width of ballast shoulders at the end of sleepers.
46. Esveld C, Improved Knowledge of CWR Track retrieved 22 September 2020. D202_Paris_98.PDF (esveld.com)
47. In accordance with ARTC Code of Practice – Section 4

Findings

From the evidence available, the following findings are made with respect to derailment of freight train 6BM9.

Contributing factors

• A mud hole and the associated loss of ballast resulted in a reduction in track lateral resistance at the derailment location.
• There were significant longitudinal compressive forces in the rails at the derailment location due to the hot conditions of the day and possibly localised reduction in rail SFT leading into a rail bridge.
• The combination of reduced track lateral resistance and longitudinal compression within the rails was sufficient for the track to misalign under the dynamic loading of train 6BM9, and for one wagon to derail.
• The loss of ballast profile at the derailment location probably required a more significant level of response than being monitored, such as a temporary speed restriction or repair.
• The ARTC systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability. [Safety issue]

Other findings

• ARTC systems for monitoring rail stress free temperature (SFT) in concrete-sleepered CWR track probably did not identify all locations that have SFT outside the Code of Practice guidelines.

Safety issues and actions

Management of track lateral stability 

Safety Issue Number: RO-2019-003-SI-01 

Safety issue description: The ARTC systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability.

Response by Australian Rail Track Corporation

The ARTC advised that this location was not deemed to be a special location. The process for identifying special locations, targets locations susceptible to incorrect SFT and instability.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Australian Rail Track Corporation reviews its processes and criteria for identifying and managing track locations vulnerable to lateral instability, considering the findings of this investigation report.

Additional safety action by Australian Rail Track Corporation

ARTC advised that their Track Stability Management Plan (TSMP) for the 30–200 km section had been reviewed by its internal audit team. As part of the 2019/20 TSMP, 10 sites had been subject to VERSE (Stress Free Temperature) testing, and 13 sites identified as special locations for the monitoring of track stability. This included the Creighton derailment site.

Additional train details

Train details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• SCT Logistics
• Locomotive drivers
• Recorded data from locomotive data loggers.

References

Nafis Ahmad, Shah Sanjar & Mandal, Nirmal & Chattopadhyay, Gopinath & Powell, J. & Micenko, P. (2011). Improvement of rail creep data to measure the stress state of a tangent continuously welded rail (CWR) track.

Schramm, G. (Trans. Lange, H.). Permanent Way Technique and Permanent Way Economy. 1st Edition. 1961.

Bartlett, D.L.(1960) The Stability of Long Welded Rails, Civil Eng. and Public Works Review Vol. 55, No. 649, 1033-1035, NO. 650, 1170-1171, No. 651, 1299-1303, No. 653, 1591-1593.

Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010. In this instance the rail was exposed to direct solar radiation.

Esveld C, Improved Knowledge of CWR Track www.esveld.com/Download/TUD/D202_Paris_98. PDF retrieved 22 September 2020.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from:

• Australian Rail Track Corporation
• SCT Logistics
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – ARTC pictorial definitions of reduced ballast profile

Source: ARTC Engineering (Track & Civil) Code of Practice Section 4 Ballast

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Overview of the investigation

At 0325 Eastern Daylight-savings Time on 6 February 2019, a Pacific National loaded coal train, MR280, travelling from Moolarben to Kooragang Coal Terminal, derailed near Baerami on the Ulan branch line on the Hunter Valley Network. All wheels of the leading bogie of the 88th wagon derailed and travelled in a derailed state for approximately 1.83 km. As the derailed train reached the points of the Baerami crossing loop, another five wagons derailed and three wagons rolled on their side, narrowly missing a stationary empty coal train UL369.

The Australian Rail Track Corporation was the rail infrastructure manager for the Ulan branch line.

ATSB’s preliminary evidence collection revealed:

• There were known track defects constituting a complete track formation failure in the section of track at the point of mount and in the region approaching the derailment site. Post derailment track measurements confirmed there was a failure of the track formation at the site of the derailment.
• These defects were not treated in accordance with the ARTC’s code of practice, and they deteriorated more rapidly than expected and consequently contributed to the derailment.
• The multiple defects acted in a compounding manner but were treated in isolation. ARTC’s code of practice allowed for consideration of multiple defects and the compounding effect and required more stringent action to be taken accordingly.
• It is likely ineffective track drainage in the area of the derailment contributed to the loss of track formation.
• Prior to the derailment, track workers that inspected the section of track where the derailment occurred had identified a defect that they did not report into the asset management system, contrary to the requirements of the system.
• The last train to successfully traverse the section of track was WG949, and the train crew identified rough riding. However, an inconsistent application of the read-back element of network rule ANGE 204 (Reporting and Responding to Conditions Affecting the Network) likely resulted in the rough riding report not being acted upon.
• Train management of MR280 was consistent with operating procedures and the condition of the rolling stock did not contribute to this derailment.

Reasons for the discontinuation

The ATSB considered the contributing factors to the derailment were a result of individual actions, where personnel had not executed the intent of the ARTC code of practice and/or had not followed procedures as required.

In response to the incident, the ARTC took safety action, including:

• implemented a daily ‘known conditions review’ meeting at all provisioning centres so that call outs, TCR’s and known conditions could be frequently reviewed with other current information and ensure appropriate controls were in place for the management of defects
• issued a communication to key operational staff to reiterate the requirements and their responsibilities under network rule ANGE 206.

Based on this information, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues or identify opportunity for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.

Safety summary

What happened

On 28 January 2019, at 1908 Eastern Daylight-saving Time,^[1] a Sikorsky S-64E Skycrane, registered N173AC and operated by Erickson Inc., collided with water at Wood Creek Dam, Victoria. The collision occurred following an approach to the dam to fill an external tank with water for firebombing operations. All the crew exited the aircraft and swam to shore. One crewmember was seriously injured and two were uninjured. The aircraft was substantially damaged.

What the ATSB found

The ATSB found that the approach path to the dam was incrementally shortened over the course of the days’ operation. It is likely that the final tight approach path was at the upper margins of allowable speed and angle of bank, requiring a steep flare that contributed to the aircraft entering vortex ring state on approach.

Furthermore, the shape of the dam and surrounds of the site reduced the opportunity for recovery, and the aircraft impacted the water. The carriage of additional crew increased the risk of injury, while training for emergencies directly supported the crew’s survival.

What's been done as a result

Erickson Inc. advised that the following safety action was taken in response to this occurrence:

• vortex ring state avoidance and recovery was to be emphasised in future training and checking
• a policy preventing non-essential personnel from being aboard during firefighting operations had been introduced.

In addition, the organisation that facilitated operation of the United States‑registered Skycrane during Australian firebombing operations, Kestrel Aviation, advised that the following safety action was also undertaken:

• It was reiterated to pilots that, though aircrew work in close partnership and cooperation with aerial attack supervisors (AAS), AAS instructions are advisory. The pilot in command retains full authority to make decisions to ensure the safety of the aircraft and management support was available if escalation was required.
• Kestrel Aviation increased the frequency of contact with Erickson Inc. crews to provide safety management support, and reduce operational pressure.

Safety message

When performing aerial work it is easy to accept incremental changes that gradually reduce margins. While these changes often increase efficiency, it is worth checking how much an operation has deviated from earlier versions and re-evaluating elements if they appear less stable.

Helicopters excel in confined areas, yet are vulnerable when operating within them. Periodic reassessment of confined areas, and approach and departure profiles, should be done throughout the duration of an operation. Both supervising parties and operating crews are well-positioned to do this.

The ATSB has previously emphasised the importance of Helicopter Underwater Escape Training (HUET) for all over-water helicopter operators. This accident demonstrates the value of HUET in saving lives.

Following an accident, it is common to overlook the need to unplug one’s helmet. Using a good quality extension cable that will maintain the integrity of communications and release under tension in the event of an emergency can also save lives.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) +11 hours.

The occurrence

What happened

On 28 January 2019, a Sikorsky S-64E Skycrane, registered N173AC, operated by Erickson Inc., was prepared for firebombing flying activities at Essendon Airport, Melbourne, Victoria. The Crew Chief, a licenced aircraft maintenance engineer, confirmed the aircraft’s serviceability and readied it for flight.

The crew of N173AC comprised three specialists:

• Pilot in Command (PIC), handling the aircraft and managing the task
• Second in Command (SIC), supporting the PIC with operational calculations and monitoring
• Crew Chief, voluntarily supporting the crew in flight with systems knowledge, and keeping a lookout for obstacles behind the aircraft, from a rearward‑facing seat.

The crew were highly experienced in S‑64 firebombing operations. The PIC had eighteen years’ helicopter experience and had operated the S-64 for four years. The SIC had forty-four years’ helicopter experience, twenty years flying S-64, and had been firefighting in Australia for twenty years. The Crew Chief had thirty-four years’ experience in helicopter engineering, including twenty-six years maintaining and developing the S-64.

All the crew reported that they were acclimatised and well-rested. Both pilots acted as alternating PIC and SIC in two-hour cycles throughout the day. The PIC sat in the left seat, and the SIC in the right. The pilots exchanged positions and roles prior to the beginning of each cycle. The accident occurred on the third cycle of the day.

Figure 1: Sikorsky S-64E Skycrane helicopter, N173AC

Source: Uniform Photography

History of the flight

At about 1000 Eastern Daylight‑saving Time,^[2] the crew repositioned the aircraft to Latrobe Valley Airport, 125 km east of Melbourne. There, they rested and prepared the aircraft while awaiting further instructions. After lunch, the crew was tasked with firebombing activities to the west of Thomson Dam, Aberfeldy, Victoria (Figure 2).

An aerial attack supervisor (AAS) coordinated the aerial assets for the firefighting mission. The AAS identified a dip site.^[3] The considerations for selection of the dip site included:

• no obstacles or wires
• that the site would remain clear of smoke
• the distance from the flame front allowing efficient delivery of suppressant
• aircraft working in concert could fill and drop their load while maintaining safe separation from each other.

Once the AAS identified the dip site, they showed the firebombing crew its location. The firebombing crew then had the final say on the dip site’s suitability for the operation.

Figure 2: Dip site location (Fire boundary as of 31 January 2019)

Source: Country Fire Authority

The dip site was Wood Creek Dam, 7 km west of the fire front. It sat at 3,480 ft above mean sea level, at the eastern base of Mount Gregory, in the Yarra Ranges National Park, Victoria (Figure 3). It had a narrow body and steep sides surrounded by tall trees. The crew assessed the dip site as confined, but not outside acceptable limits of operation.

The flight crew used the Aircraft Weight Reference Guide to calculate how much water the aircraft could carry, and then reduced the calculated figure by 91 kg to optimise performance for departure from the dip site.

Figure 3: The steep sides and narrow body of the dip site pictured from the west

Source: Department of Environment, Land, Water and Planning, Victoria, annotated by the ATSB

The crew used the aircraft’s pond snorkel^[4] to fill the tank. The snorkel required the aircraft to be stationary for up to 45 seconds, and a dedicated pump provided the pressure to fill the tank. While there were operating instructions and a checklist, there were no specific procedures around approaching waterways with a pond snorkel.

The operator classified firebombing as an external load operation, since the suppressant can be jettisoned. Procedures for control of the aircraft during external load operations required:

• descent with any combination of airspeed and rate of descent as long as rate of descent was below 800 ft/min when below 200 ft above ground/water level
• landing with a nose-up attitude of less than 10° in order to avoid tail skid strike
• limiting angle of bank to 30° for safe operation when the Automatic Flight Control System (AFCS) was engaged
• AFCS to be engaged in normal operations in order to smooth pilot inputs
• minimum clearance to obstacles of half a main rotor diameter (11 m for the S‑64).

During filling, the helicopter was positioned one main rotor diameter from the left-hand side of the dam for the PIC to keep visual hover references. This left no more than two rotor diameters to the right.

On each fill, the crew flew a descending right turn, stopped in a high hover, then descended vertically into the dam. Satellite data showed early approaches had a final approach length of 300 m to 400 m. As the aircraft crossed the southern tree line of the dip site, airspeed averaged 30 kt, and the rate of descent averaged 630 ft/min.

After a number of water drops, the AAS re-tasked the crew to fight a flame front further north, which was east-northeast from the dip site. Each drop was also incrementally further north. This resulted in the crew gradually tightening the approach to the dip site (Figure 4).

Figure 4: Change in working location over time

Source: Google Earth, Kestrel Aviation, annotated by the ATSB

During the occurrence approach, the tighter approach resulted in a greater than normal flare^[5] to arrest the aircraft at the aiming point in the dip site. The higher nose pitch up prompted the SIC to advise the PIC to move forward of the trees before descending any further to ensure tail rotor clearance. Clear of the trees, the flare was increased.

While descending with a nose-high attitude, the aircraft struck the water tail-first, submerging and removing the tail rotor, causing rapid rotation to the right through one and half turns. While rotating, the main rotor blades separated as they contacted water. The right cockpit door separated from the fuselage, and the aircraft came to rest on its left side, submerging the cockpit.

Each crewmember recalled the rehearsed drills from their helicopter underwater escape training (HUET). They identified their seat belt and nearest exit to orientate themselves in the aircraft. They all waited until the last moment to draw a breath, and did not unbuckle and exit the helicopter until motion had ceased. The crew reported that it was not possible to see anything underwater, and that jet fuel contamination was present.

The SIC in the right seat exited through his doorway, from which the door was already missing. The PIC could not open his door so he swam across the cabin (up) and was assisted by the SIC to exit through the right hand door. As the rear door was jammed, the crew chief in the aft seat pushed out a window from the rear of the cabin, and exited through it.

Neither pilot unplugged their helmet. However, the extension cords from the aircraft to the helmet plug allowed the plug to release, preventing the helmets from snaring the pilots. All three crew escaped, and inflated their life jackets. Two crew were uninjured, and one crewmember sustained a knee injury.

At the time of the accident, crews aboard S-76 and S-61N helicopters were assessing the potential of the dip site for later use in night operations. An AAS aboard the S-76 relayed details of the accident to an incident controller who enacted the emergency response plan. Neither the S-76 nor the S-61N was equipped or able to provide direct assistance, other than monitoring, and relaying information.

Following exit from the helicopter, the only form of communication available to the Skycrane crew was hand signals. They gave thumbs-up indications to the crew of the overhead S-61N to advise that they were okay. The Skycrane crew then swam to shore and trekked through dense bush to a road where they were met by rescuers.

Meteorological information

The crew received a situation report, including weather and a common barometric pressure^[6] as they began the firefighting activity. Following the failure of a 4G-equipped iPad earlier in the day, beyond this report, the crew did not have access to up-to-the-minute weather data.

The weather on the day saw temperatures over 25°C, a significant reduction from recent heatwave conditions. Winds aloft were northerly and pushed plumes of smoke to the south. The crew and witnesses to the event all assessed the wind to have been a northerly. The crew of the Skycrane advised that the wind had dropped off from around 16 kt and remained a light northerly.

Turbulence was reported to be mild. Outside of smoke, visibility was greater than 10 km. At the time of the accident, the sun was at 258°, and 15° above the horizon.

Locations on the ground showed significant local variation in wind direction and strength throughout the day (Figure 5).

Figure 5: Local variation in wind speed and direction. (15-minute average 1900 to 1915)

Source: Google Earth, Wunderground, Bureau of Meteorology, annotated by the ATSB

Flight recorders

It was a contractual requirement that all firefighting aircraft were equipped with satellite tracking devices. That data was stored remotely from the aircraft and was available shortly after the accident. The system recorded the location, altitude, heading, and groundspeed of the aircraft at 15‑second intervals for the duration of operation.

The Skycrane was also fitted with a Universal Avionics CVR-120 cockpit voice recorder (CVR). Divers recovered the CVR 45 days after the event, once the complex task of recovering the helicopter allowed access to the device. The CVR, submerged for the duration, showed little outward damage, yet voice data could not be recovered from the unit.

Vortex ring state

Vortex ring state (VRS) is a condition of powered helicopter flight that causes a loss of lift in the rotor system. During normal operation, the rotor system pushes large amounts of air down while it produces lift. If the helicopter descends into this downwash, the air can recirculate back up and over the rotors instead of it flowing down and away. This causes the same parcel of air to circulate around the rotor. As a result, the rotor system no longer has the steady stream of air required to produce lift and the helicopter will descend despite the application of additional power.

The United States Federal Aviation Administration Helicopter Flying Handbook details the methods of VRS recovery as follows:

The traditional recovery is accomplished by increasing airspeed, and/or partially lowering collective to exit the vortex. In most helicopters, lateral cyclic thrust combined with an increase in power and lateral antitorque thrust will produce the quickest exit from the hazard. This technique, known as the Vuichard Recovery (named after the Swiss examiner from the Federal Office of Civil Aviation who developed it) recovers by eliminating the descent rate as opposed to exiting the vortex.

The crew were trained to use the Vuichard recovery technique for recovery from vortex-ring state. In the Skycrane, it requires the pilot to apply full power, right cyclic^[7] and left pedal to side slip the helicopter out of its own downwash and into the ascending air just outside of the rotor system.

Safety analysis

Shortening of approach and vortex ring state

The sun progressed to a point low in the west, opposing the crew’s turn onto final approach, and casting long shadows from the steep sides, across the tree line and the surface of the dam. The crew reported that from their angle of approach the surface looked glassy, supporting their assessment of the wind becoming lighter. Video recorded shortly after the event showed that the shape of the dip site and shadows disguised a light tail wind. Wind was only visible on the surface through a 10-degree arc from the south-southwest.

A witness to the event reported that the aircraft had an apparent high rate of descent and a nose‑high attitude. The crew reported that they did not feel that any of the parameters were excessive, though speed and angle of bank were felt to be at the higher end of their normal range.

The satellite data showed the accident approach was a right-hand turn, with about a 30° angle of bank, and a radius of 150 m. The rate of descent developed from 650 ft/min to 780 ft/min. All flight parameters were within operational limits, however the length of the final approach was considerably shorter than earlier approaches (Figure 6).

The shorter approach at the upper end of the acceptable envelope of operation required a steeper than normal flare to stop the helicopter. The crew reported that once they descended below the tree line, the aircraft generated no lift and fell into the dip site, colliding with water. The crew stated that they had very likely encountered vortex ring state (VRS). The topography, high rate of powered descent, and steep flare that reduced the airspeed, created conditions conducive to the onset of VRS. The crew reported that the rapidity of onset and dimensions of the dip site did not provide enough time or space to manoeuvre sideways to effect a recovery.

Figure 6: Shortening of final approach path

Source: Google Earth, Kestrel Aviation, annotated by the ATSB

Carriage of additional crew

The operator’s operations manual stated that only flight crew and crew essential to the operation could be carried aboard the aircraft during firefighting operations. The operation could be conducted without the Crew Chief and not all company Crew Chiefs were on board their aircraft during firefighting operations.

While the Crew Chief had significant system and task knowledge, he was not required to be on board the helicopter. On this occasion, his presence exposed him to the significant hazards associated with underwater egress. More generally, the carriage of additional personnel during specialised operations like firefighting exposes them to unnecessary risk.

Egress from the submerged helicopter

Although two other helicopters were overhead, and their crews had activated the emergency response, no immediate assistance was available to the Skycrane crew. The crew had to rely on their own resources and equipment to survive.

The crew reported that Helicopter Underwater Escape Training (HUET) was fundamental to their survival. HUET enabled the crew to act rationally and decisively when submerged in the cockpit and to use the regularly‑practiced drills to escape the aircraft.

Additionally, the helmet cord release mechanism (Figure 7) prevented snaring and potential drowning after the pilots exited the submerged aircraft without unplugging their helmets.

Figure 7: Helmet cord release mechanism

Source: ATSB

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The crew conducted a tight descending right hand turn into the dam, inside the upper margins of the flight envelope. This approach required a steep flare on arrival and likely resulted in the rapid onset of vortex ring state.
• The dam’s steep sides and narrow tapered body provided limited opportunity for vortex ring state recovery actions, contributing to collision with water.
• The Crew Chief's presence aboard the aircraft during firebombing operations exposed him to unnecessary risk.
• All crewmembers credited their survival to skills learned and practiced in Helicopter Underwater Escape Training. In addition, the helmet cord extension cables detached easily from the aircraft, contributing directly to the crew's egress from the flooded cockpit.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

2. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
3. Dip site: A body of water at which firebombing aircraft draw water for firefighting operations.
4. Pond snorkel: A flexible hose which hangs below the helicopter to allow the tank to be filled from a variety of water sources.
5. Flare: the nose-up pitch of a helicopter used to reduce airspeed and rate of descent.
6. Common barometric pressure: All aircraft in the vicinity set the same pressure on the subscale of the altimeter. This allows aircraft to more accurately maintain vertical separation from each other.
7. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the fore, aft, and lateral direction.