On 21 September 2018, overnight track maintenance works being conducted in the Colac area had necessitated the isolation of the protection equipment at eight level crossings. On completion of the track work, equipment was to be reinstated and the operation of crossing protection equipment tested.
With the completion of the maintenance work, the track was returned to service and train services resumed on the morning of 22 September. However, the driver of a train transiting the area noticed that the level crossing protection equipment at the Hart Street level crossing was not operating. He stopped his train but was unable to prevent it from occupying the crossing. There was no road traffic at the time.
What the ATSB found
The ATSB found that V/Line did not have a documented detailed process for inhibiting and then reinstating level crossing protection equipment. The Signal Maintenance Technician (SMT) undertaking these activities partially restored the Hart Street level crossing equipment before attending to other tasks. He subsequently forgot to return to that crossing to complete its reinstatement and testing, and the track was returned to service with the protection at the Hart Street crossing not operational.
It was also concluded that, for the scope of works on this night, the allocation of a non-rail electrician to support the SMT was very likely of less assistance to the SMT than had a rail-qualified technician been provided.
What has been done as a result
V/Line has developed new procedures related to the task of inhibiting and reinstating level crossing equipment and conducted training for relevant employees in these procedures.
In addition, V/Line has reviewed its resourcing of complex and time critical tasks involving inhibiting and reinstating level crossing equipment.
Safety message
When isolating safety equipment, it is important to have formal procedures that require the recording of the equipment’s isolation, reinstatement and testing, in order to validate that restoration work is completed before rail services resume.
The occurrence
On the night of 21 September 2018, overnight track maintenance works were being conducted in the Colac area. To enable these works, an ‘absolute occupation’[1] applied overnight between Warncoort Loop and Camperdown (Figure 1).
Figure 1: Location diagram
Source: Melways (used with permission). Annotated by Chief Investigator, Transport Safety (Vic).
Due to the likelihood of these works causing damage to track assets, the active protection equipment at eight railway level crossings (RLXs) were required to be placed out-of-service[2] and the associated electrical connections disconnected and cables removed clear of the track.
Level crossing inhibition
A Signal Maintenance Technician (SMT) was engaged to inhibit and later reinstate the crossing protection equipment. To complete the inhibiting task for each crossing, it was necessary to isolate control equipment at the crossing, and to travel to the extremities of the level crossing approach circuits to disconnect cabling.
For the five crossings closest to Colac Railway Station, the SMT initially requested the issue of five Permits To Foul the Line (PTFL)[3] together (№’s 1-5) issued between 2216 and 2226 (Figure 2). This was so he could quickly isolate the protection equipment at these proximal crossings and remove their track connections to allow the track works to proceed.
The SMT then received a call to attend the Colac-Ballarat Road RLX (about 6 km by road from Colac Railway Station). He drove to the location, obtained PTFLs 8 and 9 (issued between 2239 and 2241) for the Colac-Ballarat Road and the nearby Flaxmill Road crossings, and completed the inhibition of these two crossings.
Returning to Colac, the technician completed the inhibition activity on the five RLXs nearby to Colac Station.
Figure 2: Diagram showing the area of works on 21 September, including RLXs
Source: Chief Investigator, Transport Safety (Vic)
Receiving advice of rapid progress, the SMT requested PTFL10 (issued at 0126), then drove to and inhibited the Deans Creek Road RLX (approximately 3.5 km by road from Colac Railway Station).
All eight level crossings were now inhibited.
Level crossing reinstatement
Knowing the Tamper & Regulator Gang had completed work at the Colac-Ballarat Road and Flaxmill Road RLX locations, the SMT returned there (a total distance of about 11 km by road to attend both RLXs), reinstated the in-track equipment, and surveyed[4] the two crossings. PTFLs 8 and 9 (for these crossings) were not returned at that point but were returned later, during the call to the Track Force Protection Coordinator (TFPC) in which PTFL 2 was also returned.
Moving to the Church Street RLX (a further 2.5 km of travel) the SMT reinstated its on-track equipment, surveyed it, and returned PTFL 2 (together with PTFL 8 and 9) between 0518 and 0519. Following this, he reinstated the equipment for the Queen Street RLX (1 km distant by road) and surveyed it as well. However, he could not return the PTFL at this time as the track machines were returning to the Colac yard and were occupying the crossing for a period.
The SMT then reinstated the in-track equipment for Hart Street (1.5 km distant) and went to the location case (the level crossing equipment control box) intending to return the control equipment to operation. However, due to overlapping track circuits[5] not yet being reconnected, the full restoration of the Hart Street crossing protection was not completed at that point in time. The technician then went to undertake other tasks, and subsequently did not return to Hart Street to complete its reinstatement.
By this time, the Tie Renewal Gang had completed their work and returned to the Colac yard, and the SMT commenced to reinstate in-track equipment and survey the remaining RLXs at Deans Creek Road, Cants Road and Armstrong Street.
The SMT then called the TFPC and returned the remaining five PTFLs between 0625 and 0626, including that for Hart Street. He believed he had been to each RLX, reinstated and tested each, and confirmed this belief with the assisting electrician. With this, the SMT considered his work for the shift completed.
At the completion of the night’s work, the track occupation was cancelled by the TFPC. This enabled the recommencement of train services between Melbourne and Warrnambool.
The first train to transit the area was a Warrnambool-to-Melbourne service. Its driver did not report any fault with the RLX. The second service was running from Melbourne to Warrnambool and had departed Colac Railway Station at about 0930. Its locomotive driver noticed that the flashing lights for the Hart Street level crossing were not operating. He made an Emergency brake application but was unable to prevent the locomotive from occupying the crossing. There was no road traffic at the time. The locomotive driver inspected the rail head and train consist wheels for contamination, identifying no issues, and the service was permitted to continue.
Subsequent inspection of the Hart Street RLX active protection revealed that the level crossing protection had not operated because it was still inhibited. __________
The track and associated infrastructure, including the level crossing protection systems, is owned by the Victorian Rail Track Corporation (VicTrack) and managed by V/Line Corporation (V/Line). V/Line is responsible for track and signalling maintenance.
The maintenance work on 21-22 September was part of a tie[6] renewal project, being carried out by V/Line between September and December 2018, to replace sleepers on the Melbourne-to-Warrnambool line.
Resourcing
This project was the first to be undertaken since the inception of a new method for allocating staff to track maintenance projects. The resourcing and support function of projects such as this became the direct responsibility of the corporate Project Delivery team. Previously, local[7] signal maintenance technicians supported projects within their area. From the time of this project, there was greater scope to draw technicians from other regions.
At the commencement of these works, maintenance technicians were not readily available (due to the effects of insufficient staff numbers and annual leave requirements). Thus, for signal maintenance technical support, the Warrnambool tie renewal project required that a technician be drawn from other assignments. The Signal Maintenance Technician (SMT) allocated to support this project was based in Ballarat.
The track maintenance work groups
There were four separate work groups operating within the track occupation:
The Electrical Assets group; a Signal Maintenance Technician and assistant, responsible for removing on-track equipment and for functionally inhibiting any active Railway Level Crossing (RLX) protection prior to the works, and for reinstating it following completion.
The Tie Discharge Gang; engaged in unloading and laying out the new sleepers. They worked ahead of the Tie Renewal Gang.
The Tie Renewal Gang; consisting of more than 40 personnel and about 12 on-track machines to insert the replacement sleepers
The Tamper & Regulator Gang; followed the Tie Renewal Gang with personnel and on-track machinery to restore the track and ballast state in preparation for the resumption of rail traffic.
Supervisor of the four workgroups
The overall on-site workgroup supervisor for the area under the Absolute Occupation was a V/Line Assistant Track Maintenance Supervisor. He had about 30 years’ rail experience.
Signal Maintenance Technician
Qualification and experience
The maintenance technician on this shift was a qualified electrician and Signal Maintenance Technician with around 4.5 years’ experience in the rail industry. He had been involved in V/Line projects since May 2018.
Technician’s roster and sleep
On the Monday prior to the incident, the SMT worked a 10-hour dayshift, then had 26.5 hours off duty. Commencing 1900 on the Tuesday evening, he was then rostered on for 12-hour night-shifts. He worked these night-shifts on the Tuesday, Wednesday and Thursday nights with 12 hours off duty, and reportedly about 6 hours’ sleep, between each shift. He was rostered to work another 12-hour shift on the night of the incident.
The incident occurred overnight between Friday and Saturday. The SMT reported going to bed at around 0630 on the Friday morning following his previous shift, and achieving about 6 hours’ sleep. He commenced work at Wendouree (Ballarat) at about 1930 that evening and drove to Colac to commence his support work. He completed activities on site at about 0630 the following morning, before driving back home.
The work
In the week prior to the incident, the SMT had become aware that signals technical support was required for this tie renewal project and had agreed to be tasked for the project. Work for the project commenced on 4 September and was progressing west.
The level crossing inhibition task required:
the isolation of the RLX active protection by using temporary jumper wires to connect certain system component terminals within the equipment location cases adjacent to each RLX (Figure 3)
the disconnection of signal and track circuit bonding wires from the rails at each RLX
the detachment and removal of any between-rails equipment.
Figure 3: Position of a typical RLX location case (Hart St, Colac)
Source: Chief Investigator, Transport Safety (Vic)
Following completion of work, these actions were reversed, with the addition of a test (survey) at each crossing to confirm its functionality.
V/Line did not have a formal, written procedure describing or defining this sequence of actions. SMTs learnt the processes associated with inhibition and reinstatement through on-the-job training.
Support resources
The SMT had commenced his role on the project working solo but, having become aware of the scope-of-works for the Friday-night shift, requested assistance for that shift.
The SMT was informed that no qualified rail technical assistance was available, but that an assisting electrician from a contract electrical company would be supplied. The contract electrician had no previous rail-based experience but held a Track Safety Awareness qualification and was to work under the technician’s direct supervision.
Supporting documentation
The overlap of adjacent track circuits and unfamiliarity with the location presented a challenge to the SMT. The As-In-Service plans[8] for the RLXs in this region had not been updated since their track-circuited approaches had been extended from 1,000 to 1,300 m about a year earlier. Lacking an up-to-date diagram of arrangement, the SMT was required to inspect the length of each track-circuited section to identify the location of connected equipment.
Worksite Protection
Overall protection
The worksite protection for the four groups was managed by a Track Force Protection Coordinator (TFPC). Their role included establishing the Absolute Occupation Order, and arranging its cancellation at the completion of works. The TFPC held such an Order for the Warncoort Loop-to-Camperdown section (issued at 2209 on 21 September 2018) with Worksite Protection recorded as being in place at 2214. This TFPC was also authorised to issue Permits To Foul the Line (PTFLs).
Signalling workgroup supervisor
The SMT functioned as the ‘Workgroup Supervisor’[9] for his workgroup. He was authorised to have on-site management of an individual or group of people working under the cover of an Absolute Occupation. He was also authorised to seek and hold PTFLs.
Permit To Foul the Line (PTFL)
A PTFL is a paper instrument designed to convey and record the granting of permission to occupy the track between defined geographical limits during the existence of an Absolute Occupation. Relevant portions of the process are described here.
Where the active protection equipment at a railway level crossing (RLX) is to be disconnected (or ‘inhibited’) or its functionality restricted, the workgroup supervisor, who, for this particular task must also be qualified as a signal maintenance technician, must first obtain a PTFL. Work at the location of the RLX cannot commence until the PTFL has been issued.
An SMT may hold multiple PTFLs for the disconnection of active level crossing protection equipment and must be in possession of a separate PTFL for each RLX during the time the active protection equipment is out-of-use at that crossing. The PTFL remains in place until normal operation of the active protection equipment has been restored.
The PTFL must only be issued or cancelled by the TFPC who (at the time) is holding the Absolute Occupation. When a workgroup, including that of an SMT, has completed their work, and all staff, machinery and equipment is clear of the line, the workgroup supervisor must ‘return’ the PTFL to the TFPC by completing the relevant section of the form. The TFPC then cancels the PTFL. This process can be by radio communication.
Toward the end of a busy night shift, the Signal Maintenance Technician (SMT) and his assistant had proceeded to Hart Street to complete reinstating its crossing protection. Track equipment was reconnected, but the reinstatement process for Hart Street was not finalised at that point in time because of a requirement to reinstate track circuit cabling. The SMT and his assistant then attended to other tasks, and forgot to return to the Hart Street level crossing to complete its reinstatement, and test its functionality.
Workload
The rate-of-progress achieved by other workgroups during the evening meant there was competition for the SMT’s attention to have level crossings isolated or reinstated as the works progressed. To satisfy the requirements of the other work groups, the SMT was engaged in considerable to-and-fro travel throughout the work area.
Fatigue
Regularly sleeping for reduced hours can affect human performance. In one study, people reporting more than 7.5 hours of sleep had significantly less probability of falling asleep than those reporting sleep durations of less than 6 hours 45 minutes.[10] Other studies have confirmed that chronic sleep restriction to fewer than 6 hours per night has been shown to impair performance and to increase the tendency to involuntarily fall asleep.[11]
In this instance, the SMT reported that he had had around 6 hours sleep the day before this shift. The technician had switched to a night-shift roster on the Tuesday, and this was his fourth 12-hour night shift. Following the shift change, and as a result of the low sleep hours in the preceding days, it is likely that the technician’s cognitive performance was less than if he’d been well rested.
Process control
SMTs learnt the process for inhibiting and reinstating active railway level crossing (RLX) installations through on-the-job observation. They did not have the benefit of any prescribed procedure for this activity. Thus, there was no formal process available to the SMT by which the individual tasks associated with the isolation or removal of active level crossing equipment could be recorded and then be available to ensure correct and complete reinstatement.
The SMT was handling multiple Permit to Foul the Line (PTFLs) (that was permitted). However, rather than returning each permit individually at the completion of reinstatement of each RLX, the SMT in some cases delayed and then grouped their return. This included the PTFL for the Hart Street crossing, that was returned, away from the Hart Street site, at the end of the SMT’s work. This method of handling the PTFLs removed another potential defence against error.
Project resourcing
The SMT assigned to the project assessed that he would require (and he requested) assistance for Friday’s overnight shift. However, V/Line could not provide a rail technician due to a lack of staffing availability, and provided instead, an electrician who was only able to carry out tasks under direct supervision. As a result, the SMT did not have the benefit of a rail-qualified associate with whom he could divide the task of inhibiting the eight level crossings. Nor was the SMT able to potentially benefit from cross-checking by a rail-experienced colleague.
Given the scope of works to be undertaken by the SMT on this night, he would have benefited from the support of an appropriately qualified rail technician.
Out-of-date ‘As-In-Service’ plans for rail level crossings
System diagrams depicting the arrangement of equipment unique to each level crossing and its associated track circuitry were held within the Public Transport Victoria (PTV)[12] Drawing Management System. Maintaining their currency was the responsibility of V/Line. However, the on-site documentation was not up-to-date. Track circuit distances had changed over the prior year, and this information had not been transferred to the As-In-Service diagrams of the RLXs.
As a result, the SMT expended valuable time in having to identify each RLX circuit without the assistance of accurate documentation.
Previous investigation
In a previous investigation[13] into a ‘short ring incident’ incident at a Colac RLX, the Chief Investigator, Transport Safety (Vic), found that: ‘As-In-Service drawings were found to be inconsistent with the actual site configuration’ and that ‘site working documents for field maintenance staff did not fully reflect the actual system configuration.’
From the evidence available, the following findings are made with respect to the non-operation of railway level crossing protection that occurred in Colac, Victoria on 22 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The Signal Maintenance Technician (SMT) forgot to complete the restoration of the Hart St level crossing.
V/Line did not have a documented detailed process for inhibiting and reinstating level crossing protection equipment. [Safety Issue]
Other factor that increased risk
For the scope of works on this night, the allocation of a non-rail electrician to support the SMT was very likely of less assistance to the SMT than had a rail-qualified technician been provided.
Other finding
V/Line had not maintained up-to-date the system diagrams depicting the arrangement of equipment at each level crossing.
Safety issues and actions
Depending on the risk level of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to rail industry, the Australian Transport Safety Bureau (ATSB) may issue safety recommendations or safety advisory notices as part of the final report.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Safety issue description: V/Line did not have a documented detailed process for inhibiting and reinstating level crossing protection equipment.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
V/Line has reviewed its resourcing levels for complex and time critical tasks involving inhibiting and reinstating level crossing equipment.
Sources and submissions
Sources of information
The sources of information during the investigation included:
V/Line
References
Level Crossing Short Warning Time, Freight Train 9251, Queen Street Colac, 9 July 2008, Chief Investigator, Transport Safety (Vic), Rail Safety Investigation Report No 2008/06, pp 35-36.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to V/Line, the employees concerned and relevant agencies. Submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 20 September 2018, at about 1620 Eastern Standard Time[1], an Airbus A320, VH‑VGZ, operated by Jetstar departed Brisbane Airport, Queensland, on a scheduled passenger flight to Sydney, New South Wales, with six crewmembers and 178 passengers on board.
During the landing roll, the flight crew selected both engines to ‘reverse thrust’ and received an Electronic Centralised Aircraft Monitor (ECAM) ‘reverse fault’. The captain called, ‘no reverse’ and the first officer completed the landing utilising normal braking. The flight crew taxied the aircraft off the runway at the planned exit. The captain later recalled that, during the pre-flight checks, he had not observed any indications on the engine cowls, in the cockpit or on the technical log to show that the thrust reversers were de-activated.
There was no damage to the aircraft, or injuries sustained during the incident.
Engineering inspection
Following the incident, an engineering inspection revealed that the thrust reversers were in the de‑activated position; with the minimum equipment list (MEL) lockout pin installed (Figure 1). The lockout pins were removed from each of the engines, thrust reversers were tested and found to be serviceable, and the aircraft was returned to service.
Figure 1: MEL lockout pin installed in thrust reverser hydraulic control unit (HCU)
Source: Operator, annotated by the ATSB
Maintenance prior to the incident flight;
On 17 September 2018, VH-VGZ arrived at the Qantas maintenance facility in Brisbane, Queensland. The aircraft was scheduled for a three-day maintenance check and was due to return to service at 2040 on 20 September 2018.
Two days into the maintenance, the engineers identified that the horizontal stabiliser actuator required replacing, which added half a day of work to the schedule. To recover the lost time, a team was organised to begin work at 0400 the following day. At about 0600 on 20 September 2018, the actuator replacement was completed and the team proceeded to finalise the remaining scheduled maintenance tasks.
At about 0840, a licenced aircraft maintenance engineer (LAME) completed and certified the task card for a required thrust reverser functional check. Based on the system test of the thrust reversers, but contrary to the required procedure, he also completed the certification for the same check on the ‘hangar release’ task card.
The check coordinator (CC) instructed the engineering team to return all equipment to the tool crib, so that he could complete signoffs on the work packages. Two hours later, the CC received a call from Jetstar to inform him that the aircraft departure time had been brought forward to 1620. The CC assessed the request based on outstanding workload, certification and resource requirements and accepted the reschedule. The CC communicated the new schedule to the engineering team. To avoid a shift handover during the final maintenance signoffs, the CC instructed the engineers to complete the maintenance by the end of first shift at 1500. Due to the compressed schedule, many of the engineers worked through their lunch breaks to ensure they could complete the maintenance on time.
After completion of the engine ground run checks, the engineers discussed the remaining maintenance items on the ‘hangar release’ task card (Figure 3), giving consideration to the limited time remaining. The engineers noted that:
the thrust reverser functional check was not a requirement in the aircraft maintenance manual (AMM) following the engine leak check
the functional check on the hangar release card had already been signed concurrently with the thrust reverser functional check completed earlier that morning.
On that basis, and with consideration to the remaining time, the engineers decided that they did not need to repeat the functional check on the thrust reversers after completing the engine leak checks. That was contrary to the requirements associated with releasing the aircraft back to service (see the section titled Maintenance procedures).
Shortly after, the engineers pushed the aircraft out of the hangar to complete the final checks, which included the engine leak checks. The AMM engine leak check procedure required the left and right engine thrust reversers to be de‑activated. The de-activation procedure specified the use of warning notices in the cockpit and a lockout pin with a red warning flag attached (Figure 2). The AMM lockout pin was located in the tool crib. Checking out the AMM lockout pin from the tool crib would have resulted in delays to the closure of the work package as that could only be done when all tools were checked back in. The MEL lockout pin, which was functionally the same but did not have a warning flag attached, was located inside the engine cowling. In an effort to keep to schedule, the engineers decided to use the MEL lockout pin as a substitute. The engineers did not put additional warning notices in the cockpit for thrust reverser de-activation as they considered the ‘maintenance in progress’ notice to satisfy the AMM requirement.
The installed MEL lockout pins were not identified following completion of the engine leak check procedure. Consequently, both engine cowlings were closed with the lockout pins in place and the thrust reversers inoperative.
Figure 2: Lockout pin with warning flag
Source: Operator
At about 1240, 3 hours and 40 minutes prior to the incident flight, the final paperwork was completed and the engineers released VH-VGZ to service.
Maintenance procedures
A typical work order for any maintenance check contained a number of ad hoc task cards that were required to be completed and certified to record the work done. During aircraft maintenance checks, ‘non-routine’ task cards could be raised by the engineers to complete defect rectification or other work resulting after carrying out inspection tasks of the check’s work pack and/or technical log defects.
The ad hoc task card for the hangar release check, contained a note regarding the importance of completing all post-maintenance checks as standalone tasks; and provided an order of jobs to be completed sequentially (Figure 3).
Figure 3: Operator’s task card for A320 hangar release check
Source: Operator, annotated by the ATSB
Engineers’ comments
The maintenance engineers provided the following comments after the incident:
During the final maintenance tasks, some of the engineers reported feeling tired as a result of a combination of factors including:
early start times
skipped meal breaks
circumstances outside work, which had limited their ability to get quality sleep the previous evening.
Each of the engineers felt a sense of responsibility and pressure to provide on-time performance to the customer.
The schedule compression and increased pressure for on-time performance influenced their decision to use the MEL lockout pin, as it would not delay the completion of the maintenance paperwork.
At the start of the maintenance check, the engineers placed a generic ‘maintenance in progress’ warning notice over the controls in the cockpit. The generic warning notice was considered by some of the engineers to concurrently satisfy the requirement in the individual AMM tasks to place specific warning notices over the controls.
Qantas’ comments
Following an internal review of the incident, Qantas provided the following comments:
The individuals involved in this occurrence were all working in compliance with the maintenance organisations’ approved fatigue management framework.
The awareness of following the AMM safety precautions steps, such as placing specific warning notices over the controls, at the Brisbane base was not as robust as it should be.
Safety analysis
Following non‑operation of the thrust reversers during the landing roll, an engineering check revealed that the MEL lockout pins were installed in the hydraulic control units (HCU) resulting in deactivation of the thrust reverser system. The pins were installed as part of required maintenance action and unintentionally not removed prior to flight.
Although the AMM procedure did not require a functional check of the thrust reversers following reactivation, the operator’s task card did. The task card was a supplemental procedure to the AMM and it was a requirement that a licenced engineer sign and certify that each step was completed. The task card specifically noted the importance of conducting the post‑maintenance checks as stand-alone tasks. Contrary to the written procedure, the engineers did not follow the task card sequentially and signed off the operational check based on testing that they had completed earlier in the day. While that action was probably motivated by the desire to expedite the aircraft’s return to service, if the engineers had completed the functional check in sequence, they would have discovered that the thrust reverser was still de-activated.
Although the required operational check of the thrust reverser would have prevented this incident, other maintenance actions hampered detection of the HCU lockout. Thrust reverser de-activation required the use of a lockout pin with a red flag attached to provide a visual indication that the HCU was de-activated. The MEL lockout pin that was actually fitted was designed for in service use and was much less visually obvious than the pin used during maintenance.
The replacement of the horizontal stabiliser actuator and change to the revenue flight departure time had a compounding effect on the maintenance schedule. The engineering team probably felt pressure to expedite the maintenance, working through meal breaks in an effort to achieve this. The engineers stated that they felt pressured to return all tools to the tooling crib so that the CC could complete the paperwork, and that this was an influential factor in their decision to use the MEL lockout pin.
The AMM thrust reverser de-activation procedure also required the use of specific warning labels in the cockpit, stating that ‘thrust reverser HCU is de-activated’. However, it was reportedly common practice to only use a generic maintenance warning notice. That action, in combination with use of the MEL lockout pins, removed opportunities to identify the status of the thrust reverser system during the final inspection, and before the aircraft was returned to service.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Deviation from the required maintenance procedures resulted in the aircraft being returned to service with the thrust reverser system inadvertently deactivated.
Operational pressure to expedite the maintenance probably influenced the engineers’ decision to deviate from the written procedures.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Qantas Engineering
As a result of this occurrence, the maintainer has advised the ATSB that the following safety actions were taken:
A Quality Alert was issued, with a requirement for all Brisbane‑based maintenance staff to read and sign. The Quality Alert reminded engineers to ‘always use the lockout pins issued from the tool crib unless a MEL is required to be applied to the aircraft.’
The occurrence was discussed with all Jetstar’s aircraft-certifying staff, including the effect of perceived time pressures and the importance of documentation and compliance.
A review of the process of previous lockout pin management in Brisbane was conducted to rule out a systemic problem with lockout pin management.
All A320 thrust reverser lockout pins were inspected to confirm they were correctly identified and flagged.
An A320 de-activation board, containing the correct A320 lockout tooling, has been constructed. The trolley will sit next to the aircraft during maintenance visits for ease of access.
Safety message
Operational pressures are a reality of the aircraft industry, with aircraft delays having a substantial cost impact to operators. Such time and production pressures have the potential to influence safe work practices. It is imperative in the aircraft maintenance industry that, at all levels of an organisation, employees feel empowered to stop a process when they observe procedural violations or foresee that an error is likely to occur.
This incident serves as a reminder that a failure to follow procedures, such as functional checks, can result in unintended consequences. Functional checks are the last line of defence in maintenance work and can identify a range or errors that may have occurred during the job completion process. The extra few minutes taken to complete a functional check could detect an unsafe situation.
The United States Federal Aviation Authority has conducted research into the topic of ‘failure to follow procedures’. A number of useful articles and training tools can be found on their website, including:
Recognising that there was no identified fatigue-related contribution to this occurrence, some of the engineers noted that they were feeling tired while completing the final maintenance checks.
The ATSB SafetyWatch report, Fatigue, provides information on how to recognise if fatigue may be affecting your performance.
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 4 September 2018, the ATSB commenced an investigation into high engine vibrations involving Avro RJ100, VH-NJY, on a flight from Prominent Hill, South Australia, to Port Augusta, South Australia on 30 August 2018. The Bureau of Meteorology had issued a significant meteorological information (SIGMET) for severe turbulence and icing along the aircraft’s planned flight path. The flight crew were aware of this SIGMET and later recalled it to be consistent with the actual conditions encountered in flight.
When cruising at FL 250[1] in instrument meteorological conditions, an engine vibration caution was annunciated on the master warning panel (MWP). The flight crew identified the number 4 engine was indicating 1.8 units of vibration (more than the specified maximum of 1.2 units). About this time the flight crew observed ice build-up on the windscreen. They commenced the applicable checklist actions, and the fault message cleared before the checklist was completed.
The MWP then indicated a second engine vibration caution, and the crew identified that the number 2 engine was indicating 2.1 units of vibration. They performed the applicable checklist actions for the number 2 engine, and the fault annunciation cleared. The flight crew then descended the aircraft to FL 190, where the outside air temperature was higher, to prevent further icing. In consultation with the operator, the flight crew elected to divert to Adelaide rather than continue the flight to Port Augusta. No further excessive engine vibrations were encountered.
The ATSB obtained additional information from the flight crew that identified that the crew had selected the engine anti-ice system on prior to the occurrence. This and other airframe anti-ice systems were reported to be functioning normally. The ATSB also obtained data from the aircraft’s flight data recorder for the flight.
The ATSB reviewed the available information relating to this occurrence as well as information from its database associated with any similar previous occurrences involving the same aircraft type. Based on this review, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
___________
[1] Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
On 14 August 2018, a Virgin Australia Regional Airlines (VARA) A320, registered VH-FNP, was prepared for a scheduled passenger flight from Perth Airport, Western Australia, to Christmas Island. Landing gear ground locks (LGGL) were fitted to the landing gear of FNP during the preparation, and were not removed prior to pushback. A ground handler removed the locking pins from the LGGL, but did not remove the associated sleeves.
As the aircraft was pushed back, taxied and took off from Perth Airport, the LGGL sleeves fell from the landing gear, onto a taxiway and Runway 21. The remainder of the flight was uneventful and FNP landed safely at Christmas Island.
What the ATSB found
The ATSB found that a lack of documentation relating to installing and removing LGGL from VARA A320s, and an ineffective handover of responsibilities between two engineers, contributed to the engineers not detecting that the LGGL remained installed during the preparation for flight.
Although the flight crew aircraft exterior walk-around check identified the LGGL, this was at a time when the flight crew did not have access to the flight deck due to maintenance work on the flight deck. The disrupted pre-flight sequence for the flight crew contributed to the flight crew later not identifying that the LGGL were missing from the stowage compartment on-board.
There was no procedure for making maintenance log entries when LGGL were installed and removed. A maintenance log entry relating to LGGL would have provided another opportunity for both the flight crew and the on-board engineer to become aware that the LGGL had not been removed and stored on-board before flight.
Rather than inform an engineer or pilot as per procedures, the pushback driver removed the LGGL pins from the landing gear sleeves before pushback. This decision was affected by time pressure and prior experience removing pins from another aircraft type. However, as the lanyards attaching the pins to the sleeves was missing and the pushback driver did not understand the LGGL locking mechanism, he removed the pins and not the sleeves.
What's been done as a result
VARA introduced procedures requiring an authorised person to sign an Aircraft Readiness Log to certify that LGGL had been removed prior to flight. If the aircraft has been towed after the initial check, the check must be performed again. Towing procedures also now require the approved brake rider to ensure that LGGL have been removed after a positional tow.
VARA have also issued a notice to flight crews instructing them to use a standardised method for stowing LGGL pins and sleeves. A separate notice reminds ground handlers they should not remove pins themselves.
Safety message
This investigation highlights how a number of relatively small errors and/or omissions, associated with separate functional areas, can combine to potentially affect flight safety. In this case, the identification and rectification of any one factor would probably have significantly reduced the likelihood of the occurrence developing.
While all persons working in and around aircraft have specific roles, they also have a responsibility to notify the operating crew about any concerns they may have with the aircraft. It is imperative that any concerns are assessed and rectified by appropriately qualified personnel before flight.
The occurrence
What happened
On 14 August 2018, Virgin Australia Regional Airlines (VARA) was operating an Airbus A320-231 (A320), registered VH-FNP (FNP), on a scheduled passenger flight from Perth, Western Australia to Christmas Island. The scheduled departure time was 1305 local time.
Aircraft tow to departure bay
To prepare for departure, ground handling personnel towed FNP from the domestic apron to its departure bay at the international terminal. In preparation for this tow, a VARA Aircraft Maintenance Organisation (AMO) engineer (the apron engineer) fitted landing gear ground locks (LGGL)[1] to the landing gear of FNP. The apron engineer then performed the aircraft brake operator (ABO)[2] duty, as FNP was towed onto its departure bay at 1117.
At 1121, the apron engineer left FNP, as he had been instructed to supervise the refuelling of another aircraft. The apron engineer anticipated that he would return after the other aircraft had been refuelled, at which time he planned to supervise the refuel of FNP and remove the LGGL.
During this time, VARA engineers were working in the cockpit of FNP to rectify a defect with a navigational display. Another engineer who was travelling with FNP to Christmas Island (on-board engineer), was assisting with the rectification work. When the apron engineer left FNP, he anticipated that it might sit for some time due to the rectification work, possibly resulting in the aircraft being unserviceable for the planned flight.
Pre-flight walk-around
The flight crew for FNP comprised the captain, first officer (FO), and an augmenting crewmember.[3] For the first sector (to Christmas Island), the captain would be pilot flying (PF) and the FO would be pilot monitoring (PM).
The flight crew arrived at the aircraft about one hour before the scheduled departure time. The crew were unable to access the cockpit to conduct their pre-flight procedures because of the rectification work. An engineer advised the captain it would take about 30 minutes to complete the works, so the crew waited in the passenger cabin.
The captain tasked the augmenting crewmember with conducting the exterior walk-around, which he commenced at about 1202. During the walk-around, the augmenting crewmember observed that the LGGL were still fitted. He considered removing the LGGL but determined he could not do so safely.
After completing the walk-around, the augmenting crewmember returned to the cabin, and reported to the captain that the LGGL remained installed. The captain acknowledged this, and anticipated that the normal departure procedures would lead to the removal of the LGGL prior to flight.
Refuelling
As the departure time approached, the apron engineer identified that he would be unable to return to FNP in time to supervise the refuel. Consequently, he phoned the on-board engineer and asked that he take over the remaining engineering duties for FNP, including supervising the refuelling.
At 1217, 48 minutes before the scheduled departure time, the on-board engineer left the flight deck of FNP. When the on-board engineer arrived at the refuelling console (on the fuselage under the wing), the refueller was already at FNP and had been waiting for some time. The on-board engineer recalled that the task of supervising the refuelling had been given relatively late in the pre-departure schedule for FNP.
From 1217 to 1245, the on-board engineer supervised the refuel, then returned to the flight deck.
Pre-flight cockpit preparation
The flight crew gained access to the cockpit about 30 minutes prior to the scheduled departure time. This was about 30 minutes after the augmenting crewmember had advised the captain that the LGGL were still installed.
The captain and the FO commenced their pre-flight procedures and checklists, performing allocated tasks as PF and PM respectively. These procedures started about 30 minutes later than normal, relative to the scheduled departure time.
Pushback and dispatch
At about 1247, the pushback driver and the dispatcher, employed by the ground handling agent Swissport, were in a pushback tug vehicle in front of FNP. The ground handlers had finished loading baggage onto the aircraft and were waiting for passengers to board before commencing pushback (using the tug vehicle) and dispatch duties.
While waiting in the pushback vehicle, the pushback driver saw pins and associated flags attached to the landing gear of FNP, which he considered unusual. The pushback driver made multiple attempts to radio the aircraft movements co-ordinator (AMCO) over a period of about 10 minutes, in order to request an engineer to inspect the pins. The pushback driver was unable to contact the AMCO.
At about 1258, seven minutes prior to the scheduled departure time, the pushback driver removed the LGGL pins from the landing gears, but unknowingly left the associated locking sleeves in place. The pushback driver placed the pins in the pushback vehicle.
Shortly after, the pushback driver went into the cockpit to have the load sheet signed by the flight crew. The dispatcher communicated with the crew via a headset plugged into the aircraft, to confirm all doors and panels were secured and that the aircraft was clear to push back. Neither ground handler mentioned the LGGL to the crew.
As FNP was pushed back, at about 1328, one of the LGGL sleeves fell unnoticed from the aircraft onto the taxiway. As FNP took off at 1339, a second sleeve fell from the aircraft onto Runway 21.
Identification of foreign object debris
In the two hours following the departure of FNP, there were a number of reported observations of foreign object debris (FOD) on Perth Airport runways and taxiways.
At 1414, the crew of an arriving aircraft contacted air traffic control to report sighting FOD on Runway 21. A Perth Airport operations officer inspected the runway, but was unable to detect the FOD.
At 1420, another arriving aircraft reported observing FOD at the northern end of Runway 21. A second operations officer located one of the LGGL sleeves adjacent to the Runway 21 precision approach path indicator.
At 1510, the second LGGL sleeve was located in the taxi line behind bay 153/154.
Approach to Christmas Island
On descent into Christmas Island, the flight crew of FNP received a satellite phone call from VARA flight management, who advised of the discovery of LGGL parts at Perth Airport and asked that the flight crew check the flight deck stowage compartment for LGGL pins and sleeves. The flight crew identified that the LGGL parts were missing from the stowage compartment.
Considering the LGGL were unaccounted for, the flight crew identified there was a risk the landing gear was potentially damaged. The flight crew modified their approach plan so that the landing gear was lowered earlier, which gave the flight crew additional time to respond to any abnormal indications.
The approach and landing into Christmas Island was uneventful. The landing gear operated normally and there were no other indications of abnormalities.
Upon landing at Christmas Island, the flight crew notified the on-board engineer that the LGGL had not been stowed on-board FNP. The on-board engineer conducted a visual inspection of the landing gear and underside, and observing no damage, certified that FNP was serviceable.
The planned flight to Christmas Island was part of an Indian Ocean Territory (IOT) service, which VARA operated twice a week. On the day of the occurrence, the service departed from Perth to Christmas Island, before continuing to Cocos Islands then returning to Perth.
Augmented crew
Due to the duty time length for the IOT service, VARA operated the occurrence flight with an augmented crew. The augmenting crewmember on-board FNP was a training Captain who was qualified to perform the roles of both the first officer (FO) and captain.
The augmenting crewmember did not have any specified duties in the pre-flight sequence. However, it was common practice for augmenting crewmembers to conduct the exterior walk-around. The IOT service contained several additional requirements in terms of the pre-departure workload for the flight crew, so delegating the walk-around to the augmenting crew reduced the load on the pilot monitoring.
A320 Landing Gear Ground Locks (LGGL)
Landing gear ground locks are used to ensure physical down-locking of landing gear during towing operations when hydraulic power supply is not available. The LGGL for Airbus A320 aircraft comprise locking sleeves that fit around the landing gear, preventing the collapse or retraction of that gear, and pins that hold the sleeves in place. There are two types of LGGL used on A320s, those which secure the landing gear strut and those which secure the landing gear door actuating cylinder. The LGGLs installed on FNP were landing gear strut lock sleeves.
Figure 1 illustrates the design of the LGGL, whereas Figure 2 shows the LGGL used on FNP.
In normal operations, the LGGL would be removed from the aircraft prior to flight and stored in the flight deck stowage compartment.
Figure 1: Schematics showing design of LGGL strut locks
Source: Airbus, amended by ATSB
Figure 2: LGGL pins, flags and sleeves installed on VH-FNP
Source: VARA
As shown in Figure 1 and Figure 2, the LGGL have several design features to make them conspicuous. The LGGL sleeves are painted red and the pins have high-visibility flags attached.
Under normal conditions, a wire lanyard secures the LGGL sleeves to the pins, preventing separation of the two components. The lanyards were missing for both sets of LGGL on VH-FNP (FNP), a condition that had not been reported prior to the occurrence. The operator conducted a check across their fleet and missing lanyards were also found on two other aircraft.
VARA AMO procedures for using LGGL
The ATSB reviewed the systems and procedures in place to manage the installation and removal of LGGL from VARA A320 aircraft during and after a positional tow.[4]
VARA Approved Maintenance Program A320 (AMP)
This manual provided a detailed description of maintenance procedures for VARA A320 aircraft, and was applicable to VARA Aircraft Maintenance Organisation (AMO) personnel. The AMP did not provide procedures for towing. There were no procedures relating to installing or removing LGGL following a procedural tow.
A320 Aircraft Maintenance Manual (AMM)
This manual described the maintenance procedures for the A320 as specified by Airbus. The AMM stated that safety devices (LGGL) were to be installed on landing gear prior to towing. The AMM did not describe steps for removing LGGL after completing a tow.
Virgin Group Operations Manual: Airport Airside Operations Manual (AAOM)
The AAOM provided instructions for towing Airbus A330 and Boeing 737 type aircraft. The instructions specified the requirement to install and remove LGGL, and that the Aircraft Brake Operator (ABO) riding on the aircraft during the tow was responsible for doing this task for these aircraft types.
The AAOM did not describe towing procedures for A320s, nor the responsibilities of the ABO for this aircraft type. The only mention of landing gear pins on A320s in the AAOM was in the section on aircraft dispatch procedures for A320s and Fokker 100 aircraft. These procedures stated that removal of landing gear pins was the responsibility of the flight crew and engineering.
VARA line maintenance procedures (LMP)
The LMP in effect at the time of the occurrence (dated 11 September 2017), noted that towing should be conducted in accordance with the AMM. Limited other guidance was provided in these procedures and there was no documentation for installing or removing pins as part of towing procedures. The section titled ‘Removal of locking and safety devices’ was empty, denoted as ‘Reserved’.
The previous version of the LMP (dated 9 September 2016) provided a summary description of the tasks involved in towing aircraft, but did not document a step for removing LGGL after a tow was completed. The section titled ‘Removal of Locking Devices’ stated:
The captain was responsible for ensuring all locks prior to flight, and must confirm with the first officer that lock pins had been removed and stowed on board the aircraft.
Authorised aircraft maintenance engineers must remove locks and stow them on the aircraft.
The dispatcher would provide an additional check during the pre-dispatch walk-around to ensure all locks had been removed.
Procedures as understood by engineers
The ATSB found that there were no specific procedures for removing LGGL from A320s after a positional tow. Consequently, the ATSB examined the engineers’ understanding of the process for installing and removing LGGL.
At interview, the on-board engineer said that the normal sequence after towing an aircraft onto the departure bay was for the engineer to remove the LGGL and stow them on board the aircraft. The on-board engineer indicated it was not normal practice to leave the LGGL on aircraft.
The apron engineer said it was approved practice for engineers to leave pins in place after towing an aircraft, particularly if the aircraft was likely to sit for a while or may be unserviceable and towed off the bay. In such circumstances, engineers would leave the LGGL installed after performing the tow and only remove the LGGL when they returned to supervise the refuel.
Recent changes to pre-flight engineering duties
In the months preceding the occurrence, changes to the responsibility for performing pre-flight dispatch duties for VARA aircraft affected the procedures used by engineers.
Prior to the change, VARA AMO engineers were responsible for dispatch. The process included a walk-around safety check, including a check of the landing gear prior to the departure of each aircraft. Engineers involved in this occurrence said that any LGGL left installed through the preparation of the aircraft would be removed at this point.
On 21 May 2018, Swissport (then Aerocare) took responsibility for dispatch duties. AMO engineers advised that they continued to conduct informal walk-arounds after dispatch duties transferred to Swissport, although there was no requirement to do so. The on-board engineer advised that he did not perform a walk-around after supervising the refuel of FNP because he perceived that he was running late and there was no requirement to perform a walk-around.
Handover of VARA AMO Engineering Duties
For this incident, the handover of engineering duties for FNP was conducted orally (via mobile phone). The two VARA AMO engineers recalled that they could clearly hear the other. However, their recollections of the handover content differed:
The apron engineer recalled that he advised the on-board engineer that FNP was on the bay and needed to be refuelled. The apron engineer also recalled that he advised that the pins (meaning LGGL) were still installed on FNP.
The on-board engineer recalled that the request was to perform the refuel only and that he was not told that the pins remained on FNP.
The apron engineer recalled he perceived the handover had been effective at the time. Neither engineer recalled confirming their understanding of the remaining tasks following the handover.
The VARA AMO did not have documented procedures or training relating to the handover process between engineers.
Flight crew pre-flight procedures and checklists
Formal procedures and checklists are essential for overcoming the limits of pilot memory, and ensuring that actions are completed in sequence and without omission. According to Degani and Wiener (1990):
The major function of the flight deck checklist is to ensure that the crew will properly configure the airplane for any given segment of flight. It forms the basis of procedural standardisation in the cockpit
The pre-flight procedures and responsibilities for VARA A320 flight crews were described in the Flight Crew Operating Manual A320 (FCOM) and the A320 Quick Reference Handbook (QRH)
Preliminary cockpit preparation
The flight crew perform the preliminary cockpit preparation procedure prior to all flights. The procedure included checking that the three landing gear pins and pitot tube covers were on board and stowed. The QRH assigns this duty to the pilot monitoring (PM).
The FO and the captain indicated that the normal sequence was to check the stowage compartment during the process of exiting the cockpit to conduct the exterior walk-around checks. The stowage compartment on-board FNP was located in such a way that it was difficult to check the LGGL while seated in the flight seat.
The ATSB noted that the check of the stowage compartment was not necessarily dependent on the walk-around, although the crew perceived the tasks were normally performed together.
Exterior walk-around
The exterior walk-around was part of the normal duties for the PM and occurred immediately after the preliminary cockpit preparation procedures. The exterior walk-around comprises a sequential check of the exterior of the aircraft, including checking that the nose, left main, and right main landing gear safety pins have been removed.
The VARA Flight Operations Policies and Procedures Manual (FOPPM) was applicable to all aircraft operated by VARA. The FOPPM described additional procedures applicable where LGGL remain fitted during the exterior walk-around. In these circumstances, the FOPPM stated that the captain must:
Direct that the LGGL are removed prior to taxiing.
Confirm the LGGL have been removed by the display of the locks/pins by an authorised person from an appropriate position on the ground.
Acknowledge (in the form of a ‘thumb up’ sign) indicating he/she is satisfied that all locking devices have been removed. (The first officer can also perform this acknowledgement).
The augmenting crewmember performed the exterior walk-around for FNP according to procedure, before returning to the aircraft and telling the captain that he had observed the LGGL were still installed. The augmenting crewmember conducted this walkaround while the remaining flight crew were waiting in the passenger cabin. However, there is no evidence that the captain subsequently directed or confirmed the removal of the LGGL as documented in the FOPPM.
Before start checklist
The Before start checklist is part of the Normal checklist and is called after cockpit preparation is completed. The VARA A320 Normal checklist was designed such that all actions should be completed from memory prior to the flight crew calling for and performing the Normal checklist, reading from a laminated card. The VARA FOPPM stated:
The normal checklist is the most effective method of identifying procedural omissions and is the last line of defence in preventing an undesired aircraft state.
The Normal checklist is a challenge-response type checklist. The pilot flying (PF) was responsible for calling for the checklist, while the PM was responsible for reading checklist items. The PF was then responsible for checking the relevant system, before responding to the PM. For the ‘Cockpit Prep is completed’ checklist item, both the PM and PF are responsible for confirming the status of the aircraft.
The Before start checklist was designed to be performed in two parts, with the parts separated by a line. The crew had to perform checks of seven aircraft systems before pushback, then four further system checks after pushback. The first two items on the checklist were:
Cockpit Prep is completed
Gear Pins and Covers are removed
The captain reported that although he was aware the flight crew did perform the Before start checklist, he did not have a specific memory of this checklist from the occurrence flight. The FO did not report any details about the Before start checklist either. Consequently, the ATSB could not verify the specific actions of the flight crew in conducting this checklist. It is not unusual for individuals to have difficulties recalling a particular iteration of a highly-practiced task, and no inference is made regarding the captain’s difficulty remembering the Before start checklist for this flight.
Procedural tasks and errors
Procedures and checklists are important defences against equipment failures and other adverse events, and the failure to perform them properly can have severe consequences for flight safety.[5] Nonetheless, research has found that checklist deviations occur relatively frequently, relative to other forms of deviation from operating procedures. Such deviations include missed checklist items, procedures performed at inappropriate stages of flight, verbal response to checklist items without actually sighting the item, and performing flow-check procedures as read-do (Dismukes and Berman, 2010).
A substantial body of research has investigated conditions associated with checklist and procedural deviations in the context of aviation. In particular, research on prospective memory errors in aviation has identified a number of task situations that increase prospective memory demands and may increase the likelihood of error.
Episodic tasks
In situations where pilots are required to remember to perform an action at a later time, prospective memory is negatively affected when that action is not usually performed. In the context of flight operations, the time between forming an intention and the window of opportunity to act, is often filled with other tasks and demands that will divert a pilot’s attention away from what they need to remember to do. In such circumstances, pilots often forget to perform the delayed task.
The flight crew of FNP were required to delay their usual checks, including checking the on-board stowage compartment and acting on the report from the augmenting crewmember, until they were able to access the flight deck. The captain reported that by the time he was able to access the cockpit, other information had ‘got in front’ of the augmenting crewmember’s report.
Interruptions
Interruptions during the pre-flight sequence can significantly affect flows and checks. Line observation research showed that flight crews experience frequent and unpredictable interruptions during pre-flights, which takes their attention from allocated tasks (Loukopoulos, Dismukes and Barshi, 2001). This research also showed that because interruptions mean pilots were required to form and defer intentions, this increased the likelihood of error.
During the pre-flight preparations for this flight, the crew experienced several interruptions. The captain recalled there were inaccuracies in the maintenance log and loading documentation, and that he needed to attend to this and re-check the documentation prior to certifying the airworthiness of FNP. Moreover, the pre-flight sequence involves a high level of workload for the flight crew, with many competing requirements. In the context of the preparation of FNP, there were other tasks and demands the flight crew attended to after gaining access to the flight deck.
Loss of normal cues and routines
As normal procedures are highly structured, and flight crews conduct these procedures over many hundreds of flights, the procedures become highly habitual over time. Along these lines, Dismukes (2008) reports that pilots often develop significant cue-behaviour associations for routine tasks. Importantly, Dismukes notes that when the prompting cue for those tasks is removed, pilots are more likely to forget to perform the task.
In this occurrence, the normal sequence for the PM pre-flight tasks was in a sequence involving standing up for the intention to leave the cockpit for the walk-around. With practice, the actions associated with standing and doing the walk-around probably developed cue-behaviour associations with other tasks in particular checking the cockpit stowage compartment.
Methods for ensuring procedures and checklists are completed
Formal safety systems and individual strategies can be used to prevent checklist deviations, to help ensure procedures and checklists are performed appropriately.
In terms of formal systems, the operator provided training to support the ability of flight crews to manage distraction and disruption, and assessed flight crew competence on those skills. In particular, pilots received threat and error management classroom training, and were assessed on these skills as part of cyclical simulator training. The classroom training included education for pilots on the effects of distractions and interruptions, and advised crews to manage distraction using a range of techniques, including re-starting interrupted checklists, and using memory aids. The flight crew for FNP had all received passing assessments for threat and error management skills in their most recent simulator assessments, prior to the incident.
The flight crew of FNP recalled a number of strategies, which they normally used while conducting procedural tasks and checklists. The main strategy was to use materials available within the cockpit to create a visual reminder of an outstanding or otherwise required action. For example, the captain described using the pull-down cockpit compass to remind him that further action was required. The FO reported turning the Quick Reference Handbook manual from portrait to landscape orientation to provide a similar reminder. The flight crew also reported using the take-off data cards to create written reminders.
However, these strategies rely on access to the cockpit. In this case, the flight crew’s normal process was disrupted due to delayed access to the cockpit, so their normal strategies were unavailable.
Maintenance log requirements for LGGL
The maintenance log records the details of maintenance activities performed on an aircraft, in order to meet regulatory requirements relating to issuing certificates of release to service. When a maintenance activity is performed, engineers make a maintenance log entry to record the details of that activity, as well as a second entry to certify that the activity is completed.
VARA Continuing Airworthiness Management Organisation (CAMO) procedures did not define installing and removing LGGL as a maintenance activity, so there was no requirement to record these activities in the maintenance log.
Use of maintenance log by flight crews
As part of the preliminary cockpit procedure, the captain reviews documentation, including the maintenance log, to determine the airworthiness of the aircraft. In this way, the maintenance log provides a means of ensuring safety-critical maintenance information is communicated effectively between the flight crew and the engineers.
The captain reported that during the preparation of FNP, he checked the documentation associated with the serviceability of the aircraft, including the maintenance log. However, the log did not contain an entry regarding the LGGL as an entry was not required by the procedures.
Use of maintenance log by engineers
The maintenance log also functions as a means for engineers to determine the maintenance status of an aircraft. The log is relatively unambiguous regarding maintenance activities that are yet to be certified as completed.
In the pre-flight sequence for the occurrence flight, the on-board engineer used the maintenance log to record the stowage of the engineer’s flyaway kit on-board FNP. The maintenance log did not record any activities related to fitting and removing the LGGL, nor was there any requirement to record these activities.
Previous occurrence
On 12 April 2016, a VARA Fokker 100 aircraft departed from Perth Airport with landing gear pins (equivalent to LGGL) attached. The pins had been fitted so that the aircraft could be towed prior to the flight, but had not been removed. The aircraft was required to conduct an air turn-back, and safely landed at Perth Airport.
An internal investigation by the operator found that the captain had conducted an external inspection and identified the pins. However, the captain had regarded removing pins as an engineering function and assumed that they would be removed prior to departure. An engineer had conducted a pre-dispatch walk-around inspection, but had not detected or removed the pins.
The operator subsequently recommended that the VARA CAMO consider making the installation and removal of gear pins an action that requires a maintenance log entry. This would require engineers to sign when pins were installed, and sign-off when they were removed. After a review, the operator introduced an Aircraft Readiness Log, which would perform the same function as described above. The log was introduced on 8 October 2018. The recommended actions had not yet been implemented at the time of the A320 incident on 14 August 2018.
Ground handling context
Ground handler background information
The pushback driver was trained for both the pushback and dispatcher roles for A320 aircraft. On the day of the occurrence, the pushback driver was performing the role of leading hand on an IOT flight for the first time without supervision. Being new to this role, he felt additional pressure to ensure he did everything correctly. The pushback driver also felt pressure to get the aircraft out on time, because he did not want delays to affect his subsequent flights that day.
Prior to this occurrence, the pushback driver had removed pins from Boeing 737 aircraft. The pushback driver described this as being done to assist the engineers, and as having occurred under the supervision of the engineers. The pushback driver recalled that the 737 has pins in a similar position to the LGGL on the A320. He also thought the A320 LGGL were equivalent to pins on a 737 and was not aware that the A320 LGGL had a sleeve. The on-board engineer also recalled instances of ground handlers assisting engineers by removing pins from aircraft.
The dispatcher was trained for the dispatcher duties on A320 aircraft, although was new to the role. When the ground handlers considered removing the LGGL from FNP, the dispatcher deferred to the judgement of the pushback driver.
Ground handler procedures and training
A320 procedures for ground handlers require the dispatcher to perform a walk-around check prior to departure. The procedures also instructed ground handlers to ‘be aware’ of landing gear pins, and indicated that the dispatcher should check that landing gear pins have been removed during the walk-around. The procedures stated that any abnormalities (such as unexpected pins) must be reported to the pilot in command immediately after the walk-around.
The training material for the dispatcher role described a similar procedure to the above. The training materials stated the dispatcher should report anomalies to the captain and/or an engineer.
The ground handler training did not show or describe the LGGL specifically. There was no indication in any training material relating to what the LGGL were, or how they function.
Pushback driver understanding and usual practices
At interview, the pushback driver noted he had been taught that if he saw anything unusual or unexpected on an aircraft, he should ‘tell somebody, either a supervisor or the AMCO, try to get an engineer’. The pushback driver reported he had been taught this during initial training, and could not recall any further reinforcement of this procedure.
The pushback driver reported that, in the context of responding to unusual observations during aircraft preparation, he would normally try to contact the AMCO, to get an engineer. The pushback driver reported this occurred very infrequently, noting that the last time he had cause to contact an engineer about an unusual observation was six months prior to this occurrence.
Factors affecting non-communication with flight crew
The decision to remove the LGGL pins and not contact the flight crew was contrary to procedures and training. The pushback driver reported that he did not consider contacting the flight crew. There were several opportunities for both the pushback driver and the dispatcher to communicate with the crew throughout the pre-flight sequence, and there was no technical barrier to this communication.
The ATSB considered whether a high power gradient between the ground handlers and the flight crew contributed to the non-communication. Pilots have substantially more aviation knowledge and more status in the context of the operation, and this is can lead to a high power gradient between them and the ground handlers. Research has shown that individuals are less likely to raise concerns with individuals they perceive to have significantly more power than they do.
Communication between the ground and the plots is a regular requirement of the ground handler roles, as part of dispatch and receipt duties. The pushback driver reported that he felt ‘fine’ talking to the crew, although he indicated his preference was to communicate with engineers. The pushback driver stated that when he entered the cockpit to deliver the loading information, the LGGL did not seem important and that his main concern was getting the aircraft out. This implies the pushback driver did not mention the LGGL due to a perception of importance, rather than reluctance due to power gradient.
In terms of safety systems which may reduce the problematic effects of power gradients, non-technical skills training completed by the flight crew included content which described the impacts of very high power gradients, specifically the importance of creating an atmosphere where others feel safe to communicate concerns. The flight crew had all received passing assessments for communication skills for the non-technical skills components of their most recent simulator assessments, prior to the incident.
Although a high-power gradient may have existed, there was insufficient evidence to determine that this influenced the non-communication between the crew and the ground handlers.
The handover of pre-flight engineering duties between the VARA Aircraft Maintenance Organisation (AMO) engineers did not effectively transfer the responsibility to remove landing gear ground locks (LGGL) from VH-FNP (FNP).
Handing over duties from one person to another has been found to be associated with increased risk of error and accidents (Parke and Kanki, 2008). The main risk associated with handover is that critical task information is lost. There are two primary mechanisms of possible information loss during a handover: critical information may be omitted, or it may not be correctly received.
The ATSB was not able to establish exactly what was said during the handover, or how it was said. The on-board engineer reported that following the handover, he did not know the LGGL remained on FNP. The two engineers reported different accounts of the handover, further supporting the absence of effective communication. It is likely that one or both form(s) of information loss occurred.
The risk of information loss during handover is influenced by the mode and methods used to conduct handover. Research has shown that oral-only handovers are associated with much higher levels of error, when compared to handovers that supplement oral methods, such as using note-taking or printed information .
Although oral-only handover is associated with greater information loss, effective communication and listening methods can moderate this. These include closed loop communication, where both the sender and receiver actively confirm that the message was transmitted as intended. Research suggests that this is effective at ensuring team members maintain shared awareness, even in complex environments (Bearman, Paletz, Orasanu and Thomas, 2010).
The ATSB did not identify any training or other materials which supported the use of effective communication skills in this context. It is possible that the use of oral-only handovers, and the absence of training or other supports for these handovers, increased the risk of information loss.
Because the handover was not effective, the on-board engineer had no expectation that the LGGL pins may have been in place on FNP when he supervised the refuel. It is likely that this contributed to the on-board engineer actions which resulted in him not detecting the LGGL pins.
Towing procedures not documented
There were no procedures specifying when or how LGGL were to be removed from VARA A320s after positional tows. Procedures which did specify these requirements did not apply to A320s.
Reason (1997) describes how the absence of appropriate formal procedures produces the conditions for the development of work-arounds and other informal practices. Where no formal procedures exist, individuals will tend to improvise and develop procedures based on their own understanding. Such improvisation is associated with high levels of error.
Procedures also facilitate a shared understanding of how and when tasks are done. Research has shown that successful team performance requires that team members develop shared mental models for the job and the task, which relate to how the task is performed, in terms of what procedures are involved. Appropriate, accessible written procedures facilitate the development of this shared understanding between team members.
Although the importance of procedures may seem abstract, these concepts were illustrated in the occurrence. The absence of appropriate procedures for removing LGGL meant that the engineers did not have an appropriate reference for how that task should be performed, and instead used their own informal procedures.
The engineers had different understandings of the task of removing LGGL from A320s. The apron engineer stated that it was accepted practice for LGGL to be left installed on aircraft after positional towing. In contrast, the on-board engineer reported that normal practice was to remove LGGL from the aircraft after a tow.
The absence of a procedure for removing LGGL contributed to the absence of shared understanding between the engineers regarding the removal of LGGL from FNP. This contributed to the LGGL remaining in place throughout the preparation of FNP.
Expectancy affected detection of LGGL
The on-board engineer had opportunity to sight the LGGL after leaving the cockpit and walking to the refuelling panel. It is likely that if the on-board engineer observed the LGGL, he would have removed them appropriately and placed them in on-board stowage compartment. The ATSB determined that the LGGL were likely to have been highly conspicuous, and there were no indications that fatigue or visual obstruction were contributory. However, the on-board engineer reported that he did not expect to see the pins when he supervised the refuel.
Research shows that expectation affects attention and perception, influencing what people detect and whether they attend to information (Wickens and McCarley, 2008). As identified in the phenomena of inattentional blindness, people can fail to detect even highly salient targets when they are not expecting to see them (Simons, 2000).
It is likely that the on-board engineer’s low level of expectancy that the LGGL would be installed on FNP reduced the likelihood he would to detect the LGGL.
Flight crew disrupted in pre-flight procedures
The flight crew of FNP omitted several checks and actions that would normally have detected that the LGGL had not been stowed on-board the aircraft as required. These were:
The captain did not perform the required actions after the augmenting crewmember advised the LGGL remained on FNP during the exterior walk-around.
The first officer (FO) did not check the landing gear stowage compartment.
Neither the captain nor the FO identified that the LGGL were not stowed on-board during the Before start checklist. It is likely that these items were not performed, or that the crew responded to the checklist items without visually inspecting the associated systems.
It is unlikely that role confusion associated with the delegation of the walk-around contributed to the omission of the cockpit stowage check by the FO.
The flight crew were delayed in accessing the flight deck. Consequently, the captain needed to remember that the LGGL had been observed during the walk-around, but could not act on this information for around 30 minutes. The captain did not implement any alternative reminder and relied on his memory to remember to perform a future action. After the crew gained access to the flight deck, they had other demands associated with the pre-flight. It is likely that the delay adversely affected the captain’s ability to remember to act on the LGGL information.
The delay also meant that the crew did not have access to the usual reminders they would employ as a method to ensure checks were performed, as these methods relied on access to the cockpit.
Because the walk-around task was delegated to the augmenting crewmember, the FO varied his normal sequence of pre-flight checks. When the FO entered the cockpit, and sat in the flight seat to conduct his pre-flight checks, there was no requirement to leave his seat because the augmenting crewmember had already performed the walk-around. The sequence of events he normally relied upon to check the stowage compartment was not necessary, so there was no cue for him to check the stowage compartment and this step was missed. In general, it is preferable to manage delays and interruptions by ensuring that procedures are performed in their usual sequence. Where there are known barriers to completing procedures, it may be preferable to delay commencing those procedures until the barriers are removed.
As summarised, the normal pre-flight sequence for the flight crew was disrupted due to maintenance work on the flight deck and delegation of the exterior walk-around check. This contributed to the flight crew not identifying that the LGGL were missing from the stowage compartment on-board FNP.
No maintenance log requirement for LGGL
Installing and removing LGGL was not defined as a maintenance activity. Consequently, there was no requirement for VARA AMO engineers to make maintenance log entries for these tasks. This meant that when the captain reviewed the log during the preliminary cockpit preparation procedure, there was no indication that the LGGL remained fitted to the aircraft and not stowed on-board the aircraft.
In the absence of maintenance log entries, the flight crew relied on visual checks during the pre-flight procedures to check. The context in which these checks occur, being the pre-flight sequence, can be characterised as typically involving a high level of workload, with frequent interruptions and distractions. As illustrated in this occurrence (and in the research literature), such conditions increase the likelihood of flight crews omitting pre-flight checks (Loukopoulos, Dismukes and Barshi, 2001).
This absence of LGGL maintenance log requirements also affected the ability of the on-board engineer to identify that the LGGL remained on FNP. This meant that engineers relied on oral-only methods to communicate the status of this task. As there was no requirement for VARA engineers to conduct a walk-around, there were limited other opportunities for the on-board engineer to notice that the LGGL had not been removed prior to flight.
It is likely that a maintenance log entry relating to LGGL would have provided another opportunity for the flight crew and the engineer to become aware that the LGGL had not been removed and stored on-board FNP before flight.
Pushback driver decision to remove LGGL pins
The pushback driver recognised that the LGGL pins and associated flags needed to be removed before flight. Although it was outside of his procedures, the pushback driver decided to remove the LGGL pins from the landing gear of FNP, but inadvertently did not remove the LGGL sleeves from the landing gear. Because the pins were removed prior to the dispatcher walk-around check, there was no opportunity for the dispatcher to identify the LGGL during that check. Neither the pushback driver nor the dispatcher advised the flight crew that the LGGL had been detected and/or removed. These decisions and the result was influenced by the following.
Time pressure
Research has shown that when individuals make decisions under pressure, they tend to sample less information overall (Wright, 1974), and perceptions of time pressure can reduce decision-making and judgement performance (DeDonno and Demaree, 2008). Time pressure is also associated with the use of less-analytical decision-making.
After attempting to contact the AMCO for around 10 minutes the pushback driver perceived pressure to ‘get the aircraft out’. This perceived pressure was partly due to the pushback driver wanting to perform well as a new leading hand on IOT flights. The ATSB established that there was no pressure explicitly placed on the pushback driver to expedite tasks during the preparation of FNP. It is likely that perceived time pressure influenced his decision to remove the pins from FNP.
Pushback driver’s experience removing pins from Boeing 737s
When the pushback driver perceived the pins on FNP, he recognised this as being similar to prior experiences of removing pins from 737 aircraft. The pushback driver perceived that he would be able to remove the pins FNP, and that this action was required to prepare FNP for flight.
Pushback driver’s lack of understanding of LGGL mechanism
Although the pushback driver correctly recognised the pins needed to be removed before flight (as indicated by the flags), he did not realise the sleeves also needed to be removed. The ATSB noted that the role of a ground handler is limited in scope and responsibility. There was no requirement for a global understanding for aircraft systems or equipment, including the LGGL. Conducting a procedure outside of his responsibility therefore greatly increased risk as his actions were then reliant on an understanding of a system he had not been trained in (Rasmussen, 1983).
Missing lanyards
As the wire lanyard was missing for both sets of LGGL, there was no physical defence to ensure the sleeves could not be left on the aircraft without the locking pins in place. While a last line of defence, such a simple mechanism would have been an effective protection against an occurrence such as this.
Findings
From the evidence available, the following findings are made with respect to the aircraft preparation event involving A320, VH-FNP (FNP) at Perth Airport, Western Australia on 14 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The handover of pre-flight engineering duties between engineers did not effectively communicate the requirement to remove landing gear ground locks (LGGL), contributing to the on-board engineer having no expectation of any further requirement to perform additional checks or tasks relating to the exterior of the aircraft.
There was no formal documentation regarding when LGGL pins should be removed following a positional tow. The absence of a formal process contributed to the LGGL remaining in place throughout the preparation of FNP, and the on-board engineer having no expectation that the LGGL were still installed when he supervised the refuel.
The normal pre-flight sequence for the flight crew was disrupted due to maintenance work on the flight deck and delegation of the exterior walk-around check. This contributed to the flight crew not identifying that the LGGL were missing from the stowage compartment on-board FNP.
The operator did not have a procedure for making maintenance log entries when LGGL were installed and removed. The maintenance log entry relating to LGGL would have provided another opportunity for the flight crew and the engineer to become aware that the LGGL had not been removed and stored on-board FNP before flight.
Rather than inform an engineer or pilot as per procedures, the pushback driver removed the LGGL pins from the landing gear sleeves before pushback. However, as the lanyards attaching the pins to the sleeves was missing and the pushback driver did not understand the LGGL locking mechanism, he removed the pins and not the sleeves.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.
Responding to a previous occurrence involving gear pins (LGGL) not being removed prior to flight, VARA reviewed existing procedures and industry practice. VARA introduced an Aircraft Readiness Log and associated procedures, which meant that an authorised person must sign a log entry whenever LGGL pins were installed and removed, to certify that LGGL have been removed prior to flight. If the aircraft has been towed after the initial check, the check must be performed again. This procedure was communicated to involved parties within VARA, the VARA Approved Maintenance Organisation and VARA Continuous Airworthiness Maintenance Organisation, as well as other affected parties, on 5 December 2018.
The memo issued on 5 December 2018 also updated towing duties for procedural towing. The memo specified that it is the responsibility of the approved brake rider (Aircraft Brake Operator) to ensure that the LGGL are installed before towing, and removed after towing is completed. The memo also specified that the Aircraft Brake Operator document the actions in the Aircraft Readiness Log.
VARA issued a notice to flight crews in April 2019 which instructed them to use a standardised method of stowing LGGL pins and sleeves in the stowage compartment. Flight crews were instructed to stow the LGGL such that the flag ends were partially exposed, to assist with easier identification during the pre-flight inspection.
VARA also issued a ‘Safety Alert’ message to all ground handlers after the incident. This message emphasised that ground handlers should not remove LGGL pins, and instructed them to notify either the pilot-in-command or maintenance personnel if they were to observe gear pins installed during their walkaround or prior to an imminent pushback. The message also showed photographs of A320 and Fokker F100 landing gear with pins installed and removed.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew
engineers
ground handling personnel
aircraft operator.
References
Bearman, C., Paletz, S. B., Orasanu, J., & Thomas, M. J. (2010). The breakdown of coordinated decision making in distributed systems. Human factors, 52(2), 173-188.
Bhabra, G., Mackeith, S., Monteiro, P., & Pothier, D. D. (2007). An experimental comparison of handover methods. The Annals of The Royal Surgical College England, 298-300.
DeDonno, M. A., & Demaree, H. A. (2008). Perceived time pressure and the Iowa Gambling Task. Judgment and Decision making, 3(8), 636.
Degani, A., & Wiener, E. L. (1990). The human factors of flight deck checklists: The normal checklist (NASA Contractor Report 177549). Moffett Field, CA: NASA Ames Research Centre.
Dismukes, R. K. (2008). Prospective memory in aviation and everyday settings. Prospective memory: Cognitive, neuroscience, developmental, and applied perspectives. NASA Ames Research Centre.
Dismukes, R. K., & Berman, B. (2010). Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail. Moffett Field, CA: NASA Ames Research Centre.
Loukopoulos, L. D., Dismukes, R. K., & Barshi, I. (2001). Cockpit interruptions and distractions: A line observation study. In Proceedings of the 11th international symposium on aviation psychology (pp. 1-6). Ohio State University Press Columbus, OH.
Mathieu, J. E., Goodwin, G. F., Heffner, T. S., Salas, E., & Cannon-Bowers, J. A. (2000). The influence of shared mental models on team process and performance. Journal of Applied Psychology, 85(2), 273-283.
Parke, B., & Kanki, B. G. (2008). Best practices in shift turnovers: Implications for reducing aviation maintenance turnover errors as revealed in ASRS reports. The International Journal of Aviation Psychology, 18(1), 72-85.
Reason, J. (1997). Managing the Risks of Organisational Accidents. Routledge.
Simons, D. J. (2000). Attentional capture and inattentional blindness. Trends in cognitive sciences, 4(4), 147-155.
Wickens, C. D., & McCarley, J. S. (2008). Applied Attention Theory. Boca Raton: Taylor & Francis Group.
Wright, P. (1974). The harassed decision maker: Time pressures, distractions, and the use of evidence. Journal of applied psychology, 59(5), 555.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Virgin Australia Regional Airlines, Swissport, CASA, the captain, first officer, augmenting crewmember and onboard engineer on board VH-FNP, the apron engineer and the pushback driver.
Submissions were received from Virgin Australia Regional Airlines and Swissport. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0845 Western Standard Time[1] on the 16 September 2018, a Cessna 207, registered VH-MIA (MIA), operated by Kalbarri Scenic Flights, took off to conduct a scenic flight from Kalbarri, West Australia (WA), to East Wallabi Island, WA. A pilot and three passengers were on board the aircraft.
The pilot had conducted a short scenic flight lasting about 45 minutes earlier that morning. She had around 30 minutes between flights to prepare the aircraft for the second flight.
The pilot advised that she briefed the passengers on the safety aspects of the aircraft before taking off. The flight proceeded past the township of Kalbarri and then along the shoreline before heading to East Wallabi Island, part of the Abrolhos Islands, at about 2,500 ft above mean sea level.
The aircraft overflew the island and the pilot reported that she observed the windsock was indicating an easterly wind, which was a crosswind for both runways. She decided to join runway 36 on the mid-crosswind leg of the circuit. The pilot reported that she touched down on the runway abeam the taxiway (see Figure 2), which normally gives her enough runway length to stop the aircraft. However, on this occasion, she could not stop the aircraft and overran the runway end by approximately 1 metre (Figure 1). The aircraft was not damaged and there were no injuries to the pilot or passengers.
Figure 1: VH-MIA after runway excursion
Source: Sue McAuliffe
Runway strip
The runway strip on East Wallabi Island is a privately owned unsealed strip. It is 637 m long and 30 m wide. The pilot reported that it slopes down slightly in the middle and has soft sand at one end. The windsock is on the western side of the runway on a slight hill.
Figure 2: East Wallabi Island runway and Kalbarri, North Island and East Wallabi Island
Source: Google Earth, annotated by ATSB
Weather at East Wallabi Island
East Wallabi Island does not have a dedicated weather forecasting service, but weather observations from North Island, which is 20 km north-west of East Wallabi Island, indicated that the wind was from the south at approximately 8 knots. This would indicate that the wind was almost all tailwind at the time the aircraft landed.
Pilot comments
The pilot reported she had checked the weather before they had departed on the first flight that morning.
The pilot reported that the approach and landing appeared normal until the aircraft did not slow after the aircraft touched down on the runway. She had slowed the aircraft to 80 kts on the final leg of the approach and touched down at the normal speed. She applied brakes as normal, released and then reapplied the brakes, to ensure the wheels did not lock, as this was a gravel strip.
The pilot reported that she used the position of the taxiway along the runway as her decision point as to whether she was going to conduct a go-around. As everything felt normal at that stage, she did not conduct a go-around.
The pilot reported that she was not fatigued. She had a day off the day before the incident. She had slept normally and had risen at her normal time of around 0530. She had arrived at the airport at around 0700, which gave her plenty of time to prepare for the flights. She was not feeling time pressure and the workload for the flight was normal.
She also advised that she had flown to the island a number of times and knew the strip well.
Operator comments
The operator reported that the aircraft was loaded within the aircraft limits.
The operator has discussed the incident with the pilot. They have stressed the importance of checking the windsock on the final leg of the circuit to ensure there is no downwind component, especially on a short runway. The operator and the pilot have also discussed the importance of using all available weather data, in particular the observations page on the Bureau of Meteorology website before going flying.
Previous occurrences
A review of the ATSB occurrence database for similar occurrences identified that in the last 10 years there were 14 incidents where a tailwind contributed to a runway excursion on landing. Of these, 11 were excursions where the aircraft ran off the end of the runway. Seven of these aircraft sustained substantial damaged.
Safety analysis
While the pilot advised she had checked the wind as they overflew the runway to join the circuit for runway 36, weather information received from the Bureau of Meteorology indicated that there was a southerly wind at the time the aircraft landed. The ATSB could not clarify if the pilot misread the windsock or the wind direction had momentarily changed when they joined the circuit and returned back to the southerly direction before the aircraft landed. The aircraft most likely landed with a tail wind component resulting in a faster ground speed at touchdown and the aircraft overrunning the end of the runway.
The pilot’s decision to land the aircraft adjacent to the taxiway reduced the available stopping distance available. Using the full runway strip, would probably have allowed the pilot to stop the aircraft on the runway.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
It is likely that the aircraft landed with a tailwind component resulting in the aircraft overrunning the runway.
The pilot’s chosen landing position did not use the full runway strip length, reducing the stopping distance available.
Safety message
This incident highlights the importance of, where possible, landing with a headwind. Landing with a tailwind could result in an increase in the required landing distance by 21 per cent for the first 10 kts of tailwind, according to the United States’ Federal Aviation Administration advisory circular no. 91-79AMitigating the risks of a runway overrun upon landing. They also advise that for some smaller general aviation aircraft (for example a Cessna 152), the landing distance required will increase by 10 per cent for every 2 kts of tailwind. If a pilot is not expecting a tailwind component, there is a significant risk that the aircraft will overrun the runway when operating on a short runway. One way of reducing the chances of landing with a tailwind is to include a check of the windsock during pre-landing checks and to conduct a go-around if a tailwind is detected.
Runway excursions continue to be a safety concern around the world with the Transport Safety Board of Canada recently releasing its Watchlist 2018, which lists runway overruns as one of its two aviation safety concerns for 2018.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 September 2018, the pilot of a Yakovlev 9-UM (YAK 9) aeroplane, registered VH-YIX, departed Latrobe Regional Airport, Victoria for a local private flight. The aircraft was observed by witnesses to the north of Moe, Victoria performing aerobatic manoeuvers. A short time later the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot and destroying the aircraft.
What the ATSB found
The ATSB found that the aircraft entered a spin at low altitude from which it was not possible to recover. There was no evidence of pilot incapacitation, or a mechanical fault with the aircraft that contributed to the accident.
The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.
The ATSB also identified a number of other factors that, while not contributory, increased safety risk. These included inadequate aircraft maintenance and operation without important flight and maintenance documentation.
Safety message
This accident highlights the inherent risks associated with performing low-level aerobatics in high performance aircraft. Pilots engaged in such flights are encouraged to observe minimum approved operating heights above the ground, commensurate with their ability and qualifications, and to engage in regular flight reviews and/or flight instruction.
Pilots should also ensure that careful preparation and planning is undertaken prior to each flight and that all documentation, checklists and required manuals are appropriately stored and accessible within the aircraft.
The occurrence
What happened
On 7 September 2018, a Yakovlev 9-UM (YAK 9), VH-YIX was flown from Boonah Queensland, to Latrobe Regional Airport, Victoria. The relocation of the aircraft was undertaken by two separate pilots, with a handover conducted at Dubbo Airport, New South Wales. One of the pilots, an instructor, flew another aircraft from Latrobe Regional Airport to Dubbo. On arrival at Dubbo the pilots swapped aircraft for their respective return flights.
Prior to landing at Dubbo in the YAK 9, the pilot from Boonah opened the forward cockpit canopy in-flight to provide greater visibility for the landing. It was reported that the resultant turbulent airflow from the open canopy ejected a number of aircraft documents from inside the cockpit. After landing at Dubbo, the instructor was advised of the loss of the aircraft checklist, maintenance release, Certificate of Registration, and Special Certificate of Airworthiness from the aircraft.
The instructor conducted an uneventful flight back to Latrobe Regional Airport in the YAK 9, and landed at about 1155 Eastern Daylight-saving Time.[1] He refuelled the aircraft with 341 litres of aviation gasoline and parked the aircraft on the Latrobe Valley Aero Club hardstand at 1244.
One of the aircraft’s owners (the pilot) met the instructor on arrival. The pilot told the instructor that his intention was to conduct some taxi practice prior to a pre-arranged instructional flight scheduled for 1630 that afternoon.
The instructor and the pilot discussed the absence of the checklist and other required documents. The instructor reported that they agreed that the aircraft should not be flown, but taxiing would be acceptable, provided the aircraft’s operating temperatures were monitored. The instructor then proceeded inside the aero club to prepare another student for a training flight.
Sometime later, the instructor heard the pilot attempting to start the YAK 9. After numerous starting attempts, the instructor went outside to assist the pilot to apply the correct starting sequence.
At about 1420, the pilot began to taxi the aircraft, which was witnessed by two aircraft engineers standing outside a hangar at the northern end of runway 21. The aircraft was taxied along to the run-up bay. The witnesses observed that the rear canopy of the aircraft was open and that the pilot appeared to conduct routine engine checks. A short time later, the aircraft entered runway 21, the pilot applied power and commenced to take-off.
The instructor, who was walking across the tarmac from the aero club, recalled observing the take-off roll of the YAK 9 and noted that the aircraft used more than double the normal length of runway before it lifted off. The instructor then noticed that the rear canopy was not secure.
He attempted to contact the pilot from within the aero club by radio to advise him that the rear canopy was not secure. The instructor made several broadcasts but did not receive a response from the pilot. However, another pilot in the area responded to the instructor’s radio call, which confirmed that the radio call had been broadcast.
The YAK 9 initially maintained runway heading as it continued to climb. At 1428, it was identified by military radar turning off runway heading to the west at about 130 kt (Figure 1). The aircraft climbed to about 2,600 ft above mean sea level (AMSL). About 4.6 km to the south‑west of Latrobe Regional Airport, it was observed on radar to level out.
Figure 1: Flight track of VH-YIX
Source: Google Earth with annotations by ATSB
At 1431:09, the aircraft was about 18 km to the north-west Latrobe Regional Airport at about 2,800 ft, and travelling at 206 kt groundspeed when the pilot began to conduct what ground witnesses assessed as aerobatic manoeuvers. Radar contact with the aircraft was lost during those manoeuvres. The aircraft briefly reappeared on radar at 1431:34, at about 3,100 ft, (2,900 ft above ground level) with a groundspeed of 157 kt. This was the last contact received by radar, and showed a 49 kt reduction in groundspeed during the 25-second period when the aircraft was not visible on radar.
Figure 2: Video captured by a witness with overlayed ATSB analysis
Source: Witness footage with ATSB analysis and annotations
Witnesses in the Moe region, who were actively watching the aircraft from the ground, observed the YAK 9 conduct a series of what appeared to be aerobatic manoeuvers. One witness described what appeared to be a roll followed by a loop. They stated that as the aircraft came out of the bottom of the loop, the aircraft appeared to conduct an abrupt left turn before it began spiralling towards the ground. Video taken by another witness showed the aircraft in a spinning, steep nose‑down attitude prior to disappearing from view (Figure 2). These four frames were captured over 0.48 seconds.
At about 1432, the aircraft impacted terrain in a paddock about 3 km north of Moe, in a flat, slightly right‑wing and nose-low attitude, with little to no forward movement (Figure 4). The aircraft was destroyed, and the pilot was fatally injured.
The pilot held a Commercial Pilot Licence (Aeroplane), issued in March 1983. At the time of the accident, the pilot held the appropriate aircraft ratings and endorsements to operate the YAK 9. The pilot had undertaken an aeroplane flight review with an instructor in a twin-engine Cessna 310, about two weeks prior to the accident.
In August 1997, the pilot conducted spin training in a basic aerobatic training aircraft. At that time, the pilot also received an aerobatic endorsement. This qualification permitted the pilot to perform basic aerobatic manoeuvres such as loops, aileron rolls, slow rolls, barrel rolls and stall turns. The endorsement contained an altitude restriction which required the pilot to have completed any aerobatic manoeuvre by 3,000 ft above ground level.
Experience
The pilot was a relatively experienced private aircraft operator, and had operated a number of ex‑military, high-performance warbird aircraft. The pilot had logged over 2,000 flight hours in multiple aircraft types, and had flown about 100 hours in warbird aircraft. The pilot had recorded a total of 1.9 hours in VH-YIX as at 29 March 2018, however it was reported that a number of additional flights were undertaken in the aircraft but not recorded in the pilot’s logbook. The instructor who had overseen all of the pilot’s operation of the aircraft estimated that the pilot’s experience in the YAK 9 was about 5‑6 hours.
As part of transitioning to operate high-performance warbird aircraft, the pilot had voluntarily undertaken a significant number of instructional flights in warbird aircraft since 2011. Flight training records and instructor interviews indicated that the pilot normally required debriefing in a number of areas after these flights. Basic warbird aircraft handling issues were identified as the most prevalent debriefing points. However, the use of checklists and correct procedures were also identified a number of times. Several different instructors noted in the pilot’s training records that he needed to fly often to retain currency and consistency in operating warbird aircraft.
The pilot had conducted aerobatics in a number of high-performance warbird aircraft in the two years prior to the accident, however he had not flown the YAK 9 in over 3 months, and had not previously conducted aerobatics in the aircraft.
Medical
The pilot conducted an aviation medical examination on 10 July 2018 and was issued a Class 2 aviation medical certificate on 31 July 2018. Limitations placed on the pilot’s medical certificate required distance vision correction to be worn whilst flying and reading correction to be available whilst exercising the privileges of the licence. A review of the previous five years of medical files did not identify any medical concerns. The post-mortem examination found no evidence of any medical conditions that may have affected the pilot’s performance.
The pilot was reported to be excited about the return of the YAK 9 to Latrobe Regional Airport, and took a flight bag when departing for the airport that morning. However, family members reported that the pilot was uncertain if he would fly the aircraft that day.
Aircraft information
General
The YAK 9 is a two-seat, low-wing, aerobatic[2] aircraft with retractable landing gear. At the time of design, it was intended to perform the role of an advanced wartime aerial combat platform. Manufactured with front and rear flight controls, the primary flight controls are located in the front cockpit section with independent, secondary flight controls located in the rear passenger cockpit.
VH-YIX was manufactured in Russia in 1996 and exported to the United States shortly after construction without an engine. A Special Airworthiness Certificate issued for the purpose of experimental exhibition was granted on 20 February 2004 to allow the aircraft to operate in the United States. Logbook entries indicate that an Allison V-12 liquid‑cooled engine was installed and on 12 April 2004, the aircraft had flown 1.5 hours. The aircraft was imported to Australia and was placed on the Australian civil aircraft register on 19 July 2004, as VH-YIX.
Handling characteristics
As part of dive recovery, most aircraft require the application of rearward pitch control input to raise the nose and ease out of a dive. Experienced YAK 9 pilots reported that the aircraft exhibited a divergent pitch control that was more pronounced when it had a rearward centre of gravity. This characteristic, which is different to most other warbird aircraft, meant that the effort required to pull back on the control stick reduced as the airspeed increased during a high-speed dive. That behaviour increases the possibility of the pilot over-controlling the aircraft with excessive pitch-up input. This, in turn, increases the risk of unintentionally entering a high‑speed stall by exceeding the wing’s maximum angle of attack[3] and entering a spin.[4]
The YAK 9 flight manual emphasises the need for smooth and deliberate control inputs for aerobatics. A high-speed stall occurs when the airflow over one or both wings of an aircraft detaches and becomes turbulent due to a high angle to the relative airflow.[5] At this point the addition of a yawing force, most typically due to an out of balance condition, begins to rotate the aircraft into a spin. These forces will continue until control input from the pilot stops them. High‑performance aircraft like the YAK 9 transition into a fully developed spin quicker and more forcefully than a typical light training aircraft. It is essential during recovery from a spin to have sufficient altitude to effect the recovery. Experienced YAK 9 pilots stated that, depending on pilot experience, 5-7,000 ft is required to safely recover the aircraft from a developed spin.
The YAK 9 flight manual states that recovery from a spin (Figure 3) also requires considerable forward control stick movement to hold the aircraft in a dive until the speed builds up. It also warns pilots not to energetically over-control the elevator during dive recovery as the aircraft may ‘wing rock’, which is a symptom of impending stall. Should too much rearward control stick application continue, then the aircraft may re-enter a stalled state that may lead to a further spin.
It is an Australian regulatory requirement that the aircraft maintenance history is documented in the aircraft and engine logbooks. A review of the aircraft’s logbooks indicated that the YAK 9 was operated in Australia for about 106 hours before the aircraft was damaged in a landing incident at Tyabb, Victoria, in September 2015. The aircraft underwent a significant repair process, which was completed on 21 October 2016. The aircraft logbook indicated that, as part of the repair the:
rudder and port aileron had been removed, repaired, recovered and refitted
fin and port wingtip had been repaired
engine was removed, bulk stripped and refitted
propeller was overhauled and propeller blades replaced
centre and rear cockpit canopy transparencies were removed and replaced.
An independent inspection of the flight control system was undertaken relating to the rudder and port aileron refit.
Following the purchase of the aircraft from the original owner, a maintenance provider conducted a periodic inspection, and a maintenance release was issued on 20 December 2017. The aircraft’s total time in service was 107.9 hours when it became registered to the pilot on 22 January 2018.
Entries in the maintenance release[6] indicated that it flew a further 15.9 hours before the day of the accident. The last recorded entry on the aircraft maintenance release was dated 29 May 2018 and listed a total time in service of 122.8 hours with no recorded outstanding maintenance or defects. It was reported by the ferry pilot that prior to departing Boonah, there were no outstanding recorded maintenance or defects.
It was originally reported that the Yak 9 was relocated to Queensland for maintenance, however the only maintenance performed on the aircraft during its time at Boonah related to checking the security of coolant hoses. It was subsequently reported that the aircraft was primarily flown to Queensland to attend, and conduct a display at, an air show.
Requirements for the carriage of a documents in flight
The Civil Aviation Regulations 1988 (CAR) require that the pilot-in-command of an aircraft carries, as a minimum on the aircraft during flight, the maintenance release and the flight manual (if any).
Paragraph 139 (1) (c) of the (CAR) also directs that an aircraft shall not commence a flight unless there is a valid maintenance release or other approved document in force, covering the period of the proposed flight. This is to ensure that the pilot-in-command:
is informed of any defects in the aircraft
is able to determine that all required maintenance on the aircraft has been completed and certified
can determine that no maintenance requirement will become due during the time of the proposed flight.
Pilots familiar with operation of the YAK 9 reported that there was little provision to store flight documents in the cockpit. When preparing to land the aircraft, it was common for a pilot to open/slide the forward canopy rearward to allow for a better view of the landing area during the final turn for landing. On a previous occasion, opening the forward canopy in flight resulted in the loss of the aircraft maintenance release and the aircraft checklist. At that time, the maintenance release was re-issued by an approved maintenance organisation.
A similar situation occurred when the aircraft arrived at Dubbo, on its return flight to Latrobe Regional Airport on the day of the accident. As a consequence, the aircraft departed Dubbo without the maintenance release or checklist. The instructor reported that on arrival at Latrobe Regional Airport, he asked the maintenance provider to arrange a replacement maintenance release for VH-YIX. However, before a maintenance release could be reissued, the aircraft departed the airport without an aircraft checklist or current maintenance release.
In the case of VH-YIX, the aircraft checklist was incorporated into, and formed part of the flight manual. Neither the flight manual nor the maintenance release were located at the accident site.
Rear canopy
The rear canopy of the YAK 9 can be secured from the rear seat inside the cockpit, or prior to flight from the front seat. Securing the rear canopy from the front seat requires the front seat pilot to face backwards in order to lock the rear canopy in place, prior to resuming the control seat.
The YAK 9 pre-flight checklist specifically requires that in single seat operations, prior to starting the engine, the rear seat must be properly prepared by securing the seatbelt assembly to prevent interference with the aircraft’s controls, and the rear canopy is also to be locked in place prior to taxi. It is not possible to secure the rear canopy once seated from the front seat.
Wreckage and impact information
On-site examination
The accident site was in a flat grazing paddock, 19 km west-north-west of Latrobe Regional Airport. The aircraft collided with terrain close to the fence line of two properties.
Figure 4: Major features of the wreckage at the accident site
Source: ATSB
The site inspection confirmed the presence of all the major flight control surfaces including trim tabs, the tailplane, fuselage and wings.
Fuel burns to grass were identified forward of the aircraft’s orientation. This was the result of the highly compressed wing structure rupturing the main leading edge fuel tanks, allowing fuel to escape on impact, chemically burning vegetation adjacent to the accident site.
The lack of wreckage trail, high compression of the aircraft structure and close proximity of the majority of the aircraft pieces indicated an impact at a high vertical speed with little forward movement.
Figure 5: Right wing structure impact damage
Source: ATSB
Ground impact marks and aircraft damage indicated that the YAK 9 collided with terrain in about a 30° right wing low, and 30° nose‑low attitude (Figure 5). This attitude and wreckage distribution was consistent with the wreckage pattern of an aircraft established in, or partially recovering from, a spin.
One propeller blade separated from the aircraft at impact and the other two sustained damage consistent with the engine operating under low power at the time of the accident. Witness reports of engine popping and backfiring prior to impact were consistent with the engine operating in a dive with a reduced power setting. The inspection of the engine and its controls did not reveal any defect that may have prevented its operation. The availability of fuel, serviceability of the ignition and engine control systems and a lack of structural defects, indicated that all systems appeared serviceable during the flight.
In combination with the propeller blade damage, it is likely that at the time of impact with terrain, the engine was operating, however at a low power setting.
The flight controls were present and accounted for at the site. Examination of the systems did not reveal any pre-existing defects that may have inhibited normal operation.
Some anomalies were noted within the wreckage during the ATSB’s on-site phase of the investigation, these included:
the rear canopy was not accounted for within the wreckage at the accident site - it was subsequently located by a land owner in a nearby paddock
one of the rear seat rudder control balance cables and pulley had detached from the airframe
internal corrosion was identified within the compromised structure of the welded steel fuselage
unsecured fasteners in the forward and rear seats
rear-seat seatbelt assembly unbuckled and unsecured.
Rear canopy
The rear passenger canopy was located approximately 500 m to the south-east of the impact site. The proximity of the canopy in relation to the accident site, in combination with the recorded radar track of the aircraft during the final moments of the flight, indicated that the canopy most likely separated from the aircraft during the vertical descent.
Assessment of canopy photographs identified that the canopy was relatively intact, sustaining only minor damage upon separation from the aircraft and some further damage on impact with the ground. The canopy’s transparency contained two large cracks on the left and right side; originating at the forward corners of the canopy frame and extending rearward. The transparency was contained within its alloy frame. The forward part of that frame, identified as the canopy bow, had buckled in a rearward manner, likely due to impact with the ground (Figure 6). There was no evidence that the rear canopy contacted the aircraft structure, including the flight controls, following detachment.
Figure 6: Forward looking view of the rear canopy
Source: Insurance assessor image with ATSB annotations
Rear rudder control assembly
The YAK 9-UM is a tandem two-seat aircraft. Each seating position has independent rudder cables running from the rudder, through a series of pulleys, to the rudder pedals. To balance the movement of each rudder pedal position in each seat, a balance cable ran between the left and right rudder pedals. This ran through a series of pulleys to ensure that if one rudder pedal was depressed then the other would raise. Each rudder control, for both the forward and rear seating positions, was independent of each other. This means that in the event of a failure in one, the other would function appropriately.
On-site wreckage examination identified that the passenger right-side rudder balance cable pulley had separated from its mount within the airframe structure. The castellated nut, washer and accompanying split pin that would normally secure the pulley bolt to the airframe tube were not able to be located and there was no evidence that the fastener had failed due to force associated with the impact sequence (Figure 7).
Figure 7: Rear right rudder pulley, found away from the airframe.
Source: ATSB
An additional anomaly was noted with the left-side rudder pulley. Although the castellated nut was present on the bolt threads to that pulley, no split pin had been fitted. Furthermore, even if one had been fitted, the fastener arrangement would not have prevented loosening of the castellated nut (Figure 8).
Figure 8: Left side rear rudder balance cable bolt and castellated nut
Source: ATSB
Internal corrosion within tubular structure
During the on-site examination of the wreckage, corrosion was noted inside a number of airframe tubes. The rear cockpit‘s rudder balance cable pulley structure also had evidence of internal corrosion. The pilot’s seat rear mount cross-member had separated from the tubular side frames of the forward cockpit, revealing further evidence of internal corrosion. Internal corrosion was also found in the tubular steel structure of the fuselage. It was noted that there was little provision for applying and draining corrosion-inhibiting products to the internal surfaces of the tubes.
Further examination
ATSB identified other anomalies during the on-site examination of the wreckage. There was evidence of incomplete maintenance activity, with further examples of missing split-pins, in the rear-seat mounting bolts and nuts. A split-pin was also missing from the pilot’s seat lower mounting bolt securing nut, which was engaged by several threads, with the locking portion of the nut disengaged.
The rear seat was found outside the aircraft near the tailplane with the individual straps of the seatbelt assembly loose. The position of the seat indicated that significant force/s had been applied to it, raising the possibility that the rear seatbelt assembly became unclipped during the impact sequence.
However, the instructor who flew the aircraft to Latrobe Valley earlier that day reported that, on arrival, he removed a bag that had been secured via the harness to the rear seat and left the seatbelt undone in preparation for a planned 1630 flight with the pilot. If that harness was not secured by the pilot prior to the accident flight, the straps may have fouled the control stick and inhibited full and free movement in flight. From the available evidence, it was not possible to determine if that occurred.
VH-YIX departed Latrobe Regional Airport, Victoria at about 1428 and climbed to 2,600 ft before turning to the north and accelerating to over 200 kt north of Moe. The pilot then began to conduct manoeuvres identified by witnesses as being consistent with aerobatics. A short time later the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot.
This analysis will discuss the development of the accident, including the pilot’s qualifications and readiness for the flight. Aspects of the aircraft maintenance and associated documentation will also be detailed.
Development of the accident
Aerobatic manoeuvres
Witness reports indicated that the pilot was performing manoeuvres consistent with aerobatics, including loops and rolls, immediately prior to an abrupt loss of control.
Analysis of video footage provided by a witness indicated that VH-YIX was established in a spin when the aircraft disappeared from view below 1,000 ft above ground level (AGL). The aircraft damage and localised nature of the accident site confirmed that the aircraft collided with terrain in a right wing‑low and nose‑down attitude at high vertical speed and with little forward movement. That impact signature was consistent with the aircraft established in a spin.
Analysis of radar coverage in that area identified that an aircraft operating below about 1,800 ft above mean sea level would be below radar coverage, and therefore not identifiable on radar. The absence of radar identification of the aircraft during the latter part of the flight therefore indicated that the pilot was operating significantly below his approved 3,000 ft AGL aerobatic limit. More importantly, the aircraft was also well below the altitude that experienced YAK 9 pilots advised was required to safely recover from a spin. As such, and consistent with the observed impact signature, the spin was probably unrecoverable in the height available.
The pilot was qualified to perform basic aerobatics above 3,000 ft AGL, and the aircraft type was appropriate for the aerobatics conducted. However, while the pilot had experience conducting aerobatics, he had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its handling characteristics during such manoeuvres. Specifically, the possible pitch control sensitivities required during aerobatic manoeuvres or spin recovery in the YAK 9.
Additionally, as there was no flight manual/checklist available to the pilot, he was unable to refer to important operational information such as operating airspeeds/limitations during the flight.
In summary, the ATSB concluded that the pilot was probably not adequately prepared to conduct a solo aerobatic flight in the YAK 9.
Canopy
Numerous witnesses recalled that the rear canopy of the YAK 9 was not secure prior to take-off. Consequently, this allowed in flight air loads to slide it fully rearward along its guide rails and ultimately detach it from the aircraft. There was no evidence that the canopy struck any other part of the aircraft as it departed the airframe.
While it remains unknown if an open rear canopy may have a detrimental effect on airflow over the rear control surfaces of the YAK 9, it is unlikely to have been sufficient to cause a loss of control as it was open from the commencement of the take-off. However, the canopy’s departure from the airframe was probably sudden and could well have distracted the pilot. Given the proximity between the canopy and the wreckage location and the flightpath of the aircraft however, it was considered likely that the canopy detached during the spinning vertical descent.
Aircraft maintenance
Defects
Examination of the rear rudder balance cable pulleys identified that the associated fasteners were not correctly secured. Specifically, the required split pins were not fitted and this led to detachment of one of the castellated nuts. Despite that, the design of the pulleys is such that the bolt shank is unlikely to migrate from its installation during operation as cable tension from the rudder control is likely to keep the rudder pulley bolt in place during service.
In addition, wreckage examination also identified unsecured rear seat mounting bolts and an unsecured pilot’s seat mounting nut.
Finally, significant corrosion was identified within the steel fuselage frame. The nature and progression of the corrosion was not at a magnitude to be visually identifiable on the external airframe, however it may have presented a significant future risk to aircraft operation. Russian accredited representatives advised that internal tube anti‑corrosion measures are not applied to the YAK 9, and that no internal surfaces are coated during manufacture.
These observations, while not considered to have contributed to the accident, indicated that maintenance had not been performed on the aircraft to an acceptable standard. That had the potential to affect the future airworthiness of the aircraft.
Documentation
The loss of the maintenance release approaching Dubbo Airport meant that the written means to convey relevant maintenance information or defects was unavailable to both the instructor and the accident pilot. While this did not influence the development of the accident, operation without this document increases the risk that maintenance may be overdue, or that a defect may compromise the safety of the aircraft.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving the Yakovlev 9-UM (YAK 9), registered VH‑YIX, which occurred 19 km west‑north‑west of Latrobe Regional Airport, Victoria on 7 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While conducting aerobatic manoeuvers, the aircraft entered a spin and impacted terrain.
The pilot initiated aerobatics lower than his flight activity endorsement permitted and well below the height required to safely recover the YAK 9 from a spin.
The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.
Other factors that increased risk
The rear canopy was unsecured before take-off and consequently separated from the aircraft during flight. This increased the risk of damage to aircraft structure, distraction of the pilot and possibly adverse handling qualities.
Post-accident examination of the aircraft identified incomplete maintenance practices, including inadequate airframe anti‑corrosion measures and insecure primary flight controls and seat fasteners.
The aircraft was operated without the maintenance release or the flight manual, which deprived the pilot of important operational and maintenance‑related information.
Additional details
Pilot details
Licence details:
Commercial Pilot Licence (Aeroplane) issued April 2010
The sources of information during the investigation included:
witness interviews
the pilot’s previous flight instructors
interviews with YAK 9 pilots
the aircraft logbooks and maintenance documentation
the aircraft flight manual and documentation
Airservices Australia and Department of Defence radar data
the Civil Aviation Safety Authority pilot licence and aircraft documentation
the pilot logbook
video and audio information related to the flight.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, Airservices Australia, Department of Defence, National Transport Safety Bureau, Interstate Aviation Committee, the maintenance provider and the pilot’s recent flying instructor and a subject matter expert in the YAK 9.
A submission was received from the pilot’s recent flying instructor. The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 15/11/2018
What happened
On 7 September 2018, a Yakovlev Aircraft Factories YAK-9UM aircraft, registered VH-YIX (Figure 1), was being operated on a private flight from Latrobe Regional Airport, Victoria. The pilot/owner of the aircraft was the sole occupant.
The aircraft departed the airport at about 1425 Eastern Standard Time.[1] Recorded air traffic control data showed that the aircraft initially tracked from the airport to the west toward Morwell, climbing to about 2,600 ft and heading north-west near Moe.
Several witnesses described seeing the aircraft conducting aerial manoeuvres to the north of Moe and video footage from a witness showed the aircraft in a steep spiralling dive shortly before it collided with terrain (Figure 2). Other witnesses described seeing the aircraft moments prior to the accident with the engine ‘not revving very loudly’, and ‘making popping noises’. The aircraft was destroyed, and the pilot was fatally injured.
On-site examination of the wreckage and surrounding ground markings indicated that the aircraft impacted terrain in a right-wing low, nose‑down attitude. The tail of the aircraft separated from the fuselage during the accident sequence. Both wings, the forward fuselage and the cockpit were substantially disrupted and compressed from vertical impact forces. An extensive area surrounding the accident site was contaminated with fuel that was released when the wing tanks ruptured. The degree of propeller damage observed on-site was consistent with the engine producing a level of power at the time of impact.
The ATSB recovered a number of components from the accident site for further examination. The aircraft was not equipped with a flight data recorder or cockpit voice recorder, nor was it required to be.
Figure 2: VH-YIX aerial picture of accident site
Source: ATSB
Ongoing investigation
The investigation is continuing and will include consideration of the:
pilot’s qualifications, experience and medical history
recovered aircraft components
maintenance documentation
operational documentation
witness interviews
electronic devices recovered from the aircraft.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 19 July 2018, a Quest Kodiak 100 aircraft registered P2-NTZ experienced a nose wheel collapse during landing at Mibu Airstrip, Raicoast District, Padang Province, Papua New Guinea. The Papua New Guinea Accident Investigation Commission (AIC) is conducting an investigation into this occurrence.
As part of its investigation, the AIC requested technical assistance from the ATSB. The ATSB was asked to examine the fractured nose wheel fork to determine the failure mode and if there were any pre-existing defects. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
The ATSB completed the component examination and found that the assembly fractured as a result of overstress with no evidence of pre-existing defect.
The PNG Accident Investigation Commission is responsible for and will administer the release of the final investigation report into this accident. Further information regarding the occurrence can be found at www.aic.gov.pg or specific enquiries should directed to infor@aic.gov.pg.
__________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Occurrence summary
Investigation number
AE-2018-060
Occurrence date
19/07/2018
Location
Mibu Airstrip, Raicoast District, Padang Province, Papua New Guinea
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 6 September 2018, the ATSB commenced an investigation into a safeworking irregularity between a suburban passenger train (45-E) and three rail track workers on the Up Suburban Line on 3 September 2018, about 100–200 m from Flemington Station in Sydney, New South Wales.
A protection officer and work group of three arrived at Flemington to place temporary speed restriction warning boards beside the Up Suburban Line on 3 September 2018, in conjunction with a track possession between Homebush and Redfern. Heavy rain prevented the group from immediately accessing the track.
After 25 minutes, the protection officer was contacted by the possession protection officer and advised that the track possession between Homebush and Redfern had been granted. Without conducting a safety assessment or seeking permission from the Flemington area controller, the protection officer and work group entered the rail corridor and moved along the track, towards the location where they intended to place the warning boards.
As Sydney Trains’ Leppington to Circular Quay suburban passenger service 45-E approached Flemington station on the Up Suburban Line at 70 km/h, the train driver saw the three workers on the track. The train driver sounded the horn and applied brake, and the workers moved across to the adjacent Down Suburban Line. The incident was subsequently reported by the train driver as a ’near miss‘.
On questioning the possession protection officer about the presence of a train within the track possession area, the protection officer was reminded that the section where the work group intended to place warning boards was not within the track possession between Homebush and Redfern.
The ATSB obtained the Sydney Trains workplace investigation report and initial incident reports, audio communication between the protection officer and the area controller Flemington, CCTV camera footage from Flemington station, and interviewed the protection officer.
Based on its review of this information, the ATSB concluded that it was unlikely that further investigation of this specific occurrence would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
Safe work on track is one of the ATSB’s SafetyWatch items. The ATSB is aware that this occurrence has similarities with a number of other occurrences in recent years in the Sydney region, and the ATSB is currently conducting other investigations of safe work occurrences. The ATSB is actively monitoring these types of occurrences.
At about 1040 on 19 August 2018, the train crew of Pacific National train 7MP7, travelling from Cook, South Australia to Parkeston near Kalgoorlie in Western Australia approached the points located at the eastern end of the Coonana train order location. Around 4 hours earlier, the trackside interlocking at Coonana detected that the point machine at the eastern end had not set correctly for the main line following the passage of a previous train. The colour light indicator (enhancer) situated adjacent to the point machine displayed a red light (stop indication) to approaching train crew of 7MP7.
During the approach to Coonana, the train crew of 7MP7 maintained track speed while looking for the light displayed by the enhancer ahead. When they realised that they could not see the enhancer, they braked but were unable to stop train 7MP7 before it traversed the eastern point machine travelling at 44 km/h and derailed. The two lead locomotives, unoccupied crew car and first two platforms of the lead wagon derailed, destroying around 200 m of the main and crossing loop tracks. The train crew were uninjured.
What the ATSB found
Point machines at each end of Coonana crossing loop would normally be set to allow travel along the main line. An incorrectly stored locking pin from a point clamp dislodged and caught in a mechanical pivot mechanism attached to the eastern point machine, preventing the correct movement of the points to reset for the main line after the departure of the previous train.
The ATSB found that during the approach to Coonana the train crew sought to identify and confirm the light displayed on the enhancer. While doing so, the speed of 7MP7 was not sufficiently reduced at the Location Ahead sign to ensure the train could be stopped before the facing points should the light indicator not display a green aspect. Additionally, a breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the enhancer indication when predicted, and the urgency of the intended action to brake the train. Consequently, train 7MP7 approached the eastern end of Coonana at a speed where it was unable to stop before the open points.
The subsequent manipulation of locomotive control inputs in response to the situation highlighted how the on-the-job component of the Pacific National driver competency program did not adequately prepare the trainee driver to control the train in response to an emergency.
What's been done as a result
Post the derailment of 7MP7, the Australian Rail Track Corporation (ATRC) removed all point clamps from the point indicator stands and relocated them to the adjacent equipment huts at each location between Malbooma (South Australia) and Parkeston (Western Australia). Additionally ARTC have replaced all K3 searchlight units with long-range LED luminaire type units between Malbooma and Parkeston.
Pacific National (PN) introduced a SPAD reduction program and reinforced that train crews reduce speed in preparation for stopping short of facing points, until both drivers confirm recognition and understanding of indicator aspects. Additionally PN discussed with ARTC the implementation of improvements to point indicators between Kalgoorlie (Western Australia) and Cook (South Australia).
Safety message
The practice of maintaining momentum approaching a train order location, before confirming the enhancer indication, is an issue that probably affects multiple operators. The variability in the distance for the effective sighting of enhancers and targets at these safety critical locations means the available distance when an indication is sighted may be less than the effective braking distance of the train, which represents a physical gap or limitation in the system. This gap/limitation places the onus on train crews to implement a rule-based procedure to reduce speed at defined locations repeatedly, in preparation for an anomalous event where the enhancer might display a red light (stop indication).
The occurrence
At about 0320[1] on 19 August 2018, a train crew comprising a supervising and trainee driver signed on to duty at Cook in South Australia. They were rostered to work a westbound Pacific National freight train (7MP7) to Parkeston, located near Kalgoorlie in Western Australia (Figure 1). The journey to Parkeston was the return leg of their first round trip[2] together as a crew.
Figure 1: Referenced locations between Cook and Parkeston (Kalgoorlie)
Source: Geoscience Australia, annotated by ATSB
The crew took control of 7MP7 following its late arrival into Cook. After refuelling train 7MP7, the crew received a Train Authority[3] (TA) from the Australian Rail Track Corporation Network Control Officer (NCO). With the trainee driver driving, train 7MP7 departed Cook at about 0347, approximately one hour later than the scheduled departure time. Shortly after, as 7MP7 approached the Koonalda Block Point,[4] the driver performed a routine running brake test,[5] which indicated no abnormality in the train’s braking performance. The lead locomotive intermittently lost traction en-route, activating the wheel slip alarm, causing the train crew to apply various driving techniques in an attempt to rectify the issue and restore tractive effort.
At about 0545, the crew travelled through the main line at Reid, crossing the first in a series of eastbound trains that would be stopped on the adjacent loop track at the respective crossing locations. Around the same time, the crew of an eastbound train (7PM5) were preparing to depart the Coonana loop track, about 500 km ahead. The crew of 7PM5 had completed a similar cross with the preceding westbound train to 7MP7.
To depart the loop track, a crewmember from 7PM5 operated a trackside pushbutton to motor the point machine at the eastern end of the yard to the reverse position. Once reversed, the point indicator displayed a yellow dumb-bell,[6] signalling the points had set correctly for the crew’s departure. Shortly after, the rear of train 7PM5 cleared the points at the eastern end of Coonana and the trackside interlocking automatically controlled the point machine to return to the normal position, set for the main line.
At about 0550, the trackside interlocking detected that the point machine had not motored to the normal position within the required time. As the points were not correctly set, the light indicator (enhancer) at the eastern end of Coonana displayed a red light (stop indication) to westbound train crews.
At about 0640, the crew of 7MP7, the next westbound train, passed through the main line at Mundrabilla after crossing another eastbound train stopped on the adjacent loop track. At Mundrabilla, the trainee and supervising driver changed over, with the supervising driver moving into the driver’s position. The supervising driver continued driving through to Wilban, where the trainee driver again changed over into the driver’s position at about 0820. Shortly after, the NCO issued the next TA to the crew, authorising travel from Rawlinna through Coonana to Golden Ridge. The NCO had no information to indicate that the eastern end-point machine at Coonana had not returned to normal for the passage of 7MP7 or that the point indicator was displaying a stop light.
The trainee continued driving, crossing train 7PM5 which stopped in the loop track at Rawlinna. The trainee and supervising driver planned another driver change at Zanthus (about 39 km before Coonana), but the trainee wanted to continue toward Parkeston to gain additional driving experience and route knowledge for the track section in that direction. At about 1020, the crew passed through Zanthus, and the supervising and trainee driver continued to discuss train-handling practices for maintaining momentum on the undulating grades through the sand hills ahead.
Approaching Coonana, the In-Cab Activated Points System (ICAPS) sounded an alert that the crew were approaching a crossing location ahead. The train crew did not need to take any action to the ICAPS alert, as their TA allowed travel on the main line through that location. The train crew cross-called[7] the TA and again discussed the typical train-handling practices for the approach. The trainee driver was also aware of an unposted temporary 80 km/h speed restriction at the eastern end of Coonana, and the need to manage train speed for that restriction. About 2,500 m from Coonana and travelling at about 115 km/h, the train passed the Location Ahead sign.
The trainee and supervising driver were both looking for the indication displayed on the eastern end enhancer, located to the left of the track ahead. From the driving position, the trainee could not discern any indication among the trackside vegetation and was waiting for the supervising driver’s call that he had sighted an indication from the observer’s position. Shortly after, the supervising driver, unable to sight any indication, calmly said to the trainee ‘brakes’. The supervising driver continued to look ahead, searching for the indication.
About 1,700 m from Coonana and travelling at 115 km/h the trainee understood the instruction from the supervisor was in relation to slowing the train in preparation for the 80 km/h speed restriction ahead. The trainee subsequently applied a minimum service airbrake application before incrementally reducing the throttle setting from notch T8 towards idle. Shortly after the supervising driver, still unable to sight an indication, realised the brake application was minimal and that the throttle setting was in power. The supervising driver told the trainee to make a full service application then, shortly after, to put the automatic brake into the emergency position.
About 1,200 m from Coonana and travelling at 110 km/h, the trainee moved the throttle control rapidly through idle to notch D8, the full dynamic braking position. Shortly after, the trainee moved the automatic brake handle toward the emergency position. About 750 m from Coonana, the supervising driver told the trainee to apply the independent brake also. Initially the trainee manipulated the independent brake handle position in order to maintain a light application before the supervising driver said to apply the independent brake fully. About 550 m from Coonana, the supervising driver left his seat and operated the End-of-Train emergency switch located on the driver’s console, in an attempt to exhaust air in the brake pipe from the rear of the train in addition to the automatic brake control setting.
The indication on the enhancer was still unsighted, but the trainee recalled the point indicator appeared to display a green arrow as they approached. Around 500 m from the points, the supervising driver saw a red light displayed on the enhancer. Shortly after, the supervising driver saw that the points were not fully set for the main line and warned the trainee to brace for a derailment (Figure 2).
Figure 2: 7MP7 approaching Coonana eastern end indicators and points.
Source: Pacific National, annotated by ATSB
At about 1045, train 7MP7 traversed the eastern points travelling at 44 km/h and derailed, destroying around 200 m of the main and crossing loop tracks. The two lead locomotives, an unoccupied crew car and wagons RQFY 58G and RRQY 733K-platforms 4 and 5 derailed all wheels (Figure 3). The train crew were uninjured.
Figure 3: Derailed locomotives NR 54 (lead) and NR 120 (trailing).
Source: Pacific National, annotated by ATSB
Post-derailment
Investigators from Pacific National and the Australian Rail Track Corporation (ARTC) attended the site after the derailment to gather evidence. ARTC undertook the onsite inspection and testing of the point machine, point control system and indicators.
Investigators identified that an unsecured locking pin from a point clamp stored on the eastern Point Indicator stand had fouled the pivot mechanism of the Point Indicator, preventing the complete travel of the throw arm and the attached point blade (Figure 4). The left point blade in the direction of travel had not closed against the stock rail, meaning the gauge face[8] of the left running rail was not continuous through the main line. The wheel flanges of the leading locomotive split the points, resulting in the derailment.
Investigators also verified that following the departure of 7MP5 from the eastern end of Coonana, the trackside interlocking restored the enhancer to display a red light. The points commenced motoring from the reverse position toward normal, but were not detected as being locked in the normal position (set for the main line). Additionally, the point indicator attached mechanically to the points had not rotated fully 90⁰ to display a complete green arrow target. The trackside interlocking functioned as designed, with the light indication on the enhancer remaining at red and the point indicator not rotating fully.
On the morning of 23 August 2018, train services resumed via a temporary deviation track. The main line at Coonana remained closed until the completion of the track infrastructure replacement works.
Figure 4: Light and point indicators at eastern end of Coonana post-derailment.
Coonana is located about 170 km east of Kalgoorlie in Western Australia at the 1610.942 km point[9] on the Australian Rail Track Corporation (ARTC) interstate rail network. A Network Control Officer (NCO) manages train movements through Coonana from the ARTC Network Control Centre located at Mile End, Adelaide, South Australia,
Approaching Coonana from the east, the last 10 km of track is tangent, with falling grades of around 1:100 transitioning about 4 km from the points through level to primarily rising grades of around 1:200.
The environment along the train line between Cook and Kalgoorlie is comprised of predominately gently undulating terrain, with low-lying saltbush and scattered over-story of western Myall or Mulga vegetation. At Coonana, there were numerous tall trees bordering the rail corridor on the eastern approach to the enhancer (Figure 6).
Train and crew information
Train 7MP7
Train 7MP7 was an intermodal freight service operated by Pacific National between Melbourne and Perth via Adelaide. The train consisted of locomotives NR 54 (leading) and NR 120 (trailing) hauling 27 wagons for a total length of 1,639 m and gross mass of 3,702 t.
Based on an analysis of the available information, the condition and serviceability of train 7MP7 did not affect its handling in the lead-up to the occurrence, and were therefore not factors in the derailment.
Train crew
The supervising driver was a senior driver, holding a Certificate III in Transport and Logistics (Rail Operations) with around five years’ driving experience. The supervising driver had arranged a shift swap with the mentor driver, who normally worked with and tutored the trainee driver. Prior to the shift, the supervising driver and mentor driver had discussed the proficiency of the trainee.
The trainee driver commenced work with Pacific National in mid-December 2017. Following completion of the classroom component of the training in mid-February 2018, the trainee commenced the practical training (on the-job) component, operating various train services from Kalgoorlie on track sections toward Merredin to the west and Cook to the east. The trainee had driven sections of the track between Kalgoorlie and Cook for about six months, but mainly in the direction toward Cook.
The duration of the Pacific National practical training component was typically 12 months, but a planned train crewing change at the Kalgoorlie depot brought forward the trainee groups’ assessment to October 2018. The rescheduling of the assessment increased the trainee driver’s awareness of the need for additional experience in operating trains on the undulating grades toward Kalgoorlie. This provided impetus for the trainee driver continuing to drive from Zanthus, rather than changing roles with the supervising driver as originally planned.
Toxicology, medical and physiological factors
On returning to the Pacific National offices at Kalgoorlie at about 1800, the crew of 7MP7 submitted to a post-incident screening test for the presence of alcohol or drugs. Each crewmember tested negative to the presence of alcohol or prescribed drugs.
An examination of the trainee and supervising driver’s health assessment records confirmed that their health assessments were current and that the individuals met the required standard prescribed by the National Standard for Health Assessment of Rail Safety Workers. There was no evidence to suggest that any medical or physiological factors affected either crewmember’s performance leading up to or during the incident.
Fatigue
Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission (Battelle Memorial Institute, 1998). Due to these negative effects on cognitive performance, fatigue is a factor that increases the risk of transport accidents.
The crew of 7MP7 had worked train 6PS7 from Kalgoorlie to Cook the previous day (18 August 2018), signing off at about 1720. After signing off, they went to their designated accommodation in Cook and retired for the evening.
The following day, the crew were rostered to commence their shift at 0240 but, as train 7MP7 was running late, Pacific National delayed the crew’s wakeup call until about 0220. The crew commenced their shift at about 0320 on the morning of the 19 August 2018. The crew were about 7 hours and 25 minutes into their shift when the derailment occurred.
The off-duty period provided an opportunity for the crew to attain restorative sleep prior to commencing work. Each driver advised that they had a good sleep and felt rested when they commenced duty. It is unlikely that fatigue adversely affected the crew’s performance during this shift.
Environmental Conditions
The train crew reported that, on departure from Cook, the weather was cold and foggy. The fog cleared shortly after sunrise and approaching Coonana, the weather was clear. The crew advised that the position of the sun (rising directly behind them) could at times adversely affect their ability to sight an enhancer ahead. The signals at Coonana, like many signals from Cook to Parkeston, were oriented approximately due east.
Safeworking system
ARTC managed the safe movement of trains between Cook and Parkeston via a verbal communications based Train Order Working system (TOW). Before issuing a Train Authority (TA), the NCO would verify, through manual procedures, that the proposed route was clear. The NCO could then issue an authority to the train crew, who then recorded the authority on a paper based Train Authority form. The train crew reading the TA back to the NCO validated its content. The TA, once validated, then authorised the train crew to proceed between specified locations and in accordance with any additional instructions, if included.
The train crew were responsible for the setting and verification of points at the locations between Cook and Parkeston. The NCO does not have any visibility of the position of points or the status of trackside light indicators (enhancers) at the locations.
A train crew executing a TA were therefore required to comply with the instructions of the TA together with any additional trackside signs or indications. The train crew were required to implement the applicable operational rules and procedures contained in the ARTC Code of Practice for the Interstate Rail Network (CoP) and ARTC Addendum to the Code of Practice for the Defined Interstate Rail Network (Addendum).
For this occurrence, the NCO issued a sequence of four TA’s to the crew of 7MP7 for the trip from Cook. Each TA authorised the crew to travel along the main line to the next location where a cross with an opposing train would occur (Reid, Mundrabilla and Rawlinna). The Addendum required each train crew undertaking a cross at a train order location to implement specified crossing and passing procedures. The train crew were also required to comply with various Pacific National operational procedures to mitigate the potential for passing a signal at stop.
Train order locations
Between Cook and Parkeston, 22 locations were available to cross or pass trains to a maximum length of 1,800 m. Each location had the facility to operate the points via local controls (push buttons installed on the wall of the equipment tank) or remotely from locomotives equipped with an ‘In-Cab Activated Points System’ (ICAPS). Both the local and remote controls interfaced through trackside interlocking equipment to operate the facing points and the aspect displayed on the respective light indicator. The trackside interlocking also provided the auto-normalisation feature of the point machines.
Remote operation was available provided the locomotive’s ICAPS GPS detected that it was located within a set limit (window), typically a two-kilometre long strike point located five to eight kilometres from the train order location. Within this limit, the train crew could enter a selection to control the facing points ahead. The points were normally set and locked for travel through the main line, therefore a selection by the train crew was only required if the TA instructed the crew to take the crossing loop track.
Each location was similar in track configuration, equipped with trackside signage, targets and light indicators adjacent to the track. The features provided additional information to train crew approaching the self-restoring point machines[10] located at either end (Figure 5).
Figure 5: Typical Train Order Location with Light Indicators and self-restoring points.
Source: Australian Rail Track Corporation
Trains crossing at train order locations
The Addendum contained various procedures for sequencing the crossing or passing of trains at train order locations. In the majority of cases, train crews would undertake a cross, where the authority of the first train crew train to arrive at the location required them to occupy the crossing loop track.
This required the train crew to operate the points to reverse via ICAPS, and reduce train speed toward the target speed of 35 km/h for the turnout at the points. After confirming the correct indications, they were to enter the crossing track and clear the main line.
After stopping prior to the clearance point at the opposite end of the loop, the train crew were to confirm the points ahead were correctly set for the approaching train to travel along the main line. After confirming the points, the train crew were also required to report their arrival at the location to the NCO. The train crew also communicated via UHF radio with the train crew of the approaching train to provide admittance into the location. The train crew of the approaching train were not to proceed beyond the Yard Limit Sign until they received the admittance from the train crew of the opposing train.
Predicted braking distance based on particular train type
The selected trackside location for signals, indicators and signage considered a range of factors in providing train crews with sufficient opportunity to sight and react to the trackside indications. The Train Braking Application Design Standard[11] detailed the typical stopping distances for the particular train-type travelling at various speeds, on an applicable track gradient.
The configuration of train 7MP7 was consistent with the specified train type of a ‘1800 m long Super-freighter braking 115 km/h max’. The ARTC GW-50 brake table illustrated the calculated braking performance for this train type travelling at varying speeds and gradients (Table 1).
The table indicated that the designated stopping distance (with full service brake application to point of stop) for a train travelling at the maximum permitted track speed of 115 km/h and on the track grade approaching the eastern end of the Coonana location would be about 2,124 m.
Table 1: GW-50 Super-freighter stopping distance
Source: Australian Rail Track Corporation. Annotation by ATSB
Trackside signs
Trackside signs provided train crew with either operational or advisory information defined by the shape and colour of the particular sign. The Location Ahead sign provided operational information and was a caution sign, warning train crew of the approach and distance to a location and recognition of its designated name (Figure 6). For the ARTC TOW safeworking system, the typical approach warning distance from the Location Ahead sign to the location’s yard limit advisory sign was 2,500 m. The Addendum described requirements for train crews:
At the location sign in advance of a location equipped with light indicators and/or with point indicators.
The train shall reduce speed, and be prepared to stop before the facing points. The maximum speed may be maintained or resumed when the Train Crew has confirmed that the correct indication is displayed.
The points installed at each end of the train order locations between Cook and Parkeston were equipped with a Point Indicator, positioned adjacent to the main line and mechanically connected via rodding to the self-restoring motorised point assembly. The Point Indicator displayed a standard day/night reflectorised target, indicating to the train crew the direction the points were set (Table 2). Movement of the points operated the mechanical rodding and an attached vertical spindle that rotated the Points Indicator targets through 90⁰ so that only one target faced the oncoming train crew and the other obscured from the drivers view by being side-on. The position of the points normal or reverse determined which target displayed. The positioning of the target next to the track should afford train crew adequate sighting and convey a clear and unambiguous message about the state (direction of lie) of the attached points.
Table 2: Point indicator target aspects
To depart a crossing loop track, a member of the train crew would detrain and operate a local push button control to motor the points to the reverse position. Prior to moving off, there was ample time for the train crew to sight the target indication and confirm the correct lie of the points ahead. Similarly, a crew departing from the main line after stopping for a cross or pass would also have ample time to confirm the lie of the points ahead before moving off. In both scenarios, once the rear of the train cleared the points the trackside interlocking auto-normalisation feature would control the points to return to the normal position (set for the main line) and a corresponding green arrow target displayed on the Point indicator.
A train crew approaching a train order location should also have reasonable opportunity to sight the target indication to determine the correct lie of the points. The engineering standard Signal Sighting and Position[12] defined the primary minimum sighting distances applicable to the Point Indicator target, relative to the approach speed of the train (Table 3). The standard indicated that the positioning of the Point Indicator target should allow the train crew a minimum approach view of 8 seconds.
For locations fitted with point indicators only, the Addendum limited the maximum permissible speed over the points to 70 km/h. The minimum sighting distance for a train travelling at 70 km/h, was 156 m in order to ensure the required 8 seconds of viewing distance. To ensure sufficient distance remained available to stop the train upon sighting the indicator, the driver needed to commence braking approaching the location, prepared for a stop at each location.
Table 3: Minimum sighting distance
Source: Australian Rail Track Corporation
The trainee recalled sighting a green arrow target on the Point Indicator when train 7MP7 was further than 550 m from the eastern end of Coonana. The points were not set for the main line and the Point Indicator had not completed a full 90⁰ rotation due to the Point Clamp pin fouling the pivot mechanism. Although the trainee recalled sighting a green arrow on the target ahead, this was not consistent with the information intended from the Point Indicator display.
Point indicators at train order locations do not confirm that the attached point machine is locked in the indicated position (normal or reverse) consequently train crews needed to slow the train to a speed where the correct target display could be confirmed and points checked, while allowing sufficient distance to stop the train if necessary.
Colour light indicators (enhancer and repeater)
The colour light indicator (enhancer) installed adjacent the Point Indicator provided an enhancement to the standard day/night reflectorised target.[13] The enhancer provided a more conspicuous indicator that the train crew should be able to sight at a greater distance from the facing point[14] enabling them to confirm earlier during the approach that the point machine had set and locked for the correct track. The greater sighting distance meant that if the train crew could confirm a correct indication displayed on the enhancer during the approach to the Location Ahead sign, the train crew could then maintain or resume speed, up to the maximum track speed of 110 km/h, to traverse the facing points.
The colour light indicators were typically equipped with a K3-style Searchlight unit containing an optical system of an incandescent globe, reflector, coloured roundels and lenses intended to provide long-range sighting from a distance of 2,500 m. Following the introduction of the enhancers, ARTC undertook modifications to the K3-style units to rectify significant variations in sighting distance provided between locations. ARTC also substituted the K3-style optical system with a single head colour light unit with a tricolour light-emitting diode (LED) or a multi-head colour light unit with red, yellow and green LEDs at new or upgraded enhancer or repeater installations.
The enhancer indicated the position of the adjacent points and provided additional information on the status of the points at the opposite end of that location (Table 4). Due to sighting limitations caused by topography or other obstructions at some locations, an additional colour light indicator (repeater) may be installed (about 2,500 m before the enhancer) that 'repeats' the indicator aspect (colour) of the enhancer in order to give train crews advance warning of its condition. Coonana did not have repeaters installed.
Table 4: Colour light enhancer aspects
If the points at either end of the location were correctly set for the main line (as was intended in this case), the enhancer should display a steady green light. If the points did not fully transition and set for the main line, the enhancer should display a red light (as occurred in this case). The required action to a red light is to stop and inspect the points.
As the status of the points or enhancers were not known to the NCO, the ARTC Addendum to the Code of Practice required a train crew departing from the crossing loop of a location to:
Where possible, following departure observe that the points have restored for the main line and a steady green aspect is displayed by the light indicator.
The aim of this requirement was to identify any failures before the passage of the next train. In this case, train 7PM5 was the last train to depart the eastern end of Coonana loop. However, given the length of the train, exit speed and the distanced travelled it may not have been possible for the crew to observe the points or light indicator via the locomotive driver's mirrors once the train had completely cleared the crossing loop, and the points had completed the intended function and returned to the normal position.
The train crew of the next opposing direction train (7MP7) stated that as they approached Coonana, they did not see the indication displayed by the enhancer until the train was about 500 m from the facing points at the eastern end.
ARTC engineering documentation
The optimal visibility of the aspect displayed by railway infrastructure defined as a trackside colour light signal or a colour light indicator (enhancer or repeater), of any luminaire type, is dependent on routine maintenance and the correct alignment of the light beam relative to the railway track.
The engineering standard Signal Sighting and Position specified the primary maximum distance to obtain optimal sighting, the maximum sighting distance, was 10 seconds for trackside colour light signals equipped with a standard-type luminaire. The specification of minimum and maximum distances provided drivers with reasonable opportunity to sight and react to the indication, while controlling the risk of read through to a signal in advance. While not specifically referencing being applicable to enhancers or repeaters installed under the TOW safe working system applicable to the Nullarbor Plain, the standard stipulated:
Where there is an absence of geographic markers for the driver (e.g. Nullarbor Plain) or the signal is not significant against the horizon or the sun may be directly behind the signal then the application of long range luminaries is acceptable.
The intention of providing a long-range type luminaire was therefore to provide a sighting distance greater than the typical 10 seconds at the nominated track speed.
The specification Signals–Work on Asset outlined the alignment requirements applicable to trackside colour light signals (including the Searchlight-type) and the routine servicing procedure applicable to both a signal, and enhancer/repeater lamp.[15] The specification required the alignment of Searchlight-type signals (sighting point)[16] to provide a sighting distance[17] of 1,000 m on a main line with straight approach. The specification did not identify whether the signal was fitted with a standard or long-range luminaire nor if the sighting point applied to enhancers/repeaters equipped with Searchlight type units. In contrast, the ARTC documents Signalling Technical Maintenance Plans applicable to Colour Light Type signals (multi-head colour light units) fitted with incandescent or LED type luminaires specified a long-range sighting point of 400 m. The documents did not specifically reference if the sighting point applied to the similar multi-head colour light units fitted to some enhancer/repeater installations.
ARTC engineering documents specified varying sighting points (either 400 m or 1,000 m) dependent on luminaire type. Although the documents specifically related to fixed signals, applicable to safe working systems of signalled areas in the ARTC network the light indications provided by enhancer/repeater luminaires that are similar in appearance to fixed signal luminaires (Searchlight and Colour Light type) were not specifically addressed. The ARTC CoP and Addendum purposely did not classify the enhancer as a fixed signal.
Notwithstanding the related ARTC specifications, no ARTC standards or maintenance procedures contained corresponding reference to the sighting point or distance applicable to colour light indicators (enhancers/repeaters). ARTC confirmed the practice in the field was to align enhancers (and repeaters) to a sighting point 1,500 m in the rear of (approaching) the enhancer/repeater.
Pacific National conducted audits of the enhancer sighting on the east and west approaches to each location between Kalgoorlie and Cook. On each occasion, train crew recorded the distance at which they observed the light indication, together with the time of day and environmental conditions. Crews reported significant variations in the sighting distance to enhancers between each location, due to the direction of approach at a particular location, the time of day or ambient light conditions.
Observations for the western approaches identified four locations[18] where a train crew reported difficulty in distinguishing the green light displayed on the enhancer. Observations for the eastern approaches identified four locations[19] where sighting was difficult due to the ambient light conditions at that time of day or other environmental conditions. Each of the locations identified were equipped with K3 style Searchlight units with an optic system containing incandescent lamps. The two records for the eastern approach to Coonana indicated that in the late afternoon, with overcast conditions, the train crew undertaking the audit sighted an indication from a distance of around 2,250 m.
The drivers of 7MP7 stated that approaching Coonana, the trees adjacent to the corridor, and variations in ambient conditions, made it more difficult to sight enhancer indications at a distance, particularly the enhancers fitted with an incandescent globe such as the one at Coonana. The drivers stated that, for that reason, the eastern approach to Coonana was a particularly difficult location for sighting the enhancer from the driving positon. The drivers stated that from previous experiences, the first sighting of the light indication would usually be from the observer’s position at around 2,000 m from the points. The first sighting of the indication from the driving position would typically occur at around 1,800 m from the points.
Reported enhancer issues Cook to Parkeston
Train crews encountering issues with the operation of the trackside equipment at train order locations report the occurrence to the ARTC Network Control Officer (NCO). Following receipt, the NCO generates a Train Control Report (TCR), logs the report for attendance by maintenance staff and, depending on the nature of the issue, provides warning to other train crews via the ‘Condition Affecting the Network’ procedures.
Between April 2016 and August 2018, ARTC recorded 177 TCR reports relating to issues with trackside equipment between Cook and Parkeston. ARTC recorded ten TCRs related to issues with the enhancer at the eastern approach to Coonana where the indication was displaying red, blacked out, or cycling due to a fault. None of the TCRs related to issues associated with poor visibility of the enhancer indication.
Following the derailment of 3MP5 at Rawlinna in April 2016, Pacific National undertook an audit of sighting distances to enhancers between Cook and Parkeston. The audit identified large variance between the locations in the distance at which the crew sighted the enhancer indication. Notations against the respective enhancer attributed the variations to the type of luminaire (incandescent/LED) and time of day at which the train crew made the observation. Sighting distances recorded against the eastern approach to Coonana varied between 1,500 and 2,300 m. These observations were recorded during the afternoon in overcast to twilight conditions.
Point clamp
ARTC provided a point clamp at selected locations for use by authorised personnel (typically train crew) in the event that a failure of the points prevented them from being correctly set and locked. Once the points are set to the correct position, authorised personnel use the point clamp to secure the points for the desired route, as advised by the NCO. At crossing locations between Cook and Parkeston, point clamps were located on a spigot attached to the point indicator stand.
Post-incident, ARTC provided an image depicting the correct storage method with the point clamp placed on the spigot with the locking pin retained in position (Figure 7). However ARTC could not provide any documentation that instructed authorised personnel on the use of this storage arrangement for the point clamp, or requirements that the point clamp be secured against unauthorised use by installation of a railway ‘S’ type padlock.
Figure 7: ARTC example of correct storage arrangement for a point clamp on a point indicator stand.
Source: Australian Rail Track Corporation
At some time prior to the passage of 7MP7, the point clamp at the eastern end of Coonana was placed on the spigot incorrectly: it was not secured by a ‘S’ type lock and the locking pin was stored in a manner that allowed it to hang loose at the end of its attachment chain. The practice of storing the point clamp on the point indicator stand increased the risk of the point indicator throw arm pivot mechanism becoming fouled.
There was no record of a recent point failure where the NCO authorised the use of point clamp by train crew. ARTC maintenance records indicate the last electrical maintenance inspection of the points occurred on the 22 June 2018. There was, however, no requirement within the electrical maintenance or other inspection procedures for a routine check of point clamp positioning or security.
Pacific National systems
In-cab activated points and GPS location alert systems
The Pacific National NR-Class locomotives were equipped with interconnected ICAPS, and the Pacific National AWARE[20] and GPS location alert systems. The ICAPS equipment facilitated train crews setting the required route at the train order location ahead from within the locomotive cab without having to stop the train at the facing points.
When ICAPS activated, a screen in the locomotive cab displayed a message showing the location name and two touch-screen buttons. An audible tone accompanied the message, alerting the driver that the system was active. If a crossing loop movement is authorised, the crew can command the points to set for the crossing loop. If a main line movement is authorised, the crew can dismiss the message and leave the points in their current position. Similarly, if the crew take no action, the points will remain in their current position (usually set for the main line).
The GPS location alert system is an enhancement to the AWARE system that provides track position information to the train crew when approaching a crossing loop or block point location. The purpose of the system is to ‘prompt the train crew to check their current limit of authority’.[21] If the crew has already made an ICAPS selection for the loop, the alert will not activate since the crew has taken action relevant to the train authority.
The GPS location alert system displays a message on the AWARE screen when the locomotive is about 5 km from the crossing location. A single audible beep also sounds, but there is no requirement to acknowledge the message.
When a locomotive is within 3 km of the crossing location, the system sounds three audible beeps and a message on the AWARE screen. For this alert, the system requires acknowledgement within 10 seconds, using the AWARE system touchscreen located adjacent the co-driver’s position. If not acknowledged, the audible beeps continue with increasing volume until actioned or if the train has travelled 3 km past that particular crossing location.
When the locomotive is about 3 km past the crossing location, the AWARE screen displays a message identifying the name and track kilometre point for the next crossing loop. No audible tone accompanies this message nor is there a requirement for the train crew to acknowledge it.
Together, the combination of systems provide a sequence of messages and audible alerts to the train crew at each location. The systems do not (nor are they required to have) the functionality to provide real-time train location information to network control. Similarly, the systems do not provide information relating to the condition of the points or indicator ahead.
NR locomotive controls
Master controller - Throttle/Dynamic brake handle
The movement of the throttle/dynamic brake handle enables the control of engine speed (Throttle and Idle) and the application of dynamic braking (Setup and Dynamic brake). Movement of the handle toward the driver, through each of the nine available detent positions (Idle to T8) increases the locomotive traction power applied. By pushing the handle to the right through a spring-loaded gate, the driver sets up a dynamic brake application. After passing through the setup detent, the handle’s position can move smoothly through the dynamic operating range from one to eight.
In applying dynamic braking, the NR-class locomotive operations manual recommended drivers apply a 10-second delay when moving the throttle/dynamic brake handle between each of the idle and setup positions before moving into the dynamic braking zone. Pausing the handle operation acts to protect against electrical component failure and prevent excessive train forces.
Automatic brake control
Locomotive NR 54 was equipped with the Wabtec Fast Brake electronic air brake system. The Wabtec system consisted of two major components, the Handle Controller Unit (HCU) and the Pneumatic Operating Unit. The HCU provided the driver with the ability to control separately the application of train or locomotive braking through the operation of the automatic or independent brake handles respectively (Figure 8). The locomotive event logger recorded the brake pipe and brake cylinder pressures resulting from the manipulation of the HCU handles.
Figure 8: Handle control unit located in the locomotive cab to the left of the drivers position.
Source: Pacific National annotated by ATSB
The automatic brake handle had seven detent positions available through the operating range:
Release (REL)
Minimum Reduction (MIN)
70 kPa Reduction (70 kPa)
Full Service (FULL)
Suppression (SUP)
Handle Off (HO)
Emergency (EM).
The operational area between the Minimum Reduction (MIN) and the Full Service (FULL) detent comprised the normal service-braking zone. Positioning the automatic brake handle through this area resulted in typical brake pipe pressure reductions of between 50 and 150 kPa respectively.
Positioning the automatic brake handle further forward engages the detent positons of Handle Off (HO) or Emergency (EM). A driver configures the HCU in the HO position during the setup of the non-driving position whenever a locomotive is a trailing unit in a multi-unit consist or being towed ‘dead’. In the HO position, the brake pipe pressure will reduce at the service rate to 0 kPa. The locomotive brake cylinder pressure will rise to approximately 350 kPa.
The automatic brake handle, when placed in Emergency (EM), will immediately initiate evacuation of the brake pipe air, subsequently reducing the brake pipe pressure to 0 kPa. In addition to the reduction in the brake pipe pressure, placing the handle in the EM position on NR class locomotives will cause the sanding system to deliver sand to the railhead in front of the leading wheels of each bogie. Additionally, if the master controller setting was set in the dynamic braking operational range, the selection of EM will cause the automatic release of dynamic braking and the application of the air brake.
The independent brake handle had two positions available through its operating range:
Release
Full Application.
Moving the handle from Release toward the Full Application position increases locomotive brake cylinder pressure, dependent on the position of the handle through the application zone. Alternatively, when in the application zone, moving the handle toward Release would reduce the brake cylinder pressure.
In the Release position, no independent locomotive braking occurs but the driver has the option to release fully (Bail Off) any locomotive brake cylinder pressure increase resulting from the operation of the automatic brake handle. To Bail Off, the driver depressed the independent handle in the Release position. Similarly, depressing the handle while in the application zone could partially Bail Off the locomotive’s brake cylinder pressure corresponding to the Independent Brake Handles position.
Sense and Brake Unit
The Sense and Brake Unit (SBU) fitted to the rear vehicle of the train provided End-Of-Train information to the cab display unit in the lead locomotive and End-Of-Train emergency braking in response to a driver-initiated command. The operation of an Emergency EOT Switch located on the left side of the driver’s screen console activated an Emergency Dump Valve via the SBU, initiating the release of the brake pipe pressure from the end of the train in an emergency.
End-Of-Train emergency brake application was only available with the SBU ‘Armed’ and confirmed ‘Armed Two Way’. The NR class locomotive event logger did not record the ‘Armed’ status of the SBU.
Locomotive NR54 event logger
Data extracted from the Wabtec event logger on locomotive NR54 displayed the timing of control inputs and braking application during the approach of train 7MP7 to Coonana (Figure 9).
Figure 9: Event logger locomotive NR54
Note: DB = dynamic brake, EAB BP = train brake pipe pressure, EAB BC = Locomotive brake cylinder pressure, TMC = Traction motor current
Source: Australian Transport Safety Bureau
At about 10:41:40, around 2,500 m from the eastern end points at Coonana and passing the Location Ahead sign, the throttle control of locomotive NR54 remained set to full power (Notch T8) and train 7MP7 was travelling at 115 km/h. Around 25 seconds later, a minimum service brake application (50 kPa reduction in brake pipe pressure) commenced. The brake application was likely in response to the supervising driver’s instruction to ‘brake’. The absence of an increase in the locomotive’s brake cylinder pressure, which would typically occur with an automatic brake application, indicated the trainee likely bailed-off using the independent brake handle control.
Shortly after, the trainee rapidly moved the throttle/dynamic brake handle to maximum dynamic braking, Notch D8. The trainee also moved the automatic brake control from the minimum service position further into the service zone, exhausting additional air from the brake pipe and increasing braking effort along the train. The locomotive did not develop brake cylinder pressure due to the dynamic brake interlock functionality. The trainee’s action was likely in response to the supervising driver’s instruction to apply full service and then emergency braking. Train 7MP7 was travelling at around 110 km/h and 1,200 m from the points at Coonana.
The train speed reduced to around 70 km/h, when the trainee driver commenced an application of the independent brake causing an increase in the locomotive brake cylinder pressure. The initial independent brake application was light, with the position of the handle likely adjusted to maintain light independent braking. Around this time, the Supervising driver operated the EOT Emergency switch. Train 7MP7 was 400 m from the points at Coonana.
There was no appreciable change recorded in the rate that air exhausted from the brake pipe following the operation of the EOT Emergency switch. Around 140 m from the points, a full application of the independent brake occurred. Train 7MP7 was travelling at 50 km/h.
The event logger indicated that air continued to exhaust from the brake pipe at a relatively constant rate to a pressure of around 300 kPa immediately before locomotive NR54 derailed. At that time, the remaining air vented almost instantaneously to atmosphere level. This was almost certainly due to a break in brake pipe continuity during the derailment.
The venting rate of the brake pipe prior to the derailment is consistent with a controlled release of air at a service rate, rather than the almost instantaneous release that would typically occur with an automatic brake handle placed in the emergency position.
The braking response of the locomotive and the brake pipe pressure falling to below the 150 kPa reduction, typically attained from a full service application, indicated that the automatic brake handle was likely moved through the service zone to the ‘handle off’ position. The event logger also recorded that the locomotive maintained full dynamic braking from initiation through to the point of derailment, which would not occur following the placement of the automatic brake handle into the emergency position.
Pacific National driver training
Pacific National was an enterprise-based Registered Training Organisation, resourced with facilitators and assessors to conduct training in the workplace at multiple regional sites. The Pacific National worker competency program derived from the applicable Transport and Logistics Training Packages. The Pacific National Certificate IV in Train Driving program instructed train crew in the safe operation of Pacific National train services through a suite of core, specialised elective units of competency, and various supporting Safety Point Lessons delivered through facilitator-led and on-the-job training.
To manage risk associated with multi-site delivery, administrative and regulatory requirements were centralised with the monitoring of the programs by the regional-based line management of the facilitators at the multiple sites. The Pacific National Kalgoorlie Depot managed the delivery of the training syllabus to trainee drivers based at that location.
Competencies in defensive driving
To mitigate the potential for a train crew to pass a signal at stop or exceed their limit of authority, the core and specialist units included training on topics related to the Identification and Response to Signals and Trackside Signs, and Defensive Train Handling Techniques and Strategies. The training associated with defensive train handling encouraged a conservative approach requiring the driver to be aware of the risks and to implement safety actions that suit the environment. Defensive driving relied on the driver knowing the route thoroughly and understanding the capabilities of the tractive effort of the locomotives, and the braking capacity of the train and rolling stock operated.[22]
The associated Single Point lessons provided train crew with a variety of proactive strategies to implement when approaching safety critical situations. Single Point lessons included:
The safety critical zone related to a set time or distance from a known area of increased risk, such as a stopping location, or limit of authority. While in a safety critical zone, train crew were to direct their attention and actions toward safety critical tasks and the implementation of defensive driving and train-handling techniques, to ensure that they controlled train speed during the approach to stop prior to the designated stopping point. The active teamwork strategies reinforced the importance of shared responsibility to ensure safety would not be compromised by any action, inaction, miscommunication or misunderstanding between crewmembers.
Although Pacific National promulgated these lessons within the organisation, the train crew of 7MP7 maintained track speed at the Location Ahead sign and into the safety critical zone at the eastern end of Coonana.
Competencies in operating a train and responding to abnormal conditions and emergencies
Core and specialist units of competency included respectively, responding to abnormal conditions and emergencies when driving a train and driving a train to operational requirements. The delivery strategy for the training activities included a mixture of facilitator-led activities (eight and 16 hours’ duration respectively) and on the job practice/work experience supervised by a mentor driver (30 and 184 hours’ duration respectively).[23]
The training delivery comprised three streams:
Theory and activities in the training room environment.
Practicals/learning on site and on the equipment to gain familiarisation prior to operating.
The on-the-job learning component, with trainees performing the task of driving a train supervised by a mentor driver.
The training room component provided trainees with an understanding of the fundamentals of operating a train and to recognise, report and manage an abnormal situation or emergency. Abnormal situations were identified as incidents or issues during train operations that required an alteration to behaviour, mindset or the performance of an action to correct, but were not life-threatening. Emergencies were incidents that resulted in major impact to the network operations and infrastructure or had the potential for a fatality. The context of the training in responding to emergency and hazardous situations focused on reporting the emergency to the network manager, Pacific National or emergency services. Following completion of the training room component, the trainee transitioned into the on-the-job component.
Trainees were assigned to a mentor driver, working various train services and routes to obtain the necessary competencies in operating rolling stock to Pacific National’s operating requirement. The mentor driver guidelines[24] detailed the expectations of the mentor driver and the training plan for the trainee during the on-the-job component. At the completion of the on-the-job component, a Driver Trainer assessed the trainee against a verification of competence checklist (VOC).[25] The mentor driver should have discussed all parts of this checklist with the trainee to determine that they were both satisfied that all aspects were understood before the assessment by the driver trainer commenced.
The VOC section covering train management on the main line included an assessment task on the operation the automatic brake handle. A driver undergoing assessment was to perform a split, cycle, balance, full service and emergency application. The emergency application included a notation ‘can simulate’. Pacific National advised it did not carry out practical (on-the-job) training in controlling a train when responding to an emergency event, due to operational practicalities and the potential risk to a train if the training was conducted during normal train operations.
Trainees recorded their experiences gained and the demonstration of practical competencies during the on-the job component in a logbook. A variety of assessment processes determined the trainee’s verbal/written knowledge and the practical application of the knowledge/skills for the competency.
Pacific National worker competency programs instructed and assessed the competency of a trainee in responding to abnormal conditions and emergencies through off-the-job training and ad-hoc discussions during on-the-job training between the trainee, mentor driver and finally the assessor. Trainees and assessors recorded the undertaking of these discussions in the trainee’s individual logbook and VOC to provide evidence the training provided, and the assessment of the trainee’s understanding of the theoretical execution of the competency.
Pacific National provided records of the off-the-job training component for the driver of 7MP7 but were unable to verify the content, or if delivery of the on-the-job discussions related to the automatic brake operation competency, occurred prior to the 19 August 2018 accident.
Previous occurrence
The ATSB investigated a similar derailment of train 3MP5 at Rawlinna, Western Australia on 21 April 2016 (RO-2016-005).
Train 3MP5, travelling from Melbourne to Perth, derailed while traversing the eastern end points at Rawlinna. The points failed to fully restore to the normal position (set for the main line) after the previous train departed the loop track, leaving the points in an unsafe open positon. The colour light point indicator (enhancer) worked as designed by displaying a red light when the points were unable to be detected and locked in a safe position. There were minor injuries sustained by the crew.
The ATSB found that the driver’s expectation that the system was likely set for the main line contributed to train 3MP5 travelling at a speed where it could not be stopped before the open points. Additionally, it was likely a common practice for drivers to approach crossing locations without slowing when authorised for the main line. Compounding this was the points enhancer sighting distance being less than the effective braking distance of trains travelling at line speed, thereby increasing the risk of overrun if not displaying a green aspect.
An incorrectly secured locking pin from a point clamp stored on the point indicator stand fouled the indicator pivot mechanism, preventing the self-restoring point machine from motoring the points fully to the normal position (set for the main line). The practice of storing the point clamp on the point indicator stand increased the risk that the moving point indicator throw arm pivot mechanism could become fouled and prevented from operating as designed.
The points were in an unsafe condition for the passage of rail traffic, causing the enhancer to display a red light (stop indication). The fouled pivot mechanism also prevented the point indicator from rotating fully to display a complete green arrow target. (However, it did rotate enough for the green arrow to be a prominent display to the driver.)
There was no automated system to alert the network control officer (NCO) to the condition of the points or enhancers at the train order locations between Malbooma and Kalgoorlie. Around 2.5 hours after the trackside interlocking at Coonana detected that the points had not correctly set, the NCO issued an authority for the crew of train 7MP7 to travel from Rawlinna to Golden Ridge, passing through the main line at Coonana.
The points at train order locations were normally set for the main line, with corresponding green light displayed on the enhancer and green arrow on the point indicator target. Indications other than green should only display following the initiation of crossing or passing procedures by a train crew or when a failure has occurred, such as the points were not correctly set. The timely identification and response to an abnormal indication relied on the actions of the train crew to either sight the red indication at a distance greater than 2,500 m or applying the organisations’ rules and procedures to ensure there was sufficient distance available to stop their train safely should the enhancer indication be at red or blacked out.
The layout of Coonana was typical of all train order locations between Malbooma and Parkeston. ARTC provided a location ahead sign at 2,500 m (nominal braking distance) and an enhancer that theoretically should be visible by crew at a distance of around 2,500 m. The drivers stated that due to the trees adjacent to the corridor combined with variations to ambient conditions and the luminaire type (incandescent globe) used at Coonana, made sighting the enhancer more difficult and first sighting of the indication would usually be from the observer’s position at around 2,000 m from the points. The enhancer at Coonana displayed a red light, which the crew stated did not come into view until train 7MP7 was around 500 m from the points, after the trainee driver could see the Points Indicator.
Generally, the conspicuity of a signal is determined by its size and intensity, its contrast with the surrounding environment, and the visual angle at which it is perceived.[26] It is likely a combination of enhancer luminaire type (incandescent globe), beam alignment, trackside vegetation, ambient lighting and other environmental conditions present at the time adversely affected the conspicuity of the enhancer indication at the eastern approach to Coonana during the approach of 7MP7.
Although sighting the light indicator aspect at 2,500 m or greater is optimal, audits of the sighting points at train order locations found significant variation in distance existed, dependent on the type of luminaire and environmental conditions at the time. Generally, light indicators fitted with LED type luminaires were more conspicuous to the approaching crew providing a greater sighting distance. However, if the train crew could not confirm the light indicator aspect during the approach to the Location Ahead sign, rules and operational procedures required the crew to reduce speed at the sign and be prepared to stop before the facing points until the light indicator aspect could be confirmed. During the approach of 7MP7 this action was delayed until the train was around 1,700 m from the facing points, less than the stopping distance required.
Given the significant distance required to stop a freight train travelling at main line speeds, the vigilance of the crew is essential to ensure that indications, trackside signs and other cues are perceived and actioned appropriately to enable effective train handling. Having established that the train crew had trouble in sighting the enhancer indication and that a reduction in train speed did not commence until around 1,700 m from the points, the remaining analysis focuses on factors influencing the actions of the trainee and supervising driver in the delayed response to cues.
After departing Cook, train 7MP7 travelled along the main line through each of the 16 train order locations before approaching Coonana. The enhancer indication (green light) displayed the correct route had set at each location traversed. With the correct route set, the train crew were able to maintain track speed through the majority of the locations, reducing speed en-route where required to comply with speed restrictions or when crossing an opposing train.
During crossing or passing procedures, train crews of the first train approaching a train order location would be cognisant that they were nearing the limit of their authority, requiring them to stop. Crews would also be preparing to operate point controls to traverse a turnout if their train was to occupy the loop track. In both situations, train crew were actioning instructions contained in their latest train authority (TA) and were therefore conscious of the requirement to reduce train speed toward achieving target values.
Train crews of the second train approaching a location where a cross/pass was to occur were also actioning instructions on their respective TA. Communications between the train crews provided confirmation to the approaching train that the points were set correctly. In each case, the train crews were responding to specific cues requiring an immediate action to reduce train speed approaching a location.
Where the TA authorised travel through a location where no cross or pass was scheduled, the respective organisation’s rules required the train crew to reduce speed at the ‘location ahead’ sign and be prepared to stop before the points, unless they had sighted and confirmed the enhancer displaying a correct indication for the intended route.
The train crew’s experiences in 7MP7 that morning were that the majority of locations did not require a reduction in train speed during the approach. This, coupled with the previous experience that the enhancer at the eastern end of Coonana was difficult to detect and would typically not come into view by both crewmembers until around 1,800 m from the points, probably contributed to the delayed defensive driving actions in response to an unsighted indication and a low expectancy of encountering a restricted signal.
Systems where vigilance tasks (reducing speed at the location ahead sign) are associated with a low likelihood of an outcome (such as there being a restricted indication displayed) tend to produce lower levels of response compliance. High false-alarm rates, where compliance rarely leads to the avoidance of an actual risk, lead to ‘cry wolf’ phenomena, where individuals start ignoring the warnings.[27], [28] As such, the low incidence of unexpected restricted indications at these locations reduces the likelihood of train crews rigorously complying with the organisations’ rules and procedures to reduce speed to target values approaching a location.
This is consistent with other investigations of rail accidents, such as the UK Health and Safety Executive examination of the Ladbroke Grove rail accident, which found:
The chance of human error can be considered to be enhanced where drivers have a high level of expectation regarding the likely signal aspects which will be displayed.
Focussed attention
Human information processing is limited in that each person has finite mental or attentional resources available to attend to information or perform tasks at any particular time. In general, if a person is focusing on one particular task, then their performance on other tasks will be degraded.[29]
Approaching Coonana, the supervising driver focussed attention on sighting the enhancer, predicting that it would come into view, from his position in the locomotive cab, around 500 m after passing the Location Ahead sign. From previous experience, the supervising driver described the task of identifying the incandescent aspect of the enhancer as very difficult, requiring train crew to scan constantly to identify it amongst the background. Attention to this task likely reduced the supervising driver’s awareness of the control inputs and the speed of the train as it passed the Location Ahead sign and approached the points.
The trainee driver focused attention on identifying the speed restriction ahead and on maintaining the train’s momentum in preparation for the rising grades ahead. The trainee had only previously experienced one instance of an abnormal indication displayed on an enhancer. On that occasion, the train was already slowing in preparation to travel along the main line to cross a train in the crossing loop.
Braking actions
Train 7MP7 approached the Location Ahead sign under power at a speed of 115 km/h and no action was taken to reduce power or brake until the call from the supervising driver. The trainee’s previous experiences approaching train order locations, limited route knowledge of the track ahead and understanding that the supervising driver would be the first to identify the enhancer indication likely influenced the trainee’s actions.
When responding to the supervising driver’s instruction to put the automatic brake handle into the emergency position, the trainee’s response of rapidly placing the throttle into the full dynamic position and operating the automatic brake handle to the notch corresponding to the ‘handle out’ position was inconsistent with the action the supervising driver had called for.
Although not placing the automatic brake handle in the emergency position as instructed, the trainee’s action in moving the throttle to the full dynamic position with the brake handle in the ‘handle out’ position resulted in the application of braking effort similar to a service rate of application, while maintaining full dynamic braking on the locomotives. Placing the handle in the emergency position would have resulted in a more rapid reduction in brake pipe pressure but would have also disconnected the additional dynamic braking effort applied by the locomotives.
In-cab communications
The transfer of concise and explicit information between train crew is essential to identify and respond to abnormal or emergency situations promptly, especially when one of the crew is undergoing on-the-job training. Oral communication is imperfect, and meaning is derived both from what is said and how it is said, as well as the nature of the interpretation of the receiver. As noted by Salas, Sims and Burke (2005), ‘very often, individuals will receive very different messages when hearing the same communication because of their own perspectives and biases’.[30] Barriers to effective communication also arise from distraction, stress, incomplete messages and/or ambiguous wording.[31] Lack of common experience, task proficiency and situational awareness additionally impede effective communication of messages between supervisor and trainee.[32]
Due to a roster change with the trainee’s assigned mentor driver, the trainee and supervising driver were working together as train crew for the first time. During the trip from Cook, the supervising driver provided instruction to the trainee on driving techniques and addressing issues experienced with locomotive wheel slip without any misunderstanding of the meaning of the communication between the parties.
Approaching Coonana, the supervisor intended to communicate that the he was unable to sight the enhancer, and that the trainee needed to brake urgently, and substantially. The trainee did not understand the call in this way, interpreting the instruction as being related to reducing speed for the 80 km/h restriction ahead. The trainee subsequently applied a minimum 50 kPa brake application and reduced the throttle power setting. The trainee recounted that the supervising driver was very calm when giving the instruction to brake, and did not appear convey any sense of alarm when speaking. The trainee likely perceived the verbal and non-verbal characteristics of the supervising driver’s communication as routine, and the inability to sight the enhancer indication as inconsistent with a possible impending emergency.
In this case, a breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the enhancer indication, and the urgency of the intended action to brake the train.
A widely practiced approach for supporting effective communication is the use of standardised calls and terminology. An example of this is air traffic control clearances, which are required to adhere to standardised content and structure.[33] Using standard terminology for known, predictable procedures and scenarios reduces the ambiguity of spoken messages. It also provides operational personnel with a standardised lexicon for communicating urgent messages and instructions when identifying and responding to an abnormal event or emergency.
Task competence
Responding to abnormal conditions and emergencies is a core competency. Trainees are required to undertake a minimum of 8 hours of practicals/learning on the equipment to gain familiarisation and 30 hours of on-the-job operation of a train. Although the training program specifies a practical component to the competency, Pacific National advised that they do not provide any practical training to trainee drivers in the application of emergency braking either in a simulator, on a locomotive (static or moving) or during the operation of a train.
The importance of providing a trainee with opportunity to practice new skills is well-established. However, unstructured practice without objectives, appropriate stimulation, and useful feedback has been shown to be counterproductive.[34] Research in aviation shows that training in abnormal and emergency events improves flight crews’ responses to these situations.[35] In a rail context, an abnormal or emergency event might call for heavy brake application.
The absence of equipment-based practicals/learning to gain familiarisation and the on-the-job operation/simulation as part of the Pacific National Certificate IV in Train Driving competency program potentially removes an important learning opportunity in preparing trainee drivers to control a train in response to abnormal situations or in an emergency.
From the evidence available, the following findings are made with respect to the derailment of train 7MP7 at Coonana, WA on 19 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
An incorrectly stored lock pin from a point clamp fouled the indicator’s throw arm pivot mechanism, preventing the points from auto-normalising.
The practice of storing the point clamp on the point indicator stand increased risk of the point indicator throw arm pivot mechanism becoming fouled.
The speed of 7MP7 was not reduced sufficiently at the Location Ahead sign to ensure the train could stop before the facing points should the light indicator not display a green aspect.
A breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the light enhancer, and the urgency of the intended action to brake the train.
Other factors that increased risk
The combination of enhancer luminaire type, positioning, and trackside vegetation likely reduced the conspicuity of the light indicator to the train crew of 7MP7.
The driver competency program did not adequately prepare the trainee driver to control the train in response to an emergency.
Other findings
The east end Light Indicator (enhancer) displayed a red lamp to the train crew.
It is unlikely a rolling-stock condition contributed to the derailment.
There was no evidence to suggest that any medical or physiological factor affected the train crew’s performance leading up to or during the incident.
It is unlikely that fatigue adversely affected the train crew's performance during this shift.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are provided separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
ARTC
Post the derailment of 7MP7, Australian Rail Track Corporation (ARTC) removed all point clamps from the point indicator stands and relocated them to the adjacent equipment huts at each location between Malbooma (South Australia) and Parkeston (Western Australia). Additionally ARTC have replaced all K3 searchlight units with long-range LED luminaire type units between Malbooma and Parkeston.
Pacific National
Pacific National introduced a SPAD reduction program and reinforced that train crews reduce speed in preparation for stopping short of facing points until both drivers confirm recognition and understanding of indicator aspects. Additionally PN discussed with ARTC the implementation of improvements to point indicators between Kalgoorlie (Western Australia) and Cook (South Australia).
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Australian Rail Track Corporation
Pacific National
Train crew of 7MP7
References
Australian Rail Track Corporation, Addendum to the Code of Practice for the Defined Interstate Rail Network, Revision 5.0, 1 July 2018.
Australian Rail Track Corporation, Code of Practice for the Defined Interstate Rail Network, Volume 3, Operations and Safeworking, Part 1 Rules, ARTC Version 3.0, 1 July 2018.
Australian Rail Track Corporation, Engineering (Signalling) Standard, ESC-04-01 Signal Sighting and Position, Version 1.4, 27 October 2010, pp 5.
Australian Rail Track Corporation, Specification, Signals – Work on Asset, Issue 1.1, 4 May 1999.
Australian Rail Track Corporation, Standard Train Braking Application design, ESD-05-03, version 1.1, 21 August 2018
Australian Rail Track Corporation, Train Braking Application Design Standard,ESD-05-03, Version 1.1, 21 August 2018.
Australian Rail Track Corporation, Signalling Technical Maintenance Plans, Signal Colour Light (Incandescent Type) Generic, Service Schedule SS07 12 01 01
Australian Rail Track Corporation, Signalling Technical Maintenance Plans, Signal Colour Light (LED Type) Generic, Service Schedule SS 07 12 11 01
Breznitz, S. (1983), Cry Wolf: The Psychology of False Alarms, Lawrence Erlbaum Associates, Mahwah, NJ.
Burian, B. K., Barshi, I., & Dismukes, K. (2005). The challenge of aviation emergency and abnormal situations. NASA/TM-2005-213462. NASA.
Cannon-Bowers, J.A., Rhodenizer, L., Salas, E., & Bowers, C.A. (1998). A framework for understanding pre-practice conditions and their impact on learning. Personnel Psychology, 51, 291-320.
Civil Aviation Safety Authority (2019). Resource booklet 4: Communication. In Civil Aviation Safety Authority. Safety Behaviours: Human Factors for Pilots (2nd Edition). Australian Government Publishing.
Conference on Railway Engineering, Wollongong, 10 -13 November 2002, RTSA Trans Australian Railway Self Restoring Point System, E.N Fletcher and R.B Kempster, Australian Rail Track Corporation.
Department of Transport and Regional Services, Code of Practice for the Defined Interstate Rail Network, Operations and Safeworking Part 1: Rules, ARTC Version 3.0, 1 July 2018.
Kahneman, D. (2011). Thinking Fast and Slow. Farrar, Straus & Giroux: New York
Kirby, J (1997). Crew Resource Management (CRM) PowerPoint presentation. A presentation of the Salt Lake City Flight Standards District Office (FSDO).
O'Brien, K. A., Cole, B. L., Maddocks, J. D., & Forbes, A. B. (2002). Color and defective color vision as factors in the conspicuity of signs and signals. Human factors, 44(4), 665-675.
Pacific National (NSW) Pty Ltd, Cv40-9i NR Class Locomotive Operators Manual, Version 2.0
Pacific National Accredited course TLIC2078, Learners Guide Part 4 Responding to Network Signals and Indicators/Signs, Version 3.2 10 September 2018.
Pacific National Learning and Assessment Strategy Certificate IV Train Driving, 8 December 2017
Pacific National Learners Guide, TLIC4019 Drive train to operational requirements, Version 3.2, 10/09/2018
Pacific National Learner Guide, TLIC2078 Identify and respond to signals and trackside signs, Version 3.2, 10/09/2018
Pacific National Learners Guide, TLIF4110 Respond to abnormal situations and emergencies when driving a train, version 3.2, 12/09/2018
Pacific National Information Bulletin No. 54A, AWARE Train Radio System, GPS Location Alerter – Driver Information System.
Pacific National Mentor Driver Guidelines, Perth Drivers Depot
Pacific National Driver Mainline Verification of Competence (VOC) Combined Checklist, Version 2.1 November 2016
Rantanen, E. M., & Kokayeff, N. K. (2002, September). Pilot error in copying air traffic control clearances. In Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 46(1), pp. 145-149. Sage CA: Los Angeles, CA: SAGE Publications.
Salas, E., Sims, D. E., & Burke, C. S. (2005). Is there a “big five” in teamwork?. Small group research, 36(5), 555-599.
Sorkin, R. (1989), Why Are People Turning Off Our Alarms? Human Factors Bulletin, 32, pp. 3-4.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Australian Rail Track Corporation, Pacific National, train crew of 7MP7 and the Office of the National Rail Safety Regulator.
Submissions were received from the Australian Rail Track Corporation, Pacific National, train crew of 7MP7 and the Office of the National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 18 August 2018, intermodal freight train YC77, operated by Aurizon, was en route from the Acacia Ridge Intermodal Terminal in Brisbane, Queensland. The train was powered by a diesel electric locomotive and one of its wagons contained a stack of three empty flat racks. During transit, the collapsible, rear end wall of the top flat rack extended upwards. This end wall contacted the Elm Street overpass on approach to Cooroy, and pulled down the high voltage overhead line equipment (OHLE). As a consequence, 1.3 km of OHLE was pulled down.
What the ATSB found
The ATSB found that personnel at the Acacia Ridge terminal did not check the collapsible end walls of the flat racks were secured on arrival at the terminal and after the flat racks were loaded onto YC77. In addition, Aurizon, did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists.
On multiple occasions following the dewirement, train crew accessed the exclusion zone associated with the close proximity of the extended end wall of the flat rack to the OHLE, prior to the wires being isolated and earthed on site. Network control centre personnel did not advise train crew of the status of the OHLE during the emergency response period, and Queensland Rail (QR) did not have an effective process in place to ensure that safety-critical actions were co-ordinated and completed when multiple network control officers were involved in responding to an OHLE emergency.
The ATSB also found that following the dewirement the driver and network control officer (NCO) did not follow required protocols for driver only operations (DOO) prior to the driver leaving the locomotive cabin, and Aurizon did not provide drivers with ready access to QR’s procedures for DOO and OHLE emergencies when they were operating on the QR network.
What's been done as a result
Aurizon has updated processes and checklists in relation to flat racks, with further theoretical training undertaken for loading personnel at Acacia Ridge in relation to securing requirements. In addition, Aurizon is currently undertaking a program to increase mobility of access to its safety management system (including relevant procedures and checklists). For driver only operations, Aurizon has commenced drafting a procedure for use on its own network, with a checklist for emergencies affixed to 2800 class locomotives that operate on the North Coast Line, at sign-on locations and attached to train lists.
QR has mandated the use of the network control officer (NCO) checklist for OHLE emergencies, and is currently reviewing related aspects of its emergency response procedures. In addition, QR have provided further training to both NCOs and train crew in relation to identifying objects in close proximity to OHLE and applicable exclusion zones. NCOs have also undertaken DOO emergency procedure refresher training.
Safety message
This occurrence has highlighted the importance of having checklists for rarely conducted tasks and emergency response tasks in the rail environment, and ensuring these checklists are readily available and used by operational personnel. This includes checklists for loading and securing personnel, rail traffic crew and network controllers.
The occurrence
Overview
On 18 August 2018, intermodal freight train YC77, operated by Aurizon, was scheduled to depart from the Acacia Ridge Intermodal Terminal in Brisbane, Queensland to the Portsmith freight terminal near Cairns, Queensland. The train was powered by a diesel electric locomotive and one of its wagons contained a stack of three empty flat racks.[1]
During transit, the collapsible, rear end wall of the top flat rack extended upwards. At about 2102,[2] this end wall contacted the Elm Street overpass on approach to Cooroy, and pulled down the high voltage overhead line equipment (OHLE).
Arrival of flat racks at freight terminal
On 14 August 2018, a freight forwarding company booked four 40 ft empty flat racks to travel by Aurizon train from Acacia Ridge to Portsmith. When booking, the freight forwarding company advised Aurizon by email that the flat racks would travel as a nest of three (stacked on top of each other) and a single. It also advised that the end walls of the nest of three had been chained down.
Sub-contractor truck drivers collected the flat racks from the freight forwarding company and delivered them to Aurizon’s Acacia Ridge terminal in two consignments on 17 August.
When the two trucks arrived at the freight terminal, the Acacia Ridge terminal coordinator instructed the drivers to proceed to the container pad. The terminal coordinator did not visually inspect the loading of the consignments. The truck drivers parked at the container pad, where a heavy forklift driver unloaded the consignments.
A subsequent review of closed-circuit television (CCTV) footage of the delivery of the empty flat racks showed that the nest of three flat racks were not secured by straps or chains.
Loading of flat racks onto train YC77
On 18 August 2018, YC77 was assembled at the Acacia Ridge terminal. In relation to the empty flat racks, loading and inspection activities included:
At about 1100, the Aurizon heavy forklift driver loaded the nest of three flat racks onto a flat wagon and the single flat rack onto a separate flat wagon. Securing was limited to spigots securing each nested flat rack to each other, and securing the bottom flat racks to their respective wagons. The flat rack end walls were not secured.
At about 1530, once train loading was complete, two Aurizon train pinners[3] inspected the loading and securing of freight on all the wagons. A Form 04 (Loading and securing advice) was issued at completion, verifying the loading on the train was safe for travel.
At about 1715, two Aurizon freight operators[4] conducted a train safety test, checking wagon integrity and correct train brake operation. A Form SW57 (Train inspection / repair certificate) was issued at completion, certifying the train as fit for travel.
At 1749, YC77 departed Acacia Ridge yard, during which an Aurizon freight operator conducted a slow speed roll-by examination for train defects.
These activities did not identify any problems with the empty flat racks.
Departure of train YC77
YC77 was planned to travel from Acacia Ridge (12.181 km)[5] to Portsmith (1,677.088 km) on Queensland Rail’s (QR’s) North Coast Line.[6] This involved operating on track that had OHLE from Acacia Ridge to Rockhampton (638.790 km).
There was no indication of any problems or concerns with the operation of the train on its journey between Acacia Ridge and when it passed through Yandina (112.790 km) at 2043. CCTV footage from a sample of stations showed that the rear end wall of the top nested flat rack remained in the down position up until the train passed Yandina, and it moved to being extended upwards at some point prior to reaching Eumundi (122.100 km) at 2049. Figure 1 shows a map of the Brisbane rail network with the departure point and the area of the occurrence highlighted.
Figure 1: Brisbane rail network showing departure point and occurrence location
The image shows stations and their distance from Roma Street Station in Brisbane. Source: Queensland Rail, annotated by the ATSB
Overhead line equipment circuit breaker trips
At 2048, after passing North Arm (117.710 km), a trip of the OHLE circuit breaker occurred, automatically de-energising[7] the electrical section from Woombye (100.690 km) to Traveston (150.310 km). The fault locator indicated to the electric control operator (ECO)[8] at QR’s Brisbane rail management centre (RMC) that the trip had occurred at 119.500 km.[9]
Given that train YC77 was in the estimated area of the circuit breaker trip at that time, the ECO requested the universal traffic control (UTC 7)[10] network control officer (NCO) to confirm the status of the OHLE with the driver. At that time, the northside relief NCO was monitoring and controlling UTC 7 (see Network control). At 2052, the northside relief NCO contacted the driver of YC77, and the driver advised observing nothing unusual. After receiving this information, the ECO reset the OHLE circuit breaker, which held closed. The reset of the circuit breaker re-energised the high voltage OHLE. The ATSB subsequently identified that this first OHLE circuit breaker trip occurred at about 119.613 km, the location of YC77 at the time Figure 2 (see Sequence of circuit breaker trips).
Figure 2: Approximate location of first OHLE circuit breaker trip
Source: Queensland Rail, annotated by the ATSB
At 2052, a track circuit showed ‘occupied’[11] three track sections[12] behind YC77, followed at 2053 by a second trip of the OHLE circuit breaker (Figure 3). The ECO identified that the fault locator did not work on this occasion, which meant the fault could have occurred anywhere on the Woombye to Traveston electrical section. At that time, in addition to YC77, there were two other trains within this electrical section.
Figure 3: Approximate locations of second and third OHLE circuit breaker trips
Source: Queensland Rail, annotated by the ATSB
The ECO contacted the UTC 7 NCO workstation, and the northside relief NCO advised that, although there were intermittent track circuits showing as occupied, there were no trains in those areas. As there were no in-field reports of OHLE abnormalities, the ECO reset the OHLE circuit breaker at 2056, which held closed. The ATSB subsequently identified that this second OHLE trip occurred at about 125.248 km, the location of YC77 at the time.
Over the following 5-minute period, a further two occupied track circuit indications occurred in different track sections behind YC77.
At 2101, a third trip of the OHLE circuit breaker occurred, and a telemetry[13] failure occurred at Sunrise (124.230 km). The fault locator indicated to the ECO that the trip had occurred at 130.170 km, to the south of the Elm Street overbridge (130.750 km). The ATSB subsequently identified that this third OHLE trip occurred at about 129.1209 km,[14] the location of YC77 at the time.
Dewirement near Cooroy
At 2102, train YC77 was entering Cooroy. It passed under the Elm Street overbridge at a speed of about 42 km/h, which was under the maximum permitted speed of 50 km/h. Subsequent inspection found that the extended rear end wall of the top nested flat rack hit the underside of the bridge, and pulled down the high voltage OHLE wires (see Site inspection), resulting in a dewirement.[15]
Examination of CCTV footage showed that, as the train passed through Cooroy, the rear end wall of the top nested flat rack was still in the extended position. In addition, the OHLE, including copper wires, was entangled on the wagon and dragging along the station platform (Figure 4).
Figure 4: CCTV footage at Cooroy station showing the flat racks with the extended end wall and OHLE wires that had been brought down
Source: Queensland Rail
At 2103, the ECO contacted the UTC 7 NCO workstation and advised the UTC 7 NCO, who had returned from a meal break, of the third circuit breaker trip. The ECO noted that YC77 may have had ‘a rope or something’ that was touching the OHLE. The NCO advised the ECO that a track fault had occurred, this time coinciding with the location of YC77. The ECO did not attempt a further reset of the OHLE circuit breaker.
At 2104, the UTC 7 NCO contacted the driver of YC77. The driver advised that, as the train passed through Cooroy station, the OHLE appeared to be ‘really loose’. The UTC 7 NCO acknowledged this report. The NCO also provided the driver clearance to proceed to outside Pomona (139.980 km), and advised the driver that the train may need to be examined, because the issue seemed to be following it.
At 2106, the UTC 7 NCO instructed the driver of YC77 to stop the train ‘straightaway’. The driver stopped the train at 134.493 km, between Cooroy and Pomona. At 2107, the driver contacted the UTC 7 NCO workstation and advised the northside relief NCO, who was now assisting the UTC 7 NCO, of the train’s location.
At 2107, the UTC 7 NCO instructed the driver of a southbound electric passenger train X906 to stop the train immediately. That train was near Woondum and scheduled to pass through the Traveston neutral section into the de-energised section 4 minutes later.
Post-dewirement activities
Where the train stopped, the OHLE was still in place. However, the extended end wall of the top nested flat rack on YC77 was still extended upwards and in close proximity to the OHLE contact wire. Although the OHLE was de-energised, a potential hazard still existed.
After the train stopped, there were a number of communications and activities involving the driver, network control personnel and emergency services personnel to assess and manage the situation. These activities included:
At 2107: The northside relief NCO instructed the driver to walk and check the train, as there were concerns ‘…something might be sticking up from the train [towards the OHLE]…’. The driver confirmed this instruction. The northside relief NCO did not advise the driver of the electrical status of the OHLE.
At 2111: The Queensland Police Service (QPS) contacted the RMC on the emergency phone line, and advised the southside train control leader (TCL) that the OHLE was down at Cooroy station. The QPS also advised that a witness observed ‘… wires on top of the train [YC77] that went through’.
At 2115: The northside relief NCO attempted to contact the driver of YC77 by radio. There was no response as the driver was outside, inspecting the train.
At 2119: The QPS again contacted the RMC by emergency phone, requesting that the OHLE be turned off in the area around Cooroy to help the police manage the scene. The caller noted that police on the scene reported that wires were down across fences and the pedestrian footbridge (north of the Elm Street overbridge). The southside TCL warned that, although the OHLE was de-energised, it was still not yet electrically safe until it was earthed and isolated at the site.
At 2120: The UTC 3 NCO[16] called the driver of YC77’s mobile phone and advised that the police had confirmed the OHLE was down. The driver advised the UTC 3 NCO of the general nature of the problem, after having walked the length of the train. The driver indicated there was a problem with one of the wagons on the train that was extending upwards towards the OHLE (Figure 5).[17] During the conversation, the UTC 3 NCO handed the phone to another network control person to clarify the situation with the driver, who advised it would be easiest to explain the situation by sending some photos. The driver returned to the locomotive cabin soon after.
At 2133: The UTC 3 NCO called the driver’s mobile phone to confirm whether the driver was in a safe place. The driver confirmed being in the locomotive cabin, but advised needing to leave the cabin to email photos of the flat rack to the RMC (due to problems with mobile phone data reception). The driver sent the photos soon after this conversation.
At 2145: The day of operations coordinator (DOOC) instructed staff at the RMC to commence the ‘DOOC & TCL Incident and Emergency Tool’ checklist.
At about 2200: A protection officer associated with a prior planned track closure to the north of the accident site arrived at the locomotive. The driver of YC77 left the locomotive cabin to talk to the protection officer, who then left the driver and inspected the train.
At 2252: The rail operations response unit (RORU) QR commander arrived at Cooroy to take over coordination of the accident. After meeting with the onsite police, the QR commander allowed the police to proceed to the locomotive to perform drug and alcohol testing of the driver. The driver of YC77 left the locomotive cabin in order to be tested.
At about 2307: The QR commander and a RORU officer attended the locomotive. The driver of YC77 left the locomotive cabin to accompany them as they inspected the train.
At 2308: A QR OHLE linesman advised the ECO that the OHLE was intact above YC77.
Early the following morning: A new driver relieved the driver of YC77, who left the locomotive cabin for changeover purposes. The new driver then entered the locomotive cabin of YC77.
At 0300 (6 hours after the dewirement): The nominated person[18] issued a Form C (Permit to Work), confirming the OHLE at Cooroy station and above YC77 had been isolated, tested and earthed.
Figure 5: Flat rack end wall in the extended position in close proximity to the OHLE
Source: Queensland Rail
Consequences of the dewirement
As a result of the dewirement, OHLE was brought down from 130.181 km to 131.447 km (about 1.3 km). High voltage wires, insulators and cantilever arms contacted the ground. Given the level of damage, the occurrence met the definition of an accident, as defined by the Transport Safety Investigation Act 2003.
There were no injuries. Although there were no people on the Cooroy station platform at the time of the dewirement, a southbound passenger train was scheduled to arrive about 30 minutes later.
Repair works were completed at 2215 on 20 August 2018, with the track reopened through Cooroy at 2301, 50 hours after the accident. During this period, all trains through the area were suspended.
The North Coast Line consisted of 1,680 km of railway between Brisbane and Cairns, Queensland. Queensland Rail (QR) owned and managed 1,567 km of the North Coast Line, including the section from Brisbane through North Arm to Pomona (Figure 1).
Constructed in 1891, the section from North Arm to Cooroy (crossing the Blackall Range), was extensively realigned and regraded in 1988, in preparation for electrification. The new alignment increased the distance between North Arm and Cooroy. In addition, the track was lowered underneath several existing overbridges to provide clearance for the high voltage overhead line equipment (OHLE), including under the Elm Street overbridge at Cooroy.
Overhead line equipment (OHLE)
In OHLE-based electrified railways, traction power is supplied to electric locomotives and train units through a train-borne pantograph contacting the OHLE contact wire. The traction power circuit is completed by the current passing from the locomotive through the wheels of the train, into the rail and back to the feeder station and earth. Figure 6 indicates the major OHLE components.
Figure 6: QR mainline electrification OHLE components
Image is of mainline electrification (autotransformer) OHLE components. Of particular note are the high voltage components, considered live at 25 kV, specifically, the catenary wire, contact wire, feeder wire, droppers, cantilevers and register arms.
Source: ATSB
QR’s mainline electrification adopted an autotransformer type system for OHLE supply at 25 kV alternating current (AC).
The OHLE’s lowest point above a train was the contact wire, which was at a nominal height of 4,900 mm above rail level. To allow for temperature-related expansion and contraction, and the effects of wind, the wires were kept tensioned by pulleys and weights placed at about 1.6 km intervals.
For general operations, the loads on trains were required to be a maximum of 3,820 mm above rail level. An authority to travel could be granted for heights up to 3,950 mm in electrified territory. However, QR advised that on the North Coast Line a special exemption for container traffic (including flat racks) allowed loads to reach up to 4,080 mm above rail level.
OHLE contact wire heights
Although the OHLE contact wire was set at a nominal height of 4,900 mm above rail level, this height was increased or decreased for clearance purposes; for example, over level crossings and under overhead bridges. As discussed in Flat rack containers, the height of an undamaged extended end wall on the top flat rack of a nest of three flat racks was about 4,845 mm above rail level, although that height would vary to some extent with the movement of a train.
OHLE contact wire heights were routinely measured by QR using a track recording vehicle, with the last survey conducted in the region of the dewirement on 14 June 2018, 2 months before the dewirement. Between Yandina (112.790 km), where the rear end wall of the top nested flat rack was last observed on closed-circuit television (CCTV) to be collapsed down, and Eumundi (122.100 km), where the rear end wall was first observed to be extended up, the OHLE contact wire height dropped to or below 4,845 mm at a number of locations. These are shown in Table 1 (in white rows).
Table 1: OHLE contact wire low points (in white rows) and location of key events (in blue rows) between Yandina and Cooroy
Kilometer-age
OHLE height (mm)
Location
Comment regarding YC77
112.790
Yandina Station
Station CCTV shows flat rack end wall down
112.952
4,837
Yandina Yard
113.601
4,495
Yandina footbridge
115.355
4,490
Bruce Highway tunnel
115.720
4,839
116.965
4,844
117.104
4,733
North Arm–Yandina Creek Road overbridge
117.682
4,816
North Arm Yard
117.710
North Arm Station
118.060
4,844
North Arm Yard
118.545
4,832
118.782
4,845
119.613
4,844
First circuit breaker trip (2048 hours)
119.637
4,811
121.075
4,841
122.100
Eumundi Station
Station CCTV shows flat rack end wall up
122.581
4,838
124.100
YC77 at about this location when first circuit breaker reset (2052 hours)
124.230
Sunrise Station
125.248
4,853
Second circuit breaker trip (2053 hours)
126.354
4,838
127.400
YC77 at about this location when second circuit breaker reset (2056 hours)
129.1209
4,842
Third circuit breaker trip (2101 hours)
129.1267
4,838
130.136
4,830
130.749
4,349
Elm Street overbridge
Flat rack end wall hits overbridge (2102 hours); dewirement
130.990
Cooroy Station
Station CCTV shows flat rack end wall up:
OHLE wires down
Due to realignment of the line in 1988, the distance between the 129 km and 130 km pegs was 1,656 m. Therefore 129.1209 refers to 1,209 m beyond the 129 km peg and 447 m prior to the 130 km peg. Similarly, 129.1267 refers to 1,267 m beyond the 129 km peg and 389 m prior to the 130 km peg.
As indicated in Table 1, the contact wire at the Elm Street overbridge was 4,349 mm above rail level. This was the lowest contact wire height between Yandina and Cooroy. The Elm Street overbridge itself was 4,816 mm above rail level.
Sequence of circuit breaker trips
The ATSB examined the available evidence to determine the most likely locations of the train when the three circuit breaker trips occurred. Relevant details, summarised in Table 1, included the following:
The first OHLE circuit breaker trip occurred at 2048, and it registered on the ECO’s fault locator at 119.500 km. The closest contact wire low point was at 119.637 km. After considering the data logger data, the most likely location of the wagon of nested flat racks on YC77 when the circuit breaker tripped was determined to be 119.613 km, just prior to the 119.637 km low point. As the OHLE height dropped to 4,844 mm above rail level at that location, it would have allowed direct contact with the extended end wall of the top nested flat rack, resulting in the tripped OHLE circuit breaker de-energising the electrical section.
The last contact wire low point prior to 119.637 km low point was at about 118.782 km (4,845 mm). Therefore, it is very likely that the unsecured end wall of the top nested flat rack raised somewhere between 118.782 km and 119.613 km.
Although further OHLE contact with the extended rear end wall of the top nested flat rack would have occurred at about the 121.075 km low point and 122.581 km low point, these contacts did not result in circuit breaker trips as the electrical section was still de-energised. ATSB analysis determined that when the ECO reset the tripped circuit breaker at 2052, re-energising the OHLE, YC77 was at about 124.100 km.
The second OHLE circuit breaker trip occurred at 2053; however, the ECO’s fault locator could not determine the location of the trip on this occasion. ATSB analysis determined that the wagon of nested flat racks was near 125.200 km at this time. There were no areas of OHLE contact wire at or below 4,845 mm at this location. However, the OHLE contact wire did lower to 4,853 mm at 125.248 km, reducing the air gap between the extended end wall of the top nested flat rack and the OHLE contact wire to 8 mm. It is almost certain that either the OHLE arced across this air gap,[19] or the end wall contacted the OHLE, resulting in the tripped OHLE circuit breaker de-energising the electrical section.
Although a further OHLE contact with the extended end wall of the top nested flat rack would have occurred at about 126.354 km (4,838 mm low point), this contact did not result in a circuit breaker trip as the electrical section was still de-energised. Analysis determined that when the ECO reset the tripped circuit breaker at 2056, re-energising the OHLE, YC77 was at about 127.400 km.
The third and final circuit breaker trip occurred at 2101, and it registered on the ECO’s fault locator at 130.170 km. The closest contact wire low points were at 130.136 km and 129.1267 km (389 m prior to the 130 km peg). After considering the data logger data, the most likely location of the wagon of nested flat racks on YC77 when the circuit breaker tripped was determined to be 129.1209 km, [20] just prior to the 129.1267 km low point. As the OHLE height dropped to 4,842 mm above rail level at that location, it would have allowed direct contact with the extended end wall of the top nested flat rack, resulting in the tripped OHLE circuit breaker de-energising the electrical section.
Train and train crew information
Train information
Aurizon train YC77 consisted of one 2800 class diesel electric locomotive hauling 32 container wagons. It was 659 m long, and had a total mass of 1,465 t. Although travelling on an electrified network, the locomotive did not use the OHLE to gain tractive power.[21]
The train was fitted with a data logger, and information from the data logger has been included in the report where relevant.
Flat rack containers
Flat racks were a type of shipping container, designed for oversized loads that could not fit within the normal profile of an enclosed side / top container. The end walls (if fitted) could be extended up or collapsed down. The advantage of collapsible end walls was their ability to be stacked flat on top of each other (or nested) when empty, allowing for efficient transportation. Flat racks were available in 20 ft or 40 ft lengths.
Flat racks with collapsible end walls were fitted with leaf spring or coil assistance for ease of raising. Once extended, two locking pins could be manually engaged to secure each end wall in the raised position. When collapsed, two twist locks (one on each side) could be manually engaged to secure each end wall in the down position (Figure 7). In addition, four spigots secured each flat rack to a flat rack below when nested, or to a flatbed rail wagon for transportation.
Figure 7: Twist lock mechanism for flat rack end wall
Source: ATSB
When travelling empty, Aurizon’s document SAF/STD/022/SWK/BUS (Loading and securing of freight manual) required flat racks to have all four twist locks engaged. It also required an additional chain or two web straps over each end wall of the top nested flat rack. This ensured that the leaf spring / coil raise assist end walls could not extend upwards during transit.
The flat racks on YC77 were Domino Seadeck 40 ft long type, similar to those shown in Figure 8. The collapsible end walls had leaf spring assist. A warning decal on the flat racks instructed the use of twist locks when a flat rack was travelling empty.
Figure 8: Flat rack containers
Image shows a flat rack with extended end walls (foreground) and flat racks with end walls collapsed (background) to enable stacking (nesting). Location of supplied securing methods when end walls were extended (locking pins) and collapsed (twist locks) are also shown.
Source: Mission & Relief Logistics, annotated by the ATSB
The height of a nest of three flat racks with the end walls collapsed, loaded on a flat wagon, was about 2,895 mm above rail level. The height of an undamaged extended end wall on the top flat rack of a nest of three flat racks was about 4,845 mm above rail level.
Train crew information
Train YC77 was crewed by a single train driver (see Driver only operations information). The driver had 7 years driving experience. This included commencing as a trainee driver with Australian Railroad Group[22] at Cloncurry (Queensland), then conducting train driving duties at Geraldton (Western Australia) and Rockhampton (Queensland), prior to being based at Acacia Ridge from January 2017.
Train performance and environmental conditions
A review of the train’s data logger determined that the driver of YC77 followed sound train handling principles, including complying with maximum speed limits, between Yandina and the location of the dewirement. Between Yandina and shortly before 119.613 km, the location where the first circuit breaker trip occurred (see Sequence of circuit breaker trips), the speed of YC77 was held consistently between 75 and 80 km/h.
A review of Bureau of Meteorology data determined that maximum wind speeds at the time of the occurrence were under 10 km/h.
Site inspection
Onsite inspection by the ATSB on 19 August 2018 found scrape marks on the underside of the Elm Street overbridge. A broken OHLE contact wire found near the bridge had blue paint marks, identical to the colour of the top nested flat rack. Colourbond fencing on the southern side of the Elm Street overbridge was also damaged.
An inspection of the train where it had stopped (134.493 km) found damage limited to that of the extended rear end wall of the top nested flat rack. The end wall had minor damage and had been bent backwards, consistent with contact damage with the Elm Street overbridge. The height of the damaged extended end wall was 4,740 mm above rail level, slightly less than its expected undamaged height of 4,845 mm.
Analysis determined that the distance between the damaged extended end wall of the top flat rack and the OHLE contact wire at the location where the train stopped was about 210 mm (Figure 9).
No web straps or chains secured the end walls of the top flat rack on the nest of three flat racks or the end walls of the single flat rack. In addition, neither of the top two flat racks on the nest of three had their twist locks engaged. A significant amount of rust was present on the twist lock mechanisms, indicating they had not been engaged for a significant period of time. The spigots securing the bottom flat rack to the wagon, and each flat rack to the one below, were in place.
Figure 9: Nest of three flat racks on train YC77, showing the damaged extended rear end wall
Image shows the extended end wall of the top nested flat rack, loaded on wagon BAZY 47520. The distance between the end wall and the OHLE contact wire is about 210 mm.
Source: ATSB
Although the OHLE above the train was intact, some wires from the OHLE that had been pulled down were entangled in parts of the train, as shown in Figure 10.
Figure 10: Part of train YC77 showing OHLE wires in contact with the train
Source: ATSB
Train loading and securing information
Loading and securing process
The Acacia Ridge Intermodal Terminal was located in the southern suburbs of Brisbane, and was owned and operated by Aurizon (Figure 11). The terminal handled the transhipment of road freight to rail transport and vice versa.
Figure 11: Acacia Ridge Intermodal Terminal
Image shows the location of the checkpoint (freight processing office), container pad, rail pad and marshalling yard at Acacia Ridge Intermodal Terminal. Source: Google Earth, annotated by the ATSB
After arriving at the security gatehouse, incoming road freight proceeded to the freight processing office and the delivering truck driver presented relevant paperwork to the terminal coordinator. If it was deemed an unusual load,[23] the terminal coordinator was required to check the load to ensure it was correctly secured for rail travel. If secured correctly, the terminal coordinator directed the trucks to the rail pad for train loading, or to the container pad for short-term storage. If loading was found to be incorrectly secured, the terminal coordinator would not be accept the load until the issue had been fixed by the delivering truck driver.
A heavy forklift driver unloaded loads from trucks and either stored them as required on the container pad, or placed them directly onto wagons at the rail pad. After loads had been placed on the wagons, pinners ensured the loads were correctly secured. Freight operators shunted the wagons from the rail pad to the marshalling yard, where the train was finalised for departure.
Loading and securing procedures
Aurizon had several documents that contained procedures associated with the loading and securing of loads. A comprehensive and detailed 242-page document 07-STD-022-SWK (Loading and securing of freight manual), and supporting checklists, were provided to assist staff. The manual provided guidance on how to secure a wide range of loads.
The procedure for securing empty flat racks was included in the loading and securing manual, within a number of other instructional dot points. As noted in the manual, the procedure required that each collapsed end wall on the top flat rack of a nest of flat racks was to be secured by either one chain or two web straps, and the two fitted twist locks. The maximum height above rail level for nested flat racks loaded on a flat wagon was not to exceed 3,165 mm.
In addition to the loading and securing manual, checklist 14-FRM-017-INT (Loading & securing checklist – Flat-racks) provided guidance on the securing of nested empty flat racks. This guidance was consistent with the content of the manual.
Other documents outlined the roles and responsibilities for personnel involved in ensuring loads were appropriately secured. More specifically:
Work instruction 14-WI-011-INT (Loading & securing – Inspection of incoming loads at terminals) provided instructions on inspecting unusual incoming loads. It stated that the terminal coordinator was to inspect any load that was not a 20 ft or 40 ft container to ensure the loading met the requirements of the loading and securing manual, using the relevant checklist.
Work instruction 07-WI-013-ACR (Train pinning: Work method statement) provided instructions for the pinners. The stated purpose was ‘when rail wagons have been loaded, the containers have to be secured and pinned up’. The stated process included walking around both sides of the train and pinning all manual spigots and checking for any non-conformances. The list of potential non-conformances included ‘unsecured loads’. However, the instruction did not provide guidance on how this was to be identified. There was no reference to the loading and securing manual or related checklists for unusual loads.
The loading and securing manual and associated checklists were stored on Aurizon’s intranet system ‘iN-Gauge’. Hard copies were not readily available.
If an incoming load was deemed unusual, the terminal coordinator would inspect the loading and securing arrangements as per the loading and securing manual and the relevant checklist, after accessing iN-Gauge. Computer access to iN-Gauge was available in the freight processing office.
On encountering an unusual load while pinning a train, pinners were required to return to the office, access iN-Gauge, find and print the relevant checklist, and recommence the loading and securing inspection.
All interviewed personnel advised that flat racks were rarely encountered at the Acacia Ridge terminal.
Loading and securing training
Aurizon provided training and assessment for loading and securing of flat racks to personnel with these responsibilities. This training included an on-line course, which contained extensive and complex loading and securing instructions for a variety of different types of loads.
Personnel were also required to sign an acknowledgement sheet that they had received a particular instruction (such as 14-WI-011-INT for inspection of incoming loads or 07‑WI-013-ACR for train pinning) and received a training session on the instruction, which included a small number of competency assessment questions.
Neither the on-line, nor the work instruction training, contained practical instruction or assessment.
Loading and securing personnel
The personnel involved in the loading and preparation of train YC77 included the following:
The terminal coordinator on duty when the flat racks were delivered had 7 months’ experience in the role and was previously employed as a heavy forklift driver. Although reporting that it was a busy evening when the flat racks were delivered, the terminal coordinator felt alert at the time of the flat rack delivery.
The heavy forklift driver who unloaded the truck on the night of delivery, and loaded YC77 the following morning, had two 2 years’ experience in the role, as well as previously working as a heavy forklift driver with another rolling stock operator. The forklift driver also performed pinner duties on a rotational basis.
Two pinners inspected YC77 prior to handover to the freight operators. Pinner no. 1 was a temporary contractor with the heavy lift section. The 6-month contract period ended shortly after the accident. Pinner no. 2 had 5 years’ experience as a heavy forklift driver and had also acted in the terminal coordinator position.
Table 2 summaries Aurizon’s records of the training received by each of these personnel for the loading and securing of freight. Although most of the personnel had conducted the detailed, online course, there was no record to indicate that pinner no. 1 had completed this training.
Table 2: Loading and securing of freight training records (date completed)
On-line course
14-WI-011-INT
07-WI-013-ACR
Terminal coordinator
12 July 2017
No evidence
9 November 2017
Heavy forklift driver
1 June 2017
16 April 2018
16 June 2017
Pinner no. 1
No evidence
No evidence
No evidence
Pinner no. 2
15 March 2018
No evidence
9 November 2017
Aurizon was unable to provide evidence that the terminal coordinator, pinner no. 1, or pinner no. 2 (who had previously acted as a terminal coordinator) had received work instruction training for 14‑WI-011-INT. In addition, Aurizon was unable to provide evidence that pinner no. 1 had received work instruction training for 07-WI-013-ACR.
During interview, the terminal coordinator, pinner no. 2 and heavy forklift driver agreed that the terminal coordinator was responsible for checking flat rack securing on arrival at the Acacia Ridge terminal. However, the terminal coordinator and pinner no. 2 said they understood this was limited to Aurizon loading only, not that received from external customers.
In terms of checking loads after they were lifted onto the wagons, pinner no. 2 and the heavy forklift driver said they understood that checks during pinning were limited to ensuring the provided securing was tight. Pinner no. 2 added that they assumed securing was not required if it was absent. Both pinner no. 2 and the heavy forklift driver advised that they were not aware of guidance material for checking unusual loads.
Form 04 (Loading and securing advice), which was issued on completion of train pinning, advised that further loading and securing checks were to be performed. Aurizon’s manual SAF-SPC-SWK-0048 (Testing of trains) advised these checks were to be conducted during a train safety test. In addition, form FDB819A (Loading and securing non-compliance report) was to be completed in instances of unsecured loads identified during a train safety test, shunting or roll-by examination. Freight operators performed all of these duties. However, Aurizon advised that freight operators were not qualified to perform loading and securing checks, nor were they required to do so.
Previous occurrences
Aurizon and its predecessor companies had previously reported two notifiable occurrences that involved load irregularities involving flat racks.
In January 2012, the collapsible end wall of a flat rack on Interail (QRNational) train 5MB7 collided at speed with a timber overpass north of Wauchope, New South Wales. The collapsible end walls were not secured with twist locks and chains or web straps. QRNational recommended that further training tools and information guides be developed for the transport of flat rack containers.
In April 2018, a 10,000 L polyethylene water tank fell from Aurizon train YU55 at Kinkuna (south of Bundaberg, Queensland). The loss was not identified until the train had travelled a further 211 km to Mount Miller (north of Gladstone, Queensland). Three remaining water tanks on the flat rack were also insufficiently secured. This incident related to flat rack loading and not the securing of end walls. However, the investigation report by Aurizon included the following findings:
• non defined process to ensure every flat rack checked by [the terminal coordinator] prior to unloading off [incoming road] vehicle
• lack of awareness / ownership of chain of responsibility by driver / loader / [terminal coordinator]
• insufficient practical load restraint training and awareness for Aurizon staff.
Aurizon recommended delivery of further training, both theory and practical, in relation to ‘sufficient load restraint for out of scope loads’. Delivery was to occur by 31 May 2018. There was no evidence that this training occurred prior to the dewirement at Cooroy on 18 August 2018.
Rail management centre information
General
Queensland Rail’s (QR’s) rail management centre (RMC) was located on the northside of Brisbane. The RMC housed the QR Citytrain network control centre for controlling and monitoring trains, and the electric control room for controlling and monitoring OHLE supply. Both were required to interface with each other to ensure safe operation of the QR Citytrain network.
Network control
QR’s Citytrain network control operated from Tamaree[24] to the north, Varsity Lakes and Acacia Ridge to the south, and Rosewood to the west. It was divided into nine universal traffic control (UTC)[25] areas for train control and monitoring purposes, with a tenth used during busy periods. The UTC 7 workstation managed the North Coast Line[26] between Glasshouse Mountains and Tamaree, which included Cooroy. The neighbouring UTC workstation, UTC 3, managed the North Coast Line from Sunshine to Beerburrum, and the Redcliffe Peninsula Line (Figure 12).
Figure 12: North Coast Line QR Citytrain universal traffic control boundaries
Image shows the location of the UTC 3 and UTC 7 boundary, between Beerburrum and Glasshouse Mountains. Source: TRANSLink, annotated by the ATSB
Network control officers (NCOs) operated the UTC workstations. The NCOs were supervised and assisted by two train control leaders (TCLs). The TCLs were senior, experienced NCOs, each of which was allocated supervision of either the northside or southside NCOs. Two experienced, relief NCOs provided additional support to the NCOs, for example, during breaks. Relief NCOs were, like the TCLs, allocated to either the northside or southside. The day of operations coordinator (DOOC) was a senior, experienced NCO, who provided overall supervision of the network control centre, including of the NCOs and TCLs (Figure 13).
Communication between train control and train crews was normally by radio. TCLs monitored and answered the QR staff, emergency services and members of the public emergency telephone.
Figure 13: Network control centre showing the train control leader and relevant network controller positions
The image is taken from the approximate boundary between northside and southside halves of the network control centre. The southside NCOs and TCL are located to the left of the image (out of frame).
Source: ATSB
Overhead line equipment control
An electric control room situated at the RMC was used for monitoring and controlling the QR high voltage OHLE systems. An electric control operator (ECO) monitored and controlled the OHLE via a supervisory control and data acquisition system (SCADA).[27] An electronic event log provided information to the ECO of electric traction system alarms, issues and associated actions. The ECO workstation was also fitted with a UTC mimic panel. This panel enabled the ECO to monitor the real-time location of train movements within the electrified areas of the QR network (Figure 14).
Figure 14: Electric control operator workstation
Source: ATSB
The electric control room was segregated from the network control centre and NCOs, with communications between these areas undertaken by telephone. The ECO was able to monitor NCO radio conversations with train crew, but was not able to communicate directly to train crews. Therefore, if an ECO needed to communicate with a train crew, they were required to telephone the NCO, who would then pass on the message.
RMC personnel
In terms of the personnel on duty at the time of the accident:
The NCO allocated to UTC 7 workstation qualified as an NCO on the northside UTC workstations just over 18 months prior to the dewirement.
The northside relief NCO qualified as an NCO assistant 13 years previously, and qualified as an NCO in 2009
The southside TCL had 36 years’ experience in the RMC, and was qualified as a TCL for both northside and southside UTC workstations.
The northside TCL commenced as an assistant NCO in the Brisbane freight network control centre 21 years previously, later transferring to the RMC and becoming a TCL about 3 years prior to the dewirement.
The DOOC, who commenced his shift at the time of the dewirement, had previously been an NCO and a TCL, and had been acting in the DOOC role for about 2 years.
The ECO initially qualified as a high voltage OHLE substation electrician, and then qualified as an ECO about 3 years prior to the dewirement.
The UTC 7 NCO, northside relief NCO, ECO and DOOC all stated that they felt alert at the time of the dewirement and emergency response. Although they stated that their workload was high during the emergency response, they felt it was manageable.
Emergency procedures
As a prescribed electricity entity, QR was required to have a discrete safety management system (SMS) for managing electrical safety risks.[28] QR standard MD-13-73 (Electrical safety management plan (ESMP) for declared electrical entity works) complied with this legislative requirement. A further ten supporting documents comprising of standards, instructions, procedures, plans and checklists were provided to guide personnel during OHLE emergencies.[29] These guidance materials included responsibilities and actions for the ECO, NCO, DOOC, train driver (including when appointed as onsite coordinator), nominated person and QR commander.
Electric control room procedures during OHLE emergencies
The QR procedure MD-11-4403 (Electric control room) provided guidance to ECOs about how to respond to OHLE circuit breaker trips. Outside a ‘high risk area’,[30] (including between Eumundi and Cooroy), the ECO could reset a tripped OHLE circuit breaker after 1 minute, after reviewing all available information. Provided the reset OHLE circuit breaker remained closed, no further action was required. However, train crews were to be requested to remain vigilant for OHLE abnormalities.
A ‘persistent’ fault was defined as one which resulted in an immediate circuit breaker trip after the circuit breaker was reclosed. The procedure stated that persistent faults:
… may involve dewirement or objects hanging from the OHLE. Re-energisation of traction OHLE under these conditions may expose people in the vicinity of the fault to the risk of contact with live OHLE and serious injury or electrocution…
Accordingly, the procedure stated that in this circumstance the circuit breaker was not to be reclosed. The procedure also stated:
Should the ECO receive indications of persistent traction faults with non-electric trains on section, the ECO shall immediately arrange for blockage to all traffic to be applied to the affected area.
In addition to a dewirement or objects hanging from the OHLE, the procedure stated that another potential source of persistent faults was over-dimensional loads.
Although the circumstances which occurred on 18 August 2018 did not strictly meet the definition of a persistent fault, they did involve recurring faults close together. The ECO effectively followed the same procedure.
In instances of non-life threatening emergencies, the ECO was to:
de-energise the OHLE between the two adjacent neutral sections[31]
arrange a block to all trains [by the NCO] to the affected section
warn onsite personnel [through the NCO] to maintain a 3 m exclusion zone of the OHLE and anything in contact with it
arrange OHLE staff to attend.
During the events on 18 August 2018, the neutral sections were located at Woombye and Traveston, requiring de-energisation of 50 km of OHLE. The ECO de-energised the section and arranged for a block to all trains. However, based on the available evidence, the ECO did not ensure the NCO had communicated the dangers of the OHLE to the driver of YC77.
In terms of identifying the location and reasons for circuit breaker trips, MD-11-4403 noted that the fault locator function was not always accurate. In addition, the ECO advised that unidentified causes for OHLE circuit breaker trips on the North Coast Line were common. The area north of Caboolture (50.390 km) was predominantly bushland, with OHLE circuit breaker trips commonly attributed to wildlife and tree branches.
Network control centre procedures during OHLE emergencies
During a confirmed high voltage OHLE emergency, QR procedure MD-11-33 (High voltage (HV) electric traction infrastructure emergency module EP1-04) was to be followed. The procedure outlined some general safety rules, including:
Electric traction exposed lines and equipment (and any objects in contact with exposed equipment) shall be treated as live and dangerous…
Maintain minimum 3 metre exclusion zone from all electric traction exposed lines and equipment (and any objects in contact with exposed equipment) and keep others away. Situational hazards may require a much greater exclusion zone...
Do not approach unless advised safe to do so by the relevant Network Control Centre.
The procedure outlined required actions for a wide range of personnel, including NCOs and ECOs. It stated:
Even when the Electric Control Operator (ECO) has informed the Network Control Officer (NCO) that the overhead line equipment (OHLE) has been de-energised, it is still NOT electrically safe until the Queensland Rail Nominated Person (NP) has isolated, tested de-energised and earthed the HV [high voltage] Electric Traction Infrastructure and issued a Form C or a Form D Permit to Work.
In addition to communicating dangers and safety requirements of the OHLE to onsite personnel, the NCO was to place track blocks[32] on the affected sections of track.
Hard copies of the emergency procedures were readily available at NCO workstations. In addition, QR provided NCOs with a supporting checklist, MD-17-482 (NCO incident and emergency response tool), for quick reference during an emergency. This checklist was introduced in 2017 and included three sections: immediate actions, communication and emergency response. Items specific to OHLE electrical safety were highlighted in red in each section. These highlighted sections included:
immediate actions: confirm OHLE status
communication: reinforce current OHLE status to train crew and emergency services, with status updates as required
emergency response: advise on OHLE status (de-energised, isolated, earthed, tested) (see Electrical safety).
Under the last item, the checklist stated:
Ensure Emergency Services are aware that the OHLE can only be considered safe when this [de-energised, isolated, earthed and tested] has been completed.
QR advised the ATSB that this checklist was a guide only, and was ‘not required to be completed by the network controllers during the course of an incident’. One TCL indicated it was better to use experience than a checklist, and the other thought that checklists assisted in ensuring tasks were completed. Several NCOs stated that no checklist for the NCOs existed, with one stating they would be helpful for those new to the role. The UTC 7 NCO did not complete a checklist during the 18 August 2018 emergency response.
In terms of the procedures and guidance for other personnel:
There was no specific procedures or guidance for NCOs allocated to neighbouring UTC workstations to that dealing with an OHLE emergency, and no specific procedures or guidance for the relief NCOs.
TCLs were not provided with specific procedures or guidance to assist in process coordination during times of an emergency. A mandatory checklist, MD-17-486 (OHLE incident – DOOC and TCL incident and emergency tool), for both the TCL and DOOC existed; however, the main focus of this checklist was effective stakeholder engagement and the organisation of alternate passenger transport. One entry related to ensuring emergency services were aware of OHLE dangers, and another related to arranging assistance for the NCO dealing with the emergency. Neither of these two action items were marked as completed during the 18 August 2018 emergency response, although the southside TCL did warn the QPS communications centre of the OHLE dangers onsite at Cooroy (see Post-dewirement activities).
Procedural guidance for the DOOC during an OHLE emergency was limited to stakeholder communications, declaring an emergency, activating a QR commander to manage the accident site, and providing general assistance.
In terms of responsibilities during an emergency response, the DOOC advised that the TCLs provided supervision and handled operational incidents, with the DOOC’s role limited to communication with stakeholders. One of the TCLs noted ‘… everyone knows what goes on [during an incident]’, with the DOOC providing oversight. The other TCL believed the DOOC was responsible for coordination and decisions. Several personnel noted that NCOs commonly divided tasks among themselves when handling an incident.
During interview, most of the network control personnel felt that the emergency response on 18 August 2018 was well managed, with good teamwork and utilisation of previous experiences.
The UTC 7 NCO recalled being in charge of handling activities associated with train YC77, with the only assistance being from the southside TCL (although UTC 7 was under the northside TCL’s supervision). Audio recordings of communications indicated that the UTC 7 NCO had limited communications with the driver of YC77 after the dewirement, and was occupied with other train control duties during the emergency response period, including managing other trains and answering phones. The UTC 7 NCO was unaware the driver was instructed to inspect the train by another NCO.
The southside TCL recalled having minimal involvement during the emergency response, limited to answering the emergency phone, and thought the northside TCL likely assisted the UTC 7 NCO.
The northside TCL, in charge of supervising the UTC 7 NCO, felt that the NCO ‘probably’ managed the accident train. After a review of all available evidence, the ATSB could not determine what involvement the northside TCL had during the emergency response.
Procedures for onsite personnel
MD-11-33 also outlined procedures for other personnel, such as the train crew. The procedures relating to rail traffic crew (RTC) included:
Stay on the radio to NCO and await instructions…
Advise passenger/RTCs to remain on the train until further notice if it is safe to do so
Do not leave the train until the NCO confirms it is safe to do so…
MD-11-30 (Rail emergency response module EP1-01) outlined additional procedures. It stated that, in the initial stages, the NCO would appoint an onsite coordinator to take control of the scene. After declaration of an emergency by either the DOOC or business operations shift supervisor, a QR commander could be activated to attend onsite and take over coordination of the scene from the onsite coordinator.
The QR commander’s duties included:
onsite point of contact
conducting site assessment for hazards
(as an authorised person) receiving Form C from the nominated person
communicating the limits of electrical safety to onsite teams.
During the emergency response on 18 August 2018, the driver of YC77 was initially appointed the onsite coordinator, with the QR commander taking over after arriving at the site at 2252. The QR commander then contacted the ECO, who confirmed that the OHLE was de-energised from Traveston to Woombye but was not yet isolated. The ECO further advised that OHLE personnel were yet to determine what earthing requirements were required in the vicinity of the train itself.
Shortly afterwards, the QR commander met with the QPS who were required to conduct alcohol and drug testing of the driver of YC77.[33] Although the QPS were empowered to enter exclusion zones in the event of an emergency (to direct evacuations and exclude persons from premises),[34] this did not apply to conducting post-accident drug and alcohol testing. The QR commander allowed the QPS to attend the locomotive of YC77, requiring the driver to leave the locomotive cabin.
Previous occurrence involving an emergency response
On 31 January 2013, a Queensland Rail (QR) passenger train (T842) failed to stop at the Cleveland station platform (due to problems with braking system effectiveness) and collided with the end-of-line buffer stop, the platform and the station building at a speed of about 31 km/h. There were 19 people on board the train (including the driver and a guard); three people were on the platform and five were in the station building. During the collision sequence, the train contacted an OHLE mast resulting in a dewirement, with wires brought down onto the train and platform.
It was identified that during the emergency response the guard (after communicating with network control) had assisted two passengers to evacuate the train before the OHLE was made electrically safe. In its investigation report,[35] the ATSB made the following finding:
During the period immediately following the collision there were a series of communication issues which resulted in incomplete information being provided to key personnel. This resulted in the train control operator and train guard miscommunicating the status of the downed overhead power lines, leading to the guard permitting some passengers to exit the train before emergency services had ensured it was safe to do so.
At the time of the 2013 accident, QR had not provided NCOs with a checklist for responding to an emergency such as an OHLE dewirement. The ATSB report provided discussion about the relevance of checklists and the handling of the emergency response by the network control centre, including:
With no quick reference decision aids or checklists to refer to, train control personnel were required to interpret ambiguous and incomplete information about a complex situation, based solely on voice communications from a remote location...
The use of standardised procedures for emergencies enables personnel to use rule-based decisions to react quickly and effectively to contain a situation. It permits the considered design of procedures by experts to be efficiently implemented by operators, and has the potential to mitigate the effects of inexperience and misunderstanding of an event. However, the effectiveness of these procedures is influenced by familiarity with, and accessibility of the procedures. In this case, the train control personnel had no quick reference guides or checklists to assist in diagnosing the situation (to then determine which module would apply), nor was the document organised in a way that facilitated ease of identification of required actions and their sequencing…
The investigation established that some train control personnel referred to the Derailment procedure, whilst another followed the Overhead Line Equipment Emergency procedure. Other staff did not make use of the specification [relating to OHLE emergencies], but instead relied on memory and experience to guide their actions. In some instances, this resulted in a lack of clarity as to allocation and priority of responsibilities and tasks, as well as some ineffective communications…
The train control operator continued to provide control services to the other lines under his control … there was no initiation of processes to reallocate [his] extraneous tasks in order to enable him to focus on the emergency response to this event, nor was there any consideration for this to occur documented within the emergency procedures.
The effective management of an emergency situation from a location remote to the event presents a number of challenges for the train control staff, primarily related to ensuring that timely and accurate information is available, communicated, and understood, and that the response is handled in an efficient and coordinated manner. To that end, it is critical that standard procedures are in place, but it is equally critical that those procedures are designed to accommodate human performance limitations in conditions of high stress and/or workload, and that they are well understood through staff training and well-practised through field based and desk-top exercises.
On 31 January 2003, a passenger train derailed at Waterfall, New South Wales. The special commission of inquiry[36] provided a detailed discussion about emergency response activities. The commission report stated:
The rail industry needs to develop checklists for its staff to follow in the event of a particular kind of incident, such as a derailment. For example, the train driver should have a simple checklist identifying the information which he should immediately communicate to the RMC [rail management centre]…
Other railway personnel need to have checklists identifying clearly and precisely what they are required to do in the case of an emergency and the order in which things are to be done…
Such checklists should be provided as part of the ICS [incident command system]… They should be on a sheet in the driver’s cabin, guard’s compartment or signaller’s or train controller’s work station.
Accordingly, the commission recommended that the RailCorp [the rolling stock operator and rail infrastructure manager] emergency response plan should include action checklists for each relevant employee.
Overhead line equipment safety information
Description
The autotransformer system used by QR consisted of a feeder wire that was energised at 25 kV AC (-25 kV), but at opposite phase;[37] that is, 180⁰ to the contact wire (+25 kV). Although supply to trains remained at 25 kV AC, this system introduced an additional nominal phase-to-phase[38] voltage of approximately 50 kV AC. This was in addition to the 25 kV AC phase to neutral[39] in comparison to ground; that is, the return rails (0 kV). An additional earth wire electrically connected adjacent OHLE structures, to ensure safe return to ground in the event of a failed earth bond on a single structure.
The advantage of the autotransformer system was the ability to energise further distances due to the higher 50 kV AC feed, halving the number of high cost feeder stations.
Electrical safety
The Queensland Electrical Safety Regulation 2013 stipulated exclusion zones that applied to untrained persons in relation to high voltage overhead uninsulated electric lines. In instances where the phase-to-phase voltage was approximately 50 kV, as for the OHLE in the Cooroy precinct:
the exclusion zone between an untrained person and the overhead line was 3,000 mm
the exclusion zone between a vehicle operated by an untrained person and the overhead line was 2,100 mm.
The regulation stated that a person ‘comes within an unsafe distance of an overhead electric line if the person is within the exclusion zone’. An untrained person was a person who was not technically proficient or experienced with the OHLE. Train drivers and emergency services personnel would generally be classified as untrained persons.
In instances where exclusion zones were not reasonably practical to achieve, the regulation allowed an organisation to reduce the distance after a risk assessment and control measures had been implemented. For the purposes of a vehicle operated by untrained persons, QR advised the ATSB that its nominated exclusion zone was 300 mm, accounting for arc distance and a safety margin.
In other words, if the rolling stock or anything being carried by the rolling stock was within 300 mm of the OHLE, then it was within an unsafe distance. Accordingly, an exclusion zone then applied to the rolling stock, such that an untrained person could not approach within 3,000 mm of the rolling stock. A person who was still on the rolling stock from before it entered the exclusion zone was still in effect in a safe place. However, if they attempted to leave the rolling stock, they would be entering an exclusion zone. Appendix A – Dangers associated with high voltage overhead line equipment (OHLE) in dewirements provides further details of the hazard associated with OHLE following dewirements, including touch potentials (a person touching the ground and the rolling stock) and a step potential (a person being in close proximity to the rolling stock with both feet on the ground).
In the case of the 18 August 2018 dewirement, as the rear end wall of the top nested flat rack extended into the 300 mm exclusion zone associated with the rolling stock, the end wall and train YC77 were subject to an exclusion zone for untrained persons of 3,000 mm.
As noted in Network control centre procedures during OHLE emergencies, QR procedure MD‑11‑33 prohibited entry to exclusion zones until the high voltage OHLE was electrically safe, by being de-energised, isolated, tested and earthed. More specifically:
De-energised: the opening of high voltage circuit breakers, either automatically by excess current or manually by the ECO, to disconnect electrical energy. This did not guarantee the electrical energy had been discharged from the OHLE.
Isolated: the opening and, lock and tag out of isolation switches, to disconnect all possible sources of electrical energy to the section of OHLE, including by unintentional energisation. This was performed by the nominated person in the field.
Tested: confirmed the isolated section of OHLE had been de-energised. This was performed by the nominated person in the field.
Earthed: the isolated section of OHLE was connected to the general mass of the earth, to ensure discharge of any residual energy. This ensured the OHLE could not be made live from external sources, for example, other live wiring. This was performed by the nominated person in the field.
Once earthing was confirmed, the nominated person could issue a Form C (Permit to work) to an authorised person. It was at this point that the section of high voltage OHLE nominated on the Form C was considered electrically safe, allowing entry to the exclusion zone.
In the case of the 18 August 2018 dewirement, the OHLE was de-energised at 2101, just prior to the dewirement. The nominated person issued the first Form C at 0300 the morning after the dewirement. The QR commander delegated the receipt of Form C from the nominated person to the accompanying rail operations response unit (RORU) officer, who was also qualified as an authorised person.
Instruction and training of OHLE dangers for QR personnel
QR provided general guidance regarding the hazards associated with OHLE in various procedures and other documents. In addition to MD-11-33, this included the MD-14-36 (General appendix) and MD-10-191 (Electric traction systems) manuals. The general instructions section of the general appendix stated:
All employees and contractors shall constantly bear in mind the ever present danger of electrocution from the high voltage overhead line equipment in electrified areas. It is dangerous for anyone to touch, or to come into close proximity of, live overhead line equipment.
Similarly it is dangerous to allow any object to touch or to come close to live equipment.
Note: Always treat overhead line equipment as live until it has been ascertained that the equipment has been made safe for persons to approach or to come into contact with it.
Although the documents used by network control personnel and other operational personnel provided guidance regarding the 3,000 mm (or 3 m) exclusion zone between a person and OHLE, none of the documents provided clear guidance on the additional aspect of the 300 mm exclusion zone between a vehicle and OHLE.
NCOs completed OHLE safety training, including TLIF2080 (Safely access the rail corridor), when initially appointed to their position. This unit of competency was reassessed as part of periodic NCO competency reassessments. TLIF2080 training included dangers associated with objects in close proximity to OHLE, but did not provide an indication of a safe gap distance between rolling stock or objects on rolling stock and the OHLE. NCO duties did not include in-field operations.
QR commanders completed authorised person training, which allowed them to receive a Form C when OHLE was made electrically safe. Authorised person training included dangers associated with objects in close proximity to OHLE, but did not provide an indication of a safe gap distance between rolling stock or objects on rolling stock and the OHLE.
Instruction and training of OHLE dangers for train crew
Aurizon advised that the driver of YC77 completed OHLE safety training in January 2014, as part of the nationally-recognised unit of competency TLIF2080C (Safely access the rail corridor), while based in Geraldton, Western Australia. There was no OHLE fitted in Geraldton. Although the training included dangers associated with objects in close proximity to OHLE, it did not provide an indication of a safe gap distance between rolling stock or objects on rolling stock and the OHLE.
A review of the driver’s last reassessment of competence found a single question in relation to OHLE safety during a dewirement emergency. In addition, the driver operated diesel locomotives only, which did not rely on OHLE for traction purposes. The driver reported never having been in a dewirement occurrence before.
Although Aurizon drivers did not work for QR, they were required to follow QR procedures while operating a train on the QR network. The driver of YC77 was aware QR documents were available on Aurizon’s iN-Gauge intranet service, but was not sure which document contained the OHLE emergency procedures. There was no computer access available on board YC77. Therefore, the driver did not have access to enable referral to the procedure at the time of the emergency response.
Recognition of OHLE danger presented by extended flat rack end wall
During interviews after the dewirement, it was apparent that almost all network control centre personnel handling the emergency response, the QR commander and the driver of YC77 did not recognise the hazard associated with the extended end wall of the flat rack being close to the OHLE. The general belief was that OHLE dangers were limited to the site of the actual dewirement at Cooroy, about 3 km behind where YC77 stopped. As the OHLE was still erect above YC77, most personnel on the evening of the accident felt it was in a safe state.
Driver only operations information
General
Driver only operations (DOO) was a train crewing configuration where a single driver operated the train without the presence or assistance of any other on-board personnel.
On the QR network, Aurizon operated DOO services between Acacia Ridge and Townsville on the North Coast Line (1,353 km), Fisherman Islands and Ebenezer on the West Moreton system (79 km), and Stuart and Mount Isa / Phosphate Hill on the Great Northern Railway (1,032 km). Further, on its own network, Aurizon advised it operated DOO services between the nearest depot and ports on the Moura, Blackwater, Goonyella and Newlands coal systems.
The Queensland Work Health and Safety Regulation 2011, and an accompanying Code of Practice,[40] required that the movements of remote or isolated workers[41] be monitored, including ensuring adequate communication methods were maintained.[42] Train drivers in a DOO configuration would generally be classified as remote or isolated workers. The purpose of these requirements was to ensure timely assistance in the event of an emergency or incapacitation.
QR emergency procedures for driver only operations
The North Coast Line was subject to open access by third party operators. A formal access agreement and interface risk management plan (IRMP) arranged access by Aurizon on QR’s network. The IRMP detailed interface risks and resultant controls between QR as the rail infrastructure manager[43] and Aurizon as the rolling stock operator.[44] QR provided Aurizon access via a customer portal to all relevant sections of QR’s SMS, in connection with the risk controls nominated in the IRMP. Aurizon arranged access to QR documents for its personnel via its own intranet system ‘iN-Gauge’.
According to the QR IRMP, risks to drivers trackside when in a DOO configuration were to be managed in accordance with the DOO emergency procedure within QR’s MD-14-36 (General appendix). The procedure stated that when a train had been stopped due to an accident, obstruction or exceptional circumstances, drivers would secure their train from uncontrolled movement, and complete form MD-15-457 (Authority for driver only rail traffic driver to leave locomotive) with the NCO prior to leaving the locomotive cabin to investigate the nature of the problem. The procedure also stated:
Instructions must not be given to the rail traffic driver to take any action that could affect his/her personal safety or the safety of the train.
QR introduced form MD-15-457 in November 2015 (replacing an earlier form, no. 22513). The form required the driver and NCO to describe the details of the train, the location and the situation and agreed reporting times (to ensure effective communication was maintained with the driver at all times they were outside the locomotive cabin). A maximum reporting interval of 15 minutes was nominated by the DOO procedure. In the event of a loss of communication, the NCO was to assume an emergency existed and immediately arrange assistance (for example, from emergency services).
Aurizon emergency procedures for driver only operations
Aurizon’s procedures stated that, in the event of an emergency, drivers were to refer to emergency checklist 16-FRM-012-COM (Duty card train crew) for immediate actions, including when vacating a locomotive cabin. There was no reference to the DOO procedure or requirements on the duty card.
Aurizon drivers carried an on-the-spot risk assessment tool called Stop! Take time and switch on. This tool was used to identify hazards and control risks, prior to performing an unusual or non-routine task, for example, vacating a locomotive cabin at an unusual location. Aurizon advised that, although this tool had a supporting instruction, this instruction was withdrawn following the 18 August 2018 dewirement.
Although form MD-15-457 contained a ‘situation report’ section, neither it, nor QR’s DOO emergency procedure, required an on-the-spot assessment of hazards and control of risks prior to the locomotive cabin being vacated.
Access to relevant procedures and forms
In order to be able to complete form MD-15-457, hard copies needed to be provided in the locomotive cabin. No forms were stored on train YC77.
Access to Aurizon’s duty card, QR’s DOO procedure and form MD-15-457 were limited to Aurizon’s iN-Gauge intranet service. There was no computer access available on board YC77. Therefore, the driver did not have access to these documents at the time of the emergency response, or any time while undertaking driving duties.
The driver reported not having seen form MD-15-457 before, instead referencing the older form (no. 22513), which was withdrawn almost 3 years previously. The driver was aware QR documents were available on Aurizon’s iN-Gauge intranet service, but was not sure which document contained the DOO procedure.
Application and knowledge of DOO emergency procedures
Based on a review of recorded voice communications, neither the driver of YC77 nor multiple NCOs followed QR’s DOO procedure during the emergency response. The driver of YC77 left the locomotive cabin on five occasions during the emergency response (two in the absence of any other personnel), without completing form MD-15-457. The NCO was not advised on all occasions, no agreed report back times were agreed and, a mobile phone was used as the method of communication.
During interview, it was found that knowledge of the DOO procedure was well known among network control centre personnel. Some personnel noted that it was difficult to identify if a train was operating in a DOO configuration. However, based on a review of recorded voice communications, there was no evidence that the driver of YC77 or the NCOs discussed the type of crewing arrangement during the emergency response.
Although the DOO procedure was included in initial NCO training, it was not contained within the NCO periodic reassessment of competency. Of the network control centre staff interviewed, one had seen a DOO form, and another two advised not having issued such a form for more than 10 years.
The driver reported being aware of the QR DOO procedure, but could not recall being trained in its use. Periodic driver reassessments of competence did not contain the DOO procedure. The driver further advised of not having been in a situation requiring its use in almost 5 years.
Driver only operations on the Aurizon network
During investigation, the ATSB found that both Aurizon and third party operators operated DOO services extensively on the Aurizon owned network in Queensland. As a rail infrastructure manager, Aurizon was required to provide third party operators with access to relevant sections of its SMS documents, which controlled risks while operating on its network. Although referenced within the Aurizon risk assessments, the ATSB found that no DOO procedure existed for the Aurizon owned portion of the North Coast Line.
In November 2015, when QR made changes to the DOO form in use on its network, Aurizon issued an advice notice to staff advising of QR form no. 22513 being replaced by QR form MD-15-457. In addition, Aurizon (with the withdrawal of form no. 22513), elected to adopt an existing form (SW12, which was used for a variety of purposes), to be used when operating DOO on its own network. This advisory notice was withdrawn from circulation on 19 February 2016.
Despite changing to a different DOO form on the Aurizon network, Aurizon advised that no documents within its SMS were altered to reflect this change.
To ensure correct implementation of the altered DOO procedural form requirements on both the QR and Aurizon networks, Aurizon recommended follow-up inspections and auditing of the process. Aurizon could not provide evidence this had occurred.
Aurizon freight train YC77 departed Acacia Ridge Intermodal Terminal with one of its wagons containing a stacked nest of three empty flat racks. During its journey, the rear collapsible end wall of the top flat rack extended upwards (reaching a height of about 4,845 mm). The top of this end wall impacted the underside of the Elm Street overbridge (a height of 4,816 mm), just prior to Cooroy Station, and pulled down overhead line equipment (OHLE). The dewirement resulted in a significant amount of damage to 1.3 km of OHLE, and the consequences could have been much worse had passengers been on the Cooroy Station platform at the time of the accident.
Analysis of closed-circuit television (CCTV) footage, OHLE circuit breaker trips and related information determined that the rear end wall very likely raised upwards at some point between 118.782 km and 119.613 km, and then remained in the extended position until hitting the Elm Street overbridge (130.750 km).
YC77’s data logger indicated that the train’s speed was consistently between 75 and 80 km/h for an extended period immediately prior to the rear end wall of the flat rack extending upwards. It is therefore likely that running at this speed for an extended period eventually resulted in the unsecured rear end wall raising from passing wind resistance, assisted by the flat rack’s leaf spring raise-assist design. There was no evidence that the driver’s actions on approach to Cooroy Station, problems with the serviceability of the train or excessive wind conditions contributed to the accident.
This analysis focuses on the loading and securing of the flat racks on YC77 and reasons why the load was not effectively secured. In addition, it considers the control of hazards at the accident site following the dewirement and aspects associated with driver only operations (DOO) procedures.
Loading and securing of freight
Delivery of flat racks to Aurizon
The freight forwarding company advised the rolling stock operator 4 days prior to the accident that a set of four flat racks were to be delivered for rail transport and that the end walls of the nest of three flat racks were secured by use of chains.
Based on CCTV evidence, the ATSB identified that neither of the end walls on the top flat rack on the nest of three were strapped or chained when delivered, as required for rail travel. The ATSB’s inspection after the dewirement found no evidence that chain or straps had been in place at either end of the flat rack to provide an additional means of restraint. In addition, the ATSB identified that the twist locks to lock the end walls of the top two flat racks in the down position were not engaged, and given the condition of the twist locks it is unlikely they had been locked for some time. It also seems very unlikely that the twist locks could have moved during transit, or that anyone would have unlocked them prior to transit.
In summary, the nested set of three flat racks were delivered to the Acacia Ridge terminal without the collapsible end walls of the top nested flat rack being secured for rail travel. The ATSB did not examine the reasons why the flat racks were delivered in an unsecured state, instead focussing on the controls the rolling stock operator had in place to ensure the security of loads on its train.
Inspection of flat racks during delivery and loading
According to Aurizon’s procedures, securing of the end walls of any flat racks travelling as freight were to be checked twice prior to the departure of a train. The terminal coordinator was required to check the flat racks when they were first delivered, and the pinners were required to check the security of any loads (including flat racks) after they had been loaded onto a wagon.
In this case however, the terminal coordinator did not check the securing of the flat racks on arrival at the terminal and, consequently, the flat racks were loaded onto YC77 in an unsecured state. The terminal coordinator (and another person who sometimes acted in the role) advised they were not aware of the requirement to inspect loading from external freight forwarding companies.
Similarly, the pinners did not check for the absence of chains or web strapping during the securing inspection, and consequently the flat racks departed Acacia Ridge in an unsecured state. Personnel who performed this task stated they believed checks during pinning were limited to ensuring any provided securing was tight, rather than checking what securing was absent (such as straps or chains). However, the investigation could not determine the exact reasons why the twist locks on the top two nested flat racks were not identified as disengaged during the securing inspection. The twist locks on the top flat rack would have been almost 3 m above the ground, but the position of the handles (which indicated whether the twist locks were engaged) should still have been visible from the ground.
Unusual load responsibilities and access to guidance material
The terminal coordinator and pinners’ limited understanding with regard to their responsibilities for checking unusual loads highlighted issues relating to training and continued competency assessments in the roles.
Aurizon was unable to provide evidence that the terminal coordinator or another person who had performed that role had received training in the instructions for the terminal coordinator role. Although one of the pinners and the heavy forklift driver had received training in the work instruction for pinning, that work instruction provided limited detail regarding what type of checks of unsecured loads were required and it did not refer to the relevant checklists.
These personnel had received the on-line loading and securing of freight training course, which provided extensive complex instruction on securing of unusual loads. However, it was conducted up to 14 months previously for some personnel. All interviewed personnel advised that flat racks were rarely encountered at the Acacia Ridge terminal. As any such instructions were rarely used, it was likely their accurate recall was diminished by the time they were required to be used.
Issues with knowledge of flat rack securing requirements had been identified after two previous accidents involving inadequate securing of unusual loads. Although Aurizon had recommended that staff undertake further theory and practical training, this training had not occurred prior to the 14 August 2018 dewirement.
In addition to the effectiveness of the training, the ATSB also identified problems related to access to relevant guidance material. Given the low frequency that each type of unusual load was encountered, ready access to checklists or other guidance material would help ensure familiarisation with the relevant procedures at the relevant time. Although Aurizon provided access to manuals, instructions and checklists through its intranet site ‘iN-Gauge’, this was problematic for several reasons:
The Loading and securing of freight manual (07-STD-022-SWK) contained 242 pages, with instructions to secure empty flat racks appearing on one page within a number of other instructional dot points. This limited the ability to source relevant information quickly and easily.
Although checklists for unusual loads were available on-line, and referenced in the work instruction for inspecting incoming loads, Aurizon stated they were not readily available in hard copy. As such, each time a pinner encountered an unusual load, and wanted to refer to guidance material, they would have been required to return to the office, find and print a checklist and recommence a train inspection. This was unlikely to occur.
As already noted, the work instruction for train pinning did not refer to the available checklists for checking unusual loads. In addition, personnel who performed that role reported they were not aware any guidance documentation existed.
Therefore, based on the available evidence, the ATSB found that Aurizon did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists. Had these problems been addressed, it is likely that the checking of unusual loads would have been more effective.
Electric control information anomalies
YC77 departed Acacia Ridge at 1749, and the first indication of a problem to the rail management centre occurred at 2048 when the first OHLE circuit breaker trip occurred. The dewirement did not occur for another 14 minutes. Accordingly, the ATSB considered the potential opportunity for the problem with YC77’s load to have been detected during this period prior to the dewirement.
In non-high risk areas such as Yandina to Cooroy, the electric control operator (ECO) could reset OHLE circuit breaker trips after 1 minute, after reviewing all available information. Provided the reset OHLE circuit breaker remained closed, no further action was required. During the event sequence, the ECO reset two separate occurrences of OHLE circuit breaker trips. The third occurrence, 13 minutes after the first, was not reset. Although these three OHLE circuit breaker trips occurred on the same electrical section, the information presented to the ECO to assist decision making was conflicting and ambiguous. More specifically:
The driver of YC77 reported observing nothing unusual after the first OHLE circuit breaker trip.
The fault locator (which may be inaccurate) did not operate for the second OHLE circuit breaker trip. Therefore, the location of this trip was unknown, encompassing a 50 km section of track on which three trains were operating.
During each of the first two OHLE circuit breaker trips the circuit breaker reset held closed, suggesting there was not a persistent fault (which would have provided a more obvious indication of an over-dimensional load).
Until the dewirement, multiple track circuit occupied indications (which are occasionally associated with OHLE traction faults) were either not near the location of YC77, or they did not coincide with OHLE circuit breaker trips.
OHLE circuit breaker trips on the North Coast Line were not uncommon and were often attributed to wildlife and tree branches touching the OHLE.
With consideration of the available information during the sequence of events leading up to the dewirement, the ECO followed the correct procedure, with no firm indication until after the third OHLE circuit breaker trip that YC77 was the probable reason for the observed indications.
Post-dewirement response
Entries into an exclusion zone
High voltage electricity is a significant hazard, and a primary risk control to ensure safety prior to the equipment being made electrically safe is the implementation of exclusion zones. In relation to QR’s OHLE, the following exclusion zones applied for untrained persons (such as train crew):
3 m between an untrained person and the overhead line
3 m between an untrained person and the train and objects on the train if an object was within 300 mm of the overhead line.
Exclusion zones applied at two locations following the dewirement at Cooroy. The first was in the Cooroy Yard precinct, in the area of the actual dewirement. The second was near where YC77 stopped. As the end wall of the top nested flat rack extended within 300 mm of the OHLE, the train was subject to an exclusion zone of 3 m.
In this case, the actual risk around the train was relatively low as the OHLE had been de-energised. However, the OHLE had not been made electrically safe, and there was the potential for the OHLE to be inadvertently re-energised by the ECO, dewired OHLE contacting external supply authority lines, or an electric train entering into the de-energised electrical section from an adjacent live section. In the case of the latter, an electric passenger train was scheduled to enter the de-energised electrical section 9 minutes after the dewirement.
If the OHLE had been re-energised, the likelihood of arcing over a 210 mm air gap was also relatively low. However, initially no-one knew the exact nature of the problem. It is acknowledged that in circumstances of an OHLE circuit breaker trip of an unknown cause, with no immediate indication of a problem, it is impractical to not allow an external inspection of the OHLE by train crew prior to the OHLE being made electrically safe (assuming the train crew first conduct an inspection from their cab prior to leaving the train). However, in this instance there had been sufficient evidence to indicate either a dewirement or, at the very least, some part of YC77 had been intermittently contacting the OHLE. The distance from that object to the contact wire after the train stopped, or the extent to which the train had pulled down wire close to where it had stopped, was unknown.
Therefore, even though the actual level of risk (determined after the emergency response) was relatively low, during the emergency response the risk level was unclear and the situation should have been treated as if there was a genuine level of risk. Accordingly, no-one should have approached the train (or exited the train) until the applicable exclusion zone could be determined or until the OHLE at that location had been made electrically safe (that is, de-energised, isolated, tested and earthed). The extent of the damage was not determined until an OHLE linesman inspected the area about 2 hours after the dewirement. The process to make the OHLE electrically safe around the train was not completed until 6 hours after the dewirement occurred.
Initially the driver entered the exclusion zone by exiting the locomotive to conduct an inspection of the train, under instruction from a network controller officer (NCO) and before the police had advised that wires had been pulled down. After the driver sighted the extended end wall, the exact distance of the gap between the end wall and the contact wire was still unknown. When inspected from the ground at night, it would have been difficult to estimate the gap accurately. The prudent course of action at that stage would have been to assume the end wall was within 300 mm of the OHLE, and therefore an exclusion zone of 3 m applied around the train.
The ATSB determined that the driver of YC77 and other train crew then entered this exclusion zone on multiple other occasions before the OHLE was made electrically safe. More specifically:
the driver proceeded to a location to improve mobile phone data reception and send photos to the rail management centre
the driver met with a protection officer, associated with an unrelated track closure
the driver undertook post-accident drug and alcohol testing with the Queensland Police Service
the driver accompanied the QR commander and other personnel while they inspected the train
the driver changed with a relief driver.
The ATSB could not determine if the police, QR commander or other personnel also entered the exclusion zone associated with YC77 while interacting with the driver.
Recognition of the risk associated with dewired OHLE
During an OHLE emergency, the NCO was required to advise the OHLE status to train crew and onsite personnel. A report to the network control centre confirming there had been a dewirement at Cooroy and possible OHLE contact with YC77 was received 9 minutes after the dewirement occurred. That information was not passed to the train driver for a further 9 minutes, after an NCO had already instructed the driver to leave the locomotive and inspect the train and OHLE for damage. At no stage during the emergency response was the driver advised that, although the OHLE was de-energised, it was still not electrically safe.
These omissions of key actions appeared to be associated with limited recognition that a potential problem existed at the train, and problems with the coordination of actions between multiple network control personnel.
In terms of the limited recognition of the potential risk, the general belief of interviewed personnel was that OHLE dangers were limited to the site of the actual dewirement at Cooroy, about 3 km behind YC77. The fact that there was known to be significant damage to the OHLE at Cooroy may have focussed their attention on that area. There was limited expectation that a problem could also exist where the train was located, even though it was recognised that the train may have had an object that had been contacting the OHLE.
Although training for the driver of YC77, NCOs and QR commander included dangers associated with objects in close proximity to OHLE, due to the danger of arcing, it did not provide an indication of the appropriate safe gap distance in this situation (that is, 300 mm). This limitation in the training materials may have reduced their ability to recognise the danger posed. Nevertheless, a conservative approach should have determined the gap was problematic, even if the safe gap distance was unknown.
Co-ordination of network control activities post dewirement
In terms of the coordination of actions during the post-dewirement response, there was no single assigned person who was in charge of coordinating activities and managing the ongoing issues as they related to the dewired high voltage OHLE. Although it is not unusual for tasks to be conducted by multiple personnel in an emergency, in this instance the allocation of tasks appeared to rely on an informal division of tasks, teamwork and previous experience.
This resulted in a situation where the UTC 7 NCO, who was responsible for managing YC77, was conducting a number of tasks involving other trains. Meanwhile, at least two other NCOs communicated with and provided instructions to the driver of YC77, including an instruction to inspect the train, without the knowledge of the UTC 7 NCO.
One means of ensuring an effective response is having very clearly defined roles, responsibilities and required actions for different personnel. A review of procedural documentation found that allocation of safety critical tasks during OHLE emergencies was not clear, particularly in relation to the roles of NCOs on neighbouring workstations, relief NCOs and the train control leaders (TCLs). It is recognised that emergencies can take many forms and procedures need to have some flexibility regarding the specific roles of each position in any specific emergency. Nevertheless, ensuring that one person is coordinating all the required actions and ensuring they are completed is essential.
Another means of ensuring an effective response is the use of checklists. Although a mandatory checklist for OHLE emergencies applied for the day of operations coordinator (DOOC) and TCL, this was of limited safety value, as it dealt more with stakeholder management aspects. QR had recently developed a second checklist that summarised NCO responsibilities during an OHLE emergency, which was underpinned by a number of standards, procedures and instructions. It included three entries related to advising electrical safety status to onsite personnel. This checklist was not used or referred to by the UTC 7 NCO or other personnel, and QR advised that its use was optional.
Emergency responses can involve high workload, distractions and interruptions, time pressure, ambiguous sets of information and stress. There can be many different tasks and objectives to achieve, and many people involved in gathering information and conducting the required actions. Such environments provide an ideal opportunity for omission errors to occur. As Hales and Pronovost (2006) explain, cognitive function can be compromised under stressful conditions, particularly in complex, high-intensity environments (such as a network control centre). These authors noted that checklists have the capacity to summarise masses of information that need to be recalled rapidly under challenging circumstances.
Reason (1990) also noted the potential for omission errors associated with the limitations with prospective memory, where an intended task can be forgotten during the interval between intention to perform the task and its execution (due to interruptions or competing priorities). He further noted checklists can assist in reducing these error types when under stressful conditions, such as an emergency response, by acting as a memory aid, thereby ensuring all required steps are completed.
Similarly, it is worth noting that the RISSB guideline document Rail emergency managementplanning stated:
Maintaining ‘quick references’ is recommended to support response and recovery. In the initial onset/identification of the emergency, Procedures or Action Cards and Checklists should detail immediate and important actions to help workers at all levels perform effectively.
There are two types of checklists that are useful in this regard. The first is ‘read-do’, where the checklist item is read and the action performed, which is particularly useful when performing an infrequent task (Dismukes and Berman 2010). The second is ‘flow-then-check’, where a number of actions are performed from memory, then verified as completed through a checklist. As such, there are two opportunities for ensuring the required procedure has been followed (Dismukes, Berman and Loukopoulos 2007).
Due to the benefits of checklists during an emergency response, the Australian Manual of Air Traffic Services,[45] used by both civil and military air traffic control, includes a series of checklists for controllers to use when responding to in-flight emergencies. The manual stated that on notification of the emergency, the checklist actions were to be initiated and the checklist items were to be continually reviewed to ensure all actions had been completed.
QR are to be commended for developing a checklist for NCOs to use for responding to an emergency. However, not making its use mandatory, or ensuring that NCOs continually refer to the checklist during an emergency response, provided a missed opportunity to capture important errors of omission.
Driver only operations procedures in an emergency
Another set of emergency response procedures that should have been applied on this occasion related to driver only operations (DOO). These procedures required that, before a driver left the locomotive following an accident or similar event, they would discuss the situation with network control and establish a report interval.
The DOO procedures were generic in nature and did not require discussion of OHLE safety specifically. However, if the procedures were formally applied, they provided an opportunity for a driver and network control personnel to consider the situation and relevant hazards.
In the case of the 18 August 2018 dewirement, multiple NCOs and the driver did not follow QR’s DOO procedure for leaving the locomotive cabin. On the five occasions that the driver left the locomotive during the emergency response, not all were advised to the NCO. Of those that were, no report back time was agreed or appropriate method of communication formalised.
In terms of potential reasons why the procedure was not followed:
Queensland Rail (QR) provided access to their DOO and OHLE emergency procedures to Aurizon, via a customer portal. Aurizon arranged personnel access to these via its intranet system ‘iN-Gauge’. However, no computer access to the iN-Gauge intranet was available on board YC77. Therefore, the driver was unable to access these procedures and associated forms in an emergency, when required for use.
The driver of YC77’s recollection of the DOO procedure was incomplete, having not referred to it for almost 5 years. Where memory of procedures is degraded, ready access to procedural documentation is important to ensure they are followed.
Aurizon provided a duty card in the form of an emergency checklist for drivers in the event of an emergency. However, a hard copy was not provided and there was no reference within the on-line checklist to the DOO procedure or requirements.
Aurizon provided a hard copy on-the-spot risk assessment tool for drivers to use prior to performing a non-routine task, for example, an unplanned exit of the locomotive cabin. There was no reference to the DOO procedure or requirements within this tool.
Although network control centre personnel knew of the DOO procedure, it was rarely used. The NCOs also were not aware of the crewing arrangements on board YC77, although this could have been clarified in the initial communications with the driver after the train had stopped.
In summary, Aurizon did not provide drivers with ready access to QR’s DOO procedures for when they were operating on the QR network. The same problem applied with access to QR’s OHLE emergency procedures. Limited access, knowledge of existence and supporting document prompts to follow for the DOO and OHLE procedures increased the likelihood of these procedures not being followed during the emergency response. In the case of the DOO procedure, this increased the risk that, had the driver of YC77 required emergency assistance, there may have been a significant delay in recognition and response.
In addition, there was no procedural document for DOO on the Aurizon-controlled section of the North Coast Line. A number of rolling stock operators, including those that also operated DOO services, accessed this track. As such, although Aurizon had adopted a generic form for DOO on its network in November 2015, there was no underlying procedure to instruct its use, or emergency procedures to be followed, in the event of a DOO train emergency.
From the evidence available, the following findings are made with respect to the dewirement involving freight train YC77 that occurred at Cooroy, Queensland on 18 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
As freight train YC77 approached Eumundi, the rear collapsible end wall of the top nested flat rack raised up, resulting in multiple arcs and contacts with the overhead line equipment, which ultimately resulted in the dewirement at Cooroy.
The nested set of three flat racks and a single flat rack were delivered to the Acacia Ridge Intermodal Terminal without the collapsible end walls of the flat racks being secured for rail travel.
Personnel at the Acacia Ridge Intermodal Terminal did not check the collapsible end walls of the flat racks were secured on arrival at the terminal and after the flat racks were loaded onto freight train YC77, and the train departed without these end walls being secured.
Aurizon did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists. [Safety issue]
Although the electric control operator was provided with indications of overhead line equipment faults in the minutes prior to the dewirement, the pattern of information presented was ambiguous and did not enable the reason for the trips to be easily identified.
Other factors that increased risk
On multiple occasions following the dewirement, train crew accessed the exclusion zone associated with the close proximity of the extended end wall of the flat rack to the overhead line equipment, prior to the wires being isolated and earthed on site.
Multiple personnel did not recognise the potential risk associated with part of YC77 being very close to the OHLE after it stopped. In addition, network control centre personnel did not advise train crew of the status of the OHLE during the emergency response period.
Queensland Rail did not have an effective process in place to ensure that safety-critical actions were co-ordinated and completed when multiple network control officers were involved in responding to an overhead line equipment emergency. [Safety issue]
Following the dewirement, the driver and network control officer did not follow required protocols for driver only operations prior to the driver leaving the locomotive cabin.
Aurizon did not provide drivers with ready access to Queensland Rail’s procedures for driver only operations and overhead line equipment emergencies when they were operating on the Queensland Rail network. In addition, Aurizon did not have procedures for driver only operations that applied to its own network. [Safety issue]
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Unusual loads responsibilities and guidance material
Safety issue description: Aurizon did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists.
Access to QR procedures and existence of Aurizon documents
Safety issue description: Aurizon did not provide drivers with ready access to Queensland Rail’s procedures for driver only operations and overhead line equipment emergencies when they were operating on the Queensland Rail network. In addition, Aurizon did not have procedures for driver only operations that applied to its own network.
Process for co-ordinating network control activities during an emergency response
Safety issue description: Queensland Rail did not have an effective process in place to ensure that safety-critical actions were co-ordinated and completed when multiple network control officers were involved in responding to an overhead line equipment emergency
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Queensland Rail
In July 2020, Queensland Rail (QR) advised that it had taken the following proactive safety action in relation to driver only operations (DOO) on its network:
Post this incident occurring, Queensland Rail has re-enforced the understanding of requirements relating to driver only operations and delivered training in this area to key Network Control employees. An assurance activity for Quarter 2 of the 20/21 financial year has been scheduled to verify improvements in this area.
This training was in the form of a tool box talk, delivered in March 2019, and included the DOO emergency procedures and issuance of form MD-15-457 (Authority for driver only rail traffic driver to leave locomotive).
In August 2020, QR also advised that it had:
…issued an Important Safety Notice [ISN] to Rail Traffic Crew [train drivers and guards] addressing identifying emergency situations involving OHLE.
This ISN, issued in August 2020, advised train crew that in the event of an overhead line equipment (OHLE) issue, they were to:
confirm the status of the OHLE with the network control officer (NCO)
remain within the train and advise the NCO in the case of a suspected dewirement or high voltage earth alarm on the train
if while inspecting a train an object or rolling stock was found to be within 300 mm of the OHLE, apply an exclusion zone of 3 m around the rolling stock, until the OHLE has been de-energised, isolated and earthed.
QR document MD-11-30 (Rail Emergency Response Module EP1-01), required that a comprehensive review / debrief be undertaken after an emergency on QR’s network. This was to include all affected QR operational staff, with an invitation to attend extended to emergency services and a representative from the third party operator, in this case Aurizon. The purpose was to review the effectiveness and identify improvements in the emergency response and recovery process.
QR advised that it did not undertake a debrief after the Cooroy dewirement response. However, it noted that there were some informal discussions between network control personnel after the occurrence. In addition, QR advised that it typically did conduct debriefs for multi-agency emergencies, and provided examples of three other incidents in 2018-2019 where these occurred. It also advised that:
Post this incident occurring, Queensland Rail has re-enforced the importance of a conducting a formal debrief for incidents involving multi-agency emergencies.
Train details
Train details
Track manager:
Queensland Rail
Train operator:
Aurizon
Train number:
YC77
Type of operation:
Intermodal freight
Consist:
1 x 2800 class locomotive, 32 x flat wagons
Departure:
Acacia Ridge (Brisbane), Queensland
Destination:
Portsmith (Cairns), Queensland
Persons on board:
Crew – 1
Passengers – n/a
Injuries:
Crew – nil
Passengers – n/a
Damage:
Substantial damage to overhead line equipment, minor damage to rear end wall of top nested flat rack
Sources and submissions
Sources of information
The sources of information during the investigation included:
Aurizon (train operator)
Acacia Ridge Intermodal Terminal personnel
the driver of train YC77
Queensland Rail (QR) (infrastructure manager)
rail management centre personnel
the QR commander.
References
Dismukes RK & Berman BA 2010, Checklists and monitoring in the cockpit: why crucial defences sometimes fail, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2010-216396.
Dismukes RK, Berman BA & Loukopoulos LD 2007, The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Aldershot UK.
Hales BM & Pronovost PJ 2006, ‘The checklist – a tool for error management and performance improvement’, Journal of Critical Care, vol. 21, pp. 231–235.
Reason JT 1990, Human error, Cambridge University Press Cambridge, UK.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Queensland Rail, Aurizon, the driver of train YC77, Acacia Ridge Intermodal Terminal personnel, network control personnel, the QR commander and the Office of the National Rail Safety Regulator (ONRSR).
Submissions were received from Queensland Rail (primarily safety action), Aurizon (safety action only) and the terminal coordinator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Dangers associated with high voltage overhead line equipment (OHLE) in dewirements
Although voltage is required to force an electric current to flow in a circuit, electrical dangers to the human body are the result of an electric current passing through it, not the voltage. Voltages as little as 50 V AC are capable of overcoming the human body’s limited resistance to electric current, with severity of injuries increasing as voltage and thereby corresponding electric current increases.[46] Electrical safety guidance material states that a current of 2 Amperes is capable of stopping the heart and causing severe burns to internal organs.[47]
Under fault conditions (that is, a short circuit), current flow directly to rail or earth could reach thousands of Amperes due to a shortened pathway with less resistance than the normal electric circuit. A dewirement situation could result in such a short circuit where OHLE touched or came in close proximity to a train. This could allow current to flow directly through the metallic wagons or locomotive, into the rails. The greatly increased amperage would result in the circuit breaker for the electrical section tripping to protect OHLE from overheating or causing an electric shock. In this situation, the potential danger posed to personnel during fault conditions includes both touch and step potentials.
A touch potential occurs when a person is touching an object electrified under fault conditions and the earth. An example is holding the handrails on the egress ladder of a locomotive, with one or both feet on the ballast. As electric current will flow from a point of high voltage to low voltage, the voltage difference between the person’s hand (high voltage) and feet (low voltage) causes a large electric current to flow through their body to earth as part of the short circuit (Figure A1).
Figure A1: Touch and step potentials
Image shows both a step potential body current (left) and a touch potential body current (right), resulting from a fault condition.
Source: Voltage Lab
A step potential occurs when high voltage OHLE, or an item touching OHLE, is touching the ground, causing a current to flow through the ground to the rail or another return / earth path back to the substation. The ground voltage reduces as the distance increases from the point of contact the short circuit makes with the ground. This can cause a difference in voltage between a person’s feet standing nearby, where one foot is closer to the short circuit and thereby at higher ground voltage than the other foot. This may cause an electric current to flow from one foot through the body to the other foot (Figure A1).
Due to the high voltages of OHLE and resultant high electric currents, rubber-soled shoes may not provide protection for either touch or step potentials. All materials have a ‘breakdown voltage’, at which point a highly resistant material will lose its insulating abilities and become conductive. Similarly, high voltage OHLE can create an arc, where high voltage causes a breakdown of the air gap between an electric conductor and a conductive earthed component, allowing electricity to ‘jump’ across the air gap. The distance that electricity can arc across an air gap is dependent on a number of factors including voltage level, humidity and air pressure.
These dangers are well recognised, with rail infrastructure managers often investing in marketing campaigns to warn members of the public of the danger presented by high voltage OHLE. Figure A2 is one such example.
Figure A2: Queensland Rail’s ‘High Voltage Can Jump’ public awareness campaign
Image of Queensland Rail’s stand at the 2019 Brisbane Exhibition, highlighting the dangers of electrical arc from high voltage OHLE. The campaign was widespread throughout Brisbane, including significant display materials at Brisbane’s Central station.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
RO-2018-011
Occurrence date
18/08/2018
Location
Elm Street overbridge on southern approach to Cooroy yard, North Coast Line
