On 27 June 2016, the pilot of an Airparts (NZ) FU-24-950 aircraft, registered VH-TTD, was conducting agricultural operations from an airstrip about 50 km east-south-east of Tamworth Airport, New South Wales. The pilot was the only person on board the aircraft.
The airstrip elevation was about 3,200 ft and sloped downhill in the direction used for take‑off, with a steep slope at the end of the runway. The surrounding terrain was below the elevation of the airstrip and the first obstacle in the take-off direction was a fence at the end of the runway.
At about 1130 Eastern Standard Time (EST), after having completed about 35 flights for that morning, the pilot started their next take-off run with the flaps[1] in the normal take-off setting of 20°. The aircraft handled normally until shortly after lift-off, when at an airspeed of about 60 kt, the pilot heard a ‘bang’. The aircraft sank rapidly and the tail struck the runway surface. As the runway sloped steeply downhill, the aircraft became airborne again. Due to the proximity of the fence at the end of the runway, the pilot elected to continue the take-off and dump the fertiliser load. As the load was being dumped, the aircraft struck the fence, but continued to fly.
The pilot quickly detected that there was no response from the elevator[2] to their control inputs. They could move the control column fore and aft, but the aircraft pitch[3] did not respond. They also observed that the flap was fully retracted even though the cockpit flap lever was still set to 20°. The pilot elected to divert to Tamworth Airport, which was below the elevation of the airstrip. The pilot used engine power and elevator trim[4] to control the pitch of the aircraft.
The pilot contacted Tamworth air traffic control (ATC) and informed them that they had a ‘bit of an issue’. They also advised that they had no elevator control, but still had the aircraft under control (Figure 1). ATC cleared the pilot to manoeuvre as required to approach and land on the main runway at Tamworth.
The pilot conducted a long and low straight-in approach to runway 12 left at Tamworth with the aircraft trimmed in the approach attitude, which was slightly nose up. At about 10 ft above the runway, the pilot reduced the throttle to idle for the landing. The aircraft then pitched nose down and the nose wheel contacted the runway first and burst the nose wheel tyre. The aircraft stopped on the runway with minor damage and the pilot was not injured.
Figure 1: VH-TTD flying towards Tamworth Airport on the incident flight
Source: BAE Systems Flight Training Tamworth
Repair organisation findings
The repair organisation that performed the post-incident inspection found damage to the propeller, tailplane and underside of aircraft consistent with impact with the runway and fence during the take-off. A detailed inspection inside the airframe revealed the following:
The structural frame supporting the lower elevator control cable pulley was pushed up about 10 cm (Figure 2).
The centre section just aft of the hopper (Figure 3) had about 12 mm of water in it and the drain hole for the centre section was blocked by fertiliser. The repair organisation assessed that the size of the drain hole was inadequate and that a larger hole with a removable bung would be preferable.
The flap control cable had failed at the rear flap pulley and the failure appeared to be due to corrosion (Figure 4).
Figure 2: VH-TTD elevator control cable pulley
Source: Repair organisation and BAE Systems Flight Training Tamworth annotated by ATSB
Figure 3: VH-TTD centre section
Source: Repair organisation annotated by ATSB
Figure 4: VH-TTD broken flap cable
Source: Repair organisation annotated by ATSB
Maintenance schedule
The aircraft system of maintenance used was the Civil Aviation Safety Authority (CASA) Schedule 5 with 100-hourly periodic inspections. CASA Schedule 5 includes the following inspections relevant to this incident:
Item 3 (j) for the airframe periodic inspection: ‘inspect the control wheels, control columns, rudder pedals, control levers, control system bellcranks, push pull rods, torque tubes and cables.’
Item 17 for the daily inspection: ‘check that the drain holes are free from obstruction.’[5]
Previous maintenance inspections
The last 100-hourly periodic inspection was certified on 19 May 2016 in accordance with CASA Schedule 5. The previous periodic inspection was on 21 April 2016, and a corrosion inspection was performed on 23 November 2015, which included CASA Airworthiness Directive FU24/2: structural component – corrosion – inspection. No findings were recorded against the flap control cable for these inspections. During the periodic inspections, the flap cable was inspected by moving a cloth along the cable and no broken strands were detected, and there was no water present in the centre section of the aircraft aft of the hopper. However, the maintenance organisation indicated that they did not remove the flap cable for inspection, nor apply corrosion protection to the flap cable during the inspections.
Recommended practices
CASA Airworthiness Bulletin 27-001 issue 7 includes the following recommendation:
…flight control cables should be periodically inspected in accordance with manufacturer’s data and FAA AC 43-13-1B Chapter 7, AIRCRAFT HARDWARE, CONTROL CABLES AND TURNBUCKLES, section 8, paragraph 7.149d. To inspect all surfaces of a cable throughout its entire length for wear and fatigue (broken wires) usually requires that the cable be disconnected and removed...
United States Federal Aviation Administration Advisory Circular 43-13-1B chapter 7, section 8, paragraph 7.149 states that: ‘deterioration, such as corrosion, is not easily seen, therefore, control cables should be removed periodically for a more detailed inspection and any cable with a broken strand in a critical fatigue area[6] must be replaced.’ See Figure 5 below.
Paragraph 7.149i states that: ‘Areas especially conducive to cable corrosion are battery compartments…etc.; where a concentration of corrosive fumes, vapours, and liquids can accumulate.’
Paragraph 7.152 states that where control cables pass over pulleys: ‘Provide corrosion protection for these cable sections by lubricating with a light coat of grease or general purpose, low-temperature oil.’
Figure 5: Cable inspection technique
Source: FAA AC 43.13-1B page 7-35
ATSB comment
The ATSB notes that the corrosion present on the flap control cable at the location of the failure takes a considerable amount of time to develop. The corrosion was confined to the working length of the cable that was in contact with the flap control system rear pulley, which is considered to be a critical fatigue area. The failed cable was comprised of woven steel wires plated with zinc or tin. The cable was confirmed to be the correct type for the application.
Over time, in the absence of a suitable lubricant, the plating can wear due to frictional contact with the pulley. This will render the cable susceptible to corrosive attack and elevate the likelihood of a fatigue failure. The flap control cable was not removed during the last periodic inspection, which could have detected the corrosion damage. Nor was grease applied to the working length of the cable, or the rear flap pulley, during the last few inspections to mitigate against the development of corrosion.
Entrapped water, fertiliser and potentially, the previous use of an unsealed lead-acid battery,[7] all contributed to a corrosive environment within the centre section of the aircraft, and corrosion of the flap cable.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Maintenance organisation
As a result of this occurrence, the maintenance organisation has advised the ATSB that they are taking the following safety actions:
Maintenance practices
The FU-24 rear flap control system pulley will be removed during CASA Schedule 5 periodic inspections to facilitate inspection of the flap control cable.
Safety message
This incident highlights the need for maintenance organisations to periodically review the recommended practices published by both the manufacturer and the regulatory authorities. The Schedule 5 system of maintenance details what inspections are required, but does not prescribe how they should be performed. Reference to the relevant industry standard practices can improve the quality of maintenance conducted and ensure an organisation’s practices remain up-to-date with the respective standards, which are periodically updated to incorporate new knowledge.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 18 June 2016, at about 0136 Western Standard Time (WST), the pilot flying and a check pilot (who was the pilot in command) of a Pilatus PC-12 47E aircraft, registered VH-OWA (OWA), prepared to conduct a medical retrieval flight from Meekatharra Airport to Paraburdoo, Western Australia, under the instrument flight rules.[1] Due to the remote area, the terrain surrounding the airport was dark, although the night was moonlit. The pilot flying was seated in the left seat, the check pilot in the right seat, and a flight nurse was also on board.
The pilot flying completed the pre-start, start and after-start checks. As the aircraft had been parked under a metal roof, the aircraft’s two GPS units had not acquired enough satellites to complete their initialisation. The pilot flying therefore taxied the aircraft a short distance onto the taxiway before stopping. GPS 1 located all satellites as required, but GPS 2 failed to initialise and the crew received an UNABLE FMS-GPS MON caution message.[2] The pilot flying followed the quick reference handbook actions in response to that message, following which GPS 2 initialised and the caution cleared. The pilots then continued for a normal take-off from runway 09, at about 0145.
About 18 seconds after take-off, as the aircraft climbed through about 250 ft above ground level at an airspeed of about 110 kt, the pilots observed the radio altimeter (radalt) wind down to zero (see Radio altitude). The radalt low altitude awareness display rose to meet the altitude readout.
The synthetic vision image (see Synthetic vision system) on both pilots’ primary flight displays (PFDs) then showed the runway move rapidly left and off the screen, and the ground representation on the PFD appeared to rise rapidly up to meet the zero pitch reference line (ZPRL).[3] As a result, the pilot flying pulled back on the control column and the flight data showed the flight path indicator (see Aircraft reference symbols) moved up to about 15°. No warnings or cautions were displayed, the stick shaker stall warning did not activate (as the aircraft angle of attack was not in the shaker range), and the crew did not receive any oral alerts from the terrain awareness and warning system (TAWS).
The pilot flying reported that the synthetic vision image created the impression that the aircraft was sinking rapidly towards the ground, and they responded by instinctively pulling back on the control column. There was no vestibular sensation[4] that the aircraft was descending, nor had there been any indication of a strong wind that may have caused the aircraft to drift off the runway centreline. The resulting sensory confusion caused the pilot flying to experience a level of motion sickness.
The check pilot immediately looked outside (there was no standby instrument on the right side of the cockpit), and was able to discern a visible horizon due to the moonlight. The check pilot cautioned the pilot flying that the aircraft had a nose-high attitude, which prompted the pilot flying to switch their focus to the electronic standby instrumentation system (ESIS) and closely monitor the attitude and the airspeed tape (see Electronic standby instrumentation system). The pilot flying lowered the aircraft nose to regain an 8° pitch[5] attitude and the flight data showed that the airspeed, which had reduced to 101 kt, increased back to the target airspeed of 110 kt. The aircraft had continued to climb throughout the event.
Climbing through about 850 ft, the synthetic vision display corrected itself and all indications returned to normal. After retracting the landing gear and flap, the pilot flying deselected the synthetic vision mode on the left PFD. The check pilot continued to monitor the synthetic vision on the right PFD, and the issue did not recur during the flight. The aircraft subsequently landed at Paraburdoo Airport without further incident.
Flight data analysis
The flight data was downloaded from the aircraft condition monitoring system and analysed by the ATSB. Figure 1 depicts the calibrated airspeed and pitch angle from the start of the take-off roll. The change in pitch (pink line) from the pilot pulling back on the control column in reaction to the synthetic vision started at about 0145:30 in Figure 1.
Figure 1: Plot of selected data from the incident flight
Source: Aircraft flight data analysed by ATSB
Figure 2 shows the aircraft recorded GPS track, with the pink marker indicating the first significant increase in pitch attitude, and therefore the approximate point of radalt failure. The aircraft was then at about 250 ft above the runway.
Figure 2: Deviation of OWA (travelling from left to right) from runway centreline showing the estimated point of the radalt failure (in pink)
Source: Google earth and aircraft flight data analysed by ATSB
Incorrect instrument indications
After the incident, an engineering assessment determined that both antennas associated with the radalt system (one for transmit and one for receive) had failed, and had been in service for over 9,000 hours. The antennas did not have a life limit, but were required to be replaced ‘on condition’, which essentially meant that the antennas remained in service until they failed. After consultation with the avionics manufacturer, engineers replaced both radalt antennas and also the radar transmitter/receiver. No subsequent similar event has occurred on the aircraft. The engineers also replaced the GPS 2 antenna due to slower than normal acquisition of satellite navigation after power up, and updated the GPS databases, although it was considered that these did not contribute to the incident.
The engineers reported that this failure of the radalt antennas was likely to have resulted in the radalt winding down to zero, and the radalt low altitude diagonal bars to appear on the altitude tape to show the aircraft was close to the ground (below 550 ft) (see Figure 4 in Radio altitude below). Additionally, the radalt information was used in conjunction with the runway (and obstacle) information in the database to provide the synthetic vision system display. This resulted in the runway appearing to rise up towards the aircraft reference symbol on the PFD.
The movement of the runway to the left of the screen was probably associated with a small displacement of the aircraft to the right of the runway centreline. The wind at the time was from 094° at 9–11 kt, therefore largely a headwind component and the lateral displacement of the aircraft was unlikely to be a result of the wind.
As the radalt senses that the aircraft is nearing the ground, smaller lateral deviations from the runway centreline generate significant movement of the synthetic vision runway image.
Radio altitude
The radalt display is shown in green numbers on the PFD when the radalt data is valid and less than 2,500 ft (Figure 6). If the radalt data becomes invalid, the radalt digital readout is replaced with a radar altitude data (‘RAD’) annunciator and an amber RA 1 FAIL crew alerting system (‘CAS’) message is displayed. The crew did not receive any annunciations during this incident to indicate that the radalt had failed.
When the altitude displayed on the radalt is below 550 ft above ground level, low altitude awareness is displayed using diagonal yellow lines (Figure 3). During this incident, the crew noticed that the low altitude awareness symbology was displayed.
Figure 3: Radalt low altitude awareness display
Source: Honeywell
Synthetic vision system
The synthetic vision system fitted to the aircraft is depicted in Figure 4. It supplies a three-dimensional view of surrounding terrain, obstacles and runways based on a terrain database. Normal attitude, altitude and airspeed information is overlayed on top of the terrain display. The TAWS terrain database provides geometric altitude (obtained from the GPS) in order to display synthetic vision terrain and terrain related items such as runways and obstacles. During this incident, the synthetic vision system provided no failure annunciations.
Figure 4: Synthetic vision system example display
Source: Honeywell
Figure 5 shows a sample image of the runway scale for an aircraft on final approach for reference.
The synthetic vision system was not to be used for primary input or navigation, with the following warning issued by Honeywell in the Pilot’s Guide (used by the operator) to the avionics system:
A similar warning was contained in the Primus Apex Smart View supplement to the aircraft flight manual.
Both crew reported they were aware that the synthetic vision should not be used for primary navigation. When installed, the synthetic vision system is automatically activated at start-up but can be deselected by the pilot.
Aircraft reference symbols
The pilot flying was using the flight path indicator on the synthetic vision system. This consists of the flight director command bars (magenta symbol in Figure 6) and the flight path aircraft reference symbol (green symbol in Figure 6). The flight path indicator is a path-based mode and depicts the aircraft’s predicted flight path (not just aircraft pitch) and is affected by pitch attitude and the aircraft’s ground speed. It shows flight path angles[6] – up for increasing and down for decreasing flight path angles, whereas the traditional pitch-based mode depicts aircraft pitch angle. The flight path angle depicted in Figure 6 is -4°.
Figure 6: Synthetic vision and flight path indicator symbols
Source: Honeywell
Electronic standby instrumentation system
An electronic standby instrumentation system (ESIS) (or electronic standby indicator (ESI)), was fitted to the left of the pilot flying’s PFD. Figure 7 shows the pilot’s side PFD with the ESIS to the left of the main screen in another Pilatus PC-12 aircraft (not OWA). Note in this photo, the synthetic vision is on and the aircraft is over water.
Figure 7: Electronic standby indicator and main PFD in flight (not OWA)
Source: ATSB
Pilot comments
The two pilots were highly experienced; the pilot flying had over 11,000 hours total aeronautical experience and over 2,600 on the aircraft type, and the check pilot had over 15,000 hours total experience and 3,000 hours on type.
Both pilots commented that they had previously experienced failure of primary flight instruments at low level and at night in different aircraft (without synthetic vision systems). They had been able to disregard the erroneous or failed instruments and reference the standby instruments to maintain control of the aircraft and situational awareness. However, the prominence of the synthetic vision display is such that it is difficult to ignore erroneous information and locate valid information. Additionally, the pilot flying reported feeling a level motion sickness, probably associated with the combined effects of the prominent synthetic vision display and conflicting vestibular sensory information.
The combination of the runway and the radalt speed tape moving up gave the very strong illusion that the aircraft was going to hit the ground. The pilot flying reported that they realised something was wrong but could not initially figure out what it was. The image of the ground rising up and the runway disappearing rapidly sideways took the focus of the pilot flying away from anything else.
The pilot flying commented that the check pilot’s caution ‘attitude’ helped to redirect the pilot flying’s attention to the standby indicator. The check pilot could not easily see the standby indicator. Both pilots commented that the situation may have been more serious if operating single pilot or if they had already flown more sectors that night and been more tired.
The pilots commented that it was impossible to discern the valid attitude information on the PFD (overlaid on top of the synthetic vision) and revert to flying ‘power and attitude’ given the prominence of the erroneous synthetic vision information. While it is possible to deselect the synthetic vision, it requires two button presses or the use of the cursor control device to do so. That is very difficult to do at low level while maintaining control of the aircraft – keeping the right hand on the thrust lever and the left hand on the control column.
The Pilot Advisory Letter issued in response to this incident (see Safety action) reminded pilots to look at the primary flight indications presented on the PFD at all times. The pilot flying commented that it should refer pilots to the standby attitude indicator instead. The screen at the time of failure was simply too confusing to start looking for two small, white attitude bars. Similarly, to break the fixation on the erroneous information, it is important to look somewhere else at a different instrument – the standby indicator.
Most of the pilots’ training is done on board the aircraft, as they do not have access to a Pilatus PC-12 simulator. Although some system failures can be simulated, it is not possible to generate a false display as occurred in this incident.
Spatial disorientation
Spatial disorientation can occur when visual cues provide sensory inputs that are not matched by the motion sensed by the pilot through the vestibular senses. The discrepancy between the visual display showing the aircraft apparently descending towards the ground, and the lack of any consistent physical sensation, led to disorientation. The flight was conducted at night, and the pilot flying did not look outside for a visual reference. The check pilot did look outside and found that there was enough moonlight to provide some visual reference, sufficient to show the aircraft pitch and roll attitudes relative to the horizon.
ATSB research report ‘An overview of spatial disorientation as a factor in aviation accidents and incidents’describes this type of spatial disorientation as ‘recognised’. That is, the pilot identified that they were sensing erroneous information. The conflict between their own perceptions and that given by the instruments alerted them to a problem, which they were then able to address. However, the crew reported feeling some level of disorientation stress, or motion sickness, which is indicative of a disagreement between the senses.
The visual system provides around 80 per cent of orientation information, hence the overriding presence of incorrect visual information deprived the pilots of the majority of orientation information.
Other factors such as tiredness or fatigue, and high workload, can contribute to a pilot’s ability to assess and effectively deal with spatial disorientation. Both pilots commented that they wanted to share their experience because if they had been operating single pilot or near the end of a long shift, recovery from the instrumentation failure may have been much more difficult.
In addition, if the outside light conditions had been completely dark due to a lack of any moonlight in an area without terrain lighting, or the aircraft was in cloud, recognition of the spatial disorientation would have been reliant on the pilots being able to either extract the basic attitude, altitude and airspeed information from the primary display ignoring the background image, or revert to the accurate information depicted on the smaller standby indicator.
Pilots operating under instrument flight rules are trained to focus their attention on the visual information presented by the aircraft instruments and to ‘believe’ that information rather than the sensory information from the vestibular system, which can provide misleading cues.
The ATSB research report further states that:
…instrumentation should present a clear and intuitive sense of position, which the pilot under conditions of high stress and workload can instantly achieve an idea of what the aircraft is doing.
Failure of the aircraft instruments should hopefully never occur. However, in the event that it does, the pilot needs to receive clear and non-ambiguous indications of instrument failure. If a key instrument fails, such as the attitude indicator, the pilot needs to know that it has failed so they no longer depend on its information.
Manufacturer investigation
An investigation by the synthetic vision system manufacturer, Honeywell, found that the radio altimeter sent incorrect radio altitude data to the synthetic vision system while still indicating that the data was valid. Therefore, the synthetic vision display system continued to display the terrain information using incorrect data.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
Aircraft operator
The aircraft operator has advised the ATSB that they have taken safety actions including the following:
Engineering replaced the RADALT aerials across the fleet.
The minimum equipment list has been amended to include synthetic vision.
Flight crew were alerted to the potential hazard of a synthetic vision failure during flight through a safety communication on 1 July 2016. The potential for confusion or spatial disorientation during an event, particularly at night or in low visibility environmental conditions was highlighted.
The event has been discussed by the Training and Check Department. They are reviewing the possibilities of incorporating scenarios related to ambiguous/incorrect information from the primary flight display into check flights and have commenced trialling a scenario.
Honeywell – avionics manufacturer
As a result of this occurrence, the avionics system manufacturer has advised the ATSB that they are taking the following safety actions:
Pilot advisory letter
Honeywell issued a Pilot Advisory Letter (PAL-APEX-01) to all pilots, chief pilots and flight operations managers on 11 August 2016. The letter included a description of the event. The letter also advised pilots that the use of synthetic vision is for situational awareness and should not be utilised for the indication of attitude or altitude in lieu of the primary flight display indications for pitch, roll, yaw, or altitude. The letter advises pilots to follow the primary flight indications presented on the PFD at all times.
The letter was also made available on the Pilatus ‘my pilatus’ website and all subscribers to that website were notified by email.
System solution
Honeywell is investigating ways to make the synthetic vision system more robust against a similar failure. The focus of their investigation is to prevent the synthetic vision display from continuing to display the image when the data is incorrect but assessed as valid by the Radalt.
Safety message
Incorrect instrument indications that are not associated with a failure mode present pilots with a complex and challenging situation. This situation may be exacerbated during single-pilot (rather than multi-crew) operations, where there is a lack of external visual references (such as at night or in instrument meteorological conditions), under high pilot workload conditions, or where a pilot is experiencing an elevated level of fatigue.
The image of terrain on the primary flight display is powerful and compelling. This incident highlights the manner in which an inaccurate synthetic vision image can rapidly lead to a degree of spatial disorientation. Pilots need to ensure that they are familiar with the limitations of the synthetic vision system and how to effectively deal with erroneous information as well as system failure modes. Organisations that operate aircraft fitted with similar technology should ensure that appropriate information and training is available to pilots, including when and how it should be used when it is not approved for primary navigation.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 21 March 2016, a Cessna 172L, registered VH-XZZ, disappeared from radar about 7 NM (13 km) north-east of Byron Bay, New South Wales (NSW). The pilot was the sole occupant and, despite initial search efforts, the aircraft was reported as missing.
The accident is being investigated by the NSW Police Force on behalf of the NSW Coroner. The ATSB did not initiate a separate accident investigation; however, on 14 June 2016, the police advised the ATSB that the wreckage had been located and video recorded by the Royal Australian Navy. In addition, the police requested ATSB assistance with their examination the video footage of the wreckage.
To facilitate this support, on 15 June 2016 the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003. The ATSB completed its review of the video footage and provided a report to the NSW Police Force on 30 August 2016.
Any enquiries as to the planning for, or conduct or progress of the Coroner’s investigation into this accident should be directed to the:
State Coroner’s Court of New South Wales 44–46 Parramatta Road Glebe NSW 2037
Phone: (02) 8584 7777
_________________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
At about 0738 Central Standard Time (CST), a Cessna 172 aircraft, registered VH-EKV (EKV), taxied to depart from runway 12 at Alice Springs Airport, Northern Territory for Ayers Rock. The pilot and two passengers were on board the private flight. The air traffic control Tower was scheduled to open at 0800. At the time of departure, procedures for operating in the vicinity of non-controlled aerodromes applied at Alice Springs Airport. The airport has a common traffic advisory frequency (CTAF) when the Tower is closed.
The aircraft was located on the general aviation apron and taxied for holding point bravo for runway 12 (yellow line in Figure 1). The pilot of EKV broadcast a taxi call on the CTAF.
Figure 1: Alice Springs Airport showing the taxi routes and relevant locations of EKV (yellow line) and MLB (orange line)
Source: Google earth, modified by the ATSB
The transcripts of the relevant CTAF recordings are shown below, with the time, who made the broadcast, the transmission, and readability.[1]
Time
Source
Broadcast
Readability
0738:26
EKV
All stations EKV Cessna 172 taxiing for the runway 12 [AFRU[2] ‘Alice Spring CTAF’]
5. Perfectly readable
Following the broadcast by the pilot of EKV, several broadcasts were made on the CTAF where the airport rescue and firefighting service were conducting routine radio checks.
At 0741:15, the pilot of a Beech 58 aircraft, registered VH-MLB (MLB), broadcast a taxi call on the CTAF (the readability was 2, as the call was badly broken and very hard to understand). The aircraft was located on the commuter apron and taxied for holding point echo with the intention of then backtracking on the runway in preparation for a runway 30 departure (for a flight to Nyirripi) (orange line in Figure 1). The pilot and two passengers were on board the charter flight.
0741:15
MLB
Alice springs traffic MLB taxiing and backtracking runway 30 for Nirripi Alice Springs [AFRU tone]
2. Readable now and then
At 0741:25, the pilot of EKV broadcast that they were lining up on runway 12 (Figure 1).
0741:25
EKV
EKV lining up on 12 [No AFRU tone]
5. Perfectly readable
The pilot of MLB reported that they did not hear this broadcast from EKV, nor the earlier broadcast that they were taxiing for runway 12.
At 0741:30, the pilot of a Piper PA32 broadcast a taxi call (the readability was 3, with a loud squeal). The PA32 was located at the general aviation apron, close to where EKV had taxied earlier, and was taxiing for runway 12.
0741:30
PA32
Alice springs traffic [registration] taxiing runway 12 Alice Spring [AFRU tone]
3. Readable but with difficulty
The pilot of MLB responded to the broadcast by the pilot of the PA32, asking if they were happy for MLB to taxi (which included entering and backtracking the runway) for runway 30, and advised that they were ‘shortly to depart’.
0741:38
MLB
Aircraft taxiing runway 12 you happy for me to taxi runway 30 shortly to depart [No AFRU tone]
5. Perfectly readable
The pilot of the PA32 responded to that broadcast by indicating that they would hold short of runway 12.
0741:43
PA32R
Affirm [registration] will hold short [No AFRU tone]
4. Readable
The pilot of MLB responded, thanking the pilot of the PA32.
0741:47
MLB
MLB thank you [No AFRU tone]
5. Perfectly readable
Following this exchange between the pilot of the PA32 and the pilot of MLB, several broadcasts were made on the CTAF, where the airport fire and rescue service were conducting radio checks (at 0741:53, 0741:59, and 0742:02).
The pilot of MLB approached holding point echo and reported looking for other aircraft on approach or lined up on either runway (12 or 30). The pilot of MLB did not see any other aircraft and had not heard any other aircraft on the CTAF except for the PA32, so entered the runway and commenced backtracking runway 30 (orange line in Figure 1).
At about the same time, the pilot of EKV commenced take-off on runway 12. At about take-off speed, the pilot reported observing another aircraft enter the runway and start taxiing on runway 12 (away from them). The pilot assessed that it would be more dangerous to stop, so continued with the take-off.
An air traffic controller arrived in the control tower (which was due to open at 0800) and observed a Cessna 172 aircraft (EKV) taking off on runway 12 and a Beech 58 aircraft (MLB) taxiing on the same runway, about half way down the runway (Figure 1). The controller advised the pilot of EKV to stop immediately.
The pilot of EKV reported not hearing the advice to stop immediately, but was busy with the take-off. The controller reported that EKV was airborne approximately 500 m before the position of MLB and passed overhead MLB at about 150 feet above ground level. The pilot reported banking the aircraft to the north at about 500 feet and two-thirds of the way down the length of the runway to avoid any possible conflict with the aircraft (MLB) on the runway.
The pilot of MLB heard the controller’s advice to another aircraft to stop, but was not aware of the reason. During the turn at the end of the runway to line up on runway 30, the pilot noticed a Cessna 172 (EKV) in a left turn toward the north. The pilot broadcast on the CTAF for the aircraft in the Alice Springs circuit area to notify their intentions.
0743:57
MLB
Aircraft in circuit area at Alice Springs MLB just request your intentions [AFRU tone]
5. Perfectly readable
The pilot of EKV then gave a departure call at 0744:14 (readability was 4).
0744:14
EKV
EKV on climb to 3,000 departed time 14 [AFRU tone]
4. Readable
The pilot of MLB believed that the pilot of the Cessna 172 (EKV) had responded to their broadcast, and reported that the readability from the Cessna 172 was very poor. The pilot of MLB responded to the Cessna 172 at 0744:27, but that broadcast was over-transmitted by another aircraft making a taxi broadcast.
The next broadcast recorded from MLB was at 0747:19, where the pilot broadcast a departure call. The pilot reported having made lining-up and holding broadcasts, which may have been over-transmitted, and also making a rolling broadcast that was not recorded on the CTAF.
Both aircraft departed without further incident.
Pilot comment VH-EKV
The pilot reported generally operating at Alice Springs Airport when the tower was open, so would normally communicate with the tower controller. At the time of the occurrence, the Tower had not opened and the pilot reported hearing radio calls, but commented that radio calls from aircraft were not as clear as those made from the tower controllers. The pilot was aware that there was another aircraft departing to Nyirripi (destination of MLB).
Pilot comment VH-MLB
The pilot reported identifying the location of the PA32 as they approached holding point echo. The pilot commented that there were some white buildings in the distance behind the threshold of runway 12 that may have made it difficult to see EKV. The pilot indicated that the runway, although long, it is quite flat, and the whole runway was visible. The pilot also indicated that they were focused on known traffic. The pilot recognised the aircraft registration of the PA32 and the voice of the pilot, and confirmed the location of that aircraft before entering the runway.
The pilot reported that the winds were calm. They elected to use runway 30 as it was the most convenient runway for their departure.
Radio communication - Alice Springs airport
A study was conducted in 2010 by the Civil Aviation Safety Authority (CASA) to review the airspace classification above Alice Springs, Aeronautical Study of Alice Springs (YBAS) January 2010, and is available from the CASA website. The study consulted with stakeholders and did not identify any radio transmission ‘black spots’.
ATSB comment
The relevant communication recordings for the Alice Springs CTAF were obtained by the ATSB from Airservices Australia and the relevant broadcasts were given a readability level by the ATSB using the standard in radiotelephony communications as published in the AIP. The communications recorded are not necessarily what a pilot hears in their respective aircraft.
The ATSB could not establish why the pilots of both aircraft did not hear the broadcasts from the other aircraft.
Safety message
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One such concern is Safety around non-controlled aerodromes, which highlights that it is difficult for pilots to detect another aircraft through visual observation alone. The ATSB has identified that insufficient communication between pilots operating in the same area is the most common cause of safety incidents near non-controlled aerodromes.
This incident highlights the fundamental importance of effective communication, particularly during operations at a non-controlled aerodrome. The Civil Aviation Safety Authority (CASA) has produced several publications and resources that provide important safety advice related to operations in the vicinity of non-controlled aerodromes. Relevant guidance and explanatory material provided by CASA includes the following:
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
_____________________________
[1] As outlined in the Airservices aeronautical information publication (AIP), the readability scale is as follows: 1. Unreadable, 2. Readable now and then, 3. Readable but with difficulty, 4. Readable, 5. Perfectly readable.
[2] Alice Springs Airport has an aerodrome frequency response unit (AFRU) installed. The AFRU is to provide an automatic response to CTAF broadcasts to indicate to an operator that the correct radio frequency was selected and to confirm the operation of the radio’s transmitter and receiver, and the volume setting. If a broadcast has not been made on the CTAF in the preceding five minutes, and this transmission is over 2 seconds in length, a voice identification from the ARFU ‘Alice Springs CTAF’ is generated. If a broadcast has been made on the CTAF in the preceding five minutes, a 300-millisecond tone will be generated after each transmission over two seconds long.
On 15 June 2016, Sydney Trains’ maintenance staff identified the 64 crossover points[1] (64 points) at Clyde yard as unfit for service and arranged to book the points out of use. 63B points on the Up Main line were also booked out of service to prevent rail traffic from operating over 64 points.
On 18 June 2016, Sydney Trains’ maintenance staff obtained a Track Occupancy Authority (TOA) to protect civil rectification work on 64 points. The protective limits of the TOA extended only to defined clearance points on either side of 64 points and did not include 63B points.
At approximately 0530, as the repairs neared completion, two members of a signal maintenance team (SMT) tasked to test and certify the operation of 64 and 63B points, arrived at Clyde yard. Both members of the team entered the danger zone near 63B points where train W510 struck and fatally injured one worker.
What the ATSB found
Sydney Trains’ work-planning process, involving multiple work groups, did not assure the consideration of worksite safety for all tasks undertaken by each involved party over the duration of the work and when returning the rail infrastructure into service.
The Protection Officer (PO), who was part of the civil maintenance team, was aware of the signal team’s work tasks but did not consider these in his worksite protection arrangements. The PO had briefed the civil maintenance team, but did not brief the signal team, and the signal team did not seek a pre-work briefing before commencing work on-track. The PO was not provided with a briefing on the scope of the signal team work and did not provide protection at 63 points.
The signal team assumed their workplace was within the limits of the TOA and did not plan their own worksite protection. The signal team entered the danger zone unprotected and unaware of the approach of W510, and the Clyde Signaller did not recognise the signal team were in an unprotected area.
Network communications by various parties in Sydney Trains were not in accordance with the principles underpinning the network rules.
Although not contributing to the accident, the ATSB also found that Sydney Trains’ preference to keep the Up Main operational influenced the selection to use the clipped and locked 63B points to protect the worksite at 64 Points. The worksite protection method presented an increased risk in that if track workers inadvertently exited the worksite, they would be in the immediate vicinity of operational main line rail traffic.
The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite.
Finally, the lack of use of train headlights at night and the absence of any supplementary lighting (such as beacons) may have increased the likelihood of a train driver not seeing workers in the danger zone.
What has been done as a result
Sydney Trains delivered on a number of safety actions and commitments following the incident.
Some of the direct actions to address the contributing factors to the incident were:
Review and validation of proposed worksite protection plans is required through Sydney Trains’ Corridor Safety Centre.
Increased numbers of rail safety coaches and mentors, with a required coaching session for all Protection Officers at least once per year.
Protection Officers are required to implement a form of worksite protection at least once every quarter to remain eligible to be re-certified as a Protection Officer, this activity is monitored by the Corridor Safety Centre.
Additionally, Sydney Trains established a Post Incident Assurance Group (PIAG) to respond to the incident. This group established key focus areas to promote the safety of workers and avoid future incidents. These areas included; Worksite protection, Culture, Planning for maintenance work and Safety critical communications.
The PIAG later established the Safety Focus Program, which included key initiatives:
Safety Focus Sessions
Safety Culture Program
Improvements to Protection Officer selection and training
Signal Key Switch Project
Safety Critical Communication Enterprise Wide Program
Maintenance Access Planning Project, and
ATRICS ASB.
Safety message
This accident highlights the importance of planning and integrating safety across the entire scope of work. It also highlights the importance of briefing all workers and all workers seeking a safety briefing about the worksite protection plans before work commences and when circumstances change.
In the early morning of 18 June 2016, a civil maintenance team (CMT) neared completion of their work to replace sleepers under the crossover at 64 points in the Clyde Yard, New South Wales. A Track Occupancy Authority (TOA) protected the civil team’s worksite from approaching rail traffic.
A signal maintenance team (SMT) comprised of an electrician and mechanic were to then test and certify the operation of 64 points, and another set of points (63B) that had been booked out of service previously. During the testing, both members of the SMT left the area protected by the TOA to work on 63B points. As the SMT worked on the track at 63B points, an interurban passenger train (W510) travelling along the same track struck and fatally injured the SMT Mechanic.
Events triggering the civil task at 64 points
On 15 June 2016, a team of civil and signal engineering staff from Sydney Trains’ Clyde Network Base undertook an inspection of track infrastructure at Clyde Yard in response to ongoing drainage issues causing damage to the track and signalling equipment.
During the inspection, team members identified deficiencies associated with 64 points involving subsidence in the track formation material and decaying timber sleepers. The team categorised the deficiencies as an E2[2] defect and arranged Infrastructure Booking Authorities[3] (IBA) to remove 64 points and other signalling infrastructure from service. As an E2 defect required action to minimise risk within 24 hours, the team also recommended booking 63B points out of service to prevent trains accessing 64 points from the Up[4] Main Line (Figure 1).
On 16 June at 1020,[5] network based signal staff booked 63 points (A and B end) out of service and applied a point clip[6] to the ‘B’ end. On completion, the signal staff issued the signaller at Clyde Signal Box (Clyde Signaller) with IBA number 160616TPA, recording that 63B points were out of service. At 1340, network-based civil workers applied point clips to 64 points, issuing a separate IBA number 160616 to the Clyde Signaller.
The Clyde Signaller later identified the train plan could not be met for the Rosehill race event scheduled for 18 June 2016, as the IBA 160616 affected access to the siding leading off 64 points to allow storage of additional passenger trains on race day.
Planning of the civil task
On 17 June, the Assistant Area Manager, West Signal Box operations, sought advice from civil maintenance staff about the possibility of returning 64 points to service in time for the scheduled race day trains. Maintenance staff relayed the request to the manager for civil works based at the Clyde Network Base (Manager Civil), who initially denied the request due to the unavailability of sufficient materials, labour and plant.
After another request from train operations staff, the Manager Civil contacted the civil maintenance team leader (CMT Leader) who agreed to arrange labour for the repairs to the track at 64 points as an ‘emergency call-out’. Later that afternoon, the CMT Leader confirmed the availability of resources for the repair work to commence that night.
The civil maintenance team (CMT) were tasked with replacing a pattern of four timber sleepers under 64 points that had rotted, potentially affecting the safe operation of train services. The replacement of the sleepers would restore the condition of the track to comply with the Sydney Trains infrastructure standard. The Manager Civil allocated work tasks to the Protection Officer (PO) and CMT Leader near the end of their day shift. The expectation was that the work later that night would take about three hours to complete.
At 1442, the Signals Team Leader e-mailed the night shift SMT Electrician informing him the civil team would be fixing civil issues on 63 and 64 points that night and identified where the SMT Electrician would find the IBA and a handwritten disconnection list for various signalling infrastructure.
Figure 1: Site map of Clyde showing area of civil works and involved points
Source: Sydney Trains, annotated by ATSB
Arranging worksite protection for the civil task
At about 1900, the PO telephoned the Clyde Signaller to discuss the planned work and to enquire whether a Track Occupancy Authority (TOA) (see Network Rules) was required from the Clyde Signaller or if protections through the Pacific National Clyde Yard Master (PN Clyde Yard Master) were sufficient, as the PO understood 64 points to be within the PN yard[7]. The Clyde Signaller referred the PO to Pacific National for clarification.
About an hour later, the PO telephoned the Clyde Signaller to discuss further the rail infrastructure affected by the work. After confirming that the Clyde Signaller controlled 64 points, the PO discussed the requirement for a TOA to protect the worksite. There were several interruptions during the telephone call while the Clyde Signaller attended to other tasks. The PO informed the Clyde Signaller that he and the CMT Leader had to postpone discussions, as they needed to attend to a call-out at another location. They agreed to meet at the Clyde signal box on their return to continue planning the protection arrangements. In the meantime, the Clyde Signaller informed the Train Controller for the Goods Board (Goods Controller) of the PO’s plan for protecting the work in the Clyde Yard.
At about 2100, the SMT members commenced their rostered shift and began planning their night’s work, including reviewing e-mails from the signals team leader. About 30 minutes later, all of the CMT members had returned to work and signed on for their overtime shift at the Clyde Network Base. Shortly after, the SMT Electrician spoke to CMT members seeking additional information about the proposed work, who advised the SMT Electrician to contact the PO.
At about 2200, the PO provided a worksite protection pre-work briefing to the five members of the CMT, who each signed the worksite protection pre-work briefing form recording their attendance. The SMT were not asked and did not attend this briefing. However, the SMT Electrician reported making multiple attempts to contact the civil team in an attempt to understand the scope of works and timings. The SMT Electrician also recalled that around this time he contacted the PO who advised that the start time for the work on track was unknown.
At 2215, the Goods Controller contacted Infrastructure Control staff (ICON) enquiring if they knew of the civil work at Clyde Yard 64 points. ICON was not aware as Clyde Network Base had not informed them of the work. ICON undertook to confirm what was happening and contacted the CMT Leader to establish if they were to work on 64 points. ICON called the Goods Controller back to confirm that the civil team were working out protection with the Clyde Signaller, and to expect to hear from them.
Shortly after, the PO contacted ICON enquiring if they knew of the work at 64 points and again discussed the possible requirements for implementing a TOA. The PO and ICON discussed whether this required possession of the Main line as the PO maintained that the protecting signal must be greater than 500 m from the worksite[8] even though locking 63B points in the normal position already excluded rail traffic accessing 64 points from the main line. ICON questioned whether the PO really needed to take possession of the Up Main line referring the PO back to the Goods Controller.
The PO contacted the Goods Controller advising the need to take possession of the Up Main line and explaining that while locking 63B points in the normal position prevented rail traffic accessing 64 points, the points were within 500 m of the worksite. The Goods Controller referred the PO back to the Clyde Signaller to determine the TOA requirements.
Shortly after, the PO and the CMT members signed a ‘permit to work’ enabling access to the Pacific National (PN) managed portion of the Clyde yard. Around the same time, the PO contacted the Goods Controller advising the PN Clyde Yard Master would place blocking facilities[9] (blocks) in Clyde Yard preventing access to the worksite from the east and that the last PN train into the yard would arrive at approximately 0130.
While waiting for the last PN train to arrive, the CMT commenced some preparatory work in the PN yard area under the permit to work. During these preparations, members of the CMT accessed the track at 64 points to mark out the pattern for sleeper replacement and to remove some track fastenings. The work to remove the sleepers did not commence until after the last train had cleared and protection arrangements were in place for an excavator to cross tracks and access the worksite at 64 points (see Civil task at 64 points below).
At 2306, the Clyde Signaller and the Train Controller for the Outer Board (Outer Controller) discussed the protection needed for the work. The Outer Controller sought clarification of why a TOA would include the Up Main line to which the Clyde Signaller identified the 63B points were within 500 m of the worksite. The Outer Controller expressed the view that with 63B points clipped and locked in the normal position he could not see a risk, as trains could not access the worksite. The Clyde Signaller sought clarification if additional signal protections on the main line were necessary. The Outer Controller repeated that the only identified risk was from rail traffic entering from the east end of the yard, as the clip and lock on 63B points prevented rail traffic entering from the west end of the yard.
Shortly after, the Clyde Signaller contacted the PO confirming the work could go ahead with 63B points clipped and locked in the normal position. The PO again questioned the proposed protections, as 63B points were within 500 m of the worksite. The Clyde Signaller told the PO of the discussion with the Outer Controller and that they could not see a problem as long as 63B points were in the normal position and locked. The Clyde Signaller then advised the PO that the Outer Controller wanted to talk to him.
The PO contacted the Outer Controller repeating his view that protections had to be located 500 m from the worksite for a TOA. The Outer Controller replied ‘not necessarily’ and discussed with the PO that 63B points locked in the normal position ‘eliminated the risk’. The PO understood that the points excluded trains from the worksite but expressed an uncertainty about what protections were required and who would be approving them (Goods Controller or PN Clyde Yard Master). The Outer Controller informed the PO that an authority (TOA) was required, and advised he would talk to the Clyde Signaller about it.
The PO and Clyde Signaller then met at the Clyde signal box to discuss the details of the TOA in person before the Clyde Signaller called the PN Clyde Yard Master to inform him of the proposed arrangements for the TOA. The PN Clyde Yard Master was satisfied with the arrangements as long as it did not affect train movements in Clyde yard.
At 0005 on 18 June, the Clyde Signaller called the Outer Controller[10] to seek authorisation for the TOA. After going through the TOA details, and confirming the section was clear of traffic, and the signals had been set and blocks applied, the Outer Controller advised that TOA 35 had been authorised at 0011.
Civil task at 64 points
There was a delay to the start of the civil works until 0131 to clear a freight train movement into the PN yard before the CMT’s excavator could cross the tracks to access the worksite. After the freight train cleared, the Clyde Signaller advised the PO that he had placed blocks on several points (54, 56, 57, 60) to exclude rail traffic and protect the excavator as it accessed the worksite. The PO repeated the point numbers and recorded their details on the worksite protection plan.
At 0222, the Clyde Signaller informed the Outer Controller the IBA on 63B points would impact on the Race day program as the points were required to access the Up-storage siding. In a subsequent three-way telephone hook-up between them and ICON, the ICON representative informed the Clyde Signaller and the Outer Controller that he would get signals staff on the following day shift from Clyde Network Depot to book 63B points back in at about 0630. Around this time, the SMT Electrician contacted the PO advising they were in transit to the worksite when the PO asked them to collect a chainsaw en-route. The SMT arrived at Clyde yard at about 0318 and delivered the chainsaw before departing about 20 minutes later and returning to Homebush to wait for the work on 64 points to be completed.
At 0420, the PO called the Clyde Signaller to request an extension of TOA 35 by one hour to 0600, as the work was taking longer than expected. The Clyde Signaller confirmed the request with the Outer Controller before contacting the PO and extending the TOA.
Completion of the civil task and commencement of electrical testing of points 63 and 64
At 0523, the SMT Electrician contacted the PO to enquire on the progress of the civil works. He reported that he informed the PO that the SMT would not return until the TOA was back in place. The PO confirmed that the civil works were just about finished. Shortly after, the SMT arrived at the worksite and the SMT Electrician recalled that the PO told him there was a TOA in operation that would expire at 0600, but did not go into the details of the area that the TOA covered. The SMT Electrician recalled that there was no pre-work briefing provided by the PO and the SMT did not sign the pre-work briefing form. The PO recalled that he did not meet with the SMT on their return, so no pre-work briefing was possible.
At 0541, the SMT Electrician telephoned the Clyde Signaller to test the operation of 64A/B points. After removing a clip and lock, the SMT Electrician confirmed the correct operation of that point to the reverse and normal positions. The SMT Electrician then told the Clyde Signaller he would call him back when he got to the other end of 64 points.
At 0547, the PO contacted the Outer Controller to inquire if he could get a second extension to TOA 35. The extension of time was required to inspect the track before booking it back in to service. The Outer Controller advised the PO to contact the Clyde Signaller to arrange, as they could not extend a TOA more than once. The PO contacted the Clyde Signaller who then called the Outer Controller to arrange the second TOA, which was authorised as TOA 36. The Clyde Signaller then called the PO to provide details of the new TOA, confirming it was authorised and to fulfil TOA 35.
At 0604, the SMT Electrician telephoned the Clyde Signaller to complete testing of 64 points. The SMT Electrician then told the Clyde Signaller, ‘okay, I’m finished with 64…. Just got to take the point clip off 63’. The SMT Electrician then commenced walking toward 63B, while maintaining the mobile telephone connection with the Clyde Signaller. The Clyde Signaller asked the SMT Electrician to ‘hold on a minute’ while he contacted the Outer Controller to advise the time that TOA 35 was fulfilled.
Around the same time, the SMT Electrician had begun removing the point clip and lock from 63B points but had difficulty, so he called out to the SMT Mechanic to bring a podger (metal crow bar).
At 0607, the SMT Mechanic arrived at 63B point with the bar and took over removal of the point clip and lock. Both members of the SMT had entered the danger zone unprotected and unaware of approaching train movements. Concurrently, train W510 travelling on the Up Main line at a speed of about 67 km/h passed through Clyde Station and approached 63B points.
The SMT Electrician recalled he was conversing with the Clyde Signaller regarding the IBA for 63B points while opening the lid to the point machine to check for lock and detection when he noticed the approaching train and yelled a warning to the SMT Mechanic. About the same time, train W510 passed over 63B points, striking and fatally injuring the SMT Mechanic.
Figure 2: 63B points in normal position prevents movements towards 64 points
Source: ATSB
Post-collision
The collision caused the air brakes on the train to apply[11] and the train came to a stand about 20 seconds and 200 m later. The train driver contacted the Clyde Signaller informing him that the train had come to a stand after striking something then losing the air, and he could not build air pressure back up. The Clyde Signaller informed the train driver that the train had struck a worker on the track.
At 0611, the Clyde Signaller called the Outer Controller and requested the emergency services to attend to the site. The Outer Controller commenced notifications, initiated incident management procedures and commenced diverting other rail traffic from the area. He arranged with the Clyde Station Duty Manager and Sydney Trains Security for Police and Ambulance to arrive on site. At 0615, the Incident Response Commander received notification and arrived on site at 0653. A supporting Incident Response Commander arrived on site at 0720.
Clyde Yard is located in the Main Western rail corridor approximately 20.660 km[12] by rail from Sydney Terminal (Figure 3). Clyde is a junction of the Main West and Carlingford rail lines.
Figure 3: Location of Clyde
Source: NatMap, Railways of Australia, Geoscience Australia, annotated by ATSB
Clyde Yard is on the northern side of the Main Western line and is utilised by Sydney Trains for through movements and stabling of passenger trains and by Pacific National for the stabling of freight trains and limited maintenance activities.
Track layout at Clyde
The Up and Down Main lines and Up and Down Suburban lines at Clyde, between Auburn (18.551 km)[13] and Granville (21.148 km), are part of the Sydney Trains-controlled Metropolitan Rail Area network. Sydney Trains was responsible for track maintenance, signalling, network control and incident management functions in this corridor. The posted track speed for the Up Main line through Clyde station and over 63B points was 80 km/h for electric passenger services.
The Clyde signal box provided the control and monitoring function for all signals and points on the Up Main line around the 63 and 64 points together with other signalling equipment within the area of control. This area encompassed the Main West line spanning approximately 1.2 km to include the entry/exit to/from the Carlingford line, Pacific National freight yard (Country end) and Auburn Maintenance Centre (Country end). The control area abutted Auburn signal box (on the Sydney side) on the Down Main, Suburban, Relief and Through Roads, Granville signal box (on the Countryside) on the Up Main and Suburban lines, and Parramatta Road signal box on the Carlingford line.
The Pacific National rail freight yard consisted of a system of tracks used for shunting and marshalling of freight trains (Figure 1). The PN Clyde Yard Master[14] was responsible for coordinating, managing and directing the safety of all rail movements within the PN yard area.
Operational interfaces and staff involved
Train Controller
The primary responsibility of train controllers is to manage train paths for the safe and efficient transit of rail traffic. Train controllers and their supervisory staff were located within the Rail Management Centre (RMC) at Sydney Central Station along with representatives of other supporting functions including ICON, customer and information services, security, train crewing and train monitoring. The RMC provided 24/7 integration and coordination of all operational train services (both Sydney Trains and non-Sydney Trains services) in the area bounded by Nowra, Macarthur, Newcastle and Lithgow. For the works at Clyde on 17–18 June, the train controllers (Goods Controller and Outer Controller) had visibility of the layout and status of the points, signals and other monitored equipment at Clyde via an overview (mimic) panel.
Signaller at Clyde Signal Box
The primary responsibility of the Signaller is to issue Occupancy Authorities and control points, signals and other signalling equipment to manage routes for the safe and efficient transit of rail traffic through the area of their control. The Signaller is also responsible for issuing work on track authorities (LPA and TOA) and work on track methods.
The signaller at the Clyde signal box (Clyde Signaller) was a Sydney Trains employee with 34 years’ rail experience. The Clyde Signaller held the required qualifications and competency for the role performed and was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.
Although the Clyde Signal Box was located in close proximity to the worksite, the Clyde Signaller could not physically see the civil worksite at 64 points or persons moving within the worksite or yard area on 17-18 June 2016. This is because the signalling system is an electronic system that does not require a line of sight for the signaller to operate. In this instance, the Clyde Signaller’s work station faced away from the windows that looked out to the Clyde Yard and the worksite location (Figure 4 and 5). The Clyde signaller was not required or expected to watch the actual work activities in the Yard.
Figure 4: Clyde Signaller’s workstation
Source: ATSB
Figure 5: Daylight view of Clyde yard from Clyde Signal Box
Source: ATSB
Civil Maintenance Team
The civil maintenance team (CMT) comprised:
A PO (responsible for managing worksite protection)
an acting team leader (CMT Leader) responsible for managing the rectification work
three civil infrastructure workers under the direction of the CMT Leader
a third party contract excavator operator.
All members of the CMT, except the excavator operator, were Sydney Trains employees based at the Clyde Network Base. All the Sydney Trains CMT members had worked their rostered day shift between 0700 and 1500 prior to returning to work at 2130 to repair 64 points on an overtime shift.
The Protection Officer
A Protection Officer (PO) was responsible for managing the rail safety component of worksite protection to keep the work site and the workers in the work site safe from rail track movements. The PO was a Sydney Trains employee with five years rail experience. The PO held the required qualifications including a worksite protection competency (protection officer level 2) for the role performed and was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.
On 17 June, the PO commenced his rostered shift at 0539, although the PO was not involved in the planning of the repair work, he concluded his shift at 1500 with the understanding that the CMT would return later the same day and commence an overtime shift at 2130 and he would be arranging protection for this emergency work.
Signal Maintenance Team
The Clyde Network Base signals work group comprised two signal electricians and two signal mechanics, a Senior Signals Engineer and Signals Team Leader. The signals work group were responsible for checking signals and points were operable before going back into service, conducting out-of-course repairs and minor routine maintenance to signalling equipment and points throughout the rail network bounded by Clyde, Macdonaldtown, North Strathfield, Sefton and Marrickville. Additional areas of responsibility included the Up and Down Yards at Clyde, the Carlingford line, the Olympic Loop line, the Goods line at Chullora and Enfield Yard. The signals work group regularly worked with the civil maintenance teams undertaking repairs to track and other civil infrastructure.
General supervision and tasking of signal maintenance staff was the responsibility of the Senior Signals Engineer and Signals Team Leader. However, as these positions worked weekday business hours, there was little interaction outside business hours, with tasking routinely made via notes or e-mail.
The signal maintenance team members (SMT) involved in the accident included a signal electrician (SMT Electrician) and a signal mechanic (SMT Mechanic).
On the 17 June 2016, the Signals Team Leader emailed the SMT Electrician with the tasking and instructions for their shift that night. The Signals Team Leader wrote:
Tonight [CMT] will be chucking a few new timber in points in Clyde Up Yard. They are planning on starting at 2200. They will only be fixing the civil issues on 63 and 64 points not cleaning the rusty rails. On my shelf there is a disconnection list and IBA for you. Hopefully it goes smoothly. Also I’ve chucked a two Loc’s at CLJ onto T4 but it won’t let me attach them to this email so I sent a different one.
The SMT Electrician was a Sydney Trains employee with 13 years’ rail experience. The SMT Electrician held the required qualifications for the role performed as well as competencies in worksite protection (protection officer level 3). The SMT Electrician was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.
The SMT Mechanic was a Sydney Trains employee with 26 years’ rail experience. The SMT Mechanic held the required qualifications for the role performed as well as competencies in worksite protection. The SMT Mechanic was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.
Network Rules
The Sydney Trains Network Rules prescribe the requirements to manage safety on the network for train operations and working in the rail corridor.
NWT 300 Planning work in the rail corridor
Network Rule NWT 300 Planning Work in the Rail Corridor required a safety assessment of the work and of its potential to intrude on the danger zone. Work in the danger zone must use one of the protection methods listed below and not begin until the required safety measures were in place:
one of three authorities:
Local Possession Authority (LPA)
Track Occupancy Authority (TOA)
Track Work Authority (TWA)
or method of protection:
Absolute Signal Blocking (ASB)
or safety measure:
Lookout Working.
The level of safety must not be reduced to allow rail traffic movements and each work on track method had mandatory minimum safety measures with the highest protections provided by an LPA to the least provided by Lookout Working.
The preferred methods for working on track were the LPA and TOA. In addition to the safety assessment and selection of protection method, Network rule NWT 300 required the PO to:
brief workers about the rail safety component of worksite protection
make sure that the rail safety component of the work is done safely
keep records about the method used for working safely on track and protection arrangements, and
communicate with the Network Control Officer about the work.
Sydney Trains form NRF 015 Worksite Protection Plan defined the type and format of information recorded by an assigned PO. In completing the worksite protection plan for the civil works at Clyde 64 points, the PO had several discussions with operational staff to determine the protection arrangements for the work.
The PO’s initial plan for the TOA included locating worksite protection (track signals, flags/lights) on the main line, to provide the specified distance of 500 m between the worksite and the worksite protections. However, the Train Controller advised that there was no need for an occupancy on the main line, as with the 63B points clipped and locked in the normal position trains could not access the worksite area from the main line.
To clip and lock points, a qualified rail safety worker fits and secures a mechanical clamp to the track securing the point blades to the desired lie (normal or reverse). Once installed, the lie of the points cannot change until the point clamp is removed; ensuring the direction of any rolling stock movement is only possible in the configured direction (Figure 6).
Figure 6: Application or removal a point clip
Source: Sydney Trains, annotated by ATSB
NWT 304 Track Occupancy Authority
The basic principle of work-on-track rules is to provide clear separation between track workers and trains. A Track Occupancy Authority (TOA) achieves this by authorising exclusive occupation of track within specified limits for undertaking work on track, for an agreed period. Sydney Trains’ Network Rule NWT 304 Track Occupancy Authority prescribed the rules for authorising, issuing and using a TOA. The rule defines the TOA limits as being between yard limits, or between defined clearance points,[15] or may be a combination of the two. The worksite lies within the TOA limits and has defined boundaries/limits.
The network rule (NWT 304) defined the requirements for protecting both the TOA limits and for protecting the worksite. The rule stated:
Protecting TOA limits
- All points of entry into the TOA limits must be protected.
- The Signaller must apply blocking facilities[16] to prevent unauthorised rail traffic entry into the TOA limits.
In addition:
Protecting Worksites
- Worksites must be protected by three Railway Track Signals and red flags/red lights placed at least 500m from each side of each worksite.
Worksite within 500m of TOA limits
- Unless a set of points can be clipped and locked to prevent access to the portion of track within the TOA limits, the distance between the signal protecting the limits of the TOA and the worksite must not be less than 500m.
A second document, NPR 701 Using a Track Occupancy Authority, provides additional information regarding the procedures for using a TOA, including some examples illustrating the methods for protecting worksites.
Figure 7 illustrates the typical protection arrangements for a worksite on straight track. A signal at least 500 m from the worksite is required for the ‘Protecting Controlled Absolute Signal’. Blocking facilities applied to the protecting controlled absolute signal provides the primary method for excluding rail traffic from the worksite.
If a train driver inadvertently passes the protecting controlled absolute signal, the train would subsequently pass over the worksite protection (track signals, flags/lights) 500 m before reaching the worksite. This, in effect, provides a second layer of defence whereby the train driver receives a warning that they are approaching a worksite and must take action to prevent entry into the worksite.
Figure 7: Worksite protection
Source: NPR 701 Using a Track Occupancy Authority
Figure 8 illustrates the protection arrangements for a worksite where the protecting controlled absolute signal is within 500 m of the worksite, but a set of points is available to route trains on a track other than the one containing the worksite. In this scenario, the points must be set, clipped and locked for the alternative route to prevent trains accessing the TOA limits and the worksite contained within. The signaller could also apply blocking to the point controls as part of the protection arrangements.
Figure 8: Worksite protection
Source: NPR 701 Using a Track Occupancy Authority
When implementing the TOA on the night of 17 June 2016, the PO thought protection had to be implemented as per the scenario illustrated in Figure 7. That is, the facilities providing worksite protection were to be located on the main line, at least 500 m from the worksite.
However, after several discussions with train controllers, signallers and ICON, the PO was made aware the application of protections could be done as illustrated by the scenario in Figure 8. That is, since the IBA on 63B points meant they were set, clipped and locked for the main line, rail traffic was excluded from the track containing the worksite. The scenario also negated the requirement to place worksite protections (track signals, flags/lights) 500 m from the worksite. The solution proposed by Sydney Trains’ operations staff provided the operational advantage of not occupying the main line, leaving it active for the passage of rail traffic.
Worksite protection arrangements
The Network Rules for work on track require the PO to brief the workers about the site-specific hazards and the protection measures in place before work begins. The Site Supervisor may also provide a briefing of the work planned. The PO must record details of the worksite protection pre-work briefing and the workers who attended the briefing, or amendment to the briefing, on the Network Form NRF 014 Worksite Protection Pre-work Briefing.
Additionally, the Sydney Trains’ guidance document Working Safely Handbook advised it was a responsibility of all workers to ensure they attend a pre-work brief before starting work.
Implementation of the worksite protection and pre-work briefing for civil works
The PO undertook the worksite protection pre-work briefing with the CMT members at the Clyde Yard. The briefing documentation included the Worksite Protection Plan (WPP), Pre-work Briefing form (PWB) and documentation specific to the use of an excavator under live overhead wiring.
The WPP and PWB required the PO to produce or attach a diagram/map to represent the worksite protection arrangements. The PO in this instance used a Drivers Route Knowledge Diagram (DRKD) to illustrate the location of points, signals, tracks, protections and safe areas.
The DRKD did not identify all signals and points used by the PO and Clyde Signaller to protect the movement of the excavator when crossing the tracks to access the worksite (Figure 9).
Figure 9: Photograph of PO’s work plan with annotation on the DRKD
Source: ATSB, annotated by ATSB
The PO annotated the DRKD to record that the Clyde Signaller applied blocking facilities to 54, 56, 57 and 60 points that were outside the limits of TOA 35. The limits of TOA 35 were the Clyde end of Storage Siding to Down through Road between 23L Signal and 24R Signal and indicated by a light green highlighted area on the DRKD (Figure 9). In order to protect the limits of the TOA, the Clyde Signaller placed 23L and 24R signals at stop and applied manual blocking facilities on the route and track (including points) ahead of those signals. The application of the blocking facilities was a second layer of control to prevent the inadvertent clearing of the signals and movement of points.
NGE 204 Network communication
The procedure NGE 204 Network communication prescribed the rules for spoken and written communication in the network. In principle, Sydney Trains required that communications must be clear, brief and unambiguous, relevant to the task, and agreed as to its meaning before being actioned.
If the communications related to safeworking arrangements, parties must utilise the 24-hour clock, phonetic alphabet, spoken numbers and standardised terminology to identify items such as train and signal identifiers.[17] The procedure mandated the receiver of the message repeat the message back to the sender for communications such as a work on track authority and work on track train running information. NGE 204 contained a ‘WARNING’ that:
Qualified Workers must not assume that a receiver has understood a message before the receiver confirms that the message has been understood.
After returning to work, the PO communicated with various train controllers and the Clyde Signaller to discuss the civil work requirements, and establish the work location in the Clyde yard relative to areas of control and the method for applying worksite protections. Similarly, the train controllers, Clyde Signaller and PO communicated to establish and record details of the safeworking arrangements associated with the TOA’s.
Passenger service W510 and train crew
Train W510 was an intercity electrical multiple unit passenger service operated by NSW Trains. W510 was crewed by a driver and a guard. It consisted of the lead set V26 made up of cars 8081 (lead car), 9105, 9037 and 8077; and the rear set V21 made up of cars 8032, 9032, 9036 and 8036.
The service departed from Lithgow at 0338 and was on schedule. The service, carrying 49 passengers, had just departed from a scheduled stop at Granville and was travelling according to ‘proceed’ signal indications on the Up Main Line toward the next scheduled stop at Strathfield. The train was travelling at 67 km/h at the time of the accident. The collision activated a trip mechanism causing the release of brake pipe air and automatic application of the train brakes. The train continued for a further 19 seconds travelling approximately 200 m before coming to a stop.
Train crew
The driver had 20 years’ rail experience, which included 16 years’ driving passenger and freight trains. The driver, from the NSW Trains depot at Lithgow held the required qualifications for the role performed. The driver was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.
The guard was travelling in the last carriage 8036, and did not have any involvement in the accident sequence.
External train lighting
The Rail Industry Safety Standards Board (RISSB) coordinated the development of Australian Standards, Codes of Practice, Guidelines and Rules for the rail industry.[18] RISSB developed a standard for rail traffic lights and markers.[19] Adoption of the RISSB product was not mandatory and it was the responsibility of the Rail Transport Operator to develop a train lighting standard relevant to the safety risks being managing within its network. Sydney Trains, as an accredited rail transport operator,[20] developed a train lighting standard specific to its network requirements.
Sydney Trains lighting standard
Network rule NTR 406 Using train lights prescribed the use of train headlights for the Sydney Trains Network requiring:
Trains must have a working headlight fitted to the leading locomotive, and travel with the headlight switched on, when the train travels beyond the:
- Sydney area, including intermediate branch lines, bounded by Helensburgh, Macarthur, Emu Plains and Cowan, or
- Newcastle area, including intermediate branch lines, bounded by Newcastle, Fassifern and Islington Jct, or
- Wollongong area, including intermediate branch lines, bounded by Thirroul and Unanderra.
NOTE Unless headlights are needed for safety, trains fitted with headlights must have their headlights switched off when travelling through the areas prescribed above.
Switching headlights offHeadlights must be switched off during approach to another train.Headlights must be switched off or dimmed during approach to:
- A motor vehicle on a nearby road
- A platform
- A signal box
- A location where shunting is in progress
Headlights may be switched off to prevent back-reflection into a driver’s or track vehicle operator’s eyes.
Before headlights are temporarily switched off, visibility lights, if fitted, must be switched on.
Sydney Trains rules therefore required the driver of train W510 must, unless needed for safety, have the headlights switched off as it was operating within the Sydney metropolitan area and near the Clyde Station platform and Clyde Signal Box.
Event recorders from W510 and the Clyde Station CCTV footage confirmed the driver had extinguished the headlights of train W510. The leading car displayed two white marker lights; two visibility (ditch) lights and one coupler light (Figure 10).
The marker lights (top left and right) indicated the front (white) or rear (red) of a train. Ditch lights (bottom left and right) illuminated the track immediately in front and improved detectability of the train. The coupler light provided illumination to assist train crew in coupling/uncoupling passenger cars when required.
Figure 10: Train lighting on front of W510 as it approached Clyde Station
Source: Sydney Trains, annotated by ATSB
The primary purpose of visibility lights was to improve detectability of the train by road users. The engineering standard detailing the minimum operating standards for rolling stock[21] specified the visibility lights were to project at least 25 m in front of the vehicle at top of rail and then be aimed/turned cross-eyed to between a minimum of 7.5 degrees and maximum of 15 degrees to the longitudinal centreline of the vehicle (Figure 11).
Figure 11: Side view and Top view of visibility light aiming
Source: RSU 600 Series – Minimum Operating Standards for Rolling Stock – Multiple Unit Train Specific Interface Standards v 1.0
Figure 12, taken from a similar Sydney Trains K-Set type car showing the typical illumination pattern and forward illumination of the track provided by the visibility lights.
Figure 12: Similar train type showing visibility (ditch) lights illuminating track ahead
Source: ATSB
Environmental factors
The morning of 18 June 2016 was cool and cloudy with 4.8 mm of rainfall recorded in the 24 hours to 0900. The overnight minimum temperature was 12.4 °C as recorded by the Bureau of Meteorology at Sydney Olympic Park, approximately 5.3 km (East) from Clyde station.
At the approximate time of the accident, there was little ambient lighting in the area around 63B points. The floodlighting used by the CMT during the sleeper replacement works was off and the CMT team leader and SMT were working on the tracks using torchlight.
CCTV footage from Clyde Station and the nearby Auburn Maintenance Centre illustrated the likely level of ambient lighting present and the presence of steady rainfall around the time of the accident (Figure 13).
Figure 13: CCTV footage depicting environmental conditions as W510 passed through Clyde station moments before the accident
Source: Sydney Trains, annotated by ATSB
A site visit on 22 June 2016 conducted at a similar time to the accident photographed the ambient lighting conditions at 63B points (Figure 14). The train service shown had a similar lighting configuration to the lead car on train W510. A slight increase in illumination in close proximity to the front of the train due to the visibility lights is evident.
Figure 14: Ambient lighting near 63B points on 22 June 2016
Source: ATSB
Conspicuity of workers on or about the track
All rail safety workers when on or about the track, are required to wear approved Personal Protective Equipment which included high-visibility safety vests/wet weather attire with reflective markings.
The SMT Electrician was wearing standard cotton drill pants and high visibility reflective shirt and the SMT Mechanic was in similar attire but additionally wearing a recommended wet weather jacket that also had high-visibility reflective striping over the shoulders, with a cross on the back and strips around the cuffs. In darkened conditions, reflective clothing exhibit little utility unless they were self-illuminating, or exposed to some form of external light source that caused them to reflect.
To mitigate risk in low light conditions, Sydney Trains Safe Work Instruction D2015/7605 Use of Flashing Beacons in the Danger Zone at night[22] required workers to display a flashing beacon when entering the Danger Zone at night. Sydney Trains identified the use of flashing beacons as an effective means of improving the visibility of workers operating within the danger zone at night. The beacons were designed to increase rail traffic driver’s visibility of workers at night. Each workgroup required at least one beacon, with additional beacons displayed where there was a distance of more than 50 m between workgroups. Positioning of the beacons were required to ensure they are clearly visible to approaching train drivers.
The Sydney Trains instruction and related SafeTracks bulletins identified that:
The use of flashing beacons does not reduce or replace the requirements in the Network Rules or Procedures relating to worksite protection.
Neither the CMT nor SMT members deployed flashing beacons at the worksite or wore them individually during the works at the Clyde yard on the 17 and 18 June 2016.
Fatigue management
The National Transport Commission (2008) defines fatigue as:
A human condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep. It includes physical, cognitive, psychological and physiological dimensions that interact with each other to reduce human performance and lead to uncontrollable sleep onset.
Humans cycle through numerous circadian rhythms with daily peaks and troughs. The National Rail Safety Guideline on Management of Fatigue in Rail Safety Workers (NTC 2008) highlights aspects of circadian rhythms that are relevant to fatigue management of rail safety workers. Alertness, physical and mental performance both reach their circadian low in the early morning (between about 0300 and 0500) when the physiological drive for sleep is greatest. The occurrence happened shortly after the circadian low.
Sydney Trains were required to manage the risk of fatigue in its rail safety workers. This included scheduling of work to allow for sufficient sleep opportunity as well as systemic management of fatigue through Fatigue Risk Management Systems. The Sydney Trains Fatigue Risk Management program included procedures on how to manage fatigue risk and the rostering principles outlined the safe hours of work (maximum of 12 hours) and rest (minimum of 12 hours) for typical hours of duty and planned overtime.
The operating procedure for the management of fatigue risks[23] outlined a risk management approach to identify, assess and implement control measures to mitigate risk exposure to rail workers in workgroups and worksites where shift work and extended hours’ arrangements were undertaken.
The investigation explored the possibility that the time of day, working during the circadian low point (3am to 5am) and the rostered work hours may have contributed to an increased feeling of fatigue in some of the workers on duty that night.
The ATSB assessed the probable fatigue levels of the SMT members, the CMT Leader, the PO and Clyde Signaller. Information taken into account included sleep (quantity and quality) in the previous 24 hours, workload, time at work, work break (rest and food) opportunities, and the use of two bio-mathematical fatigue models (FAST and FAID).
Of the workers assessed, shift duration and the time of day affected them equally and were assessed to have a moderate likelihood that their alertness on duty may have been affected.
Only the PO and the CMT Leader were assessed as likely to be experiencing a level of fatigue known to affect performance. However, in the context of the work tasks they were involved in on the night and their performance of these tasks, the ATSB did not consider their level of fatigue influenced decisions made on the night of the accident.
Drug and alcohol testing
The Rail Safety National Law (NSW) prescribed the post-incident testing of a rail safety worker for the presence of a proscribed drug or alcohol. The legislation required rail safety workers involved in a prescribed incident to undergo a breath test and provide a sample (oral, blood, or urine) within 3 hours of an incident. The Shift Manager within the RMC coordinated the testing of Sydney Trains rail safety worker/s directly involved in a prescribed incident.
Between 0640 and 1000 on 18 June 2016, the two-crew members from W510, PO, Clyde Signaller and the SMT Electrician undertook the testing and all parties returned a negative result.
The toxicology results from the post-mortem showed no presence of alcohol or other drugs in the deceased.
For any track rectification work, the section of track requiring work needs: firstly, to be booked out of service; secondly, worked upon and rectified; and thirdly, tested and booked back into service. At each stage, where workers are required to access or occupy the rail track, suitable safety measures are implemented to protect those people on track.
Each phase of work can be and was often completed independently.
For the work on 64 points crossover, 63 and 64 points were booked out of service on 16 June 2016. The signals team booked out and clipped 63 points and arranged their own protection to do this safely. The civil team booked out 64 points and arranged their own protection to do this safely.
For the rectification works on 64 points crossover, the civil team implemented safety measures that protected the workers at 64 points.
For the electrical testing of 63 and 64 points prior to booking them back into service, the SMT could have done this independently of the civil team. However circumstances on the night meant the two work teams and their tasks interacted.
At no point prior had there been any discussion about planning for the work teams to interact and how to manage safety of the workers should this scenario occur.
Sydney Trains’ system controlled this scenario by requiring the PO or Supervisor to provide a pre-work brief and for the PO to ensure all workers sign the pre-work briefing form. In the vast majority of cases, this singular control had been effective.
For the work on 64 points crossover, the local management chose to conduct the work under emergency provisions and planning was completed close to the start of works.
The job did not go to plan with significant delays to the start time and during the job. At the time the SMT arrived on site to electrically test points and “support the civil team”, the PO and Supervisor were pre-occupied managing the work and did not brief the SMT.
Sydney Trains’ planning process for emergency works was ineffective in that it tolerated local management at Clyde Network Base triggering the repair of the defective sleepers under emergency work provisions to expedite the return of a siding track into service for stabling race day trains the following day without consideration of the full scope of work.
The responsibility for coordinating access to the track for the repair work and planning for worksite protection subsequently transferred on the night of the works from local managers to the CMT team leader, SMT team leader and PO respectively. The CMT team leader and PO were directly involved in planning the sleeper rectification work and its worksite protection. The SMT members were not involved in planning the work and the SMT Electrician only received instruction from the Signals Team Leader via an e-mail read at the commencement of the SMT Electrician’s night shift.
The instruction contained in the e-mails from the Signal Team Leader to the SMT Electrician were ambiguous appearing to link 63 and 64 points to the proposed civil works. This likely influenced the perception of the SMT Electrician that the 63B points were part of the civil task and the assumption that they would therefore be within the limits of the protections implemented by the PO.
Although the PO was aware of the requirement for the SMT to attend at the Clyde yard toward the end of the civil work, the PO directed his attention to the immediate task of accessing the track and implementation of worksite protections for the commencement of civil work at 64 points. The SMT members were not asked and did not attend the pre-work briefings involving the CMT workgroup conducted by the PO at either the Clyde yard or PN yards.
It was likely that the PO considered the SMT were functioning as a separate workgroup managing their own protections. Consequently, there was no consideration in the planning for the civil work, or the associated worksite protections, of the scope of work intended by the SMT as a part of the civil workgroup or as a separate workgroup interfacing with the civil group to remove an IBA and return rail infrastructure into service.
Fatigue management
Circadian effects, time on task (including breaks between shifts) and inadequate sleep opportunity are some of the recognised primary risk factors for fatigue related performance degradation. The Signal Mechanic and the Signal Maintainer were working to their normal rostering pattern and mostly likely the least affected, if at all, by fatigue.
The Civil Protection Officer and the Civil Team Leader were rostered on a day shift and then after a 4-5 hour break returned for the emergency overtime shift. The length of the break in between shifts was significantly less than that applied from the Sydney Train’s typical rostering principles requiring a minimum of 12 hours’ rest to allow for recovery and sleep. The break, considering time allocated for commuting, meals and hygiene, allowed for considerably less than 5 hours sleep, which according to Dawson and McCulloch (2005), would be ‘inconsistent with a safe system of work’. With the limited sleep obtained and limited sleep opportunity provided between shifts; it is likely that the Protection Officer and Civil team Leader were experiencing levels of fatigue known to affect performance. However, in the context of the work tasks they were involved in on the night and their performance of these tasks, the ATSB did not consider their level of fatigue influenced decisions made on the night of the accident.
The planning and approval processes for the emergency works at Clyde yard did not consider, in the case of the PO and Civil team leader, the possibility and consequences of worker fatigue during the emergency overtime works arising from limited rest opportunity between shifts, time on task and extended wakefulness increasing the risk of fatigue and fatigue-related errors. With the absence of oversight by line management, the risk control for the management of fatigue relied solely on self-assessment by the workers onsite.
Worksite protection arrangements
At about 1900 on 17 June 2016, the PO contacted the Clyde Signaller to initiate discussion about the night’s work. At that point, the PO was seeking advice whether the permit to work within the PN yard adequately protected the worksite and the need to take out a TOA from Sydney Trains. Over the following 5 hours, multiple phone conversations between the PO and various parties discussed the work and necessary protection arrangements.
While the PO participated in a number of these discussions, many were between various operations staff to determine how to apply the proposed protection arrangements. By about 2320, the train controller confirmed that a TOA was required and advised the PO there was no problem with using 63B points clipped and locked in the normal positon as protection against trains entering the worksite from the main line.
The PO repeatedly raised his understanding that if the protecting controlled absolute signal was within 500 m of the worksite, an occupancy of the main line was required to provide a 500 m separation between the worksite and the worksite protections, he was not aware the Network Rules afforded an alternative option but accepted the advice of other operations staff.
Following the completion of the pre-work briefing and an hour later, the PN permit to work, members from the civil work group accessed the danger zone at 64 points to undertake preparatory work. Although no trains were in the area at that time, and with points 63B clipped in the normal positon mechanically preventing access by trains from the main line, CMT personnel had entered the danger zone and commenced work around 2 hours before the required safety measures were in place through the authorisation of TOA 35.
By the time civil works neared completion, there was no record of the SMT members participating in a pre-work briefing with the PO before accessing the worksite to commence their work. At this time, the civil workgroup members were preoccupied with packing up equipment. Around the same time, the PO was arranging with operations staffs to take out another TOA (as TOA 35 was to expire), so the civil team leader could complete a final inspection of the track before returning it to service. The civil team member’s and PO’s attention was almost certainly directed toward completing their tasks as soon as possible and not the activity of the SMT.
There were recollections of discussions between SMT and CMT members upon the SMT entering the civil group’s worksite area and when commencing tests of the electrical functionality of 64 points. None of the discussions pertained to the limits of the TOA or extent of worksite protections.
There were variances in recollections between the civil team leader, SMT Electrician and PO of the content of the verbal exchanges that occurred regarding the TOA and worksite protection arrangements in place. It is likely that:
The PO understood the SMT and their task were separate to the civil task and workgroup, and therefore assumed they would arrange their own worksite protections to undertake the electrical testing of points as experienced on previous occasions when a signals work group were involved with a civil work group.
The SMT members were aware a TOA was in place protecting the civil worksite but were not alerted to the TOA limits and details of worksite protections during the verbal exchanges with civil team members onsite.
The SMT members had formed an assumption, based on information provided to them at the beginning of their rostered shift that, points 63B were included in the civil scope of work and would therefore lie within the limits of the TOA.
There was no evidence that the SMT received, or sought to receive, a formal pre-work briefing from the PO about the rail safety component of worksite protection prior to commencing their work on 64 points. The Sydney Trains’ network rules for work in the rail corridor placed responsibility on the PO and Site Supervisor to brief workers, but did not similarly compel a worker arriving at a worksite to ensure they sought out the PO/Site Supervisor, explained their task, and did not commence any work until the requirements of pre-work briefing were completed.
The absence of an understanding of the TOA limits and its associated protections, together with the lack of track signals, flags/lights or any additional facility to remind/alert workers of the worksite limits, the SMT members unknowingly exited the protected worksite area and into the immediate vicinity of operational main line rail traffic.
The SMT Electrician commenced the removal of the point clip potentially compromising the effectiveness of the protections associated with TOA 36. Although the SMT Electrician was in mobile phone contact with the Clyde Signaller and narrating his intended actions, the Clyde Signaller did not realise the SMT had exited the protected worksite area. This was likely due to the Clyde Signaller directing attention toward fulfilling TOA 35 with the Outer Board Controller.
Following the fulfilment of TOA 35 at 0600, the subsequent issuance of TOA 36 maintained worksite protections for the Sydney Trains network. However, the authority to occupy the track provided by the PN permit to work expired at 0500. There is no record of an extension of the PN permit to work between 0500 and the fulfilment of TOA 36 at 0654.
Worksite protections of a TOA
The fundamental principles of the work-on-track rules were to provide clear separation between track workers and trains. A TOA achieved this through providing exclusive track occupancy for track workers undertaking work on track.
Under a TOA, worksite protection (track signals, flags/lights) was normally placed at least 500 m from the worksite and blocking facilities applied to all entry points into the TOA limits. In effect, this provided a buffer zone of at least 500 m outside a worksite, plus a further train exclusion zone in excess of 500 m from the worksite. That is, trains must stop at the protecting controlled absolute signal. If a train inadvertently passes the protecting signal, then the train will trigger the audible track signal warning devices at least 500 m before reaching the worksite (Figure 15). This delivered an additional level of control to track workers by providing advice of an approaching train.
Figure 15: Worksite protection
Source: NPR 701 Using a Track Occupancy Authority – modified and annotated for clarity
The TOA rule (NWT 304) and procedure (NPR 701) also provide for a scenario where the protecting controlled absolute signal may be less than 500 m from the worksite, so long as points can be clipped and locked for a different route. It was this scenario that was considered for the night of 17 June 2016.
In this case, the authority (TOA 35) defined the limits as the track between 23L signal and 24R signal. This also reflected the worksite boundaries since both signals were relatively close to 64 points. No further protection was provided on the main line, since 63B points were already clipped and locked. Consequently, the main line remained available for unrestricted rail traffic while work was undertaken on 64 points (Figure 16). This method did not provide advice of approaching trains on the Up Main.
Figure 16: Worksite protection
Source: ATSB
Under the arrangements implemented on 17/18 June 2016, the buffer zone between the worksite and unrestricted main line rail traffic was considerably less than 500 m, noting the distance between the worksite and 63B points was about 50 m. It is evident that under this arrangement, there is an increased probability, a track worker could move along the track, inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. The arrangement did not include any additional audible or visual warning devices for approaching trains, or any facilities for reminding track workers of the worksite limits.
In addition, the arrangement allowed main line rail traffic to operate normally over the facilities used for protecting the TOA limits and worksite, a condition not permitted under any other protection arrangement defined in the TOA rules.
The worksite protection method presented an increased risk, in that track workers might inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. Sydney Trains network rules and procedures for a Track Occupancy Authority did not identify the increased risk associated with the chosen worksite protection method.
Conspicuity of track workers on or about the track
Unless needed for safety, Sydney Trains network rules required drivers to extinguish train headlights within selected metropolitan areas. At the time, Sydney Trains was accredited to operate with headlights off based upon a risk assessment that highlighted the potential hazards of the headlight glare dazzling approaching train crews or other persons in or adjacent to the railway.
In low ambient light conditions, high-visibility garments rely on light reflected from their surface to be directed back along the path of the incoming light beam. An observer will not gain the benefit of a retroreflective article unless he/she is observing it from a position closely aligned with, usually just behind, the light source.[24]
On the morning of 18 June 2006, the area near 63B points presented as a low light condition. The SMT members were using handheld torchlights directed towards their work (63B points).
Although the Sydney Trains safe work instruction mandated the use of flashing beacons at a fixed worksite or by individual workers in the danger zone, neither the CMT nor SMT members deployed flashing beacons at the worksite or worn individually during the works at the Clyde yard on the 17 and 18 June 2016.
Since the accident, Sydney Trains engaged a team of human factors specialists to conduct a review of the use of personal flashing beacons. The study found that personal flashing beacons were ineffective in many situations due to the beacon being lost within other artificial lights within the driver’s field of view. They also found use of beacons transfers the responsibility of safety to the driver and may provide a false sense of security to the rail safety worker. The study further found the beacon may be out of the driver’s line of site depending on the location the beacon is worn on the rail safety worker.
While addressing risks associated with headlight glare, the practice of extinguishing the headlights and reverting to visibility lights may have increased the risk that a train driver would not sight workers on or about the track during times of low ambient light conditions.
Effective communications
Network procedures prescribing the rules for spoken and written communication in the network acknowledged that effective written, radio and telephone communication was essential for safety in the network. The voice recordings of the telephone conversations between the train controller/s, Clyde Signaller and PO in determining the method for applying worksite protections associated with the TOA were conversational, centred toward discussing pros and cons of the protection options available under the rules for using a TOA. The conversations occurred over a five-hour period between the parties (at remote locations from each other) and featured some minor misunderstandings/confusion, which resulted in several repeat exchanges to clarify views. While there was a considerable exchange of information, combined with sporadic distractions to perform other functions associated with the individuals’ respective roles, the parties understood and agreed on the requirement for an authority and that the clip on 63B points provided worksite protection within the TOA, avoiding an occupancy on the main line.
Other voice recordings between the parties addressing the safeworking arrangements for the TOA were also primarily conversational and in some instances subjected to sporadic distractions. Although the parties did not adhere to the procedures for spoken and written communication, the information relayed and recorded on the TOA’s was correct and understood by the Clyde Signaller and the Civil Team.
A telephone conversation occurred between the SMT Electrician and the Clyde Signaller immediately before the collision during which the SMT Electrician asked the Clyde Signaller to operate 64 points to confirm the correct operation. The SMT Electrician advised testing of 64 points was complete before commenting that he had to take the point clip off 63. The Clyde Signaller did not respond to the SMT Electrician, remaining silent as the SMT Electrician walked towards 63B points. As occurred on previous occasions, the Clyde Signaller’s attention diverted briefly during the call toward another task, which was to communicate the fulfilment of TOA 35 to the Outer Controller. When returning to the call with the SMT Electrician, in which the SMT Electrician mentioned difficulty in removing the point clip, the Clyde Signaller did not recognise that the SMT members were in the danger zone and unprotected from the approaching train W510.
Although the network procedures require spoken communication to be clear, unambiguous and agreed to its meaning before being acted upon, the information relayed during the telephone conversation between the SMT Electrician and the Clyde Signaller during testing of the points was insufficient to alert either party that 63B was an unprotected work area.
From the evidence available, the following findings were made with respect to the track worker fatally injured when struck by train W510, Clyde, New South Wales on 18 June 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
Sydney Trains’ work-planning process, involving multiple work groups, did not assure the consideration of worksite safety for all tasks undertaken by each involved party over the duration of the work and when returning the rail infrastructure into service. [Safety Issue]
The PO civil was aware of the signal team’s work tasks but did not consider these in his worksite protection arrangements.
The PO had briefed the civil team, however did not brief the signal team, and the signal team did not seek a pre-work briefing before commencing work on-track.
The PO civil was not provided with a briefing on the scope of the SMT work and did not provide protection at 63 points.
The signal team assumed their workplace was within the limits of the TOA and did not plan their own worksite protection.
The signal team entered the danger zone unprotected and unaware of the approach of W510.
The Clyde Signaller did not recognise the signal team were in an unprotected area during his communication with the signal team, possibly due to being distracted on other tasks.
The network rules and procedures require communications to be clear, brief and unambiguous. Network communications by various parties in Sydney Trains were not in accordance with the principles underpinning the network rules. [Safety Issue]
Other factors that increased risk
Sydney Trains’ preference to keep the Up Main operational influenced the selection to use the clipped and locked 63B points to protect the worksite at 64 Points.
The worksite protection method presented an increased risk, in that track workers might inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. Sydney Trains network rules and procedures for a Track Occupancy Authority did not manage the increased risk for the chosen worksite protection method. [Safety Issue]
The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite [Safety issue]
Other findings
The workers were conducting work during the circadian low and in poor environmental conditions. It is possible that this contributed to an increased level of fatigue in some of the workers on duty that night, but was unlikely to have influenced decisions made contributing to the accident.
The lack of use of train headlights at night and the absence of any supplementary lighting (such as beacons) may have increased the likelihood of a train driver not seeing workers wearing reflective clothing and subsequently sounding the train horn.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The Sydney Trains’ work-planning process, involving multiple work groups, did not assure the consideration of worksite safety for all tasks undertaken by each involved party over the duration of the work and when returning the rail infrastructure into service.
Safety issue description: The network rules and procedures require communications to be clear, brief and unambiguous. Network communications by various parties in Sydney Trains were not in accordance with the principles underpinning the network rules.
Safety issue description: The worksite protection method presented an increased risk, in that track workers might inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. Sydney Trains network rules and procedures for a Track Occupancy Authority did not manage the increased risk for the chosen worksite protection method.
Safety issue description: The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite.
Additional safety actions
Sydney Trains delivered on a number of safety actions and commitments following the incident.
Some of the direct actions to address the contributing factors to the incident were:
Review and validation of proposed worksite protection plans is required through Sydney Trains’ Corridor Safety Centre.
Increased numbers of rail safety coaches and mentors, with a required coaching session for all Protection Officers at least once per year.
Protection Officers are required to implement a form of worksite protection at least once every quarter to remain eligible to be re-certified as a Protection Officer, this activity is monitored by the Corridor Safety Centre.
Additionally, Sydney Trains established a Post-Incident Assurance Group (PIAG) to respond to the incident. This group established key focus areas to promote the safety of workers and avoid future incidents. These areas included; Worksite protection, Culture, Planning for maintenance work and Safety critical communications.
The PIAG later established the Safety Focus Program, which included key initiatives;
Safety Focus Sessions
Safety Culture Program
Improvements to protection officer selection and training
Signal Key Switch Project
Safety Critical Communication Enterprise Wide Program
Maintenance Access Planning Project, and
ATRICS ASB.
Sources and submissions
Sources of information
The sources of information during the investigation included:
NSW Police
NSW Trains
Pacific National
Rail Industry Safety and Standards Board (RISSB)
Sydney Trains
The Bureau of Meteorology
The Office of the National Rail Safety Regulator
The Sydney Trains protection officer
The Sydney Trains work group leader (Civil Worksite Supervisor)
The Sydney Trains Signaller Clyde signal box
The Sydney Trains Work Group Leader (Signal Electrician)
The Sydney Trains Train Controller
The Sydney Trains Team Leader signals
The Sydney Trains Group Manager, Safety and Standards
The Sydney Trains Group Manager, Rail Corridor Safety
The Sydney Trains Systems Support and Assurance Specialist
Transport for NSW, Asset Standards Authority.
References
RailSafe Glossary July 2012 Version 7.0
Rail Industry Safety and Standards Board (RISSB, Dec 2010). National GuidelineGlossary of Rail Terminology.
Sydney Trains General Rule NGE 200 − July 2014.
RailCorp General Rule NGE 204 − November 2008.
RailCorp General Rule NGE 212 − November 2008.
Sydney Trains Network Local Appendices NLA 200.
Sydney Trains Network Local Appendices NLA 206.
Sydney Trains Network Procedure NPR 701 − March 2016
Sydney Trains Network Procedure NPR 703 − March 2016
RailCorp Network Procedure NPR 707 − July 2012.
RailCorp Network Procedure NPR 711 − December 2010.
Rail Safety National Law National Regulations (2012) − Made under the Rail Safety National Law (NSW).
Sydney Trains Network Form NRF 002 − July 2014
Sydney Trains Network Form NRF 003 − July 2014
RailCorp Network Rule NSY 500 − August 2005.
Sydney Trains Network Rule NTR 406 – July 2014.
Sydney Trains Driver Route Knowledge Diagrams – Main West Line, maps 02 to 05.
Sydney Trains Work on Track Rule NWT 300 − July 2014.
Sydney Trains Work on Track Rule NWT 304 − March 2016.
Sydney Trains Work on Track Rule NWT 308 − March 2016.
Sydney Trains Work on Track Rule NWT 310 − July 2012.
Sydney Trains Working Safely Handbook – June 2014
Technical Note – TN 036:2015 Update to passenger trainstop braking, braking, and traction performance requirements
Train Operating Conditions (TOC) Manual – April 2016
Transport NSW Engineering standard ESR 0001 – 600 RSU – Minimum Operating Standards for Rolling Stock – Multiple Unit Train Specific Interface Standards, Version 1.5, December 2012.
Duncan, J., Martens, S., Ward R. (1997) Restricted attentional capacity within but not between sensory modalities. Nature 387, 808-810. www.nature.com/articles/42947
Redick, T. S., Shipstead, Z., Meier, M. E., Montroy, J. J., Hicks, K. L., Unsworth, N., Kane, M. J., Hambrick, D. Z., Engle, R. W. (2016). Cognitive predictors of a common multitasking ability: Contributions from working memory, attention control, and fluid intelligence. Journal of Experimental Psychology: General, 145(11), 1473–1492. http://dx.doi.org/10.1037/xge0000219
Taoka, George T, Brake Reaction Times of Unalerted Drivers, ITE Journal, March 1989
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to:
NSW Coroner
NSW Police
NSW Trains
Pacific National
Sydney Trains
The Office of the National Rail Safety Regulator
The Sydney Trains Protection Officer
The Sydney Trains Work Group Leader (Civil Worksite Supervisor)
The Sydney Trains Signaller Clyde signal box
The Sydney Trains Work Group Leader (Signal Electrician)
The Sydney Trains Train Controller
The Sydney Trains Team Leader Signals
Transport for NSW.
Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.
Appendices
Appendix A – Bio mathematical modelling
Bio-mathematical models are tools for predicting operator fatigue levels, performance levels and the provision of opportunity for rest, based on an understanding of scientific relationships between work hours, sleep and performance. All bio-mathematical models have limitations that must be understood to ensure their appropriate use within an FRMS.
Sydney Trains’ assessment of rosters for managing fatigue risk is based primarily on the use of a bio-mathematical fatigue-modelling program known as Fatigue Audit Interdyne (FAID).
FAID requires hours of work as a single input.
“It assigns a recovery value to time away from work based on the amount of sleep that is likely to be obtained in non-work periods, depending on the length and time of day that they occur” (Roach, Fletcher and Dawson, 2011)
FAID does not predict fatigue but rather predicts sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep (Dawson and others, 2011).
The ATSB used FAID and Fatigue Avoidance Scheduling Tool (FAST®). FAST is a software decision aid designed to assess and forecast performance changes induced by sleep restriction and time of day. No planning software, including FAST, can predict fatigue or fatigue-induced errors in all cases for all individuals.
Both FAID and FAST have been applied in investigation RO-2016-008 for consideration, with full awareness of the limitations of these systems.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 June 2016, the pilot of an Agusta S.P.A A109S helicopter, registered VH-XPB, prepared to conduct a private flight under the instrument flight rules[1] from Sydney Airport to Ellerston, New South Wales (NSW), with three passengers on board. As the planned arrival time at Ellerston was after dark, the pilot contacted ground personnel at Ellerston before departure, who advised there was lighting at the helicopter landing site (HLS). The pilot also entered the coordinates of the HLS into the helicopter’s global positioning system (GPS). The elevation of the HLS was 1,720 ft above mean sea level (AMSL).
The helicopter departed Sydney at about 1738 Eastern Standard Time (EST). During the cruise at 8,000 ft AMSL, the helicopter entered cloud, with the cloud base at about 4,500 ft. When about 10 NM from Ellerston, the pilot commenced a descent to the calculated lowest safe altitude[2] of 6,500 ft.
When about 3 NM from Ellerston, with the property in sight, the pilot commenced a descent to 3,500 ft, to ensure adequate terrain clearance for arrival overhead the GPS position of the helipad (Figure 1). During the descent, the pilot sighted the lights from the buildings at Ellerston and visually confirmed they were at the intended location.
Figure 1: Ellerston property
Source: Google earth – annotated by ATSB
At about 1838, the helicopter arrived overhead the GPS position for the helipad. The pilot sighted a red beacon, but as they had expected to see the illuminated hangar and helipad, became unsure of the location of the HLS. The pilot reported that they then descended to about 2,500–3,000 ft and tracked to the west and north-west towards other lit buildings and then to the east back over the red light, but did not see any illumination indicative of a HLS. The pilot then elected to track towards the buildings of the homestead and descend to verify their exact location.
At about 1841, the helicopter descended to 2,286 ft (according to recorded data) in the vicinity of the Ellerston clubhouse and nearby buildings which the pilot reported were all well illuminated and visible. The elevation of the terrain at that point was 1,770 ft with rising ground to the north and south-east up to 2,250 ft (Figure 1). The pilot reported that they were then sure of their exact location, and assessed that the red light must be on the hangar next to the HLS.
The pilot then commenced a right turn to position for an approach from 2 NM to the north-east of the HLS. At about 1842, as the aircraft was positioning for the approach, the pilot received a ‘landing gear’ warning from the radio altimeter. This warning is generated whenever the helicopter is below 200 ft above ground level (AGL) without the landing gear extended. The pilot immediately raised full collective and commenced a climb to 4,000 ft AMSL tracking towards the south. A low rotor RPM occurrence was recorded on the aircraft computer at 1842, indicative of a rapid raising of the collective.[3]
After climbing to 4,000 ft, the pilot turned to track towards the red light from the south-south-west, and saw a flashing bright torch light near the red light indicating the HLS. The pilot then positioned the helicopter to the north-east of the HLS and commenced an approach. During the approach, ground personnel shone car headlights from the sealed area, which confirmed to the pilot that the helicopter was approaching the helipad. At about 50 ft AGL, the pilot was able to identify ground features at the helipad and continued with the landing.
After landing, the passengers disembarked and the pilot refuelled the helicopter. The pilot then conducted a ferry flight to Camden Airport, NSW. After arriving in Camden, the helicopter was pushed into a well-lit hangar, at which stage damage to the helicopter was detected. It was apparent that the helicopter had struck a tree branch, causing damage to the right-side landing lights, horizontal stabiliser, vertical fin and rotating beacon (Figure 2). It was unclear exactly when the helicopter had struck a tree.
Figure 2: Damage to right landing light of VH-XPB
Source: Helicopter operator
Pilot comments
After overflying the buildings and positively establishing the helicopter’s position, the pilot turned right to track north. A line of hills ran north-south from that area. The pilot was then attempting to maintain about 500 ft AGL and when the 200 ft radio altimeter ‘landing gear’ warning sounded, the helicopter was either descending (without the pilot realising) or maintaining altitude, but heading towards rising ground.
The pilot assessed that the helicopter probably struck a branch when the 200 ft warning sounded. The pilot did not hear or feel the collision, but at the time the warning sounded, the pilot rapidly raised full collective and their workload was high. If the collision with the tree branch had occurred later during the approach to the helipad, the pilot thought they would have heard or felt it due to lower airspeed and engine power settings. The pilot was not aware of having struck anything and no damage was detected during refuelling at Ellerston.
The pilot had landed at Ellerston three times previously in daylight but had not been there at night. After speaking to ground personnel prior to the flight, the pilot was expecting the sealed area and helipad to be illuminated. When there was no illumination visible from above, in the vicinity of the helipad, the pilot became confused as they could see the red light but not the helipad. In response, they orbited to confirm their position and then to determine where the helipad was in relation to that position. They were then trying to get visual reference with the landing site and remain at a safe height above the terrain and any obstacles.
Due to the overcast cloud, there was no celestial illumination, and as the area was surrounded by high ground, it was a black hole. In that situation, the pilot’s attention was split between looking outside to establish their position relative to the landing area, and inside at the instruments to maintain altitude and speed.
On a dark night, pilots need to apply greater safety margins such as use of the autopilot to reduce pilot workload, and maintaining a greater height above terrain until the landing site has been positively identified and an approach commenced.
Aircraft satellite tracking data
The helicopter was fitted with a satellite tracking system which recorded the time and the helicopter’s position, height and speed, at 2-minute intervals. The 200 ft warning occurred between two of the recorded points, so the exact position and altitude of the helicopter at that time was not recorded.
Operator report
The helicopter operator conducted an investigation and found the following factors contributed to the incident:
It was assumed by the company that the pilot was familiar with the layout and positioning of the Ellerston village and helipad because they had operated there on multiple occasions during daylight in the same aircraft, and they had discussed lighting arrangements with ground staff prior to the flight.
The helipad did not have the appropriate edge lighting to identify it as a HLS for night operations.
After flying overhead and realising the need to orbit to identify the helipad, the pilot should have nominated a vertical limit of 3,500 ft and a horizontal limit of 2 or 3 NM to prevent inadvertent controlled flight into terrain. A descending turn while scanning between ground lights and instruments in a pitch-black environment creates a very high workload. Planning the descent with absolute limits is critical to maintaining situational awareness. The use of autopilot in this situation can also aid in reducing workload while scanning outside.
Although the pilot was highly experienced and current with regard to regulatory requirements, lack of training in the conduct of ‘black hole’ approaches (recognised as a particularly demanding exercise) was identified as a factor.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
Helicopter operator
As a result of this occurrence, the helicopter operator has advised the ATSB that they are taking the following safety actions:
Introduction of night, black hole approach training and controlled flight into terrain avoidance technique training for all pilots who conduct night and IFR operations. This is to include both inflight and simulator training.
No company pilot will be authorised to fly into the Ellerston helipad at night without specific familiarisation training from the local pilot.
It is recommended that the Ellerston HLS be assessed against standard HLS lighting requirements for any future night operations.
All private helipads with potential for night operations are to be risk assessed and documented procedures produced.
Adjustment of the radio altimeter warning decision height for the A109 is limited to the standard 200 ft and 150 ft alerts. A variable decision height warning device is to be investigated.
The company will increase the reporting rate on the satellite-tracking device from 2-minute to 1-minute intervals.
The extra risks inherent in visual flight at night are from reduced visual cues, and the increased likelihood of perceptual illusions and consequent risk of spatial disorientation. Situational awareness with respect to the relative position of terrain and obstacles is fundamentally important during the conduct of limited visibility operations.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 16 June 2016, a student and instructor planned to conduct a training flight in a Piper PA-28-161 aircraft, registered VH-IPO (IPO), from Mangalore Airport, Victoria.
The planned flight included time in the Mangalore training area before returning to the airport for circuit training. The aircraft departed Mangalore at about 0940 Eastern Standard Time (EST).
After completing the planned training area manoeuvres, the instructor conducted an orbit and asked the student to identify significant geographical points within the training area. At this time, the instructor noticed the tachometer indicated a slightly lower engine power output than expected for the selected throttle position. The instructor suspected carburettor icing[1] and applied carburettor heat.[2] This resulted in an immediate further drop in power and the instructor also reported the engine running slightly rough. After 10–15 seconds the power level returned to normal. After a further 10–15 seconds, the instructor selected the carburettor heat off and instructed the student to return to Mangalore. During the return flight, the instructor periodically applied carburettor heat without further indications of carburettor icing.
As the aircraft descended to Mangalore, the student selected carburettor heat on and joined the circuit for runway 36. Due to traffic in the circuit, the student conducted two go-arounds.[3] After the second go-around, the aircraft re-joined the circuit, and the student prepared the aircraft for another approach. As the student prepared to turn onto the base leg, they applied the carburettor heat. At that time, the instructor observed a large drop in RPM. The instructor then took control of the aircraft and immediately turned onto the base leg. During the turn, the engine failed, and the instructor continued the turn to track directly to runway 36. The instructor carried out the engine failure checklist, but was unable to restart the engine. The instructor then broadcast MAYDAY[4] on the Mangalore common traffic advisory frequency.
As the aircraft descended toward runway 36, the instructor assessed that they did not have sufficient altitude to glide to the runway. The instructor identified a field to the south of runway 36 and outside of the airport perimeter as suitable for a forced landing. As the aircraft descended through about 200 ft above ground level, the instructor conducted the shutdown checklist and landed the aircraft in the selected field.
The instructor and student were not injured in the incident and the aircraft was not damaged.
VH-IPO
Source: Aircraft operator
Operator comment
The operator of IPO provided the following comment:
An engineer inspected the aircraft after the incident. The exhaust system, engine controls, fuel system and ignition system were inspected. Engine tests and a flight test were also performed. All checks indicated no faults with the aircraft or contaminants in the fuel system.
Carburettor icing
Induction icing, often referred to as carburettor icing, is the accumulation of ice within the induction system of an engine fitted with a carburettor. This ice forms as the decreasing air pressure and introduction of fuel reduces the temperature within the induction system. The temperature may reduce sufficiently for moisture within the air to freeze and accumulate. This build-up of ice restricts airflow to the engine, leading to a reduction in engine performance.
Environmental conditions influence the likelihood of carburettor ice forming, as shown by the Civil Aviation Safety Authority (CASA): Carburettor icing probability chart.
On the morning of the engine failure, the Mangalore aerodrome weather information service reported the following weather conditions.
Table 1: Weather conditions at Mangalore Airport on 16 June
Time
Temperature
Dew point
1000
8.6 °C
8.6 °C
1015
9.4 °C
9.1 °C
1030
9.6 °C
7.5 °C
1045
10.1 °C
7.3 °C
1100
10.6 °C
6.9 °C
1115
10.9 °C
6.5 °C
The carburettor icing probability chart shows the conditions at Mangalore Airport placed IPO in the serious icing zone for carburettor icing at the time of the incident (Figure 1). Carburettor icing could be expected at any power setting.
Figure 1: Carburettor icing probability chart showing prevalent conditions in yellow
Source: CASA modified by ATSB
The first indication of carburettor icing is normally a reduction in power produced by the engine. If not corrected by the pilot this may lead to rough running of the engine and engine failure.
When operating in conditions conducive to carburettor icing, pilots should use carburettor heat to prevent and remove ice build-up. After selecting carburettor heat, engine performance may deteriorate further as the ice is melted before engine performance returns to normal. This may take up to 30 seconds.
Instructor comment
The instructor of IPO provided the following comments:
On the two circuits prior to the engine failure, the student selected carburettor heat on prior to turning onto the base leg of the circuit with no indications of carburettor icing.
After the second go-around, the student joined a shortened downwind. The time period when the carburettor heat was selected off, where the carburettor ice appeared to form was very short and occurred at a very high-power setting.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
The operator has increased instructor and student awareness of carburettor icing probability and symptoms for early detection. The operator has issued all instructors and students with a copy of the CASA article Ice kills.
The operator will review relevant company briefs to include carburettor ice probability and prevention.
The operator has recommended the company operations manual be reviewed to mitigate against flying outside of gliding distance to the runway during circuit training.
Safety message
This incident highlights the insidious nature of carburettor icing and the speed with which carburettor icing can occur in favourable environmental conditions. The incident also reinforces the need for pilots to be aware of the risk of carburettor icing at all times during the operation of aircraft fitted with a carburettor.
The article Piston engine icing produced by the European Strategic Safety Initiative provides in-depth information to assist pilots in identifying and managing carburettor icing.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 17 June 2016 at about 0055 Eastern Standard Time, a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, departed Melbourne Airport, Victoria, on a freight service to Launceston, Tasmania. After arriving overhead Launceston, the flight crew proceeded to conduct an instrument approach for runway 32L. However, due to adverse weather condition, the crew were unable to land and a missed approach was conducted.
On completion of the missed approach, the captain (CA) initiated a left turn to re-position the aircraft for a second approach. A short time later, while responding to a call from the airport groundsman about the weather conditions, the CA handed control of the aircraft to the first officer (FO).
While the captain instructed the FO to maintain the turn, subsequent manoeuvring had not been discussed. The resultant flight path led to the aircraft entering an area with a minimum permitted altitude of 5,800 ft. While the crew had commenced a climb, the aircraft had not reached that minimum altitude and entered the area at about 4,400 ft. In response, air traffic control issued a safety alert for terrain and instructed the crew to climb the aircraft above the minimum safe altitude.
What the ATSB found
The ATSB found that the instrument approach briefing conducted by the flight crew did not ensure that there was a shared understanding of how the aircraft would be manoeuvred on completion of the published missed approach. That resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
The ATSB also identified that flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.
What's been done as a result
In response to this occurrence the operator issued a flight standing order that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring. In addition, the approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
The effective management and manipulation of the aircraft, following a missed approach, was included as a discussion item and exercise in the operator’s recurrent simulator training program.
Safety message
This occurrence highlights the value of having a clear, and where appropriate, shared plan. A common understanding between flight crew prevents additional workload associated with clarifying intentions during busy events, such as during and after missed approaches.
Operators and flight crew should consider including appropriate missed approach considerations, such as intended flight path, crew actions, terrain clearance and air traffic control requirements, into their approach briefings, regardless of the existing environmental conditions.
The occurrence
On 17 June 2016 at about 0055 Eastern Standard Time[1], a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, was scheduled to operate a freight service from Melbourne, Victoria, to Launceston, Tasmania. The flight crew consisted of a training captain (CA) as the pilot flying[2] and a first officer (FO) under training as the pilot monitoring. This flight was the FO’s ninth sector operating the B737 aircraft.
The flight crew signed on for duty in Melbourne at about 1910. The duty included a return flight to Sydney, New South Wales, followed by a return flight to Launceston. A review of the weather for the duty indicated relatively benign conditions for Melbourne and Sydney. However, the Launceston forecast included cloud at 1,500 ft above the ground and periods of light rain. A temporary reduction in visibility to 4,000 m and cloud down to 1,000 ft were also forecast, together with heavier rain showers. Those weather conditions required the flight crew to carry an alternate. In this case, the aircraft carried sufficient fuel to operate to Launceston and return to Melbourne.
The flight to Sydney and return was uneventful. Approaching Melbourne, the flight crew obtained a weather update for Launceston. That update forecast cloud at 1,000 ft, reducing temporarily to 500 ft with continuing rain showers. Automated weather observations for Launceston at 0000, recorded visibility of 5,000 m in rain and overcast cloud at 100 ft. While the observed weather conditions were below those required to land, the CA reported that adverse weather conditions at Launceston historically fluctuated.
The flight departed Melbourne for Launceston at about 0055. On board the aircraft was sufficient fuel to operate the flight to Launceston, conduct three instrument approaches and, if required, return to Melbourne. The flight crew continued to monitor the Launceston weather conditions en route. Subsequent automated observations showed little or no improvement to the weather.
Prior to descent, the flight crew conducted an approach briefing for Launceston. That briefing included discussions covering the expected instrument landing system[3] (ILS) approach for runway 32L (Figure 1), and the missed approach should it be required. The operator’s low visibility procedures were also covered. Those procedures required that, approaching the minima, the CA was to scan both the aircraft instruments and outside for the runway. The FO’s primary task was to monitor instruments and the aircraft’s flight path.
Descent was commenced at about 0125. Automated weather observations for Launceston at 0113, recorded visibility of 9,000 m in rain showers and overcast cloud at 200 ft. At about 0131, air traffic control (ATC) advised the crew that, based on the latest automated weather observations, conditions on the ground were, 300 m visibility and overcast cloud at 200 ft. The crew were subsequently cleared to leave controlled airspace on descent and to conduct an instrument approach to runway 32L.
Launceston tower control services were generally available between the hours of 0600 and 2200. As the tower was closed, the controlled Class D airspace below 1,500 ft above mean sea level (AMSL) had reverted to non‑controlled Class G airspace. In the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace above 1,500 ft AMSL and a clearance would be required prior to any subsequent manoeuvring on completion of the published missed approach.
The aircraft passed overhead Launceston at about 0136. The flight crew then proceeded to descend the aircraft in accordance with the prescribed ILS approach procedure. The minimum altitude for landing of 750 ft (202 ft above the runway threshold) was reached at about 0145. As the crew could not see the runway, a missed approach was conducted.
At about 0147, the aircraft levelled off at the missed approach altitude of 3,200 ft. About 20 seconds later, the CA initiated a left turn by selecting the autopilot heading bug to a south‑westerly heading. The CA’s intention was to continue the left turn and position the aircraft overhead the airport for a second instrument approach. The FO reported being surprised by the turn and immediately thought that they should climb the aircraft.
Figure 1: Launceston instrument landing system approach chart for runway 32L with relevant minimum safe altitudes required for manoeuvring, in instrument meteorological conditions or at night, circled in red.
Source: Airservices Australia modified by the ATSB
After advising ATC that they had conducted a missed approach, ATC asked the crew to confirm that they were on the published missed approach. The flight crew confirmed this and advised ATC that they were turning back towards Launceston. At about the same time, the CA responded to a radio call from the Launceston Airport groundsman and handed control of the aircraft to the FO. While the CA did instruct the FO to keep the turn going, to where, or onto what heading was not discussed.
While the CA was talking to the groundsman about the weather, the FO observed the radio altimeter become active. The radio altimeter provides an indication of aircraft height above the ground up to 2,500 ft. In response to the radio altimeter activation, the FO advised the CA that they should climb the aircraft.
By about 0148, the aircraft was turning left through a heading of 140 degrees and climbing through 3,900 ft. The aircraft was also approaching the boundary of the 3,200 ft minimum sector altitude[4] (MSA). At about the same time, ATC asked the crew to confirm that they would be remaining within the 3,200 ft sector and advised that otherwise they needed to be at 5,800 ft. The crew responded by advising they were climbing to 5,800 ft.
The aircraft subsequently entered the 5,800 ft MSA sector at about 4,400 ft, on a steady heading of about 110 degrees, and about 3.5 NM (6.5 km) southwest of the airport. As the aircraft was below the required MSA, ATC issued a safety alert for terrain and instructed the crew to climb immediately to 5,800 ft.
In response, at about 0149, the crew advised ATC that they were climbing to 6,000 ft. ATC acknowledged the call and asked the crew if they would be entering the holding pattern overhead Launceston. The crew reported that they were maintaining 6,000 ft and asked ATC to standby.
At about 0150, the aircraft was in a left turn, maintaining 6,000 ft and about 5 NM (9 km) to the southeast of the airport. ATC advised the crew that they were about to enter an area with a higher MSA and to climb immediately to 6,300 ft or higher. The crew acknowledge the altitude requirement and advised ATC that they would be returning to Melbourne. A short time later, as the aircraft had not yet reached 6,300 ft, ATC reissued the instruction to climb immediately to 6,300 ft.
The aircraft was subsequently cleared to climb to its cruise altitude and returned to Melbourne.
Flight below the minimum sector altitude (MSA) occurred following a missed approach that was conducted due to poor weather conditions. While the flight crew assessed that the safety of the aircraft was never in doubt, there was confusion as to how the aircraft was to be manoeuvred on completion of the missed approach.
This analysis will examine the aircraft’s flight path following the missed approach, and factors that contributed to the flight below MSA.
Prior to commencing descent, the crew conducted a normal approach briefing. The prevailing weather conditions at Launceston airport were such that the flight crew were required to conduct an instrument landing system (ILS) approach. The weather conditions also meant that it was reasonably foreseeable that they would need to conduct a missed approach. While an instrument approach briefing was conducted prior to descent, and covered the standard components including the missed approach segment, there was no discussion of how the aircraft would be subsequently manoeuvred.
A missed approach following an ILS approach is not common as the associated low weather minima usually permits the landing to be completed. As such, planning how the aircraft is to be manoeuvred in the event of a missed approach may not always be considered in detail. Additionally, tracking and altitude requirements following a missed approach are often provided by air traffic control (ATC), particularly in the case of larger commercial aircraft such as VH‑XMO.
Additionally, with the exception of situations such as simulator training, missed approaches are often unexpected. Consequently, the safe conduct of a go‑around and subsequent manoeuvring relies on a shared appreciation to avoid the need to clarify intentions during an already busy period. Irrespective of the weather conditions, a thorough go‑around briefing, that gives consideration to factors such as initial and subsequent flight paths, crew actions and co‑ordination, terrain clearance and ATC requirements, offers an effective means of ensuring that a common appreciation exists.
Although air traffic control (ATC) services were available en route and during descent, Launceston Tower was closed when the aircraft arrived. Consequently, the normally tower‑controlled Class D airspace below 1,500 ft became non-controlled Class G airspace. This meant that, in the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace at 1,500 ft and an ATC clearance would be required prior to manoeuvring beyond the published missed approach.
The approach and missed approach flight paths were aligned to enable the aircraft to descend and climb clear of terrain. The missed approach path positioned the aircraft within a sector that had an MSA of 3,200 ft. Any manoeuvring outside of that sector required the crew to climb the aircraft to the relevant sector MSA prior to entry. In this case, the left turn was towards a sector that had an MSA of 5,800 ft. Alternatively, climbing straight ahead on the missed approach track to 5,800 ft would have enabled the crew to manoeuvre the aircraft as required within 10 NM (19 km) of the airport.
On completion of the missed approach, the captain commenced a left turn with the intention of positioning the aircraft for a second approach. While a continuous left turn may have maintained the aircraft within the 3,200 ft sector, this manoeuvre had not been discussed during the approach briefing. As a result, when the CA handed control of the aircraft to the FO, the left turn was stopped on a south-easterly heading.
The south-easterly flight path resulted in the aircraft tracking towards a sector with a MSA of 5,800 ft while at an altitude of 3,200 ft. Although the crew had commenced a climb, the aircraft had only achieved an altitude of 4,400 ft when it entered the 5,800 ft sector. As a result, ATC issued a safety alert for terrain proximity. ATC also issued instructions for an immediate climb to 5,800 ft and later, to 6,300 ft.
Although the aircraft was never in immediate danger of colliding with terrain, it was operated over an area and at an altitude less than that prescribed for safe flight. Had the required clearance been obtained prior to manoeuvring, ATC would have provided the crew with appropriate tracking and altitude requirements. Additionally, without the flight path monitoring and timely altitude alerts provided by ATC, the risk of collision with terrain may have increased.
Had the approach briefing included a discussion about subsequent manoeuvring, both crew members would have had a shared understanding of the expected flight path. Such a discussion would have provided the crew with an opportunity to discuss alternative tracking, minimum safe altitude requirements, and the need to obtain a clearance.
Findings
From the evidence available, the following findings are made with respect to the flight below lowest safe altitude involving Boeing 737, registered VH-XMO at Launceston Airport, Tasmania on 17 June 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The instrument approach briefing conducted by the flight crew did not ensure there was a shared understanding of how the aircraft would be manoeuvred following completion of the published missed approach.
The absence of an established, and shared, manoeuvring plan, resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
On completion of the missed approach, the flight crew did not obtain an onwards airways clearance prior to further manoeuvring. That negated the terrain clearance assurance that would otherwise have been provided and increased the risk of conflict with other aircraft.
Other findings
The flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.
Safety issues and actions
Proactive safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The aircraft operator, Express Freighter Australia, has made the following amendments to their training and procedures:
A flight standing order was issued that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring.
The approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
A ‘Hot Topic’ discussion item – post missed approach manoeuvring and management, was added to the recurrent simulator training program.
The recurrent simulator training program, released in December 2016, included exercises that reinforce the enhanced arrival and approach briefing requirements. Crews were required to demonstrate appropriate inflight management and manipulation subsequent to completion of a published missed approach.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew
aircraft operator
Airservices Australia.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew and operator of VH-XMO, Airservices Australia and the Civil Aviation Safety Authority (CASA).
Submissions were received from CASA and the aircraft operator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 June 2016 at about 1000 Western Standard Time (WST), a Fokker F28 MK 0100 aircraft, registered VH-NHF, departed on a charter flight from Christmas Creek to Perth, Western Australia. On board were five crewmembers and 28 passengers.
The aircraft was on climb to the planned cruise altitude of FL 340[1] and the weather was generally clear and smooth with intermittent icing conditions. The first officer was the pilot flying (PF) and the captain was the pilot monitoring (PM) for this flight.[2]
As the aircraft climbed through FL 200, the flight crew heard a ‘whistling’ noise. They did not notice any other abnormal indications and after about one minute, the noise stopped. At about FL 305, a loud ‘whooshing’ noise was heard by the flight crew on the flight deck and the three cabin crewmembers who were standing in the forward galley.
The cabin crew believed the noise was coming from the forward lavatory, so one cabin crewmember inspected the lavatory, but could not identify where the noise was coming from. The PM checked the aircraft pressurisation indications located on the cockpit overhead panel and noticed that the cabin altitude[3] indicated 6,000 ft as expected, but the cabin pressure rate of climb had increased from about 200–300 ft/min to about 500 ft/min[4] (Figure 1). This indicated to the PM that they were losing cabin air faster than the pressurisation system could pressurise the aircraft.
Figure 1: F28 cabin pressure gauges
Source: Operator annotated by ATSB
The PM contacted air traffic control (ATC) to request a level-off at FL 320, rather than their planned level of FL 340. At about this time, the cabin manager informed the flight crew that the cabin crew had heard a ‘suction’ noise from the forward lavatory, but could not identify the source of the noise. The PM asked the cabin manager to cautiously inspect the forward lavatory again. The flight crew then received a ‘PACK 1’[5] level 2 warning[6] in the cockpit and the associated emergency procedure displayed on the multi-function display unit (MFDU). The first step of the procedure was to turn off the affected air-conditioning pack and wait two minutes for the pack to cool before attempting a reset. When the PM turned off air-conditioning pack 1, they noticed the cabin pressurisation rate of climb increase to in excess of 2,000 ft/min.
The PM contacted ATC again and requested a descent to FL 250 and received a clearance from ATC to initially descend to FL 290 due to an airspace boundary. Before the PF was able to start the descent, the flight crew received an ‘auto-throttle 1’[7] level 1 warning. At about this time, the PM informed the cabin manger that they were about to activate the seat-belt sign because an ‘excessive cabin altitude’ warning was imminent and the emergency oxygen would deploy.
Before the two minutes passed for the air-conditioning pack reset, the ‘excessive cabin altitude’[8] level 3 warning activated. The flight crew performed their initial drill,[9] which included donning their oxygen masks. The PM then checked the cabin altitude, noticed it was indicating in excess of 25,000 ft and that the passenger emergency oxygen had deployed, and made a PAN[10] call to ATC. They received a clearance for an immediate descent to 10,000 ft, and the PF initiated an emergency descent.
As the aircraft descended, the cabin crew performed their ‘sit-fit-advise’[11] drills for deployment of passenger emergency oxygen and the flight crew performed their ‘emergency descent procedure’. The flight crew completed their ‘excessive cabin altitude’ procedure during the descent and then discussed their requirements for flight at 10,000 ft, which included alternate destination options. The PF levelled the aircraft at 10,000 ft and the flight crew completed the ‘emergency descent procedure’, which included a public address that emergency oxygen was no longer required.
The flight crew completed the air-conditioning pack and auto-throttle emergency procedures. After air-conditioning pack 1 was selected on, the cabin altitude decreased to 1,500 ft and the PACK 1 fault did not return for the rest of the flight. The PM left the seat belt light on for the remainder of the flight, but gave permission for the cabin crew to leave their seats to check on the needs of the passengers.
The cabin crew checked on the condition of the passengers and noted that one passenger wished to continue using supplemental oxygen. The cabin crew facilitated the passenger’s request and provided them with portable oxygen for the remainder of the flight.
ATC contacted the aircraft for a progress update and provided the latest weather details for Newman, Meekatharra and Perth. The flight crew diverted the aircraft to Newman Airport, which was the closest option with company ground services. The crew advised ATC that an ambulance was required on arrival.
The aircraft landed at Newman at about 1100. Paramedics were available on arrival at Newman to provide assistance, but were not required.
F28 pressurisation – general description
Bleed air is compressed air taken from the compressor stage of the engine. Bleed air is used for several functions including pressurisation, air-conditioning and anti-icing. For pressurisation, the bleed air is supplied to the two air-conditioning packs located underneath the floor of the flight deck, which are used to control the temperature of the air prior to distribution into the flight deck and cabin (Figure 2).
Cabin pressure is regulated by the outflow valves, which control the outflow of air from the cabin in either automatic or manual mode. Controls for automatic and manual mode of operation are located on the flight deck. In automatic operation, the differential pressure[12] of 7.46 psi provides a cabin pressure altitude of 8,000 ft at an aircraft altitude of 35,000 ft (FL 350). The outflow valves will normally limit the maximum pressure differential in automatic and manual mode to 7.65 psi and the cabin pressure altitude to 12,000 ft plus or minus 1,500 ft, provided airflow from the air-conditioning pack(s) is available. An excessive cabin altitude warning is presented at 10,000 ft. The cabin is automatically depressurised upon landing and there are two negative pressure relief valves to prevent negative cabin pressure.
When one pack is selected off, the respective pack main valve shuts off bleed air supply and the other pack increases its output flow rate to 140 per cent of the normal flow rate. A single pack is capable of maintaining cabin altitude by itself at the maximum operating altitude of FL 350. Air-conditioning pack 1 is located underneath the floor of the flight deck on the left-hand side, which is just forward of the forward lavatory.
Figure 2: F28 bleed air supply
Source: ATSB
Captain (PM) comments
The captain provided the following comments:
No systems associated with air-conditioning/pressurisation were recorded as unserviceable before the flight.
The emergency unfolded ‘very quickly’ with multiple faults and therefore knowledge of the emergency drills and procedures needed to be ‘second-nature’. By the time they had performed their initial drills and checked the deployment of the passenger emergency oxygen, the cabin pressure altitude was already indicating in excess of 25,000 ft.
The loud ‘whooshing’ noise was similar to the noise heard in the simulator during rapid decompression training.
They did not feel any physiological effects during the loss of pressure and responded in accordance with their training.
Their simulator training was comprehensive, allowing them to follow procedures while maintaining sufficient ‘spare mental capacity’ to deal with all the problems that unfolded in a logical and methodical manner.
Cabin manager comments
The cabin manager provided the following comments:
One passenger reported to them there was an unusual smell and the PM indicated to them that this was probably from the failed air-conditioning pack.
Prior to the oxygen mask deployment, they felt a sensation in their ears, ‘like on a descent’. Another cabin crewmember commented to the cabin manager that they looked pale, and another cabin crewmember reported to them that they felt a loss of breath.
After the instruction to sit down for the expected excessive cabin altitude, they were concerned that the sleeping passengers might not get their oxygen masks on when they deployed.
About two minutes after sitting down, they heard a loud bang and the passenger emergency oxygen deployed.
Some passengers had trouble fitting their oxygen mask, so the cabin crew used a combination of hand signals and verbal communication to assist them while remaining in their jump seats.
They felt that the incident was managed in a ‘textbook’ manner.
Another member of the cabin crew reported to them that they saw sticky tape covering the emergency oxygen in the forward lavatory, which prevented its deployment.
Maintenance findings and corrective actions
The operator’s maintenance investigation of the incident found the following:
There was a visual indication of duct over-temperature on air-conditioning pack 1.
There was a controller fault on air-conditioning pack 1 and the flight deck temperature control was not working. The controller was replaced.
A ‘heavy leak’ was found from the recirculation duct during investigation of air-conditioning pack 2. The recirculation duct was replaced.
One of the outflow valves was found to be a ‘bit sticky’. The primary and secondary outflow valves were replaced. However, this did not have any effect on the pressurisation test results.
There was a ‘massive leak’ from the inlet and outlet of air-conditioning pack 1. Pack 1 was removed and a large hole found in the plenum duct[13] (Figure 3). The plenum duct and primary and secondary heat exchanger were replaced on pack 1. Aircraft pressurisation was then tested and found to be serviceable (including operations with either pack 1 or pack 2 turned off).
Figure 3: Ruptured plenum duct
Source: Operator
Operator comments
The airline operator provided the following comments:
The pack 1 fault was triggered by a compressor outlet overheat switch, which is located in the compressor outlet duct of the number 1 air-conditioning pack.
The auto-throttle 1 fault was probably linked to the leaks in the air-conditioning ducts, which resulted in a conflict between the demands of the pressurisation computers and the operation of the auto-throttle system.
The reason why the passenger emergency oxygen did not deploy in the forward lavatory is under investigation.
The depressurisation can be attributed to pack 2, being the sole air supply, having a ‘heavy’ recirculation duct leak, which would not allow pack 2 to pressurise the aircraft.
Similar occurrence
On 11 April 2016 VH-NHF suffered a number 2 bleed valve fault, which was reset once and then failed a second time. The pilots initiated a return to Perth. During the transit, the number 1 bleed valve failed. The pilots initiated their emergency drills, which included the use of emergency oxygen and a precautionary descent to FL 140. The excessive cabin altitude warning did not activate and during the descent, the number 1 bleed valve was reset. A normal approach and landing was performed at Perth.
ATSB comment
Air-conditioning pack 1 is located on the left side of the aircraft underneath the floor of the flight deck, just aft of the left seat, which places it close to underneath the floor of the forward lavatory. The pack 1 plenum duct likely ruptured at about FL 305 to produce what the aircraft captain described as a loud ‘whooshing’ noise and what the cabin manager described as a ‘suction’ noise. According to Flight Safety Foundation Human Factors and Aviation Medicine, the immediate donning of oxygen masks by the flight crew, following an ‘excessive cabin altitude’ warning, is the essential first step to surviving a high-altitude depressurisation.
The subsequent maintenance investigation found duct leaks from both air-conditioning systems. However, only the leak from air-conditioning pack 1 triggered an alert to the pilots, and that fault was associated with an overheat condition. In accordance with the operator comments, the rapid increase in the cabin pressure altitude rate of climb, which occurred when the flight crew turned pack 1 off, indicates that pack 2 alone could not supply a sufficient quantity of air to the distribution ducting to maintain cabin altitude. The systems were only able to re-pressurise the aircraft following the descent to 10,000 ft (the demands on the pressurisation system were substantially reduced) [14] and the successful reset of pack 1.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Operator
As a result of this occurrence, the operator has advised the ATSB that they are taking the following safety action:
All parts removed from the number 1 air-conditioning pack will be forwarded to the manufacturer, or authorised repair organisation, for further technical investigation to determine the cause of the failure of the plenum duct.
Safety message
The incident started in a subtle manner as an unusual noise, then quickly escalated to a compound emergency. After some initial uncertainty regarding the noise, the flight crew quickly recognised the true nature of the emergency that was unfolding. The captain and cabin manager both commented that the emergency then unfolded in accordance with their expectations and there were several factors that assisted their emergency management. These factors included:
their training experiences, which they felt closely matched their emergency experience
procedural knowledge of their initial drills
the fact that their colleagues were trained to the same level as themselves.
This incident highlights the importance and value of high-quality training for both flight crew and cabin crew. Quality training clearly assists in equipping crewmembers with the required knowledge and confidence to effectively respond to a time critical emergency. A sound understanding of emergency procedures is particularly important in ensuring that crews not only respond to an emergency appropriately, but also retain the capacity to deal effectively with other potentially complicating factors. Similarly, a sound understanding of aircraft systems supports effective crew decision making with respect to the best course of action when confronted with abnormal circumstances.
Additional information regarding how to respond to an aircraft depressurisation is provided in the following ATSB education bulletins:
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 June 2016, at 0418 Eastern Standard Time (EST), the pilot of a Fairchild SA227-DC, registered VH-HPE (HPE), departed Brisbane Airport, Queensland, for a flight to Mount Isa, Queensland. The flight included intermediate stops at Rockhampton and Richmond. The pilot was the only person on board the scheduled freight flight.
Prior to commencing the flight, the pilot reviewed the weather and NOTAM[1] information. The pilot noted there was no NOTAM information for Richmond Airport for the expected arrival time.
After completing the first leg of the flight, HPE departed Rockhampton for Richmond 30 minutes later than scheduled, at about 0615. The expected arrival time for Richmond was about 0810.
At about 0800, the aerodrome reporting officer (ARO) arrived at Richmond Airport with a work crew to undertake pre-planned work. The planned work was to remove plant growth from around the runway lights. The ARO conducted a pre-work safety briefing which included the work crew actions in the event of an aircraft arrival. The ARO then gave the two available hand-held VHF radios to the workers in the two works vehicles working within the runway strip. The ARO did not have a VHF radio in their vehicle and they were the only person qualified to broadcast on the common traffic advisory frequency (CTAF) used by aircraft, which uses VHF. All other works vehicles carried UHF radios.
At about the same time, the pilot of HPE broadcast on the Richmond CTAF advising they were 40 NM to the east and conducting a straight-in approach to runway 27. The pilot received a full response from the aerodrome frequency response unit (AFRU).[2]
After the brief, the workers undertook the required task in three groups. One group positioned at the eastern end of the runway and a second group at the western end of the runway while the ARO remained at a mid-point along the runway (Figure 1). While the work groups conducted the plant removal, the pilot of HPE activated the pilot activated lighting.[3] The workers in the groups at each end of the runway observed the lights illuminating and immediately began to vacate the runway strip.[4] The pilot made a further broadcast when 20 NM east of Richmond, and received only a short response from the AFRU.
At about 0815, as the aircraft joined a 5 NM final approach to runway 27, the pilot reported that they sighted a vehicle on the runway threshold moving clear of the runway strip. The pilot then broadcast on the Richmond CTAF and broadcast again passing 3 NM on final approach to the runway. They received no response to the broadcasts apart from the AFRU short response.
As HPE approached the runway, the pilot reported that they noticed vehicles and equipment at the far end of the runway and witches hats along the edge of the bitumen. As the vehicles and equipment had moved clear of the runway strip, the pilot continued the approach. At a height of about 100-200 ft above ground level, the pilot reported that they observed a person inside the runway strip near the bitumen of the runway and conducted a go-around.[5]
The pilot then re-joined the circuit, and observed that all workers and equipment were clear of the runway. The pilot conducted a second approach and landed without incident.
No persons were injured, and the aircraft was not damaged in the incident.
Figure 1: Richmond Airport
Source: Google Earth, modified by the ATSB
Aerodrome reporting officer (ARO) comment
The aerodrome reporting officer provided the following comments:
The works procedures for Richmond Airport require a NOTAM to be provided for all works within the runway strip exceeding 30 minutes duration. As the ARO did not expect the works to exceed 30 minutes duration, no NOTAM was provided.
The ARO elected to conduct the works on a Tuesday, as no passenger service was scheduled for that day.
The ARO receives no notification of the actual expected arrival time of the scheduled daily freight service, therefore they were not aware that the service was running late and did not check the airport movement log. Had the ARO checked the log they would have delayed the works until after the aircraft had departed.
The work crews carried two hand-held VHF radios for communicating with aircraft. While broadcasts from aircraft further than 5 NM from Richmond Airport may not be heard, calls within 5 NM are generally received.
The runway lights were activated about 15 minutes prior to the aircraft landing.
HPE conducted a straight-in approach to runway 27. In the past, aircraft arriving overflew the airport prior to approaching to land which the ARO believes is a safer procedure.
All workers and equipment were clear of the runway strip at the time HPE arrived. However, the workers and equipment positioned themselves just outside the runway strip. It may have appeared to the pilot that the workers and equipment were not clear.
Pilot comment
The pilot of HPE provided the following comments:
When approaching Richmond Airport an inbound radio broadcast was made. The AFRU provided a full response, which confirmed that their radio was working correctly and no radio broadcasts from other sources had been recently made within the Richmond CTAF.
No radio call was received from the work crew before or after the incident.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Airport operator
As a result of this occurrence, the airport operator has advised the ATSB that they are taking the following safety action:
Change to works procedure
Prior to conducting works within the runway strip, the flight log is to be reviewed to ensure no flights are scheduled to arrive while work is in progress.
Safety message
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One identified concern is Safety around non-controlled aerodromes.
This incident shows the importance of communication and ensuring that the systems exist and are used to minimise the likelihood of communication break downs. Effective communication between all parts of the aviation system, along with robust systems in place to support the individuals, is essential for safe operations.
The Airservices Australia document An airside driver’s guide to runway safety provides information to assist ground personnel to operate safely at both controlled and non-controlled aerodromes.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
-------
[1] A Notice To Airmen (NOTAM) advises personnel concerned with flight operations of information concerning the establishment, condition or change in any aeronautical facility, service, procedure, or hazard, the timely knowledge of which is essential to safe flight.
[2] Aerodrome frequency response unit provides an automatic response when pilots transmit on the traffic frequency for that particular aerodrome. If no other transmissions have been received by the AFRU within the previous 5 minutes the AFRU will respond with a pre-recorded voice message comprising aerodrome identification followed by ‘CTAF’. If a transmission has been received within the previous 5 minutes the AFRU will respond with only a short tone.
[3] Pilot activated runway and taxiway lighting is activated by a series of timed transmissions using the aircraft’s very high frequency radio, on either a discrete or the local airport communication frequency.
[4] Runway strip is a prepared area provided around the runway to reduce risk of damage to an aircraft running off of a runway and also provide an obstacle-free area for aircraft using the runway during take-off and landing.
[5] Go-around, the procedure for discontinuing an approach to land, is a standard manoeuvre performed when a pilot is not completely satisfied that the requirements for a safe landing have been met. This involves the pilot discontinuing the approach to land and may involve gaining altitude before conducting another approach to land.
