Safety summary

What happened

At 0152 on 7 March 2018, freight train 6792, operated by Aurizon, departed Cairns, Queensland, for a journey on Queensland Rail’s North Coast Line. A condition affecting the network (CAN) due to wet weather had been declared, and the train crew were required to operate at controlled speed for a significant part of the journey, which meant they were to be able to stop short of an obstruction within half the distance of clear line that was visible ahead.

At 0612, the train rounded the curve prior to the Little Banyan Creek rail bridge, which was under 0.6 m of flowing water. With a sighting distance of about 60 m to the bridge, the train’s speed (50 km/h) was significantly in excess of the controlled speed, and the train entered the floodwater. The train crew were not injured, but there was some damage to the train’s rolling stock, caused by immersion in water.

What the ATSB found

The Little Banyan Creek weather monitoring station’s water level sensor had been out of service for 57 days, and therefore no flood alarm was provided to network control and passed on to the train crew. Further, although there was a closed circuit television camera (CCTV) at the location to enable monitoring of water levels, the illuminator to enable effective operation at night had been out of service for 14 days. Queensland Rail (QR) also did not have an effective means of ensuring that, during situations such as a CAN, network control personnel were aware of the relevant weather monitoring systems that were unserviceable. In addition, QR did not have procedures that required network control personnel to actively search for information about track conditions ahead of a train during situations when conditions had the realistic potential to have deteriorated since the last patrol or train had run over the relevant sections.

The ATSB also found that QR did not have any restrictions on the distance or time that controlled speed could be used as a risk control for safe train operation in situations such as a CAN. The effectiveness of controlled speed has the significant potential to deteriorate over extended time periods due to its effect on driver workload, vigilance, fatigue and risk perception. In addition, Aurizon’s procedures and guidance for two-driver operation during situations such as a CAN did not facilitate the effective sharing of duties and teamwork to minimise the potential effects of degraded conditions on driver workload and fatigue.

What's been done as a result

Following the occurrence, QR improved its processes for ensuring the reliability of weather monitoring systems, and its procedures for ensuring network control personnel were aware of any faults. QR also developed new procedures and training for network control personnel for managing a CAN, including for proactively monitoring conditions on the network. In addition, QR is undertaking further work to guide the use and conditions around controlled speed and restricted speed, and Aurizon is undertaking further work to review its procedures for the management of workload in two-driver operations during a CAN.

Safety message

This occurrence highlights the importance of having serviceable weather monitoring stations at known flooding locations on a rail network, especially during the tropical wet season, and ensuring that if these systems are not functioning then all relevant parties are aware of the problem.

This occurrence also highlights the importance of effective communication between all relevant parties during a condition affecting the network. In particular, train controllers need to ensure that all relevant information associated with the conditions is passed on to train crews and track maintenance personnel so that they can effectively perform their roles.

The occurrence

Overview

At 0152^[1] on 7 March 2018, freight train 6792, operated by Aurizon, departed Cairns, Queensland, for a journey to Brisbane, Queensland.^[2] Heavy rain had fallen in some areas of North Queensland in the preceding hours (night of 6 March) and continued to fall during 7 March. At 0612, the train ran into floodwater over the Little Banyan Creek rail bridge, 134 track km south of Cairns. The train crew were not injured, but there was some damage to the train’s rolling stock, caused by immersion in water.

Events prior to train 6792’s departure

During 5–6 March, Queensland Rail’s (QR’s) North Coast Line was closed for a 36-hour period for planned track maintenance near Rockhampton in Central Queensland. In addition, during the first week of March 2018, a significant amount of rain fell in some areas of North Queensland.

On 6 March, the track maintenance supervisor (TMS, see Track inspection procedures) based at Innisfail conducted a patrol of the track between the Babinda to Cardwell section (Figure 1). The patrol started at 0655 and was completed at 1145. No areas of concern were identified.

Figure 1: Section of North Coast Line from Cairns to Cardwell

The image shows stations and their distance (in track km) from Roma Street Station in Brisbane.

Source: QR, modified by the ATSB.

During 6 March, the Townsville network control centre commenced preparations to run Aurizon freight train 6792 and Pacific National freight train 67P8 south from Cairns, with the first train expected to depart early on 7 March. These would be the first trains on the Babinda to Cardwell section since the 6 March track patrol.

A ‘condition affecting the network’ (CAN) associated with the wet weather was declared before trains 6792 and 67P8 departed. The regional transit manager (RTM) on duty at the network control centre on 6 March (up until 2030) directed that trains 6792 and 67P8 were to run at ‘controlled speed’, which meant they were to be able to stop short of an obstruction within half the distance of clear line that was visible ahead (see Controlled speed).

At 0050 on 7 March, the train crew (consisting of a driver at the controls and a second driver) of Aurizon train 6792 signed on for duty. At 0127, the driver phoned the network control officer (NCO) on the Townsville North control board. The NCO issued the crew with a written authority for rail traffic (form SW50), which directed them to operate their train at controlled speed between Gordonvale (1658.350 km)^[3] and Bilyana (1524.150 km) due to the weather conditions. The controller advised the driver that he did not think the conditions were ‘anything to be too concerned about’, but he requested that the train crew provide advice about the weather and track conditions while en route. The NCO advised that there was no opposing traffic and that train 67P8 would be following close behind them.

Cairns to Innisfail

At 0151, train 6792 left Cairns in heavy rain and at 0222 it passed through Gordonvale (1,658.350 km). At 0228, the driver reported very heavy rain at Aloomba (1,652.310 km), and the NCO reminded him to continue to report on the weather conditions as the train proceeded south.

At 0200, the driver of Pacific National train 67P8 contacted the NCO, and the NCO provided the train crew with a form SW50, which directed them to operate the train at controlled speed between Gordonvale and Bilyana due to the weather conditions. Train 67P8 departed Cairns at about 0220 and travelled about 30 minutes behind train 6792.

At 0308, the driver of the Aurizon train 6792 phoned the NCO^[4] and advised that the creek at Babinda (1,622.290 km) was about 1 m from the bottom of the bridge and flowing quickly. He also noted that on the previous day the water was 2 m below the bridge. The driver stated that the rain had eased off, but he was unsure of what was happening in the nearby hills, where water could flow down rapidly. Soon after (at 0314), the NCO advised the driver that he could see on closed-circuit television (CCTV) images from Babinda that the water was about 1 m below the rails.

During the phone call, the NCO also provided the 6792 train crew with a form SW50 for the Mamu Road level crossing (1,602.913 km), located between Waugh and Innisfail. The level crossing had been indicating active to road vehicle users all night, and the form SW 50 required the crew to ensure there was no road traffic prior to entering the crossing.

At about 0333, train 6792 passed through Waugh (1,608.130 km). Soon after, the driver and NCO discussed aspects of the shunting the train crew needed to do in Innisfail. The driver reported it was raining heavily at that time.

At 0345, the driver advised they had passed through the Mamu Road level crossing. He also advised that they had stopped at the Garradunga tramway because the signal was incorrectly indicating red. The second driver had inspected the site and could not rectify the problem.

At about 0400, train 6792 arrived at Innisfail (1,594.120 km) and the train crew commenced shunting operations for the next hour. The crew subsequently reported that it was raining heavily at Innisfail during this period.

At 0400 there was an NCO shift change on the Townsville North control board. The incoming NCO received a handover from the outgoing NCO and a briefing from the RTM (on duty since 2030), and he was advised that trains 6792 and 67P8 were required to be running at controlled speed.

The Innisfail track maintenance supervisor (TMS) contacted the NCO by phone at 0456 and they discussed the overnight weather conditions. The NCO advised that there had been a rainfall alarm at Babinda (north of Innisfail) at 2340, indicating more than 25 mm of rain had fallen in an hour. There had also been a flood alarm at Warrubullen Culvert (1,573.575 km, near Silkwood and about 20.5 km south of Innisfail), indicating that the water level had reached 1 m below the rails at 0311.

The NCO and TMS agreed that the TMS should conduct a patrol (See Track inspection procedures) of the 120 km of track between Babinda and Cardwell (south of Innisfail). The NCO advised the TMS of the current and expected rail traffic on the line. The TMS asked the NCO if the train crews had seen anything, and the NCO replied that they had not reported anything yet. The TMS advised the NCO that he would commence duty at 0600 and would arrive at Babinda at about 0630 to begin the patrol, following trains 6792 and 67P8 south. He noted that his patrol would therefore be conducted before QR’s Spirit of Queensland passenger train operated from Cairns to Townsville.

Innisfail to Little Banyan Creek

At 0504, train 6792 departed Innisfail. The driver and the NCO briefly discussed the weather conditions. The driver advised that it was still raining, and the NCO requested that the crew keep providing updates about the conditions.

Train 6792 passed through Boogan and Silkwood and, at about 0552, it passed through El Arish (1,561.48 km). At 0554 the driver phoned the NCO and advised that it was not raining at El Arish, but the water level was 2.5 feet (about 0.75 m) below the rail bridge over Whing Creek and 2 m below the rail bridge over Big Maria Creek (Figure 2). He noted that both creeks were flowing rapidly.

Figure 2: Route map showing features along the North Coast Line between El Arish and Old Tully Road (left) and Old Tully Road to Little Banyan Creek (right)

Note: the diagram is oriented so that the train’s direction of travel is upwards (south). Speed limits are shown in yellow circles; distances are shown in blue text.

Source: QR.

At 0610:09, the driver phoned the NCO and reported that all the culverts between Feluga and Birkalla (Figure 2) were full. He also reported that there was a culvert at the Birkalla tramway crossing where the water was about halfway up the ballast (see also Additional information related to wet weather operations). He advised the NCO to monitor that location because if the water got any higher it would start flowing through and start scouring out the ballast.

At 0611:18, the driver asked the NCO to stay on the phone so he could report on the water level in Little Banyan Creek (1,546.100 km). He also noted that it would be interesting to see the condition of Murray Flats (1,534.410 km), given the water level in the previous culverts.

At 0611:35, the train rounded the left curve on the approach to the rail bridge over Little Banyan Creek (Figure 3). The train’s speed was about 50 km/h, with the maximum permitted speed in normal conditions being 70 km/h. The driver saw floodwater covering the bridge and he immediately attempted to stop the train by applying the emergency brake. The train was unable to stop in the distance available, and it entered the water at 0611:50 (Figure 4).

Figure 3: Train 6792’s route on approach to the Little Banyan Creek rail bridge

Source: Google Maps, modified by ATSB.

The distance from brake application to the train stopping was 294 m. After it stopped, the train was on the bridge with the locomotive and first three container wagons partially submerged in about 0.6 m of water (Figure 5). Neither of the train crew were injured.

Figure 4: Train 6792’s locomotive passing over the flooded Little Banyan Creek rail bridge

Source: QR.

Figure 5: Empty container wagons behind train 6792’s locomotive, standing on the flooded Little Banyan Creek rail bridge

Source: QR.

Post-occurrence events

The driver of 6792 was still on the phone to the NCO as the train entered the floodwater and he immediately notified the NCO of the problem.

The train crew were unable to leave the locomotive due to the surrounding water, and they also believed it was unsafe for them to remain in that position. At 0615, after consulting with their supervisor and the NCO, the driver moved the train forward at low speed through the floodwater and into Tully yard.

After the NCO was notified of the collision with floodwater, the relevant section of track was closed and the following train (67P8) was held at Innisfail.

Train 6792’s crew were replaced by a relief crew. Following discussions between train crew and the rollingstock defect coordinator, the coordinator understood that the water ingress to wheel bearings was minimal. On this basis the relief train crew was authorised to continue to the nearest servicing depot at Townsville. At about 1730 on 7 March, the relief train crew restarted the train and continued south. After running 43 km, the locomotive failed and the train was unable to continue any further. Aurizon subsequently reported that, following a detailed inspection of the train, it identified water damage to the traction motors and all wagon wheel bearings that had been submerged in water.

__________

1. All time references in this report are in local time (Eastern Standard Time).
2. The train departed from the Portsmith railway yards, about 2.5 km south of Cairns, and the intended destination was the Acacia Ridge intermodal terminal, about 12 km south of Brisbane.
3. All distances are in km from Roma Street station in Brisbane.
4. Most of the communications between the driver and the NCO after the train departed Cairns were via train control radio. However, the driver initiated some communications by mobile phone.

Context

Train and train crew information

Train information

Aurizon train 6792 was an intermodal freight train, servicing customers between Cairns (Portsmith) and Brisbane (Acacia Ridge). On 7 March 2018, train 6792 departed Cairns with one diesel electric locomotive (number 2806) and 28 container wagons. During shunting at Innisfail, three wagons were detached and five other wagons were attached, which resulted in the train having 30 wagons and being 603.5 m long with a gross mass of 1.054 t. Many of the containers on the train were empty, but several were loaded with old road vehicle tyres, bananas and tea.

No problems were identified with the train’s braking performance or other relevant systems.

The train was fitted with a data logger and information from the data logger has been included in the report where relevant. All reported speeds have been rounded to the nearest 5 km/h.

Train crew roles and experience

Train 6792 was operated in the two-driver operation configuration, with a planned crew change in Townsville. In this configuration, two qualified locomotive drivers conducted a variety of duties up to a maximum shift length of 12 hours.

Aurizon’s General Operational Safety Manual stated that, when rail traffic was worked in the two-driver operation configuration, driver duties included:

Rail Traffic Driver at controls

• take charge of running of the rail traffic

Rail Traffic Driver not at controls to monitor

• other drivers performance
• signal aspects
• speed board changes
• level crossings
• other safeworking requirements

Note: By agreement with the rail traffic driver at the controls, the other rail traffic driver can take a short break when it is considered safe to do so and when not in or approaching a Safety Critical Zone.

Both drivers of train 6792 on 7 March 2018 were based in Townsville. They advised that they determined their division of duties before the train departed Cairns. Consistent with their normal practice, they intended to swap driving duties at Bilyana, about halfway between Cairns and Townsville. Up until then, one driver would conduct all train driving, safeworking and reporting duties (including all communications with NCOs).

Driver 1 conducted the driving duties up until the time of the occurrence. He confirmed that there were no requirements for drivers to share driving and related duties when operating a train during a condition affecting the network (CAN) or abnormal event, such as in wet weather conditions.

Driver 2 inspected the train prior to departing Cairns, inspected the signals at Garradunga tramway, and handled the shunting duties in Innisfail yard. During the shunting at Innisfail, heavy rain fell and his clothes were saturated. In the period between departing Innisfail and the occurrence, driver 2 put on dry clothes and dried out in the locomotive cab, and conducted monitoring duties.

Both drivers were qualified to work trains between Townsville and Cairns. Driver 1 had a substantial amount of train driving experience, having first qualified as a driver in 1995, and he had a substantial amount of experience on the North Coast Line. In the preceding 12 months, he had worked over the route 65 times. Driver 2 had worked the route 16 times in the preceding 12 months.

Train crew recent history

Over the 4 days prior to the occurrence, driver 1 had worked four duty periods, as shown in Table 1. He conducted no duty periods in the previous 4 days.

Table 1: Actual duty times for driver 1 over previous 5 days

Train 6792 normally departed during the day but, due to the backlog associated with the closure of the North Coast Line associated with planned maintenance, a non-standard start time was required. On 6 March driver 1 and driver 2 drove a road vehicle from Townsville to Cairns to position themselves to operate train 6792 back to Townsville. They signed off duty at 1150 and went to motel accommodation to rest.

Driver 1 reported he had some sleep in the afternoon and woke for dinner. He then returned to sleep for a couple of hours and was woken at midnight by a phone call from the train operator. He stated that at that time he was tired, as was normal for a duty time that commenced in the middle of the night. The driver’s planned and actual duty periods met the requirements of the operator’s fatigue management system.

Driver 2 worked the same duty periods as driver 1 on 6–7 March, and had the previous 2 days free of duty.

Rail line information

North Coast Line

Queensland Rail’s (QR’s) North Coast Line extends 339 km from Townsville to Cairns. Most of the line runs along the foot of the coastal ranges or crosses river flood plains, with major rail bridges over the Mulgrave, Russell, Johnstone, Tully, Murray and Herbert Rivers. In several sections, the route crosses hilly terrain where there can be landslips from cutting faces and fallen trees across the line after periods of wet weather. Some sections of the line have relatively poor alignment, with many tight curves, low bridges and level crossings.

Between Gordonvale and Bilyana, there were 10 sections, with a total distance of 134.2 km. Over the 10 sections, there were a significant number of sites that could be associated with potential hazards. These potential hazards included 83 bridges, 56 speed-restricted curves, 20 sugar cane tramway crossings and 79 level crossings (only 14 equipped with active level crossing protection).

There were usually 17 scheduled passenger and freight trains in each direction each week, operated by QR (5), Aurizon (6) and Pacific National (6). These included QR’s Spirit of Queensland passenger train, which ran between Cairns and Brisbane.

Little Banyan Creek

Banyan Creek is part of the Tully River catchment. It has a small catchment, bounded by the Walter Hill Range and Mount Mackay. The creek flows south along the foot of the range, and its major tributary, Little Banyan Creek, flows south-west to a point of confluence about 1 km north-east of Tully. Banyan Creek joins the Tully River downstream about 7 km further south.

QR’s North Coast Line crossed Little Banyan Creek at 1,546.100 km, about 80 m from the confluence with Banyan Creek. The timber trestle bridge was about 40 m long (Figure 6).

Figure 6: Little Banyan Creek rail bridge

Source: QR.

Approaching Little Banyan Creek and Tully yard from the north, the rail track curved to the left on a 502 m radius curve after the Vaughan Street level crossing and dropped down to the bridge (Figure 3). Trains were permitted to run at a maximum speed of 70 km/h around the left curve and over the bridge. At the southern side of the bridge, the maximum speed limit changed to 60 km/h.

Train crew visibility going around the left curve before the bridge was restricted by large trees beside the track, on the inside of the curve (Figure 3). This meant that a driver in a locomotive could not see the bridge until they were about 60 m away.

Calculations conducted by QR determined that, for a freight train similar to train 6792, a driver would have to be operating at a speed of 15 km/h in order to stop within 60 m.

Track inspection procedures

The QR Civil Engineering Track Standard (CETS), document MD-10-575, specified the safety standards and good practice guidelines for the construction and maintenance of track owned by QR.

The standard provided for the following types of track inspections:

• scheduled patrol
• scheduled general inspection
• scheduled detailed inspection
• unscheduled patrol
• unscheduled general Inspection
• unscheduled detailed Inspection.

Scheduled patrols were required to be conducted at a maximum interval of every 96 hours. Such patrols involved examining the track and related infrastructure. They were usually conducted by a single infrastructure worker driving an on-track (hi-rail) vehicle^[5] along the track, at a speed not exceeding 40 km/h. Scheduled general inspections (maximum interval 4 months) and detailed inspections (maximum interval 4 years) were more detailed in nature.

The CETS stated that unscheduled patrols, unscheduled inspections or operational restrictions had to be applied in response to various events. These included ‘heavy rainfall / inundation / floods / washaways / ingress of ground water’. The standard also required the rail infrastructure manager to prepare and maintain a hazard location register. The register needed to detail the hazards and the required actions (such as unscheduled patrols or inspections) at hazard locations where defined events might rapidly reduce the capability of the track to safely perform the required function. It stated such locations included track adjacent to an overbridge and track subject to flooding.

The hazard location register for the North Coast Line, from Cains to Cardwell, was last updated in August 2017. It listed 29 locations, with the associated condition or situation of 19 of these locations related to flooding. Some referred to specific locations (such as Banyan Creek) whereas some referred to a distance of up to 14 km of track. Most (14) of the locations were north of Banyan Creek and some (4) were south of Banyan Creek.

Table 2 shows the hazard location entries for Little Banyan Creek (1,546.100 km) and the area immediately north or south. Most of the other entries in the register associated with flooding were similar to the first row in the table.

Table 2: Selected hazard location register entries for locations near Little Banyan Creek

Source: QR, modified by the ATSB.

The track maintenance supervisor (TMS) based in Innisfail was responsible for the Babinda to Cardwell section of track. He reported that scheduled patrols were normally done twice a week, once in the northern direction and once in the southern direction. The TMS last conducted a patrol on 6 March (the day before the incident) in a southern direction, which was completed at 1145. After a discussion with the NCO at 0456 on 7 March, he planned to commence another patrol in the southern direction starting at Babinda at about 0630 that morning.

The TMS stated that he was not permitted to conduct patrols at night due to various safety concerns. He said that he had only conducted inspection activities at night in recent years in response to specific incidents at specific locations.

Areas prone to flooding

QR’s Townsville network control centre had developed flood hot spot maps for each of its lines. The map for the North Coast Line from Cairns to Townsville, dated 2010, showed 11 flood hot spots between Gordonvale and Bilyana. These included two spots pointing to the area between Tully (1,545.610 km) and Bilyana (1,524.150 km), with an associated table stating these spots included the areas from 1,531.000–1,548.000 km and 1,530.000–1,544.300 km. The location of QR’s weather monitoring stations was also marked. However, the labels for the flood hot spots and the weather monitoring stations did not include specific location names.

The TMS based at Innisfail had been working in that or similar roles for more than 10 years. He stated that the main areas prone to flooding of the track between Cairns and Bilyana included Harvey Creek (1,632.310 km), Codfish Creek (1,627.270 km), Babinda Creek (1,621.510 km) and the area between 1,530–1,550 km, which included crossings at Little Banyan Creek (1,546.100 km), Murray River (1,5434.410 km) and Corduroy Creek (1,530.290 km) (Figure 7).

The TMS also advised that Little Banyan Creek could get flooded due to localised rain. That is, on some occasions the creek would be flooded but Tully River and other nearby creeks and rivers the rail line traversed would not be flooded.

Previous occurrences of trains entering floodwater

QR reported that there had only been one previous occurrence during the period from January 2008 to March 2018 when a train had entered floodwater on the North Coast Line. That event occurred at Little Banyan Creek on 14 March 2008.

QR advised that it could not locate an investigation report for the March 2008 occurrence, and therefore the detailed circumstances associated with that occurrence were not able to be determined. The information available to QR indicated that crews of trains that passed over the Little Banyan Creek rail bridge provided reports of the water levels at 2245 on 13 March 2008 (1.5 m below the rails), 2315 (dropping since last report) and 0020 on 14 March 2008 (same as last report). However, at 0145 freight train 6C55 went through water that was about 1.2 m above the rails. A situation update at 0500 indicated that other creeks along the line were at least 1.9 m below the rails but Little Banyan Creek was still 1 m over the rails at 0630.

Meteorological and environmental information

General information

The North Coast Line between Cairns and Townsville experiences a wet season from about November to March each year. According to QR, during this period it was common for the network to be impacted by localised flooding in the numerous rivers and creeks over which the line crossed.

Tully is one of the wettest towns in Australia, with an average annual rainfall of 4,083 mm and an average March rainfall of 756 mm.

Forecasts and warnings

In the first week of March 2018, heavy rain fell in many areas of North Queensland. Rain forecast maps issued by the Bureau of Meteorology (BoM) on the morning 6 March 2018 indicated that the area between Cairns and Tully would receive up to 50 mm of rain on 6 March, up to 100 mm on 7 March and between 100–200 mm on 8 March.

BoM issued an initial flood watch at 1514 on 6 March 2018 for coastal catchments between Cooktown (north of Cairns) and Ingham (between Cardwell and Townsville). It stated:

• Areas of heavy rainfall were expected to develop across the flood watch area later on 7 March and continue into 8 March.
• Minor flood levels were likely across the flood watch area from late on 7 March.
• Heavy rainfall may lead to local flooding.
• Catchments likely to be affected included the Mulgrave, Russell, Johnstone, Tully, Murray and Herbert Rivers.

BoM issued an initial minor flood warning for the Tully and Murray rivers (Figure 7) at 0549 on 7 March. It stated that rainfall totals of 70–300 mm had been recorded across the Tully River catchment since 0900 on 6 March, with the bulk of the rain falling overnight, and further showers then rain were expected. For the Tully River, the warning stated:

River levels are rising in upper reaches of the Tully River.

The Tully River at Euramo is currently at 5.53 metres and rising. The Tully River at Euramo will exceed the minor flood level^[6] (6.00 m) Wednesday morning. Further rises are likely as heavy showers continue. Predictions will be updated as required.

For the Murray River (south of the Tully River), the warning stated:

River level rises are being recorded in the Murray River catchment.

River levels are expected to remain below minor flood levels at Murray Flats during Wednesday but with further heavy rainfall expected from Wednesday evening rises above the minor flood level are likely during [8 or 9 March].

QR advised that it received the publicly-available weather forecasts and warnings provided by BoM and had processes in place to assess them and their potential impact on its network. It did not have any arrangements in place for BoM to directly contact QR.

Figure 7: Position of rivers, creeks, and weather stations near Tully

Source: Google earth, annotated by ATSB

Rainfall observations

As indicated above, the initial flood watch stated that locations in the Tully River catchment recorded 70–300 mm of rain between 0900 6 March and 0500 on 7 March.

Table 3 shows daily rainfall figures for 6 and 7 March 2018 for the Tully Sugar Mill (1.35 km south-west of the Little Banyan Creek rail bridge) and some other locations close to the North Coast Line in the Tully River catchment (Euramo and Upper Murray) and north of the Tully River catchment (Mulgrave Hill, Deeral and Innisfail).

Table 3: Rainfall for selected locations 6–7 March 2018

Source: QR, modified by the ATSB.

Water level information

The closest locations to Little Banyan Creek with recorded water level data were:

• Euramo (near a road bridge crossing Tully River, 500 m south-east of the North Coast Line at 1,539.000 km). The water level reached 4.98 m at 0400 on 7 March and was increasing. It reached the minor flood level of 6.00 m at 0712 and the moderate flood level of 8.00 m at 2219. It subsequently reached 8.80 m at 0141 on 9 March, below the major flood level of 9.00 m.
• Murray Flats (near a road bridge crossing Murray River, 50 m from the rail bridge crossing Murray River at 1,534.410 km). The water level reached 5.05 m at 0400 on 7 March and was increasing. It reached the minor flood level of 7.00 m at 2226, the moderate flood level of 7.50 m at 0414 on 8 March, and the major flood level of 8.00 m at 1138.

Queensland Rail weather monitoring stations

General information

QR had weather monitoring stations at 10 locations between Gordonvale and Bilyana, including at Little Banyan Creek. The stations could provide various types of information to the Townsville network control centre, including air temperature, rail temperature, humidity, rainfall and water level. Some parameters were only available for some locations. If a specific value was exceeded, the station would transmit an alarm message.

The weather monitoring station at Little Banyan Creek provided information on air temperature, rail temperature, rainfall and water level.

In October 2017, QR commenced testing of weather monitoring stations on the North Coast Line prior to the wet season. Accordingly, a 6-month service of the Little Banyan Creek station was conducted on 31 October 2017, and the system was found to be fully operational.

Weather monitoring station sensors in North Queensland are exposed to extreme weather conditions and regularly experienced faults. Such faults were allocated a lower priority, relative to other types of equipment faults, as they were deemed to be ‘non-vital’ assets that did not directly impact on the movement of rail traffic. Vital systems, including level crossings and signalling systems, were recognised as essential to the movement of rail traffic and were generally accorded a higher priority.

The QR weather monitoring stations were independent of other weather monitoring stations, such as those used by BoM for rainfall at the Tully Sugar Mill and the water level at Euramo and Murray Flats (see Meteorological and environmental information).

Water level monitoring

Nine of the 10 QR weather monitoring stations between Gordonvale and Bilyana, including at Little Banyan Creek, had a water level sensor. These sensors were mounted on rail bridges and measured the vertical distance between the water and the top of the rails.

If the distance reached a certain level, the system would send a flood alarm message. The calibrated levels for a flood alarm were 1.0 m, 0.4 m and 0.1 m below the rails, at rail height, and 0.2 m, 0.5 m and 1.0 m above the rails. All flood alarm messages were sent to the relevant network control officer (NCO) workstation and the regional transit manager (RTM) workstation within the Townsville network control centre.

On 10 January 2018, while working on the Little Banyan Creek rail bridge, a QR maintenance gang damaged a cable running from the water level sensor. A technician attended the site and identified that repairs were required.

On 18 January 2018, a QR engineer, who was monitoring cameras at the site, noted the water level in Little Banyan Creek had risen to the top of the sleepers on the bridge, but the flood alarm had not activated. A new water level sensor was ordered, and a technician attended the site in mid-February to install it. However, the technician was unable to calibrate the sensor. At the time of the occurrence on 7 March 2018, the water level sensor had not been calibrated and it was still offline.

In addition to Little Banyan Creek, QR advised that the water level sensors at two other weather stations between Gordonvale and Bilyana had a ‘failed’ status during the period between 0000 and 0600 on the morning of 7 March. These were Swann Creek (1,656.500 km) and Murray River (1,534.410 km). The Murray River sensor, located close to the Murray Flats station used by BoM, had a failed status since 9 February.^[7]

QR advised that the only flood alarm message sent to the network control centre during the 12-hour period leading up to the occurrence was at 0311 on 7 March from the Warrubullen weather monitoring station (1,573.575 km), which stated that the water level was 1 m below rail height.

Total hourly rainfall monitoring

All 10 of the QR weather monitoring stations between Gordonvale and Bilyana, including at Little Banyan Creek, recorded rainfall. One of the two rainfall parameters that was monitored was total hourly rainfall, or the total amount of rain recorded over the previous 60 minutes (calculated every 5 minutes).

If the total hourly rainfall was over 25 mm the system would generate a warning alarm message, and if it was over 50 mm the system would generate a critical alarm message. Warning and critical alarm messages for total hourly rainfall were sent to the relevant NCO workstation and critical alarm messages were sent to the RTM workstation.

On 7 March 2018 at 0039, a warning message was recorded indicating that the total hourly rainfall at Little Banyan Creek was more than 25 mm (actual value 25 mm).^[8] QR advised that this should have generated a warning alarm message, however no message was sent. QR advised that following the occurrence it identified that the system as delivered by external developers had not been correctly configured, which meant that a higher amount of rainfall (in the order of 30 mm) was required before a warning message was sent from the device to the server. QR also advised that it had commenced an investigation of these types of issues prior to the occurrence.

The only total hourly rainfall alarm message received by the network control centre during the 12‑hour period leading up to the occurrence was at 2340 on 6 March from the Babinda weather monitoring station, which stated that the total hourly rainfall over the last hour was more than 25 mm (actual value 27 mm).

Derived rainfall rate of change monitoring

The other monitored rainfall parameter was derived rainfall rate of change, or the estimated rainfall per hour based on the amount of rain measured over a 5-minute period.

If the derived rainfall rate was over 25 mm/h, the system would generate a critical alarm message. These critical alarm messages for derived rainfall rate were sent to RTM workstation but not the relevant NCO workstation.

For Little Banyan Creek, critical alarm messages were recorded:

• 6 March at 1503
• 6 March at 2039
• 7 March at 0015.

All three messages stated that the derived rainfall rate changed to more than 25 mm/h (actual value 28 mm/h).

Closed-circuit television cameras

Some locations along the North Coast Line had a closed-circuit television (CCTV) system that provided images that were able to be viewed by the relevant NCO and the RTM. The systems included an illuminator, which allowed a camera to capture artificially-illuminated images during the hours of darkness.

Between Gordonvale and Bilyana, there were four CCTV systems, located at Swann Creek (1,656.500 km), Babinda (1,621.510 km), Little Banyan Creek (1,546.100 km) and Murray River (1,534.410 km). The CCTV at Little Banyan Creek was installed in September 2015.

The CCTV systems automatically generated a new still image every 2 hours. In addition, network control personnel could generate a new image manually at any other time.

On 22 February 2018, QR’s Townsville fault coordination centre received a notification that the camera illuminator at Little Banyan Creek had failed. In its failed state, the images taken by the camera at night were too dark for any detail to be discerned.

A technician was sent to Little Banyan Creek to repair the illuminator, but was not able to access the site due to inclement weather conditions. At the time of the occurrence on 7 March 2018, the camera illuminator had not been repaired.

Morning civil twilight^[9] on 7 March 2018 at Tully commenced at 0555. The presence of water over the bridge was discernible on the CCTV footage from about 0550.

Network control information

Townsville control centre

QR’s Townsville control centre consisted of seven control boards, one for each line. A separate network control officer (NCO) provided network control services at each board. An NCO was responsible for controlling rail traffic in accordance with safeworking procedures and conducting related duties.

A regional transit manager (RTM) supervised the overall operations of the NCOs on duty, as well as coordinated activities with external parties. A network support officer assisted the RTM.

The Townsville North control board was responsible for the North Coast Line from Purono (1,368.060 km) to Cairns (1,680.580 km). It was also responsible for the Tablelands Branch from Cairns to Croydon. The Townsville North control board’s workstation included several monitors for displaying safeworking (train progress) information. There was also a communications monitor and another monitor that was used for a range of other tasks, including ViziRail^[10] monitoring, GPS location assurance, weather monitoring, email monitoring, access to procedures and sourcing other operational information.

The RTM’s workstation also included a monitor that provided weather-related information.

A large monitor in the control centre displayed current weather radar information for the area from the BoM website.

Network control personnel information

The NCO who commenced duty on the Townsville North control board at 0400 on 7 March 2018 was qualified on five control boards, including the Townsville North board. He had about 3.5 years experience as a controller. He reported that he worked mainly as a relief controller, filling in for others as required, and therefore there could be extended periods where he did not work on the Townsville North control board. He stated that he did not have much experience with far north Queensland wet seasons, and was not aware that Little Banyan Creek was a known location prone to flooding.

During the NCO’s shift, the only traffic on the North Coast Line in the area he was responsible for were trains 6792 and 67P8. During the period after civil twilight (0555) he was dealing with some traffic on the Tablelands Branch, including processing a release for one train at 0600 and issuing a warrant for a track vehicle at 0610.

The RTM on duty in the Townsville control centre at the time of the occurrence was normally a network support officer, but acted in the role of an RTM about once per month. He had conducted RTM duties over a 7-year period, and had previously worked as an NCO in the centre for 15 years. He was aware that Little Banyan Creek was a known location prone to flooding.

The RTM signed on at 2100 and was due to sign off at 0630. He stated that the workload during this shift was higher than normal, due to the wet weather and the planned reopening of the North Coast Line after a significant period of closure due to planned maintenance, which affected the Townsville North control board and other control boards.

QR procedures and guidance for managing wet weather events

General rules and procedures

The QR standard MD-12-189 (Queensland Network Rules and Procedures), outlined the safety requirements for all persons who were required to access and perform activities in the network rail corridor managed by QR. The standard included rules and procedures for operating rail traffic in flood-affected areas (QR 3027). It stated that if an NCO was made aware of flood-affected track, the NCO must stop the rail traffic and arrange inspection by a maintenance representative.

QR 3027 also stated that, when ‘the track is affected by flooding’, a maintenance representative must arrange for track workers to monitor the height of any water and report damage to the NCO, tell the NCO about any rise or fall of the water level, check the condition of the track before any traffic travels through flood-affected areas, and advise the NCO of operating restrictions on affected track. The standard noted that the height of water could be checked using automatic weather stations (where fitted).

MD-12-189 also included rules and procedures for reporting and responding to a condition affecting the network (QR 2009). It stated:

Conditions that can or do affect the safety of operations in the Network must be reported promptly to the Network Control Officer responsible for the affected portions of line…

If necessary, the Competent Worker reporting the Condition Affecting the Network must:

• prevent rail traffic from approaching the affected portions of line, and
• apply protection for rail traffic or a line in an emergency.

If there is any doubt about the safety of rail traffic, any fault must be treated as an emergency and workers must:

• tell the Network Control Officer…

The QR standard MD-10-107 (General Operational Safety Manual) outlined the instructions and procedures for rail traffic movements and other matters. With regard to adverse conditions, it stated:

Where it is required to operate rail traffic in adverse conditions such as:

• heavy rain,
• high wind, or
• reduced visibility…

and these conditions affect or have the potential to affect the safe operation of rail traffic and people on the network, the rail traffic crew will operate their rail traffic to suit the current conditions and advise Network Control of the conditions

Network Control should consult with rail traffic crew, Track Maintenance Supervisors and any other resources available and determine other factors which may impact on the running of rail traffic.

Where information is available to Network Control that relates to the condition of the network, the Network Control Officer will advise if it is unsafe for rail traffic to travel.

The Network Control Officer will impose such special conditions as may apply when rail traffic travel under adverse conditions and these include but are not limited to:

• continual monitoring
• restricted speed
• increased exchange of information to ensure safety
• updates on changes in weather conditions

Local guidance information

Supplementary to the QR rules and procedures, the Townsville Regional Safety Committee published a set of ‘wet weather protocols’ in December 2011 for use by NCOs in the Townsville control centre. These protocols, which were not a formal part of QR’s safety management system, included the following guidance:

• We will stop trains when conditions are uncertain, or until track inspection verifies safe for traffic. For example…

- Weather monitors alert to a problem

- Water is in the ballast

- Visibility is poor

- There is a report from the last train over the section that indicates a problem…

• We recognise the importance of sharing information and will focus on the quality of our conversations by:-

- Provide weather report advice to train drivers at the start of their shift when needed.

- Observe and report on conditions that could stop traffic when travelling across the corridor. For example water levels rising, water entering the ballast and or sever localised storms.

- Sharing information from Train Control on weather conditions to trains in transit where applicable…

Safety alerts

In December 2015, an Aurizon freight train derailed near Julia Creek on QR’s Mount Isa Line, following a flooding event that scoured the ballast and formation of the track. The ATSB investigation^[11] identified the following safety issues associated with QR’s procedures:

• The Queensland Rail General Operational Safety Manual (MD-10-107) contained insufficient guidance for rail traffic crews to ensure the timely identification and management of a potential hazard (resulting from a weather event) that might affect the safe progress of the train. [RO-2015-028-SI-01]
• The Queensland Rail network rules, procedures and safety manual [MD-12-189] provided insufficient guidance to identify the magnitude of the potential hazard from a weather event, or define the response when encountering water that had previously overtopped the track and receded or was pooled against the track formation or ballast. [RO-2015-028-SI-02]

In January 2016, following the December 2015 derailment, QR issued critical safety alerts to rail traffic crew and network control officers. QR advised the ATSB that the safety alerts were to be trialled over the 2016–2017 wet season and then incorporated into relevant manuals. A subsequent version of the critical safety alert for NCOs was issued in November 2016 and reissued in November 2017.

The 2016/2017 critical safety alert stated:

If Train Traffic Crew observe flood water (or evidence of recent flood water such as debris on the track) in the ballast (above the formation) they must immediately stop the rail traffic (in a controlled manner) and report to the NCO. The rail traffic must not proceed until authorised (verbally) by the NCO. The NCO must consult with relevant infrastructure personnel prior to providing this authorisation.

• Note: This rule does not apply to puddles, drainage water or small volumes of water that would not impact on the structural integrity of the track.

NCOs may become aware of a wet weather related conditions that affect or potentially affect the network by:

• Reports from the field of

- unusually heavy rain;

- water pooling against the formation or on land adjacent to the railway;

- a washout or scouring of ballast or the formation;

- poor visibility;

- high or rising levels in creeks or waterways.

• Failure of Track Circuits;
• Remote monitoring station data
• Meteorological forecasts, observations, warnings and alerts.

NCOs must seek further information from personnel in the field and from Infrastructure personnel if they are unclear on the condition of the network.

NCOs must stop rail traffic if they become aware of a condition that affects or potentially affects the network. The Network should then be inspected…

Network control personnel were required to sign a document to acknowledge they had received and read the alert in November 2017. The NCO and the RTM on duty at the time of the 7 March 2018 occurrence had both signed the document. Both of them recalled in interview that their understanding of the relevant wet weather procedures was that if water was observed to be in the ballast a train should be stopped.

Specific procedures for conditions affecting a network

On 16 January 2018, QR issued version 1.0 of the procedure MD-18-20 (Supply Chain North – Condition Affecting the Network (CAN) Management). The document stated:

This Procedure is intended to provide strategic guidance for Supply Chain North around management of Conditions Affecting the Network (CAN).

The Procedure draws together information from a number of related standards and instructions that guide the Regional Transit Manager (RTM), Network Control Officer (NCO) and/or Asset Maintenance personnel in decision making on receiving reports of “condition affecting the network”. This procedure does not replace or contradict related standards; instead it aims to provide a link between each requirement by guiding the actions of the leaders…

This procedure outlines how the Townsville Control Centre will identify and manage CAN’s, nominating the functional roles, escalation steps, and integration requirements with other groups of the business and supporting agencies…

In terms of defining a CAN, the document stated:

A CAN is a situation or condition that affects, or has potential to affect, the safety of the Network... Activities directly associated with a CAN included in this document, but not limited to:

Track Defect (Rough track-Buckle-Broken Rail- and other Track defects that affect the Network)

Extreme Weather (Heat-Wind-Floods-Earthquake’s and other Extreme Weather Conditions that affects the Network)

Wildfires

In terms of assessing a CAN, MD-18-189 stated that the RTM and NCO were to utilise the resources from various websites (such as BoM and emergency services sites) and information from the field (via train crews, maintenance personnel, members of the public and other sources).

The procedure provided guidance on how to manage various types of conditions. The guidance related to water-related conditions is outlined in Table 4.

Table 4: Procedures for addressing water-related conditions affecting a network

Network control personnel reported the specific CAN procedure (MD-18-20) had been sent to them by email, but there had been no specific training in relation to the document.

Use of weather monitoring station and CCTV information

As noted in Queensland Rail weather monitoring stations, the weather monitoring stations were configured to send different types of alarm messages to the NCO’s workstation and the RTM’s workstation, depending on the parameter. More specifically:

• The NCO’s workstation would receive flood alarms and total hourly rainfall warning alarms (more than 25 mm) and critical alarms (more than 50 mm).
• The RTM’s workstation would receive flood alarms, total hourly rainfall critical alarms (50 mm) and derived rainfall rate critical alarms (25 mm/h).

All alarm messages were required to be acknowledged by the NCO and/or RTM.

If a weather monitoring station sensor failed, the system would send an alarm message to the RTM’s workstation, which was also required to be acknowledged.

In addition to receiving alarms, data from the weather monitoring station (such as rainfall and water level under the rail) could be viewed at the RTM’s workstation (if the relevant sensor was online). To view the data, the user had to log into a software program on a computer at their workstation. They could also view weather information via the internet on the BoM website on the same computer.

To view the CCTV images from a location, the NCO or RTM had to open a software program on a computer at their workstation and select the desired location. It the program was left open, the site would generate a new image every 2 hours. If the user refreshed the location, a new image would be displayed, but network control personnel advised it would generally take several minutes to load a new image.

Recorded data indicated that a user had refreshed the Little Banyan Creek CCTV image on the following seven occasions:

• 6 March at 2051 (12 minutes after a derived rainfall rate alarm)
• 6 March at 2139
• 6 March at 2356
• 7 March at 0023 (8 minutes after a derived rainfall rate alarm)
• 7 March at 0033
• 7 March at 0114
• 7 March at 0328 (14 minutes after the NCO had viewed the Babinda Creek CCTV).

Network control personnel reported that in general they would not routinely search for weather information or CCTV information for specific locations unless they had previous advice of problems at those locations. They would typically rely on advice from a track maintenance supervisor (TMS), train crew reports, reports from the public and weather monitoring station alarms to provide information about the extent that weather conditions were affecting the network. They also advised that there were no procedures that required them to proactively monitor weather information or CCTV information ahead of a train’s progress during a CAN event.

Awareness of the status of weather monitoring stations and CCTV systems

The Townsville North NCO and the RTM on duty at the time of the occurrence both reported that they were not aware that the water level sensor at Little Banyan Creek was unserviceable at the time of the occurrence. Both of them assumed that, if the water level rose above the threshold level at that location, they would have received a flood alarm message. In addition, both the NCO and the RTM (and other network control personnel) stated they were unaware that the CCTV illuminator at Little Banyan Creek was unserviceable.

Network control personnel stated that there was no formal process in place to ensure that all RTMs and NCOs were aware that weather monitoring equipment or CCTV equipment at specific locations was unserviceable. The handover documentation for both the NCO and the RTM on duty at the time of the occurrence provided no indication to them that either the water level sensor or CCTV illuminator at Little Banyan Creek were unserviceable. Similarly, there were no other formal notices provided to network control personnel advising them of this information.

The TMS based at Innisfail reported that he also was not aware that the water level sensor at Little Banyan Creek and Murray Creek were unserviceable, and he would not normally be provided with such information. QR confirmed that TMSs were not necessarily advised when water level sensors were faulty or offline. If a fault notification was received and a request for repair work issued, then telecommunications personnel rather than the local TMS would receive the work order.

Train operations information

Aurizon procedures and guidance for managing wet weather operations

On 6 January 2016, following the December 2015 derailment near Julia Creek, Aurizon issued a critical safety alert to its train crew. Similar to the QR safety alert, it stated:

Train Traffic Crew must immediately STOP and report to the Network Control Officer:

• water on the formation and near the ballast
• any potential track or formation deficiencies
• if the track formation and / or supporting ballast cannot be seen
• any signs of washouts or scouring on the side of the ballast or formation…

The safety alert included the following diagram to clarify the difference between the ballast and formation.

Figure 8: Except from Aurizon safety alert showing difference between ballast and formation

Source: Aurizon.

On 21 November 2017, Aurizon issued a safety, health and environment guide titled Operation of rail traffic in adverse weather conditions. Its purpose was to provide guidance to train crews operating in severe weather conditions. With regard to wet weather operations, the guide stated:

When it is necessary to operate rail traffic during fog, heavy rain, unexpected storms and similar circumstances where there is reduced visibility, RTC [rail traffic crew] are to take appropriate steps to protect their safety, the safety of the rail traffic and the track infrastructure by driving to the conditions. RTC should assess the situation and regulate the speed of the rail traffic in accordance with the conditions, and advise the NCO and LRC of their intended action, i.e. they are proceeding at reduced speed because of low visibility.

If operation of rail traffic in heavy rain is required, the Rail Infrastructure Manager (RIM) will normally monitor any flood indicator alarms and/or water levels and to take whatever action is necessary to ensure safe rail traffic operations (e.g. speed restrictions, track closures etc.). RTC operating rail traffic on the affected line(s) are to adhere to any instructions received and take whatever other action is necessary to ensure their own safety and the safety of the rail traffic they are operating.

Occasionally, RTC will encounter storms, flash flooding or similar events where advice is not received from the RIM. In these situations, RTC are to observe any water adjacent to the rail infrastructure. Where the water level is such that the sleepers and the supporting ballast is not visible, or there is signs of washouts or scouring on the side of the ballast and/or in the formation (Refer Figure 1, 2 & 3) the RTC is required to stop the rail traffic and advise the NCO and LRC [live run coordinator].

Additional information related to wet weather operations

Driver 1 of train 6792 recalled that the Aurizon safety alert stated that a train could not proceed if water was observed to be in the ballast. As noted in The occurrence, driver 1 advised the NCO that the water in a culvert at the Birkalla tramway crossing was halfway up the ballast. He subsequently reported during interview that the water at Birkalla was level with the bottom of the ballast (and not in the ballast), and that he exaggerated the level of the water in his phone call to the NCO at 0611 to ensure the NCO took notice. He could see that the track was intact and there had been no scouring of the ballast, and he believed the conditions were safe for his train to proceed. However, he was concerned that the conditions would deteriorate prior to the arrival of the following train at this location.

Driver 1 stated that he was aware of the potential flood hazards along the North Coast Line, and that Little Banyan Creek was one of the most likely locations for flooding. However, in the period leading up to the occurrence, he was not concerned about that location as he was aware that it had a flood alarm and a CCTV system that were monitored by network control, and he believed that if there was a problem the NCO would have advised him about it.

Driver 1 reported that the two drivers discussed the potential hazards they could encounter during their journey that day. He also said they were more concerned about other potential flooding locations that were not actively monitored. In particular, they were concerned about Murray Flats (1,534.41 km), located to the south of Tully. Although there was a weather monitoring station at the river crossing, the land for about 2 km to the south of that was also prone to flooding.

Driver 2 stated he was aware that QR had systems in place to monitor water levels at certain bridges, and would advise them if these bridges were affected by water.

Procedures for communicating with network control

The QR standard MD-12-189 (Queensland Network Rules and Procedures) included requirements for communications between rail traffic crew and network control personnel. The document MD‑14‑36 (General Appendix) supplemented the MD-12-89 standard, and outlined operational instructions that applied on the QR network.

The general appendix stated that mobile phones were prohibited within rail traffic crew compartments while undertaking rail traffic crew duties. The only permitted exceptions involved the failure of the train control radio, situations where no other means of communication was available (and the train was stationary) or to allow emergency contact/fault reporting (but only to be answered by a co-driver not involved in safety critical duties).

Aurizon confirmed that, when its personnel were conducting operations on the QR network, they were required to comply with QR’s network rules and procedures.

Aurizon also had an enterprise-wide guidance document on the use of mobile phones. Its general requirements included:

Aurizon workers shall not use a mobile phone / other electronic device if that use would interfere with their safety or the safety of others…

The use of personal electronic devices is prohibited while any safety-related duty is being performed, unless in case of an emergency or exceptional circumstances.

In a section covering the operation of locomotives and safety critical tasks, it stated:

Radios are permitted for use in accordance with radio protocols. If a mobile phone is required to be used in lieu of the radio then applicable radio protocols must be complied with.

Other drivers, workers and passengers traveling spare may use a mobile phone / other electronic devices if it does not interfere with any safety-related duties or distract the driver.

As noted in The occurrence, the driver of train 6792 used a mobile phone to initiate some of the communications with network control personnel. The driver reported that when he was using his mobile phone he used it in hands-free mode.

Communications involving train 67P8

Pacific National train 67P8 was operating about 30 minutes behind train 6792. All recorded communications between the train crew of 67P8 and the NCOs were conducted via train control radio.

The Townsville North control board NCOs did not ask the 67P8 train crew to provide any information about weather conditions en route. At 0345, the NCO on duty at the time checked that the train crew of 67P8 was aware of the signal problem at the Garradunga tramway reported by the 6792 driver (which the driver had broadcast on train control radio). However, the NCOs did not ensure that any of the information provided by the driver of 6792 about weather and track conditions was passed on to the crew of 67P8.

Controlled speed

Operational speed restrictions

QR was the owner and manager of most of the rail network in Queensland. The QR standard MD‑10-107 (General Operational Safety Manual) included two operational speed restrictions that could be used to manage risk in particular circumstances in its network. These were:

• controlled speed – a speed that allows rail traffic to stop short of an obstruction within half the distance of clear line that is visible ahead
• restricted speed – a speed that allows rail traffic to stop short of an obstruction within half the distance of clear line that is visible ahead, but limited to a maximum speed of 25 km/h.

QR did not include any limits or guidance on the duration or distance that a train crew may be required to operate at controlled speed.

In Australia, the Rail Industry Safety and Standards Board (RISSB) and Arc Infrastructure (the owner and manager of the rail network in Western Australia) used similar definitions as QR. They also did not specify any limits on the duration or distance that may be travelled at controlled speed.

For operations in New South Wales, the Australian Rail Track Corporation (ARTC) defined ‘restricted speed’ as a ‘speed that allowed rail traffic to stop short of an obstruction within the distance of clear line that is visible ahead’. The definition did not include a maximum operating speed. Therefore, the ARTC definition of ‘restricted speed’ was similar to the QR definition of ‘controlled speed’, although it referred to the distance of line of sight rather than half the distance of line of sight.

In December 2010, a Pacific National grain train collided with the rear of another grain train at Yass Junction, New South Wales. The ATSB investigation^[12] into the occurrence identified the following safety issue:

• The current ARTC definition of restricted speed requires considerable judgement on the part of train drivers. [RO-2010-013-SI-01]

The ATSB report also stated that, when using restricted speed:

Drivers must use their experience to judge a range of factors, in particular the sighting distance and train braking characteristics in the prevailing conditions. That judgement may also vary significantly between different drivers depending on the level of risk perceived and accepted by that driver. While the definition of restricted speed may be a ‘clear and concise instruction’ its application is not precise and it is something that cannot be measured unless an incident, such as a collision, occurs.

Application of controlled speed on 7 March 2018

Network control had issued the requirement for the train crews of 6792 and 67P8 to operate at controlled speed from Gordonvale to Bilyana. These sections included 134.2 km of track, and the normal sectional running time over these sections (including temporary speed restrictions) was 162 minutes.^[13]

As previously discussed (The occurrence), recorded data from train 6792’s data logger showed that the train was travelling at about 50 km/h rounding the left curve prior to the Little Banyan Creek rail bridge. The maximum permitted speed around the curve was 70 km/h in normal conditions, decreasing to 60 km/h at the southern side of the bridge. Therefore, the train was travelling about 10 km/h below the upcoming maximum speed limit.

Driver 1 advised that he was fully aware of the meaning of ‘controlled speed’. He said that network control had issued him with requirements to operate at controlled speed on previous occasions, but he had not previously encountered a situation where he had driven into water or had water over the track. He thought that he was operating the train at about 40 km/h when it rounded the left curve (rather than the recorded 50 km/h). He realised that, in hindsight, he should have been travelling slower to fully comply with the controlled speed restriction. However, he did not expect there would be a hazard at Little Banyan Creek because of the monitoring systems that he thought were in place and working (see Additional information related to wet weather operations).

The ATSB reviewed the train’s recorded speed in earlier parts of the journey on 7 March 2018 and compared it with sectional running times published by QR, including adjustments for temporary speed restrictions. The key results were:

• Between Gordonvale and Waugh (50.2 km),^[14] the adjusted sectional running time was 58 minutes and train 6792’s running time was about 71 minutes. The train’s average speed (42 km/h) was 18 per cent less than the average adjusted sectional running time speed (52 km/h). There were 38 bridges, 27 speed-restricted corners and numerous other potential hazards in these sections.
• Between Innisfail and Little Banyan Creek (48.0 km),^[15] the adjusted sectional running time was 63 minutes and train 9762’s running time was about 68 minutes. The train’s average speed (42 km/h) was 7 per cent less than the adjusted sectional running time speed (46 km/h). There were 20 bridges, 15 speed-restricted corners and numerous other potential hazards in these sections.

In terms of other locations that had a curved track prior to a bridge, similar to Little Banyan Creek:

• At Harvey Creek (1,632.654 km), the maximum permitted speed in normal conditions was 40 km/h, the train was travelling at about 35 km/h, and there was probably a similar sighting distance of the bridge due to vegetation as at Little Banyan Creek (that is, about 60 m).
• At Frenchman Creek (1,626.218 km), the maximum permitted speed in normal conditions was 40 km/h, the train was travelling at about 30 km/h, and the sighting distance was more than at Little Banyan Creek.

In both cases, the train would not have been able to stop within half the distance of the line of sight, but at Frenchman Creek the train may have been able to stop prior to reaching the bridge. Both locations had a weather monitoring station with a water level sensor.

The ATSB also reviewed the train’s recorded speed at a sample of other locations. The speeds ranged from close to the maximum permitted speed to speeds significantly below (by more than 20 km/h) the maximum permitted speed. Locations where the speed was significantly below the maximum permitted speed were on both sides of Innisfail, including Whing Creek, about 15 km north of Little Banyan Creek.

In its investigation report into this occurrence, Aurizon noted that the requirement to operate at controlled speed from Gordonvale to Bilyana (134.2 km of track) was excessive for driver concentration.

Network control information indicated that train 67P8, following about 30 minutes behind train 6792, was operated at a similar speed to train 6792 between Gordonvale and Waugh.

Implementation of controlled speed on other occasions

QR provided the ATSB with four other recent examples of the application of controlled speed by the Townsville network control centre. These included:

• 29 January 2019, between Orkabie and Dawlish (distance 60.0 km) on the North Coast Line for 19.4 hours. The restriction was prompted by a flood alarm that indicated water was 1 m below the rail level at Ilbilbie. Significant rain fell on the Central Queensland coast during 28–30 January 2019 and the TMS in Mackay expressed concern about the water level in culverts at Dawlish. The restriction was applied to five sections of track, which included 24 rail bridges and a number of other sites with potential hazards.
• 3 February 2019, between Ilbilbie and Koumala (distance 15.9 km) on the North Coast Line for 21.3 hours. A weather monitoring station between Ilbilbie and Koumala was reported to be defective and QR maintenance staff were unable to access the site to make repairs. The restriction was applied to a single section of track with a specific location of concern.
• 16 February 2019, between Jericho and Longreach (distance 193.6 km) on the Central Western Line for 3.5 hours. A report of heavy rainfall and rising water levels in culverts between Alice and Lochnagar prompted network control to apply controlled speed. The restriction was applied to 10 sections of track. Only one train was affected (the westbound Spirit of the Outback passenger service). The train took 3.4 hours to run from Lochnagar to Longreach, but the controlled speed restriction was cancelled at 1808 after it had run under those conditions for 1.5 hours at an average speed of about 50 km/h.
• 29 March 2019, between Pombel and Ingham (distance 13.1 km) on the North Coast Line for 1.1 hours. Water was reported to be about 0.3 m below the Cattle Creek rail bridge. The restriction was applied to a single section of track with a specific location of concern. The controlled speed restriction was applied until it was confirmed that the water level was dropping, and only one train was affected.

Use of restricted speed in the United States

In the United States, the General Code of Operating Rules (GCOR) were common to most railroads in North America. The GCOR stated:

6.27 Movement at Restricted Speed

When required to move at restricted speed, movement must be made at a speed that allows stopping within half the range of vision short of:

• Train.
• Engine.
• Railroad car.
• Men or equipment fouling the track.
• Stop signal.

or

• Derail or switch lined improperly.

When a train or engine is required to move at restricted speed, the crew must keep a lookout for broken rail and not exceed 20 MPH [32 km/h]…

6.28 Movement on Other than Main Track

Except when moving on a main track or on a track where a block system is in effect, trains or engines move at a speed that allows them to stop within half the range of vision short of:

• Train.
• Engine.
• Railroad car.
• Men or equipment fouling the track.
• Stop signal.

or

• Derail or switch lined improperly…

In other words, the GCOR definition of ‘restricted speed’ was similar to the QR definition, but more explicit about the types of obstructions that were applicable. The equivalent of controlled speed was only applicable off a main track, where only short times or distances would be encountered.^[16]

Based on a review of five accidents in 2011, the United States National Transportation Safety Board (NTSB) expressed concern that driver compliance with restricted speed requirements ‘may be an issue affecting a broad segment of the U.S. railroad industry’.^[17] The NTSB noted that ideally other mitigators would be in place to prevent collisions, but at times it was necessary for two trains occupy the same section of track and therefore collision avoidance relied on driver compliance with restricted speed requirements. It also noted that collisions in the 20 mph range could have catastrophic consequences, particularly if they involve freight trains carrying hazardous materials.

The NTSB stated that restricted speed was not a numerical value, and that to ensure safe operation of following trains the performance portion of the rule (that is, stopping within half the distance of line of sight) needed to be stressed rather than any maximum speed. Based on its review of the five accidents in 2011, the NTSB issued the following recommendation to the Association of American Railroads, the Brotherhood of Locomotive Engineers and Trainmen and the United Transportation Union:

Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, use the occurrences of five recent rear-end collisions of freight trains—(1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011—to urge your members to undertake a review of their operations to identify the potential for similar occurrences and to take appropriate mitigating actions.

Some research has indicated that restricted speed compliance is the most common operational rule compliance problem in the US (Cohen, 1999). Recent research into US railroad accidents identified that the rate of accidents associated with the appropriate application of restricted speed remained constant during the period 2000–2016 (Zhang and Liu, 2019). In comparison, the rate of some other accident types, and the overall accident rate, decreased.

There is limited published research about the reasons for non-compliance with restricted speed requirements. In some cases trains exceeded the 20 mph limit, and some of these exceedances have been associated with factors such as fatigue and distraction. There has also been some indications that compliance with the sighting distance aspect is more problematic for a driver than the maximum limit of 20 mph, and that a low level of expectancy of particular types of hazards can be problematic (Cohen, 1999).

__________

5. Light vehicle capable of operating on rail tracks and the road network.
6. BoM’s description of minor flooding included ‘Causes inconvenience. Low-lying areas next to watercourses are inundated. Minor roads may be closed and low-level bridges submerged...’
7. In addition, the weather monitoring stations at two other locations were temporarily offline (for all parameters) during 7 March, including Harvey Creek (1,632.310 km) during 0108–0245 and 0545–0612 and Corduroy Creek (1,530.290 km) during 0246–0740.
8. The same message was also recorded on 6 March 2018 at 0358.
9. There are three phases of twilight: civil, nautical and astronomical. The sun is below the horizon in each phase, but in civil twilight there is sufficient natural light to carry out most outdoor activities.
10. Train scheduling, monitoring and reporting software module.
11. ATSB Transport Safety Report, Rail Occurrence Investigation RO-2015-028, Derailment of freight train 9T92, near Julia Creek, Queensland, 27 December 2015. Report issued 9 December 2016. Available at www.atsb.gov.au.
12. ATSB Transport Safety Report, Rail Occurrence Investigation RO-2010-013, Collision between grain trains 3234N and 8922N at Yass Junction, New South Wales, 9 December 2010. Available at www.atsb.gov.au.
13. QR published sectional running times for some types of trains to enable rail operators to plan their activities. It also published advice about additional time required for any temporary speed restrictions. Published running times did not include any allowance for starting or stopping, or associated with other traffic.
14. The train stopped several minutes after passing Waugh to allow the crew to inspect the Garradunga tramway crossing, so the time between Waugh and Innisfail did not provide a reliable indication of the train’s operating speed in that section.
15. The adjusted section running time between Innisfail and Tully was 64 minutes, and 1 minute was deleted for the 600 m between Little Banyan Creek and Tully.
16. CSX Transportation differed from other American rail operators in its requirement that a train should not exceed 15 mph under restricted speed. It also included a controlled speed restriction, defined as ‘A speed that will permit stopping within one-half the range of vision’.
17. NTSB Accident Report NTSB/RAR-12/2, Collision of BNSF Coal Train With the Rear End of Standing BNSF Maintenance-of-Way Equipment Train, Red Oak, Iowa, April 17, 2011. (Available at www.ntsb.gov.)

Safety analysis

Introduction

At 0612 on 7 March 2018, the Little Banyan Creek rail bridge was under 0.6 m of flowing water. The train crew of Aurizon freight train 6792 were unaware of the problem and, after their train rounded the left curve on approach to the bridge, they were unable to prevent the train colliding with the floodwater. The train did not derail and there were no injuries. However, the consequences had the realistic potential to be much worse.

This analysis will first consider the reasons why none of the relevant parties were aware that the bridge was under water before the train arrived. The use of unscheduled patrols, weather monitoring stations, active monitoring of conditions ahead of a train and communication between relevant parties are discussed. The analysis will then discuss potential reasons associated with why the train was travelling in excess of ‘controlled speed’ on approach to the bridge, and the driver therefore did not have sufficient time to stop prior to the collision.

Use of patrols or inspections

The last patrol of the track from Babinda to Cardwell was conducted on the morning of 6 March, and no trains subsequently used those sections because the line was closed for planned maintenance further south. After the declaration of a condition affecting the network (CAN) due to wet weather, another patrol would ideally have been conducted ahead of the two freight trains (6792 and 67P8) that were planned to depart Cairns early on 7 March.

However, there was no specific requirement to conduct a patrol or inspection, with any decision to be made based on an interpretation of whether specified conditions had been met. Queensland Rail’s (QR’s) CAN procedures stated that an inspection was required if there were ‘reports of unusually heavy rain or water pooling against formation’, ‘high or rising levels in creeks or waterways’, or relevant advice from meteorological warnings, weather monitoring stations or the public about wet weather conditions. Similarly, the hazard location register stated a patrol or inspection was required for particular locations along QR’s North Coast Line ‘after heavy rain’ and at one location (Tully River and Murray Flats) if floodwater had reached a specified level.

In this case, the Bureau of Meteorology (BoM) had issued an initial flood watch for the general area on the afternoon of 6 March, indicating local flooding from late on 7 March. Although rain had fallen in the area overnight, prior to train 6792 departing Cairns, there had been no flood alarms or reports of any water-related problems with the track. The water levels at Tully River and Murray Flats were also well below the levels of concern. However, given the flood watch, the conditions had the potential to deteriorate over the coming days.

If a patrol had been conducted prior to train 6792 departing, it could have only commenced at about 0600 (during daylight), using a hi-rail vehicle with a maximum speed of 40 km/h. This would have further delayed the train by about 6 hours, and potentially longer if the Spirit of Queensland passenger train was then given priority.

In these circumstances, the decision to run trains 6792 and 67P8 without another patrol could be understood. However, the decision meant that train 6792 was in effect being used to prove the integrity of the network following the declaration of the CAN. It also meant that the other controls and processes in place to ensure track conditions were serviceable had to be effective.

Serviceability of weather monitoring stations

Little Banyan Creek was one of several locations on the North Coast Line known to be prone to flooding. In addition, it was a location where the flooding could be localised, and not able to be predicted by the conditions at other nearby locations.

Accordingly, QR had installed a weather monitoring station with a water level sensor, which would provide network control with a flood alarm if the water reached within 1 m of the rails on the Little Banyan Creek rail bridge. It had also installed a closed-circuit television system (CCTV) at the bridge.

However, the water level sensor at Little Banyan Creek had been out of service for 57 days prior to the occurrence. The CCTV’s illuminator, which enabled images of the bridge to be viewed in dark conditions, had also been out of service for 14 days. In addition, the water level sensor at Murray Creek, another known flooding location 12 km south of Little Banyan Creek, had been out of action for 28 days.

Given that the region was still in its wet season, it would have been appropriate for relevant weather monitoring systems at known flooding locations to be allocated a relatively high priority for repair. At the time of the occurrence however, other types of systems directly related to the movement of train traffic received a higher priority. Nevertheless, attempts to repair the Little Banyan Creek water level sensor and CCTV illuminator had been undertaken, but the problems had not been able to be resolved.

If the relevant systems could not be repaired, then it was important for network control personnel to be aware of the problems. However, neither the network control officer (NCO) or the regional transit manager (RTM) on duty in the period leading up to the occurrence were aware that the Little Banyan Creek water level sensor or the CCTV illuminator were unserviceable. Had they been aware of the problem with the water level sensor, it is likely they would have advised the 6792 train crew of the situation, and/or taken action to obtain more information about the status of the bridge prior to the train’s arrival.

When a weather monitoring station parameter first developed a fault, a message was sent to the RTM’s workstation as well as to QR’s fault coordination centre. After the message was acknowledged, there was no ongoing process of communicating the status of the system to network control personnel.

More specifically, QR did not have a formal process for ensuring that network control personnel were aware of which relevant weather monitoring systems or CCTV systems were unserviceable or operating in a degraded mode prior to commencing a shift. Although such a process would be useful in all situations, it was particularly important when a CAN due to wet weather was declared.

Processes for actively monitoring conditions ahead of a train

Regardless of the status of relevant weather monitoring systems, it would have been useful for network control personnel to have actively obtained information about track conditions ahead of train 6792. Such a process would have provided more redundancy in the case of problems with the weather monitoring systems, and provided more advance notice of potential problems even if the flood alarms were operational.

However, QR did not have procedures that required network control personnel to actively search for information about track conditions ahead of a train during a CAN associated with wet weather conditions, or in other situations where conditions had the realistic potential to have changed since the last patrol had been conducted or the last train had operated over the section.

It is likely that some network control personnel would actively monitor conditions ahead of a train in some situations, even without specific procedures requiring them to do so. However, there was no indication that this was done in the period immediately leading up to the collision with floodwater. Network control personnel also indicated it was not something that was normally done, and generally they only searched for information if they had already received advice of a problem, such as via a weather monitoring station alarm or a report from an external party. This occurred on the morning of 7 March when the NCO on duty up until 0400 checked the water level at Babinda on the CCTV at 0314, soon after the driver of 6792 had already provided advice about the water level.

Little Banyan Creek was the next location south of Babinda that had a CCTV system. It appeared that one or more network control personnel did attempt to view CCTV images, or at least obtain refreshed images, from the Little Banyan Creek CCTV during the 5 hours prior to train 6792 departing Cairns, and on one occasion after it had departed. This last occasion occurred at 0328, soon after the NCO on duty had checked the CCTV at Babinda. These attempts at viewing the conditions at Little Banyan Creek would have been unsuccessful, given they all occurred at night and the CCTV system’s illuminator was not working. There was no attempt to view conditions at the creek after civil twilight (0554) and prior to the train arriving at the creek (0612).

In addition to the CCTV information, network control personnel could also have obtained current information on various parameters from weather monitoring stations at the RTM’s workstation. If they had done this, they would have identified that there was no water level information available for Little Banyan Creek or Murray River, which should have generated an increased level of caution. Such a search would have been prudent, given that the RTM’s workstation had received derived rainfall rate alarms at 2039 on 6 March and 0015 on 7 March.

To some extent, the ability to actively search for information on conditions ahead of a train will always be dependent on the workload of the network control personnel, and on this occasion the RTMs and NCOs were conducting some other tasks. Nevertheless, a formal process to actively monitor conditions ahead of a train during a CAN or similar situation should ensure that an elevated priority is given to such search tasks, increasing the likelihood that they will be able to be conducted within an appropriate time period.

The active search for information about track conditions would be facilitated if the relevant systems were easy to use and the information was readily available and prominently displayed. From the evidence available, it appeared that obtaining refreshed CCTV images and current weather parameter information from weather monitoring stations was not without some difficulty. Nevertheless, a formal procedure, with appropriate priority for this type of situation, should still ensure that relevant information would be obtained within an appropriate time period.

Communications between operational personnel

During a CAN due to wet weather or similar abnormal situation, it is essential for operational personnel to exchange relevant information to ensure that each of them can effectively perform their roles. During the morning of 7 March, however, there were several aspects of the communications involving network control personnel, trains crews and the track maintenance supervisor (TMS) that were problematic.

Firstly, the Townsville North control board NCOs requested that the 6792 train crew pass on any observations about the weather and track conditions, and the driver of 6792 provided relevant information on several occasions. Unfortunately, the driver of 6792 initiated these communications via mobile phone. The train crew of 67P8 and the TMS (after he commenced duty at 0600), listening to the train control radio, were therefore not directly aware of the reported information. The use of mobile phones is a necessary part of communications on some networks, but they were not permitted for use on the North Coast Line due to associated safety concerns.

Secondly, the NCOs were aware of some weather monitoring station alarms at locations on the North Coast Line, and when the TMS contacted the NCO on duty at 0456, the NCO on duty provided some information about the alarms that had been received. However, this information was not passed on to the train crew of 6792 or the crew of the following train (67P8). In addition, the NCOs did not pass on the relevant information about weather and track conditions provided by the driver of train 6792 (such as the water level at Babinda) to the TMS or the crew of train 67P8.

In normal operations, there would be limitations on the amount of information that needed to be communicated between these parties on the train control radio frequency. However, given a CAN due to wet weather had been declared, a recent track patrol had not been conducted, and only two trains were on the line between Cairns and Townsville at the time, increased sharing of relevant information was warranted.

Although enhanced communications between the relevant parties would have provided more assurance that hazards would be identified and managed, it is unlikely that this would have prevented the occurrence. The more fundamental problem was the absence of known information about the conditions at Little Banyan Creek.

Another communications aspect of note was that the driver of train 6792 advised the NCO at 0610 that there was water halfway up the ballast at the Birkalla tramway. According to the relevant procedures, if a train crew observed water in the ballast they were to immediately stop their train and advise network control. However, the train driver later stated that the water was not in the ballast, and it was not possible for the ATSB to verify the exact status of the water. In addition, the NCO did not have an opportunity to stop the train, as the driver was still providing his report on conditions at the time, and indicated that he had already proceeded through the area of concern.

Train operating speed

Use of controlled speed

In the absence of a recent track patrol, a serviceable water level sensor at Little Banyan Creek and/or active monitoring of the track conditions ahead of the train, the final risk control in place to reduce the risk of a collision with floodwater or a related occurrence was the requirement for the train crew to operate at ‘controlled speed’.

In normal operation, a driver may assume the integrity of the network has been proven by a recent track patrol (or rail traffic) and remote monitoring. They can then drive in accordance with the displayed signals and speed limits, with the assumption that they have right of way on the track unless the signals indicate otherwise. When a controlled speed restriction is applied, the driver is required to drive a train in a manner in which it can be stopped short of an obstruction within half the distance of clear track that is visible ahead.

Instead of operating to well-known speed limits, a driver has to estimate target speeds in real time, based on their route knowledge, expectation of potential hazards on the track ahead, perception of the current visibility at the time and judgements about stopping distance in the prevailing conditions. In addition to flooding at known flooding locations, wet weather could also involve a range of other potential hazards to consider, such as signal irregularities or debris on the track. In some cases under controlled speed, a driver may be able to operate at or near the maximum permitted speed limit, whereas in some other cases they may have to operate at speeds well below the maximum speed limit. Overall, the task of estimating controlled speed would vary in complexity during a journey.

Given that the line of sight to the Little Banyan Creek rail bridge was 60 m, and the speed required to stop the train within 60 m was 15 km/h, the driver had to be travelling at much less than 15 km/h to stop within half the distance of line of sight, even if the driver had a rapid response time.

The driver of train 6792 reported that he was operating the train at about 40 km/h, and the data logger indicated the speed was about 50 km/h. Although 50 km/h was conservative relative to the maximum permitted speed of 70 km/h (in normal conditions), it was still far in excess of the controlled speed at that location.

More broadly, during the journey from Cairns, the driver operated the train at a speed that was less than the normal running time speed, indicating that he was applying a level of caution. There was evidence that the train was probably travelling at (or less than) controlled speed at some locations, but there was also evidence that the train’s speed was higher than controlled speed at some other locations, including locations similar to Little Banyan Creek.

There is no detailed research that has examined train driver compliance with controlled speed and the reasons why trains have exceeded the controlled speed at particular types of locations. In contrast, a substantial amount of research has determined that road vehicle drivers reduce their speed in reduced visibility or other adverse conditions, but the adaption is not sufficient and speeds are often still inappropriate for the conditions, and a wide range of motivational, perceptual and other factors can be involved (European Commission, 2018).

The ATSB considered a range of potential reasons as to why the driver of train 6792 did not effectively comply with controlled speed on the approach to Little Banyan Creek. These reasons included expectancy, workload and fatigue.

Expectancy

The most obvious reason that the driver was operating the train in excess of controlled speed at Little Banyan Creek was that he did not expect there would be a problem at that location. He was aware that network control had access to a weather monitoring station with a flood warning and CCTV, and he believed that they would advise the train crew if there was any problem at the bridge. The fact that he appeared to be driving more cautiously at some locations that did not have a weather monitoring system, and reported that he was more concerned about locations without a weather monitoring system, is consistent with this explanation.

A person’s risk perception of a situation, or expectancy that they will encounter a problem, can decrease after prolonged exposure without any adverse consequences. More specifically, the driver of train 6792 may also have been affected by a low level of expectancy of a problem because he had encountered little evidence of any flooding in the previous 112 km of the journey.

In this regard, the train’s average speed was lower (relative to the normal running time speed) in the first half of the journey (Cairns to Waugh) compared to the second half (Innisfail to Little Banyan Creek). However, a range of other factors may account for this difference, including variations in the nature of the track, actual weather conditions at the time and number of perceived hazards given the conditions. The driver also applied a similar approach to approaching other bridges with similar characteristics as Little Banyan Creek (which had weather monitoring stations), prior to reaching Waugh. Overall, there was insufficient evidence to conclude that the driver was operating less cautiously over time during the journey.

Workload and divided attention

Workload is also a relevant consideration. Workload refers to the interaction between a specific individual and the demands associated with the tasks they are performing. High workload leads to a reduction in the number of information sources an individual will search, and the frequency or amount of time these sources are checked (Staal, 2004). It can result in an individual’s performance on some tasks degrading, tasks being performed with simpler or less comprehensive strategies, or tasks being shed completely (Wickens and Hollands, 2000).

Driving a freight train in normal conditions involves a high level of expertise managing the mass and energy of the train in sections of track with undulating terrain and a significant number of curves and changes in speed limits, such as on the North Coast Line. In this case, the driver’s workload was exacerbated by the requirement to operate at controlled speed and operating at night in weather conditions that included heavy rain. In addition, his workload was increased by passing on reports about the weather and track conditions to network control.

One potential problem with this higher than normal workload was the potential for the driver’s attention to be divided at a critical time, resulting in an important task not being conducted in an effective or timely manner. For example, at the time the train was approaching the curve prior to the Little Banyan Creek rail bridge, the driver was engaged in a conversation via mobile phone about the current conditions with the NCO. A substantial amount of research has shown that the use of a mobile phone can adversely affect road vehicle driver performance, particularly in terms of reaction time and stimulus detection, with no difference in effect between handheld or hands-free use (Caird and others, 2018, Horrey and Wickens, 2006).

Given the available sighting distance after rounding the left curve prior to the bridge, the driver could not have prevented the collision, regardless of how promptly he reacted to the situation. Nonetheless, the available evidence indicates he promptly identified the hazard and reacted accordingly. The extent to which the driver’s workload may have influenced other aspects of his performance at the time, such as his consideration of potential hazards and monitoring of the train’s speed, could not be determined based on the available evidence.

Workload and sustained attention

Another aspect of the driver’s tasks and workload was the potential for his sustained attention to be affected. Research has shown that when an individual has to detect specific types of targets or stimuli over an extended period, their performance level will decrease, often typically within the first 30 minutes (Wickens and Hollands 2000). This problem, known as the vigilance decrement, has been demonstrated in a wide range of tasks, and a number of factors can influence its severity. For example, the problem increases as the salience of the targets (or hazards) decrease, the uncertainty about when the targets will occur increases, and the likelihood of encountering a target decreases.

Although there has been no specific research examining the nature of the vigilance decrement on a task such as driving a freight train at controlled speed, there is the realistic potential for a driver’s vigilance to be affected if they are performing the task for an extended period. In this case, the driver of train 6792 was operating with the controlled speed requirement for 68 minutes after departing Innisfail, and had operated with a controlled speed requirement for a longer period between Gordonvale and just passed Waugh. However, as discussed above, there was insufficient evidence to conclude that the driver’s performance changed or deteriorated over time.

Fatigue

Fatigue can have a range of adverse influences on human performance, including slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance and more lapses or errors of omission (Battelle Memorial Institute, 1998), as well as various effects on decision making (Harrison and Horne, 2000). More specifically, research has shown that fatigue can lead to an increased risk of speed violations in freight train driving (Dorrian and others, 2007), and that fatigued drivers will drive faster and use brakes less in some situations, such as approaching a reduced speed limit on a downhill grade (Dorrian and others, 2006).

Sleep is vital for recovery from fatigue, with both the quantity and quality of sleep being important. Most people need at least 7–8 hours of sleep each day to achieve maximum levels of alertness and performance. Research has shown that obtaining less than 5 hours sleep in the previous 24 hours is inconsistent with a safe system of work (Dawson and McCulloch, 2005), with some research indicating less than 6 hours sleep can increase risk (Thomas and Ferguson, 2010, Williamson and others, 2011). In addition to sleep, a number of other factors can increase fatigue, including time of day, time awake and the nature of work activities.

The driver of train 6792 was woken at midnight after obtaining less than a normal amount of sleep. There is always the potential of reduced sleep and alertness in such situations, even if sufficient rest opportunity has been provided, and this is consistent with many transport activities being conducted overnight. The driver’s sustained workload could also have exacerbated any fatigue.

Overall, there was insufficient evidence to conclude that the driver was experiencing a level of fatigue likely to have a demonstrated influence on performance. It was unclear how much sleep the driver actually obtained and, as discussed above, there was insufficient evidence to indicate that the driver’s response times or other aspects of his performance deteriorated during the journey.

Summary

In summary, a range of factors had the potential to adversely influence the driver’s effective use of controlled speed during the 112 km (over 3 hours of driving) from Gordonvale to Little Banyan Creek, including the last 48 km (68 minutes) since departing Innisfail. Based on the available evidence however, the only factor that can be concluded as probably influencing his use of controlled speed at Little Banyan Creek was his expectancy that there was unlikely to be any problems at the bridge, given that he had received no advice from network control about any potential problem.

Requirements to operate at controlled speed

As indicated in the previous section, the application of a controlled speed requirement on a train crew is in effect the final risk control in place to prevent a train from encountering a hazard during a condition affecting a network (CAN) or similar situation. It is undoubtedly also an important risk control to apply in many situations.

However, the effectiveness of controlled speed as a risk control has significant potential to deteriorate if it is required to be used by a train crew for an extended period. As already discussed, its application can significantly increase driver workload, and the potential for problems with divided attention as well as maintaining sustained attention (or vigilance). The workload involved can also increase the potential for driver fatigue. In addition, if the requirement is in place for an extended period and no hazards are encountered, there is the potential for a driver’s expectancy of a hazard or risk perception to decrease.

Given these considerations, it would have been appropriate to have any restrictions on time or distance that controlled speed could be used as a mitigation measure for safe train operation in degraded conditions. However, QR had no such restrictions in place, and it did not provide detailed guidance for network control about how controlled speed could be applied to minimise the risk of its use for extended periods by train crews.

Network control personnel generally applied controlled speed as a risk control for specific hazards at specific locations. In such cases, it is relatively easy for drivers to comply with the requirement, particularly if they know the specific types of hazards involved. However, on the 7 March 2018, the requirement was applied for a 134.2 km of track, which involved at least 162 minutes of operation in normal operating speeds (and much longer if controlled speed was applied). As no specific locations or types of hazards were stated in the written authority, the range of potential hazards was also quite large. Network control had also applied a controlled speed requirement for significant distances (193.6 and 60.0 km) associated with wet weather conditions on two other occasions in early 2019.

Alternatives to using controlled speed for extended periods could include using ‘restricted speed’, with a maximum speed limit, for some or all of the distance involved. Train drivers would find this easier to comply with over extended periods, but the 25 km/h limit would significantly increase running time.

If controlled speed is applied for an extended period, other associated risk controls need to be effective. As already discussed, this includes having serviceable weather monitoring systems, procedures to ensure network control (and other parties) are aware of any relevant weather monitoring systems that are unserviceable, and active monitoring by network control of conditions ahead of the first train.

It could be argued that, if a more appropriate procedure for implementing controlled speed was in place, then the crew of train 6792 would not have had to be using controlled speed for such a distance without other risk control, such a recent track patrol, also being in place. However, based on aspects already discussed, it seems likely that the occurrence would still have resulted even if the requirement for controlled speed had only been applied for a relatively short section of track that included Little Banyan Creek.

Management of train crew workload

The problems with attempting to comply with controlled speed for an extended period for a two-driver operation could be reduced, to some extent, by the drivers effectively sharing their duties.

Aurizon’s procedures for two-driver operation required one driver to operate the train and the other driver to conduct monitoring duties. The train crew reported that it was normal practice for the operating driver to handle all communications with external parties, and the drivers would swap roles halfway through the journey. Aurizon had no additional procedures or guidance for a condition affecting the network (CAN) due to wet weather, or similar situation.

The ATSB is aware than this approach to sharing duties in a two-driver crew is common across many routes and many rail operators. However, this traditional approach exacerbates the adverse effects of operating at controlled speed (or restricted speed) for an extended period. The effects could be reduced by the monitoring driver conducting some of the operating driver’s duties (such as communications with network control), and/or more frequent swapping of roles between the two drivers. Alternatively, procedures requiring clear verbal nomination and agreement of potential hazards and target speeds could be introduced.

Research in aviation and some other fields has shown the important role that effective teamwork, sharing of duties and use of non-technical skills can play in managing fatigue, or at least making teams more resilient to the effects of fatigue (Dawson and Thomas, 2019). Although efforts to introduce rail resource management in rail operations have been ongoing over many years, further development is needed.

Introducing more effective application of teamwork in two-driver operations in normal situations may be a challenge for many rail operators. Nevertheless, in situations such as a CAN due to wet weather, or other situations likely to increase the normal workload and/or fatigue of the operating driver, having more detailed requirements and guidance about how to share tasks to minimise risk would certainly be beneficial.

Findings

From the evidence available, the following findings are made with respect to the collision with floodwater involving Aurizon freight train 6792 at Little Banyan Creek, Queensland, on 7 March 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The Little Banyan Creek rail bridge was under 0.6 m of flowing water, due to heavy rainfall in the Banyan Creek catchment in the hours prior to train 6792 approaching the bridge.
• The Little Banyan Creek weather monitoring station’s water level sensor had been out of service for 57 days, and the closed circuit television camera (CCTV) illuminator, which enabled effective operation at night, had been out of service for 14 days.
• The network control officer and regional transit manager on duty in the period leading up to the occurrence were not aware that the Little Banyan Creek water level sensor was out of service. Consequently, they expected to be alerted to any problem by a flood alarm, and did not actively search for additional information about the water level at the bridge prior to train 6792 arriving.
• Queensland Rail did not have an effective means of ensuring that, during situations such as a condition affecting the network (CAN), network control personnel were aware of the relevant weather monitoring systems that were unserviceable. [Safety issue]
• Queensland Rail did not have procedures that required network control personnel to actively search for information about track conditions ahead of a train during situations such as a condition affecting the network (CAN), when conditions had the realistic potential to have deteriorated since the last patrol or train had run over the relevant sections. [Safety issue]
• The crew of train 6792 expected there were no flooding problems at Little Banyan Creek, based on not receiving any advice of a flood alarm from the network control officer.
• Train 6792 was travelling at about 50 km/h as it rounded the curve prior to the Little Banyan Creek rail bridge. With a sighting distance of about 60 m to the bridge, this speed was significantly in excess of the ‘controlled speed’, and the driver was unable to stop the train before it entered the floodwater.

Other factors that increased risk

• Although the driver of train 6792 provided regular updates on the operating conditions, he conducted these communications via mobile phone rather than train control radio, limiting the potential for other relevant parties to obtain the information.
• Network control personnel did not pass on all the relevant information they had about the operating conditions during the condition affecting the network (CAN) to the crews of trains 6792 and 67P8 and the track maintenance supervisor.
• During the journey south from Cairns, the driver of train 6792 was experiencing an elevated workload due to operating at night in adverse weather conditions and the requirement to operate at controlled speed. He was also providing reports of the operating conditions to network control, including providing a report via mobile phone as the train approached Little Banyan Creek.
• Queensland Rail did not have any restrictions on the distance or time that controlled speed could be used as a risk control for safe train operation in situations such as a condition affecting the network (CAN). The effectiveness of controlled speed has the significant potential to deteriorate over extended time periods due to its effect on driver workload, vigilance, fatigue and risk perception. [Safety issue]
• Aurizon’s procedures and guidance for two-driver operation during situations such as a condition affecting the network (CAN) did not facilitate the effective sharing of duties and teamwork to minimise the potential effects of degraded conditions on driver workload and fatigue. [Safety issue]

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are provided separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Advice of weather monitoring station serviceability

Safety issue number: RO-2018-007-SI-01

Safety issue description: Queensland Rail did not have an effective means of ensuring that, during situations such as a condition affecting the network (CAN), network control personnel were aware of the relevant weather monitoring systems that were unserviceable.

Procedures for actively monitoring conditions ahead of a train

Safety issue number: RO-2018-007-SI-02

Safety issue description: Queensland Rail did not have procedures that required network control personnel to actively search for information about track conditions ahead of a train during situations such as a condition affecting the network (CAN), when conditions had the realistic potential to have deteriorated since the last patrol or train had run over the relevant sections.

Application of a controlled speed requirement by network control

Safety issue number: RO-2018-007-SI-03

Safety issue description: Queensland Rail did not have any restrictions on the distance or time that controlled speed could be used as a risk control for safe train operation in situations such as a condition affecting the network (CAN). The effectiveness of controlled speed has the significant potential to deteriorate over extended time periods due to its effect on driver workload, vigilance, fatigue and risk perception.

Procedures for sharing workload in two-driver operation

Safety issue number: RO-2018-007-SI-04

Safety issue description: Aurizon’s procedures and guidance for two-driver operation during situations such as a condition affecting the network (CAN) did not facilitate the effective sharing of duties and teamwork to minimise the potential effects of degraded conditions on driver workload and fatigue.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Queensland Rail
• Queensland Rail personnel involved in network control and track maintenance
• Aurizon
• the data logger from train 6792
• the driver of train 6792
• the Bureau of Meteorology.

References

Battelle Memorial Institute 1998, An overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.

Caird JK, Simmons SM, Wiley K, Johnston KA & Horrey WJ 2018, ‘Does talking on a cell phone, with a passenger, or dialling affect driving performance? An updated systematic review and meta-analysis of experimental studies’, Human Factors, vol. 60, pp.101–133.

Dorrain J, Roach GD, Fletcher A & Dawson D 2006, ‘The effects of fatigue on train handling during speed restrictions’, Transportation Research Part F, vol. 9, pp. 243–257.

Coplen MK 1999, Compliance with railroad operating rules and corporate culture influences – Results of a focus group and structured interviews, US Department of Transport / Federal Railroad Administration report DOT/FRA/ORD-99/09.

Dawson D & McCulloch K 2005, ‘Managing fatigue: It’s about sleep’, Sleep Medicine Reviews, vol. 9, pp. 365–380.

Dawson D & Thomas MJW 2019, ‘Fatigue management in practice – It’s just good teamwork’, Sleep Medicine Reviews, vol. 48, pp. 1–3.

Dorrian J, Roach GD, Fletcher A & Dawson D 2007, ‘Simulated train driving: Fatigue, self-awareness and cognitive disengagement’, Applied Ergonomics, vol. 38, pp. 155–166.

European Commission 2018, Speed and speed management, downloaded from www.erso.eu.

Harrison H & Horne JA 2000, ‘The impact of sleep deprivation on decision making: A review’, Journal of Experimental Psychology, vol. 6, pp. 236–249.

Horrey, WJ & Wickens CD 2006, ‘Examining the impact of cell phone conversations on driving using meta-analytic techniques’, Human Factors, vol. 48, pp. 196–205.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Thomas MJW & Ferguson SA 2010, ‘Prior sleep, prior wake, and crew performance during normal flight operations’, Aviation, Space, and Environmental Medicine, vol. 81, pp. 665–670.

Wickens CD & Hollands JG, 2000, Engineering psychology and human performance, 3rd edition,

Prentice-Hall International Upper Saddle River, NJ.

Williamson A, Lombardi DA, Folkard S, Stutts J, Courtney TK & Connor JL 2011, ‘The link between fatigue and safety’, Accident Analysis and Prevention, vol. 43, pp. 498–515.

Zhang Z & Liu X 2019, ‘Safety risk analysis of restricted-speed train accidents in the United States’, Journal of Risk Research, published online July 2019, pp. 1–19.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Queensland Rail, the network control officer and regional transit manager on duty at the time, the track maintenance supervisor, Aurizon, the driver of train 6792, and the Office of the National Rail Safety Regulator (ONRSR).

Submissions were received from Queensland Rail (safety action only), Aurizon (safety action only) and the ONRSR. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 11 March 2018, during departure from Dampier, Western Australia under harbour pilot guidance, the bulk carrier Bulk India experienced an electrical blackout resulting in loss of propulsion and steering control. As a result, the ship exited the channel and ran aground. The ship was recovered into the channel with the aid of tugs, before being taken out the channel, to anchor, for further investigation.

What the ATSB found

The electrical blackout occurred because the auxiliary diesel generator engines shut down after the cooling water temperature controller malfunctioned, resulting in overheated cooling water. The ship’s engineers did not immediately identify the problem and were unable to manually operate the cooling water temperature control valve in time to prevent the blackout.

The ATSB also found that the problems in the engine room started about 13 minutes before the blackout, however the two pilots on board were not informed of the situation. This removed the opportunity for the pilots to prepare for the loss of control, and delayed actions that may have assisted in a more timely or more effective response.

Further, it was found that Bulk India’s emergency generator was not fit for service. When the blackout occurred, the engine started but shut down shortly after, due to overheating. The radiator fan belt had failed several months prior but had not been replaced. The operator, Kowa Marine Service did not have in place adequate procedures to ensure that critical spares were identified and their inventory level maintained, to guarantee availability when required on board.

What's been done as a result

Kowa Marine Service has undertaken a fleetwide program of continual improvement of its safety management and operating systems, and staff education and training processes. This included actions directed at identification, operation, maintenance and spare parts management relating to critical plant and machinery.

Rio Tinto have revised escort towage arrangements for ships departing their facilities in Dampier on the basis of extensive simulation exercises and a review of existing risk assessments. As a result, attendance by a second tug has been extended to number 3 beacons. Further, a comprehensive guidance manual for ship towage operations in Dampier and Port Walcott has been developed.

Safety message

Ship operators and crewmembers should ensure that systems, machinery and equipment, critical to the continued safe operation of the ship, are thoroughly understood, as well as appropriately maintained and tested. This will reduce the likelihood of an emergency situation relating to these items developing and provide a defence against adverse outcomes, should such a situation arise.

The occurrence

At 1806^[1] on 8 March 2018, the 289 m bulk carrier Bulk India (Figure 1) was all fast alongside the Parker Point number 5 berth, Dampier, Western Australia. The ship had moved from anchorage after a ballast voyage from Zhoushan, China. During this port call, the ship was to load iron ore for export and take on stores and spares.

In addition to routine stores, the ship had been awaiting replacement fan belts for the emergency generator diesel engine since August 2017. The belts had not reached the ship in multiple previous ports, but on 9 March 2018, they were delivered to the ship as part of a normal delivery of ship’s spares. However, neither the master nor chief engineer were aware of their arrival, as it was usual practice to check the packages and their contents once the ship was at sea.

Figure 1: Bulk India

Source: DDGHANSA, Shipspotting.com

Departure preparations

During the morning of 11 March, all on board were preparing to depart Dampier on the afternoon tide (high tide 3.37 m due at 1618) bound for Zhoushan. Bulk India was loaded with 169,789 t of iron ore and had departure draughts of 17.49 m forward and 17.51 m aft.

At 1200, 1 hour’s notice of departure was provided to the engineers. In the engine room, the main engine was prepared and tested ahead and astern. A second diesel generator (number 3 – AuxDG3) was started and brought on-line to supply electrical power in parallel with the first diesel generator (number 1 – AuxDG1). The third diesel generator (number 2 – AuxDG2) was started but not connected to supply power. It was usual practice on board to have two diesel generators providing power during manoeuvring (about 250 kW each), with the third running but not supplying power.

By 1300, all navigational equipment had been checked and recorded in the navigation log as being in good working order. On the bridge were the master, third mate as the officer of the watch (OOW) and an able seaman (AB) on the helm. The engine room was attended by the chief engineer, first engineer, third engineer and an oiler. At 1330, two harbour pilots, consisting of a pilot-in-charge (PiC) and a peer,^[2] boarded the ship. They were escorted to the bridge and the PiC and Bulk India’s master commenced the master-pilot exchange of information (MPX). The peer pilot prepared for assessment duties and also set up the PiC’s portable pilotage unit (PPU) in position at the front of the bridge.

During the MPX, the Dampier Pilots’ MPX form and Bulk India’s pilot card were worked through (see Appendices B and C). The PiC received confirmation that relevant equipment had been tested: the main engine had been run ahead and astern, the steering gear had been checked, and the anchors were cleared and ready for use. The master also confirmed that there were no machinery or equipment deficiencies that would affect the pilotage.

The prevailing weather and current conditions were discussed—wind from the north-east at 15 to 20 knots,^[3] and current about 0.8 knots to the south-west. The PiC also mentioned that there would be a south-westerly set and they would tend to stay middle of the channel, favouring the northern side. This would mean that the ship would be best positioned through the departure channel bend to account for the maximum tidal flow. The master and PiC signed the forms to show agreement to the plan, and the conduct of the ship transferred to the PiC. The PiC then completed a steering test with the OOW and AB, and checked that the steering operated in hand and non-follow up operational modes.

Two harbour tugs were in attendance and were made fast—Pilbara Titan (bollard pull^[4] 65 t) on the port shoulder^[5] and Pilbara Vulcan (bollard pull 65 t) centre lead aft.^[6] On instruction from the master, the mooring parties (fore and aft) let go lines and all were recovered on board. The tugs moved the ship into the Parker Point Departure Channel (maintained depth of 15.5 m) and at 1404, the main engine was started dead slow ahead and the ship was under way (Figure 2 and Appendix A).

Diesel generator engine overheating

At 1418, the ship’s speed was 5 knots and in the channel, well clear of the wharf area. Pilbara Titan was let go and it was manoeuvred aft of the ship, to escort position off the starboard quarter. The second tug, Pilbara Vulcan, remained made fast.

At 1420, as the main engine was increased to full ahead, AuxDG1 went into alarm due to high temperature (85°C) of the cooling fresh water outlet. The third engineer went to investigate and reported to the chief engineer that the diesel generator engine cooling fresh water control valve was in the ‘bypass open’ position, rather than the ‘cooler open’ position. This meant the cooling water was bypassing the fresh water cooler and was not being cooled.

The chief engineer went to inspect the equipment as the third engineer attempted to manually operate the control valve via the hand wheel fitted to the top of the valve. However, the hand wheel could not be turned in the direction indicated (counterclockwise, to raise the valve spindle and open flow to the cooler) despite the use of a wheel key and considerable force.

The chief engineer instructed the first engineer to open the emergency/maintenance cooling water supply from the main engine cooling system. However, this had little effect and the cooling water temperature continued to rise. The chief engineer then telephoned the bridge and discussed the problems with the master.

Meanwhile, the PiC remained unaware of the engine room events. The main engine remained at full ahead, and the ship’s speed increased to 7.7 knots. The ship remained positioned in the middle of the channel, passed the Mid Ground buoy and followed the starboard turn into the Rio Tinto Channel.

Figure 2: Bulk India's track from berth to grounding and recovery

Source: Australian Hydrographic Service, annotations by ATSB

Blackout—navigation/pilotage actions

At about 1428, AuxDG1 tripped due to excessively high cooling water temperature (90°C). All electrical load transferred to AuxDG3.^[7] The chief engineer called the master and provided an update of the situation in their native language (Filipino). The details were not shared with either of the pilots.

At 1430, the turn into the Rio Tinto Channel had been completed. The PiC was satisfied that the ship was safely positioned in the fairway and, as there was no further assistance required from it, Pilbara Titan was released. Pilbara Titan fell back and turned to return to Parker Point. Pilbara Vulcan remained made fast and trailed close astern. At this stage, the ship had a speed of 8 knots (Table 1, Figure 3).

At 1431, as the ship was lined up and steadied in the channel, the PiC asked the AB to steer 008° and at 1432:30, 009° to account for the tidal flow pushing the ship to port. The rudder had been put to starboard, arresting a slow turn to port and the rate of turn (RoT) increased to starboard. At 1433:06 the AB reported that the ship was on 009° and applied port rudder which slowed the RoT to starboard. At about this time, the rudder was put 20° to port.

At 1433:23, AuxDG3 tripped on excessively high cooling water outlet temperature and the ship lost all electrical power (blackout). The emergency generator started and soon after, shut down due to overheated cooling water. Multiple alarms sounded on the bridge, signalling that the ship had lost electrical power and propulsion.^[8] Loss of power to the steering gear meant that the rudder remained at 20° to port.

Table 1: Selected data (from AIS and PPU) at time of the blackout and grounding

Local time (LT) - UTC +8 hours; SOG is speed over the ground in knots; HDG is heading in degrees true; COG is course over the ground in degrees true; RoT is rate of turn in degrees per minute – negative indicates turn to port.

Figure 3: Bulk India movement data taken from PPU

Rate of turn in degrees per minute—negative indicates turn to port.

Source: Marine Services Western Australia, annotated by the ATSB

The grounding

The PiC went to the helm and determined that all control of the steering had been lost. The applied port rudder had taken effect and the ship had stopped turning to starboard and the RoT increased to port. The PiC directed the master of Pilbara Vulcan to take the stern to port, with full power, in an attempt to stop the turn. Anchors were ready and available but the PiC advised the master not to release them at this stage, in case they passed under the ship and holed the hull.

The peer pilot assumed communications responsibility and provided information and updates to the PiC. At 1433:45, Dampier vessel traffic service (VTS) was contacted and notified of the situation. The peer pilot also used the radio to alert all stations to the ship having blacked out and of a port emergency, and requested all tugs to attend the ship. Pilbara Titan was then radioed and the tug master asked to return to Bulk India. The tug was just over 1 nautical mile (NM) away and was immediately turned around and steamed back toward the ship under full power. Another tug, Pilbara Neptune (bollard pull 65 t) was approaching Parker Point wharf when the port emergency call was made. Pilbara Neptune’s master immediately turned the tug and increased speed to go to the ship’s aid.

Despite the loss of rudder effectiveness when the main engine stopped, and the efforts of the tug, the RoT to port increased from 2°/min at 1434, to 4°/min by 1435.

At 1435, the master directed the second mate (at the aft mooring station) to go to the steering gear room and engage the emergency steering. The second mate was aware that the emergency generator had started and upon checking inside the accommodation, realised the ship had blacked out. Once at the steering gear (directly below the aft mooring station), the second mate radioed the bridge and informed the master that emergency steering could not be engaged because there was no power to either of the steering motors.

The PiC realised that control of the steering would not return and that the ship was going to turn out of the channel and run aground. The priority for the PiC changed from arresting the turn to slowing the ship, to limit any damage from contact with the bottom. The master of Pilbara Vulcan was directed to reposition and apply full transverse arrest^[9] while continuing to take the stern to port.

The ship’s speed began to slow while the RoT increased. At 1435:45, the peer pilot informed the PiC that the ship was going out of the channel—the ship had speed of 7.6 knots and a rate of turn to port of 5°/minute. The PiC directed Pilbara Vulcan to direct all power to slowing the vessel in order to reduce the severity of the imminent hull contact with the channel side. VTS was informed that the ship was departing the channel and running aground. At 1437, at 7.2 knots, on heading 355° and with a rate of turn of 10°/min to port, Bulk India took the bottom.

The ship contacted the bottom at an angle of about 15° to the channel side. The ship rode up the channel side, heeled and slewed to starboard, coming back parallel with the channel. It slid along the bottom and slowed. The PiC asked the peer pilot to call the port authorities, including the harbour master and pilot manager, and inform them of the incident. The peer pilot referred to the pilotage company emergency checklist and informed the necessary parties.

By 1440, Bulk India had slowed to 2 knots. With the port bow still in contact with the bottom, momentum took the ship’s stern to starboard and into the channel, which kept the ship’s propeller and rudder in deep water. The PiC directed Pilbara Vulcan to counter the swing to prevent the stern from turning across to the other side of the channel.

The ship continued to slow and closed in on the number 5W channel beacon. At 1441, the master of Pilbara Titan contacted the PiC, and was directed to the port shoulder to push up on the port bow and take it clear of the channel beacon. The tug was about 0.4 NM astern of Bulk India, closing fast at about 12 knots.

Blackout—engine room actions

The engineers eventually applied sufficient force to move the cooling water control valve manual hand wheel in the ‘cooler open’ direction. However, the valve spindle remained in the ‘bypass open’ position. In addition to this, opening the cooling water supply from the main engine system had no effect. The engineers dismantled the control valve pneumatic actuator and, when the control air pressure was released, the valve moved to ‘cooler open’ position. However, it was about this time that AuxDG3, AuxDG2 and, shortly after, the emergency generator shut down due to the high cooling water temperature.

The engineers dismantled the control valve actuator and found that the thrust bearing and disc fitted to the end of the manual operating hand wheel shaft had come adrift. The set screws normally holding these components in place had broken, allowing the assembly to fall off the shaft. The set screws were replaced and the control valve actuator reassembled.

The time taken to repair the valve actuator allowed the engines to cool a little and, at 1435, the temperature of AuxDG2’s cooling fresh water outlet returned to within normal limits (83°). This allowed the engine to be restarted, which commenced circulation of the cooling water. Electrical power and services were then slowly restored as control of the engine temperatures was regained by manual operation of the control valve. By 1440, all three cooling water temperatures were within the normal operating range.

At 1443, the chief engineer spoke with the master on the telephone (in Filipino) regarding the blackout and attempts to restore power. They discussed the restoration of power using the main generators and the failure of the emergency generator to operate correctly.

Recovery to anchor

The channel beacon was about 200 m ahead of the bow as Pilbara Titan passed up the port side of the ship. At 1444, the tug was in position and applied weight to the port shoulder.

At about 1445, alarms began to sound and lighting flickered on the bridge, indicating that restoration of power was underway in the engine room. However, no communication was received from the engine room regarding the return of power.

At 1447, Pilbara Neptune was approaching Bulk India and the PiC directed the tug to the starboard shoulder to assist the ship’s bow back into the channel. The ship slowed below 0.5 knots and then stopped for a short period.

At about 1448, electrical power was restored. The engineers continued to restore services and check systems in preparation for restarting the main engine. In the minutes following, the master directed the second mate to engage emergency steering and move the rudder to midships.

At this time, with power available to mooring winches, three tugs were in attendance and made fast: Pilbara Vulcan on the centre lead aft, Pilbara Titan on the port shoulder and Pilbara Neptune on the starboard shoulder. The PiC directed the tug masters to manoeuvre the ship back into the channel. A fourth tug, Riverwijs Rowan (bollard pull 84 t), responded to the request for assistance and at 1451, was under way from the King Bay Supply Base, about 4 NM from the ship.

From this time, the ship’s speed was slowly increased as it came free of the channel edge and cleared beacon 5W. At 1452, the ship was back in the channel and proceeding at 0.5 knots, with Pilbara Vulcan pushed up on the stern and the two forward tugs controlling the bow. As the PiC manoeuvred the ship with the tugs, the master and ship’s crew confirmed that power and services had been reinstated. The second mate engaged emergency steering and by 1455, the rudder was centred and operation of the steering gear tested. The ship’s speed steadily increased through 1 knot as the ship moved into the middle of the channel.

At 1457, the master spoke with the chief engineer and confirmed that the main engine was available. At 1458, the main engine was started at dead slow ahead and propulsion was restored At 1500, as the ship passed between number 5 channel beacons, at 2 knots, the main engine speed was increased to half ahead.

At 1506, the master of a fifth tug, Pilbara Thor (bollard pull 65 t), contacted VTS to notify that the tug was underway to Bulk India. It was about 5 NM away at that time and proceeded at full speed.

Riverwijs Rowan arrived off Bulk India at 1513, by which time the ship was passing number 4 beacons at a speed of 4.5 knots. The ship’s speed was increased further, until it reached 5 knots (a speed the pilots were comfortable with) at 1520. At 1530, after receiving a request from the harbour master, the master confirmed that tank soundings showed that the ship’s hull had not been breached.

At 1547, as the Fairway beacon was passed, Pilbara Thor reached the ship. With 2 tugs port and starboard forward (on the shoulders), two tugs aft under the bridge wings, the fifth tug astern, and the main engine at half ahead, Bulk India was taken out the channel, past the Sea Buoy and to anchor.

At 1830, the starboard anchor was let go at anchorage WA17. At 1845, the pilots departed the ship by helicopter and at 1848, finished with engines was rung.

Subsequent events

As a consequence of the incident, the Australian Maritime Safety Authority (AMSA) detained the ship as unseaworthy.

On 13 March, a ClassNK^[10] surveyor attended the ship and oversaw a dive inspection of the hull. Evidence was found of contact with the bottom but no significant damage. The surveyor also inspected the cooling water system, including the control valve repairs, and the emergency generator condition and operation. The systems were tested to the surveyor’s satisfaction. The AMSA detention order was lifted on 13 March, and at 2248 the same day, standby was called and the ship departed the anchorage to continue its voyage.

A ClassNK recommendation was issued for the installed emergency generator fan belts to be replaced with correctly sized belts as soon as possible and within one month. On 29 March the ship was attended by ClassNK while alongside in Ningbo, China. The emergency generator fan belts were confirmed to have been replaced with the correct sized belts from the original equipment manufacturer. The class recommendation was cleared.

__________

1. All times referred to in this report are Western Australia local time, Coordinated Universal Time (UTC) + 8 hours.
2. The second harbour pilot was conducting a peer review pilotage assessment of the pilot-in-charge.
3. One knot, or one nautical mile per hour, equals 1.852 kilometres per hour.
4. Bollard pull is a measure of the pulling power of a tug, expressed in tonnes.
5. A shoulder is the area where a ship’s hull form changes from the bow shape to the parallel mid-body.
6. Centre lead aft—a guide for a mooring line (a fairlead) which enables the line to be passed through a ship bulwark without snagging or fouling and is mounted on the centreline of the ship (centre) at the stern (aft).
7. No evidence was provided to show that AuxDG2 was brought on load or that the electrical preferential trips activated to reduce the load on AuxDG3.
8. Many of the main engine systems and services (including engine control) are provided by electrical machinery and equipment. Consequently, when electrical power was lost the main engine also stopped.
9. Transverse arrest is a method of using a tug to slow the speed of a ship by having the tug on a line astern with its thrusters pointing at 90° to the travel. Large forces can be generated due to the athwartships component of the tug propeller wash creating drag.
10. ClassNK—the ship’s classification society. See later Classification section in Context for more detail.

Context

Bulk India

At the time of the incident, Bulk India was registered in Panama, operated by Kowa Marine Service Co Ltd (Japan), owned by Southern Route Maritime S.A. and Nissen Kaiun Co Ltd (Panama), and classed with ClassNK (Nippon Kaiji Kyokai).

Bulk India’s navigation bridge was equipped with navigational equipment consistent with SOLAS^[11] requirements. The layout included a control console with radars, Electronic Chart Display and Information System (ECDIS), main engine controls, a machinery alarm panel, a steering stand and communications equipment. The console was located on the ship’s centreline, just forward of the chart table

Crewmembers

Bulk India had a complement of 23 Philippines nationals all qualified for the positions which they held.

The master had 33 years’ experience at sea, 20 years with Kowa Marine Service, held a Philippine master’s certificate of competency and had sailed as master since 2011. The master had joined Bulk India during November 2017.

The chief mate had 37 years of sea-going experience, worked for Kowa Marine Service for 5 years, held a Philippine certificate of competency and had sailed as chief mate for 1 year.

The chief engineer had 35 years of sea-going experience, 26 years with Kowa Marine Service, held a Philippine chief marine engineer’s certificate of competency and had sailed as chief engineer for 3 years.

The first engineer had 19 years of sea-going experience, 2 years with Kowa Marine Service, held a Philippine marine engineer’s certificate of competency and had sailed as first engineer for 4 years.

The third engineer held a Philippine marine engineer’s certificate of competency, had worked for Kowa Marine Service for 10 years and had sailed as third engineer for 5 months.

The chief mate and the chief and third engineers joined Bulk India during October 2017. The first engineer had joined the ship during May 2017.

Machinery

Bulk India’s main engine was a Mitsui MAN B&W 6S70MC delivering 16,860 kW via a directly driven, fixed pitch propeller at 91 rpm. The ship had three Daihatsu 5DK-20 auxiliary diesel generators. Each provided 560 kW of electrical power at 60 Hz.

Auxiliary cooling fresh water system

Bulk India’s auxiliary diesel generator engine cooling fresh water system was a closed system with contents maintained via an expansion tank. Water was circulated through each engine and the common auxiliary fresh water cooler via engine driven pumps (Figure 4). Sea water for the cooler was supplied by external electric motor driven pumps. The temperature of the fresh water returning to the pump suctions was monitored and a pneumatic controller adjusted a three-way control valve to control the temperature.

Without electrical power and with all engines stopped, the cooling water (fresh and sea water) was not circulated. Therefore, temperature control during engine start-up relied upon thermal inertia within the engine mass and the volume of cooling water in the system to provide time for the cooling system to become effective. If the engine did overheat, safety interlocks prevented it from being restarted until the cooling fresh water outlet temperature reduced below a threshold and the shutdown circuit reset.

The main engine fresh water cooler could be used in place of, or to supplement, the auxiliary fresh water cooler if the need arose (during maintenance or for emergency cooling). However, this arrangement continued to rely on the auxiliary engine cooling water temperature controller and control valve. Therefore, the temperature of the cooling water for the ship’s main source of electrical power was reliant upon operation of the one controller and one control valve.

Figure 4: Auxiliary diesel generator engines cooling fresh water system

Source: Kowa Marine Service, annotations by ATSB

Pneumatic temperature controller

The pneumatic automatic indicating controller sensed the cooling water temperature in the line to the pump suctions and compared this to the desired temperature. The difference in temperatures was converted to air pressure which was sent to the control valve to adjust the valve position and water flow accordingly.

The controller was supplied with air from the ship’s 0.7 MPa control air system. The control air mains was filtered and dried before a branch line passed through a filter-regulator unit at the input to the controller. The controller internal components included fine nozzles, orifices and pathways for air flow, the blockage of which would cause the controller to malfunction. Reliable operation of the controller therefore depended upon the quality of the air supplied and regular maintenance.

At the time of the incident, Bulk India’s planned maintenance system (PMS) included maintenance tasks for the control air system including checks of the reservoirs, in-line filter, dehumidifier, auto drains and reducing and relief valves. The PMS did not include maintenance tasks (for example, function tests over the full range of operation in manual and automatic modes) for control equipment for individual systems such as the auxiliary cooling water.

Control valve

The final control element in the auxiliary engine fresh water cooling system was the three-way control valve with pneumatic actuator and manual hand wheel (Figure 5). The valve position was controlled by air pressure from the controller, which pushed the valve spindle down against spring pressure. The hand wheel was not physically connected to the diaphragm or the valve spindle. In automatic mode the hand wheel was in the fully up position (turned fully counterclockwise) so that it remained clear of the diaphragm and did not impede the full range of motion.

Figure 5: Three-way, single-acting pneumatic temperature control valve

Source: Kowa Marine Service, annotations by ATSB

In the non-energized condition (fail-safe with no air pressure applied), the valve allowed full flow from the cooler outlet to the pump suction (flow from the engine outlets was closed). All water flow from the engines was directed through the cooler (Figure 6 left). The valve body position indicator pointed to this as ‘cooler open’.

Figure 6: Control valve flow positions

Line A – to engines, B – from engines, C – from cooler.
Source: Kowa Marine Service, annotations by ATSB

As air pressure was applied on top of the diaphragm, the valve spindle moved down and warmer water from the engine outlet bypassed the cooler and mixed with the cooler water from the cooler. The full air, extreme position was the ‘bypass open’ position with no flow through the cooler (Figure 6 right).

For manual operation, the hand wheel acted in place of the air pressure. When pressure was vented, the spring moved the valve spindle (and diaphragm plate) fully up, against the thrust piece attached to the end of the hand wheel spindle. This (upper) position initially provided full flow through the cooler. The hand wheel was then wound down or up to decrease or increase cooling respectively, as required.

Previous blackout

On 26 February 2018 (2 weeks before the incident), Bulk India had a blackout due to auxiliary diesel generator high cooling fresh water outlet temperature. Afterwards, the sea water side of a limited number of engine coolers (lubricating oil and charge air) were cleaned. No evidence was recorded to show whether the fresh water cooling or temperature control systems were identified as faults.

Emergency generator

When the mains power supply is lost, a ship’s emergency generator is required to automatically start and supply power to essential equipment, including the steering gear and emergency lighting.^[12],^[13]

Bulk India was fitted with a Demp^[14] MAN type D2866TE emergency generator providing 140 kW at 60 Hz. The engine cooling water was circulated by an engine driven pump and cooled through a front end mounted radiator with engine driven fan.

Fan belt

About 7 months before the incident, on 29th July 2017, Bulk India was loading cargo at San Nicolas, Peru. During routine testing of the emergency generator, the fan belt failed. This failure was reported to shore management, accompanied by a request for replacement belts. The requisition indicated that there were no spares on hand and was marked urgent. This stores request was repeated a month later in August 2017.

Some delays were experienced in sourcing the parts and they were not supplied to the ship before it departed Peru almost 3 weeks later. From then, until arriving into Dampier on 9 March 2018, Bulk India visited nine ports. The required emergency generator fan belts did not reach the ship at any of these ports. The company was unable to provide an explanation as to how this occurred.

The master and chief engineer stated that the emergency generator would start and take load but could only run for a short time before overheating and shutting down. However, no officials, including in the ports visited, or other authorities such as the flag Administration or Class were made aware of this situation.

Bulk India maintenance records showed that the emergency generator was inspected and test run each week. The generator was shown to be in good condition, with no defects recorded since July 2017. A blackout test was conducted on 30 December 2017 while the ship was at anchor. No record of fan belt condition, that spares were on order, or other relevant details were recorded on the inspection sheets.

Critical equipment and functions

The International Safety Management (ISM) Code^[15] required that ship operators identify equipment and technical systems the sudden operational failure of which may result in hazardous situations—that is, critical systems. The company’s safety management system (SMS) should provide for specific measures aimed at promoting the reliability of such equipment or systems and these should be included in the ship’s maintenance routines. The measures should include the regular testing of stand-by arrangements and equipment or technical systems that are not in continuous use. It follows that systems associated with the operation of critical equipment should also be identified. This includes maintenance and spare parts.

At the time of the incident, Kowa Marine Service did not have in place systems and procedures to monitor and maintain the reliability of identified critical equipment, including maintaining spare parts inventory.

Port of Dampier

The Port of Dampier is one of Australia’s largest bulk export ports and is located about 1,550 km north of Perth, Western Australia. The port comprises public and private port terminals, which predominantly service the iron ore industry of the Pilbara region and the oil and gas fields of the North West Shelf (together more than 94 per cent of cargo throughput).

The terminals are functionally separate (including separate towage and pilotage services), legislatively governed by the Pilbara Ports Authority (PPA).^[16] The PPA provides Vessel Traffic Services (VTS) for multi-user facilities, port communications, and oversees marine safety and port security. The PPA also issues licences for port services including pilotage, towage, lines boats, bunkering, pilot boat transfers, security, stevedoring and waste management. The PPA provides information and directions on ship operations within Dampier port limits with specific terminal information provided by the individual terminal operators.

During financial year 2017-2018, the port had more than 9,500 vessel movements and in excess of 177,000,000 t cargo throughput. Of this, more than 145,000,000 t of iron ore was exported, representing 82 per cent of the port’s total cargo throughput.

Vessel Traffic Service

The Pilbara Ports Authority—Port of Dampier was authorised as a Vessel Traffic Service (VTS) Authority and provided an Information Service (INS) and a Traffic Organisation Service (TOS).^[17] All areas within port limits and anchorage areas immediately adjacent were covered by the VTS service.

Pilotage

The PPA was to ensure pilotage services were provided within the port, ensure pilotage providers were licensed, and approve individual pilots. Pilotage within port limits was compulsory for all vessels over 35 m in length or 150 gross tonnes, unless the master held a current exemption certificate.

Three pilot service providers had been licensed by the PPA with Marine Services Western Australia (MSWA) the supplier of pilotage services under contract to Rio Tinto in Dampier. The MSWA website provided relevant pilotage information, including waypoint passage plans and master-pilot exchange of information forms (www.mswa-pilots.com.au).

The pilot in charge (PiC) on board Bulk India joined MSWA in 2011 and was a fully licensed (unrestricted) pilot for the Port of Dampier. The PiC first went to sea with the Royal Australian Navy in 1985, moved to the offshore industry in 1998, completed a master Class 1 certificate of competency in 2001 and moved to pilotage in 2008. Recent activities involved up to two, or infrequently, three pilotages per day. After being well rested, Bulk India was the PiC’s second pilotage for 11 March.

The peer pilot had an unrestricted licence, had been piloting in Dampier for 6 years after obtaining a master Class 1 certificate of competency in 1992 and had more than 15 years’ pilotage experience in New Zealand and Australia. On 11 March, the peer pilot was conducting a routine peer review of the PiC to satisfy MSWA and the PPA requirements.

Towage

The PPA issued licences for Dampier port towage services. At the time of the incident, Westug was licensed to provide towage services to Rio Tinto, under contract. This included operating and maintaining the Rio Tinto fleet of 11 tugs plus lines and pilot boats.

The Rio Tinto Dampier and Port Walcott Port Handbook (July 2016) provided guidance on typical towage requirements for all Rio Tinto berths. For departure from Parker Point berth 5, the guidance stated that two tugs were to be in attendance with one tug to escort the ship into the Rio Tinto Channel and accompany the ship to the Fairway beacon.

Rio Tinto—Dampier

In the Pilbara region of Western Australia, Rio Tinto operated an integrated network of 16 iron ore mines, four port facilities, a 1,700 kilometre rail network, and related infrastructure. Dampier port facilities comprised the Parker Point and East Intercourse Island terminals, and Rio Tinto had exclusive use of the channels servicing these terminals. This included the Rio Tinto Channel and the Parker Point Departure and Approach channels.

Specific terminal and berth information and guidance for ships calling at Rio Tinto’s Dampier terminals was available via the Rio Tinto Dampier and Port Walcott Port Handbook (accessible at the time of the incident via the Rio Tinto website).

Pilotage from Parker Point

Ships departing Parker Point transited a 15 NM channel and sea-track maintained to a depth of 15.5 m (Figure 7). From the Parker Point berthing pocket, the channel led on 270° before curving north. After about 2 NM it met the channel from East Intercourse Island at a point called Mid Ground (MG). A single straight channel extended from MG about 5 NM to the Fairway channel marker (FW), where ships continued along a natural deep water track to the sea buoy (SB). The transit from berth to sea buoy took about 2 hours.

At the time of the incident, usual practice was for ships departing Parker Point, once clear of the wharf, to be escorted by a single tug, tethered centre lead aft until FW. From FW, the ship proceeded under its own engines along the deep water track to sea. However, on a trial basis, and in the case of Bulk India, two tugs were to escort ships until past MG, with the second (short escort) tug made fast on the port shoulder. The short escort tug remained until the ship completed the turn into and straightened up in the Rio Tinto Channel and it was considered to be of no more assistance. At this point, usually in the vicinity of channel beacon 7E, the tug was released from duty and departed. The aft tug remained made fast until FW before being dismissed.

Figure 7: Navigation chart Aus58 of the Port of Dampier showing the track from Parker Point to sea. Inset shows part of navigation chart Aus60 with detail from Parker Point

Source: Australian Hydrographic Service, annotated by the ATSB

Tug escorting assessments

Rio Tinto risk management defined the tolerable frequency for any grounding event as once in 10 years. To quantify the risk, in 2012 and 2016 Rio Tinto engaged third parties to conduct studies into the risks of loaded ships grounding during departure from the Dampier port. These studies used ship movement and incident data collected for ships servicing Rio Tinto’s Dampier facilities. The 2016 study used improved data collection methods and results, as well as experience from simulation training completed by harbour pilots and tug masters. This study assessed the risk of ship groundings for variations in the method and distance for tug escorting out of the port.

The study found that the majority of groundings were likely to occur within the channel,^[18] before FW. Out-of-channel groundings were most likely to occur beyond FW. The most likely outcome was an in-channel grounding, resulting in no environmental release and impacting the port for one day during salvage. The grounding risk was found to lie on the threshold of Rio Tinto acceptance and required active monitoring.

In 2016, the usual practice was to maintain a single escort tug to FW. The study found that more tugs, escorting for longer, would reduce the probability of a single ship experiencing a grounding event. If two tugs were used for escort, there was a significant reduction in risk of a grounding event, compared to no tug escort or the use of a single tug escort. The 2016 study recommended adoption of this lower risk escort strategy.

Towage training

Marine Services Western Australia (MSWA) and Westug had undertaken programs of simulator-based emergency response training for MSWA pilots and Westug Dampier tug masters. The exercises were intended to provide familiarisation in standard escort tug manoeuvres and competence in their use. The aims were to equip pilots and tug masters with enhanced knowledge and techniques so as to locate assets in the most effective/efficient positions, taking into account the conditions at the time.

As part of the training, pilots and tug masters completed exercises together.^[19] Emergency and contingency manoeuvres were performed to identify options available to keep the ship safe. Differing locations for the tugs and variations of indirect and direct towage were trialled to determine limitations or unnecessary risk to assets. To reduce the risk of confusion, the exercises also included the use of standard communication techniques, commands and terminology.

The simulator training programs included attendance by and input from Rio Tinto personnel and the Dampier harbour master. Specific scenarios and outcomes were discussed amongst all attendees with simulation results then used to guide port towage policies and procedures.

The PiC of Bulk India had completed simulator training during October 2017. Experience gained and techniques practised during the simulator exercises were employed by the pilots and tug master(s) during the incident and recovery from it.

Classification—ClassNK (Nippon Kaiji Kyokai)

A classification society is a non-governmental organization that establishes and maintains technical standards for the construction and operation of ships and offshore structures. Classification is to verify the strength, integrity, function and reliability of a ship’s structure and systems in order to maintain essential services on board.^[20] Classification societies aim to achieve this through the development and application of their own rules and by verifying compliance with international and/or national statutory regulations on behalf of flag Administrations. Activities which generally fall outside the scope of classification include such items as design and manufacturing processes. ClassNK advised the ATSB that Class is not a designer who considers the philosophy behind a design. Rather, Class is the inspector who validates and reports that the ship's construction is in accordance with relevant international regulations.

ClassNK rules^[21] required that special consideration be given to the reliability of essential machinery and equipment that affects the normal operation of the propulsion machinery, such as the main source of electrical power or sources of water pressure. Rules governing cooling systems were restricted to the more general piping systems rules. Pumping requirements were prescribed, but specific cooling system automation or control requirements were not.

In addition to main sources of electrical power, the rules required ships to have a self-contained emergency source of electrical power. When this was an emergency generator, it must start automatically within 45 seconds of failure of the main source of electrical power. It must also be capable of supplying sufficient power to all services that are essential for safety in emergencies, including lighting, communications, navigation and steering systems.

The rules also list the minimum spare parts required for machinery installations, including diesel engines, generators or auxiliary machinery essential for main propulsion, but not emergency generators. The requirements did not extend to the identification of spare parts for support systems such as cooling water.

Ship inspection

Ship vetting (RightShip)

RightShip^[22] is a commercial organisation that provides risk management and environmental assessment to the maritime industry. The company provides an online ship vetting tool (RightShip Qi), which uses predictive analytics to determine the likelihood that a ship will have an incident in the following 12 months. The customer is then provided with an indication of the risk involved in selecting a particular ship for charter. The system utilises analysis of data and records from multiple sources and questionnaires to assess the ship against RightShip and customer criteria. When a ship is vetted, it undergoes a risk assessment to determine its relative safety for a particular voyage.

The system assesses against criteria related to terminal requirements include ship mooring capabilities, cargo/ballasting capabilities, ship loader compatibility, gangway details, helicopter capability, senior officer experience and ship details. The question of condition of the ship machinery and equipment is limited to Port State Control history, validity of certification (including Class), and incident history.

A RightShip Qi vetting of Bulk India was requested on 22 February 2018 for the voyage from Dampier to China. Records show that the terminal questionnaire was marked ‘satisfactory’, and the ship had no adverse reports and was recommended for approval. The RightShip risk star rating at the time was four stars.^[23] Bulk India had undergone the RightShip vetting process on at least six occasions since the start of 2014. Of these, one vetting was unacceptable due to the ship being unable to fulfil all customer requirements.

Under some circumstances (including age, ship modification or customer request) a ship may have a physical inspection. The RightShip ‘Dry bulk inspection’ is used to validate a ship’s condition, capabilities and application of its safety management system. The RightShip ‘Inspection and Assessment Report for Dry Cargo Ships (FOD06)’ checklist includes determining if ‘All stores/spares requisitions are filled in less than 30 days’. No record of Bulk India having undergone a physical vetting inspection was provided.

Port State Control inspections

Port State Control (PSC) is an internationally agreed program for the inspection of foreign ships in other national ports. International conventions and the United Nations Convention of the Law of the Sea (UNCLOS) give responsibilities to flag States to check and control ships in their waters, so that they do not pose threats to ship and crew safety or to the marine environment. If a ship is found to have deficiencies, it may be detained until the issue is resolved.

Bulk India had been subjected to 15 Port State Control (PSC) inspections, including follow-up inspections, since 2012. The most recent inspection prior to the incident was during November 2017 while the ship was in Lianyungang, China. None of the inspections highlighted issues with power generation or with the emergency generator.

__________

11. SOLAS - The International Convention for the Safety of Life at Sea, 1974, as amended.
12. SOLAS Chapter II – 1 Reg 43: Ch II-1 Construction – Structure, subdivision and stability, machinery and electrical installations, Part D Electrical installation, Reg. 43 Emergency source of electrical power in cargo ships
13. Classification society (ClassNK) rules require that the emergency generator must automatically supply power within 45 seconds and supply the steering system for at least 30 minutes of continuous operation.
14. Demp – Danish engineering and marine power
15. The International Management Code for the Safe Operation of Ships and for Pollution Prevention
16. Pilbara Ports Authority (PPA) operates as a Western Australian Government Trading Enterprise, and is governed under the Port Authorities Act 1999 WA.
17. Information Service (INS) is defined as provision of relevant information at appropriate times and on request for the VTS area. Traffic Organisation Service (TOS) is defined as a service to prevent the development of dangerous maritime traffic situations and to provide for the safe and efficient movement of vessel traffic within the declared VTS area.
18. The study defined an in-channel grounding as one which occurred on the channel boundary and obstructed about 60 m of the channel width. Out-of-channel grounding occurred within 3,000 m of the channel boundary, beyond which it was assumed not to have grounded.
19. The simulator facilities used provide multiple bridge simulators and a tug simulator which can be used individually or configured to interact and complete the same scenario.
20. Refer to International Association of Classification Societies (IACS) for additional information
21. Rules for the Survey and Construction of Steel Ships, Part D Machinery and Part H Electrical Installations.
22. Information available at www.rightship.com
23. Rightship analysis for 2014-2015 showed that a 1-star bulker was 19 times more likely to have an incident than a 5-star bulker.

Safety analysis

Bulk India ran aground as a result of an electrical blackout, which caused a loss of propulsion and steering control. This analysis will explore the equipment and machinery factors leading up to the blackout and recovery from it. This will include the condition and operation of the electrical generators and associated systems, maintenance and spare parts. In addition to this, bridge communications and the implications on emergency event response and recovery will be discussed.

Grounding

After the blackout occurred at 1433, the failure of the emergency generator meant the ship lost all power. This resulted in the loss of steering control which meant that the rudder could not be moved from 20° to port. Bulk India had commenced turning to port when all power was lost and, in the limited time available, Pilbara Vulcan was unable to stop the ship from continuing the turn. About 90 seconds after the loss of power, the PiC determined that the ship was going to run aground and redirected the tug so as to limit any damage.

It is likely that had the emergency generator worked as designed, control of the rudder would not have been sufficient to prevent the turn to port continuing, and the ship running aground. Several factors have led to this conclusion, including:

• the time for the emergency generator to start and take load (45 seconds)
• the time for bridge personnel (ship and pilots) to assess the situation, react and verify control of the rudder
• the time to turn the rudder from port to starboard
• the time to reposition the tug and apply weight
• the reduced effectiveness of the rudder due to the reduced flow over its surface
• the time taken for the tug and rudder to overcome the turn momentum of the loaded ship and turn it away from the channel side.

Auxiliary generator overheating

The exact cause of the cooling water temperature control malfunction was not determined. However, air pressure remained applied to the diaphragm until the engineers removed the air supply pipe. That is, the controller continued to supply air to the valve even though increasing temperature of the cooling water to the pumps should have led to the air pressure being reduced. It was therefore likely that this was caused by an air pathway blockage within the pneumatic controller.

Temperature control via a single-acting, spring return, pneumatically controlled three-way valve is a common arrangement used on ships. However, when the control valve was stuck in the cooler bypass position, the engineers did not know how to manually operate it. Had the air pressure been vented and the valve changed to manual control when first discovered, it is likely that the temperature of the cooling water would have been controlled and the engines would not have overheated.

As a single point of failure, this equipment should have been identified as critical and its associated systems understood by the crew and regularly tested. This would include maintenance of the valve, as well as the control air supply and system. It would also include understanding of, and familiarity with, auto-manual operation of the controller and the valve.

Emergency generator

The emergency generator overheated and shut down because the radiator fan drive belt had failed several months prior and had not been replaced. As a result, the engine would only run for a few minutes because there was no fan belt. Regular routine testing meant that the condition of the machinery was well known.

ClassNK rules required that the emergency generator start automatically, within 45 seconds of a blackout, and supply sufficient power for at least 30 minutes’ continuous operation of the steering gear (longer for other emergency services such as lighting). Bulk India’s emergency generator was not capable of meeting these requirements and was therefore unserviceable and not fit for purpose. This represented a condition that directly affected the safety of the ship. It was also a reportable deficiency that should have been rectified as soon as possible.

Critical spares

At the time, Bulk India and the wider Kowa Marine fleet did not have an adequate procedure or system to monitor and maintain reliability of critical equipment. Had they done so, the emergency generator fan belts would have been identified as critical to the safe operation of the ship and their inventory level maintained to ensure that replacement belts were always available at short notice.

Furthermore, there were no procedures in place that progressed and tracked an urgent request for spare parts. As a result, the ship was not notified that these critical spares were en route or when to expect them to arrive. As a consequence, the emergency generator fan belt had not been replaced, despite having been received on board. It also meant that Bulk India had sailed for more than 7 months with an emergency generator that was unserviceable and would not operate as required.

Communication during pilotage

The pilots were not informed of machinery problems which could directly affect the safe navigation of the ship (including the state of the emergency generator) at any time prior to the blackout occurring. Conversations between the master, chief engineer and others, relevant to the deteriorating situation in the engine room, were not in a language the pilots could understand, which removed an opportunity for the pilots to be informed. Even so, the master had opportunity outside of these conversations to inform the pilots, but did not do so.

The first opportunity was soon after the first cooling water high temperature alarm at 1420; 13 minutes before the blackout occurred. Secondly, after AuxDA1 tripped at 1427, at least two phone conversations were held between the bridge and engine room in the following 2 minutes. This was still about 4 minutes before the blackout. Without this knowledge, the short escort tug, Pilbara Titan, was released from duty at 1430, 10 minutes after the initial alarm and 3 minutes before the blackout. Had the pilots been aware of the escalating problems, their actions would have most probably changed, including that the short escort tug would not have been released when it was. This may have led to a more favourable outcome, including the possibility of avoiding the grounding.

The absence of effective communication therefore removed the opportunity for the pilots to prepare for the loss of power and control. Consequently, reactions which may have assisted in a more timely or more effective response were unnecessarily delayed.

Findings

From the evidence available, the following findings are made with respect to the grounding of Bulk India during departure pilotage from Dampier, Western Australia on 11 March 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• Whilst Bulk India was transiting the Rio Tinto Channel, all electrical power was lost. Control of the ship and its manoeuvrability were lost and the rudder remained fixed at 20° to port. The ship turned to port and contacted the channel side, running aground.
• Electrical power was lost when the auxiliary diesel generator engines shut down due to overheating of the cooling water. A fault in the pneumatic controller resulted in the cooling water bypassing the cooler and overheating.
• When the temperature control valve stuck in the cooler bypass position, the engineers did not know how to manually operate the valve. Had the valve been correctly manually operated when first discovered, it is likely that the temperature of the cooling water would have been controlled and the engines would not have overheated.
• Bridge communications were ineffective and the pilots were not informed of the machinery problems prior to the blackout occurring. This removed the opportunity for the pilots to prepare for the loss of control and delayed actions which may have assisted in a more timely or more effective response.

Other factors that increased risk

• The emergency generator was not fit for service as it was unable to provide sustained electrical power to the ship and steering. The engine overheated and shutdown because the radiator fan drive belts had failed several months prior and had not been replaced.
• No procedure or system was in place to ensure critical spares were identified and their inventory controlled to ensure availability when required. As a consequence, the fan belts for the emergency generator had been on order for several months. [Safety issue]

Safety issues and actions

Critical spares

Safety issue number: MO-2018-004-SI-001

Safety issue description: No procedure or system was in place to ensure critical spares were identified and their inventory controlled to ensure availability when required. As a consequence, the fan belts for the emergency generator had been on order for several months.

Safety action not associated with an identified safety issue

Additional safety action addressing Dampier port operations

Rio Tinto Iron Ore (RTIO) and Rio Tinto Marine (RTM), both part of the Rio Tinto group of companies, advised that changes have been made to several areas of business operations in response to investigations into the grounding of Bulk India. Actions included:

• Following the incident, ‘immediate containment’ changes included extension of the short escort tug attendance to number 5 beacons. This remained in effect until additional reviews of towage arrangements had been completed.
• Rio Tinto actively engaged with Dampier port stakeholders (marine pilots, towage, Dampier harbour master and port operations) to undertake a risk-based review of vessel escorting practices and procedures. The current Dampier (and Port Lambert) escort towage risk assessments were reviewed and multiple simulation exercises were completed to determine the effectiveness of escort towage practices (including in emergency situations). The assessments, exercises and discussions resulted in changes to escort towage arrangements for vessels departing Dampier—in particular, the short escort tug was extended to number 3 beacons (Figure 7) with the primary escort tug remaining to the Fairway buoy.
• RTM, in conjunction with Marine Services Western Australia (MSWA) pilots and Westug towage, have developed a ‘Guidance manual for ship towage operations: Dampier and Port Walcott’. This manual was aimed at providing clear ‘guidance for personnel associated with terminal towage and pilotage operations in order to address risk mitigation, maintain the highest industry standards and meet regulatory compliance.’
• RTM circulated a safety bulletin to vessels, brokers and owners advising of actions expected to be taken immediately: all critical machinery to be checked and operational; associated machinery and plant to be in good order; to identify and ensure sufficient stock of critical spares; review and to reiterate bridge resource management techniques including command and communications.
• Completing improvements to ship vetting (including RightShip) through improved oversight, amended frequency of ship inspections and audits.
• Improving engagement with global ship owners and managers (for example through shipping safety forums) to enhance relationships and clarify standards and expectations in relation to vessel safety, asset quality and maintenance.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the master and crew of Bulk India
• Kowa Marine Service
• Rio Tinto Marine (Dampier)
• Rio Tinto Iron Ore (Dampier)
• Marine Services Western Australia (MSWA)
• Westug
• ClassNK
• the Australian Maritime Safety Authority
• Bulkseas Marine Management.

References

ClassNK (Nippon Kaiji Kyokai) 2018, Rules for the Survey and Construction of Steel Ships, ClassNK. Available at www.classnk.or.jp

International Maritime Organization (IMO) 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.

International Maritime Organisation (IMO) 1995, International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code) as amended, IMO, London.

Oil Companies International Marine Forum (OCIMF) 2018, Safety Critical Equipment and Spare Parts Guidance, OCIMF, London. Available at www.ocimf.org

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• master and chief engineer of Bulk India
• the pilot in charge
• the peer pilot
• Kowa Marine Service
• Rio Tinto (Dampier)
• Pilbara Ports Authority – Dampier harbour master
• Marine Services Western Australia (MSWA)
• Westug
• Australian Maritime Safety Authority
• Panama Maritime Authority
• Bulkseas Marine Management.

Submissions were received from:

• Kowa Marine Service
• Australian Maritime Safety Authority
• Pilbara Ports Authority – Dampier harbour master
• Rio Tinto (Dampier)
• Marine Services Western Australia (MSWA)
• Westug
• Bulkseas Marine Management.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Additional ship details

Ship details

Appendices

Appendix A—Table of selected AIS data for Bulk India’s departure from Dampier

Appendix B—Bulk India Pilot card

Appendix C—Marine Services Western Australia master/pilot exchange of information (MPX) form

Copy of MPX form in use on the day. Page 1:

Marine Services Western Australia master/pilot exchange of information (MPX) form. Page 2:

__________

24. UTC +8 hours.
25. Speed over the ground in knots.
26. Course over the ground in degrees true.
27. Heading in degrees true.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At about 1454 Eastern Daylight‑saving Time^[1] on 5 March 2018, the 143 m, self‑unloading cement carrier Goliath (Figure 1) arrived in Melbourne, Victoria, after a 21-hour voyage from Devonport, Tasmania. Cargo operations commenced and continued into the following day. At about 2330 on 6 March, the master was informed that there were problems with the cargo quality making it difficult to discharge, and consequently departure would be delayed. At midnight, the third mate completed his cargo watch and prepared for the vessel’s departure but, as departure was delayed, at 0200 he was relieved of his duties by the master and retired for rest. The chief mate was roused from sleep at 0230 to attend to the cargo issues and cargo discharge was completed soon thereafter. The chief mate then remained on duty for departure and for his normal 0400 to 0800 navigation watch.

Figure 1: Goliath

Source: Lester Hunt, MarineTraffic.com

At 0315, on 7 March, under the guidance of the pilot exempt master,^[2] stand-by for departure was called. At 0718, Goliath commenced sea passage bound for Devonport. At 0800, the chief mate handed the navigation watch to the third mate. During watch handover, in addition to navigation information, the planned ballast water exchange operation was discussed. The chief mate also advised that he would be inspecting the cargo holds during the morning.

In addition to normal navigation and shipboard routines, a shore-based trainer had embarked in Melbourne to conduct a programme of onboard training during the voyage to Devonport. Two sessions were to be held, from 1300 to 1500 and 1530 to 1730. The navigation watches were altered to allow the rostered officer of the watch (OOW) to attend one of the training sessions.

At 0815, the third mate, as OOW, commenced the routine ballast water exchange as required under the ship’s ballast water management plan.^[3] Ballast movements (water in or out) followed a prescribed sequence and timing, as laid out in the plan. The ballast pumps and remotely operated valves were controlled and their status (open or closed) monitored by the OOW from the ballast control panel located in the ship’s wheelhouse. Assistance around the ship was provided by the duty integrated rating (IR), who operated manual ballast valves, sounded tanks (measured water levels), and removed tank access covers as required. There was no way to remotely monitor the status of the manual valves, and no record was routinely taken of the valves in use and their status. Verification of the manual valve status was reliant upon communications between the OOW and the duty IR, via the ship’s handheld UHF radios.

Goliath’s ballast system consists of eleven tanks. Ten tanks are located forward of the engine room and one tank aft, the after peak. The system is serviced by two 500 m³/hr ballast pumps via a ring main which could be split via an isolating valve at the bow. This allows number 1 ballast pump to be configured to service the after peak tank and the starboard side ballast tanks, and number 2 pump to service the fore peak tank and the port side ballast tanks. This effectively segregated the two pumping systems, was the usual configuration, and was in use on 7 March.

At 1200, the second mate took over the watch and the ballasting operations. Elsewhere, the chief mate had completed hold inspections and rested until 1500 after which he was scheduled to attend the training. The second mate attended training from 1300, and the third mate returned to the bridge at that time to take the watch.

At 1420, the ballast system was configured to complete the after peak tank water exchange. At 1453 the second mate returned to the bridge to again take over the watch. However, the third mate retained the watch to complete the after peak tank ballasting which involved lowering the level to 8.5 m for ship stability requirements.

At 1500, the third mate contacted the duty IR and asked that the two after peak manually operated valves be closed (Figure 2). For reasons that could not be determined, the requested valve closures were not actioned. The third mate did not confirm with the IR that the message had been received and actioned so he was unaware that the valves connecting the after peak tank to the starboard ballast main had not been closed.

The watch was handed to the second mate who then continued with the next scheduled ballast movement of exchanging the water in the fore peak tank, also unaware that the valves to/from the after peak tank remained open. The third mate left the bridge and attended training before going to bed thereafter. The chief mate attended the same training session and the second mate remained on watch beyond 1600, when the chief mate usually took the watch.

At 1620, flow-through water exchange^[4] of port and starboard ballast tanks commenced. This involved the use of both ballast pumps and systems. At 1730, the chief mate came onto the bridge and took over the watch.

Shortly thereafter, at 1736, an engine room alarm (aft bilge well high level) activated and the duty engineer (first engineer) responded. Upon entering the engine room, the first engineer noticed water flowing over the doorstep through the open steering gear room door. This water drained to the aft engine room bilge, resulting in activation of the alarm. The first engineer discovered water coming from a scupper pipe in the steering gear room, which drained into the steering flat bilge well. This bilge well was not fitted with an alarm and was manually drained to the engine room bilge. Consequently, it had overflowed, leading to flooding of the deck to a depth of about 10 cm. The water then overflowed the doorstep, into the engine room, and to the aft bilge well.

Figure 2: Part of the ballast system piping diagram showing valve configuration for pumping out the after peak tank (APkTk)

Source: CSL Limited, annotated by ATSB

The first engineer noted that the water was salt water but could not find an obvious source in the adjacent spaces. He contacted the chief engineer and the bridge, informed them of the flooding, and inquired about the ballasting process. He also contacted the third engineer and requested he attend the engine room to assist. The first engineer then returned to the engine room to begin transfer of the aft bilge well contents to the bilge holding tank.

At 1745 the ballasting operations were stopped and tanks sounded. The after peak tank sounded at 11.54 m, 3 m higher than at the completion of after peak tank ballasting at 1500. At 1752, after checking stability conditions, the chief mate started pumping down the after peak. The chief mate also directed the duty IR to check the after peak tank ballast line valves. Both valves were found to be open.

Continuing investigations then found water coming up the drain in the CO₂ room, (located on the deck above and atop the starboard side of the steering flat). The senior officers discussed the situation and agreed the most likely cause was a holed scupper pipe running through the after peak tank.

At 1802, the chief engineer informed the master that water had stopped coming from the scupper pipe in the steering flat. The after peak tank was now at 8.37 m and was further lowered to 4.64 m. At 1830, the ballast pump was stopped. Other spaces were checked and tanks sounded. At 1918, a sounding of the after peak tank confirmed that the level was unchanged.

It was determined that the leak had been stopped and the ship was safe to continue passage. At 2224 on 7 March, Goliath was all fast alongside in Devonport.

A tank entry and inspection of the after peak tank found the scupper line from the CO₂ room holed, on the outboard (back) side of the pipe, adjacent to the ship’s side, just below the tank top (Figure 3). This line ran through the after peak tank before passing through the steering gear room bulkhead to drain into the steering gear room bilge well. The rear of the elbow piece directly below the tank top was heavily corroded and wasted with most of the pipe wall missing.

The tank was rarely filled to a depth which covered the holed section of pipe. However, when the starboard ballast tank was pressed up to overflowing, the open valves to the after peak tank allowed it to also fill. As the tank neared full, water covered the hole in the pipe, drained into the steering gear room bilge well and overflowed.

Figure 3: Scupper pipe in after peak tank showing corroded and holed elbow

Source: CSL Limited, annotated by ATSB

A condition of class was placed on the ship until suitable repairs had been completed. In the meantime, any ballasting was to be completed with additional monitoring of this area of the ship and tank levels. Procedures were amended to require the duty officer to keep a log of all manual valve operations and ballasting of the after peak tank was to be conducted only during daylight hours. In addition, a status tracking board was made for the manual valves with moveable pegs to be used to show the status of each valve.

Initial repairs involving renewal of the CO₂ room drain line (about 7.5 m), deck and bulkhead penetrations were completed on 10 March. Final repairs, survey and testing were completed on 18 March and the condition of class was lifted.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The request to manually close the after peak tank ballast line valves was not confirmed or actioned as expected. This led to undetected filling of the after peak tank during subsequent ballasting operations.
• The after peak tank filled to a level sufficient for water to leak into the holed scupper line within the tank and drain into the steering gear room bilge well. This overflowed and flooded the steering gear room.
• There was no structured or formalised system of logging or tracking the status of ballast system manually operated valves. Thus, when closure of the after peak valves was not actioned or confirmed, there was no record at the ballast control panel to show the status of the valves.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Ship owner/operator – CSL Australia

As a result of this occurrence, CSL Australia has advised the ATSB that further to the immediate actions referred to earlier, the following safety actions have also been taken.

• Ballast tank inspection procedures have been reviewed and updated with added emphasis on internal tank fixtures
• During scheduled drydocking of Goliath in 2018 it:
  • fitted a ballast water treatment system in compliance with the Ballast Water Management convention which will remove the need for ballast water exchange
  • had the ballast tank remote sounding and alarm system replaced
  • had steelwork in the ballast tanks, including piping in the after peak tank, replaced.

Ship details

Safety message

Disruption of normal routine, increased workload and changes of shift personnel increase the potential for error. This is particularly important during short sea voyages. All activities carried out during these times need careful and particular attention to ensure all individual tasks are completed and/or their status passed to new personnel.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylight Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Goliath’s master had a pilot exemption for Melbourne and Devonport and piloted the ship into and out of each port. The master also acted as the ship’s agent.
3. Under Australian and International law, from 8 September 2017 all vessels are required to manage their ballast water in accordance with the International Convention for the Control and Management of Ships’ Ballast Water and Sediments, 2004.
4. Flow-through ballast water exchange involved removal of the tank access lids and continually overflowing the tank for a prescribed period of time.

Safety summary

What happened

At about 0828 Eastern Daylight-saving Time (EDT), on 12 March 2018, an Airbus Helicopters AS355F-1 helicopter, VH-SEV, operated by Rotor Head, air taxied from the hangar to the maintenance facility at Bankstown Aerodrome, New South Wales with the pilot and one passenger on board.

After about 5 minutes in flight, the pilot commenced the landing. As the skids touched the ground, the pilot observed the right-hand engine chip light illuminate and smoke coming from the right-hand side of the aircraft. The pilot immediately shut down the right-hand engine. Mechanics from a nearby workshop ran out and extinguished the engine fire.

The aircraft sustained significant damage to the engine and minor heat damage to the surrounding structure.

What the ATSB found

A single third-stage turbine wheel blade failed due to fatigue cracking, resulting in secondary damage to the engine and total engine failure. The rapid fatigue crack progression was probably caused by a momentary dwell in the speed avoidance range.

A number of fatigue cracks were present but not detected during the last inspection of the third-stage wheel. The size and nature of the cracks meant there was a low probability of detection using the method specified.

What's been done as a result

Rolls-Royce are in the process of redesigning the third-stage turbine wheel to improve its tolerance to fatigue cracking and operation at responsive wheel modes.

Safety message

Any operator, irrespective of their level of experience, can find themselves confronted with an unexpected failure. Therefore, it is important for operators to monitor aircraft performance parameters continuously for abnormal indications. Acting quickly to shut down malfunctioning hardware and following failure management procedures will ensure the best possible safety outcome, as demonstrated by the pilot in this occurrence.

During this investigation, Rolls-Royce advised the ATSB of a few key points regarding the operation of the Rolls-Royce 250 enhanced power turbine engine:

• A dwell in the order of a few seconds can be enough to initiate damage and propagate a crack to failure.
• The best way for an operator to monitor the transition through the speed avoidance range is to watch the needle on the N2 tachometer. If the needle stops, that constitutes a dwell.
• If an operator recognises or suspects an inadvertent dwell in the speed avoidance range, contact Rolls-Royce for advice.

Third-stage turbine wheel removed from VH-SEV showing damage

Source: ATSB

The occurrence

At about 0828 Eastern Daylight-saving Time (EDT)^[1] on 12 March 2018, an Airbus Helicopters AS355F-1 Helicopter, registered VH-SEV (SEV), operated by Rotor Head, air taxied from the hangar to the maintenance facility at Bankstown Airport, New South Wales for a routine maintenance inspection with the pilot and one passenger on board.

After about 5 minutes in flight, the pilot commenced the landing. As the skids touched the ground, the pilot recalled hearing a loud squeal from the right-hand side of the aircraft. The pilot scanned the instrument panel and observed the engine gas generator speed (Ng) drop to 55 per cent and the right-hand engine chip light illuminate. A few seconds later, the pilot saw smoke coming from the right-hand side of the aircraft and he immediately shut down the right-hand engine. Mechanics from a nearby workshop witnessed the event and acted quickly to extinguish the fire on the right-hand engine.

The incident resulted in substantial damage to the right-hand engine and minor heat damage to the surrounding structure on the aircraft.
__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.

Context

Aircraft information

The aircraft was an AS355F-1 helicopter manufactured in 1982 and first registered in Australia in 1994 (VH-SEV). It was a six-seater, twin-engine helicopter powered by two Allison 250-C20F turboshaft engines (Figure 1), with enhanced power turbine wheels.

Figure 1: Right-hand engine from VH-SEV

Source: ATSB

Engine maintenance

On 31 January 2018, a heavy maintenance inspection was conducted on the engines installed on SEV. The maintenance included actions required for compliance with the relevant airworthiness directive (AD) and commercial engine bulletins (CEB) (see the section titled Aircraft safety alerts). Some of the maintenance items on the turbine section (Figure 2) of the right-hand engine included:

• replacement of the first-, second- and fourth-stage turbine wheels
• fluorescent penetrant inspection (FPI) on the third-stage turbine wheel (there were no crack indications identified during the inspection).

The reliability of FPI is measured in terms of probability of detection (POD) and is dependent upon the component material and geometry in addition to the nature of the defect.^[2] The engine manufacturer had not developed POD curves specifically for the third-stage wheel, however, based on industry reports, they advised that the POD of a 0.070 inch^[3] long crack was 0.95 and for cracks smaller than 0.045 inches in length, the POD was considered to be around 0.4.

The aircraft was returned to service on 5 February 2018 and operated for 24 flight hours (22 cycles) before the right-hand engine failed.

Figure 2: Rolls-Royce (Allison) 250 engine cross section

Source: Rolls-Royce, annotated by the ATSB

Aircraft safety alerts and operations manual

Airworthiness directive 2017-18-14 and commercial engine bulletin 1407

AD 2017-18-14 was released in October 2017.^[4] The AD was initially prompted by turbine wheel blade failures on the third- and fourth-stage wheels, which led to engine failure and damage to the aircraft.

The AD stipulated a number of measures that affected SEV, which included:

• Every 1,775 hours, remove the third-stage turbine wheel to perform a visual inspection and FPI for cracks.
• Remove and replace any turbine wheels found to have cracks at the trailing edge (near the fillet at the rim) of the turbine blades.

CEB 1407 was released in association with AD 2017-18-14 and provided additional guidance on how to conduct the FPI and visual inspection on the third-stage turbine wheels.

Commercial engine bulletin 1400

CEB 1400 provided advanced notification of actions pertaining to the third- and fourth-stage turbine wheels that were later incorporated into all applicable Model M250 Series II engine operation and maintenance manuals.

CEB 1400 was first released in December 2006. At the time of the incident, CEB 1400 revision 5 was in effect. The bulletin enforced a speed avoidance range for some Rolls-Royce M250 engines, which included the C20 series. The speed avoidance range was designed to reduce engine vibrations at resonant frequencies (or responsive wheel modes), which are known to accelerate fatigue cracking on the third- and fourth-stage wheel turbine blades.

For the parts installed on VH-SEV^[5], a mandatory 75‑88 per cent engine N2^[6] steady-state speed avoidance range was required for all flight and ground maintenance operational practices. Transient operation only was permitted in the speed avoidance range 75‑88 per cent N2. All other operation in the band was prohibited; in particular steady-state or continuous operations (any dwell of more than 1 second).

The Rolls-Royce service bulletin did not provide actions to carry out in the event of an inadvertent dwell in the speed avoidance range. Rolls-Royce advised, however, that operators should contact them for further advice should this occur.

M-250 C20 Operations and maintenance manual

At the time of the occurrence, the operations and maintenance manual for the engine specified the speed avoidance range and directed the user back to CEB 1400 for further guidance relating to the speed avoidance restriction.

Above the speed avoidance range notation, the consequence of not complying with the limitations was stated as:

WARNING: TO PREVENT SERIOUS ENGINE MALFUNCTION OR CRUCIAL LOSS OF POWER, DO NOT OPERATE THE ENGINE IN EXCESS OF ANY SPECIFIED LIMIT.

Pilot-related information

The pilot of VH-SEV (SEV) was an experienced helicopter pilot, with about 10,600 hours total flying time and about 4,400 hours on type.

The 71-88 per cent N2 speed avoidance range observed by the pilot was a conservative range that encompassed the engine manufacturer’s guidance (see the section titled Aircraft safety alerts and operations manual). The avoidance range was marked at the bottom of the instrument panel (Figure 3). The pilot’s standard start-up and shut-down procedures were to transition between ground idle (approximately 63 per cent N2) and 100 per cent N2 in a continuous motion through the speed avoidance range. The pilot stated that there were no operational parameters that required operation in the avoidance range.

Figure 3: VH-SEV instrument panel showing decal with speed avoidance range

Source: Rotor Head

Engine examination specialist reports

Engine examination report

Following the incident, an engine examination was conducted at an engine maintenance facility with the assistance of Rolls-Royce. The following observations were made during the examination:

• The damage was limited to the turbine section of the engine.
• One blade on the third-stage turbine wheel had liberated, resulting in substantial secondary damage to the wheel (Figure 4).
• Damage to the other engine components was consistent with secondary damage caused by rotor imbalance and impact damage from debris (Figure 5).^[7]

Figure 4: Third-stage turbine wheel removed from VH-SEV showing damage

Source: ATSB

Rolls-Royce failure analysis

Following the engine examination, Rolls-Royce conducted metallurgical failure analysis on the third-stage wheel. The laboratory report included the following findings:

• The microstructure, chemistry and hardness of the third-stage turbine wheel were consistent with the engineering requirements.
• Using FPI, 21 of the remaining 34 third-stage turbine wheel blades were found to have crack-like indications on the trailing edge. The indications ranged in length from 0.007 inches to 0.045 inches.
•  One third-stage turbine wheel blade fractured and separated due to fatigue cracking. The fracture surface showed two distinct fatigue regions:
• The initial portion of the crack was consistent with the crack-like indications in the trailing edge of the blades. It was 0.069 inches in length and characterised by oxidation across the fracture surface. The number of fatigue striations indicated that this portion of the crack was present at the time of the maintenance inspection. However, the exact size of the crack at the time of the inspection could not be determined.
• The crack then transitioned to a high cycle fatigue cracking mechanism, progressing towards the leading edge, before the blade liberated in overload (Figure 5).

One of the blades with crack-like indications was selected for further analysis. The blade was lab-fractured and the fracture surface compared to that of the liberated blade. The crack was measured to be 0.045 inches in length and the crack morphology was found to be consistent with the initial portion of the failed blade.

Figure 5: Fracture surface of liberated blade on third-stage turbine wheel

Source: Rolls-Royce, annotated by the ATSB

Third-stage turbine wheel failures

Since the release of the enhanced third-stage turbine wheel (as installed on SEV) in 1999, there have been nine reported in-service failures. At the time of writing this report, the enhanced fleet (C20 Series, C20R Series, B17 Series, and B17F Series engines) had accumulated approximately 8.2 million flight hours. The failure rate of the third-stage wheels is therefore 1 in 911,111 flight hours. Rolls-Royce is working on design changes to reduce the risk to 'As low as reasonably practicable' (ALARP).

Additionally, 21 third-stage wheels have been returned to Rolls-Royce after crack-like indications were identified during the maintenance inspections required by AD 2017-18-14 (and previously released versions).

Of the nine reported in-service failures:

• Four investigations were conducted (three by the National Transportation Safety Board (USA) and one by the Transportation Safety Board (Canada)) between 2003 and 2017.
• In each instance, at least one blade on the third-stage turbine wheel liberated because of fatigue, resulting in an engine failure. Analysis showed similar crack morphology to that found on the third-stage wheel of SEV.
• At the time of those investigations, Rolls-Royce was unable to identify a single root cause for the liberation of the turbine blades.

Examination of the returned turbine wheels and further simulated analysis enabled Rolls-Royce to develop a better understanding of the failures. With improved knowledge, Rolls-Royce has now stated that high cycle fatigue crack progression only occurs when there is steady-state operation of the engine at a responsive wheel mode. The responsive wheel modes were identified in CEB 1400 and are specified as the speed avoidance range.

In 2011, Rolls-Royce learnt that there was an issue with the maintenance practices for MD Helicopters (in particular the MD-500, which had seen 2 blade failures in the 1999-2009 period). This error resulted in the maintenance personnel sometimes dwelling the engine in the speed avoidance range while doing track and balancing of the main rotors. In 2011, MD changed their track and balance procedure specifically to address this issue.

Additional information

Rolls-Royce provided the following additional information to the ATSB regarding the engine failure:

• Fatigue crack growth under normal operational loading is very slow. Cracks initiated under this regime on the trailing edge of the turbine wheel blade will not propagate to failure in the life of the wheel (4,550 flight hours, 6,000 flight cycles) if the aircraft is operated in accordance with CEB 1400.
• There does not need to be a pre-existing fatigue crack on a blade for the steady-state engine operation at a responsive wheel mode to cause blade failure.
• The blade failure event and operation on a responsive wheel mode may not have occurred simultaneously.
• A dwell in the order of a few seconds in the speed avoidance range is sufficient to cause a crack to propagate in high cycle fatigue.
• A pilot can identify a dwell by watching the needle on the tachometer. If the needle remains stationary for any period of time this would indicate a dwell.

The pilot did not recall any incidents where the N2 speed had dwelled in the speed avoidance range between the last maintenance inspection (see the section titled Engine maintenance) and the incident flight. The pilot indicated that while he was aware of the speed avoidance range and was careful to avoid continuous operation within it, he was not aware that a dwell in the order of a few seconds could result in total failure of the engine.

__________

2. Experimental estimation of POD usually requires a large number of service-expired engine turbine disks. Alternatively, the POD studies can also be carried out using laboratory induced samples containing various sizes of defects.
3. The imperial unit for length. 1 inch (in) is equal to 25.4 mm.
4. The AD was first released as AD 2012-14-06 in 2012. The AD was subsequently revised and replaced with AD 201502-22 in 2015 and then again in 2018 by AD-2017-18-14
5. SEV was fitted with third-stage wheel part number 23065818 and fourth-stage wheel part number M250-10445.
6. N2: the rotational speed of the power turbine.
7. Based on the manufacturer’s previous experience and comparison with examination of other engines known to have a liberated blade on the third-stage wheel.

Safety analysis

Engine failure

Metallurgical analysis of the fracture surface of the single liberated turbine blade showed conclusively that the blade had failed under fatigue loading. The fracture type and location of the primary crack was as described in AD-2017-18-14.

Damage was limited to the turbine section of the engine, with the power turbine exhibiting a significant amount of scoring inside the engine casing and a fractured turbine to compressor coupling shaft. This damage is consistent with damage from rotor imbalance resulting from the release of a turbine blade. With the exception of the third-stage wheel, the remainder of the damage was identified as impact damage from debris. In addition, Rolls-Royce stated that the damage to the SEV engine was consistent with that found during previous examinations on engines known to have third-stage wheel failures.

In summary, a single third-stage turbine wheel blade failed due to fatigue cracking, resulting in secondary damage to the engine and total engine failure.

Third-stage turbine wheel fatigue cracks

Rolls-Royce’s analysis of the failed and lab-fractured blade concluded that at least two fatigue cracks existed at the time of the last maintenance inspection. Given the large number of blades found with crack-like indications, it is likely that some or all of the indications on the remaining blades were present at the time of the inspection.

In the event that any of the cracks had been detected, the correct course of action (per the requirements of AD-2017-18-14) would have been to remove the wheel from service. The primary fatigue crack on the liberated blade was measured to be 0.069 inches and the remainder of the crack-like indications were a maximum of 0.045 inches long. The probability of detection of any one crack less than 0.045 inches was estimated to be 0.4. Therefore, the indications existing at the time of inspection were likely to be so small that the probability of detecting any one of the cracks in the turbine blades was low.

It was therefore concluded that a number of fatigue cracks were present but not detected during the last inspection of the third-stage wheel. However, due to the size and nature of the cracks there was a low probability of detection using the specified method.

Rapid fatigue crack progression

The primary fatigue crack on the liberated blade was no greater than 0.069 inches in length at the time of the inspection. Within 24 flight hours (22 flight cycles) the fatigue crack progressed to more than 50 per cent of the blade cross section. That is, it propagated to the critical crack length in under 0.5 per cent of the expected life of the wheel.

The manufacturer’s analysis showed that under normal operational loading, a crack indication at the trailing edge of the blade would not progress to failure within the life of the wheel (4,550 flight hours, 6,000 flight cycles). Physical examination of the fracture surface verified that the blade did not fail because of a material or component defect, or impact damage. Rolls-Royce identified that the crack propagated under high cycle fatigue loading, which it determined was the result of steady state operation of the engine at a responsive wheel mode (defined as the speed avoidance range). Without recorded flight data, however, a dwell in the speed avoidance range could not be verified.

The pilot had significant experience on this aircraft and had never had any previous engine failures using his standard power up/down process. The pilot was aware of the speed avoidance range and did not recall dwelling in the range between the engine maintenance and the incident flight. However, given that the damage can occur in the order of a few seconds, it is possible that a momentary distraction during the power-up or -down phase could have resulted in an inadvertent, unnoticed dwell.

While it was not possible to verify the operation of the aircraft, based on examination of the fracture surfaces and expert opinion, the rapid fatigue crack progression in the third-stage wheel was probably caused by a momentary dwell in the speed avoidance range.

Findings

From the evidence available, the following findings were made with respect to the engine failure involving Airbus Helicopters AS355F-1, registered VH-SEV at Bankstown Aerodrome, New South Wales on 12 March 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• A single third-stage turbine wheel blade failed due to fatigue cracking, resulting in secondary damage to the engine and total engine failure.
• The rapid fatigue crack progression in the third-stage wheel was probably caused by a momentary dwell in the speed avoidance range.

Other factors that increased risk

• A number of fatigue cracks that would have required removal of the third-stage turbine wheel from service were present, but not detected during the last inspection. The size and nature of the cracks meant there was a low probability of detection using the specified inspection method.

Safety issues and actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action.

Rolls-Royce

To reduce the risk of engine failure events, Rolls-Royce is re-designing the third-stage turbine wheel to improve the strength and durability of the component. The main feature of the new design is a larger fillet at the blade trailing edge, which will reduce the stress at the critical location, resulting in a more durable component with greater tolerance to fatigue cracking and operation at responsive wheel modes. The new design was expected to be released at the end of 2020.

Since this occurrence, Rolls-Royce has also updated CEB 1400 (Revision 7) and the operations manual to simplify the speed avoidance range and more clearly articulate the possible consequence of dwelling. The operations manual now states:

WARNING: TO PREVENT POSSIBLE POWER TURBINE FAILURE, TRANSIENT OPERATION ONLY IS PERMITTED IN THE N2 SPEED AVOIDANCE RANGE. ALL OTHER OPERATION IN THIS RANGE IS PROHIBITED.

Airbus Helicopters

Airbus Helicopters published Safety Information Notice No. 3289-S-72 in October 2018 (Appendix A and available at www.airbushelicopters.com/techpub/) to highlight CEB 1400 and the risk of malfunction from an engine dwell within the identified resonant ranges.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• engine manufacturer (Rolls-Royce)
• engine maintenance provider
• aircraft owner
• pilot.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the pilot, the aircraft owner/operator, the engine manufacturer (Rolls-Royce), the engine maintenance provider, the Civil Aviation Safety Authority and the French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA).

Submissions were received from the pilot, Rolls-Royce and BEA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Airbus Helicopters safety information notice

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 4 March 2018, the pilot of a Cessna 206 floatplane, registered VH-LHQ (LHQ), operated by Cloud 9 Seaplanes, was due to pick up two passengers from a park next to Sea World Resort at Southport Broadwater, Queensland, for a short charter flight to Stradbroke Island.

At about 0845 Eastern Standard Time,^[1] the pilot arrived at the aircraft’s base and conducted a pre-flight inspection. At about 1000, he conducted a 6-minute positioning flight from LHQ’s base to Southport Broadwater, where he was due to collect the passengers. No problems or defects were identified during the pre-flight inspection or the positioning flight.

At about 1030, prior to the passengers boarding the floatplane, the pilot briefed them on the safe entry and exit procedures. The passengers boarded LHQ and, at about 1040, the pilot began taxiing. During the taxi, the pilot completed the passenger safety briefing. As part of the briefing, the passengers were shown the location of their life jackets and the location and operation of the emergency exits. To ensure the passengers understood how to operate the emergency exit, the pilot asked the passenger in the rear seat to practice opening the exit.

The floatplane had a relatively long taxi to avoid a large boat travelling south. After the boat passed, the pilot taxied to the eastern side of the western channel (Figure 1), passing over the boat’s wake.

Figure 1: Approximate aircraft taxi and take-off path

Source: Google maps, annotated by ATSB

Shortly after, the pilot applied take-off power. The take-off run was normal and the pilot put the aircraft on the step.^[2] The pilot reported that take-off run was a little bumpy, due to the wakes of some speedboats in the vicinity, but he did not consider it out of the ordinary. At about 30 kt, the aircraft started to ‘wobble’ from side-to-side. Moments later, the nose pitched down and the propeller contacted the water. In response, the pilot pulled back the power and mixture and attempted to steer the aircraft in a straight line – there was little steering control.

The aircraft came to a stop about 300 m from the shore. The pilot reminded the passengers of how to put on their life jackets, before he got out of the aircraft to assess the floats for damage. He found the front spreader bar of the floats had fractured but the floats were intact. As they were intact, he decided not to evacuate the passengers. No one had been injured.

The pilot then deployed and secured the floatplane’s anchor. About a minute after the occurrence, a parasailing boat whose occupants had witnessed the accident came alongside the aircraft. The passengers were transferred to the boat and taken ashore.

After another couple of minutes, a voluntary marine rescue boat arrived at the scene, and arranged to tow the substantially damaged aircraft onto a nearby beach (Figure 2).

Figure 2: The damaged Cessna 206 aircraft

Source: Operator

Floats

The aircraft was equipped with Aerocet seaplane floats. These floats incorporated composite float hulls, separated by two aluminium spreader bars and mounted to the aircraft with aluminium struts. Flying wires stabilised the mounting to the aircraft, and the spreader bars were attached to a socket inside the float.

The manufacturer provided an inspection regime for the floats, which included 25, 100 and 200‑hour inspections. The maintenance manual included repair procedures for minor damage and information on when the manufacturer should be consulted about damage and repairs. The floats did not have a service life limitation and operated ‘on condition’.

The maintenance manual, however, did indicate that ‘exceptional inspections’ were necessary to identify possible damage to the floats. The manual listed the following scenarios that could make such inspections necessary:

• Landing on grass or other runway
• Harsh landings
• Impact with submerged objects
• Suspected damage during tie-down or mooring, such as from wind or wave action
• Excessive water during pump-out or pre-flight inspection

The floats were installed new in June 2016, after the operator acquired LHQ. At the time of the accident, the floats had about 370 hours in service. The maintainer had conducted a visual inspection of the floats 22 hours prior to the accident – no defects to the spreader bar were identified. The operator stated that he always carried out a visual inspection of the floats during the aircraft’s daily wash. The aircraft was last washed the day prior to the accident. No defects were identified during the wash or pilot’s walk around on the morning of the accident.

After the accident, the spreader bars were inspected and a fatigue crack was identified in the front spreader bar that had propagated to the point of failure. The failure was located about 3.5 cm inside the float so the fatigue crack was not visible (Figure 3). Cracks were also identified extending from the boltholes of the rear spreader bar. It could not be determined if these were a result of the accident or were pre-existing.

Figure 3: Front spreader bar fatigue failure located within the float

Source: Operator

The spreader bars were returned to the manufacturer for further analysis. As a result of that analysis, the manufacturer reported that there was ‘no apparent autogenous condition such as occlusions in the base material. It appears that repeated overloading of the float structure occurred leading to cracking in a difficult to detect location.’

Previous failure

In October 2015, the operator found a fatigue crack in a spreader bar in a similar location during his daily inspection on another set of Aerocet C206 floats. In that instance, the crack extended outside the floats and was detectable. The crack had extended to about 50 per cent of the spreader bar. The operator reported that failure to the manufacturer and provided the Civil Aviation Authority (CASA) with a defect report.

The manufacturer stated that no other operator had reported similar failures.

Operating environment

After the accident, the operator identified a number of factors that may have increased the stresses on the floats. These included:

• Conducting a high number of 5-minute scenic flights that increased the number of take-off and landing cycles per flying hour.
• When the seaplane is beached at Sea World resort, due to the angle of the beach, large boat wakes can hit the seaplane at a 45-degree angle. This results in the floats and spreader bars shuddering.
• During take-off and landing at Sea World and Couran Cove, cross wakes (two boat wakes colliding) can cause large waves and create a bumpy ride and excessive bounce and stress on the float hardware.
• Retrieval of the seaplane at the end of the day sometimes caused the seaplane to rock on the boat ramp when the plane was being loaded onto the trailer.

Safety analysis

During the take-off of LHQ, the floats’ front spreader bar fractured. This resulted in the floats separating forward of the floatplane’s centre of gravity and its propeller impacting the water.

The float system was designed and constructed with the spreader bar attached to a fitting within the float. This resulted in a section of the spreader bar that could not be visually inspected as it was also within the float. In this accident, the fatigue crack was located in that internal section of the spreader bar, which meant that it was not possible to visually identify it during normal operation and maintenance.

The operator had previously identified a fatigue crack in a spreader bar on another aircraft. In that instance, the crack had extended outside of the float and been identified prior to structural failure.

The operating environment increased stresses on the float assembly due to the short flights increasing the take-off and landing cycles per flight hour as well as increasing the amount of taxiing time per flight hour. This increased flight frequency, along with operating in a high water traffic environment, increased the loading on the floats.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During the take-off roll, the floatplane’s front spreader bar fractured resulting in the floats separating and the aircraft pitching down sufficiently for the propeller to contact the water.
• The origin of the fracture was a fatigue crack in the spreader bar section located inside the float, which meant routine visual inspections could not have detected the crack.
• Frequent, short flights in an area of high-water traffic exposed the floats and associated structure to high cyclic loading and stresses, increasing the likelihood of material fatigue.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Cloud 9 Seaplanes

The aircraft operator advised the ATSB that they had taken the following safety actions as a result of this occurrence:

Proactive safety action

• A borescope will be used to inspect spreader bars at intervals of 100 service hours. 
• In addition to the 25 hourly inspection, the floats and hardware will be inspected while the floatplane is on the water. This will help to determine if there is any play in the fittings and hardware.
• Passenger loading has moved from Sea World Resort, to a location with a beach with less exposure to boat wake.
• Passengers and ropes will be used to keep the plane at a 90-degree angle to the water at all times when boat wakes are present. This will reduce uneven loading on the floats.
• A review of the take-off and landing areas and times will be carried out, to reduce rough and bouncy landings. 
• The number of 5-minute scenic flights will be minimised to reduce the number of take‑off and landing cycles.
• The end of day procedure will be modified to reduce stresses on the floats when loading the seaplane onto the storage trailer.

Safety message

Scheduled maintenance inspections and the pilot’s daily inspection are a central element of the continuing airworthiness of the aircraft. However, continuing airworthiness also relies on inspections that allow the identification of damage, so that parts can be repaired or replaced prior to failure. In addition, where a structure may have experienced excessive loads (for example, hard landings) additional inspections may be required.

As was the case in this accident, it is important that defects are reported to regulators and aircraft manufacturers because they depend on accurate data to ensure the ongoing continued airworthiness of the aircraft. Defects reported to CASA through the Defect Report Service (DRS) system, and to the manufacturer, provide the opportunity for fleet trend monitoring and allow issues to be identified and rectified.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Universal Coordinated Time (UTC) + 10 hours.
2. The step position is the attitude of the aircraft when the entire weight of the aircraft is supported by hydrodynamic and aerodynamic lift, as it is during high-speed taxi or just prior to take off. This position produces the least amount of water drag. The step is also called the planing position.

Safety summary

What happened

On 02 March 2018, at 1549 Western Standard Time, a Skippers Aviation Cessna 441 Conquest, registered VH-LBY, departed on a scheduled passenger service from Fitzroy Crossing to Broome, Western Australia with one pilot and nine passengers on board.

During descent, the FUEL LEVEL LOW annunciators illuminated. The pilot observed that both fuel quantity gauges indicated sufficient fuel remaining and continued flying towards Broome. The right engine began surging, followed by similar surging from the left engine. Subsequently, the right engine lost power and the pilot conducted the engine failure checklist.

The pilot declared a MAYDAY and advised air traffic control that, as the left engine was still operating, the aircraft would be able to reach Broome. However, the left engine also lost power and both engines were unable to be restarted. The pilot landed the aircraft safely on the nearby highway. There were no injuries, and the aircraft was undamaged.

What the ATSB found

Due to water contamination in the fuel tanks, the aircraft’s fuel quantity gauges were significantly over reading on the day of the occurrence and on previous days. The water contamination had existed for some time without being detected by multiple pilots’ fuel quality testing.

Although the pilot routinely compared indicated versus calculated fuel quantities, and indicated versus flight-planned fuel quantities, the pilot did not routinely conduct two other methods stated in the operator’s procedures for cross-checking fuel quantity gauge indications.

In addition, although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications. Pilots also did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified, and pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser.

The FUEL LEVEL LOW annunciators likely illuminated approximately 30 minutes before the fuel was exhausted in each tank, and when the aircraft was still within range of suitable alternative airports. However, the pilot disregarded the annunciations, and relied on the (erroneous) fuel quantity indications and continued to Broome until the engines lost power, at which point a forced landing on a highway was the only remaining option.

What has been done as a result

The operator increased the frequency of a fuel quantity comparison checks to a known quantity to ensure continued quantity measurement accuracy, specified clearer requirements for determining discrepancies when using fuel totaliser figures, implemented additional fuel management record keeping and increased management oversight of its Broome operations. It also increased focus on fuel management procedures during training.

Safety message

Accurate fuel management is a critical aspect of flight operations, and it is important to utilise all available means in order to gain the highest assurance that fuel quantity measurement is accurate. It is essential that a reliable quantity cross-check is adopted, utilising at least two independent methods and a conservative approach. Pilots also should understand the functionality of the low fuel warning system on their aircraft and treat any warning annunciations as being accurate unless there is overwhelming evidence otherwise.

Further reading is available in the ATSB research report, Starved and exhausted: Fuel management aviation accidents (AR-2011-112). This report discusses methods that pilots can use to ensure they will have sufficient fuel to land at their destination.

The occurrence

Previous sectors

On 2 March 2018, Skippers Aviation was operating a twin turboprop Cessna 441 Conquest (C441), registered VH-LBY, on a four-sector scheduled passenger flight from Broome to Fitzroy Crossing, then to Halls Creek, returning via Fitzroy Crossing to Broome, Western Australia. The flight was conducted as a single-pilot operation under instrument flight rules. No significant weather was forecast for Broome and there was a risk of afternoon thunderstorms at the other destinations.

The pilot flew the same aircraft on the previous day. At the end of that day’s flying, the pilot recorded on the aircraft’s flight log that the fuel gauges were indicating a total of 1,300 lb^[1] usable fuel.^[2] Prior to the first flight on 2 March, 600 L (1,050 lb) of fuel was uploaded, which resulted in a calculated fuel on board of 2,350 lb. This amount was sufficient to conduct all four sectors.

After arriving at Halls Creek following the second sector on 2 March, the pilot recorded the fuel quantity gauges as indicating a total of 1,430 lb usable fuel. The pilot stated that the indicated fuel quantities after the first two sectors were consistent with the expected (flight-planned) fuel burns for those sectors. The pilot also reported that the first three sectors were conducted without incident and on schedule.

Prior to departure from Fitzroy Crossing

The aircraft arrived at Fitzroy Crossing after the third sector at 1532 Western Standard Time.^[3] The pilot recorded the fuel quantity gauges as indicating a total of 1,300 lb. This indicated that the fuel burn for the third sector was 130 lb, although the pilot recorded 230 lb on the flight log. The flight-planned fuel burn for the third sector was 357 lb, and the pilot was expecting a fuel quantity indication of about 1,110 lb rather than 1,300 lb.

The pilot’s flight plan estimated 977 lb was the minimum required for the final sector (included reserves). Noting that the indicated fuel quantity (1,300 lb) was above the minimum required according to the flight plan, the pilot did not consider the difference between the expected fuel quantity and indicated quantity any further.

Departure and cruise

The pilot and nine passengers were on board for the last sector from Fitzroy Crossing to Broome (Figure 1).

The pilot reported that, during the taxi for departure at Fitzroy Crossing, the right fuel transfer pump (R X-FER PUMP FAIL) annunciator illuminated momentarily. The pilot attributed this to fuel moving within the tank during the left turn onto the runway from a downward sloping taxiway. The pilot also noticed an imbalance between the quantity indications (left tank higher than right) and selected the right engine crossfeed (both engines supplied from the left tank). The pilot reported that the quantity indications for both sides were similar prior to take-off.

The aircraft departed Fitzroy Crossing at 1549. The pilot reported that the take-off and climb to flight level 260 (FL 260)^[4] were normal.

Figure 1: Aircraft track (just prior to top of climb until landing) and highway

Source: Google Earth, modified by the ATSB

The aircraft reached top of climb at 1607. The pilot stated that, shortly after, the left main boost pump (fuel pump) circuit breaker opened, and the left auxiliary boost pump (L AUX BOOST ON) annunciator illuminated (indicating automatic activation in order to maintain fuel supply). After a short delay to allow the fuel pump to cool, the pilot reset the circuit breaker. The pilot recalled that the circuit breaker opened again, so they conducted the main and auxiliary fuel boost pump failure checklist.

At 1613, the pilot contacted air traffic control (ATC) and advised that the aircraft was maintaining FL 260 at about 90 NM from Broome. ATC cleared the pilot to descend when ready to 7,000 ft. About a minute later, the pilot commenced descent. At this point the aircraft was approximately 27 NM south of Curtin Airport and 42 NM south of Derby Airport (Figure 1).

At about this time, the pilot observed a fuel imbalance (right tank higher than left) that was not consistent with the fuel quantity indications on departure and the fuel flow observed during climb. The pilot selected left engine crossfeed (both engines supplied from the right tank), but the right auxiliary boost pump (R AUX BOOST ON) annunciator did not illuminate as it should for this crossfeed selection. The pilot assessed this as an annunciator fault as the left tank quantity showed an expected increase.

The pilot stated that, during the crossfeed, the R X-FER PUMP FAIL annunciator flickered on and then off, prompting the pilot to stop the crossfeed. The R FUEL LEVEL LOW annunciator then illuminated. The pilot observed that both fuel gauges indicated sufficient fuel to continue to Broome. Shortly after, the R X-FER PUMP FAIL and right fuel pressure low (R FUEL PRESS LOW) annunciators also illuminated. A few minutes later, the corresponding left fuel system annunciators also illuminated.

Engine power losses

The pilot recalled that, soon after the annunciators illuminated, the right engine began surging, prompting the pilot to conduct the partial/intermittent engine power checklist. During the checklist actions, the left engine also started to surge. Following completion of checks for the right engine (with no success), the pilot conducted the checks for the left engine. During this activity, the right engine lost power and the pilot then conducted the engine failure checklist.

At 1623, the pilot contacted the Broome tower controller and declared a MAYDAY.^[5] The aircraft was approximately 47 NM east of Broome at FL 155. By this time, the aircraft was now a similar distance from Derby and Curtin (Figure 1).

At 1627, the tower controller asked the pilot if the aircraft would still be able to reach Broome. The pilot advised that the left engine was still operating, and they would be able to reach Broome. At this time, the aircraft was descending through 10,800 ft and approximately 38 NM from Broome. However, shortly after, the left engine also lost power. The pilot attempted to restart the left engine. It regained power for a brief time before surging and losing power again. Further restart attempts were made on both engines without success.

Diversion and forced landing

With both engines not providing power, the pilot assessed that the aircraft would not reach Broome and they tracked to the south towards the Great Northern Highway in the vicinity of Roebuck Plains.

At 1633, the pilot notified Broome tower of the ‘dual engine failure’ and intentions for the forced landing. The aircraft was approximately 22 NM east of Broome at approximately 4,000 ft. The pilot was unable to extend the landing gear normally and conducted an emergency extension of the gear. Although a passenger brief was conducted, the passengers were not instructed to brace for the emergency landing.

The pilot landed the aircraft safely on the highway approximately 21 NM east-south-east of Broome without injuries or aircraft damage (Figure 1).

After landing, the pilot made radio contact with another aircraft in the area, and the pilot of that aircraft relayed their status and requirements to Broome tower. All passengers were subsequently transferred to Broome via road. The aircraft was towed and secured at a nearby truck stop.

A photo of the fuel quantity gauges taken approximately 1 hour after landing indicated about 1,120 lb fuel on board (Figure 2). Subsequent inspections identified that little or no usable fuel was on board.

Figure 2: Fuel gauges after forced landing

The image shows the fuel gauges indicating a total of about 1,120 lb of fuel on board, about 1 hour after landing on the highway. With the addition of fuel calibration card corrections, the indicated amount should have represented 1,220 lb.

Source: Pilot of VH-LBY following occurrence flight

__________

1. The Cessna 441 Pilot’s Operating Handbook and instrumentation refers to fuel quantity as a weight in lb. The operator specified a conversion factor of 1.74 (1 L equals 1.74 lb). A quantity of 1,300 lb equated to 747 L.
2. Unless otherwise noted, the indicated fuel quantities in this report include the application of fuel calibration card corrections.
3. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8.0 hours.
4. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 260 equates to 26,000 ft.
5. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.

Context

Pilot information

The pilot held a valid commercial pilot (aeroplane) licence with a multi engine command instrument rating and a valid medical certificate. The pilot joined Skippers Aviation in May 2017 and had been qualified on the Cessna 441 (C441) since June 2017. They had a total of 2,403 hours flight time, of which 402 hours were on the C441. The pilot had also flown a number of single engine aircraft, including the Cessna 172, 206 and 210, and other multi-engine aircraft, including the Beechcraft Baron and Cessna 402 and 404.

The pilot’s training records for conversion to the C441, check to line and the most recent instrument proficiency check did not contain any major issues or concerns regarding the pilot’s performance or capability.

The pilot was one of four pilots based in Broome that operated C441 aircraft for the operator.

Aircraft information

General information

The C441 is a pressurised twin engine turboprop aeroplane, accommodating up to 11 people.

VH–LBY, serial number 0023, was manufactured in 1978. It was first registered in Australia in May 1986 and Skippers Aviation was the registered operator from November 1992. The aircraft had accumulated over 25,000 hours total time in service. The aircraft was one of three C441s based in Broome used by the operator.

Fuel tank system

The C441 fuel system includes fuel tanks as integral portions of each sealed wet wing. Each fuel tank normally supplies the engine on the same side of the aircraft. The total usable fuel capacity is 3,168 lb or 1,800 L (1,584 lb per side). Fuel systems schematics are provided in Appendix A – Fuel System Schematics. 

Each fuel tank incorporates an open-top hopper tank (located inboard), which accumulates fuel to ensure continuous supply for the two electric boost pumps (main and auxiliary) situated in the bottom of the hopper. The main boost pumps supply fuel under pressure to the respective engine and transfer ejector pumps. If the main boost pump fails, the auxiliary boost pump will automatically activate, and the associated annunciator (L/R AUX BOOST ON) will illuminate. 

The transfer ejector pumps in each tank utilise high pressure fuel flow from the respective boost pumps (motive flow) in conjunction with a venturi to produce a high-volume flow. Provided a boost pump is operating (main or auxiliary), the respective ejector pumps will operate continuously to transfer fuel from the lowest points in the forward and rear of each tank into the hopper to maximise the amount of usable fuel available to the engine. 

If the boost pumps are off, the transfer ejector pumps will not transfer fuel from the tank to the hopper. If more than 580 lb of fuel is in the tank, the fuel level will be sufficient to overflow into the open-top hopper tank and keep it full. If there is less than 580 lb of fuel in the tank, then fuel will not overflow, and the fuel level in the hopper will lower.   

For each fuel tank, the associated X-FER PUMP FAIL annunciator is actuated by a float switch near the top of the hopper tank. The annunciator will illuminate when: 

• less than 80 lb of fuel is in the hopper tank (with boost pumps on), or 
• less than 580 lb of fuel in the tank, including in the hopper tank (with boost pumps off). 

Illumination of the X-FER PUMP FAIL annunciator is usually associated with failure of the respective transfer ejector pumps. That is, a failure to ensure the hopper tank remains full. 

However, this feature can also be used on the ground to determine if a tank’s quantity is above or below 580 lb by turning the fuel boost pumps off and observing the annunciator. Illumination of the annunciator indicates a fuel quantity in the tank less than 580 lb. 

In case of an engine failure or fuel tank imbalance, a crossfeed system allows the pilot to select one of the engines to be supplied from the tank on the other wing. For example, if both engines are operating and the left engine crossfeed is selected, the following would occur without further pilot action: 

• interconnection of the output from the two tanks 
• left main boost pump de-energised 
• right auxiliary boost pump energised (in addition to right main boost pump) 
• both engines supplied from the right tank 
• excess fuel leaving the right tank transferred to the left tank. 

Two drain valves are fitted to the lower inboard surface of each fuel tank and two are fitted to the crossfeed lines to allow samples to be extracted for visual and chemical detection of water and other contaminants. The standard design of VH-LBY did not include drain valves in the hopper floor panel and none were fitted at the time of the occurrence. 

The manufacturer advised that the drains were located at low points in the fuel tank system, which was in front of the hopper tanks. It also noted that the pre-flight checklist called for the sumps in each wing, and the two crossfeed line sumps, to be drained and checked for water and contamination before each flight. It stated that draining those fuel sumps before every flight would remove water that has entered the fuel tank and prevent that water from being fed into the hopper tank. 

Fuel quantity indications 

The fuel quantity indicating system (FQIS) is a capacitance-type system with five probes in each tank, connected to a signal conditioner in each wing that converts probe values to an electrical output. This output is transmitted to two gauges on the instrument panel, which display the quantity of usable fuel in increments of 50 lb (Figure 2, Figure 3). 

Each probe is an assembly of concentric tubes acting as plates of a capacitor with fuel or air acting as the normal dielectric medium between plates. The value of probe capacitance is proportional to the submersion of the probe in the fuel. Probes are not adjustable but are subject to regular testing to establish serviceability. The signal conditioner can be adjusted to maximise the accuracy of the quantity indications. 

If a contaminant is in contact with the probes, then the quantity indications will be altered based on the capacitance property of that contaminant. Water has a much higher dielectric constant than fuel. Therefore, the presence of water on the probes would likely cause an over reading of the fuel quantity. 

The aircraft also has a low fuel warning system, activated by a magnetic float switch co-located with the inboard fuel probe. The L or R FUEL LEVEL LOW annunciator illuminates when the associated tank contains between 150–250 lb of usable fuel and the main and/or auxiliary fuel boost pumps are operating. The low fuel level warning is independent of the fuel quantity gauges. 

VH-LBY and the operator’s other C441 aircraft were fitted with fuel flow transducers that transmitted information to fuel flow gauges located on the instrument panel. This fuel flow information was also transmitted to the Garmin GNS 530 GPS/navigation system, which had a fuel totaliser function. A fuel on board figure was required to be manually entered prior to flight and/or after refuelling. Following this, the Garmin GNS 530 would then be able to accurately monitor the fuel consumed and calculate the residual fuel at any point. Senior pilots reported that the fuel burn figures produced by the Garmin 530 totaliser function were accurate. 

The aircraft was not equipped with a mechanism to directly read the fuel quantity in each tank, such as a drip/magna stick or sight gauge. It was only possible to visually determine the quantity of fuel on board the aircraft by viewing the fuel via the open fuel filler cap when the tanks were full. 

FQIS maintenance requirements 

The operator’s system of maintenance required that the FQIS was calibrated every 12 months. The procedure started with empty tanks and adjusting or verifying the zero indication of the gauges. Following this, fuel was added incrementally, and gauge indications were recorded for each added amount. A calibration card was then compiled, allowing pilots to make applicable corrections to the gauge readings to reflect actual fuel on board. 

The last calibration for VH-LBY was conducted in April 2017 and the calibration card was current until April 2018. For both tanks, the card required the addition of amounts of about 10 per cent of the indicated quantity. Similar values were evident in previous calibrations. 

In addition to the annual calibration, the operator required a comparison check of the FQIS at intervals of 150 hours flight time. The procedure required the tanks to be drained of all fuel, and then 500 lb per tank added in 100 lb increments. A comparison of gauge indications and fuel added was made to verify accuracy of the FQIS. 

The aircraft had been operated for about 66 hours since the comparison check, which was conducted on 6 January 2018. 

Post-occurrence actions and maintenance 

On the day following the occurrence (3 March 2018), a fuel drain was conducted and a significant but unquantified amount of water was drained. The aircraft was then refuelled with 650 lb of fuel from sealed drums and the subsequent fuel drain did not contain a significant amount of water. The engines were ground run and no fuel leaks were evident. The fuel pump pressure low and fuel level low annunciators were checked to be operating as satisfactory. 

Based on this evidence, and an assessment that both engines had likely lost power due to fuel exhaustion, the Civil Aviation Safety Authority (CASA) issued the operator with a special flight permit to allow the aircraft to be flown to Broome. The ferry flight was conducted without incident. 

On arrival in Broome, all usable fuel was drained from the aircraft by diverting boost pump output into drums. Accounting for the quantity of fuel added on the highway and consumed during the ferry flight, the operator estimated there was little or no usable fuel on board the aircraft at the time of landing on the highway. The operator also noted that the fuel quantity gauges indicated 370 lb per tank even though all the usable fuel had been drained (Figure 3). 

Figure 3: Fuel quantity gauges after defueling in Broome 

The image shows the fuel gauges indicating 370 lb per tank, though all usable fuel had been drained from both tanks. Source: ATSB 

The aircraft was inspected in Broome by licenced aircraft maintenance engineers employed by the operator’s maintenance organisation, in consultation with observers from the ATSB and CASA. To allow inspection of the fuel tanks and system components internal to the tanks, the fuel drains were opened, and the underwing access panels were removed. As the panel forming the floor of the hopper (and boost pump mount) was removed, fuel was released into a container with some unavoidable spillage onto the floor. It was estimated that about 500 mL of water was in the fuel released from the hopper. 

Inspection of the tank interiors showed significant water beading on the internal surfaces and on the fuel quantity probes. A grey substance, later identified as fungus, was also observed in the tanks, although not on the probes. 

When tested, the probes did not conform to capacitance specifications. The probes were cleaned and dried overnight. When retested, the probes passed the capacitance test, and the fuel quantity gauges indicated the correct zero fuel state (Figure 4). 

Figure 4: Fuel quantity gauges after cleaning and drying the probes 

The image shows the fuel gauges indicating zero usable fuel on board, following cleaning and drying of the fuel quantity probes. 

Source: ATSB 

During the process of removing fuel from the tanks, approximately 1 L per side of fuel was collected for analysis. The sample from the left tank was cloudy with a small amount of settled contaminant. About one fifth of the right tank sample was a distinct contaminant and the rest was clear. Specialist analysis subsequently identified water as the only contaminant. 

Due to the significant water contamination and fungal growth, several engine fuel system components and the main fuel boost pumps were removed for overhaul. The engineers observed minimal component damage, suggesting that water was not present for an extended period. 

As part of return-to-service maintenance, the FQIS was calibrated and found to be serviceable. During this process, the left and right fuel level low warning system was checked and found to switch the annunciators on/off at 160 lb per side, which was within the specified range. 

Additionally, both fuel transfer pump fail annunciators switched on/off when the fuel level reached about 580 lb per side (and the boost pumps were off), in accordance with specifications. 

Fuel system maintenance 

In January 2018, VH-LBY underwent a scheduled maintenance check. Fuel system related inclusions were a fuel drain and check for evidence of moisture, fuel gauge to fuel quantity comparison check, and various fuel system component inspections. No fuel system related issues were identified during this check. 

In February 2018, the left fuel computer was replaced due to intermittent dropouts. 

In terms of previous problems with fuel quantity readings, in March 2017 the right fuel gauge was reported as being unreliable. All right-side fuel probes were removed and reinstalled after testing within limits. In February 2017, the left-side fuel gauge was reported as over reading. The inner fuel probe was replaced after being tested as out of limits. 

Fuel contamination opportunities 

The operator and the ATSB reviewed operational records for VH-LBY since the comparison check on 6 January 2018 to identify the potential source of the water. 

On 13 February 2018, VH-LBY was involved in a towing incident, during which the right wingtip was damaged and required repair. Due to hangar availability and maintenance on other aircraft, VH-LBY was not always inside a hangar. Repairs were completed and the aircraft returned to service on 26 February 2018. 

During this period, Broome received heavy rainfall associated with tropical cyclone Kelvin. On 17 February 2018, 377 mm was recorded at Broome Airport. It is possible that the aircraft was exposed to some heavy rainfall, allowing the ingress of water through the damage in the right wingtip, but specific information about the extent to which this occurred was not available. There was no evidence that the fuel caps were incorrectly secured or that the fuel cap seals were degraded. 

The aircraft was refuelled on 22 February 2018 and on five other occasions before the day of the occurrence. All but one of these refuels were at Broome Airport and there were no reports of any fuel quality issues from the fuel supplier or other operators. One of the operator’s other C441 aircraft based in Broome was inspected after the 2 March occurrence and no contamination was found. 

Since the aircraft was returned to service on 26 February, and up to the day of the occurrence, the aircraft was operated on 4 days by three pilots. The pilot of the occurrence flight conducted flights on the 1 and 2 March, and the other pilots conducted flights on 27 February and 28 February. 

Overall, 12 flights totalling 13.0 flight hours were conducted prior to the occurrence flight. For each of the 4 days, the flight log was signed to certify that the daily inspection had been carried out. Noone reported that fuel drains conducted prior to each flight were anomalous, and there were no indications in the aircraft’s technical log or daily flight logs of any problems. 

Fuel quality management 

Regulatory requirements regarding fuel quality 

Civil Aviation Order (CAO) 20.2 (Air service operations — safety precautions before flight) (15 May 2006) directed that the operator and pilot in command must ensure that inspections and tests for the presence of water in the fuel system of the aircraft are made. CAO 20.2 provided the following as guidance: 

Note  It is important that checks for water contamination of fuel drainage samples be positive in nature and do not rely solely on sensory perceptions of colour and smell, both of which can be highly deceptive. The following methods are acceptable: 

1. Place a small quantity of fuel into the container before taking samples from tank or filter drain points. The presence of water will then be revealed by a visible surface of demarcation between the two fluids in the container. 
2. Check the drainage samples by chemical means such as water detecting paper or paste, where a change in colour of the detecting medium will give clear indication of the presence of water. 
3. In the case of turbine fuel samples, tests should also include inspection for persistent cloudiness or other evidence of the presence of suspended water droplets, which will not necessarily be detected by methods mentioned in notes 1 and 2. Should any doubt exist of the suitability of the fuel, the checks specified in the aircraft Operators Maintenance Manual should be followed. It is advisable to allow turbine fuel a reasonable period of stagnation before drawing test samples from fuel drain points; this allows settling of suspended water which is a slower process in turbine fuel than in aviation gasoline. 

The CAO also stated: 

If, at any time, a significant quantity of water is found to be present in an aircraft fuel system, the operator and pilot in command must ensure that all traces of it are removed from the fuel system, including the fuel filters, before further flight. 

Note  In eliminating water from an aircraft fuel system, it is important that consideration be given to the possibility of water lying in portions of the tanks or fuel lines where, because of the design of the system or the existing attitude of the aircraft, it is not immediately accessible to a drain point. 

Operator requirements regarding fuel quality 

The operator’s Flight Operations Manual (FO1) required that a pilot conduct a fuel drain prior to the first flight of the day and following each refuel. The fuel sample was to be visually checked for water and other contaminants. If any water was evident, further drains were to be conducted until water was no longer evident. Once water was no longer visually evident (via draining), a sample was to be chemically tested for water using a water detection capsule. If the water test resulted in a positive detection of water, the aircraft was not to be flown and a defect report raised. Further details of the operator’s procedures are provided in Appendix B – Fuel System Testing. 

The operator did not provide guidance as to what amount of water was considered excessive or out of the ordinary, nor did it require any reporting or recording (in a maintenance log or similar) of any water drained from the tanks. It appeared that the assessment of excessive or out of the ordinary was reliant on an individual pilot’s experience and the knowledge gained from instructor pilots during training. 

The operator’s procedure did not include guidance to allow fuel to stagnate for a period to enable suspended water to settle, or that water may be in areas not immediately accessible via drain points. 

Fuel quality management actions and events 

In the case of the flights conducted on 2 March 2018, the pilot reported that a fuel drain was conducted during the pre-flight inspection at Broome prior to refuelling but no testing was conducted with the water detection capsules. The pilot did not report any concerns regarding their observations of the fuel samples. 

The pilot stated they did not conduct a fuel drain after the aircraft was refuelled (at Broome). The pilot explained during interview that, following the pre-flight inspection at the hangar, they drove to the passenger terminal to conduct check-in duties and ordered fuel once check-in was complete. The pilot was not present at the aircraft during refuelling and the aircraft was towed to the terminal by an engineer. The pilot could not offer any explanation for not conducting the additional water test. 

Fuel quantity management 

Regulatory requirements regarding fuel quantity 

At the time of the occurrence, Civil Aviation Regulation (CAR) 234 (Fuel requirements) stated that the pilot in command and the operator had to take reasonable steps to ensure that an aircraft carried sufficient fuel ‘to enable the proposed flight to be undertaken in safety’. No specific cross check requirements were stated in the regulation. 

The Civil Aviation Safety Authority issued Civil Aviation Advisory Publication (CAAP) 234-1(1) (Guidelines for aircraft fuel requirements) in November 2006. With regard to establishing fuel on board, the CAAP stated: 

Fuel gauges, particularly on smaller aircraft may occasionally be unreliable. In addition, except when the tank is full, it is extremely difficult to establish the quantity of fuel in a tank unless the aircraft is perfectly level and the manufacturer has provided an accurately graduated dipstick, sight gauge, drip gauge or tank tab. 

In terms of fuel quantity cross-checks, the CAAP stated: 

Unless assured that the aircraft tanks are completely full, or a totally reliable and accurately graduated dipstick, sight gauge, drip gauge or tank tab reading can be done, the pilot should endeavour to use the best available fuel quantity crosscheck prior to starting. The cross-check should consist of establishing the fuel on board by at least two different methods such as 

1. Check of visual readings (tab, dip, drip, sight gauges) against fuel consumed indicator readings: or 
2. Having regard to previous readings, a check of electrical gauge or visual readings against fuel consumed indicator readings: or 
3. After refuelling, and having regard to previous readings, a check of electrical gauge or visual readings against the refuelling installation readings: or 
4. Where a Series of flights is undertaken by the same pilot and refuelling is not carried out at intermediate stops, cross-checks may be made by checking the quantity gauge readings against computed fuel on board and/or fuel consumed indicator readings, provided the particular system is known to be reliable. 

Operator requirements regarding fuel quantity 

The operator’s fuel management requirements were documented in the Flight Operations Manual (FO1) and the Conquest Flight Operations Manual (FO6). The FO1 section on fuel quantity measurement included the following: 

On aircraft types with a MTOW less than 5700kgs, the PIC must use the acceptable cross check methods to ensure sufficient fuel is on board at take-off for the proposed flight. 

It must be understood that the degree of accuracy achieved when taking fuel quantity readings is highly dependent upon the scale provided on the gauge or measuring device and the slope of the tarmac surface. 

The following fuel quantity measurement methods are acceptable:- 

• Indicated (electrical fuel quantity gauges) 
• Stick Gauge (Magna or drip sticks) 
• Calculated (by adding the refuel quantity to the residual fuel quantity) 

The following cross-check methods are acceptable:- 

• Check of stick gauge readings against indicated readings, 
• A check of stick gauge against calculated, 
• A check of indicated against calculated, 

When a series of flights is undertaken by the same crew and refuelling is not carried out at intermediate stops, cross checks, other than the first flight of the day, may be made by checking the gauge readings against the calculated fuel on board. 

As the C441 did not have a stick gauge, only the cross-check of indicated versus calculated fuel quantity was applicable to that aircraft. 

FO1 defined ‘residual fuel quantity’ as the indicated quantity at engine shutdown and, as indicated above, it stated that calculated fuel was the residual fuel plus the amount added during refuelling. Given this definition, the last paragraph of the FO1 procedure provided very limited guidance to pilots. In effect it meant that, if no fuel was added between flights, the indicated fuel quantity at the end of the previous flight should be compared with the indicated fuel quantity prior to the current flight.  

By comparing the operator’s procedures with CAAP 234, the last paragraph of the FO1 procedure would have provided clearer guidance if it used the term ‘computed fuel’ rather than ‘calculated fuel’. FO1 defined ‘computed fuel’ as: 

For the purposes of acceptable fuel cross check methods, Computed fuel is defined as the anticipated destination fuel quantity that is derived during flight by use of fuel flow, ground speed and distance to the destination aerodrome. 

However, none of the cross-check methods stated in FO1 referred to computed fuel. 

In a section about fuel usage records, FO1 stated: 

Fuel on board gauge readings are to be checked prior to departure by adding the fuel quantity uplifted, as per the release note, to the fuel quantity remaining at the end of the previous flight which has been recorded on the Flight Log. 

In effect this statement was requiring pilots to conduct the cross-check of indicated fuel quantity (prior to a flight) with the calculated fuel quantity for those flights where fuel was added. 

FO6 provided further procedures and guidance for C441 pilots. It stated that ‘the acceptable method’ of cross-checking fuel quantity indications was as follows: 

• Prior to flight, confirm the difference between the indicated fuel vs the residual figure noted in the flight log from the previous flight are within 5% 
• After re-fuelling, compare the indicated fuel vs calculated and verify the difference is less than 5% of the higher amount. 
• Should the indicated fuel vs residual figure noted or the indicated fuel vs calculated after refuelling difference exceed 5%, the aircraft shall not be flown and an appropriate entry into the Defect Endorsement Log shall be made. The crew should then seek Engineering assistance to rectify the defect. 
• Prior to shutdown on the ground the L-R FUEL X-FER FAIL light will be used as a gross error check vs the indicated amount. The fuel boost pump switches will be position to OFF. If the L or R FUEL X-FER FAIL light illuminates, the associated fuel gauge should read below 580 Lbs or if the L or R FUEL X-FER does not illuminate the associated fuel gauge should read above 580 Lbs. 
• When equipped with a Garmin 530 and the Shadin (fuel totaliser). Enter the total fuel at departure into the “FOB” on the Fuel Planning page in the Garmin 530. After shutdown open the Fuel 

Planning in the Garmin 530. “FOB” vs indicated amount will be used as a gross error check. 

If the crew believes a gross error check was not within an acceptable amount, the aircraft shall not be flown and an appropriate entry into the Defect Endorsement Log shall be made. The crew should then seek Engineering assistance to rectify the defect. 

The manual did not define an ‘acceptable amount’ for the two gross error checks (last two dot points).  

In addition, the C441 pre-flight checklist stated: 

Verify current fuel status and ensure balance [between both tanks] is within 300lbs. Enter indicated total fuel quantity on board into the Garmin 530 “Fuel Planning” page after re-fuelling. 

The C441 cruise checklist stated: 

Calculate and note destination fuel on current or average estimated ground speed and current fuel flow. Monitor throughout flight. Check balance [between both tanks] is within 300 pounds. 

None of the cross-check methods in FO6 referred to computed fuel. In addition, none of the methods stated in FO1 or FO6 referred to the use of estimated destination fuel or estimated fuel burn based on using flight-planned fuel burn figures. 

Senior pilots indicated that a pilot should also reference the flight-planned fuel figures as a crosscheck, and they described the operator’s flight planning software as accurate and reliable. One senior pilot stated that if the difference between the flight-planned fuel burn and the recorded fuel burn was more than 100 lb, they would be attempting to determine the reason for the discrepancy. Senior pilots reviewed the flight plan produced for the four sectors on the day of the occurrence and noted no errors or omissions in its preparation. 

Use of flight logs 

The operator’s pilots used a flight log form to record details of each of the flights conducted on a specific day. In terms of fuel, the form allowed a pilot to record the following in separate columns: 

• total fuel quantity at departure 
• fuel burn 
• residual fuel 
• added fuel (in L) 
• added fuel (in lb). 

In the top row, the residual fuel from the previous flight log could be entered. 

FO1 stated: 

The figure placed in the ‘Total Fuel QTY at Dept’ column of the Flight Log Form shall be the fuel total as described in the aircraft type specific operations manual. 

FO6 did not provide any definition of what should be placed in the total fuel quantity column for a C441. 

A review of flight logs for VH-LBY from 1 February to 2 March 2018 indicated the following: 

• The total fuel quantity was always the residual fuel from the previous flight log entry or, if the aircraft had been refuelled, the total fuel quantity was always the calculated fuel quantity. That is, the amount always matched the residual fuel plus the added fuel (in lb). If the indicated fuel quantity was being recorded, these figures would have at least occasionally varied slightly from the residual or calculated fuel quantity. 
• The fuel burn was always the total fuel quantity at departure minus the residual fuel. 
• No comments were included in the ‘Comments / Observations’ section on the flight logs to indicate any differences between the calculated fuel and indicated fuel prior to a flight, or the results of any other cross-checks. 

Sectors on 2 March 2018 

The pilot prepared a flight plan using the operator-provided flight planning software. Key flightplanned fuel figures for the 2 March are presented in Table 1. 

Table 1: Flight plan extract - planned fuel figures 2 March 2018 

The pilot reported that, prior to the first sector on 2 March, they compared the indicated fuel quantity to the residual quantity recorded in the flight log from the last sector on the previous day (1,300 lb). The pilot stated that the fuel quantity gauges were as expected following this comparison and they carried forward the residual quantity to the new flight log. The actual indicated fuel quantity was not recorded (nor was it required to be). 

After the aircraft was refuelled, the pilot recorded the added fuel (1,050 lb) on the flight log. They also calculated the total fuel quantity at departure as 2,350 lb and recorded that figure on the flight log. The pilot recalled that, when checking the gauges after refuelling, the indicated fuel quantity was as expected. The actual indicated quantity was not recorded (nor was it required to be). 

At the end of each sector, the pilot recorded the indicated fuel quantities on the back of the flight plan. This included the raw indicated amounts in each tank, the total raw indicated quantity and the total indicated quantity after applying the appropriate calibration card corrections. These notes are reproduced below in Table 2. The pilot’s application of the calibration card corrections for the last two sectors contained minor errors. The recorded residual fuel at Halls Creek should have been 1,410 lb and the recorded residual fuel at Fitzroy Crossing should have been 1,310 lb. 

Table 2: Pilot’s fuel notes regarding indicated quantities on 2 March 

The pilot’s notes contained the information not included in brackets. The information in brackets is provided to assist the reader with interpreting the pilot’s notes. *Figure should have been 1410. ** Figure should have been 1,310. 

At some point later, the pilot transferred the residual fuel figures to the flight log. The recorded flight log figures are reproduced in Table 3. The pilot also annotated the residual fuel amounts after each sector on the flight plan next to the estimated destination fuel quantities after each flight. 

Table 3: 2 March 2020 flight log extract – recorded fuel figures 

* This figure should be 130, based on the indicated quantities recorded. 

 In terms of cross-checks of the fuel quantities: 

• The fuel burn and residual quantity figures for the first two sectors were similar to the flightplanned figures (that is, 1,810 and 1,430 lb compared to 1,841 and 1,467 lb respectively). The pilot reported that the differences were minimal and not a concern. However, there was a large disparity between recorded and planned figures for the third sector (that is, 1,300 lb indicated compared to 1,110 lb estimated). 
• The pilot stated that although the 1,300 lb indicated quantity after the third sector was higher than expected, it was greater than the planned minimum quantity required for the final sector (977 lb) so no further investigation was made. 
• There was no evidence to suggest that any comparison of (recorded versus planned) fuel burn figures was made. The fuel burn for the third sector was recorded as 230 lb but should have been 130 lb based on the recorded residual fuel figures at the end of the second and third sectors, and 100 lb if the recorded residual fuel figures were correctly derived. This recorded fuel burn was substantially less than the flight-planned fuel burn (357 lb), and the actual flight time (32 minutes) was slightly longer than the planned flight time (28 minutes). 
• There was no evidence to suggest that any computed fuel quantity calculations were made during the flight (that is, using fuel flow and time to run during flight or by using actual flight time with an average or block fuel consumption rate).   
• Although the pilot was aware of the fuel totaliser capability in the Garmin 530, this was not used to do a gross error check of the fuel quantities as the pilot did not consider this to be mandatory. In other words, the pilot did not use the Garmin 530 to ascertain the fuel remaining after each flight and compare that figure with the recorded residual fuel based on fuel quantity indications. The pilot reported that they had seen other pilots use this gross-error check but 

that it was not used regularly.  A senior pilot based in Broome also advised that it was possible this cross-check was not routinely conducted by the other Broome-based pilots. 

• On completion of each sector, the pilot did not conduct the gross error check that utilised the L/R FUEL X-FER FAIL annunciators to indicate if the tank quantity was above or below 580 lb. Although it was specified in the operator’s FO6 manual, the pilot stated being unaware of this gross error check method at the time of the occurrence. A senior pilot advised that it was routinely taught to pilots during line training. 

Sectors on 1 March 2018 (day prior to occurrence flight) 

The pilot of VH-LBY on the day of the occurrence operated the same aircraft on the previous day (1 March) for two sectors from Broome to Kununurra and return. Key flight-planned fuel figures are in Table 4 below. 

Table 4: Flight plan extract – planned fuel figures 1 March 2018 

The recorded fuel figures on the flight log are shown in Table 5. 

Table 5: 1 March 2020 flight log extract – recorded fuel figures 

 For both sectors, the recorded fuel burn derived from the total fuel quantity at departure and residual fuel quantity figures was significantly below the flight-planned estimates, even though the flight times were about the same. For the first sector the recorded fuel burn (664 lb) was 201 lb (23 per cent) less than planned, and for the second sector the recorded fuel burn (730 lb) was 122 lb (14 per cent) less than planned. 

Estimated fuel on board during recent sectors 

The operator estimated that the fuel burn during the fourth sector on 2 March (occurrence flight) was about 420 lb. Given that about little or no usable fuel was remaining when the aircraft landed on the highway, the aircraft therefore departed Fitzroy Crossing with about 420 lb on board. 

Using flight-planned fuel figures, the actual fuel on board for each of the sectors on 1 and 2 March was estimated and compared with the indicated fuel quantities, as shown in Table 6. The estimated fuel quantities would become less reliable as they progressed further back in time. Nevertheless, the comparisons showed that the fuel gauges were over reading throughout both days, and the amount of over reading substantially increased prior to the last sector and after the aircraft landed on the highway during the fourth sector. It also significantly increased after both of the sectors on 1 March. The amount of over reading did not increase on every flight. 

Table 6: Indicated and estimated fuel quantities during 1 and 2 March 2018 

Indicated fuel quantities as recorded on the flight log except for minor corrections. Estimated fuel quantities based on using known quantity after last flight and using flight-planned fuel burns for previous flights. All figures rounded to the nearest 10 lb for readability. *The actual gauge readings prior to the first flight each day were not recorded. It is assumed that the calculated fuel quantity (recorded) was close to the indicated fuel quantity. **Calibration card corrections applied to gauge readings. 

Given the estimated fuel quantities, if the pilot had conducted gross error checks utilising the L/R 

FUEL X-FER FAIL annunciators, the annunciators would have illuminated at the end of sector 2 at Halls Creek and the end of sector 3 at Fitzroy Crossing on 2 March. They also would have illuminated at the end of the second sector on 1 March. 

Based on post-occurrence testing, the L/R FUEL LEVEL LOW annunciators would have illuminated when each tank quantity reduced to 160 lb. This amount equates to about 30 minutes of flying time, so the annunciators would have been activated during climb between 5 and 10 minutes after take-off from Fitzroy Crossing if the two tanks had the same quantity of fuel. If the tanks had different quantities, then one of the lights would have come on earlier. 

Given the likely quantity of fuel on board, it is possible that the fuel system annunciation observed during taxi was R FUEL LEVEL LOW rather than R X-FER PUMP FAIL. Given that the transfer pumps would have been on at that stage, the R X-FER PUMP FAIL should not have illuminated. 

As the pilot related, when the pilot observed the FUEL LEVEL LOW annunciators illuminated, the fuel quantity indications were sufficient for continuation of the flight to Broome. The pilot reported that they had developed a mistrust of the annunciators because of a faint glow during night flights and intermittent activation on various occasions. In contrast, the pilot had no experience of fuel quantity indication faults in the C441 and believed that the system was reliable. 

Once the fuel quantity in a tank reduced to below 80 lb, the FUEL X-FER FAIL annunciators would have illuminated. That amount provides for about 15 minutes flying time, so the annunciators would have been activated in the 5 minutes prior to top of descent. In that time period, the aircraft was between 55 and 25 NM to the south of Curtin. 

Review of other flight logs 

The ATSB reviewed the recorded fuel figures in the aircraft’s daily flight logs from 1 February 2018 to 2 March 2018. This included 10 flight logs from 1–13 February (prior to the wingtip damage event) and four flight logs from 27 February to 2 March (following the wingtip damage repair). A small number of maintenance and training/check flights were excluded, and the last sector (occurrence flight) on 2 March was excluded. 

Summary results are provided in Table 6. Based on the review, the following was noted: 

• The average recorded fuel burn rate up to 13 February was 533 lb/hour and the average rate after 13 February was 465 lb/hour (Table 6). This difference of 68 lb/hour equated to a reduction in fuel burn rate of 13 per cent. If this rate was applied over the total flight time in the period after 13 February (13.0 hours), this equated to about 880 lb less fuel burned than expected. 
• The recorded fuel burn rate on each sector varied significantly. As would be expected, the rate was generally shorter as the length of the flight increased. The average flight duration up to 13 February was 58 minutes and the average after 13 February was 68 minutes. 
• To ensure the best comparison, a sample of flight logs was chosen from the period 1–13 February that matched the four flight logs from after 13 February (in terms of the destinations and/or the durations of the sectors). Where there were multiple logs that matched, the data was averaged. This resulted in a matched-sample average fuel burn rate during the period 1– 13 February of 509 lb/hour (Table 6). This difference of 44 lb/hour equated to a reduction in fuel burn rate of 9 per cent. If this rate was applied over the total flight time in the period after 13 February, this equated to about 570 lb less fuel burned than expected. 
• For each of the four flight logs after 13 February, the matched sample had a higher fuel burn rate (ranging from 7 to 12 per cent). The rates were also lower than another matched sample from flights in October 2020. 

Table 7: Flight times and fuel burn rates for periods before and after 13 February 2018 

With regards to specific flights: 

• For flights of the same duration, there was a notable variance in recorded fuel burns (both before and after 13 February), which increased the difficulty of identifying patterns in recorded fuel burns for specific sectors. However, the most notable outlier was the third sector on 2 March, when the fuel burn was substantially lower than the average for similar flights both before and after 13 February. 
• Estimated fuel burns for all the flights were derived from using the fuel planning figures from 1 and 2 March and the recorded flight times for each sector. Based on this approach, a small number of flights during 1–13 February had recorded fuel burns significantly lower than expected fuel burns, and there was no obvious pattern in these flights. For flights after 13 February, the last 3 of the 4 sectors on 27 February, the last of the 2 sectors on 28 February, and the first of the 2 sectors on 1 March had recorded fuel burns significantly lower than the expected fuel burns (ranging from 21 to 29 per cent lower). 
• As already noted, the fuel burn was substantially higher that the flight-planned burn for the third sector on 2 March and a similar result would have occurred for the fourth sector had the flight been completed successfully. 

Operator fuel usage monitoring 

A requirement to monitor fuel usage existed within FO1, which stated: 

The FOM monitors the actual fuel burn data and makes adjustment to the Champagne Flight Planning Software where necessary. 

Although FO1 did not state how this was to be achieved, nor at what frequency, the chief pilot explained that they undertook this duty on a monthly basis. The chief pilot explained that this was a broad review of fuel usage but on a few occasions the review required follow up maintenance to confirm usage data. 

There were no fuel usage anomalies recorded or reported from the flights after 13 February until the occurrence flight. The exact date on which the last fuel usage monitoring was conducted for VH-LBY could not be determined. 

Other fuel management occurrences 

AO-2007-017

On 26 June 2007 at 0639 Western Standard Time, an Empresa Brasileira de Aeronáutica S.A. EMB-120ER aircraft, registered VH-XUE and operated by Skippers Aviation, departed Perth on a contracted passenger charter flight to Jundee Airstrip (Western Australia). On final approach to Jundee Airstrip, the aircraft drifted left of the runway centreline. As the flight crew initiated a goaround, the aircraft aggressively rolled and yawed left, causing the crew control difficulties. 

The left engine had sustained a total power loss following fuel starvation, because the left fuel tank was empty. The left fuel quantity gauge was indicating 300 kg at the time. A fuel probe in the left fuel tank had failed, which resulted in the left fuel quantity indicator over reading. The aircraft was not fitted with a fuel low level warning system (nor was it required to be). 

The investigation concluded that the practices used by the operator’s EMB-120 pilots for measuring and logging of fuel quantity were inconsistent. The aircraft was fitted with dripless measuring sticks and a fuel totaliser, but these devices were not being effectively used for crosschecking the fuel quantity gauge indications and aircraft were rarely refuelled to a known quantity. Fuel quantity cross-checks largely relied on checking the indicated quantity after refuelling with the calculated quantity (residual plus refuel quantity), with significant discrepancies in this amount not always being adequately explained. 

Following the occurrence, the operator revised its procedures, which included using a dripless measuring stick each day and improving its recording practices and the checking of flight logs. 

AO-2007-049

On 18 October 2007, the pilot of a Cessna C404 Titan aircraft, registered VH-TMP, was conducting a charter flight from Adelaide Airport to Parafield Airport, Beverley Airstrip, and return to Adelaide (South Australia). The pilot had commenced descent into Adelaide on the final sector of the flight when the right engine lost power. There were no apparent anomalies and the fuel quantity gauges were showing adequate fuel in each tank. After securing the right engine, the pilot continued to Adelaide Airport and landed without further incident. 

Aircraft maintenance engineers who inspected the aircraft reported that 3 L of fuel was drained from the right tank, and the associated fuel quantity gauge was indicating 150 lb (95 L). An engineer found that one of the electrical circuits in the right fuel quantity indication system had a high resistance. After wiring in the circuit was repaired, the fuel quantity gauge correctly indicated zero fuel in the right tank. Calibration of the fuel quantity indication system (FQIS) was carried out 

and, during that process, the left and right signal conditioners were found to be unreliable and were replaced or repaired. 

The investigation concluded that the operator’s pre-flight fuel quantity measurement procedures were predicated solely on FQIS readings, with no provision for regular independent checks of fuel quantity. Problems with the accuracy of recording details on the flight logs was also identified. The operator amended its fuel documentation and fuel planning procedures to include a secondary means of verification of fuel on board to cross-check the electric fuel indication system. 

Safety issues identified 

During the AO-2007-017 investigation, the ATSB issued safety advisory notice (SAN) AO-2007017-SAN-013, which stated: 

The ATSB suggests that all turboprop operators take note of the following safety issue and review their processes accordingly: 

The processes used by some turboprop operators for checking the fuel quantity on board prior to flight have not used two methods of sufficient independence. In particular, the practice of using a comparison of a gauge indication after refuelling with the gauge indication prior to refuelling plus the fuel added is not adequate to detect gradually developing errors in gauge indications. 

Investigations AO-2007-017 and AO-2007-049 also identified safety issues concerning regulatory guidance for fuel quantity measurement as follows: 

• Regulatory guidance regarding the measurement of fuel quantity before flight lacked clarity and appropriate emphasis and did not ensure that the fuel quantity measurement procedures used by operators included two totally independent methods. (AO-2007-017) 
• Guidance promulgated by the Civil Aviation Safety Authority (CASA) in Civil Aviation Advisory Publication 234-1 regarding aircraft fuel requirements allowed for a fuel quantity cross check to be conducted after refuelling and without reference to an independent source of onboard fuel quantity information. (AO-2007-049) 

In 2016, the ATSB started an investigation into the fuel exhaustion and subsequent collision with terrain of a McDonnell Douglas Corporation 369 helicopter. The final report stated: 

A search of the ATSB database for the period from 2003 to 2017 found 76 reports of ‘fuel exhaustion’, which included four accidents with fatalities, three accidents with serious injuries and two accidents with minor injuries, with some accident reports including more than one injury classification. The operations represented in the occurrences included sport aviation, private, aerial work, training, charter and air transport–low capacity. From the 76 occurrences, 26 were for commercial operations, and all reports were for aircraft not greater than 5,700 kg MTOW… 

The presence of commercial operators indicated that the applicable fuel regulations may be less than adequate, and shows that commercial operators may not implement effective fuel policies and training to prevent fuel exhaustion events. 

The final report also included the following safety issue: 

The current legislation does not require commercial operators of aircraft not greater than 5,700 kg maximum take-off weight to provide instructions and procedures for crosschecking the quantity of fuel on board before and/or during flight. This increases the risk that operators in this category will not implement effective fuel policies and training to prevent fuel exhaustion events… 

It was noted that CASA had commenced a review of regulatory requirements and guidance in 2016 in response to the safety issues: 

The Civil Aviation Safety Authority (CASA) has started project CD 1508OS, which was published on their website 20 January 2016. The project contains the proposed changes to Civil Aviation 

Regulation (CAR) 234, the issuance of a CAR 234 Legislative Instrument, and revised Civil Aviation 

Advisory Publication (CAAP) 234-1(2): Guidelines for aircraft fuel requirements, CAAP 215-1(2): 

Guide to the preparation of Operations Manuals, Volume 2, appendix B9: Fuel management, and the Air Operator’s Certificate (AOC) handbook Volume 2 – Flying Operations – Section 6: Fuel policy and related requirements. Once made into law, the amendments to the existing CAR 234 will commence on 8 November 2018. 

A key outcome of the amendment is providing clarity about the regulatory requirements that apply to fuel by having those requirements set out in a legislative instrument. This overcomes difficulties with the previous arrangement, where requirements were set out in guidance material ‘called up’ by regulation, in that the requirements were often not readily recognised as having the force of law. CASA 29/18 – Civil Aviation (Fuel Requirements) Instrument 2018 sets out the legislative requirements that: 

• specify the matters that must be referenced by the operator and the pilot in command in determining the quantity of usable fuel required for a flight 
• specify the quantities required to commence a flight and also to continue a flight 
• require that inflight fuel management be conducted, and 
• specify the contingencies to which additional fuel calculation must be applied. 

To assist industry and CASA understanding of the changes to the fuel requirements in legislation, the amendment to guidance material CAAP 234-1(2) will be published. It will contain enhanced guidance on the generally applicable fuel related areas of the legislative instrument. CAAP 234-1(2) will differentiate between requirements and guidance.

The updated regulatory material was published November 2018 (8 months after this occurrence). 

Emergency procedures 

The emergency landing area was a single carriageway road with two-way traffic. The road was only just sufficiently wide for the aircraft to land on (Figure 5). For comparison, the runway at Broome Airport is 45 m wide and other aerodromes the operator used C441 aircraft normally had runways of 30–45 m wide (and occasionally a narrow runway of 23 m wide). The wingspan of a C441 is about 15 m. 

Figure 5: The emergency landing area

Source: Broome Advertiser 

The operator’s aircrew emergency procedures manual highlighted the risks to an individual during an emergency landing and included the following detail on the brace for impact position: 

Passengers must be encouraged to correctly fasten their seat belts and practice the brace for impact position in a prepared emergency landing. 

If a seat belt is not worn in an impact, the body continues moving forward at the same speed as the aircraft was moving before the impact. 

Even with a seat belt fastened, the deceleration causes the head and limbs to fly forward until they make contact with something stopping their movement, (that is, the seat or bulkhead in front). In most cases, this leads to traumatic injury preventing movement away from the aircraft and/or death. The brace for impact position is a compact position allowing the body to move very little during the impact and post impact deceleration. This position should increase the chance for survival... 

The brace for impact position must be held until the aircraft completely stops. 

In the case of the 2 March 2018 forced landing on the highway, the pilot did not instruct the passengers to adopt the brace-for-impact position.

__________

1. For demonstrative purposes, the ATSB utilised a figure of 600 lb per hour as a block fuel consumption rate. This was based on the average planned fuel consumptions from the occurrence flight plan, taking into account climb and cruise segments.
2. The fuel burn during start and taxi can be similar regardless of flight duration, and there is a higher fuel burn rate during climb than during cruise. Actual fuel burns prior to and after each flight were not known and not able to be subtracted.
3. ATSB Investigation AO-2007-017, Fuel starvation Jundee Airstrip, WA – 26 June 2007 VH-XUE Empresa Brasileira de Aeronáutica S.A., EMB-120ER
4. ATSB Investigation AO-2007-049, Engine power loss (fuel tank exhaustion) 102 km north Adelaide, SA 18 October 2007 VH-TMP Cessna Aircraft Company C404
5. ATSB investigation AO-2016-078, Fuel exhaustion and collision with terrain involving McDonnell Douglas Corporation 369, VH-PLY, 36 km NW Hawker, South Australia, on 17 July 2016

Safety analysis

Introduction

The Cessna 441 (C441) aircraft departed on a scheduled passenger flight from Fitzroy Crossing to Broome without sufficient fuel to reach the destination. This was not identified by the pilot and subsequently the fuel tanks were exhausted and both engines lost power.

Although the weather was suitable for visual flight rules and the aircraft was within range of a highway, the pilot was faced with a dual engine failure, a situation that is not usually addressed in multi-engine training and checking. The pilot successfully landed the aircraft on the nearby highway and there were no passenger injuries or aircraft damage.

A fuel exhaustion event on scheduled passenger transport flight is a serious incident. Accordingly, this analysis will discuss the accuracy of the fuel quantity indication system (FQIS), the procedures and practices used to check the fuel quality, the procedures and practices used to check the fuel quantity, and the effectiveness of the fuel low level warning system.

Fuel quantity indication system error

Post-occurrence inspection of the fuel system identified water contamination of the fuel tanks. The presence of water on the probes had a significant effect on probe functionality, resulting in over reading of the fuel quantity in the tanks. The FQIS functioned appropriately after the water was removed.

More specifically, following the engine power losses and forced landing, the fuel quantity gauges indicated 1,120 lb. On return to Broome, having drained all usable fuel on board, the gauges indicated 740 lb. In addition, prior to the occurrence flight, the gauges indicated about 1,310 lb (after applying fuel calibration card corrections) when there was only about 420 lb of usable fuel on board.

The source of the water contamination could not be definitively determined. It is likely to have occurred at some point during the period 13–26 February, when wingtip damage was being repaired. A review of the aircraft’s flight logs identified that recorded fuel burns after this period were consistently lower than fuel burns prior to this period.

Based on the available information, the water was unlikely to have been introducing during refuelling. It is possible that it was associated with the aircraft sitting in a humid environment for a period of time and, because the tanks were close to empty (about 590 lb total fuel on board), condensation forming in the tank.

It is reasonable to presume that the influence of the water on the fuel quantity gauge indications increased over time. If there had been a substantial step change in the gauge indications (more than the fuel added), then it is likely that this would have been detected when the aircraft undertook a test flight following the repair. However, there was no indication in the flight logs of a substantial discrepancy.

Nevertheless, it is also unlikely that the amount of over reading increased in a linear manner over time. The limited information available suggested that there may have been larger increases in over reading when the fuel levels were lower, which would be consistent with less water on the probes when the fuel tanks were at higher levels. 

Fuel quality management

Considering the level of water contamination found after the occurrence, and the length of time the water had been in the aircraft, it is unclear why this problem had not been detected through fuel quality testing. Fuel drains were required to be conducted by the operator’s pilots prior to the first sector each day and following each refuel. This should have resulted in at least nine inspections prior to the occurrence flight. However, none of these checks appeared to identify an unusual amount of water.

The pilot reported conducting a fuel drain during prior to the first sector on the day of the occurrence but did not report observing water in the fuel and did not test the sample using the water detection capsule. A final opportunity to detect contamination was available following aircraft refuelling. However, the pilot did not conduct a fuel drain and chemical test following the refuel, which reduced the opportunity to detect contamination.

At the time of the occurrence, fuel in the hopper area of each fuel tank of VH-LBY could not be sampled because the standard fuel drains were located elsewhere (including the low points of the fuel system). Although fuel was able to circulate throughout the tank, the hopper was designed to limit the outflow of fuel. As such, it is possible that some fuel samples were not representative of the fuel in the hopper. Nonetheless, not all of the water contamination was found to be in the hopper tanks.

Fuel quantity management

Overview

The operator had several processes in place to check the functionality of the FQIS on its C441 fleet, including several methods that pilots could use to cross-check the fuel quantity gauge indications with other sources.

One reliable and independent method of cross-checking fuel quantity gauge indications is to use some form of direct reading of the fuel quantity; however, no direct reading mechanisms were available for the C441.

Another reliable and independent method of cross-checking fuel quantity gauge indications is to fill the tanks to capacity or to empty the tanks of usable fuel and add a known quantity of fuel. Due to the nature of the operator’s flights, its C441 aircraft were rarely refuelled to capacity during normal operations. However, the operator required each of its C441’s fuel tanks to be refuelled to a known quantity (500 lb per side) every 150 flight hours. Unfortunately, the last check on VH-LBY was done 66 hours prior to the occurrence (and 53 hours prior to the likely start of the FQIS error).

The operator’s fuel management procedures were also supported by regular maintenance inspections to confirm FQIS accuracy. However, in this instance the error had developed in between maintenance inspections.

Ultimately, detecting the FQIS error in this case relied on the operator’s procedures for cross-checking fuel quantity gauge indications, and its pilots use of those procedures.

Check of indicated versus calculated fuel quantities prior to a flight

The primary cross-check method for the C441 fleet specified in the operator’s manuals was a check of the indicated fuel quantity against the calculated fuel quantity (or residual fuel, indicated at the end of the previous flight, plus the refuel amount). This is a relatively simple and commonly used cross-check method in the aviation industry, which can only be used when fuel is added.

However, this cross-check method is not an independent check of the FQIS. It is simply checking the difference in the fuel quantity gauges after fuel has been added. In other words, the check is self-referencing the same source of information. Although it may detect some types of FQIS error, it is generally not adequate to detect gradually developing errors in gauge indications.

The extent to which the method could have been effective on this occasion was difficult to determine because of limitations in the way the C441 pilots were recording information on the flight logs. The operator required pilots to confirm that the difference between the residual quantity recorded on previous flight log and the indicated quantity prior to flight was within 5 per cent of higher amount. After refuelling, pilots were to confirm the difference between the indicated quantity and calculated quantity (sum of residual/indicated plus added fuel) was within 5 per cent. These comparison checks were not recorded, nor required to be recorded. Consequently, pilots were not able to identify any differences or trends in indicated readings over time, or in the indicated versus calculated readings over time.

On the day of the occurrence, the pilot refuelled the aircraft prior to the first sector. The pilot reported that the fuel quantity gauge indications were verified as required before and after refuelling. The residual fuel figure from the previous day was within comparison check limits and therefore carried forward on the flight log, facilitating the continuity of the FQIS error.

Check of indicated versus computed or planned fuel quantities

The operator’s Flight Operations Manual required pilots to compare the indicated fuel with the computed fuel on board (although the manual mistakenly used the word ‘calculated’ instead of ‘computed’). This meant comparing the indicated fuel quantity at the end of a flight with a value based on the indicated quantity at the beginning of the flight and the computed fuel burn during the flight.

In addition, during cruise, C441 pilots were required to compute the destination fuel using current or average groundspeed and current fuel flow, but there was no requirement for this to be recorded. The pilot of the occurrence flight did not appear to use this method, and the extent to which other pilots were using it was unclear.

The operator’s pilots did report that they regularly compared flight-planned fuel burns with recorded fuel burns (based on fuel quantity gauge indications) after each sector. The pilot of the occurrence flight reported that, following each of the first two sectors that day, there was no notable discrepancy between the recorded fuel burns and the flight-planned fuel burns. However, the recorded fuel burn for the third sector based on fuel quantity gauge indications was substantially lower than the expected fuel burn based on the flight plan. Even so, in the absence of relevant information from other sources, the pilot rationalised that this discrepancy was not significant, given that the indicated fuel quantity was significantly more than the minimum required for the flight.

The ATSB noted that there appeared to be significant variability in recorded fuel burns and the associated fuel burn rates, both before and after the FQIS error started. The exact reasons for the size of this variability are not clear, but its effect would be to make it difficult for a pilot to detect when a discrepancy was meaningful. The fuel quantity indications on the aircraft also needed significant corrections from the fuel calibration card, which complicated any calculations. Nevertheless, in the case of the sector prior to the occurrence flight, the discrepancy was substantial and should have prompted further inquiries by the pilot about the fuel quantity indications.

At that stage, the pilot had limited other options available to verify the amount of fuel on board. However, they could have discussed options with a senior pilot or elected to add more fuel.

Check of indicated quantity versus fuel totaliser reading at end of a flight

The operator’s procedures required that C441 pilots enter the indicated fuel on board into the Garmin GNS 530 system at the beginning of each sector, and then compare the fuel quantity gauge indications with the fuel totaliser indication (of fuel on board) at the end of a sector. In effect, this cross-check method, using an independent source, provided a means of detecting whether there was a change in the reliability of the fuel quantity gauges during a flight (or a longer period).

The operator had not specified a threshold level or ‘acceptable amount’ for this check. Accordingly, if a pilot followed the procedure, it was unclear what level of difference between the gauge indications and the totaliser indications warranted action.

More problematically, the procedure was not always being used. The pilot of the occurrence flight reported that they did not think it was mandatory, based on observing other pilots, and did not use it themselves. A senior pilot also agreed it may not have been used regularly by other pilots.

If the pilot of the occurrence flight had used the procedure, then it would have identified a significant discrepancy after the third sector on the day of the occurrence. It is also likely to have detected discrepancies on the two sectors they conducted the previous day. In addition, if the method was being regularly used, it is likely that it would have identified discrepancies on some sectors conducted by the operator’s pilots on previous days.

Check using the X-FER PUMP FAIL annunciators

The operator’s procedures also required that C441 pilots, prior to engine shutdown after a flight, switch the fuel boost pumps off to check whether either of the X-FER PUMP FAIL annunciators would illuminate. If they did, then this meant there was less than 580 lb in that tank. This check was coarse in nature, and would only detect a problem in some cases, depending on the indicated fuel quantity.

Although the procedure was clearly stated in the operator’s operations manual, the pilot of the occurrence flight reported not being aware of this requirement and so was not conducting these checks. Post-occurrence fuel quantity calculations suggests that this gross error check would likely have identified the indication error on arrival at Fitzroy Crossing after third sector and possibly at Halls Creek after the second sector on the day of the occurrence. It is likely it would also have detected a problem after the last sector the previous day.

Summary

In summary, the operator had specified multiple methods for its C441 pilots to use to cross-check fuel quantity indications. However, there were limitations with the design, definition and/or application of these methods. In particular, the primary method used (indicated versus calculated) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications. In addition, the operator’s pilots did not record sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified, and the pilots did not routinely cross-check fuel gauge indications with the information from the independent fuel totaliser.

In the case of the occurrence flight, the pilot had not been applying two of the operator’s cross-check methods (that is, the use of the fuel totaliser and the use of the X-FER PUMP FAIL annunciators). Using either or both of these methods would have identified discrepancies, which should have resulted in the pilot concluding that the FQIS was not functioning correctly.

Low fuel level warning

Illumination of the L/R FUEL LEVEL LOW annunciators on the C441 indicated that 150 to 250 lb remained in the associated tank. This would be approximately 30 to 50 minutes flight time for each engine. The annunciators on VH-LBY were found to be serviceable during post-occurrence inspections and were illuminating at approximately 160 lb remaining in each tank, or roughly 30 minutes flight time.

The fuel level low annunciators are independent of the FQIS and of each other (left and right). Landing as soon as possible would be the most conservative response to a fuel level low annunciation.

Although the pilot reported that the annunciators illuminated in the 10 to 15 minutes prior to the first engine failure, analysis suggests it likely that the annunciators had been illuminated well prior, sometime during the climb. In that timeframe, the aircraft was within range of suitable airports to which a diversion could have been effected.

The pilot considered the FQIS to be reliable but based on experience did not trust the annunciators. As such, the pilot believed there was sufficient fuel on board and continued to Broome and disregarded the fuel level low annunciations. Overall, the pilot’s response to the various fuel system annunciations was consistent with confirmation bias, or a tendency for a person to seek information that confirms or supports their hypotheses or beliefs, and discounting or not seeking information that contradicts those hypotheses or beliefs (Wickens and others 2013). This was likely influenced by not completing all the required fuel quantity cross-checks during previous sectors, resulting in the pilot having little information available (other than the annunciators) to doubt the fuel quantity indications.

Briefing prior to an emergency landing

During the emergency landing, the pilot did not instruct the passengers to adopt the brace-for-impact position.

In a recent cabin safety bulletin, the Civil Aviation Safety Authority (2020) advised:

Passenger survival rates are improved when they are informed about the correct use of equipment and the actions they should take in the event of an emergency, such as how to assume an appropriate brace for impact position.

The brace position has been determined to be the most effective protective position for passengers and crew to adopt to mitigate the potential for injury during impact.

The “brace for impact” position is an action where a person pre-positions his/her body against whatever he/she is most likely to be thrown against, and which may significantly reduce injuries sustained.

The brace position serves two purposes:

1. it reduces flailing by having the forward-facing occupant flex, bend, or lean forward over his/her legs in some manner

2. it reduces secondary-impact injuries by pre-positioning the body, predominantly the head, against the surface that it would otherwise strike during that secondary impact, thus reducing the momentum of the head and other parts of the body.

In summary, because the passengers did not adopt the brace-for-impact position, this increased the risk of injury during the emergency landing. It is likely that the pilot was experiencing a high workload during the approach and emergency landing, but pilots in such situations should ensure, when time is available, that passengers are appropriately briefed for any emergency landing and instructed to brace for impact.

Findings

From the evidence available, the following findings are made with respect to the fuel exhaustion and forced landing involving Cessna 441, VH-LBY, 39 km east‑south‑east of Broome Airport, Western Australia on 2 March 2018.

Contributing factors

• Due to water contamination in the fuel tanks, the aircraft’s fuel quantity gauges were significantly over reading on the day of the occurrence and on previous days. This ultimately resulted in the aircraft departing for a flight without sufficient fuel to reach its destination.
• Although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. These included:
  • The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications.
  • Pilots did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified.
  • Pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser. (Safety issue)
• Although the pilot routinely compared indicated versus calculated fuel quantities, and indicated versus flight-planned fuel quantities, the pilot did not routinely conduct two other methods stated in the operator’s procedures for cross-checking fuel quantity gauge indications.
• The recorded fuel burn for the previous (third) sector based on fuel quantity gauge indications was substantially lower than the expected fuel burn based on the flight plan. However, in the absence of relevant information from other sources, the pilot did not regard this as being an indication of a fuel quantity indicating system problem.
• The pilot disregarded the L/R FUEL LEVEL LOW annunciators, which likely illuminated approximately 30 minutes before the fuel was exhausted in each tank, and when the aircraft was still within range of suitable alternative airports. The pilot relied on the (erroneous) fuel quantity indications and continued to Broome until the engines lost power, at which point a forced landing on a highway was the only remaining option.

Other factors that increased risk

• Although the pilot stated that they conducted a fuel quality check prior to the first flight of the day, they did not conduct another check after refuelling (as required by the operator’s procedures), increasing the risk of undetected fuel contamination.
• The pilot did not instruct the passengers to brace for impact prior to the emergency landing.

Other findings

• Following the complete engine power loss, the pilot assessed the aircraft would not reach Broome Airport, identified a suitable landing area, and conducted a forced landing without injury to the passengers or damage to the aircraft.

Safety issues and actions

Fuel quantity assessment methods

Safety issue number: AO-2018-019-SI-01

Safety issue description: Although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. These included:

• The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications.
• Pilots did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified.
• Pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser.

Safety action not associated with an identified safety issue

Safety action by Skippers Aviation

In April 2021, during the directly involved party process, Skippers Aviation advised that:

• There was a strong focus on Broome as an operating base, with the chief pilot now visiting multiple times per year, and regular audits being carried out.
• Communication between Broome and Perth had been enhanced.
• Emergency procedure training now emphasised brace commands.

Safety action by the Civil Aviation Safety Authority

In the 18 months following the occurrence, the Civil Aviation Safety Authority (CASA) conducted additional surveillance of Skippers Aviation through a series of visits, interviews and observation flights. Surveillance encompassed Airworthiness, Flight Operations, Cabin Safety, Ground Operations and Safety Systems. CASA noted that the operator had demonstrated improvements in the operations of its Broome base and recommended returning to a normal oversight level. No findings were issued on completion of the surveillance.

Sources and submissions

The sources of information during the investigation included:

• the pilot of the occurrence flight
• the operator (Skippers Aviation Pty Ltd)
• the Civil Aviation Safety Authority
• Airservices Australia.

References

Civil Aviation Safety Authority 2020, Cabin Safety Bulletin No.6 – Brace positions, available from www.casa.gov.au.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot of the occurrence flight
• the operator (Skippers Aviation Pty Ltd)
• the Civil Aviation Safety Authority
• Textron Aviation (Cessna).

Submissions were received from:

• the pilot of the occurrence flight
• the operator (Skippers Aviation Pty Ltd)
• the Civil Aviation Safety Authority
• Textron Aviation (Cessna).

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Fuel system schematics

Source: C441 Pilot’s Operating Handbook

Source: C441 Pilot’s Operating Handbook

Appendix B – Fuel system testing procedures

Source: Skippers Aviation Flight Operations Manual

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 1 November 2017, an Aeroprakt A22LS Foxbat was involved in a landing accident that resulted in the aircraft coming to rest inverted adjacent to the airstrip. Examination of the aircraft following the occurrence, identified that the right rudder control cable had failed in flight. Significant damage to the left rudder control cable was also identified at a similar location to where the right cable had failed.

Recreational Aviation Australia requested that the ATSB perform a detailed technical examination of the aircraft’s rudder control cables and associated rigging. The scope of this examination was limited to the identification of factors that contributed to the damage and subsequent failure of the cable. To facilitate this work, the ATSB initiated an external investigation under the Transport Safety Investigation Act 2003.

The ATSB analysis found that the right cable failed as a result of fatigue failure associated with significant wear of the individual wires (see Figure 1). Although the left hand cable did not fail, it was found to be unserviceable based on the standards set in the aircraft maintenance manual, due to fatigue fracturing of the wire strands. Both cables were found to be within material specifications.

Figure 1: Wear and associated fatigue fracture of wires on the right rudder control cable

Source: ATSB

Any further enquiries in relation to the accident investigation should be directed to Recreational Aviation Australia.

___________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.

On 9 October 2017, a Jonker Sailplanes CC JSIC 18/21 sailplane, registered VH-IBS, collided with terrain near Boggabilla, NSW. The pilot sustained fatal injuries.

The Gliding Federation of Australia (GFA) requested assistance from the ATSB to download information from an avionics unit on-board the sailplane, on the accident flight.

The GFA sent the avionics unit (the unit) to the ATSB facilities in Canberra. The unit was a LXNAV LX900. The device was badly damaged, with damage to the internal electronic circuit board. A micro-SD card, which was attached to the main circuit board, was also cracked (Figure 1). This micro-SD card contained the flight data.

Figure 1: Micro-SD card recovered from the avionics unit with the crack highlighted inside the red box

Source: ATSB

The micro-SD card was x-rayed, which confirmed damage to the internal electrical connections (Figure 2).

Figure 2: X-ray of micro-SD card with the crack highlighted inside the red box

Source: ATSB

The ATSB was unable to recover any data from the micro-SD card. A report documenting the ATSB’s work was provided to the GFA.

Any enquiries in relation to the investigation should be directed to the GFA.

______________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.

Safety summary

What happened

On the night of 27 February 2018, the Queensland Rail Network Control Officer (NCO) at Townsville planned to cross two freight trains at Oonoomurra on the Mount Isa line, Queensland. Train 9221 had departed Cloncurry at about 2310, travelling in an easterly direction toward its limit of authority at Oonoomurra. Shortly after train 9221 stopped at Oonoomurra, its rail traffic crew advised the NCO that the rear of the train was clear of the track section between Cloncurry and Oonoomurra.

The NCO then issued an authority to the crew of train 9T66, travelling in a westerly direction, to continue through Oonoomurra toward Cloncurry, as train 9221 had reported clear of that track section. The crew of train 9T66 entered Oonoomurra travelling at about 25 km/h. As the train rounded a sweeping left curve at the western end, the crew sighted three empty container wagons at the rear of train 9221, with the last wagon fouling the track. The driver made an emergency brake application but was unable to avoid a collision. The collision caused minor damage to the lead locomotive of train 9T66 and the last wagon of train 9221, derailing its trailing bogie. There was no injury to the rail traffic crew of either train.

What the ATSB found

The on-board information system in the lead locomotive of train 9221 was operating in a degraded state, displaying erroneous speed and distance information to the driver. The driver, unaware of the error, relied on the displayed indication of distance travelled to determine the last wagon of train 9221 was clear of the track section to its rear. The rail traffic crew of train 9221 did not make sure the train was in clear before releasing the track section to the NCO.

Towards the western end of the crossing, the track alignment resulted in the headlight of the lead locomotive on the opposing train projecting light predominately to the right of the track, away from train 9221. The rail traffic crew were observing the top sections of the adjacent bulk wagons but it was not until the track alignment transitioned to straight that the crew then sighted the last of three empty container wagons at the rear of train 9221. By this time, with the train travelling at 25 km/h and despite making an emergency brake application, a collision was unavoidable.

What's been done as a result

Pacific National (PN) verified the accuracy of the Functionally Integrated Railroad Electronics (FIRE) system on each 83-class locomotive in its fleet and the process for advising rail traffic crew to use alternative methods to validate accuracy of displayed information, should a ground radar fault occur. Additionally PN introduced procedures for the maintainer to identify restrictions to a locomotives operation as lead, and reinforced the implementation of procedures associated with the active identification of a stopping location with PN staff.

In the longer term, PN undertook to investigate procedural or locomotive-based system changes to alert rail traffic crew of an inconsistent speed fault, based on deviations greater than 7 per cent and to advise rail traffic crews of this faulty meter counter occurrence and the follow-up action taken. Additionally PN undertook to review the Townsville Bulk and the Coal Depot’s risk registers to ensure the identification of hazards associated with faulty FIRE system indications, and the implementation of appropriate control measures

Safety message

Rail traffic crews on both trains undertaking a cross at a directional travel station under the Direct Traffic Control safeworking system must validate rail traffic is complete and in clear prior to releasing the block to the rear of the rail traffic and prior to entering a block following receipt of a proceed authority.

The occurrence

What happened

At about 2310^[1] on 27 February 2018, the Queensland Rail (QR) Network Control Officer (NCO) at Townsville issued a direct traffic control (DTC) authority^[2] for the rail traffic crew of Pacific National freight train 9221 to depart Cloncurry, Queensland and proceed to Oonoomurra, located about 14.5 km by rail to the east. About the same time, the rail traffic crew of an opposing empty Aurizon fertiliser train 9T66 were departing Undina, Queensland, travelling west toward Oonoomurra (about 39 km by rail). The NCO planned to cross the two trains at Oonoomurra. The rail comprised of a single track with crossing loops.

Later that night at about 2334, the driver of 9221 advised the NCO that the train was approaching Oonoomurra, which was the limit of their authority. The driver reduced the train speed to around 18 km/h, crossed the Landsborough Highway level crossing before entering the western end of the Oonoomurra crossing location. The Oonoomurra crossing location is a directional travel station that is 1,033m long and equipped at each end with a trailable point^[3] set to divert an approaching train to the right side track. Directional travel stations between Townsville and Mount Isa are typically of similar length, equipped with trackside location boards that mark the limits of the respective Station and Section blocks and configured to divert an approaching train to the right (Figure 1).

Figure 1: DTC Blocks and position of Block Limit Boards

Source: Queensland Rail annotated by ATSB

As the locomotive cab passed the departure side^[4] of trackside location board BLB OA16, the driver selected the length counter feature of the on-board information system^[5] to measure the distance the locomotive had travelled after passing the board. The driver had previously set the length counter feature to a distance of 2,500 m, to assist in managing the train’s approach to any temporary speed restrictions.^[6] The driver controlled train speed and referred to the distance travelled on the length counter to reduce the potential of overshooting the limit of authority at the eastern end of Oonoomurra and ensure the rear vehicle was clear of BLB OA16.

The driver stopped the train when the length counter readout reduced to 1,431 m. Having travelled 1,069m (according to the counter) and considering train length (rounded to 1,000 m), the driver calculated that the rear wagon should be in clear of the adjacent track by around 70 m. The rail traffic crew crosschecked their location and limit of authority before contacting the NCO to confirm the rear of train 9221 had vacated the Cloncurry to Oonoomurra block^[7] behind them.

Shortly after, the rail traffic crew of train 9T66 contacted the NCO advising they were approaching Oonoomurra, the limit of their authority and the cross with train 9221. Having received confirmation from 9221 that they were clear, the NCO subsequently extended the authority of 9T66 from Oonoomurra through to Cloncurry.

Prior to 9T66 entering Oonoomurra, the rail traffic crew of 9221 contacted the crew of 9T66 on the train-to-train radio channel to confirm the trailable points were set for their arrival. Train 9T66 entered Oonoomurra, at speed of 25 km/h; the driver turned the locomotive headlight off as they approached the lead locomotive of 9221 to avoid shining light in the eyes of the opposing train crew.

After turning the headlight back on, the crew of 9T66 continued through Oonoomurra observing the wagons on 9221. As 9T66 transitioned into a sweeping left curve at the western end of Oonoomurra, with the headlight orientation ahead, the rail traffic crew could distinguish only the upper profile of the adjacent bulk wagons. The rail traffic crew sighted the end of the last bulk wagon, which appeared clear of their track.

As they continued through the curve, the rail traffic crew sighted three empty container wagons at the rear of train 9221, with the last wagon (RNDY 20927-S) fouling the track.

The driver made an emergency brake application shortly before locomotive 2838 collided with the middle of the last wagon of train 9221 (Figure 2). Locomotive 2838 was travelling at 25 km/h at the time of the collision and travelled about 104 m after the brake application.

Figure 2: Damage to locomotive 2838 and wagon RNDY 20927-S

Source: Queensland Rail annotated by ATSB

The collision caused minor damage to the headstock of the locomotive and side frame of the wagon and the derailment of the wagon’s trailing bogie. There was no injury to the rail traffic crew of either train.

Train information

Train 9221

Train 9221 was 984 m long with a gross mass of 6,422 t comprising locomotives 8316, 8315 and 8317, a crew accommodation van and 79 freight wagons (the last three were empty). Train 9221 provided a freight service, conveying mineral products between Mount Isa and Townsville.

Post occurrence inspection identified two end-of-train marker devices mounted on train 9221 (Figure 3). One marker, installed at the rear of the last wagon, was in use and connected to the brake pipe and the electronically controlled pneumatic braking system of the train. The other marker was not in use, but mounted at the rear of the fourth wagon from the end of the train. The operator had placed the additional (unused) end-of-train marker device to facilitate its operational requirements for that train service.

Figure 3: End-of train marker devices located on train 9221

Source: Queensland Rail annotated by ATSB

The QR interface standard^[8] specified the requirement for operators to install at least one red tail light, or an approved end-of-train marker device to indicate the rear of the last vehicle of each train. However, the standard did not clearly preclude an operator placing additional (unused) markers in train. Post occurrence QR commenced a review into the phrasing of the interface standard to ensure their end-of-train marker device requirements are clear and operators do not place end-of-train marker devices on any part of the train apart from the last wagon.

Train 9T66

Train 9T66 was 887.96 m long with a gross mass of 1,154 t comprising locomotives 2838 and 4028 with 57 empty freight wagons. Train 9T66 provided a bulk fertiliser service between Phosphate Hill and Townsville.

Procedures for Directional Travel Stations

The safeworking system of Direct Traffic Control (DTC) used on the Mount Isa railway operates on the principle of absolute block working which provides that only one rail traffic movement will be authorised on any one block, at any one time. The DTC Standard^[9] identifies limitations in that while the system design validates and creates authorities for issue by the NCO, it cannot:

• detect if blocks that are currently occupied, or to be occupied are released:
  • by the rail traffic crew
  • or by the NCO
• detect if a block which is available to the NCO is physically unavailable for traffic for any reason such as a track defect.

For trains to cross/pass at a directional travel station, the NCO is therefore reliant on the rail traffic crew stopped at the location to confirm their train is complete and in clear of the block to the rear (in this instance, train 9221). Following receipt of confirmation and the release code from the rail traffic crew, the NCO then issues an electronic authority for the opposing/following train (in this instance, 9T66) to proceed and occupy the vacated block.

The General Operational Safety Manual also requires the rail traffic crew of each train undertaking a cross/pass at a station to:

• ensure that the other train is in clear and complete by checking:
  • the other rail traffic is in clear
  • last vehicle (wagon) has the rear of train signal fitted and working
• tell other rail traffic crew, if possible, the rail traffic is complete.

If the opposing rail traffic is not clear, the rail traffic crew are required to

• stop clear of other traffic
• tell rail traffic crew of other rail traffic their train is not in clear

Additionally if the opposing rail traffic is not complete, the rail traffic crew are required to:

• tell rail traffic crew of opposing train
• tell the NCO
• not proceed into the block until authorised by the NCO.

__________

1. All times referred to in this report are local time, Eastern Standard Time (EST).
2. An instruction displayed on a computer screen, or on a prescribed form issued for rail traffic movement
3. Point designed to permit a trailing movement through points closed against the intended move. The wheelset opens the points, which spring back to the normal position after the wheelset is through.
4. When on the departure side, the worker can see the back of the board (blacked out) and not the block limit board (BLB) number.
5. Functionally Integrated Railroad Electronics (FIRE) system forming the interface between the operating crew and locomotive computer systems.
6. A Caution board is placed 2,500 m in advance of any temporary speed restriction Slow board.
7. A portion of line with defined limits between two adjoining Block Limit Boards, which only one rail traffic movement is permitted at any one time.
8. Queensland Rail Standard MD-10-194, Interface standard, Version 4.1, s 2.3.4.
9. Queensland Rail MD-10-113, Direct Traffic Control Manual, Version 2.5, Module DT-1 General, s 1.6 Computer Operations

Safety analysis

Train 9221 lead locomotive serviceability

The lead locomotive 8316 on-board information system used a Doppler speed sensor (ground radar) and Global Positioning System to calibrate the speed and distance measurement. The ground radar on locomotive 8316 had malfunctioned about a week earlier (23 February 2018) and the locomotive returned to the maintainer’s Townsville facility on the 25 February 2018. The locomotive re-entered service, on the 26 February 2018, with the ground radar equipment disconnected.

There was no record of the initial ground radar fault documented in the operator’s locomotive logbook, the daily-automated report, or other maintenance records issued by the maintenance provider to Pacific National.

The disconnection of the ground radar meant that the on-board information system would not automatically calibrate speed and distance measurements. Although a calibration error existed, the maintainer considered it was within the allowable tolerance of 1 to 10 per cent. Testing by the operator found the error resulted in a lower than actual speed indication and a longer than actual length measurement. In this case, the displayed length measurement was around 120 m further than actually travelled.

There was no information displayed on the on-board information system or conveyed during the pre-start briefing or available in the locomotive to alert the rail traffic crew of the disconnection of the ground radar or the implications to the accuracy of the speed and distance information displayed on the systems monitor.

The practice of rolling stock operators operating longer trains on the Mount Isa railway has required drivers to bring their lead locomotive closer to the limit of authority to ensure the rear wagon of the train is in clear.

It is likely that the rail traffic crew in undertaking this action, and complying with the operators signal passed at danger (SPAD) mitigation procedures, place an increasing dependence on the on-board information system to identify the location of the rear of the train. Errors in the distances displayed on the on-board functions therefore have the potential to increase operational risk to that train and other trains required to cross/pass at directional travel stations operated under the Direct Traffic Control safe working system.

Crossing of trains 9221 and 9T66

Train 9221

To facilitate the cross with train 9T66, the driver of 9221 was required to stop the 984 m long train within the 1,033 m track section between block limit boards OA16 and OA25. Pacific National procedures for signal passed at danger SPAD mitigation^[10] applicable to Direct Traffic Control (DTC) safeworking areas also required the driver to stop the train no closer than 50 m from the block limit board marking the limit of authority (BLB OA25), before moving forward to ensure the rear of the train was in clear. To determine the stopping point for train 9221 to be in clear, the rail traffic crew relied on the length counter function to identify the location of the last vehicle with respect to BLB OA16.

Based on the displayed distance information, the driver stopped about 82 m from the limit of authority BLB OA25 (Figure 4) believing locomotive 8316 travelled around 1,070 m into the loop and the rear of the train was therefore in clear of BLB OA16.

Figure 4: Stopping location of train 9221 relative to limit of authority

Source: Pacific National annotated by ATSB

After stopping, the rail traffic crew prepared to release their authority for the Cloncurry-Oonoomurra block to the rear. The Standard General Operational Safety Manual^[11] required the rail traffic crew to undertake a number of actions, including ensuring rail traffic is in clear and complete^[12] from the adjacent track. To make sure the rail traffic is in clear required the rail traffic crew to compare the length of the rail traffic to the capacity of the main line or loop and, although not expressly stated, should include consideration of the distance between the lead locomotive and the BLB ahead. The rail traffic crew, in this instance, relied solely on the displayed indication of distance travelled to determine their train was in clear before releasing the block to the Queensland Rail Network Control Officer (NCO).

A validation check comparing the indicated distance travelled against the available loop length, train length, and distance between the stopping point of locomotive 8316 and BLB OA25 may have alerted the rail traffic crew to the error in the displayed information and that the rear wagon of train 9221 was fouling the adjacent track. Information on the loop lengths, including Oonoomurra was available to rail traffic crew through the operator’s route competency training and in a ‘run sheet’ carried on board that identified the length of the loop against the location name.

Train 9T66

After receiving an authority to proceed, the rail traffic crew of 9T66 entered Oonoomurra to cross train 9221. As the trains passed, the crews checked the other train to identify the end-of-train maker to determine if the opposing train was complete and in clear. The rail traffic crew of 9221 identified the end-of-train marker on 9T66 and advised its crew.

The rail traffic crew of 9T66 were traversing a left curve at the western end of Oonoomurra. The track alignment resulted in the headlight of the lead locomotive projecting light predominately to the right of the track, away from train 9221. The rail traffic crew were observing the top sections of the adjacent bulk wagons (ROAF class) from train 9221 and were looking for the end-of-train marker on train 9221 and BLB OA16 on the adjacent track, but could not see it.

It was not until the track alignment transitioned to straight, approaching the Landsborough Highway level crossing, that the crew then sighted the last of three empty container wagons (RNDY class) at the rear of train 9221; the last was foul of their track (Figure 5). By this time, with the train travelling at 25 km/h and despite the making an emergency brake application, a collision was unavoidable.

Figure 5: Stopping location of wagon RNDY 20927-S relative to the adjacent track

Image taken post collision of  the re-railing of wagon RNDY 20927 illustrating the location of the wagon relative to the adjacent track and trailable point at the Western end of the Oonoomurra crossing location.

Source: Queensland Rail annotated by ATSB

__________

10. Pacific National, Active Identification of a Stopping Location, PN-SPL-SAF, Single Point Lesson, Version 1
11. Queensland Rail, MD-10-107, Module GS 2, Version 2.4, Rail Traffic Movements, s 2.9 - Rail Traffic in Clear and Complete
12. Clear and Complete - Rail traffic where the last vehicle of a consist has passed beyond a location.

Findings

From the evidence available, the following findings are made with respect to the collision of train 9T66 with the rear wagon of train 9221 at the Oonoomurra directional travel station, Queensland, on 27 February 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The on-board information system in locomotive 8316 was operating in a degraded state, displaying erroneous speed and distance information to the driver.
• The Pacific National procedures to determine and communicate the serviceability of a locomotive to operate as a lead were inadequate.
• Train 9221 stopped with the rear fouling the track section between Cloncurry and Oonoomurra. The rail traffic crew relied solely on the displayed indication of distance travelled to determine the train was in clear and did not validate the distance travelled against the length of their rail traffic and the distance available in the loop before releasing the block to the Network Control Officer.
• Rail traffic crew of train 9T66, having received authority to proceed through Oonoomurra, did not identify the fouled track ahead with sufficient time to avoid a collision.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Pacific National

As a result of this occurrence, Pacific National has advised the ATSB that they are taking the following safety actions:

Short term measures

• Verification of the Functionally Integrated Railroad Electronics (FIRE) systems on 83 class locomotives in the Pacific National fleet.
• Verify the message displayed to rail traffic crew when a ground radar fault occurs and determine arrangements to advise the rail traffic crew to use alternate methods to verify the accuracy of displayed information.
• Procedures for the maintainer to identify and qualify restrictions to locomotive operation to enable Pacific National to respond.
• Disseminate information to relevant staff reinforcing the procedures associated with the active identification of a stopping location.

Long-term measures

• Investigate the requirement to implement a procedural or locomotive-based system change for the identification to rail traffic crew of an inconsistent speed fault based on deviations greater than 7 per cent.
• Publish a Rollingstock Notice advising rail traffic crews of this faulty meter counter occurrence and follow-up action taken.
• Review the Townsville Bulk and the Coal Depot’s risk registers to ensure the identification of hazards associated with faulty FIRE system indications and the implementation of control measures.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Aurizon
• Pacific National
• Queensland Rail
• Rail Traffic Crew.

References

Pacific National, Active Identification of a Stopping Location, PN-SPL-SAF, Single Point Lesson, version 1.

Queensland Rail Standard, MD-10-113, Direct Traffic Control Manual, Module DT-1 General, s 1.6 Computer Operations, version 2.5, 26 October 2016, pp. 7-8

Queensland Rail Standard, MD-10-194, Interface standard, s 2.3.4, version 4.1, 4 September 2018.

Queensland Rail, MD-10-107, Rail Traffic Movements, Module GS 2, s 2.9 - Rail Traffic in Clear and Complete, version 2.4, 10 March 2014, pp. 24-25

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Aurizon, Office of the National Rail Safety Regulator, Pacific National, Queensland Rail and the Rail Traffic Crew.

Submissions were received from Aurizon, Office of the National Rail Safety Regulator, Queensland Rail and the Rail Traffic Crew. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 6 February 2018, the ATSB commenced an investigation into an aircraft loading event involving a Qantas Boeing 737, VH-VYE, at Brisbane Airport, Queensland that occurred on 1 February 2018.

During take-off, the first officer, in their role as pilot flying, noted that the aircraft rotated at a slower rate than expected with a resultant higher than normal initial climb speed. The crew later observed a large tour group of children/adolescents onboard, seated together primarily aft of the over wing exits. The crew did not know the age of the passengers in the group or if they were recorded correctly for weight and balance purposes.

The ATSB obtained additional information from the operator that confirmed a tour group of 96 passengers was onboard. The age of the group ranged between 14-16 years old, which classified them as adults in the operator’s load control system. The operator confirmed that the loading, take-off performance figures, and speed/trim settings were correct for the conditions of that flight. The operator noted however that it was possible the positioning of the tour group of adolescents, with slight frames, likely affected the feel of the aircraft on rotation. The operator and pilot confirmed the aircraft was at all times controllable, however increased backpressure was required to rotate the aircraft.

The ATSB reviewed the additional information provided by the operator into this occurrence as well as information relating to previous loading occurrences involving the operator. Based on this review, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation, but will continue to monitor loading occurrences involving all operators.

____________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.