On 21 December 2017, the pilot of a Gregory S. Browning  Zodiac 601XL departed Shelbyville Municipal Airport, Tennessee on a flight to Wifferdill Airport, Chapmansboro, Tennessee. A short time later, witnesses in the vicinity of Chapmansboro reported hearing a loud ‘boom’ similar to a crash. The aircraft was found in an open field in an upright position with substantial damage. The pilot, the only person on board, sustained fatal injuries. The National Transportation Safety Board (NTSB) of the United States commenced an investigation into the occurrence.

As Australia is the State of Manufacture of the engine, the ATSB requested to be appointed as an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB on 8 January 2018. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.

The NTSB has completed their investigation and the final report is available on the NTSB website.

Any enquires relating to the investigation should be directed to the NTSB at: www.ntsb.gov

Safety summary

What happened

On 2 January 2018 at about 1413, V/Line train 7750 was travelling from Waurn Ponds to Geelong as an empty car service not carrying passengers. Shortly after passing Marshall Railway Station, the train passed two signals at Danger. After passing these signals, the train entered the single line section between Marshall and South Geelong, and also the Marshalltown Road level crossing before the crossing booms had lowered. The driver applied braking as the train entered the crossing and the train came to a stop.

The 1305 V/Line Melbourne to Warrnambool passenger service, train 8865, had departed Geelong at about 1410 and was proceeding towards Marshall on the same single line section. The trains were scheduled to cross using the loop track at Marshall. The train controller in Melbourne was monitoring the progress of both trains in order to operate the points and signals at Marshall to effect the crossing. When he became aware that train 7750 was passing signals at Danger, the controller initiated a radio emergency fleet call instructing both trains to stop. When stopped, the distance between the trains was about 940 m.

What the ATSB found

The ATSB found that the driver of train 7750 did not respond to the Stop indications of signals MSL10 and MSL8 at Marshall. He subsequently made an emergency brake application, either after noticing that the Marshalltown Road level crossing booms were not lowered or possibly in a delayed recognition of signal(s) MSL10 and/or MSL8 being at Stop. The driver’s performance was probably influenced by symptoms associated with nicotine withdrawal, having not applied a nicotine patch on this day.

Following this incident, the driver of train 7750 tested positive for an inactive metabolite of cannabis, with levels suggesting use within the previous 7 days. It could not be determined whether cannabis use had affected the driver’s performance at the time of this incident.

V/Line’s drug and medical regimes had not previously identified that this driver had been using cannabis, and the driver had not been subject to random drug testing during his employment with V/Line.

The signalling system at Marshall was not fitted with any form of positive train protection system and was reliant on driver compliance with signal indications.

What's been done as a result

V/Line has installed a train protection system at this location to stop a train that has passed a signal at Danger. The system also has several over-speed sensors to prevent a train entering the Marshalltown Road level crossing when unprotected.

V/Line continues with planning for the provision of three-position signalling for this section as part of other infrastructure projects.

Safety message

Nicotine withdrawal can affect a driver’s performance. To minimise adverse impacts, attempts by safety-critical workers to stop smoking should be managed under medical supervision.

Rail operators should consider fitting authority-overrun intervention at locations (like Marshall) that present a heightened risk due to rail operations on a single, bidirectional track.

The occurrence

On 2 January 2018, the driver was rostered to commence work at 1158. He first ran the V/Line 1250 service from Southern Cross Station to Waurn Ponds. On arrival at Waurn Ponds, the driver changed ends and train 7750 departed empty cars^[1] towards Geelong. The driver was to proceed to Geelong where the train would then form the 1435 passenger service to Melbourne (Figure 1).

Figure 1: Marshall Railway Station location relative to Waurn Ponds and Geelong

Source: PASS Assets (Public Transport Victoria) adapted by Chief Investigator, Transport Safety (Vic)

After passing the Departure signal at Waurn Ponds, there were five signals within the Marshall location over a distance of about 5 km. Distant signal^[2] MSL22 was followed by four Home Signals,^[3] MSL24, MSL26, MSL10 and MSL8 (Figure 2).

Figure 2: The sequence of signals through Marshall, travelling towards Geelong

Source: Chief Investigator, Transport Safety (Vic)

At 14:09:23^[4], the train passed Distant signal MSL22 at a speed of about 86 km/h. This signal displayed a Caution indication, meaning that at least one Home signal within the Marshall location was at Stop. Prior to MSL24, the train’s speed was reduced to 57 km/h at the Surf Coast Highway level crossing, exceeding the Temporary Speed Restriction (TSR) of 40 km/h at that location.

The train speed was then increased and the train passed signal MSL24 (that was at Proceed) at a speed of about 85 km/h at 14:12:15. The train then continued at speeds of up to 94 km/h before reducing speed and passing MSL26 at about 71 km/h at 14:13:10. This reduction in speed was consistent with an approaching TSR of 70 km/h that applied just beyond signal MSL8.

The right-hand arm of signal MSL26, that was applicable for the straight-route, was at Proceed and the signal for the loop was at Stop. This indicated that the points were set for the straight (number 1) track and that train 7750 was authorised to proceed on this track.

The intention of the train controller was to hold train 7750 at MSL10 to allow the Warrnambool bound train (8865) to enter the loop (number 2) track. Train 7750 was then to proceed towards Geelong. Train 8865 would then have been required to remain in the loop at Marshall to allow a Warrnambool to Southern Cross train that was following train 7750 to also cross.

After passing MSL26, the speed of train 7750 further reduced. Home signals MSL10 and MSL8 were at Stop and the train passed both signals at a speed of about 64 km/h, at 14:13:24 and 14:13:29 respectively. The train had passed signals MSL10 and MSL8 without authority. This type of event is referred to as a Signal Passed At Danger (SPAD).

The driver reported noticing that the Marshalltown Road level crossing booms were up and making an Emergency brake application. The train entered the single line between Marshall and South Geelong and then the level crossing, before the booms had lowered.

The train controller had commenced his shift at 0700 working the ‘Geelong Room’ that managed rail traffic between Manor Junction^[5] and Waurn Ponds. In preparation for the cross of the two trains at Marshall, he was observing the signalling control and CCTV VDU^[6] when he saw train 7750 go through Marshall platform travelling too fast to stop at MSL10. Realising that train 7750 would not be able to stop, the train controller made a fleet radio transmission to all trains in the area to ‘Red Light’ (Stop). He then radioed the drivers of trains 7750 and 8865 to confirm that they had both stopped. The CCTV also allowed the train controller to confirm that train 7750 had stopped beyond the Marshalltown Road level crossing.

When both trains were stopped, the separation between train 7750 and train 8865 was about 940 m. For a single train travelling at an average speed of 85 km/h, this distance equated to about 40 seconds of travel.

Post-incident

Following the incident, the driver of train 7750 was drug and alcohol tested at Geelong at approximately 1538. Drug testing was by sampling oral fluid and returned a negative result. Testing for alcohol also returned a negative result.

V/Line subsequently requested (under its Rail Safety Worker Health Assessment processes) that the driver undertake a drug test by urine sample. This was taken at around 1000 the following morning (3 January). This testing returned a positive result for the presence of an inactive metabolite of cannabis.
__________

1. The train was transferring to another location without passengers, and was not required to stop at any stations.
2. In a two-position signalling system, a Distant signal is located prior to the first Home signal for a location and provides information to drivers on the indication of Home signals on the through route.
3. Signals that are ‘absolute’ (or Stop-and-Stay) and directly protect higher-risk locations such as infrastructure at which a potential conflict of traffic exists. When cleared (at Proceed), this signal gives the driver the authority to enter the section.
4. Times in this detailed sequence are based on train data records and expressed as hour:minutes:seconds
5. Located between Little River and Werribee, on the Melbourne side of Geelong.
6. Visual Display Unit(s)

Context

Marshall

Marshall is located on the single line between Geelong and Warrnambool, about 80 rail-km from Melbourne. The line is part of the regional intrastate network managed by V/Line Corporation. Adjacent to Marshall Railway Station was the main line (number 1 track) and a loop (number 2 track) to facilitate trains crossing or passing. Marshall Railway Station had a single platform adjacent to the number 1 track. Except where speed restrictions applied, the line speed for this track was 115 km/h.

Safeworking and signalling

Rail traffic between Geelong and Waurn Ponds was managed under the operating rules and procedures applicable to the Track Block Safeworking System. The object of this system is to prevent trains being in the section between two adjoining locations at the same time. Interlocking prevented the train controller from being able to place a signal controlling the entrance into a single line section to the Proceed position until the section was clear.

Fixed signalling through Marshall was two-position. This type of signalling is now uncommon in Victoria, having mostly been replaced with three-position signalling. Two-position signals are route signals that apply to a single route. Home signals do not provide information on the aspect of the next signal, nor specific guidance for the driver on the speed to the next signal. The driver of train 7750 indicated that he was familiar with the signalling system through Marshall.

Marshall had a signal sequence that comprised a Distant signal followed by a series of Home signals. For Geelong-bound trains, the signal sequence through Marshall was:

• MSL22 (Distant signal)
• MSL24 (Home signal)
• MSL26 (Home signal) that included separate signal heads for the mainline and the loop tracks
• MSL10 (Home Signal) and MSL12 (Home signal on the loop track)
• MSL8 (Home signal).

MSL26 was located before Marshall Railway Station, and MSL10 and MSL8 following the station and before Marshalltown Road level crossing (Figure 3).

Figure 3: Extract of signalling diagram at Marshall Railway Station

The diagram is based on the signalling diagram covering Marshall Railway Station. Key features are retained to show the location of signals MSL26, MSL 10 and MSL8 in relation to the station platform and Marshalltown Road level crossing.

Source: PTV DMS, amended and annotated by Chief Investigator, Transport Safety (Vic)

The aspect displayed on Distant signals at each end of the Marshall location was governed by the status of the Home signals through Marshall and functioned automatically. For traffic coming from Waurn Ponds, if all mainline Home signals at Marshall were Clear, MSL22 would indicate Proceed (green). However, if any of MSL24, MSL26, MSL10 or MSL8 were at Stop, MSL22 would indicate Caution (yellow). A similar signalling sequence was in place for trains travelling from South Geelong to or through Marshall.

Home signals MSL10 and MSL8 were two-position, colour-light signals that displayed either a red (Stop) or green (Proceed) aspect (Figure 4).

Figure 4: Signals MSL10 and MSL8 at Marshall, pictured displaying ‘Stop’ indications

The picture shows signal MSL10 adjacent to the Geelong-end of Marshall Railway Station. Signal MSL8 is identified in the distance, closer to the Marshalltown Road level crossing.

Source: Chief Investigator, Transport Safety (Vic)

Signalling control for Marshall was managed from Centrol^[7] in Melbourne. The control workstation provided for remote control and monitoring of the signalling system. Train controllers could observe the status of all the signalling in the area and operate points and signals. The system was fitted with a SPAD alarm for this location (that would alert the controller), but in this instance the alarm volume had been turned down.

The train controller had control of all Home signals at Marshall. Home signals were operated individually, or a through-route could be set. In the through-route scenario, signals would clear when the section ahead became available without any call on the system from the train controller. However, whenever trains were to cross, the train controller was required to select and call for the desired route and clear the signals individually.

The safe application of signalling at Marshall was reliant on drivers responding correctly to signals, and did not include any additional enforcement controls to protect against a train exceeding its authority.

Marshalltown Road level crossing activation

The Marshalltown Road level crossing was track-circuit activated. However, when signal MSL10 displayed a Stop indication, the level crossing would not be activated if a train passed the signal and occupied the track circuit on the Geelong side of the signal. This configuration was to cater for a low-speed run-around movement^[8] where a calling-on signal^[9] provided authority for a locomotive to move from one end of a train to the other without activating the Marshalltown Road level crossing. Consistent with this configuration, train 7750 did not trigger the crossing protection system until it had travelled beyond signal MSL8, approximately 28 m before the level crossing.

Signalling system playback

The status of signals and the movement of trains through the section were captured on the recording of the train controller’s VDU. The colour of each track section also provided an indication of its status as follows:

• Red indicated the presence of a train in the section
• Green indicated the track was clear and the route was set
• Blue indicated the track was clear but no route was set.

The first snapshot (Figure 5) showed the status of the network with train 7750 at the Waurn Ponds platform.

At this point, a route had been set (in green) from Waurn Ponds Railway Station to Marshall. Departure signal WPD10 was at Proceed, MSL22 at Caution (because MSL10 and MSL8 were at Stop), MSL24 and MSL26 were at Proceed, and MSL10 was at Stop to hold train 7750 at Marshall Railway Station.

Beyond MSL10, the track was clear but a route had not yet been set beyond MSL10. This route condition remained unchanged until train 7750 later occupied this single-line section of track.

Figure 5: Snapshot of VDU when train 7750 was at Waurn Ponds

A route had been set from Waurn Ponds to Marshall Railway Station. Distant signal MSL22 was at Caution (because MSL10 and MSL8 were at Stop) and signals MSL24 and MSL26 were at Proceed. Beyond MSL10, the track was clear but a route had not yet been set beyond MSL10.

Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)

The second snapshot (Figure 6) showed the status of the network as train 7750 passed WPD10. The route for train 8865 (green) was set from South Geelong through to MSL4 but the train had not yet been detected in this section. The status of signals and points at Marshall remained unchanged.

Figure 6: Snapshot of VDU after train 7750 had departed Waurn Ponds

The route for train 8865 (the Melbourne to Warrnambool) was set through to MSL4 but the train had not yet been detected in the section beyond South Geelong. The status of signals and points at Marshall remained unchanged. Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)

The third snapshot (Figure 7) showed train 7750 having passed signals MSL24 and MSL26,and these had reverted to Stop. The train was now in the track sections adjacent to the Marshall Railway Station. It had passed MSL10, but had not yet reached MSL8. The Warrnambool-bound train 8865 occupied the section up to Distant signal MSL2.

Train 8865 had a route (green) set towards Marshall, but not beyond signal MSL 4, which was at Stop.

Figure 7: Snapshot of VDU when train 7750 was passing Marshall Railway Station

Train 7750 had passed MSL24 and MSL 26, and the train was in the track sections adjacent to the Marshall Railway Station and beyond MSL10, but not yet past MSL8. The Warrnambool-bound train 8865 was in the section up to Distant signal MSL2, and had a route set towards Marshall, but not beyond signal MSL 4 which was at Stop.

Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)

The VDU recording showed that train 7750 travelled beyond signal MSL8 and entered the Marshalltown Road level crossing travelling on the single line towards South Geelong (Figure 8). The level crossing protection had also activated (indicated by its change on the VDU from a black line to white).

This had placed the trains in potential conflict. Once past MSL8, the next Home signal that would face train 7750 was SGL19 at South Geelong, beyond the location of train 8865.

Figure 8: Snapshot of VDU when train 7750 passes MSL8 and enters the level crossing

Train 7750 was now on the single line towards South Geelong, placing the trains in conflict.

Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)

The recording then showed that train 8865 had passed signal MSL2 and entered the section up to signal MSL4, that was at Stop (Figure 9). The trains were now in adjacent track sections. There were no further signals that could have prevented train 7750 continuing to the location of train 8865.

Figure 9: Snapshot of VDU with trains 7750 and 8865 stopped in adjacent sections

Train 8865 would be held by signal MSL4 that was at Stop. However, there was no signal ahead of train 7750 that would prevent it from continuing to the location of train 8865.

Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)

The driver

The driver had been working with V/Line since 2005. His safeworking and route knowledge qualifications were current and he was certified as medically fit for duty. By arrangement with the rostering area, together with the mutual exchange of shifts with other drivers, he generally worked shifts commencing between 0900 and 1000. This resulted in him regularly running of services between Melbourne and Waurn Ponds.

On this day, his shift had commenced at about 1200. This shift and the previous 7 days rostering would not have contributed to a fatigue condition.

Nicotine withdrawal

The driver had been a heavy smoker. In his endeavours to stop smoking, he had been using nicotine patches for about 3 months

Tobacco smoking exposes the user to a significant number of substances. The nicotine component of tobacco is a particularly addictive compound, and it is largely this property of nicotine that leads to difficulty in ceasing smoking.^{[10] [11] [12]}

Cessation of tobacco smoking, especially if abrupt, can lead to the development of nicotine withdrawal. This is a recognised clinical entity, with clearly established criteria laid down in the World Health Organisation’s International Classification of Disease. Symptoms of nicotine withdrawal usually appear quite quickly after the last tobacco intake (within 2-3 hours) and peak in 2-3 days.^[13] Tobacco withdrawal can lead to a myriad of symptoms, including task-related effects such as difficulty concentrating, memory impairment and attention difficulties. There are also other potential psychological and physiological effects.

Smoking cessation strategies usually adopt the approach of gradually reducing the nicotine intake rather than suddenly stopping. The transdermal patch is typically the first choice in terms of therapies to assist smokers to quit.^[14] It comes in a range of different nicotine doses, from 5 mg to 21 mg. The replacement regime depends on the usual cigarette intake of the smoker prior to quitting. For example, a smoker of more than 10 cigarettes per day might use a 21/14/7 mg regimen, that involves wearing a 21 mg patch daily for 6 weeks, then a 14 mg patch daily for 2 weeks, then a 7 mg patch daily for 2 weeks.

In this instance, the driver had maintained the use of a 21 mg patch, and had not yet commenced to taper the dosage. However, the driver reported that on the day of this incident he did not apply a nicotine patch.

Use of Cannabis

The driver reported that he had been using cannabis for about 2 months to assist with sleep and nicotine withdrawal issues. Cannabis contains over 530 chemical compounds, including over 100 pharmacologically active constituents known as cannabinoids.^[15]

The most potent and psychoactive of these is ∆9-tetrahydrocannabinol (∆9-THC, or more simply THC). Cannabinoids act on a specific class of cell receptor, which are widely distributed in the brain. They tend to be particularly located in brain regions associated with cognitive processes, memory, pain perception and psychomotor coordination.^[16]

THC is broken down into an inactive metabolite, 11-nor-9- tetrahydrocannabinol-∆9-carboxylic acid (THC-COOH). This substance is the principal secondary metabolite of THC and is excreted from the body over a period of days to weeks.^[17] THC-COOH is the metabolite targeted in blood or urine testing for cannabis use.

A single dose of THC may take up to 30 days to be fully eliminated from the body. THC may be found in the urine for at least 48 to 72 hours after oral administration.^[18] With repeated use, however, cannabinoids can accumulate in high levels in the body. Such chronic, long term use leads to accumulation of THC and THC-COOH in fatty tissue, with continued excretion into the urine for as long as 30 to 60 days from the time chronic use is halted.

The effects of cannabis on cognitive function and psychomotor performance are documented in literature. Studies have shown that acute cannabis use impairs cognitive functions such as attention and learning,^[19] increases reaction time and causes difficulty in concentration.^{[20] [21]} Cannabis can also adversely affect human performance of complex cognitive tasks for up to 24 hours, with the extent of effects post-exposure depending on the task complexity.^{[22] [23]} One consistent finding with cannabis exposure is the adverse effect on memory. Cannabis-induced disruption of normal memory functions, particularly short-term memory, have been described.^{[24] [25] [26] [27]}

Driver toxicology

The toxicology assessment for this driver used a urine sample collected from the driver at around 1000 on 3 January. Analysis performed on 4 January 2018 revealed the presence of THC-COOH in the urine. THC-COOH is the inactive secondary metabolite of THC and there is no specific biological effect of THC-COOH. Whereas the inactive THC-COOH can be detected in urine for more than 7 days after a single use, and longer for habitual use, urinary THC values have been shown to peak about two hours post cannabis use, and then decline to be unrecordable within 6 hours.^[28] There was no level of THC (the active metabolite) recorded or reported in the toxicology assessment.

The presence of THC-COOH in urine at concentrations greater than 15 ng/mL is a strong indicator that the individual has used cannabis. If the urinary THC-COOH level is greater than 100 ng/mL, this indicates relatively recent use, probably within the previous 7 days. Levels greater than 500 ng/mL suggest chronic and recent use. The recorded level in the driver involved in this particular incident was 120 µg/L (equivalent to 120 ng/mL). This measured level was over 100 ng/mL and therefore suggests use of cannabis probably within the previous 7 days.

Methods for detecting cannabis use

Drug testing is generally effective at determining the presence of a drug or its metabolite. A drug test will have a minimum threshold (‘cut-off’ value) above which the test result will be considered positive, and below which it will be considered negative. A drug test may also be negative despite recent or ongoing drug use if the window of detection has passed or there has been adulteration of the specimen.

Oral fluid testing

Oral fluid testing for cannabis targets the active metabolite Delta-9-tetrahydrocannabinol (THC). This is the most potent and psychoactive of the metabolites of cannabis.^[29] The consumption of cannabis via smoking leads to the oral tissues being exposed to high concentrations of THC. The THC is then released and is detectable in the saliva during the next several hours following use, and this process can last up to 24 hours.^[30]

Oral fluid testing represents relatively new technology, being introduced in several countries in the last 10-20 years.^{[31] [32]} In general, it is used for detecting the presence of certain drugs in settings such as the workplace or road traffic enforcement. The accuracy and reliability of these tests has also been improving over the years.^[33]

Urine testing

Typically, urine is tested for THC-COOH, an inactive metabolite of cannabis. This metabolite can be detected in urine for more than 30 days after cannabis use, and so this test is effective at detecting prior use of cannabis. However, a positive result for this metabolite does not provide information about impairment at the time of testing. A more extensive test panel including testing for THC and 11-hydroxy-THC as well as THC-COOH could provide a more comprehensive picture of recent cannabis use.

Urine tests have some disadvantages, including a greater potential for false samples and adulteration. Products can be used to mask the presence of certain drugs in urine samples and intentional urine dilution may reduce drug concentration below the cut-off level of the test.

V/Line systems to identify employee use of cannabis

Relevant legislation

Drug and alcohol requirements for Rail Transport Operators and Rail Safety Workers were governed by the Rail Safety National Law (RSNL)^[34] and associated Regulations. The RSNL required that rail operators prepare and implement a Drug and Alcohol Management Program (DAMP). It also required that Rail Safety Workers not carry out, or attempt to carry out, rail safety work whilst ∆9-THC (the active metabolite of cannabis) was present in their oral fluid or blood.

V/Line Policy and Procedures

V/Line had developed a drug and alcohol policy and implemented a drug-testing regime. The policy required that its employees not be under the influence of alcohol or illicit drugs or be impaired by any other drugs.^[35] Further detail on the implementation of the policy was included in its management guide.^[36]

Responsibilities

The management guide specified that employees, including drivers, report to work in a fit condition without detectable levels of alcohol or other drugs, and notify their manager if their ability to undertake rail safety work might be hindered by alcohol or any other drug.

The guide also detailed responsibilities for V/Line management including supervisors of drivers. Supervisor responsibilities included ensuring persons were not hindered by the presence of alcohol or other drugs whilst reporting for or being on duty. It also included a requirement to ensure the provision of information to employees about the problems arising from the consumption or use of alcohol, tobacco and other drugs.

Testing Program

Assurance of employee compliance with its alcohol and drug management policy included random^[37] and post-incident drug testing. Testing was conducted by an independent agency. Employees working only in Victoria were tested using sampling of oral fluid.^[38] This method included testing for the presence of cannabis metabolites in oral fluid. The program required testing of a minimum of 30 per cent of workers per annum, of which at least 25 per cent were required to be Rail Safety Workers (RSW). In practice, the proportion of RSW tested was significantly higher than this requirement. Between commencement of random testing in 2015 and 1 January 2018 (prior to this incident), there was one positive result returned from the random drug testing program, and that was for THC.

The guide also made provision for ‘for cause’ testing. In the event that a supervisor or manager had reasonable grounds to suspect that a person may not meet the drug and alcohol criteria, that person could be required to undergo testing. For the same period from 2015 to 1 January 2018, there had been one ‘for cause’ test, and it had returned a positive result for cannabis use. There was no specific training of supervisors to assist them to undertake fitness for duty assessment or to make decisions on the need to conduct ‘for cause’ testing.

In addition, its train drivers were classified as Category 1 Safety Critical Workers and were required to undertake medical assessment that included testing of urine for the presence of a number of prescribed drugs (including cannabis). Drivers were required to undergo Category 1 medical assessments every 5 years (up to the age of 50), every 2 years (50 – 60) and every year above age 60.

Other SPADs at or near Marshall

On 29 May 2015, a V/Line train passed signals MSL10 and MSL 8 at Stop.^[39] Following its investigation of this incident, the ATSB reported that:

Marshall was re-established with infrastructure that catered for the relatively small number of passenger services. However, over a ten-year period, rail traffic increased significantly (16 services per week in 2005 to 160 in 2015), altering both the operating environment and the risk profile of the location. To improve the control of traffic through this location, there was scope to upgrade to three-position signalling and potentially introduce measures to mitigate against SPAD events.

In response to the May 2015 SPAD event, V/Line introduced a Temporary Speed Restriction (TSR) of 70 km/h at this location. This TSR was still in place at the time of the January 2018 SPADs.

Subsequent to the May 2015 SPAD, V/Line advised that its internal investigation had recommended a three-position signalling upgrade for the Geelong-Waurn Ponds section of track and that it was undertaking a study into the duplication of track between South Geelong and Waurn Ponds. V/Line has advised that track duplication was still under consideration.

Between January 2015 and January 2018, there were six other SPAD events between Waurn Ponds and South Geelong. Five involved signal MSL24 and one was at MSL4. All of these SPADs were attributed by V/Line to driver misjudgement. As a mitigation for the SPADs at MSL24, a 40 km/h TSR was introduced for the approach to this signal.

__________

7. V/Line train control, located in Melbourne.
8. Where the locomotive is moved from one end of the train to the other.
9. Subsidiary signal fixed under the Home signal for the route concerned and when showing a 'Proceed' indication authorises the driver to proceed under control into a section of line which may be obstructed at any point.
10. Kessler DA, Natanblut SL, Wilkenfeld JP, Lorraine CC, Mayl SL, Bernstein IB, Thompson L: Nicotine addiction: a pediatric disease. J Pediatr 1997; 130:518–524.
11. The Health Consequences of Smoking—Nicotine Addiction: A Report of the Surgeon General. Rockville, MD, US Department of Health and Human Services, 1988.
12. Royal College of Physicians of London. Tobacco Advisory Group. (2000). Nicotine addiction in Britain: a report of the Tobacco Advisory Group of the Royal College of Physicians. Royal College of Physicians.
13. Hughes JR. Effects of abstinence from tobacco: valid symptoms and time course. Nicotine & Tobacco Research. 2007 Mar 1;9(3):315-27.
14. Fiore MC: Treating tobacco use and dependence: an introduction to the US Public Health Service Clinical Practice Guideline.
15. Mehmedic Z, Chandra S, Slade D, Denham H, Foster S, Patel AS, Ross SA, Khan IA, ElSohly MA. Potency trends of ∆9‐THC and other cannabinoids in confiscated cannabis preparations from 1993 to 2008. Journal of forensic sciences. 2010 Sep 1;55(5):1209-17.
16. Hall W. Solowij N. Adverse effects of cannabis. Lancet 1998; 352:1611-6.
17. O’Kane CJ, Tutt D, Bauer L. Cannabis and driving: a new perspective. Emerg Med 2002; 14:296- 303.
18. Yesavage JA, Leirer VO, Denari M, Hollister LE. Carry-over effects of marihuana intoxication on aircraft pilot performance: a preliminary report. Am J Psychiatry 1985; 142:1325-9.
19. Beautrais AL, Marks DF. A test of state dependency effects in marihuana intoxication for the learning of psychomotor tasks. Psychopharmacologia 1976; 46:37-40.
20. Heishman SJ, Huestis MA, Henningfield JE, Cone EJ. Acute and residual effects of marijuana: profiles of plasma THC levels, physiological, subjective, and performance measures. Pharmacol Biochem Behav 1990; 37:561-5.
21. Macavoy MG, Marks DF. Divided attention performance of cannabis users and non-users following cannabis and alcohol. Psychopharmacologia 1975; 44:147-52.
22. Heishman, Huestis, Henningfield, Cone, op. cit.
23. Yesavage, Leirer, Denar, Hollister., op. cit.
24. Abel EL. Marijuana and memory: acquisition or retrieval? Science 1971; 173:1038-40.
25. Darley CF, Tinklenberg JR, Roth WT, Atkinson RC. The nature of storage deficits and state- dependent retrieval under marihuana. Psychopharmacologia 1974; 37:139-49.
26. Heishman SJ, Arasteh K, Stitzer ML. Comparative effects of alcohol and marijuana on mood, memory, and performance. Pharmacol Biochem Behav 1997; 58:93-101.
27. Tinklenberg JR, Melges FT, Hollister LE, Gillespie HK. Marihuana and immediate memory. Nature 1970; 226:1171-2.
28. Manno JE, Manno BR, Kemp PM, Alford DD, Abukhalaf IK, McWilliams ME, Hagaman FN, Fitzgerald MJ. Temporal indication of marijuana use can be estimated from plasma and urine concentrations of ∆9-tetrahydrocannabinol, 11-hydroxy-∆9-tetrahydrocannabinol, and 11-nor-∆9-tetrahydrocannabinol- 9-carboxylic acid. Journal of analytical toxicology. 2001 Oct 1;25(7):538-49.
29. Huestis MA. Human cannabinoid pharmacokinetics. Chemistry & Biodiversity 2007 Aug;4(8):1770-804.
30. Niedbala RS, Kardos KW, Fritch DF, Kardos S, Fries T, Waga J, Robb J, Cone EJ. Detection of marijuana use by oral fluid and urine analysis following single-dose administration of smoked and oral marijuana. Journal of Analytical Toxicology 2001 Jul 1;25(5):289-303.
31. Steinmeyer S, Ohr H, Maurer HJ, Moeller MR. Practical aspects of roadside tests for administrative traffic offences in Germany. Forensic science international. 2001 Sep 15;121(1-2):33-6.
32. Gallardo E, Barroso M, Queiroz JA. Current technologies and considerations for drug bioanalysis in oral fluid. Bioanalysis. 2009 Jun;1(3):637-67.
33. Strano-Rossi S, Castrignanò E, Anzillotti L, Serpelloni G, Mollica R, Tagliaro F, Pascali JP, Di Stefano D, Sgalla R, Chiarotti M. Evaluation of four oral fluid devices (DDS®, Drugtest 5000®, Drugwipe 5+® and RapidSTAT®) for on-site monitoring drugged driving in comparison with UHPLC–MS/MS analysis. Forensic science international. 2012 Sep 10;221(1-3):70-6.
34. Rail Safety National Law (South Australia) Act 2012, as applied in Victoria.
35. SAPO-1, Policy – Alcohol and Drugs Management, dated 26/10/2016.
36. SAMG-51, Alcohol, Tobacco and other Drugs Management Guide, Revision 1, dated 17/08/2017.
37. The random drug testing program commenced in August 2015
38. In NSW, urine testing was used for drug testing.
39. ATSB, Investigation report RO-2015-009, Signals Passed at Danger by Train 1240 at Marshall near Geelong, Victoria on 29 May 2015

Safety analysis

The incident

The driver did not respond to the Stop indications of signals MSL10 and MSL8 and passed these signals without authority. His subsequent action to stop the train was either after noticing that the Marshalltown Road level crossing booms were not lowered, or possibly in a delayed recognition that signal MSL10 and/or signal MSL8 was at Stop. Had the driver not stopped the train, there were no other signalling defences to alert the driver against continuing through the section in conflict with the approaching Warrnambool-bound passenger train.

The actions of the train controller to monitor the passage of the trains and then make a radio call to stop trains were appropriate.

The driver

Nicotine withdrawal

Withdrawal from nicotine can produce a range of symptoms that can also affect human performance. The driver had been using the 21 mg patch for about 3 months. However, the driver reported that on the day of the incident he did not apply a patch. It is therefore likely that he was experiencing symptoms of nicotine withdrawal.^[40]

Nicotine withdrawal symptoms typically become apparent within a few hours of last nicotine exposure. Task-related effects can include difficulty concentrating, memory impairment and attention difficulties. These and other symptoms of nicotine withdrawal probably had an adverse effect on the performance of the driver.

Cannabis use

Cannabis has a range of short and long term adverse effects on human health and performance. There is considerable evidence of a residual effect of cannabis during the 12 - 24 hour period following use, which may occur after a single dose. The residual drug effects observed involve impairment of performance on tests of focused attention, visual and verbal memory, and visuomotor functions.^[41]

Oral fluid testing (taken about 90 minutes after the event) returned a negative result for the presence of the active metabolite of cannabis (THC). Subsequent urine testing identified an inactive metabolite at a level suggesting cannabis use probably within the previous 7 days. Based on the available evidence, it was not possible to determine if the prior use of cannabis had affected the driver’s performance on the day of the event.

Expectancy

Train 7750 was a non-passenger-carrying train returning to Geelong and was therefore not required to make passenger stops at any stations, including at Marshall Railway Station. It is possible that the notion of the service being ‘express’ established in the driver’s mind an expectation that the train would have an unimpeded passage through to Geelong and that all signals would be at Proceed. It is possible that this expectancy affected the driver’s observation of, or perception of, the signal indications of MSL10 and MSL8.

Recall of Distant signal indication

When passed by train 7750, Distant signal MSL22 was at Caution, indicating that a subsequent signal within the Marshall location was at Stop. This Caution indication warns the driver to be prepared to stop at any upcoming Home signal within the Marshall group of signals, and the driver of train 7750 was familiar with its function and meaning.

However, this information was not utilised by the driver as the train approached signal MSL10. It is probable that the information indicated by Distant signal MSL22 was forgotten by the driver some time during the 4 minutes after passing MSL22. Such a lapse in short term memory would be consistent with symptoms associated with nicotine withdrawal.

Signalling information for driver

With two-position signalling, a Home signal at Stop (Red) may directly follow a Home signal at Proceed (Green), as it did in this case. Whereas, with three-position signalling, a driver is presented with signal aspects that indicate the status of the next signal. These aspects are also speed-related and in many locations have sequences that require the train speed to be reduced over several signal sections before a Stop indication is displayed. Three-position signalling would therefore have provided the driver with more information on the status of the next signal.

Drug testing

This driver

This driver had not been tested under the random drug testing program, and his use of cannabis had not been detected by V/Line prior to this event.

Comparison between oral fluid testing and urine testing

The detection window for oral fluid testing for cannabis use is much smaller than that for urine testing. The window of detection for cannabis in oral fluid testing is up to 24 hours, compared with 30 days or longer for testing of urine. The longer window for urine testing is due to the progressive metabolism of cannabinoids that are excreted in the urine over time.

The differences in detection windows and the targeted metabolite create different interpretations for a positive result for each type of test. Given the shorter detection window and the targeting of THC, a positive oral fluid test is indicative of recent use (within 24 hours).^{[42] [43]} In contrast, a positive urine test indicates prior exposure to cannabis which could be 30 days prior or more. The prolonged detection window for urine testing is well outside the corresponding window of cannabis-induced impairment. A positive oral fluid test for cannabis, therefore, is much more likely to be correlated with cannabis-induced impairment, although there can be individual variation.^[44]

‘For-cause’ testing

V/Line drug management guidelines provided that ‘for cause’ testing could be conducted should a supervisor have grounds to believe that an employee did not meet the drug criteria. However, supervisors were not trained in how to identify impairment or assess whether such grounds existed.

SPAD mitigation at Marshall

The Marshall location was not equipped with any form of authority-overrun intervention. A previous ATSB investigation^[45] identified that, particularly due to increased traffic and associated risks at Marshall, ‘there was scope to introduce measures to mitigate against SPAD events’.

The Train Protection and Warning System (TPWS)^[46] was installed at many locations with three-position signalling. TPWS initiates train braking to reduce the potential consequences of a SPAD event.

The train control system included an audible SPAD alarm for this location, to alert the train controller. However, in this instance, its volume had been turned down.
__________

40. Expert Opinion: Signals Passed at Danger by Train 7750, Marshall, Victoria 2 January 2018, Flight Medicine Systems, Dr David G. Newman 30 April 2018
41. Pope HG, Gruber AJ, Yurgelun-Todd D. The residual neuropsychological effects of cannabis: the current status of research. Drug Alcohol Depend 1995; 38:25-34.
42. Menkes DB, Howard RC, Spears GF, Cairns ER. Salivary THC following cannabis smoking correlates with subjective intoxication and heart rate. Psychopharmacology. 1991 Feb 1;103(2):277-9.
43. Gross SJ, Worthy TE, Nerder L, Zimmermann EG, Soares JR, Lomax P. Detection of recent cannabis use by saliva δ9-THC radioimmunoassay. Journal of Analytical Toxicology. 1985 Jan 1;9(1):1-5.
44. Huestis, op. cit.
45. ATSB, Investigation report RO-2015-009, op.cit.
46. A train protection system developed in the UK and used on the Victorian rail network.

Findings

From the evidence available, the following findings are made with respect to the Signals Passed at Danger by Train 7750 at Marshall, Victoria on 2 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The driver did not respond to signals MSL10 and MSL8 at Stop and passed the signals without authority.
• The driver did not use a nicotine patch on the day of the incident, probably leading to nicotine withdrawal and associated symptoms that affected performance.

Other factors that increased risk

• The driver had been using cannabis and this was not identified by V/Line.
• The signalling system was not equipped with any form of authority-overrun intervention
• The volume of the audible SPAD alarm at the train controller’s station had been turned down.

Other findings

• V/Line did not provide training to its driver supervisors to assist them to effectively identify and take action to manage possible drug use by safety critical workers.

Safety issues and actions

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Following this incident, V/Line applied a 40 km/h speed restriction at this location as a temporary measure, issued a SPAD alert, and briefed drivers on risks associated with this location and empty car movements. This empty cars service also became a normal passenger run from Waurn Ponds.

V/Line completed its installation of a bespoke (two position signalling) TPWS for this location in June 2019. The system is designed to automatically apply the braking of a train that has had a SPAD. The system also has several over-speed sensors that are designed to prevent a train occupying an unprotected Marshalltown Road level crossing.

V/Line continues with planning for the provision of three-position signalling for this section as part of other infrastructure projects.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• The driver of train 7750
• V/Line
• Medvet testing contractor.

References

Abel EL. Marijuana and memory: acquisition or retrieval? Science 1971; 173:1038-40.

ATSB, Investigation report RO-2015-009, Signals Passed at Danger by Train 1240 at Marshall near Geelong, Victoria on 29 May 2015

Beautrais AL, Marks DF. A test of state dependency effects in marihuana intoxication for the learning of psychomotor tasks. Psychopharmacologia 1976; 46:37-40.

Darley CF, Tinklenberg JR, Roth WT, Atkinson RC. The nature of storage deficits and state- dependent retrieval under marihuana. Psychopharmacologia 1974; 37:139-49.

Expert Opinion: Signals Passed at Danger by Train 7750, Marshall, Victoria 2 January 2018, Flight Medicine Systems, Dr David G. Newman 30 April 2018

Fiore MC: Treating tobacco use and dependence: an introduction to the US Public Health Service Clinical Practice Guideline.

Gallardo E, Barroso M, Queiroz JA. Current technologies and considerations for drug bioanalysis in oral fluid. Bioanalysis. 2009 Jun;1(3):637-67.

Gross SJ, Worthy TE, Nerder L, Zimmermann EG, Soares JR, Lomax P. Detection of recent cannabis use by saliva δ9-THC radioimmunoassay. Journal of Analytical Toxicology. 1985 Jan 1;9(1):1-5.

Hall W. Solowij N. Adverse effects of cannabis. Lancet 1998; 352:1611-6.

Heishman SJ, Arasteh K, Stitzer ML. Comparative effects of alcohol and marijuana on mood, memory, and performance. Pharmacol Biochem Behav 1997; 58:93-101.

Heishman SJ, Huestis MA, Henningfield JE, Cone EJ. Acute and residual effects of marijuana: profiles of plasma THC levels, physiological, subjective, and performance measures. Pharmacol Biochem Behav 1990; 37:561-5.

Huestis MA. Human cannabinoid pharmacokinetics. Chemistry & Biodiversity 2007 Aug;4(8):1770- 804.

Hughes JR. Effects of abstinence from tobacco: valid symptoms and time course. Nicotine & Tobacco Research. 2007 Mar 1;9(3):315-27.

Kessler DA, Natanblut SL, Wilkenfeld JP, Lorraine CC, Mayl SL, Bernstein IB, Thompson L: Nicotine addiction: a pediatric disease. J Pediatr 1997; 130:518–524.

Macavoy MG, Marks DF. Divided attention performance of cannabis users and non-users following cannabis and alcohol. Psychopharmacologia 1975; 44:147-52.

Manno JE, Manno BR, Kemp PM, Alford DD, Abukhalaf IK, McWilliams ME, Hagaman FN, Fitzgerald MJ. Temporal indication of marijuana use can be estimated from plasma and urine concentrations of ∆9-tetrahydrocannabinol, 11-hydroxy-∆9-tetrahydrocannabinol, and 11-nor-∆9-tetrahydrocannabinol- 9-carboxylic acid. Journal of analytical toxicology. 2001 Oct 1;25(7):538-49.

Mehmedic Z, Chandra S, Slade D, Denham H, Foster S, Patel AS, Ross SA, Khan IA, ElSohly MA. Potency trends of ∆9‐THC and other cannabinoids in confiscated cannabis preparations from 1993 to 2008. Journal of forensic sciences. 2010 Sep 1;55(5):1209-17.

Menkes DB, Howard RC, Spears GF, Cairns ER. Salivary THC following cannabis smoking correlates with subjective intoxication and heart rate. Psychopharmacology. 1991 Feb 1;103(2):277-9.

Niedbala RS, Kardos KW, Fritch DF, Kardos S, Fries T, Waga J, Robb J, Cone EJ. Detection of marijuana use by oral fluid and urine analysis following single-dose administration of smoked and oral marijuana. Journal of Analytical Toxicology 2001 Jul 1;25(5):289-303.

O’Kane CJ, Tutt D, Bauer L. Cannabis and driving: a new perspective. Emerg Med 2002; 14:296- 303.

Pope HG, Gruber AJ, Yurgelun-Todd D. The residual neuropsychological effects of cannabis: the current status of research. Drug Alcohol Depend 1995; 38:25-34.

Rail Safety National Law (South Australia) Act 2012.

Royal College of Physicians of London. Tobacco Advisory Group. (2000). Nicotine addiction in Britain: a report of the Tobacco Advisory Group of the Royal College of Physicians. Royal College of Physicians.

SAMG-51, Alcohol, Tobacco and other Drugs Management Guide, Revision 1, V/Line 17/08/2017.

SAPO-1, Policy – Alcohol and Drugs Management, V/Line, 26/10/2016.

Steinmeyer S, Ohr H, Maurer HJ, Moeller MR. Practical aspects of roadside tests for administrative traffic offences in Germany. Forensic science international. 2001 Sep 15;121(1-2):33-6.

Strano-Rossi S, Castrignanò E, Anzillotti L, Serpelloni G, Mollica R, Tagliaro F, Pascali JP, Di Stefano D, Sgalla R, Chiarotti M. Evaluation of four oral fluid devices (DDS®, Drugtest 5000®, Drugwipe 5+® and RapidSTAT®) for on-site monitoring drugged driving in comparison with UHPLC–MS/MS analysis. Forensic science international. 2012 Sep 10;221(1-3):70-6.

The Health Consequences of Smoking—Nicotine Addiction: A Report of the Surgeon General. Rockville, MD, US Department of Health and Human Services, 1988.

Tinklenberg JR, Melges FT, Hollister LE, Gillespie HK. Marihuana and immediate memory. Nature 1970; 226:1171-2.

Yesavage JA, Leirer VO, Denari M, Hollister LE. Carry-over effects of marihuana intoxication on aircraft pilot performance: a preliminary report. Am J Psychiatry 1985; 142:1325-9.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Directly-Involved Parties. Submissions were received from V/Line and the Office of the National Rail Safety Regulator. These submissions were reviewed and where considered appropriate, the text of the draft report amended.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At 1523 on Saturday 4 November 2017, Qube Logistics freight train 7MC1 was signalled into the crossing loop at Wallan, Victoria. Entering the loop from the main line, the leading bogie on the 37th wagon derailed and travelled in a derailed state until the train stopped within the loop. At this stage, the locomotive crew were unaware of the derailment.

Following the passing of an opposing passenger service, and signals clearing, 7MC1 commenced its departure from the loop. Shortly after, a member of the public made the crew of 7MC1 aware that a wagon was derailed and the train was brought to a stand.

What the ATSB found

The ATSB found that the leading left-hand wheel of the leading bogie of wagon LQAY 00025D climbed the left-hand stock rail within the turnout from the crossing loop to the cripple track. The second wheelset of the same bogie derailed several hundred metres into the loop after the train commenced its departure from the loop.

It was found that the derailment occurred within a rapid transition of track superelevation from the main line to the loop track, resulting in the unloading of the leading left-hand wheel. The twist through the location exceeded network requirements and the basis for its acceptance was not documented.

In addition, the track alignment through the turnout to the cripple track probably resulted in the wheel tracking towards the left stock rail. The condition of some sleepers was also degraded resulting in a reduced effectiveness of rail fastenings.

The wagon and its loading was compliant with network requirements.

What's been done as a result

ARTC completed rectification works at the derailment location to address the identified twist exceedances. Works included improving track geometry, the installation of turnout bearers with resilient fastenings and mechanised tamping.

ARTC has also enhanced work management processes for the response to geometry conditions in accordance with ARTC’s Safety Management System.

Safety message

Effective management of track defects is critical to minimising the risk of derailment and maintaining safe rail operations.

The occurrence

Train 7MC1 was an intermodal freight service between Melbourne and Junee operated by Qube Logistics Rail Services (Qube) on 4 November 2017. It comprised two QBX-class locomotives and 46 wagons. After loading and pre-departure inspections, the train departed Melbourne at 1315.

At Somerton, about 22 km into its journey, there was a change in the train crew. After departing Somerton, the changeover locomotive driver felt that the train was not performing as expected, suspecting that the second locomotive was not powering. The driver stopped the train to check the Multiple Unit (MU) cable connection between locomotives. They attended to the MU connection and on resuming, the driver was satisfied that the second locomotive was powering.

Figure 1: Wallan Loop layout and signalling

Source: Chief Investigator, Transport Safety (Vic)

Prior to Wallan, the crew of train 7MC1 was contacted by network control^[1] and advised that their train would be routed into the crossing loop at Wallan to allow an opposing passenger train to pass (Figure 1).

Train 7MC1 was stopped prior to the loop at the Wallan Home signal (WLN/2). The signal then cleared to display a Low Speed Caution indication meaning a maximum speed of 15 km/h. The train departed at about 1523^[2] and then entered the loop at about 13 to 14 km/h.

As 7MC1 was entering the loop, the leading wheelset of the 37th wagon (LQAY 00025D) derailed. The leading left-hand wheel of the wagon climbed^[3] the stock rail^[4] beyond the point blade in the cripple track turnout, ran along the railhead and dropped to the outside of the rail (Figure 2).

Figure 2: The location of the point of mount within the cripple track turnout

Source: Chief Investigator, Transport Safety (Vic)

The train continued its entry into the loop at around 13 km/h and then commenced braking for about 240 m before stopping at the Loop Home Departure signal (WLN/U6).^[5] The train was now fully within the crossing loop. There was no loss of brake pipe continuity and the train crew were not aware of the derailment.

The V/Line Standard-Gauge passenger service 8620 that was running from Albury to Southern Cross Station then passed 7MC1. Its driver radioed to the crew of 7MC1 that their train was ‘complete’ and ‘looked ok’.^[6]

Once the passenger train had cleared, 7MC1 received a signal indication to depart Wallan. As it was departing, the № 2 axle on the same bogie derailed and a member of the public who had seen the derailed wagon drove alongside the locomotive and signalled to the crew to stop.

The train was brought to a stand. Damage to the train was limited to wagon LQAY 00025D that had derailed all wheels of its leading bogie (Figure 3).

Figure 3: The derailed bogie (both wheelsets) after the train was brought to a stop

This picture shows the derailed wagon after the train was stopped when departing Wallan Loop. Source: Chief Investigator, Transport Safety

The track sustained damage to sleepers over a distance of several hundred metres (Figure 4).

Figure 4: Typical damage to concrete sleepers within the crossing loop

Source: Chief Investigator, Transport Safety (Vic)

Post-occurrence

The locomotive driver contacted the ARTC network controller and informed them of the situation while the driver’s assistant went back to inspect their train.

ARTC network control requested that the lead portion of 7MC1 continue its journey, as the train was now blocking the main line. 7MC1 was divided between the 33rd and 34th vehicles and departed Wallan at 1935 to Kilmore East where the train crew were drug and alcohol-tested. The drivers were cleared to continue and 7MC1 departed Kilmore East at 1945.

Recovery

Representatives from Qube’s maintenance contractor attended the site on 6 November to re-rail LQAY 00025D. After re-railing, the wagon was transferred to the Melbourne end of the loop. It was then moved towards the cripple track^[7] adjacent to the loop. During this move, the leading axle of the wagon in the direction of travel derailed on the cripple track turnout. This was on a different section of track to the earlier derailment and the bogie was in a damaged condition.

This bogie was again re-railed and successfully shunted into the cripple track. The wagon was unloaded and the bogies changed out and transported to Melbourne where they were quarantined for further inspection.

__________

1. The ARTC train control office for the Standard-Gauge network between Sydney and Somerton.
2. All times are in Eastern Daylight saving Time (EDT).
3. The Point of Mount (PoM) at which the wheel flange climbed the rail and commenced running along the rail.
4. The outside, continuous rails of a turnout.
5. The train speed was logged at about 13 km/h when braking was applied to bring the train to a stand within the loop.
6. Refers to the train being intact from one end to the other, and the last vehicle being properly identified.
7. A cripple track is used for stabling disabled rolling stock clear of the main line.

Context

Track

Location

Wallan loop is located about 47.3 rail km from Melbourne on the Victorian North-Eastern Standard-Gauge main line between Melbourne and Albury. The Australian Rail Track Corporation (ARTC) was the Rail Infrastructure Manager. It managed network rail traffic from its control centre in Junee, NSW, and track maintenance for this section of track from Seymour, Victoria.

Wallan crossing loop layout

The track at Wallan included the crossing loop and a cripple track for disabled rolling stock. The southern end of the loop consisted of a right-hand turnout from the main line and a second right-hand turnout to the cripple track. The Normal direction of this second turnout led into the crossing loop proper and to a short left-hand curve before the loop track curved right paralleling the main line (Figure 5).

Figure 5: The southern entry from the mainline into Wallan Loop and the cripple track

Source: Chief Investigator, Transport Safety (Vic)

The turnout at the southern entry to the crossing loop was located on a 1247 m radius main line curve with minimal gradient. The main line track has a superelevation^[8] of 100 mm that transitioned to the flat loop track over a distance of about 24 m.

The cripple track turnout was on timber sleepers. At the derailment location, sleepers were in degraded condition with an observable loss of effectiveness in the rail fastenings.

Track geometry

Standards

The ARTC track geometry standards specified defect categories for track gauge, horizontal alignment (line), vertical alignment (top) and twist (variation in actual cross level). The standard noted that the specified maintenance response was based on an isolated geometric defect, and a more stringent response than that mandated by the geometry alone may be necessary if deterioration of the infrastructure both at the defect and on adjoining track is in evidence.

The required response to a defect varied depending on the permitted train speed. Response requirements reduced as train speed reduced. The standard also defined response timeframes (Figure 6).

Figure 6: Response categories and timeframes

Source: ARTC Code of Practice, Track Geometry Section 5

Twist criteria

Two criteria applied to track twist. Short twist was measured over 2 m (approximating typical wagon bogie wheel spacing) and long twist was measured over 14 m (approximating a typical spacing of wagon bogie centres). Higher levels of twist were permitted in transition curves.

Track geometry recording car and maintenance response

Prior to the incident, the track geometry of the Wallan Loop was last assessed on 1 September 2017, using the AK Car.^[9] The inspection flagged two Emergency twist defects at the southern end of Wallan Loop and near the location of the derailment (Figure 7).

Figure 7: E Class defects identified near the derailment location

Source: ARTC Track Recording Car and Code of Practice, Track Geometry Section 5

Documentation indicated that the two defects were closed out on the asset management system on the same day as the inspection. There was no indication of any repair activity to correct the defects and no supporting documentation or approvals permitting the defect condition.

The previous two track-recording runs through the derailment site, in April 2017 and December 2016, also identified short and long twist defects categorised for emergency response.

Post-incident geometry measurement

Following the derailment, track gauge and cross level measurements were taken through the derailment location (Figure 8).

Figure 8: Point of wheel mount

Source: Chief Investigator, Transport Safety (Vic)

The PoM was at a chainage of approximately 47.316 km.^[14] Static twist measurements peaked around this location. A measured peak static long twist of 78 mm^[15] extended from 14 m before the PoM, up to the PoM. The measured peak static short twist^[16] was about 22 mm about 2 m ahead of the PoM. These values were comparable to the E-defects measured by the AK Car.

The maximum measured (no-load) wide gauge through the location was 20 mm at the PoM. This was within permitted maintenance tolerances. Review of the most recent AK Car data, measured under load, indicated a peak wide gauge of 31 mm at a chainage of 47.319 km. This falls within the P2 (Priority Class 2) defect category for this low speed track.

Track lateral alignment through the cripple track turnout was also sub-optimal and there was a significant dip in both rails at the transition (mechanical joint) from the main line turnout to the cripple track turnout (Figure 9).

Figure 9: Transition from main line turnout to cripple track turnout

This picture shows a close-up view of the track through the derailment location and shows the rail lateral alignment around the point of mount. The deviation in rail line is exaggerated by the telephoto effect.
Source: Chief Investigator, Transport Safety (Vic)

The train

Consist

Train 7MC1 comprised two QBX-class locomotives and 46 loaded wagons conveying shipping containers. It was 1,018 m long and had a gross mass of about 3,300 t. It had been loaded at Westgate sidings at Qube’s intermodal terminal in Melbourne. A Melbourne-based crew prepared and examined the train prior to its departure from the terminal, and then operated the train until a crew change-over at Somerton.

Wagon

The derailed wagon was designated LQAY 00025D. It was the 37th wagon from the locomotives and was “B” end leading. There were four wagons of this type in the consist, two ahead of the derailed wagon (2nd and 23rd), and one behind (the 46th and the last vehicle).

LQAY wagons are 19.3 m (60’) skeletal container wagons manufactured in China by Meishan Rolling Stock Works. The derailed wagon was one of 100 ordered by Macathur Intermodal Shipping Terminal (MIST) with production commencing in 2005. The use of this type of vehicle and bogie on the ARTC network was approved by ARTC in the form of a TOC Waiver in October 2009. As these wagons were initially operated on the Rail Infrastructure Corporation’s (RIC) NSW network they were required to meet the then RIC Minimum Operating Standards for Rolling Stock. ARTC’s Engineering Standard for Rolling Stock WOS 01 was based on these RIC requirements.

LQAY wagons are fitted with three-piece bogies with a steering arm mechanism linked to primary rubber pad arrangement between the side frame and axle box. They also have variable friction damping on the secondary springs and constant contact side bearers (Figure 10).

Figure 10: The derailed bogie after its transport to Melbourne

Source: Chief Investigator, Transport Safety (Vic)

Wheel profile

The bogies were delivered in 2005 with wheels profiled to the WPR 2000^[17] profile. This was the profile preferred by RIC, the original network destination for this wagon. The profile was subsequently changed to the ANZR-1^[18] profile, listed in the ARTC Route Access Standard General Information, for freight rolling stock operating on the Defined Interstate Rail Network. There was no evidence provided by the Rolling Stock Operator of a change management process associated with this change in wheel profile.

The WPR 2000 wheel profile is a worn wheel profile that was designed to increase wheel life compared to the ANZR-1 through limiting wear of the wheel flanges (Figure 11). It achieved this by utilising a more conical tread profile that generates a larger rolling radius difference between the wheels on a common axle. This increased the wheelsets ability to steer through curves and hence placed less load on the wheel flange.

Figure 11: Comparison between the WPR 2000 (blue) and ANZR-1 (red) wheel profiles

Source: Australian Transport Safety Bureau

While the increased steering capability of the WPR 2000 wheel profile offered less flange wear, it had been shown in use to lower the critical speed^[19] for some combinations of wagon type and rail profile leading to undesirable dynamics known as hunting^[20]. The ATSB understands that the flatter tread profile of the ANZR-1 was generally less susceptible to hunting and therefore the preferred profile for freight rolling stock operating on the ARTC Defined Interstate Rail Network (DIRN). It was also an option on other track where it could be demonstrated that a vehicle was experiencing bogie instability.

Wagon maintenance

LQAY wagons were on a preventative maintenance (PM) program. Maintenance records for LQAY 00025D indicated that:

• On 30 November 2016 both bogies and all wheelsets were replaced.
• The wagon had its last PM inspection on 24 October 2017.

Wagon type testing

Type testing of the LQAY wagon type was conducted in China in September 2005 and covered wagon numbers 00001 – 00100. The type testing was in accordance with the RIC Minimum Operating Standards for Rolling Stock and witnessed on behalf of MIST by Interfleet Technology. The type testing included a static vehicle twist test and vehicle/bogie swing test.

The twist test examined potential wheel unloading in response to track twist. Twist was simulated by packing wheels on one side of the wagon (Figure 12). For the type testing of the LAQY wagons, the packing used was P1 = 18 mm, P2 = 86 mm and P3 = 86 mm. The wheel unloading (the reduction in wheel load) was measured for the leading wheel (P0).

Figure 12: Test configuration for twist type testing, and centre-bowl engagement criterion

Source: QUBE, modified by Chief Investigator, Transport Safety

During this twist test, a maximum wheel unloading of 23% was measured, compared to the requirement of ‘…the loss of absolutely no more than 60% of the static wheel load for any wheel’. The measured engagement of the vehicle centre plate within the bogie centre casting was 14 mm, equal to the minimum permitted (Figure 12).

The purpose of the vehicle/bogie swing test is to evaluate clearance when a wagon is navigating tight curves. The criteria used in testing was a 70 m simple curve. This testing found adequate clearances for normal operations. The only adverse finding was fouling when the handbrake was applied.

Wagon loading

Wagon LQAY 00025D was loaded with two containers. At its leading end was an empty 20-foot refrigerated container with a reported mass of 3.2 t. Behind this was a 40-foot container loaded with strapped bundles of recycled paper and having a reported mass of 26 t (Figure 13). Wagon tare was 19.9t, giving a total mass of 49.1 t. This compares with the train consist report that records a total mass of 69 t. The reason for this discrepancy is unknown.

The two containers wholly occupied the length of the wagon. The mass distribution of the containers and wagon tare resulted in an estimated 21 t at the leading bogie and about 29 t at the trailing bogie of (Figure 14).^[21] The difference of about 8 t was within the ARTC Route Access Standard^[22] requirement of no more than 20 t.

Figure 13: Paper bundles loaded in the 40-foot container

Source: Qube Logistics

Figure 14: The container loads and the resultant mass at each bogie

The mass at each end has been rounded up, resulting in a total rounding error of 1 t, and an apparent total mass of 50 t compared to the actual total mass of 49 t.
Source: Chief Investigator, Transport Safety (Vic) based data from Qube

Post incident inspection

A detailed inspection was conducted on both bogies of wagon LQAY 00025D. The derailed bogie was designated LHSY113 (Figure 15).

Figure 15: The derailed bogie at the post-incident inspection

This picture shows the bogie that derailed. It shows damage to the centre bowl liner and some components, all believed to have occurred after the bogie derailed. 

Source: Chief Investigator, Transport Safety (Vic)

No wear or damage conditions were identified that were considered contributory to the derailment. Wear to both bogies was minimal and consistent with the recent December 2016 overhaul. In addition, surface condition of constant contact side bearers did not indicate any unusual behaviour.

Wheel wear was within the operating requirements and similar on both bogies. Wheel wear on the derailed bogie was relatively light and evenly matched from side to side indicating the bogie had been tracking well. Wear on the wheel flanges was more than expected for a steering bogie, but was within tolerance.

The performance of self-steering bogies is, in part, dependant on the wheel profile used. A change was made from the higher steering WPR 2000 wheel profile to the lower steering ANZR-1 wheel profile and this may have contributed to the more than expected wheel flange wear.

Type of bogie

The LQAY wagon bogies were of a ‘self-steering’ bogie design. The steering mechanism is an adaptation of a design pioneered by Dr Herbert Scheffel in the 1970’s in South Africa^[23]. The design sought to improve the curving performance of bogies by permitting the wheelsets to steer into curves reducing wheel and rail wear while retaining good stability and resistance to hunting. This bogie design is often referred to as the Scheffel Bogie.

Scheffel’s design mounted the wheelsets to sub-frames that were diagonally linked and utilised rubber shear pads (springs) to permit motion between the sub-frame and bogie frame. Configured in this way, the design permits yawing of the axles in response to wheelset steering forces, allowing them to adopt a ‘radial’ configuration that greatly improves curving performance (Figure 16). The design also resists shear motion between the two wheelsets and is therefore said to have good resistance to hunting.

Figure 16: The principle behind the steering bogie

The figure identifies the key design components (top) and radial steering (lower). Source: Australian Transport Safety Bureau

The magnitude of response of the steering mechanism is dependent on several factors including the wheel profiles used, with the resulting wheelset steering forces having an influence on the performance of the steering mechanism.

Train handling

Data logger

The lead locomotive was fitted with a data logger that provided a recorded history of the locomotive’s movements and train handling, including powering and braking during the sequence of events (Figure 17).

Figure 17: Key sequence of events from the locomotive data logger

Source: Chief Investigator, Transport Safety (Vic)

7MC1 entered Wallan Loop at low speed and power was being applied between notch 1 and notch 3. In-train coupler action would have been minimal and it is unlikely that there was sufficient in-train forces generated to contribute to the derailment.

Locomotive crew

Both crewmembers were qualified for their respective roles and held current medical certification.

Victoria Police conducted post-incident alcohol and drug tests on the locomotive crew at Kilmore East with non-positive results for all tests.

__________

8. The height difference between the rails. The outer rail on a curve is often elevated above the inner rail to facilitate higher curving speeds.
9. The AK Car is part of a three-car train that records track geometry on the standard-gauge network.
10. ARTC Code of Practice, Track Geometry Section 5, Table 5.5.
11. Absolute values shown. In the direction of travel, the left-hand rail was descending relative to the right rail.
12. The distance in rail km from a reference point in Melbourne.
13. As specified for a transition curve.
14. The estimated error tolerance on chainage at the PoM is +/- 2 m.
15. Track was measured by several parties with small, but inconsequential, variances in the hand measurements.
16. Measured over 2 m.
17. Standard AS 7514.2 Australian Standard – Railway Rolling Stock Wheels – Part 2: Freight Rolling Stock (2010) Appendix A.2
18. Standards AS 7514.2 Australian Standard – Railway Rolling Stock Wheels – Part 2: Freight Rolling Stock (2010) Appendix A.1
19. Critical speed: The lowest speed at which hunting is demonstrated. Can also be used to describe speed at which a resonant response occurs with cyclic track irregularities.
20. Hunting: Uncontrolled and undesirable cyclic lateral and yaw displacements of the wheelsets of a vehicle, generally worsening with increasing speed.
21. The mass distribution is an approximation.
22. This document defines the terms and conditions upon which ARTC grants access to its Network. It is intended to aid Train Operators to ensure trains are planned, constructed, inspected, maintained, loaded and operated in accordance with route attributes.
23. Original patent link.

Safety analysis

The derailment

Site evidence was conclusive that the flange of the leading left-hand wheel on the wagon LQAY 00025D climbed the left-hand stock rail in the turnout to the cripple track, a short distance past the point blade. The derailment was clear of moving turnout components including the point blade.

Flange climb derailment

Flange climb derailments initiate when the outward lateral force (L) applied by the wheel on the rail results in the wheel climbing the rail gauge face. This critical point is determined by several factors including the vertical load on the wheel (V), the angle of the wheel flange and the coefficient of friction between the rail and wheel.

A generally adopted limit for preventing flange climb is known as Nadal’s limit.^[24] Nadal’s limit defines a limiting lateral on vertical force ratio (L/V) for given wheel geometry and friction conditions. Flange climb becomes more likely as the L/V ratio increases beyond this value. This means that either an increase in lateral force, a decrease in vertical force or a combination of both will increase the risk of flange climb.

The lateral force of the wheel against the rail may increase due to a track feature such as a tight curve or lateral misalignment or by a condition of the bogie that affects its tracking. A reduction in the vertical load, also referred to as wheel unloading, can be associated with a track feature such as twist and can also be influenced by wagon condition including loading.

Track geometry

Twist

Near the point of flange climb, there were long and short twist defects. The long twist was of comparable magnitude to the value used in type testing of the LQAY wagon and the short twist was probably at least 20 percent^[25] greater than that used in the type testing. The track twist would have contributed to an unloading of the leading left-hand wheel of LQAY 00025D.

Alignment

Site observations indicated that traffic was probably tracking towards the Down leg^[26] around the derailment location. For north-bound traffic (the incident train), this meant that vehicles were probably typically tracking to the left towards the stock rail of the turnout to the cripple track. The rail alignment through the cripple track turnout and the track configuration through this location probably influenced wagon tracking behaviour.

Gauge

Track gauge measured statically after the derailment was at its widest at the point of wheel climb, but was within permitted tolerances. Under dynamic conditions, the wide-gauge at this location was about 50 percent higher, but also not at a level that would have required emergency corrective action.

Sleeper condition and effectiveness of rail fastenings

The most-recent AK Car assessment recorded a wide gauge of 31 mm at a chainage about three metres past the point of mount. This exceeded the static (no-load) peak gauge measurement of 20 mm through this location. Considering the degraded condition of sleepers and the loss of effectiveness of the fastenings, it is probable that there was some movement of the stock rail under dynamic load, probably adversely impacting track geometry.

Track defect management

At and near the point of mount, there were two identified twist defects categorised as requiring immediate emergency response. Records indicated that these twist defects had existed for at least 12 months.

The long track twist through the location was a result of the superelevation being rapidly transitioned from about 100 mm on the main line curve through to the flat crossing loop track. The dynamic short twist within this transition was more severe, and probably the result of localised ballast subsidence under the load of rolling stock.

The acceptance of the track in this condition contrary to the network geometry standards was not supported by documentation and approvals as required by the standard.

Wagon performance

This wagon type and its loading was compliant with network requirements and the post-incident bogie inspection did not identify a condition that may have contributed to the derailment.

It is possible that the response of wagon LQAY 00025D to the track geometry anomalies was different to other wagons. A factor that may have influenced its response was its load distribution.

No conclusion was drawn from the second derailment of the vehicle as it was being transferred to the cripple track. The bogie was damaged and the second derailment occurred on a different part of the track to the first.

__________

24. Nadal, M.J., Locomotives à Vapeur; (Collection: Encyclopédie Scientifique, - Bibliothèque de Mécanique Appliquée et Génie, 1908).
25. Based on a short twist of 24 mm measured under the dynamic conditions of the AK Car. Under the loading of LQAY 00025D, the dynamic twist in the track may have been greater.
26. The left-hand rail when facing away from Melbourne.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 7MC1 at Wallan on 4 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• ARTC allowed identified track twist defects to remain in track contrary to network track geometry requirements. [Safety Issue]
• Track twist contributed to unloading of the leading left-hand wheel of wagon LQAY 00025D.
• Track alignment probably resulted in the leading left-hand wheel of wagon LQAY 00025D tracking to the left-hand stock rail as the wagon passed through the cripple track turnout.
• When traversing the cripple track turnout towards the crossing loop, the leading left-hand wheel of wagon LQAY 00025D climbed the left-hand stock rail, and the wagon derailed.

Other factors that increased risk

• The degraded condition of some sleepers through the location reduced the effectiveness of rail fastenings, probably adversely affecting track geometry under dynamic load.

Other findings

• The operation of the train was consistent with network practice and unlikely to have contributed to the derailment.
• Post-incident bogie inspection did not identify a condition that may have contributed to the derailment.

Safety issues and actions

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Track defect management

Safety issue number: RO-2017-016-SI-01

Safety issue description: ARTC allowed identified track twist defects to remain in track contrary to network track geometry requirements.

Additional safety action

ARTC has completed rectification works at Wallan to address the twist exceedances in the vicinity of the turnout from the loop to the cripple track. The geometry was initially corrected on 23 December 2017. Follow-up works were completed on 19 March 2018 and included the installation of turnout bearers with resilient fastenings and mechanised tamping (Figure 18).

Figure 18: The derailment location after rectification works

Source: Chief Investigator, Transport Safety (Vic)

Sources and submissions

Sources of information

• Qube Logistics (Rail) Services
• Australian Rail Track Corporation

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Australian Rail Track Corporation, Qube Logistics Rail Services, the Rail Regulator, and the locomotive drivers. Submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the morning of 18 December 2017, a Jetstar Airways Airbus A320 aircraft, registered VH‑VQG was on final approach for Gold Coast Airport, Queensland. The aircraft was operating as a scheduled passenger flight, from Adelaide, South Australia.

After a normal descent and touchdown, the captain selected both engine thrust reversers. The left engine thrust reverser did not activate. The aircraft decelerated using normal braking and taxied to the gate without further incident. There was no damage to the aircraft, or injuries as a result of the incident, and the captain reported the thrust reverser issue for investigation.

What the ATSB found

During overnight maintenance in Adelaide, the left engine thrust reverser lockout pin had been installed. However, the pin was not removed after the maintenance, resulting in the aircraft returning to service with the thrust reverser deactivated.

The lockout pin was located at the top of the engine and its 1 m red warning flag was difficult to see in the prevailing low‑light conditions. This probably led to the engineer not seeing the flag and removing the pin.

Further, the lockout pin was not booked out of the tool store nor was its installation recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin's removal were missed.

What's been done as a result

The aircraft’s maintenance organisation, Qantas, advised that it is taking safety action that includes the following:

• Highlighting the importance of the aircraft maintenance manual precautions to maintenance staff at Adelaide.
• Lengthening all thrust reverser lockout pin warning flags to hang past the closed engine cowls. The pin will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.

The aircraft manufacturer, Airbus, advised that the August 2019 revision of the aircraft maintenance manual introduced an operational test of the thrust reverser system to confirm its re‑activation after maintenance tasks.

Safety message

This investigation highlights the importance of considering the environmental conditions in which equipment and tools will potentially be used, as well as the importance of following procedures that in this instance should have resulted in detecting the error.

When considering the effectiveness of equipment, tooling and procedures that aim to minimise the likelihood and/or consequences of an error, an engineered solution is generally more effective than relying on procedural compliance. Further, a functional check is generally more effective within procedural compliance than a self-check of work. See the ATSB research report, An overview of human factors in aviation maintenance (AR-2008-055), available from the ATSB website.

The occurrence

What happened

On the morning of 18 December 2017, a Jetstar Airways (Jetstar) Airbus A320 aircraft, registered VH‑VQG (VQG) was on final approach to Gold Coast Airport, Queensland. The aircraft was operating as a scheduled passenger flight, from Adelaide, South Australia, with two flight crew, four cabin crew, and 140 passengers.

At about 0845 Eastern Standard Time,^[1] air traffic control cleared VQG to land. After a normal descent and touchdown, the captain (pilot flying) selected both engine thrust reversers.^[2] The right engine thrust reverser activated but the left engine reverser did not, and the flight crew received a ‘reverse fault’ alert. They continued with the landing and the aircraft decelerated to a taxi speed using normal braking. The captain moved the thrust reverser controls to the stowed position, the aircraft was taxied to the gate without further incident and the passengers disembarked.

While taxiing, the captain cycled the thrust reverser levers and the alert extinguished. Nevertheless, the captain reported the thrust reverser issue for investigation by engineering personnel.

The subsequent engineering inspection found the left engine thrust reverser lockout pin installed, effectively deactivating the reverser. The lockout pin was removed, the thrust reverser confirmed to be operating normally and the aircraft returned to service.

There was no damage to the aircraft, or injuries as a result of the incident.

Overnight maintenance

Maintenance on the aircraft’s left engine was carried out in Adelaide during the night before the incident flight. Two A320 licensed maintenance engineers had carried out that maintenance.

One of the engineers (engineer 1) began his scheduled night shift at about 1900 on 17 December, and he described the weather that evening as hot and humid. He initially thought he was the only engineer on that shift to carry out maintenance certification on four A320 aircraft, and stated that he felt ‘stressed’ and under pressure. The other engineer (engineer 2) had been called in to work overtime that evening. He started his shift at 1830, carrying out other tasks before being assigned to assist engineer 1 with VQG later that evening.

At about 2300, after completing their other tasks, the engineers commenced maintenance on VQG. This maintenance was unscheduled and involved investigating an engine bleed air issue. Jetstar had not provided paperwork for this task. Engineer 2 began collecting the consumables required for the task. Engineer 1 went to the tarmac tool store to get a lockout pin, required to be installed on the engine to prevent inadvertent activation of the thrust reverser.

After locating the lockout pin with some difficulty, engineer 1 hurried back to the aircraft without booking out the pin on the store’s computer system. He opened the left engine cowling and, using a stand to access the top of the engine, installed the pin. Procedures required the pin’s installation to be entered in the aircraft’s technical log. The log was located in the line office, and the engineer decided to record it in the log later.

A couple of hours later, the engineers completed investigating the bleed air issue. By this time, it had started raining. Engineer 1 made a visual inspection around the engine in preparation to close the cowling. The available lighting had reduced as half the tarmac lights automatically turn off at midnight. Engineer 1 missed seeing the lockout pin and its 1 m long red warning flag, and closed the cowling (Figure 1). The flag was shorter than those on the pins in the hangar tool store at Adelaide, which had been lengthened to 4 m after a previous incident to make them more obvious. Additionally, the stand that engineer 1 had used to install the pin, and which may have reminded him about it, had been removed for another task.

The aircraft maintenance manual thrust reverser de-activation procedure also required the use of specific warning labels in the cockpit, stating that ‘thrust reverser HCU [hydraulic control unit] is de-activated’. This procedure was not used during this maintenance task.

Figure 1: Photograph of a thrust reverser lockout pin and warning flag (non-reflective)

Source: Operator, annotated by the ATSB

Shortly after 0230 on 18 December, the engineers completed the maintenance on VQG, and went to the line office to complete the paperwork. The engineers recorded different parts of the completed maintenance, but neither entered the installation of the lockout pin in the technical log.

At the release to service of VQG, a tooling inventory check was conducted. As the pin was not booked out on the store’s computer, it did not show up during the check.

The aircraft was released to service with the lockout pin installed.

Similar occurrences

AO-2018-064^[3]

In September 2018, the engine thrust reversers on a Jetstar A320 aircraft did not activate when landing at Sydney Airport, New South Wales. The ATSB investigation into that occurrence found that the thrust reverser lockout pins on both engines were not removed after maintenance at the Brisbane Airport, Queensland facility before the flight.

In that case, the aircraft maintenance lockout pins (fitted with warning flags) were substituted with in-service pins without flags. Further, the functional check of the thrust reversers following reactivation as per the operator’s task card for that planned maintenance was not carried out. The investigation also found that operational pressure to expedite the maintenance probably influenced the deviation from procedures.

January 2017

In January 2017, the right engine thrust reverser on a Jetstar A320 aircraft did not activate when landing at Melbourne Airport, Victoria. The operator’s investigation found that the thrust reverser lockout pin was not removed after maintenance at Adelaide before the flight.

In that case, the aircraft maintenance lockout pin also had a 1 m red warning flag and was not booked out on the store’s computer system.

Safety analysis

The left engine thrust reverser did not activate when VH‑VQG landed at the Gold Coast Airport because its lockout pin was installed. Engineers had installed the pin during maintenance in Adelaide before the flight, but missed removing it due to a number of reasons.

The maintenance in Adelaide was carried out in the night under artificial lighting on the tarmac. The lighting significantly reduced at midnight when the tarmac lights automatically dimmed (half extinguished). In addition, it was raining when engineer 1 carried out a visual inspection before closing the engine cowling. These conditions made it difficult to see the lockout pin’s red warning flag.

The red colour of the flag was also harder to see in the artificial lighting,^[4] and the flag was not fitted with reflective material. The lockout pin was located at the top of the engine, where its 1 m flag was not as conspicuous as other longer flags, which would have hung below the engine to the tarmac. Further, the stand used to install the pin, which might have served as a reminder, had been removed. The combination of these factors probably led to the pin not being removed.

Procedures aimed at ensuring the lockout pin’s removal were not followed. These procedures included booking items out on the tool store’s computer system. As the pin was not booked out, its return to the store could not be checked. Further, the pin’s installation was not recorded in the technical log, which meant its removal went unnoticed and unrecorded.

Finally, the required cockpit warnings associated with thrust reverser deactivation were not used, thereby removing an opportunity to identify that the pin had not been removed before the aircraft was returned to service.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The lockout pin on the left engine thrust reverser was not removed after maintenance, resulting in the aircraft returning to service with the thrust reverser deactivated.
• The location of the thrust reverser lockout pin at the top of the engine meant that its 1 m red warning flag was difficult to see in the prevailing low‑light conditions. This probably led to the engineer not seeing the flag and removing the pin.
• The lockout pin was not booked out of the tool store nor was its installation recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin's removal were missed. Additionally, the required cockpit warnings associated with thrust reverser deactivation were not used, removing an opportunity to identify that the thrust reverser was disabled.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas

The aircraft maintenance organisation, Qantas, has advised the ATSB that it is taking the following safety actions:

• Highlighting the importance of the aircraft maintenance manual precautions, and the limitations of human performance on the stages of maintenance, to maintenance staff at Adelaide.
• Lengthening all thrust reverser lockout pin flags to hang past the closed cowls. The pin will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.
• Focused audits on work practices for tooling and documenting maintenance activities.
• Reiterating the responsibilities of engineers to those involved in this incident.

Airbus

The aircraft manufacturer, Airbus, advised that the August 2019 revision of the aircraft maintenance manual introduced an operational test of the thrust reverser system to confirm its re‑activation after maintenance tasks. 

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. The purpose of the engine thrust reversers is to decelerate the aircraft on the ground, either routinely or during an emergency.
3. Available at www.atsb.gov.au
4. An effect known as the Purkinje shift, red will appear darker relative to other colours as light levels decrease.

What happened

At midnight^[1] on 10 December 2017, the multi-purpose, general cargo ship BBC Xingang (Figure 1) berthed at Mayfield number four berth in Newcastle, New South Wales. The cargo to be discharged comprised containers and ‘project cargo’, which consisted of large structures of various shapes and sizes. Some of the cargo had gel-coated surfaces that could be easily damaged, and these components were covered with cloth for protection during transport.

Figure 1: BBC Xingang

Source: Tropic Marine Images, Shipspotting.com

Sea fastenings (or stoppers) were used to secure the project cargo during sea passage. The stoppers were metal brackets welded to the ship’s deck, and they needed to be removed before the cargo could be discharged. To remove the stoppers, oxy-acetylene cutting and gouging techniques were required.

In preparation for removing the stoppers, the chief mate and deck crew had reviewed the ship’s risk assessment for hot work and completed the ship’s hot work permit. The master had notified Newcastle port of the intended work and a hot work audit report had been completed by a port representative.

At about 0600 on 11 December, a work team, including a site supervisor and a boilermaker, from a local engineering firm (Varley) boarded the ship. This team had a current Varley Job Safety and Environmental Analysis (JSEA) for hot work to remove stoppers on board ship and had completed a Varley hot work permit.

At 0630, the chief mate convened a safety meeting involving the Varley boilermaker and relevant crewmembers. The process of removing the stoppers was discussed along with the safety measures and procedures to be followed. Hot work requirements, including the hot work permits and risk assessments, were reviewed. Individual duties, including that of the fire watch, were explained and assigned. The ship’s crew were responsible for providing firefighting equipment (such as extinguishers and hoses) and controls such as the fire watch.

The work commenced in the number two cargo hold tween deck.^[2] In preparation for the hot work, gaps between the tween deck pontoons were filled and covered with fire blankets (made from woven fibre and leather) to stop sparks from falling onto the cloth-covered cargo in the lower hold (Figure 2).

Figure 2: Worksite showing stoppers, after the incident

Source: Briese Schiffahrts annotations by ATSB

The fire watch consisted of two crewmembers in contact via VHF radio, one on the tween deck and the other in the lower hold. A small diameter fresh water hose was laid out and a makeshift water spray extinguisher readied for immediate use in the lower hold. Cargo in the lower hold was covered with the transport cloth but was not covered with fire blankets.

At 1015, the boilermaker began removing the stoppers. The work site was overseen by ship’s crewmembers, the port captain^[3] and the Varley site supervisor. The port captain asked that sparks be directed away from the cargo to protect the component surfaces. This request, in some cases, resulted in the sparks being directed toward gaps between the tween deck pontoons.

The work continued as expected and, at 1100, the boilermaker stopped to relocate to the next stoppers on the tween deck. As part of checking the new work area, he lifted a fire blanket and could see small flames and smoke in the lower hold through the gap in the tween deck pontoons. He immediately raised the alarm. The lower hold fire watch was notified on the radio. At the time he was notified he was not near the area directly under where the work was being conducted. After moving to the relevant area, he quickly extinguished the fire using the water hose and water spray. Figure 3 shows the location of the work site and the fire in the ship’s hold (elevation view and plan view).

Figure 3: Number 2 cargo hold, elevation and plan views of worksite

Source: Briese Schiffahrts with annotations by ATSB

An inspection of the work site following the fire identified that molten metal and other hot material produced by the hot work had burned through the fire blankets. This hot material fell onto the material covering the cargo in the lower hold, resulting in the fire. As a result of the fire, the material covering the cargo was damaged and some surface blemishes were apparent on the cargo itself (Figure 4). No other damage was reported. Subsequent inspection of the cargo covering material found it to be 100 per cent polyester transport cloth with a maximum rated temperature of 200 °C.

Following the fire, all work to remove the stoppers was suspended and the incident was reviewed. Procedures and safety measures were reassessed during a meeting of ship’s crew and the shore contract team. The cutting procedure was amended to direct the sparks away from deck openings and containment of sparks around the work area was improved. Further, additional filling material was added to holes in the tween decks used for removable hand rails, and the lower hold fire watch was directed to monitor the area directly below the work rather than the general vicinity. Work resumed at 1315 and continued to completion without further incident.

Figure 4: Cargo covering material and cargo surface damage

Source: Briese Schiffahrts

BBC Xingang

BBC Xingang is a multi-purpose, heavy lift, general cargo ship registered in Antigua and Barbuda. The ship was built in 2013 by Tianjin Xingang Shipbuilding Heavy Industry, China and classed with DNV GL.

The ship has an overall length of 125.8 m, a moulded breadth of 22.0 m and a deadweight of 8,970 t at its summer draught of 7.60 m. The multi-purpose ship can carry containers and/or general cargo. It has two cargo holds with tween decks. Two 350 t capacity cranes are mounted on the port side and can be used in combination to lift loads up to 700 t.

At the time of the incident, BBC Xingang was owned by Briese Schiffahrts ‘Hatshausen’, operated by BBC Chartering & Logistics and managed by Briese Schiffahrts, all of Germany.

Previous incidents

The ATSB has, on two previous occasions, investigated fires on board Briese Schiffahrts managed vessels in Australian ports.^[4] On both occasions the fire was started during hot work to remove sea fastenings. In the BBC Baltic fire, flammable cargo coverings were also found to have ignited. The damage caused was considerably more than that sustained on BBC Xingang.

As a consequence of the previous incidents, Briese Schiffahrts had completed significant safety actions, which were in place at the time of the current fire. These included improved shipboard procedures, risk assessments, permits to work, safety meetings and provision of equipment such as fire blankets and mats.

Safety analysis

The task of removing sea fastenings, originally welded in place to prevent movement of the cargo during the sea voyage, involved hot work, cutting and gouging techniques. This hot work produced sparks, globules of molten steel of various sizes and other hot material. To protect the sensitive surfaces of the cargo, the debris produced by the hot work was directed away from the cargo and more toward gaps/holes in tween deck pontoons.

The work area and the gaps/holes in the pontoons were protected by fire blankets. However, the molten metal produced was of sufficient size and intensity to burn through the protective fire blankets and fall onto the cargo stowed in the deck below. This cargo was covered with transport cloth to protect it during transport but was not protected from the hot debris by covering with fire blankets. Transport cloth is made of 100 per cent polyester and will ignite if directly exposed to fire. As a consequence, when the hot material fell onto the unprotected transport cloth it resulted in the fire.

A fire watch was present in the lower hold but had not been directed to closely monitor immediately below the work site. Therefore, the fire watch was not in position to immediately react when the molten metal fell from above. It was only when the flames and smoke were observed by the boilermaker that the response was initiated and the fire extinguished.

Despite the safety actions taken after previous fires, flammable cargo coverings were again ignited during sea fastening removal on this occasion. Careful consideration must be given to the use of such materials. Prior to hot work, cargo coverings should be carefully assessed and adequate protection against damage or fire due to hot material should be provided.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

The fire on BBC Xingang started during the oxy-acetylene cutting and gouging removal of sea fastenings. Molten metal and other hot material produced by this work burned through protective fire blankets in place around the site, and fell onto unprotected cargo below.

• The cargo stowed below the work site was covered with flammable polyester material which had not been adequately identified and protected prior to the work commencing.
• A fire watch was present in the lower hold but had not been directed to closely monitor immediately below the work site so was not in position to quickly react when the molten metal fell from above.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.

Briese Schiffahrts

On board BBC Xingang, replacement fire blankets were obtained and a safety meeting convened to discuss the incident. This meeting, attended by all ship’s crewmembers, discussed the circumstances of the incident, reviewed relevant existing fleet circulars, reviewed the risk assessment and went through procedures and processes relating to this work and the role of the fire watch.

Varley

Varley advised the ATSB that it had:

• reviewed and updated the Job Safety and Environmental Analysis (JSEA) to implement added control measures for hot work
• amended work procedures to:
  • improve coordination and communication between vessel management and third party contractors regarding expectations of fire watchers and firefighting equipment prior to starting work
  • ensure inspections are conducted on all cargo and materials in lower holds, prior to starting any hot work in the tween decks
  • ensure that if suspect items are found in the lower hold that communications with work teams and site management include focus on safety expectations and hot work controls
  • include using heat proof tape to cover gaps in the tween decks with fire blankets added on top
  • use fire blankets to protect items in the lower hold.

BBC Chartering

BBC Chartering advised the ATSB of the following safety action:

• gaps/holes in the tween decks will be covered by fire resistant tape in addition to other measures such as using fire blankets to protect areas below hot work.

Vestas

Vestas advised the ATSB that as part of cargo handling guidance, storyboards explaining safety measures to be taken while welding, cutting and grinding are shared with vessel owners, carriers, and freight forwarders contracted for the carriage of Vestas cargo.

Safety message

Ship fires due to hot work to remove sea fastenings are a constant danger. The continuing incidence of hot work related fires during the removal of sea fastenings highlights the importance of maintaining vigilance throughout the entire process. This is especially important if this is a regular task and is at risk of becoming routine. Procedures and practices along with the equipment available for completion of the task need to be reviewed and assessed and used as appropriate.

Hot work requires the implementation of comprehensive risk controls and procedures. These should include, but not be limited to, detailed, task-specific appraisals, risk and hazard assessments, work permits and pre-work toolbox meetings. Ultimately, the responsibility for the implementation of these controls rests with the ship, in consultation with third parties if involved. This is especially important when shore labour is employed to complete the work and multiple organisations’ work requirements and procedures are involved.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. All times referred to in this report are local time, Coordinated Universal Time (UTC) + 11 hours.
2. The tween deck is a deck located about mid depth in the cargo hold. It consists of pontoons, which are removable steel structures running the full width of the hold (about 17 m), about 7 m long and 0.8 m deep.
3. A senior official appointed by the ship’s owners to oversee cargo handling and associated work including the fitting or removal of cargo securing arrangements such as stoppers.
4. In 2012, investigation 293-MO-2012-002 involving BBC Baltic. In 2008, investigation 245 involving BBC Islander.

Safety summary

What happened

On 12 December 2017, a fractured bogie was identified on Pacific National train TM78A during a roll-by inspection at the Kooragang Coal Terminal, New South Wales. The fracture was on bogie NDCA 1199 of wagon NHBH 42954J. This wagon operated loaded between Tahmoor Colliery and Kooragang prior to identifying the fractured bogie.

What the ATSB found

The ATSB found that a fatigue crack went undetected during preventative maintenance activities prior to the structural failure of the bogie frame. It is probable that the fracture was visible at the time of unloading at Newcastle Coal Infrastructure Group on 11 December, which went undetected. The fractured bogie was identified during a roll-by inspection on 12 December, likely preventing a derailment.

What's been done as a result

Pacific National made changes to the maintenance standards used during scheduled maintenance, to increase the area of the bogie frame subjected to non-destructive testing. These changes are aimed at identifying and addressing fatigue cracking prior to the escalation of the defect.

Safety message

Asset managers should ensure that inspection techniques effectively monitor and report on asset condition. Risk controls should also be continuously assessed to control risk to an acceptable level through the life cycle of the asset.

The occurrence

What happened

On the morning of 12 December 2017, train TM78A operated by Pacific National (PN) was unloading coal at the Kooragang Coal Terminal (KCT).^[1] At the time, a maintenance worker was conducting a roll-by inspection^[2] after the train moved through the unloading bay. The worker visually identified a crack on the lead bogie of wagon NHBH 42954J, this was the 35th wagon in the direction of travel. The train was stopped and the wagon was removed to allow for inspection.

The train operated between KCT to Clarence on the 10 December, before returning to Newcastle Infrastructure Coal Group (NCIG). On 11 December the train operated empty from NCIG to Tahmoor before returning loaded to KCT (Figure 1). During these journeys, the trackside condition based monitoring equipment recorded elevated bearing temperatures on axle 4 of wagon NHBH 42954J, as well as an increased angle of attack (AoA).^[3] These recordings did not generate an alert at the time of passing the various detection sites and the train continued to operate until the fractured bogie was visually identified by the maintenance worker.

Figure 1: Incident location

Source: Geoscience Australia, annotated by OTSI

Safety analysis

A PN maintenance worker was located inside the unloading bay at NCIG on 11 December, this worker’s primary function was to observe the wagon doors close. It was not clear if this worker was deemed to additionally be conducting a roll-by inspection. The worker was positioned on the opposite side (to the bogie fracture) of wagon NHBH 42954J and did not report any defects. The bogie was probably visibly fractured at the time based on the increased AoA.

The roll-by inspection completed on 12 December was completed by a single worker, with the worker positioned on the same side as the fractured bogie and the defect was identified. The axle showed signs of rotating forward and up relative to the frame as the fracture opened under the weight of the wagon (Figure 2). As the fracture opened the effective axle spacing changed, lengthening the wheelbase on the side of the cracked frame. PN maintenance standards permit roll-by inspections being completed by a single worker. The defect was detected during a roll-by inspection, however could have been missed if the worker was positioned on the opposite side.

Figure 2: Fractured bogie frame NDCA 1199

Source: Pacific National, annotated by OTSI

The train underwent unit train maintenance (UTM) and a full train examination (FX) on 8 December 2017 at the PN Lithgow maintenance depot. During this inspection, there were no defects reported in relation to bogie NDCA 1199. Prior to identifying the fractured bogie, the train was compliant with the PN technical maintenance plan.

Bogie NDCA 1199 underwent schedule maintenance in July 2015. The bogie frame was subjected to non-destructive testing (NDT) consisting of magnetic particle inspection (MPI) and tested in accordance with PN procedure WMM 11-08_06 One Piece Bogie Inspection. There were no defects detected at the time of testing and the location of the fracture was at the extremity of the area subjected to NDT. Evidence of remnant MPI marker paint was present on the outboard plate, but there was no apparent marker paint on the inboard plate at the region of the fracture.

Fatigue cracking has historically been identified in the NDCA bogies at the welded junction joining the vertical plate and bottom plate section due to the design and manufacturing process used to build this class of bogie at the time. The NDCA bogie is comprised of welded steel plates to form a single piece box section bogie frame.

Prior to this occurrence, a derailment occurred in 2011 at Leigh Creek, South Australia. This derailment was reportedly the result of a fractured NDCA bogie. The bogie fracture increased the wheelbase on the side of the fractures, likely placing additional loading on the axle bearing as the axle tracked abnormally, this led to the bearing overheating and failing.

Post-occurrence inspection of the bogie NDCA1199 showed a fatigue crack most likely initiated at the toe of the weld on the inboard corner of the bogie side frame before progressing across the lower plate and inboard vertical plate (Figure 3). The inboard fracture face was smooth and displayed beach marks (slow progression), while the outboard face was jagged in appearance indicative of rapid progression.

Figure 3: NDCA 1199 fracture analysis

The image shows the bogie fracture from the underside of the bogie to show the three fracture faces. Source: OTSI

The trackside condition based monitoring equipment recorded increased bearing temperatures from 10 December after departing Clarence, as well as an increased AoA on 11 December. Analysis of this recorded data following the event, indicates that the change was likely the result of the bogie frame fracture progressing. As the fracture progressed, the wheelbase (spacing between the axles) increased between axle 3 and 4, affecting the AoA and placing additional loading on the bearing.

At the time of passing through the various trackside condition based monitoring sites, the recorded bearing temperatures did not trigger an automatic alarm to notify the rail infrastructure manager (RIM) or PN. The track side detection equipment utilises algorithms to determine critical levels^[4] that trigger automatic alarms to advise the RIM or operator. In relation to bearing temperature, only warm or hot bearing alarms will trigger an automatic alarm that requires immediate attention. Low bearing temperature alerts and AoA are recorded by the system but do not generate automatic alarms.

The wagon loading for the previous journeys was reviewed and indicated, that between 10 December and 12 December, the wagon operated within the allowable 100 t gross limit. The operation of the train and wagon loading does not appear to have contributed to this occurrence.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• A fatigue crack likely originated at the toe of a weld on the inboard lower plate of the bogie frame that was not identified during the preventative maintenance activities, prior to the structural failure of the frame. The fatigue cracking most likely progressed across the full face of the lower plate and inboard side plate before rapidly progressing across the outboard side plate.
• The NDCA bogie design has a history of fatigue cracking which increases the risk of derailment if the cracking is not identified. Pacific National had processes in places to identify fatigue cracking but this crack was likely not detected due to the location of the defect.
• Trackside condition based monitoring equipment recorded elevated bearing temperature and increased angle of attack in the days prior to the fractured bogie being identified. This was likely a result of the bogie fracture progressing. The recorded temperature did not trigger an automatic alert to advise the rail infrastructure manager or operator.

Safety action

The ATSB has been advised of the following safety action in response to this occurrence.

Pacific National

As a result of this occurrence, Pacific National has advised the ATSB that they have taken the following safety actions:

Bogie Survey

Pacific National undertook a visual inspection of all NDCA bogie frames for evidence of cracking as directed by Office of the National Rail Safety Regulator (ONRSR).

Revised Maintenance Standard

Pacific National revised maintenance standard WMM 11-08_06 One Piece Bogie Inspection to increase the area subjected to NDT testing during schedule overhauls. The entire side frame is now tested on the inboard and outboard plates as well as the underside of the bogie frame through the horn cheek area.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Kooragang Coal Terminal is operated by Port Waratah Coal Services (PWCS).
2. Roll-by inspections are a visual inspection of moving rail traffic to identify equipment, loading security or other defects or failure.
3. Angle of attack (AoA) refers to the alignment of the train axle and wheels relative to the rail.
4. Bearing and Brake Temperature Alarm Model, T HR RS 133003 ST, Version 1.0. Issue date 12 January 2017. Asset Standards Authority, Transport NSW.

What happened

On 6 December 2017, at about 0800 Central Standard Time,^[1] a Cessna U206G (C206) aircraft, registered VH-HPA (HPA) and operated by Hardy Aviation, taxied at Darwin Airport, Northern Territory (NT). A Cessna 210L (C210) aircraft, registered VH-SYT (SYT) and operated by Chartair, taxied not far behind HPA.

The pilots of the aircraft were both operating charter flights to Port Keats, NT, under the visual flight rules (VFR),^[2] and had planned to track at 8,500 ft. Their initial clearance, in accordance with the traffic management plan for Darwin, was to track via VFR route 5, which tracked south for 5 NM then south-west (Figure 1). Both aircraft were taxiing to depart from runway 18. Prior to take-off, the pilot of each aircraft was advised by air traffic control^[3] that the other aircraft would also be tracking to Port Keats at 8,500 ft.

Figure 1: Extract of Darwin Visual Terminal Chart showing VFR Route 5 and direct track to Port Keats

Source: Airservices – annotated by ATSB

The pilot of HPA, with two passengers on board, observed SYT taxiing and saw only the pilot on board. He assumed, therefore, that SYT would probably be light and expected it would quickly overtake and out-climb HPA.

Shortly after take-off, the pilot of HPA contacted the Darwin approach controller and reported passing 800 ft on climb to 2,000 ft. The Australian Defence Air Traffic System (ADATS) controller’s situation display indicated the aircraft’s altitude as 700 ft at that time, based on the transmission from the aircraft’s mode C transponder (see the section titled Radar altitude). The controller then cleared HPA to track direct to Port Keats at 8,500 ft.

The pilot of SYT was cleared for take-off about 1 minute after HPA. Once airborne, he immediately looked for, and sighted HPA. Just before 0808, the pilot of SYT contacted the approach controller and reported passing 600 ft on climb to 2,000 ft, with HPA in sight (Figure 2). By the end of that transmission, the controller’s situation display radar altitude for SYT indicated 100 ft. The displayed level information differed from the pilot’s reported altitude by more than the permitted tolerance of 200 ft (see the section titled Radar altitude) but there was no indication that the controller identified that discrepancy.

Figure 2: Google Earth image overlaid with aircraft tracks

Source: Google Earth and radar data – annotated by ATSB

In response to the transmission by the pilot of SYT, the controller advised that the preceding traffic (HPA) was now tracking direct to Port Keats at 8,500 ft, and then asked whether direct tracking was also being sought for SYT. The pilot of SYT responded ‘affirm, when available’. The controller advised him to expect that clearance in 1 minute.

The approach controller reported that SYT was left on VFR route 5 for about 1 minute to segregate it from HPA, before being re-cleared to track direct to Port Keats at 8,500 ft. The pilot of SYT reported that the direct track to Port Keats put SYT on a similar track to HPA. Therefore, he kept HPA in sight, and manoeuvred to the right of its track, expecting to overtake it.

The pilot of HPA expected that SYT would be either just to the left (based on the VFR route’s initial southerly track compared to the direct track to the south-west) or directly behind HPA. At 0812, the pilot of HPA requested (and received) a clearance to stop climb at 6,500 ft ‘due to faster following traffic’. This transmission was intended to make the pilot of SYT aware that he knew SYT would be close behind, and for vertical separation between the two aircraft.

Three minutes later, the approach controller asked the pilot of SYT if he still had the preceding traffic in sight, and the pilot responded ‘affirm’. The controller then advised him that HPA was now on climb to the amended level of 6,500 ft.

As SYT approached 5,500 ft, the pilot of SYT could see his aircraft was gaining on HPA, and assessed it would soon overtake HPA. Shortly after, HPA moved through the 10 o’clock position^[4] of the pilot of SYT who then lost sight of it behind SYT’s left wing.

At 0816, when about 15 NM south-west of Darwin Airport, the pilot of SYT reported to the approach controller that he was ‘just coming up on HPA’s 3 o’clock position and lost sight’ of that aircraft. The controller advised that HPA was ‘climbing through 6,200 [ft] at the moment, probably half a [nautical] mile to your left’. The pilot of SYT responded ‘Sierra Yankee Tango’, and did not sight HPA.

The controller then gave HPA traffic information: ‘SYT is on your right 3 o’clock, half a [nautical] mile, climbing through 5,500 [ft]’. The pilot of HPA responded that he was ‘looking’. The pilot of HPA looked to his right, but did not see SYT.

The radar data at that time indicated lateral separation between the aircraft was 0.27 NM (500 m), with SYT behind and slightly right of HPA and 800 ft below. About 30 seconds later, an ADATS conflict alert (CA)^[5] activated on the controller’s situation display (SYT indicated 5,600 ft and HPA 6,400 ft). When HPA reached 6,500 ft, the pilot levelled the aircraft off and completed the top of climb checks.

At 0817, the approach controller asked the pilot of SYT ‘Do you have that traffic in sight or would you prefer a different level or tracking?’ The pilot of SYT responded ‘Negative, traffic not in sight… happy to maintain this track if HPA has us in sight’. The controller then asked the pilot of HPA if they had SYT in sight. The pilot of HPA responded ‘Negative’ and advised that HPA was now maintaining 6,500 ft.

The pilot of SYT reported that, at that time, he still thought the aircraft were half a nautical mile (900 m) apart and was expecting HPA to be out to his left. However, the radar data indicated that HPA was 800 ft vertically above, and 0.18 NM (333 m) laterally away from SYT.

At 0818 the CA activated again while neither pilot had the other aircraft in sight. The radar data at the time indicated that SYT was at 5,900 ft, HPA at 6,500 ft with a lateral separation of 0.13 NM (241 m).

The approach supervisor reported that, at that stage, there was still just over 500 ft vertically between the two aircraft and that he instructed the approach controller to maintain 500 ft separation between the aircraft.

In response to the direction from the supervisor, the controller asked the pilot of SYT if he would ‘like to stop climb 6,000 [ft]?’, to which he responded ‘Negative, I’ll continue on to 8,500 [ft], happy to take 3 [nautical] miles right of track if that puts us out of conflict’. The pilot of SYT reported that he was puzzled by the question because at that stage his altimeter was indicating an altitude of 6,300-6,400 ft. The radar data at the time showed SYT at 6,000 ft, HPA at 6,500 ft and 0.086 NM (160 m) lateral separation between the aircraft, which were then about 20 NM south-west of Darwin Airport.

The pilot of SYT commented that as soon as he made that request to deviate three nautical miles right of track, HPA came from the left top corner of his windshield across the nose to the bottom right in front of him and filled the windscreen. He estimated the two aircraft passed 3‑4 m apart.

The pilot of HPA was looking out to his 3 o’clock position when the pilot of SYT was in the process of requesting the deviation right of track. SYT appeared in the pilot of HPA’s 5 o’clock position and he reported being surprised by its close proximity. He and the passengers in HPA estimated the aircraft came within 5 m of each other.

The controller then cleared SYT to deviate up to three nautical miles right of track and advised that ‘HPA by radar is on top of you 6,500 [ft]’.

Both pilots reported that by the time the approach controller cleared SYT to deviate right of track, the two aircraft had already passed each other and the separation between them was increasing. SYT was now to the left of HPA and the pilot of SYT had HPA in sight. The closest proximity according to the radar data was 100 ft vertically and 0.02 NM (37 m) laterally.

The approach controller reported that the CA activated again and SYT did not seem to be deviating to the right, just continuing to climb. The controller observed SYT passing 6,200 ft on the situation display and, as it was now less than 500 ft below HPA, they issued a safety alert. The approach supervisor reported also directing the controller to issue a safety alert at that time.

After the aircraft had already passed each other in close proximity, the pilot of SYT responded ‘Say again’. The approach controller then responded ‘Safety alert: HPA by radar is on top of you 6,500 [ft]. Deviate up to 3 [nautical] miles right of track and maintain 6,000 [ft] until clear’.^[6]

The approach controller recalled assessing that SYT might be required to descend to the cleared altitude of 6,000 ft at the time the instruction was issued. In response to that transmission, the pilot of SYT advised that HPA was now to the right of their track, so SYT would stay to the left.

The two aircraft continued to Port Keats without further incident.

VFR aircraft in Class C airspace

In Class C airspace, VFR aircraft are provided with traffic information on other VFR aircraft and are not separated by air traffic control (ATC). The approach supervisor commented that there was no responsibility for ATC to provide separation between those two aircraft. However, they were entitled to a traffic service and a safety alert if the controllers assessed there was a problem.

Civil Aviation Regulation (CAR) 163 stated that ‘The pilot in command of an aircraft must not fly the aircraft so close to another aircraft as to create a collision hazard.’ In addition, CAR 163A states that ‘the flight crew of an aircraft must… maintain vigilance so as to see, and avoid, other aircraft.’

The approach supervisor commented that they had an expectation that the pilots of the involved aircraft would have had an understanding of the relative performance of each other’s aircraft and that they would maintain visual contact and be able to keep clear of each other.

While pilots of VFR aircraft are responsible for avoiding other VFR aircraft, according to MATS 2.2.1.1, the objectives of Air Traffic Services include to ‘prevent collisions between aircraft.’ The approach supervisor commented that when pilots of VFR aircraft lose sight of each other, the requirements of the safety alert come into place.

Darwin VFR aircraft operations

A large number of VFR aircraft operate charter flights to and from Darwin Airport. The controllers reported that VFR aircraft often tracked in close proximity to each other, although when there were more than two aircraft departing on the same track, ATC usually provided instructions to segregate them. In addition, ATC often separated VFR aircraft from instrument flight rules aircraft by issuing the pilots of the VFR aircraft with tracking instructions.

The controller commented that when multiple aircraft depart together bound for the same location, they are usually from the same operator, but in this incident they were not. He also commented that this might have contributed to the slower aircraft departing ahead of the faster one. If the two aircraft were from the same operator, the pilots may have sequenced themselves so the faster aircraft would depart first. The pilot of SYT said in future, taxiing out, he would contact the ground controller and ask if they could depart ahead of the slower aircraft. In addition, in a similar situation, as soon as possible, he would put his aircraft on a track 5 NM right of the other aircraft.

The approach controller commented that the C206 and C210 were very similarly performing aircraft, and their speeds can vary depending on how many people and how much cargo and fuel is on board, so the type of aircraft is not always a good indication of relative performance.

In accordance with Darwin’s traffic management plan, all VFR traffic are cleared to depart via a published VFR route, except those going to the nearby islands. After departure most aircraft are cleared for direct tracking as soon as practicable. The VFR route 5 tracks 5 NM south of Darwin then south-west, and would have been within a couple of miles left of the direct track. The pilot of SYT had planned to track via VFR route 5 in accordance with their standard operating procedures.

The pilot of HPA was using an electronic flight bag^[7] and tracked direct to Port Keats once cleared. The pilot of SYT reported maintaining a constant heading direct to Port Keats after receiving clearance to track direct, and that he ‘was checking the heading continuously’ and the two aircraft were ‘paralleling until he lost sight of HPA’.

Conflict alert

In Class C airspace in Darwin, when aircraft operate within 3 NM horizontally and 1,000 ft vertically, a CA activates. In response, the controller usually announces to the other controllers and supervisor what separation standard is in place – whether it is ‘traffic’, or another standard such as ‘500 ft’ vertical separation. The approach supervisor commented that it was normal for Darwin for the conflict alert to activate between VFR aircraft.

ATSB investigation AO-2011-011 identified a safety issue at Williamtown (Newcastle Airport), New South Wales associated with conflict alerting. The conflict alerting function had been disabled following a risk analysis and advice from safety specialists, due to numerous, unavoidable spurious alarms at Williamtown. During a trial period in which the alerts were activated, a Department of Defence investigation found that the alert function did not assist controllers in the identification or resolution of traffic conflicts and that false alerts may have resulted in controller desensitisation.

Limitations of see‑and‑avoid

The limitations of see-and-avoid practices are well known and documented. Civil Aviation Advisory Publication (CAAP) 166-2(1) Pilots’ responsibility for collision avoidance in the vicinity of non‑controlled aerodromes using ‘see-and-avoid’^[8] discusses see-and-avoid in non-controlled airspace, but much of the content is relevant to pilots of all VFR aircraft including in controlled airspace.

Alerted see-and-avoid, where the pilot is directed where to look to sight another aircraft, is much more effective than un-alerted. However, there are still a number of factors that affect a pilot’s ability to sight another aircraft. In this incident, the pilot of SYT lost sight of HPA when it was above and diagonally to his left, as it was then obscured by SYT’s left wing. Additionally, when the pilot advised ATC that he had lost sight of HPA, the controller responded that HPA was half a mile to his left, and then advised the pilot of HPA that SYT was half a nautical mile to his right in his 3 o’clock position. A review of the radar data identified that the relative positions of the aircraft differed from that advised by the controller.

Radar altitude

An aircraft’s transponder operating in mode C transmits a signal that permits a secondary surveillance radar ground station to determine the distance and bearing to the aircraft as well as its altitude.

Aircraft altimeters and ATC situation display show barometric altitude below the transition altitude (10,000 ft in Australia). Aircraft mode C transponders sense and transmit static air pressure to ground‑based surveillance equipment. That equipment converts the value into the corresponding pressure altitude and, if below the transition altitude, applies an input from a ground‑based QNH to obtain the equivalent barometric altitude. The calculated altitude is displayed to controllers with a resolution of 100 ft.

MATS section 9.7.5.5 Display tolerance stated that ‘when the displayed pressure altitude-derived level information differs from the pilot-reported or known altitude by more than 200 ft: a) advise pilot; b) request check of pressure setting; and c) confirm current level.’

When the pilot of HPA reported passing 800 ft, the displayed altitude was 700 ft and therefore within tolerance. However, when the pilot of SYT first contacted the approach controller and reported passing 600 ft, the aircraft’s label on the situation display indicated 100 ft by the end of the pilot’s transmission, which was outside the 200 ft tolerance. The 500 ft discrepancy between SYT’s displayed radar altitude and actual aircraft altitude correlated with the recorded radar data from Airservices Australia while the aircraft was in cruise. There was no indication that the controller detected the discrepancy.

Because of this discrepancy, SYT was about 500 ft higher and therefore about 500 ft closer vertically to HPA than displayed. Allowing for this, the closest proximity between the aircraft around the time of the occurrence was within 100 ft, and this proximity occurred before the controller issued the safety alert. Given the radar is only displayed to the nearest 100 ft, this was consistent with the pilots of both aircraft reporting that the aircraft came within 3–5 m of each other at the same altitude and that they had passed before the safety alert was issued.

Safety analysis

Development of the occurrence

The pilots of the two aircraft were required to see and avoid each other. SYT was trailing, but faster than, HPA. That relative positioning reduced the opportunity for the pilot of HPA to identify the developing proximity event, as SYT was below HPA as the two aircraft converged. As SYT closed on HPA, the pilot of SYT lost visual contact as the wing structure visually obscured HPA. The pilot of SYT identified that his aircraft was about to overtake HPA, but did not manoeuvre to keep HPA in sight or request an alternative clearance. The pilot of SYT lost sight of HPA while the aircraft were about 500 m and 800 ft apart.

Although the pilot of SYT did not manoeuvre to maintain sight of HPA, he did advise ATC that he had lost visual contact with that aircraft. When requested, ATC will provide VFR flights in Class C airspace with a suggested course of action to avoid other VFR flights, but the pilot is still required to see and avoid other aircraft.

As neither pilot requested ATC to provide avoiding action, the controller did not issue alternative segregation instructions at that time and the two aircraft continued to converge. The controller did, however, provide traffic information to both pilots and offered alternative tracking.

The controller issued a safety alert and instructions when the vertical separation depicted on the situation display between the aircraft reduced to about 500 ft. However, due to a combination of radar accuracy/resolution and the altitude of SYT on the situation display not being within the required 200 ft tolerance, the aircraft were much closer than the indicated 500 ft. Consequently, the safety alert was issued after the near collision and so neither pilot had an appreciation of just how close the aircraft were until they re‑sighted each other as they passed in close proximity.

Had the controller verified the initial altitude of SYT on first contact, they would have identified the discrepancy between the reported and displayed altitudes. The controller would then have had an accurate indication of the vertical distance between the two aircraft.

See-and-avoid limitations

Obstruction by the aircraft’s wing is one of many factors identified by ATSB research that affect a pilot’s ability to sight another aircraft. This occurrence therefore highlights the difficulties of the see-and-avoid principle, even when the pilot is given information about (or alerted to) the other aircraft’s position. Airborne collision avoidance systems (ACAS) provide valuable information to alert pilots of other aircraft in their proximity and can direct the pilot to take avoiding action, thereby reducing the risk of collision.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The approach controller did not verify the initial altitude of VH-SYT, which was outside the allowable 200 ft tolerance. That resulted in the two aircraft being significantly vertically closer than displayed and, in turn, the controller issuing a safety alert after the near collision had occurred.
• After the pilot of VH-SYT lost sight of VH-HPA, he advised air traffic control and took no further action to ensure segregation between the aircraft.

Safety message

Pilots and air traffic controllers have a joint responsibility to avoid collisions between aircraft. In controlled airspace, air traffic controllers are not required to provide pilots of aircraft operating under the VFR with separation from other VFR aircraft. While air traffic controllers can provide traffic information to pilots of VFR flights, see-and-avoid is the primary means of preventing collisions between VFR aircraft.

The limitations of see-and-avoid techniques are well known and are detailed in the ATSB publication Limitations of the See-and-Avoid Principle. When pilots are alerted to the location of another aircraft, this significantly improves their ability to sight the other aircraft. However, as detailed in the publication, many factors can affect a pilot’s ability to sight another aircraft. The publication was written in 1991 and states that ‘Because of its many limitations, the see-and-avoid concept should not be expected to fulfil a significant role in future air traffic systems.’

Both VH-SYT and VH-HPA were equipped with mode C transponders, but neither aircraft was equipped with any airborne collision avoidance system (ACAS) technology, nor were they required to be by regulation. Such a system provides information to increase a pilot’s awareness of nearby aircraft and therefore reduces the risk of a mid-air collision.

Recent advancement of ACAS technologies has made them viable for general aviation aircraft and they should be considered. The ATSB report (AO-2016-015) into a near collision involving a Saab 340 aircraft and a glider in 2016 outlined a proposal by the industry body, Australian Strategic Air Traffic Management Group, to the Civil Aviation Safety Authority (CASA). It recommended the adoption of standards for ADS‑B technology to be fitted in general aviation aircraft to enable awareness of other aircraft traffic and thereby reduce the risk of mid-air collisions.

Following industry consultation, CASA is proposing to relax the equipment and installation standards for ADS-B fitment in VFR aircraft. The aim is to make it cheaper and easier for aircraft operating under VFR to purchase and use the technology.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
2. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
3. The Australian Defence Force provides the air traffic control services associated with Darwin Airport.
4. O’clock: the clock code is used to denote the direction of an aircraft or surface feature relative to the current heading of the observer’s aircraft, expressed in terms of position on an analogue clock face. Twelve o’clock is ahead while an aircraft observed abeam to the left would be said to be at 9 o’clock.
5. The CA activated when aircraft were within about 1,000 ft and 3 NM of each other.
6. ATC will issue a Safety Alert to aircraft, in all classes of airspace, when they become aware that an aircraft is in a situation that is considered to place it in unsafe proximity to: terrain; obstruction; active restricted or prohibited area; or other aircraft.
7. Electronic flight bags can electronically store and retrieve documents required for flight operations, such as maps, charts, the Flight Crew Operations Manual, Minimum Equipment Lists and other control documents. See CASA CAAP 233-1.
8. Available from CASA’s website: www.casa.gov.au

What happened

On the morning of 1 December 2017, an M-18A Dromader aircraft (Pratt & Whitney PT6A engine), registered VH-WHR (WHR) prepared for an aerial agricultural spraying operation at a private airstrip, 9 km north of Emerald Airport, Queensland. The aircraft was operated by Central Highlands Aerial Services and was conducting a spray operation on an 81-hectare paddock (Figure 1, shown in green), about 6 km west‑south‑west of the airstrip.

Figure 1: Application area (green), accident site (blue) and track flown (yellow)

Source: Google earth, annotated by the ATSB

The pilot conducted a pre-flight inspection of WHR and found everything to be serviceable. He was also the last person to fly the aircraft, three days prior to the accident, and had not identified any problems.

The wind was reported to be 4‑6 kt from the northeast. The spraying operation was standard with no major hazards in or around the paddock ‑ the pilot had sprayed the paddock several times in the past conducting the same spray pattern flying east and west.

At about 0604 Eastern Standard Time,^[1] the aircraft arrived at the paddock and the pilot conducted several short spray runs in the south-western corner to ensure there was no overspray onto an adjoining paddock. He then conducted several back-to-back spray runs in the same corner (Figure 1) and at about 0614, he commenced a racetrack pattern over the remainder of the paddock.

At about 0620, a witness located about 1 km from the paddock observed the aircraft complete the ninth racetrack pattern run and commence a turn to the right to line up for the next run. The witness estimated that about three quarters of the way through the turn, while lining up for the next run, the aircraft rapidly pitched down and the right wing collided with the ground. The aircraft subsequently flipped, and came to rest inverted and facing in the opposite direction to the flight path about 20‑30 m from the initial contact point (Figure 2).

Figure 2: Accident site

Source: Police

At about 0622, the witness called emergency services and proceeded to the accident site. When the witness arrived at the wreckage, he found the pilot had exited the aircraft through the broken cockpit side window.

Ambulance officers treated the pilot before transporting him to hospital. He was admitted to treat his injuries, which included a fractured left leg, three fractured left ribs, bruises, cuts to his left side, and concussion. The pilot was wearing a helmet at the time of the accident and it was damaged from impact with the aircraft structure (Figure 3). The pilot had no recollection of the accident and no mechanical issue was identified that may have contributed to the accident.

Figure 3: Damage to the left side of the pilot’s flight helmet

Source: Police

While the track of the aircraft during the spray operation was recorded, other parameters such as airspeed, time, altitude, and aircraft attitude were not. Figure 4 shows the final four racetrack pattern turns back towards the west. The last inbound turn (shown in blue) was conducted at a smaller turn radius than the previous three turns in that direction. The track data finished about 460 m from the accident site.

Figure 4: Final four right turns from an easterly track (last shown in blue)

Source: Google earth, annotated by the ATSB

The pilot joined the operator in January 2015, gaining about 800-flight hours in WHR (with the installed PT6A engine) and flew the previous flight in WHR three days prior to the accident. He did not report any concerns with the aircraft.

The maintenance release for WHR was issued about 40 flight hours prior to the accident and no outstanding maintenance or defects were recorded.

Safety analysis

About three quarters of the way through a turn, as the aircraft was lined up for the next racetrack pattern spray run, the aircraft was observed to rapidly pitch down and collide with the ground. Analysis of the limited available recorded data showed that the final turn was flown at a tighter radius than the previous racetrack pattern turns. In combination, this could indicate that the accident was the result of an aerodynamic stall. However, there was insufficient information to determine if that occurred.

The pilot was unable to remember the final turn and could not provide a reason for the track variation or why the aircraft pitched down. No mechanical defects were noted with the aircraft, on the maintenance release, during the previous flight, or up to the section of the accident flight the pilot could remember. A post‑accident inspection of the aircraft by the operator did not identify any defects. From the limited available information, it was not possible to determine the reason for the accident.

The pilot was wearing his own personal flight helmet at the time of the accident. During the accident, the left side of the helmet struck the internals of the cockpit. Based on the degree of damage to the helmet, it probably prevented the pilot receiving more serious head injuries.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During a turn, and for reasons that could not be determined, VH-WHR pitched down and collided with the ground.
• The helmet worn by the pilot probably prevented more serious head injury.

Safety message

The International Civil Aviation Organization circular 85-AN/71 Safety in aerial work Part 1. Agricultural Operations discusses the importance of reducing serious head injuries by wearing a correctly fitting flight helmet. Pilots operating aircraft in agricultural operations are particularly vulnerable to accidents involving major or fatal head injury. The circular also discusses the need to select a helmet which provides effective protection and that is part of the pilot’s personal flying equipment as was the case in this accident.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 Hours.

Safety summary

What happened

On 24 November 2017, an Airbus A320 aircraft, registered PK-AZE and operated by PT Indonesia AirAsia, departed Perth, Western Australia on a scheduled passenger flight to Denpasar, Indonesia. Shortly after take-off from runway 21, the aircraft turned left, contrary to the cleared standard instrument departure, and at a height of about 223 ft above ground level, which was below the minimum height for turns specified by the operator. Air traffic control (ATC) assigned a series of headings to the flight crew. The aircraft was also turned through one of the headings assigned by ATC. An additional heading was subsequently issued by ATC to return the aircraft back to its planned track. The flight continued to Denpasar without further incident.

What the ATSB found

The ATSB found that during pre-flight preparations, the first officer (FO) as the pilot flying programmed the flight management guidance system (FMGS) using runway 03 based on the assumption that their departure runway would be the same as the runway on which they had previously landed. That programming occurred prior to the FO obtaining the automatic terminal information service (ATIS) information, which stated that runway 21 was in‑use. In addition, the captain did not separately listen to the ATIS as required by the operator’s procedures and likely relied on the briefing conducted by the FO.

Despite the various cues available to the flight crew, including several ATC instructions for using runway 21 and airport signage, and the flight crew reporting feelings of unease about the flight preparations, the incorrect programming of the FMGS was not detected. Shortly after take-off, the aircraft’s flight director indicated a left turn was required. The FO commenced a left turn and engaged the autopilot, which continued the left turn to navigate towards the first programmed waypoint (in-line with the opposite runway direction and behind the aircraft). However, ATC quickly noticed the diversion from their cleared track and corrected the crew’s heading.

Once the crew had detected the error, the captain reprogrammed the correct flight plan in the FMGS, rather than selecting the heading assigned by ATC. This resulted in the aircraft turning through the assigned heading, requiring further instructions by ATC.

It was also established that ATC were unaware of the nature of the problem and were not utilised fully as an additional resource to assist the flight crew.

What's been done as a result

Following the incident, Indonesia AirAsia have included a similar ‘change of departure runway’ scenario in their line operations flight training. Further, they have plans to launch a cross-departmental initiative to increase the awareness and skill sets of pilots, especially in the area of threat and error management.

Safety message

This incident demonstrates that deviating from standard procedures, even slightly, can render them ineffective and result in errors. Data input errors continue to be one of ATSB’s SafetyWatch priorities.

It further highlights the significance of stopping and re-evaluating the situation while on the ground when there is a feeling of uncertainty about the flight, even if it results in undesirable delays. This provides an opportunity to detect errors before they affect operations. Once airborne, workload and time limitations become even more critical due to the rapidly changing situation.

The occurrence

Pre-flight preparation

On 24 November 2017, at about 1145 Western Standard Time,^[1] an Airbus A320 aircraft, registered PK-AZE and operated by PT Indonesia AirAsia, was being prepared for a flight from Perth Airport, Western Australia to Denpasar (Bali) Airport, Indonesia. The captain was the pilot monitoring (PM) and the first officer (FO) was the pilot flying (PF).^[2] The captain conducted the exterior inspection of the aircraft while the FO entered the flight plan into the flight management guidance system (FMGS) as per the required cockpit preparation procedure.

The crew had operated the aircraft into Perth on the previous sector, and the aircraft had arrived 46 minutes after the scheduled arrival time. The previous flight had landed on runway 03. Believing that they would be using the same runway for take-off, as he had done on previous occasions, the FO entered runway 03 into the FMGS.

The FO then listened to the automatic terminal information service (ATIS),^[3] which stated the runway‑in‑use for departure was runway 21, and wrote ‘runway 21’ on the paper flight plan. He then calculated and entered the aircraft’s take-off speeds based on runway 03 into the FMGS. The FO reported he would normally listen to the ATIS first, then input data into the FMGS, but to make it easier on this occasion he programmed the FMGS first and then listened to the ATIS.

When the captain returned to the flight deck after conducting the exterior inspection, he asked the FO which runway would be used for take-off. The FO stated that it was runway 03. The captain reported that he did not listen to the ATIS. However, he cross-checked the information entered in the FMGS, which included comparing the flight plan with the anticipated standard instrument departure (SID)^[4] chart.

The FO then conducted the take-off briefing. He later recalled stating that the departure would be from runway 03. The captain also recalled that the FO’s take-off briefing stated that they would be departing from runway 03.

At 1201, the flight crew received their airways clearance from air traffic control (ATC) to depart for Denpasar using the AVNEX TWO SID and to climb to 5,000 ft as per the SID. The AVNEX TWO SID was available for both runway 03 and runway 21, with different initial waypoints before converging (refer to section titled Perth departure procedures).

The FO reported he ‘felt that there might be something wrong’ with the FMGS programming and advised the captain, but they both continued with the preparation.

Taxi to runway 21

At 1213, the flight crew received a taxi clearance from ATC and commenced taxiing (Figure 1). The clearance included a series of instructions to taxi to the holding point for runway 21 on taxiway ‘Whiskey’. The flight crew read back this clearance correctly.

Figure 1: Taxi and take-off path (in red) of PK-AZE

Source: Airservices Australia (modified by the ATSB)

At 1218, the Perth tower controller provided instructions to hold short of runway 21. Shortly after, he cleared the flight crew to line up on runway 21. The flight crew read back both instructions correctly. Prior to reaching the holding point for runway 21, the flight crew received an electronic centralised aircraft monitor (ECAM)^[5] message BRAKE SYS 1 FAULT.^[6] The captain reported that he actioned the message using the appropriate checklist. After actioning the message, the captain reported feeling there was something wrong, but was unsure of the issue.

At 1220, the controller cleared the aircraft for take-off on runway 21, which the flight crew read back correctly. At that time, the flight crew noticed the runway mode^[7] had not activated on the flight mode annunciator.^[8] They did not think it was unusual as sometimes the mode did not activate, particularly if the instrument landing system^[9] was unavailable.

Take-off from runway 21

After becoming airborne during take-off, both pilots’ navigation displays showed the next waypoint^[10] was MIDLA (Figure 2). Both flight crew noticed the flight director^[11] on their primary flight display was commanding a left turn. Shortly after, following the flight director, the FO turned the aircraft left and then engaged the autopilot. Recorded flight data showed the aircraft was manually turned at 223 ft above ground level (AGL) (refer to section titled Minimum height of turns).

Figure 2: Flight path of PK-AZE from runway 21

Source: Google Earth, modified by the ATSB

About 20 seconds later, the tower controller instructed the flight crew to turn right onto a heading of 200°. The captain read back the instruction correctly, selected the assigned heading on the flight control unit and engaged heading mode. The autopilot began to bank the aircraft to the right. As this happened, the controller asked the flight crew to confirm the instruction of heading 200°, which the flight crew read back incorrectly as 300°. The tower controller consulted another controller about the aircraft’s track, the issued instruction, and whether to cancel the aircraft’s assigned SID.

About this time, the captain took over PF duties from the FO. The flight crew were instructed to maintain the assigned heading of 200° and contact the departures controller. After the flight crew contacted the departures controller, they were cleared to climb to flight level (FL)^[12] 180 and instructed to turn right onto a heading of 270°, which the flight crew acknowledged and selected. Shortly after, the captain gave the PF duties back to the FO and soon began reprogramming waypoints in the FMGS. The FO recalled being unaware the captain was reprograming the FMGS.

At 1225, the controller instructed the flight crew to maintain heading 290°. At this time, the captain selected waypoint SWANN in the FMGS. Flight data showed that the autopilot lateral mode changed from heading mode to navigation mode at that time, which resulted in the aircraft diverging from the instructed heading. The controller repeated the instruction to turn to heading 290°. The flight crew selected 290° on the flight control unit and re-selected heading mode, and the autopilot turned the aircraft to that heading (Figure 2).

The departures controller asked the flight crew whether they were issued ‘the AVNEX SID’, which the flight crew confirmed. The controller then asked whether operations were normal, which the flight crew also confirmed. The flight continued to Denpasar without further incident.

__________

1. Western Standard Time: Coordinated Universal Time (UTC) + 8 hours.
2. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. Automatic terminal information service (ATIS): The provision of current, routine information to arriving and departing aircraft by means of continuous and repetitive broadcasts during the hours when the unit responsible for the service is in operation.
4. Standard instrument departure: A designated instrument flight rules departure route linking the aerodrome or a specified runway of the aerodrome with a specified point, normally on a designated air traffic services route, at which the en route phase of a flight commences.
5. The electronic centralised aircraft monitor (ECAM) monitors aircraft systems, displays aircraft system information, and specifies flight crew actions to be taken in the event of abnormal or emergency situations.
6. BRAKE SYS 1 FAULT: an alert indicating a fault detected in one channel of the brake system control unit.
7. Runway mode: provides lateral guidance orders during take-off roll and initial climb out (up to 30 ft radio altitude) if a localiser signal is available.
8. Flight management annunciator: a display located at the top of each pilot’s primary flight display and informs the crew of the active and armed auto flight and auto-thrust modes.
9. Instrument landing system: standard ground aid to landing comprising two radio guidance beams and two markers for linear guidance. The system was operational on the day of the incident.
10. Waypoint: predetermined and accurately known geographical position forming start or end of a route segment.
11. Flight director: a guidance aid that is overlaid on the attitude indicator and shows the attitude required to follow a certain trajectory. It computes and displays the pitch and bank angles required in order for the aircraft to follow a selected path.
12. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 180 equates to 18,000 ft.

Context

Personnel information

Captain

The captain held an Air Transport Pilot (Aeroplane) Licence, multi-engine command instrument rating, and a valid Class 1 Aviation Medical Certificate. He had a total of 13,487 hours of aeronautical experience, of which 3,974 hours were on the Airbus A320. The captain had been assessed as meeting the requirement of the International Civil Aviation Organization English proficiency at a level 5 standard.^[13]

The captain’s last instrument rating line check was on 18 November 2017 and the last line check was completed on 29 August 2017. Although the line check was passed with an overall marginal score of two out of five, the results indicated mostly satisfactory (required standard) scores of three. Deficiencies noted in the check were in knowledge and application of standard operating procedures and operations manual, and threat and error management as both PF and PM. Previous simulator training and check sessions identified similar issues.

First officer

The first officer (FO) held a Commercial Pilot (Aeroplane) Licence, a multi-engine instrument rating, and a valid Class 1 Aviation Medical Certificate. He had a total of 955 hours of aeronautical experience, of which 766 hours were on the Airbus A320. The FO had been assessed as meeting the requirement of the International Civil Aviation Organization English proficiency at a level 4 standard.

The FO’s last instrument rating line check was on 15 August 2017 and the last line check was completed on 30 June 2017. The line check was passed with all items scored as three out of five, which indicated a satisfactory result and the required standard was met. Previous simulator training and check sessions included comments about reading and understanding paper checklist procedures.

Fatigue considerations

A review of the flight crew’s rosters and sleep obtained found there was a low likelihood they were experiencing a level of fatigue known to have a demonstrated effect on performance.

Meteorological information

The Perth automatic terminal information service (ATIS) details relevant at the time of the aircraft’s departure indicated that the wind direction and strength was variable,^[14] with a maximum tailwind of 3 kt on runway 21. The temperature was 32 °C, with CAVOK^[15] conditions.

Perth Airport information

Perth Airport, with an elevation of 67 ft, is located about 10 km to the east of the city. A further 10 km to the east is the ‘Darling Scarp’ (Darling Range), an escarpment extending 345 km north-south from about Bindoon to Pemberton.

Perth Airport has two runways, 03/21 and 06/24. The movement areas, including the taxiways and runways, were marked with guidance signs, designed to assist pilots and other users with navigating the airport. These included signs that identified the holding point position with the runway designation.

Perth departure procedures

A standard instrument departure (SID) is a designated instrument flight rules departure route linking either an aerodrome or a specified runway with a specified point, normally on a designated air traffic services route, at which the en route phase of a flight commences.

At Perth, the ‘AVNEX TWO’ SID was used for both runways and in all directions (Figure 3). When departing from runway 03 using this departure, after take-off the crew were to maintain a heading of 016° (magnetic) for 4 NM (about 7 km) and conduct a left turn at waypoint MIDLA. For runway 21, the crew were to maintain a heading of 196° for 4 NM (about 7 km) and turn right at waypoint NAVEY at or above 2,500 ft above mean sea level.

Figure 3: AVNEX TWO AirAsia SID chart

Source: Aerostratus, modified by the ATSB

Operational information

Procedures and checklists

Cockpit checklists are an essential tool for overcoming limitations of pilot memory, and ensuring that action items are completed in sequence and without omission. According to Degani & Wiener (1993):

The major function of the flight deck checklist is to ensure that the crew will properly configure the airplane for any given segment of flight. It forms the basis of procedural standardization in the cockpit.

From the pre-flight preparations to the take-off, the crew completed a number of procedures and checklists where there were multiple opportunities to detect a data entry error. The relevant extracts from these checklists and procedures from the Indonesia AirAsia Flight Crew Operating Manual are below. The captain and FO were assigned specific tasks applicable to all flights.

Preliminary cockpit preparation procedure

The Preliminary Cockpit Preparation procedure specified that both flight crew were to separately obtain and calculate the aircraft’s take-off performance data. In this case, the pilot monitoring (PM) was required to cross‑check the pilot flying’s (PF’s) calculations. Specifically, the procedure stated that:

Each flight crewmember independently computes the preliminary performance data in accordance with the technical condition of the aircraft/or other criteria that may impact the aircraft performance (e.g. NOTAM [notice to airmen], runway condition, aircraft configuration).

AIRFIELD DATA.................................................................................................... OBTAIN

Obtain data needed for initializing the system, preparing the cockpit and for preliminary take-off performance computation. The airfield data should include: RUNWAY IN USE, ALTIMETER SETTING, and WEATHER DATA.

PRELIMINARY TAKEOFF PERFORMANCE……………COMPUTE AND CROSSCHECK

Cockpit preparation procedure

As detailed below in the Cockpit Preparation procedure, the PM was required to check the flight plan (‘F-PLN’) entered by the PF into the flight management guidance system (FMGS) with the relevant navigation chart and ‘paper’ flight plan. The PM was also required to check the data, including the airfield information entered into the FMGS by the PF. The take-off briefing was then conducted by the PF. During that briefing, both flight crew were required to cross-check the parameters referred to by the PF to ensure that they had been set or programmed correctly.

F-PLN A page..............................................................................COMPLETE AND CHECK

The flight crew must check, modify, or insert (as applicable) the F-PLN in the following order, according to the data given by ATIS, ATC, or MET.

F-PLN.........................................................................................................................CHECK

Check the F-PLN using F-PLN page and ND PLAN mode versus the computer (paper) flight plan or navigation chart.

FMS PREPARATION…………………………………………………………………….CHECK

After the PF prepared the FMS [FMGS], the PM checks:

The airfield data

All FMS entered data

The takeoff performance data with the data computed on his EFB [electronic flight bag]

TAKEOFF BRIEFING……………………………………………………......………PERFORM

Before pushback or start procedure

In the Before Pushback or Start procedure, the flight crew were required to confirm the final take‑off data as follows:

FINAL TAKEOFF DATA........................................................... CONFIRM or RECOMPUTE

If take-off conditions did not change, verify and confirm that the preliminary take-off data are still valid.

FMS F-PLN page......................................................................................................SELECT

It is recommended to display the F-PLN page on the PM side.

Taxi procedure

For the Taxi procedure, the PM was to obtain the taxi clearance for the assigned runway, and both flight crew confirm any changes to the take-off briefing.

TAXI clearance......................................................................................................... OBTAIN

ATC clearance...................................................................................................... CONFIRM

TAKEOFF BRIEFING............................................................................................CONFIRM

Before take-off procedure

The Before Take-Off procedure required the PM to obtain the take-off clearance from ATC and both flight crew confirm to the runway for departure using the available cues, such as those listed below.

TAKEOFF OR LINE UP CLEARANCE………………………………………………..OBTAIN

TAKEOFF RUNWAY…………………………………………………………….……CONFIRM

Confirm the line up is performed on the intended runway. Useful aids are:

The runway markings

The runway lights

Take-off procedure

In the Take-off procedure below, the PM was to monitor the navigation display (ND) and confirm the aircraft was lined-up on the runway centreline.

PFD/ND…………………………………………………………………….....………MONITOR

If an ILS [instrument landing system] that corresponds to the departure runway is tuned, RWY mode appears. If not, no lateral mode appears until the aircraft lifts off.

Check the FMS position on the ND (aircraft on runway centerline).

Minimum height of turns

Although flight crews were to follow the designated SID procedure after take-off, the Indonesia AirAsia Flight Crew Operating Manual specifically stated:

Procedures to be followed after take-off, during the approach and go around are as per SID (including Radar departure) and STAR. No turns shall be commenced below 400ft AGL [original emphasis].

Operational philosophy

Flight crew guidance

The Indonesia AirAsia Flight Crew Training Manual and standard operating procedures provided guidance to flight crew for both normal and abnormal situations. There was no specific procedure listed on managing data entry errors detected in-flight, but general Airbus principles were included in the manuals.

Golden rules for pilots

The Flight Crew Training Manual states the pilots’ responsibility is to ‘fly, navigate, communicate’ in that order, along with additional considerations. The flight crew must perform these three actions in sequence and must use appropriate task sharing in normal and abnormal operations, in manual flight or in flight with the autopilot engaged.

‘Fly’ indicates that the PF must concentrate on ‘flying the aircraft’ in order to achieve and maintain flight parameters such as pitch attitude, bank angle, airspeed, and heading. The PM must assist the PF and must actively monitor flight parameters, and call out any excessive deviation using standard phraseology. The PM's role of ‘actively monitoring’ is very important. Therefore, both flight crew must focus and concentrate on their tasks to ensure appropriate task sharing and maintain awareness of the situation and immediately resolve any uncertainty as a crew.

‘Navigate’ refers to and includes the following ‘know where ...’ statements, in order to ensure awareness of the situation, including know where you are, know where you should be, and know where you should go.

‘Communicate’ involves effective and appropriate crew communication between the PF and the PM, and between flight crew and ATC. In abnormal and emergency situations, the PF must recover a steady flight path, and the flight crew must identify the flight’s status. The PF must then inform ATC and the cabin crew of the flight’s status and the flight crew’s intentions.

Communication also applies to communicating adjustments or changes to the information and/or equipment on the flight deck, such as FMGS alterations or flight path modifications. The other flight crew must be informed and an acknowledgement obtained.

The Flight Crew Training Manual also stated to take action if things do not go as expected. If the aircraft does not follow the desired vertical or lateral flight path, or the selected targets, and if the flight crew does not have sufficient time to analyse and solve the situation, the flight crew must immediately take appropriate or required actions, as follows:

the PF should change the level of automation from managed guidance^[16] to selected guidance,^[17] or from selected guidance to manual flying.

the PM should perform the following actions in sequence: communicate with the PF; challenge the actions of the PF, when necessary; and take over, when necessary.

Similar occurrences

A search of the ATSB’s database found similar occurrences involving incorrect data entry into the aircraft’s systems and navigation errors:

ATSB investigation AO-2015-029

On 10 March 2015, an Airbus A330 aircraft operated by AirAsia X was conducting a regular passenger service from Sydney, New South Wales. On departure from runway 16R (right) the aircraft was observed by ATC to enter the departure flight path of the parallel runway, 16L (left). Following advice from ATC, the flight crew identified a problem with the on-board navigation systems. Attempts to troubleshoot and rectify the problem resulted in further degradation of the navigation system, as well as to the aircraft’s flight guidance and flight control systems. The crew elected to discontinue the flight but were unable to return to Sydney as the weather had deteriorated in the area and the available systems limited the flight to approaches in visual conditions. The aircraft was instead radar vectored to Melbourne, Victoria and the flight completed in visual conditions.

The ATSB found that when setting up the aircraft’s FMGS, the captain inadvertently entered the wrong longitudinal position of the aircraft. This adversely affected the onboard navigation systems. However, despite a number of opportunities to identify and correct the error, it was not noticed until after the aircraft became airborne and started tracking in the wrong direction. The flight crew attempted to troubleshoot and rectify the situation while under a heavy workload. Combined with limited guidance from the available checklists, this resulted in further errors by the flight crew in the diagnosis and actioning of flight deck switches. Finally, the ATSB identified that effective monitoring and assistance by ATC reduced the risk to the occurrence aircraft and other aircraft in the area.

ATSB occurrence 201806598

On 26 September 2018, a foreign-operated Boeing 737-800 was conducting a regular passenger service from Melbourne, Victoria. During initial climb, the aircraft did not adhere to the assigned runway 34 KEPPA 1 SID and conducted an early left turn. ATC queried the crew about which waypoint they were tracking to. The crew responded they were tracking to ATNOL, which was the first waypoint on the KEPPA SID 1 from runway 27. It was subsequently determined the crew had entered the incorrect departure runway of runway 27 into the flight management computer.

__________

13. The International Civil Aviation Organization has defined six levels of language proficiency, the top three levels (4, 5 and 6) are acceptable for operational flight crew. Level 4 (operational) requires retesting every 3 years, level 5 (extended) requires retesting every 6 years and level 6 (expert) does not require further testing.
14. The term ‘variable’ is used when the reporting of a mean wind direction is not possible such as, in light wind conditions (3 kt or less) or if the wind is veering or backing by 180° or more.
15. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather.
16. Managed mode: To fly along the pre-planned flight plan, entered in the flight management guidance system.
17. Selected mode: For specific ATC requests, or when there is not sufficient time to modify the flight plan.

Safety analysis

Introduction

Very shortly after take-off from runway 21 at Perth, Western Australia, the aircraft was turned at a low height in the opposite direction to their clearance and towards an escarpment. Air traffic control (ATC) assigned a series of headings to the flight crew to correct their path. During that time, the aircraft also turned through one of the assigned headings. An additional heading was issued by ATC to return the aircraft back to its planned track. The flight continued without further incident.

Although there were time delays for the flight crew’s sectors that day, there was insufficient evidence to indicate that this contributed to the development of the incident.

This analysis will examine why the incorrect runway was programmed into the flight management guidance system (FMGS) and why this error was not detected by the flight crew. It will also discuss the flight crew’s pre-flight preparations with regard to obtaining the automatic terminal information service (ATIS) and explore their actions in response to the early turn.

Incorrect runway-in-use

Based on their recent landing on runway 03, the first officer (FO), who was the pilot flying had the expectation that the take-off runway would remain the same, as experienced on previous occasions. Consequently, he entered runway 03 into the FMGS in preparation for the departure. This was done prior to listening to the ATIS and obtaining the airfield data, which indicated that runway 21 was in-use. This was performed out-of-sequence, where the operator’s procedure required the airfield data to be obtained before programming the FMGS. While the FO commented in his interview that he would normally follow the procedure, on this occasion, he elected to program the FMGS first to make it ‘easier’.

Although the FO correctly noted the ATIS details for runway 21 on his paper flight plan, he did not detect that it was different to what he had programmed. In this case, the FO may not have detected the runway he used for programming was different due to not having an expectation it would have been incorrect. Expectations can influence perception, as people often hear what they expect to hear and see what they expect to see (Hawkins 1987). Research has also found that the pilots checking their own work are less likely to detect their own error than cross-checking by other crew members (Thomas, Petrilli, and Dawson 2004).

Independently cross-checking the runway-in-use

The captain did not separately obtain the ATIS as required by the operator’s procedures and likely relied upon the FO’s briefing that runway 03 was the runway-in-use. Further, he subsequently either did not check or detect that runway 21 was written on the flight planning documents nor that it was inconsistent with the information programmed into the FMGS.

Cross-checking is a fundamental element in all multi-crew operations and is a vital mechanism for detecting errors. An exploratory study of error detection processes during normal line operations conducted by Thomas and others (2004) identified that cross-checking and monitoring of other crew actions was the most frequently observed error detection process. By not obtaining the ATIS independently and cross-checking the runway-in-use, this removed an opportunity for the captain to identify the programming error prior to take-off.

Non-detection of error

Research conducted during normal line operations has found over half of errors made by flight crew remain undetected (Thomas, Petrilli, and Dawson 2004). In this case, the error in the pre‑flight programming remained undetected until after take-off. However, aside from cross‑checking procedures, there were multiple opportunities available to the flight crew that would have provided them with the opportunity to identify the incorrectly entered runway. These were:

• Prior to, and during taxiing, the flight crew received taxi instructions and several clearances from ATC referencing runway 21, which were all read back correctly.
• The flight crew reported that, during take-off, they both noticed that the runway mode had not activated. However, they explained that the mode might also not activate if the instrument landing system was not available, rather than considering this as a programming error.
• While taxiing to the runway, there were guidance signs identifying the runway designation.

Of note, the flight crew received an electronic centralised aircraft monitor (ECAM) message around the same time ATC issued a hold‑short instruction for runway 21. This message directed the flight crew’s attention to responding to the ECAM message at a time potential cues to the error were available, such as the instruction and airport signage. Further, although the flight crew reported at two separate times, they felt there was something wrong with the preparation, they decided to continue with the flight. Even when cues to an error are provided there is a likelihood they can be dismissed or explained away if the information is not consistent with a person’s expectations (Hawkins 1987).

Turn contrary to clearance and published procedure

The FMGS was programmed for the runway 03 AVNEX TWO departure, which required a left turn after take-off at waypoint MIDLA. Therefore, after take-off from runway 21, the flight director indicated a left turn was required to capture the flight path to waypoint MIDLA to the north. The recorded flight data showed that the aircraft was turned left when at 223 ft above ground level. This was contrary to the runway 21 departure, which required a right turn at waypoint NAVEY to the south not below 2,500 ft. This was also below the operator’s stipulated minimum turn height of 400 ft.

The left turn continued momentarily after the autopilot was engaged but was quickly corrected when ATC assigned a heading instruction for the flight crew to regain the cleared flight path. During the left turn, the flight crew had not realised the autopilot was flying a different path to what was actually cleared. A left turn was consistent with the crew’s expectations based on their pre-flight briefing for runway 03, although the low height of the directed turn should have been unusual and not consistent with the briefing. Following the flight director at this stage suggests the crew were relying on automation at the expense of their own monitoring, possibly due to an over-reliance on automation (Parasuraman and Riley 1997).

Managing an unexpected situation after take-off

The flight crew were in an abnormal situation when they identified the programming error in the FMGS. Air traffic control provided the flight crew with a number of heading instructions to regain the cleared flight path and also asked if operations were normal, which they confirmed was the case. As highlighted by Tullo (2010), ATC can potentially assist with problem-resolution in abnormal situations. In this case, ATC were unaware of the nature of the problem and the flight crew did not utilise them fully as an additional resource. By making ATC aware of the abnormal situation, it could have potentially reduced the flight crew’s workload in deciding subsequent action to evaluate and solve the problem. This may have reduced the need for the flight crew to reprogram the FMGS at a time when their workload would have already been high, as they were required to complete other checklists.

Although the flight crew correctly identified the problem, the captain’s chosen solution of reprogramming the FMGS increased workload during an already high workload situation. Such circumstances reduces the ability to monitor the flight path (Dismukes and others 1998).

With reference to the operator’s ‘fly’ then ‘navigate’ golden rule for pilots, the role of the captain as pilot monitoring was to focus on the flight parameters including heading and communicate any deviations to the pilot flying. In this case, while ATC had provided the necessary navigation information (heading), the captain attempted to achieve this objective by manipulating the aircraft’s FMGS rather than selecting or flying to the given heading, at the expense of monitoring the flight parameters. During that time, the aircraft also turned through one of the assigned headings and an additional heading instruction was needed to be issued by ATC to return the aircraft back to its planned track.

Findings

From the evidence available, the following findings are made with respect to the data entry error related operational non-compliance of an Airbus A320, registered PK-AZE that occurred at Perth Airport, Western Australia, on 24 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• Based on a recent landing, the first officer assumed runway 03 would be in use and programmed this runway for take-off into the flight management guidance system (FMGS) before listening to the automatic terminal information service (ATIS). Although the first officer copied runway 21 from the data recorded onto the flight plan, he did not notice this differed from what he had programmed into the FMGS and briefed the captain for a runway 03 take-off.
• The captain did not obtain any independent information about the runway‑in‑use for pre‑departure checks, including listening to the ATIS and reviewing data recorded on the flight plan, and likely relied on verbal information from the first officer.
• The incorrect programming of the FMGS was not detected before take-off despite numerous cues that the departure runway and flight path was different to what was briefed. Although the flight crew sensed there was something amiss with their pre-flight preparation, they continued without further checking.
• Shortly after take-off from runway 21, the aircraft was turned left at 223 ft above ground level. This was below the minimum allowable height of 400 ft stipulated by the operator, and well before and in the opposite direction to the cleared standard instrument departure.

Other factors that increased risk

• The flight crew did not communicate the nature of the problem to air traffic control and so did not effectively utilise air traffic control as an available resource. This resulted in the captain unnecessarily reprogramming the FMGS at a time when workload was already high.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action taken by Indonesia AirAsia in response to this occurrence.

Line operations flight training, and threat and error management

Following the incident, Indonesia AirAsia have included a similar change of departure runway scenario in their line operations flight training. Further, they have plans to launch a cross-departmental initiative to increase the awareness and skill sets of pilots, especially in the area of threat and error management.

Additional general details

Captain

First officer

Sources and submissions

Sources of information

The sources of information during the investigation included:

• flight crew
• Indonesia AirAsia
• Airservices Australia.

References

Degani, A and Wiener EL 1993, Cockpit checklists: Concepts, design, and use, Human Factors, 35(2), 28-43.

Dismukes RK, Young GE, Sumwalt III RL, and Null CH 1998, Cockpit interruptions and distractions: Effective management requires a careful balancing act. ASRS Directline, issue 10, pp. 4-9.

Hawkins, FH 1987, Human factors in flight. Aldershot: Ashgate.

Orasanu, J 2010, Ch. 5. Flight crew decision-making. In Kani, B, Helmreich, R, Anca, J. Crew resource management (2nd ed). San Diego: Academic Press.

Parasuraman, R and Riley, V 1997, Humans and automation: Use, misuse, disuse, abuse. Human factors, 39(2), 230-253.Thomas, MJW, Petrilli, RM, and Dawson, D 2004, An exploratory study of error detection processes during normal line operations. Proceedings of the 26th Conference of the European Association for Aviation Psychology.

Thomas MJ, Petrilli RM, and Dawson D 2004, An exploratory study of error detection processes during normal line operations (Doctoral dissertation, European Association for aviation psychology).

Tullo FJ 2010, Teamwork and Organizational Factors. In Kani, B, Helmreich, R, Anca, J. Crew resource management (2nd ed). San Diego: Academic Press.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, Indonesia AirAsia, Airservices Australia, and the Civil Aviation Safety Authority.

Submissions were received from Indonesia AirAsia, Airservices Australia, and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 6 November 2017, the fully laden, mini cape-size dry bulk carrier Orient Centaur was transiting the South Channel, Weipa, Queensland, outbound under the conduct of harbour pilots as part of a trial introduction of this size of ship to the port. While in the South Channel, the ship’s main engine shut down due to a loss of water from a cracked engine cooling component, and propulsion was lost. Shortly after, the ship grounded on the northern batter of the channel. The stern then slowly swung across the channel and grounded on the southern batter.

Under the guidance of the harbour pilots, three tugs were used to successfully refloat the ship. The ship was subsequently towed out of the channel to an anchorage. Surveys conducted over the following days identified that the ship did not sustain any damage.

What the ATSB found

The ATSB found that the approval process for this size of ship had only considered the risks associated with a main engine failure before the departing ship’s entry into the narrow South Channel. The port risk assessment did not require the use of an escort tug for any ships transiting the South Channel during outbound voyages, and the tug masters had not been trained in the specifics of escort towage nor in emergency response.

What's been done as a result

The ship’s managers advised there is now weekly on board testing of cooling water and every 6 months at a shore laboratory. Also, only manufacturers’ original spares are to be used during maintenance.

In addition to the trial conditions, an escort tug is now used for all departing bulk carriers. All departing ships over 200 m now have an escort tug made fast, from the wharf to the South Channel exit. Further, two continuously manned, 85 tonne bollard pull azimuth stern drive tugs are now based at the Port of Amrun, about 60 minutes steaming time from the Port of Weipa.

All pilots and tug masters have completed emergency response and escort towage training at the Smartship simulator. The training included emergency towage scenarios, positioning and use of tugs in an emergency, competency in standard escort tug manoeuvres and indirect towage.

Arrival and departure briefs developed for the Port of Weipa have been updated with safety settings for the electronic chart display and information system, tidal information, weather conditions, wind limits and tug positions/line lengths. All masters and ship bridge teams are briefed before arrival and departure.

Safety message

The introduction of this size of ship to the Port of Weipa was preceded by identification, and risk assessment, of a number of hazards. However, aspects of tug escort and the potential for malfunction of the heavily‑laden ships within the confined channel were not considered. This occurrence highlights the importance of considering potential hazards from end to end in order to provide the best opportunity to manage safety risk.

Video animation

The occurrence

At 1120 Eastern Standard Time^[1] on 6 November 2017, the 255 m dry bulk carrier Orient Centaur (cover) completed loading a cargo of bauxite in Weipa, Queensland. The draught survey was completed shortly thereafter, with departure draughts of 12.97 m fore and aft.

At about 1415, the Port of Weipa’s dynamic under keel clearance (UKC) system became inoperative. As a result, the Weipa Vessel Traffic Services (VTS) duty officer was unable to determine the ship’s UKC. Two harbour pilots allocated to Orient Centaur for its departure then calculated that, based upon the ship’s draughts, tide and channel information, the static UKC would be 1.31 m.

At 1515, the ship’s crewmembers commenced pre-departure checks for a 1615 departure from Lorim Point Wharf (Figure 1), to sail on the evening high tide^[2] to China. Shortly after, and as required for this size of ship (mini cape-size)^[3], the two harbour pilots boarded the ship. The pilot taking the conduct^[4] (conning pilot) had worked in Queensland ports for 9 years and was a check pilot for the Port of Weipa. The second pilot (comms pilot) had worked in Queensland ports for 10 years and was also a check pilot for the Port of Weipa. Both pilots had also recently piloted sister ships to Orient Centaur departing Weipa.

Figure 1: Port of Weipa

Source: Australian Hydrographic Service annotated by the ATSB

The pilots were escorted to the navigation bridge and met by the master. By 1537, the ship’s crewmembers had completed the pre-departure checks. At 1540, the master and pilots commenced the master-pilot information exchange (MPX) and discussed the pilotage. During the exchange, they discussed the Port of Weipa pilotage plan and the Full Mission Bridge Simulation (FMBS) departure report. ^[5] The ship’s route, speeds, and UKC in the channel were detailed and the tug requirements, position and repositioning were explained. Two tugs were to be in attendance, Peter Crooke (48 t bollard pull)^[6][7] on the centre lead forward, and SL King (69 t bollard pull)^[8] on the centre lead aft. The master was informed Peter Crooke would let go when the ship was off the berth and in the centre of the channel. SL King would let go at Gonburg Point.

The MPX form also noted that a flood tide setting from the north-west was expected at Urquhart Point, the entrance to the South Channel. The master and pilots completed the MPX at 1602, and the tugs were made fast shortly after. At 1610, the ship’s last mooring line was retrieved on board, and shortly after, the tugs started pulling the ship off the berth. By 1615, the ship was in the centre of the channel off Lorim Point, and the conning pilot ordered slow ahead. At 1618, the conning pilot ordered half ahead, and Peter Crooke was let go and stood by off the starboard quarter as the ship proceeded north of Cora Bank, to Gonburg Point.

At 1643, as the ship passed Gonburg Point, SL King was let go and stood by on the quarter, and the conning pilot ordered full ahead. Shortly after, as the ship passed beacon SC24, the conning pilot ordered port helm and started altering course into the South Channel. At about 1654, when the ship was steady in the South Channel, the conning pilot released the tugs as they passed SC22, and they headed back to their berth (Figure 2). The ship then proceeded outbound in the South Channel as planned, at a speed of about 8 knots.

Figure 2: Orient Centaur passing Urquhart Point and entering the South Channel

Source: Orient Centaur VDR, annotated by ATSB

At 1716, as the ship passed SC13 and SC14, the ship’s main engine jacket water header tank went into low‑level alarm, followed by low‑pressure and high‑temperature alarms. The chief engineer phoned the bridge and asked the master to stop the main engine for repairs, as there was a cooling water issue. The conning pilot advised the master that half ahead was acceptable and the master moved the telegraph to half ahead. He then advised the chief engineer, the main engine could not be stopped as the ship was in a narrow channel.

At 1717, the conning pilot asked the master to contact the chief engineer and confirm if half ahead was available for about an hour. Shortly after, the main engine’s automatic slowdown was activated. The master tried to contact the chief engineer regarding the main engine status. The comms pilot reported the ship was experiencing engine problems to Weipa VTS, and then issued a general call to all tugs for assistance.

At 1718, the main engine shut down, with the ship’s speed at 8.6 knots (Figure 3). Peter Crooke was the first tug to respond to the call for assistance, and the comms pilot asked the tug master to attend the ship as soon as possible. The comms pilot then made several further radio calls to Weipa VTS, stating ‘the ship had lost the main engine, taking a sheer, and was about to ground in the vicinity of SC12’.

Figure 3: Orient Centaur’s main engine shutdown to the grounding at 1 minute intervals

Source: Orient Centaur VDR, annotated by ATSB

The ship’s speed reduced to 8.3 knots as it passed beacons SC11/SC12, and it started to turn to starboard with an increasing rate of turn. The conning pilot ordered hard to port, but this had little effect. The ship continued to turn to starboard and at 1723 (Figure 4), the ship’s starboard shoulder grounded on the northern batter (bank of the channel) of the South Channel, at a speed of 6.7 knots, on a heading of 270°, and the rudder positioned amidships.

Figure 4: Orient Centaur aground in the South Channel at 1723

Source: Orient Centaur VDR, annotated by ATSB

Shortly after, SL King’s tug master responded to the comms pilot’s radio call and was asked to keep him advised of their position, as the ship’s stern started to swing across the channel. The tug master advised that SL King had just passed the wharf and would be at the ship as soon as possible. Peter Crooke’s master also advised that they were about 3 minutes behind SL King. The comms pilot then made a radio call to Weipa VTS and requested a third tug, due to the need to control the situation before the tide dropped (high water was at 1737).

At 1728, Weipa VTS advised the comms pilot that the third tug, Harry Evans (43 t bollard pull)^[9] had been raised and would head out to the ship as soon as possible. At 1730, the comms pilot phoned the Regional Harbour Master (RHM) to inform him of the grounding. Unable to reach him, he called the Assistant Regional Harbour Master (ARHM). Subsequently, the ARHM gave the pilots authorisation to act in whatever manner was required to get the ship off the bank and prevent it from being aground forward and aft, across the channel, with a falling tide.

Several minutes later, the comms pilot requested the pilot boat, Windah, to read the draughts on both sides of the ship and take depth soundings around the ship’s stern. The comms pilot then advised SL King’s master to have lines ready to do heavy lifting upon their arrival.

By 1739, the ship had come to rest with the starboard shoulder aground on the northern batter, on a heading of 279°, south-west of SC 12 with the port quarter across the channel and drifting towards the southern batter.

At 1745, the comms pilot managed to contact the RHM and provided a situation update. At the same time, the ship’s crew activated their emergency procedures for a grounding. The ship’s stern continued moving slowly across the channel, before coming to rest on the southern batter at 1759, on a heading of 289°.

At 1800, the ship’s engineers identified that the cooling jacket of the cylinder head of number one main engine unit cylinder had cracked, which led to the loss of the jacket water, and the subsequent shutdown of the engine. They then started a cylinder liner jacket overhaul for the failed unit.

Shortly after, SL King arrived off the ship’s starboard quarter and put a line up through the starboard side panama lead. At 1805, the tug moved abeam and started holding the stern. At about the same time, the third tug, Harry Evans departed its berth and proceeded to Orient Centaur.

At 1808, the starboard anchor was lowered to one shackle^[10] in the water to control the bow on refloating of the ship.

By 1810, Peter Crooke had arrived off the port quarter and put a line up through the port side panama lead. After the tug’s line was fast, the tug started laying back to start pulling the ship astern from the grounded position.

Orient Centaur’s stern started to slowly swing clear and away from the southern batter and, at 1820, the ship was refloated. Shortly after, SL King was relocated forward, to run a long line up the ship’s centre lead. By 1823, the line was fast and the ship’s deck crewmembers started heaving up the anchor.

By 1826, the ship’s anchor was aweigh and, at 1830, Orient Centaur was back in deep water and being manoeuvred back into the centre of the channel. The pilot’s plan from here involved SL King towing the ship, and for Peter Crooke (port quarter) and Harry Evans (starboard quarter), to steer the ship (Figure 5). The comms pilot then updated the RHM on the situation and the intended plan. The RHM advised the pilots that the ship should be towed to the emergency anchorage, that the Australian Maritime Safety Authority (AMSA) had taken charge of the incident, and that the ship was officially detained pending inspections.

Under towage, the ship passed between SC10 and SC9 at 1838, at a speed of 3.8 knots with an UKC of 3.2m. At 1843, the third tug, Harry Evans was off the starboard quarter and by 1848, had made fast a line through the starboard side panama lead.

By 1856, the ship had passed SC7 at a steady speed of 4.5 knots and shortly after 1948, passed the fairway buoy and was clear of the South Channel.

The pilots and Orient Centaur’s master checked the proposed route to the emergency anchorage, and determined that the emergency anchorage position would not provide a satisfactory UKC for the ship in the loaded condition. At 2010, the comms pilot informed RHM that the emergency anchorage area did not have sufficient water for the ship’s draught and an alternative position was agreed.

Figure 5: Tugs Harry Evans arriving at Orient Centaur and Peter Crooke fast on the port quarter

Source: Ports North pilots

At 2120, the tugs started slowing the ship in preparation for letting go the starboard anchor. Shortly after, SL King was cast off and the ship’s crew prepared the anchor for letting go.

The ship’s starboard anchor was let go at 2137. By 2206, all three tugs were clear of the ship and the pilots disembarked at 2218.

Orient Centaur remained at anchor throughout 7 November 2017, during which time the ship’s engineers completed the cylinder liner jacket replacement. The main engine was tested and made ready for departure.

At 0800, 8 November 2017, marine surveyors from AMSA and the ship’s classification society attended the ship with a dive team. The dive report noted some loss of paint on the starboard shoulder and no damage or paint loss on the port quarter.

The AMSA surveyor revoked the detention order at 1345, and at 1518, the ship weighed anchor and proceeded to China.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Weipa has a diurnal tide range, which is characterised by one high water (tide) and one low water (tide) per day. Typically, with a diurnal tide each successive high or low tide is 24 hours and 50 minutes apart, this is the length of one lunar day.
3. A size that is at the lower end of the range of cape-size ships, which have dimensions larger than that allowable for transit of the Panama Canal.
4. Conduct of the ship’s passage means directing the navigation and movement of the ship.
5. Weipa Port Procedures - Vessels in excess of 240 m in length with a beam greater than 38 m may be subject to Full Mission Bridge Simulation (FMBS) exercises before any approval will be considered.
6. The capacity of tugs is measured by their rated Bollard Pull. The Bollard Pull of a tug is the force it exerts at zero forward speed, in calm water conditions, with the engine working at its full power.
7. Bollard pull test measuring the static pull from the vessel undertaken in July 2012.
8. Bollard pull information from the Port Procedures and Information for Shipping – Port of Weipa, August 2017.
9. Bollard pull test measuring the static pull from the vessel undertaken in July 2012.
10. One shackle equals 90 feet or 27.43 m.

Context

Orient Centaur main engine cooling system

Orient Centaur was fitted with a Hyundai MAN B&W 6S60MC-C7 slow speed engine (appendix A). The six-cylinder engine is cooled by a central cooling system.^[11]

Figure 6: Jacket water cooling diagram

Source: MAN Two-stroke MC/MC-C Engines

The cylinder liner is made of alloyed cast iron and suspended in the cylinder frame with a low‑situated flange. The top of the cylinder liner is fitted with a cooling jacket. The cylinder cover, made of forged steel, is attached to the cylinder liner and has bores for cooling water.

The jacket cooling water system (Figure 6) is used for cooling the cylinder liners, cylinder covers, and exhaust valves of the main engine, and for heating the fuel oil drainpipes.

The engine manufacturer had issued a service letter (SL2014-584/LRA) in January 2014, regarding the cooling water systems associated with engines of this type. The service letter provided a number of possible actions to prevent corroded or cracked engine parts (cylinder cover, cylinder liner and cooling jackets) and cooling water leakage. It stated:

…most cases of heavy corrosion in the cooling water system or cracked cylinder cooling jackets on the cylinder cover, were related to insufficient cooling water maintenance. Heavy deposits tended to find the way into the clearances between the cylinder cover and the cooling jacket. This made heat expansion of the cylinder cover impossible without also exposing the cooling jacket to significant stress as the heat expansion is reducing the clearances. In combination with heavy corrosion of the engine components caused by insufficient cooling water treatment, the cooling jacket may consequently crack.

Consistent with the detail in the service letter, the engine jacket water needed to be carefully treated, maintained and monitored to avoid corrosion, corrosion fatigue, cavitation, and scale formation.

The crewmembers who were in the engine room at that time of the occurrence sighted water coming from a crack in the cylinder cooling jacket of the cylinder head of cylinder number 1 (Figure 7). The loss of jacket water triggered the main engine to shut down.

Figure 7: Cylinder cooling jacket failure and crack (after cleaning)

Source: Interorient accident investigation report annotated by ATSB

The engine manufacturer subsequently inspected the failed cylinder cooling jacket and identified that:

• the jacket had one vertical crack that passed through a securing bolt hole
• there were four bulges around the crack but no evidence of any impact marks
• the cooling space of the inner cooling jacket had heavy corrosion/rust and metal peeled off.

The cooling water systems were tested for nitrites, chlorides and pH after the incident. All were within limits, however the chloride tests of the high temperature cooling water were slightly high.

Port of Weipa

Located on the north-west coast of Cape York Peninsula, the Port of Weipa’s primary export is bauxite (aluminium ore) from the Rio Tinto Alcan mine (RTA). North Queensland Bulk Ports Corporation (NQBPC) is a statutory Queensland government‑owned corporation charged with overseeing the commercial activities in the port, including the maintenance of the port infrastructure. The primary function of NQBPC, under the Transport Infrastructure Act 1994, is to establish, manage and operate effective and efficient facilities and services within the port, while maintaining appropriate levels of safety and security.

Port Procedures

Maritime Safety Queensland (MSQ), the maritime regulator, administers the State’s shipping legislation. MSQ appoint Regional Harbour Masters (RHM), who are authorised to give direction under the relevant provisions of the Transport Operations (Marine Safety) Act 1994. An RHM controls the pilotage areas within their region and has the authority to direct the master of a ship to navigate or operate a ship in a prescribed way.

Each pilotage area has a Port Procedures and Information for Shipping Manual (PPM).^[12] The PPM details services, mandatory regulations and procedures to be observed. The manual also includes guidelines and information to assist masters, owners and agents of vessels arriving and departing the area.

MSQ operates a Vessel Traffic Service (VTS) for the Port of Weipa. The VTS is based at the RHM's office in Cairns, Queensland. VTS operators at Cairns have direct contact with shipping. In the event of an emergency, the VTS centre is the key notification and communications facility and activates the appropriate response agencies.

Pilotage

All ships that are 50 m or more in length, proceeding within a Queensland pilotage area, must carry a licensed marine pilot or be under the command of a master who holds a pilotage exemption certificate for the area. Far North Queensland Ports Corporation Ltd (Ports North) provide the compulsory pilotage service for the Port of Weipa, as well as for the ports of Cairns, Cape Flattery, Mourilyan, Karumba, Thursday Island (Port Kennedy) and Skardon River.

Sailing times

Ships can only depart Lorim Point on a flood tide and are scheduled so as to depart the berth 1 hour 15 minutes before the high water at Humbug Point (Figure 1). This scheduling allows ships about 30 minutes to enter and steady in the South Channel by the time they are off Urquhart Point. By that time, the tidal stream should have reduced to less than one knot.

First-strike response

The Port of Weipa had an emergency response plan (First-strike Oil Spill Response Plan), prepared by the Queensland Department of Transport and Main Roads, for dealing with pollution from ships. The plan detailed the operational arrangements between MSQ and Ports Corporation of Queensland and the response and handover arrangements for oil spills within the port. Further, the plan identified available resources and key contact information for responding to an oil pollution incident.

The plan was to be used in conjunction with the following:

• the Queensland Coastal Contingency Action Plan (QCCAP)
• Maritime Safety Queensland's Standard Operating Procedures for oil spill response
• the Oil Pollution First-Strike Response Deed for the Port of Weipa.

MSQ is both the statutory and combat agency for ship‑sourced oil spills and the incident controller for all incidents within the scope of the plan. North Queensland Bulk Ports (NQBP) are responsible for ensuring that an adequate first‑strike oil spill response capability is maintained within the port. The incident controller was the RHM, assisted by the NQBP Port Manager. The local first-strike response team consisted of six personnel, with either the NQBP Port Supervisor or MSQ representative as local incident controller, with five personnel from Rio Tinto Alcan.

Although the grounding incident did not result in any pollution, the incident debrief attended by all directly involved parties identified an issue with the first-strike response. As NQBP and MSQ have only one officer each based in Weipa, NQBP utilises Rio Tinto personnel to meet their responsibilities. It was not clear whether the first‑strike response team could have been assembled in a timely manner with the number of local personnel as required by the QCCAP.

Mini cape-size bulk carrier

Weipa arrival and departure simulation

In 2017, Rio Tinto Marine submitted a written application to the RHM for mini cape-size ships that were 255 m in length with a 43 m beam to export bauxite from Weipa. As the ships exceeded the port’s size limits, Full Mission Bridge Simulation (FMBS) exercises were required. In May and July 2017, the RHM, pilot manager, several senior pilots and a Rio Tinto shipping specialist, attended the MSQ Smartship simulator in Brisbane, Queensland, to conduct the FMBS exercises. The exercises (Figure 8) used a model of the mini cape-size bulk carrier for arrivals in a ballast condition and departures in a fully laden condition, to a maximum draught of 12.8 m.

Figure 8: Port simulation exercise report

Red arrows show areas of bank effect, yellow arrows show flood tide, other annotations show ship’s course, past positions and tidal information.

Source: MSQ regional harbour master (Cairns)

The ship’s manoeuvrability was tested in normal^[13] and extreme^[14] weather conditions. The recommendations included, among others:

The vessels push the limits for the channel, but simulation indicated they can safely enter and leave the port in conditions expected at Weipa.

Before final sign off can be given the following will need to be completed:

All pilots will need to spend two days in the simulator before handling the vessels to ensure they get “the feel”. These vessels are marginal and it was shown in the initial simulation that the pilots need to get used to the lack of power and the effect on the steering capability.

It was further recommended another 2-day simulation exercise be conducted to train two more pilots to handle the vessels. On the completion of the (Full Mission Bridge Simulation) exercise and risk assessment, a vessel of this class is chartered to Weipa for a couple of voyages to “prove” the feasibility. Provided this is successful more pilots would be trained and the number of mini cape vessels be limited to 5 vessels of the same class.

Risk assessment

The RHM’s risk treatment action plan, based on the outcomes of the FMBS exercises for mini cape-size ships entering the Port of Weipa was completed prior to any shipment trials. The plan covered four areas, general, channel entry, berthing and departure. The plan also covered the risks, current controls, interventions and identified the responsible officer in each area.

The general risk controls included the PPM requirements, simulated arrival and departure conditions, bridge resources management issues, and ship characteristics among others. The risk controls also required that two pilots, appropriately qualified and trained in the simulator, were to be on board for the ship’s transit.

The arrival channel entry risks detailed environmental effects, wind and leeway limits related to the 106 m wide South Channel widening to Cora Bank (Bell Mouth). The average draught of the mini cape-size bulk carriers in ballast was 7.5 m and the ships arrive on a rising tide, with the maintained channel depth at 11.1m. The risk assessment identified the possibility of main engine failure during arrival, and the ship’s anchors ready and tugs available as the mitigating risk controls. This was on the basis that ships in ballast have shallower draught, and therefore have less chance of grounding in the 11.1 m deep approach channel. Further, with this greater clearance under the keel (compared to fully‑laden deep draught departure channel clearance) the ships’ anchors can be used to assist manoeuvring and control.

In addition, during arrivals, a tug is required to be on stand-by at SC24 beacon, at the entry into Cora Channel. The tug is positioned adjacent to the section of approach channel with the more shallow water outside the channel and thus the greater risk to grounding should a ship leave the channel. From this position, the tug is immediately available to assist ships on approach to Urquhart Point if needed.

The berthing risks included control measures for the ship’s draught, usage of tugs, speed of approach and use of sound navigational methods. An intervention measure required that only pilots with an endorsement for mini cape-size ships would be assigned to this type of ship.

The departure risks identified the same areas of risk as for the channel entry, with the same controls and intervention measures. Engine failure was also identified as a risk, with controls being escort tugs, and that they be available.

At the conclusion of the exercises, the RHM recommended ship trials into the Port of Weipa under the following conditions:

• the vessels must be one of the five sister ships
• vessel to be loaded no deeper than 12.8 m and use static UKC of 10 per cent draught
• entry and departure for first six visits to be in daylight only
• two senior pilots who have attended the simulation to be on board
• wind conditions maximum 25 to 30 knots
• departure from Lorim Point to be 1 hour 15 minutes before high water at Humbug Point to minimise current at Bell Mouth
• tugs to be available to escort until vessel has entered the South Channel – this may restrict other departures or arrivals
• 6 trial shipments to be permitted subject to the above conditions
• following trial, review pilot observations
• should further shipments be approved all, pilots who conduct the vessel to have completed 2 days simulator training.

Tug requirements

The PPM stated that all ships over a certain size that used the Lorim Point (Figure 1) berths were required to use a minimum of two azimuth stern drive (ASD) tugs for all movements. In addition, guidance for ships departing Lorim Point stated that the forward tug should be let go after the ship responded to helm movements, and the aft tug as required, when the ship was steady and passing Gonburg Point. Further, during the trials, tugs were to be available to escort until the ship had entered the South Channel. One of the objectives of escorting a ship is to apply high steering and braking forces via a towline to limit to impact of grounding. Escort tugs are specifically designed for this role to operate over long distances and at relatively high speeds. At the time of the occurrence, the Port of Weipa did not have any escort-rated tugs and the tug masters were not trained in the specifics of escort towage nor in emergency response.

ASD tugs can be operated in either direct or indirect towage methods (Figure 9). The method used in the Port of Weipa was direct towage, as the tugs were predominantly used for harbour work and assisting ship berthing and un-berthing manoeuvres. Direct towing is performed at low speeds from about 0‑ 5 knots. The tug uses its engines and propellers to generate the tow force (directly), which is governed by the conventional bollard pull of the tug.

Indirect towing can be performed at speeds in the range of 5‑12 knots. The tug generates a tow force (indirectly) by putting tension on the tow line using a combination of the tug’s weight, water pressure (from the tug’s skeg) and the resultant drag of the propeller wash. The tug can assist swinging and steadying by working around the radius of the towline. When working at the stern of a ship, the pull on the towline can be increased by a factor of 1.5 to 2 times the bollard pull.

The effectiveness of the towage methods is also dependent on the availability of safe water to work in. In a narrow channel, the ability to work around the radius of the towline is restricted. Therefore, with the ship at speed (about 8 knots) in the South Channel (106 m) it was prohibitive for a tug to effectively steer it using dynamic arrest mode. However, direct arrest mode remained an effective option when retarding (braking assistance) forces were required.

Figure 9: Azimuth stern drive tugs - direct and indirect towage methods

Source: Tug Use in Port, A Practical Guide, Captain Henk Hensen, annotated by ATSB

__________

•  
  11. The cooling water system has three circuits: a seawater system, a low temperature freshwater system and a jacket cooling water system.
  12. Port Procedures and Information for Shipping – Port of Weipa, August 2017.
  13. Normal weather conditions – wind, 20 knots gusting 25 knots from south-east and current, 2.7 knots maximum on flood and ebb tides.
  14. Extreme weather conditions – wind, 30 knots gusting 35 knots from south-east, south-south-west, west and northwest and current, 2.7 knots maximum on flood and ebb tides.

Safety analysis

Main engine failure

As Orient Centaur proceeded outbound in the South Channel, the main engine shut down due to low cooling water flow, and a loss of propulsion.

The loss of cooling water was the result of a crack in a main engine unit’s cylinder cooling water jacket through a securing bolt hole, an area of inherent stress concentration. Furthermore, consistent with the engine manufacturer’s service letter, it is possible that the effects of corrosion products found in the cooling water space contributed to the cracking due to increased stress in the area of the failure.

Mini cape-size bulk carriers operation

Port risk assessment

The hazards associated with engine failure (loss of propulsion) during departure from Weipa was considered during the approval risk assessment process and were to be mitigated by having tugs in attendance until the ship was steady in the South Channel. On the day of the occurrence, and after the ship had passed beacon SC 21, the tugs were stood down and instructed to return to the berth. Consequently, when the loss of propulsion occurred in the narrow South Channel, there was no effective mitigation against grounding. The time taken for tugs to reach the ship would depend on its position in the channel, as well as the proximity of the tugs.

The subsequent investigation report observations prepared by the Regional Harbour Master (RHM) stated:

Completed Risk Assessment shows having tugs standing by until vessel is steady in channel would help prevent the vessel “T boning” the shoreline in areas where the channel is wide enough for the vessel to sheer sufficiently to be 90 or almost 90 degrees to the bank when grounding could be more violent and lead to hull damage.

Slope of batter in vicinity of Beacon SC 12 was beneficial to grounding as it slowly brought the vessel to a stop.

Further to seaward increase in depth and reduction in slope of batter would have seen the vessel get further out of the channel and may have been grounded for more of the length of the vessel.

No vessel discharge facility or equipment is available in Weipa.

As the South Channel was only 106 m wide, the ship was too long to ‘T bone’ in the channel. However, after grounding on the northern batter, the stern swung on the falling tide and grounded on the southern batter, effectively blocking the channel. There was then a significant risk the ship’s structural integrity could be compromised and at that time, the pilots estimated they had about 30 minutes to refloat the ship. Fortunately, the actions taken by the tugs and the pilots on board enabled the ship to be re‑floated before the falling tide rendered the task impossible.

The subsequent grounding debrief, attended by the RHM, Maritime Safety Queensland, Far North Queensland Ports Corporation Ltd (Ports North), North Queensland Bulk Ports and Smit Lamnalco, identified this risk:

If the Orient Centaur hadn't been successfully floated the vessel may have grounded forward and aft across the channel. The steep channel batters coupled with the ebbing tide may have compromised the hull's integrity. This could have blocked the channel and essentially closed the Port of Weipa. Due to the potential complexity of the salvage and also the remote location and long transit times for suitable salvage equipment this could have led to a salvage and port closure lasting many months, which would have an effect on the Queensland economy.

Further:

If the vessel had grounded further west where the gradient of the batter was more gradual, the refloat may have been more difficult, although hull integrity may not have been such a concern.

Simulation

The pilots stated that, during departure, Orient Centaur handled in the same manner as during simulation. However, during the simulation exercises for the mini cape-size ships, emergencies such as loss of propulsion and/or steerage were not simulated in the South Channel. The pilots had previously been trained in simulated emergency scenarios and escort towage, but only for events such as loss of propulsion and engine failure in smaller vessels when entering/departing the less confined Bell Mouth.

After the incident, the ATSB attended the Smartship simulator to observe several pilots participating in a 2‑day mini cape-size ship simulation. During this time, the incident was simulated with and without tug assistance. With tug assistance (tow line centre lead aft), the ship was kept directionally stable and its speed reduced significantly, to control a grounding. Without tug assistance, the ship grounded in an uncontrolled manner.

The inclusion of a loss of propulsion simulation in a confined channel during the mini cape-size approval process would have informed the likelihood of grounding and the subsequent impact on port operations and provided the opportunity to practice the response to such an event.

Tug usage and availability in the Port of Weipa

In addition to the requirements of the Port Procedures and Information for Shipping Manual and the Ports North pilotage operations safety management system, the RHM required two tugs to escort a mini cape-size ship until it was steady in the South Channel. The tug crews then had to remain with the tugs until the ship had departed the South Channel.

The contingency for a ship grounding in the South Channel was that the tugs would be manned and ready to proceed to the ship. After Orient Centaur grounded, the tugs started to arrive at the ship after about 47 minutes.

The pilot’s orders to the tug masters during the refloating of the ship were standard and well understood, and the required tug movements were also standard practice. However, during the recovery, the operation of two tugs working in close proximity on the stern of the ship was different to that of the day-to-day operations of the tugs.

With a ship at speed, and with two tugs working at the stern, interaction forces between water flow patterns are generated by both the ship and tugs, and between the tugs themselves. When tugs are towing on a line, the situation is further complicated, as they are frequently changing position and heading, therefore operating in areas where they experience different interaction effects. The tug masters were conscious of these effects and reported spending a lot of time avoiding contact with each other during the recovery. This was particularly apparent when asked to either layback, or move out to lift the ship’s stern from port or starboard. This shows that a higher skill set than those associated with standard harbour towage practice was required during the response to the occurrence and for escort towage more generally.

However, the tug masters had not been trained in indirect towage methods, multiple tug usage or emergency scenarios. Additionally, at the time of the occurrence, the tugs were considered to be used as a means of controlling grounding and were not escort rated.

Emergency response to a pollution incident

This grounding occurrence did not produce any pollution however, in different circumstances activation of the pollution emergency response plan would been required. That response relied on trained personnel from North Queensland Bulk Ports to form the First-strike Oil Spill Response team. However, due to the limited availability of personnel at the time of the occurrence it was unlikely that that an emergency response to a pollution incident in the Port of Weipa would have been initiated in a timely manner. As detailed in the Safety issues and actions section of the report, appropriate proactive action has been taken to improve the emergency response.

Findings

From the evidence available, the following findings are made with respect to the grounding of Orient Centaur, which occurred in the South Channel, Weipa, Queensland on 6 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• As the ship was transiting the South Channel, its main engine shut down due to a loss of cooling water associated with failure of the number 1 cylinder cooling jacket. Following the loss of propulsion, the ship’s starboard shoulder grounded on the northern batter and its port quarter drifted across the channel to ground on the southern batter.

Other factors that increased risk

• In pre-trial simulations, the risks associated with engine failure during departure were only considered up to when a ship had entered the South Channel. Consequently, the tugs were not in attendance to assist if propulsion was lost. [Safety issue]
• The conditions for trial shipments required all pilots to complete extensive arrival and departure simulations, including transit through the South Channel. However, the simulations did not include contingencies, such as loss of propulsion and/or steerage that would have assisted in determining the risk of, and response to, such occurrences.
• Tugs were to be available to escort the mini cape-size ships until they had entered the South Channel, where they were stood down. However, the tug masters had not been trained in the specifics of escort towage nor in emergency response. [Safety issue]

Other findings

• At the time of the incident, it was unlikely that that an emergency response to a pollution incident in the Port of Weipa would have been initiated in a timely manner. Subsequently, appropriate proactive action has been taken to address the emergency response issues.
• The actions of the pilots, ship's crewmembers and tug masters following their arrival at the ship were timely and significantly reduced the consequences of the occurrence.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to initiate safety action proactively, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the marine industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Mini cape-size risk assessment

Safety issue number: MO-2017-010-SI-01

Safety issue description: In pre-trial simulations, the risks associated with engine failure during departure were only considered up to when a ship had entered the South Channel. Consequently, the tugs were not in attendance to assist if propulsion was lost.

Usage of tugs

Safety issue number: MO-2017-010-SI-02

Safety issue description: Tugs were to be available to escort the mini cape-size ships until they had entered the South Channel, where they were then stood down. However, the tug masters had not been trained in the specifics of escort towage nor in emergency response.

Additional safety issues

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Interorient, the ship’s managers advised the following proactive actions will be taken:

• water analysis on board weekly

• water analysis at shore every 6 months

• checking appropriate tightening of Cylinder Head every 8000 hrs

• proper overhaul of cooling jacket (replacement of o rings and cleaning) and use of original spares according to manufactures instructions, service letters and manual every overhaul

• checking securing bolts as per manufactures service letters every overhaul

• proper tracking of running hours monthly

• original spare cooling to be available on board at all times

• all cylinder jackets renewed within 1 year from incident

• maker guidance/recommendations and service letters are followed as per planned maintenance system schedule.

North Queensland Bulk Ports (NQBP) advised their operations have been reviewed and have taken the following proactive actions:

NQBP have prepared a tender package for the provision of Salvage and Casualty Advice for all NQBP Ports to include:

- guidelines to assist NQBP on items that may be included in vetting requirements to minimise the likelihood of an incident in the future

- the establishment of appropriate minimum insurance requirements for ships using NQBP ports

- provide response timing and plans, which are considered for reasonably foreseeable events within their Ports.

Obtained quotes for Vessel Vetting Service (Rightship) to facilitate implementation of additional vetting protocols. Implementation is planned following the review of Salvage Planning, as this work will also consider vetting parameters that can be enforced to minimise the likelihood of an incident occurring.

As part of this process, NQBP has already sought from each of our Terminal Operators detail of their vetting processes, specifically the criteria that they are vetting to.

Completed a First Strike Oil Response exercise in Weipa

NQBP was added to the Weipa VTS Incident Notifications

NQBP are currently in the process of undertaking a Risk Assessment & Management review of our Ports for marine operations. This process is being completed in conjunction with the RHM, Terminal Operators and Towage Providers for each Port.

Ship details

Ship details

Appendices

Appendix A – Engine cross section MAN B&W 6S60MC-C7

Sources and submissions

Sources of information

The sources of information during the investigation include:

• the master and involved crewmembers of Orient Centaur
• Interorient
• the Australian Maritime Safety Authority
• the Regional Harbour Master (Cairns), Maritime Safety Queensland
• the Manager Pilotage Services, Ports North
• North Queensland Bulk Ports
• Smit Lamnalco.

References

Rowe, Captain RW (with Russell, Captain PJD). The Ship Handler’s Guide, The Nautical Institute in conjunction with the Warsash Maritime Centre, London.

Hensen, Captain Henk. Tug Use in Port, A Practical Guide, The Nautical Institute, London.

Maritime Safety Queensland (MSQ) 2017, Port Procedure and Information for Shipping – Weipa, MSQ, Brisbane. Available at https://www.msq.qld.gov.au

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to master and directly involved crew and managers of Orient Centaur, the ship’s flag State, the pilots and manager pilot services, the Regional Harbour Master (Cairns), North Queensland Bulk Ports, Smit Lamnalco and the Australian Maritime Safety Authority and Regional Harbour Master (Cairns).

Submissions were received from the Australian Maritime Safety Authority, the pilots and manager pilot services and the Regional Harbour Master (Cairns). The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.