On the 5 September 2017, Queensland Rail suburban passenger train 1W33 was being transferred from Mayne Depot to Roma Street Station, Brisbane, Queensland, as a non-revenue operation. Nearing the Roma Street Station at 1628, train 1W33 passed signal RS57 at danger. Signal RS57 was displaying a stop indication (red aspect). Train 1W33 ran through points 226 and travelled east into platform 8. At the same time, another train (15X2) was approaching Roma Street Station on a converging route from the east.
As the train passed signal RS57 at danger, a ‘signal passed at danger’ (SPAD) alarm was generated in the Queensland Rail Management Centre. The Network Control Officer broadcast an emergency call to 1W33 and converging train 15X2. Both trains came to a stop approximately 550 m apart.
The rail infrastructure (points 226) was damaged by train 1W33. There were no reported injuries or damage to the rolling stock.
What the ATSB found
The ATSB found that the driver of 1W33 was distracted from his primary task of driving the train, including observing and reacting to signals, by personal emotional thoughts, when approaching signal RS57 displaying a stop indication.
What's been done as a result
Queensland Rail has initiated a number of strategies to manage the risk of SPADs, including administrative processes, human factors analysis, plus reviews and improvements to existing SPAD controls.
Longer term, Queensland Rail have sought expressions of interest from market leaders to partner with Queensland Rail to implement European Train Control System (ETCS) on sections of the Queensland Rail network. ETCS incorporates automatic train protection that provides for monitoring of train speed and limits of authority to ensure trains stay within designated speed limits and authorised safeworking limits.
Safety message
This incident highlights how distraction increases the risk of a SPAD event. Distractions can be external, but internal thoughts related to significant personal events or circumstances can take away a driver’s attention from their primary task of safely managing the train.
Queensland Rail suburban passenger train 1W33
Source: Queensland Rail
The occurrence
At about 1623 Eastern Standard Time on 5 September 2017, the Queensland Rail (QR) suburban non-revenue passenger train 1W33, departed Mayne Depot and travelled on the Exhibition loop towards Roma Street Station, Brisbane, Queensland (Figure 1).
Figure 1: Train 1W33 route from Mayne depot to Roma Street Station, Brisbane, Queensland
Image shows signal and station locations. Note that the colour of the signal markers denotes the aspect of the signal passed by 1W33. Source: Google Earth annotated by ATSB.
The penultimate signal prior to Roma Street Station (RS49) displayed a restricted indication (flashing yellow aspect[1]) for the driver. As train 1W33 approached signal RS49, the driver slowed down in preparation for a 25 km/h speed board placed adjacent the signal. The driver recalled that the Automatic Warning System (AWS)[2] generated an in-cab alert of the restricted signal RS49 indication ahead and that he acknowledged the AWS alert. At about 1628, train 1W33 continued past signal RS49 towards signal RS57, just west of Roma Street Station. Signal RS57 was displaying a stop indication (red aspect) to allow other train movements to clear Roma Street Station before train 1W33 would be authorised to continue.
Meanwhile, passenger train 1K56 was preparing to depart Roma Street Station from platform 8 (Figure 2). At about 1628, train 1K56 departed Roma Street Station travelling west towards the Springfield line via points 226 set normal.[3] About 11 seconds after train 1K56 cleared 226 points, train 1W33 proceeded past signal RS57 at danger. Train 1W33 ran through[4] points 226 about 26 seconds after passing RS57 at danger and travelled east into platform 8.
Figure 2: Western end Roma Street Station layout, Brisbane, Queensland
Image shows track infrastructure layout west of Roma Street Station with the directions of travel and path for trains 1W33 and 1K56. Source: Queensland Rail annotated by ATSB.
At approximately the same time, another train (15X2) had just departed Central Station and was travelling towards Roma Street Station on a converging route with train 1W33 from the east.
As train 1W33 passed signal RS57, an alarm activated at the QR Rail Management Centre. The Network Control Officer, broadcast an emergency radio message, calling for the driver of 1W33 and the driver of 15X2 to stop. At about 1630 the two drivers confirmed they had stopped.
Train 15X2 came to a stop approximately 25 m prior to signal RS102. Signal RS102 is the signal before the eastern entry signal (RS100) into platform 8 at Roma Street Station (Figure 3). Signal RS102 was displaying a single yellow caution[5] indication at this time due to signal RS100 displaying a stop indication. The signal interlocking system had restored Signal RS100 to stop when train 1W33 entered platform 8 at Roma Street Station. The two converging trains stopped approximately 550 m from each other.
Figure 3: Train 15X2 route from Central Station towards eastern entry of Roma Street Station, Platform 8
Image shows signal locations and stopping locations of train 1W33 and 15X2. Note that colour of the signal markers denote the aspects displayed after 1W33 entered the platform track circuit at Roma Street Station. Source: Google Earth annotated by ATSB.
The ATSB explored the following aspects which have been known as contributing factors in other signal passed at danger incidents.
Environmental conditions
A review of the CCTV[6] images from the time of the incident and driver comments indicated that the weather conditions were fine and clear. Further to this, no rainfall had been recorded for Brisbane on the day of the incident by the Bureau of Meteorology. The ATSB found that environmental conditions did not contribute to this incident.
Human performance
The ATSB reviewed the health assessment records, drugs and alcohol test results, rosters (with respect to fatigue) and competency records related to the driver of train 1W33. In conjunction with the driver comments, the ATSB found that these human performance factors did not contribute to this incident.
Rolling stock
Train 1W33 consisted of two coupled Suburban Multiple Units (SMU’s), with SMU 261 leading and SMU 279 trailing. Train 1W33 weighed approximately 256 tonnes and had a length of approximately 150 m.
As permitted by the Queensland Rail standard for operational integrity of trains, event recorders[7] for suburban multiple units SMU 261 and SMU 279 had both been temporarily removed for repairs and therefore did not record rolling stock inputs in relation to this incident (refer to ATSB comment below). However, driver comments and examination of available CCTV footage did not suggest any degradation of braking performance of train 1W33.
Visibility of signal RS57
Signal RS57 was a 4-aspect[8] main line signal fitted with a junction indicator and low speed shunt signal (Figure 4). Signal RS57 authorised train movements towards signals RS83 or RS85 located at the eastern end of Roma Street Station (platforms 8 and 7).
Figure 4: Signal configuration of RS57, at Roma Street Station, Brisbane
Source: Queensland Rail
Signal RS57 was located at the end of a left hand curve adjacent to Roma Street Station on the right hand side of the track in the direction of travel. Due to the curvature of the track and the placement of the overhead catenary masts, RS57 signal sighting was limited to approximately 103 m.
Queensland Rail managed the limited signal sighting with the application of a 25 km/h speed restriction from signal RS49 leading up to signal RS57 and LED signal lamps had recently been installed. In addition, other controls have been considered and implemented as part of Queensland Rail’s ongoing signal sighting reviews.
The ATSB found that the configuration and sighting of signal RS57 did not contribute to this incident.
Signal SPAD history
The ATSB found that signal RS57 had been passed at danger on six occasions since 2007. Queensland Rail records for these SPAD events noted varying sources of driver distraction as the causal factor for each event.
Figure 5: Signal RS57 10 year SPAD history
Image shows that in 2007 three reports for signals passed at danger for RS57 were recorded, plus three more each in 2009, 2012, and this event in 2017.Source: Queensland Rail records graphed by ATSB.
Following the three SPAD’s in 2007, Queensland Rail identified RS57 as a multi-SPAD signal and had undertaken SPAD risk studies and regular reviews of the signal sighting. These risk studies and reviews led to the identification and, where accepted, the implementation of additional controls. This incident is the first time RS57 had been passed at danger in five years.
Driver distraction
Driver distraction can be understood as a type of inattention and has been defined as ‘the diversion of attention away from activities critical for safe driving toward a competing activity (occurring) voluntarily or involuntarily’.[9] A physical source of distraction common in today’s society is the use of mobile phones. In this case, the driver reported he was not using his phone and there was evidence showing that his phone was not used at the time of the incident. Similarly, the driver reported no distractions from any radio chatter or noticing anything external to the train.
While the source of distraction can often be physical, it can also be non-physical. For example, a situation where task-irrelevant thoughts interfere with task-relevant thoughts can also contribute to distraction and decrease task performance.
A contributor to irrelevant thoughts is emotional mood states which have been described as providing a third processing layer on top of cognitive and physiological levels. ‘Emotions play an important role in motivating people to initiate and maintain a task in the first place, but they may also interfere with cognitive processing. In particular, under time pressure or threatening conditions, the regulation of our emotions is critical for efficient task performance’.[10]
A research study into the effects of emotional mood states on irrelevant thoughts and cognitive task performance concluded that ‘people produce more irrelevant thoughts during emotional mood states, and when the proportion of irrelevant thoughts to relevant thoughts increases, performance suffers.’[11]
In relation to this incident, the driver advised that prior to commencing work he recalled a significant past personal event that resulted in an emotional response. It is likely this contributed to an increase in task-irrelevant thoughts that led to the driver being distracted from observing and reacting appropriately when approaching signal RS57 displaying a stop indication.
ATSB comment
The function of a safety investigation is to identify and reduce safety-related risk, by gathering information and evidence to form conclusions based on the facts.
The ATSB noted that the Queensland Rail standard for operational integrity of trains permitted trains into service on their network without an operational event recorder. In this case, the ATSB relied on CCTV footage and the driver’s recollection for identifying the sequence of events. The absence of recorded data prevented further verification of the driver’s performance against operational practice.
From the evidence available, the following findings are made with respect to train 1W33 passing signal RS57 at danger near Roma St Station, Brisbane, Queensland, on 5 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The driver of 1W33 was distracted by personal emotional thoughts from his task of observing and reacting appropriately when approaching signal RS57 displaying a stop indication.
Other findings
A SPAD alarm activated at the QR Rail Management Centre prompting the network control officer to broadcast an emergency radio message stopping all affected trains.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
As a result of this occurrence, Queensland Rail has advised the ATSB they are taking the following safety actions:
A qualitative analysis of the SPAD scenarios at RS57 using a bowtie model.
Present a health and wellbeing strategic plan to the Executive Leadership Team which includes an organisational resilience and psychological wellbeing education and awareness program.
Human factors review of driver response to AWS audible indications and reaction times for green and restricted signals.
Facilitate the decrease in volume of the AWS audible indication at a proceed signal (green) and increase the volume of an AWS audible indication at a restricted signal (double yellow, yellow, and red).
Queensland Rail have sought expressions of interest from market leaders to partner with Queensland Rail to implement ETCS (European Train Control System) on sections of the Queensland Rail network. ETCS incorporates automatic train protection that provides for monitoring of train speed and limits of authority to ensure trains stay within designated speed limits and authorised safeworking limits.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Queensland Rail (QR)
Train driver involved in incident
Recorded data
Rail Industry Safety and Standards Board (RISSB)
Bureau of Meteorology.
References
Queensland Rail Observance of Signals Manual (MD-10-109).
Queensland Rail Event recorders for rolling stock specification (MD-10-217).
Queensland Rail Operational Integrity Of Trains standard (MD-10-106).
Rail Industry and Safety Standards Board, 2010, National Guideline Glossary of Railway Terminology.
Pennie S. Seibert and Henry C. Ellis, (1991), Memory & Cognition Irrelevant thoughts, emotional mood states, and cognitive task performance, 507-513.
Regan, M.A., Hallett, C. & Gordon, C.P. (2011). Driver distraction and driver inattention: Definition, relationship and taxonomy. Accident Analysis and Prevention, 43, 1771-1781.
Gaillard, A.W.K. (2001). Stress, workload and fatigue as three bio-behavioural states: A general overview. In P.A. Hancock, & P.A. Desmond (Eds.), Stress, workload, and fatigue. Mahwah, NJ: L. Erlbaum.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Queensland Rail, the driver of train 1W33, and the Office of the National Rail Safety Regulator.
Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 September 2017, a Fairchild SA227-AC aircraft, registered VH-SEZ, was operating Sharp Airlines flight SH843 from Portland to Essendon, Victoria. The first officer was pilot flying (PF) and the captain was pilot monitoring (PM).[1]
About 46 NM east of Portland, overhead Warrnambool, and in the cruise at flight level (FL) 170,[2] the left engine fire warning lights on the annunciator and fire warning panels started to momentarily illuminate. At 1608 Eastern Standard Time,[3] the flight crew contacted air traffic control (ATC) advising that they required a clearance to descend to 9,000 ft and that they would require a direct track to Essendon.
The fire warning lights continued to flicker and then both remained illuminated. As a result, the flight crew assessed that there was an engine fire. They conducted the memory checklist for in‑flight engine fire, which included:
shutting off the left fuel supply and hydraulic system
discharging the fire retardant.
The fire warning lights then extinguished.
The captain looked over his left shoulder at the left engine and could not see any smoke, flames or scorch marks. The flight crew then declared a MAYDAY[5] to ATC, and reported that they had experienced an engine fire and that the fire was extinguished.
The captain made a public address to the passengers, explaining that they had shut down the left engine due to suspected fire and asking any passengers who had seen smoke or flames to come forward and let him know. No one reported any visual indication of fire.
The flight crew assessed their options for landing, considering both Warrnambool and Avalon Airports. Although they were nearer to Warrnambool Airport, the runway there was shorter and narrower and the wind was gusty, so the crew elected to divert to Avalon Airport. The flight crew reported that a tailwind en route to Avalon and the presence of emergency services also influenced their decision.
At 1613, the flight crew advised ATC that they required direct tracking to Avalon Airport. They received a clearance to do so.
As the aircraft tracked to Avalon, and about 5 minutes after the fire warning lights had extinguished, the lights started to flicker and then came back on to a steady warning. By that time, the crew had tested the integrity of the fire warning loop, discharged the bottle of fire retardant and shut down and secured the left engine.
ATC advised the crew that Runway 36 at Avalon had an occasional 5 kt tailwind and Runway 18 had an occasional tailwind of 9 kt. The flight crew responded that they would require Runway 36. When the aircraft was about 15 NM from Avalon, the captain took over the pilot flying role. ATC provided heading guidance to the flight crew, and the aircraft landed at Avalon at about 1626.
After landing, firefighters advised that there was no sign of fire in the engine. Consequently, there was no need to conduct an emergency evacuation and the passengers and crew disembarked normally.
Engineering inspection
Engineering examination did not identify any signs of fire, smoke or heat damage in the left engine bay. Engineers inspected the four left engine fire sensor probes and all appeared to be functioning normally, but they replaced the lower rear sensor due to cracking of the ceramic insulator.
On the fire extinguisher control panel, each engine has a button and a tri-coloured light – red for fire, green to indicate system integrity of the fire loop, and yellow to indicate a bottle of fire retardant had been discharged and was empty. After the crew pressed the fire button, the empty (yellow) light did not illuminate. This was despite the fact that the fire bottle pressure gauge was indicating zero, after being full pre-flight, and there was indication of discharge into the engine. The yellow light did illuminate when the bulb was tested however, which indicated an issue with the circuit.
Engineers found that the logic control unit in the fire extinguisher control assembly had failed, resulting in erroneous illumination of the engine fire warning. The logic module was replaced, along with the fire extinguisher control panel.
Approach and landing
The captain commented that two out of their six cyclic biannual simulator checks included fire warnings, engine shutdowns and single engine actions. In this occurrence, the engine shutdown, diversion and single-engine approach and landing were consistent with the simulator training. There were no issues with controlling the aircraft or with its performance.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The fire extinguisher control logic module failed, resulting in an erroneous engine fire warning.
Safety message
This incident highlights the importance of well-designed simulator training and robust threat and error management procedures. The captain commented that it was important to treat fire warnings as legitimate indications of fire. Additionally, the declaration of an emergency alerts air traffic control and enables the provision of appropriate assistance.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0219 Western Standard Time[1] on 7 August 2017, a Pilatus PC‑12/47E aircraft, registered VH-OWS (OWS), taxied at Meekatharra Airport, Western Australia. The aircraft was operating as a Royal Flying Doctor Service (RFDS) air ambulance flight to Jandakot Airport, and had a pilot, two medical staff, and a patient on board.
At about 0227, OWS lined up and departed from runway 09. The night was clear with almost a full moon. At about 1,000 ft above ground level, when the pilot turned the aircraft to depart from overhead the airport, he noticed small beads forming on the outside of the windscreen. As there was no rain in the area, he shone a torch on the windscreen. The beads had formed into a steady stream of fluid moving up the windscreen, and noting its thickness, the pilot surmised that it was oil.
The pilot also knew that the aircraft’s propeller shaft seal had been replaced during maintenance on the previous day. Before this flight, he had followed his normal routine of checking the engine oil quantity and found that it was indicating ‘full’.
In assessing the situation, the pilot noted that all the engine parameters were in the normal range and he elected to return to Meekatharra Airport. He levelled the aircraft at an altitude of about 5,500 ft, and informed air traffic control of his intention to return for a landing on runway 09.
The pilot then conducted a wide descending circuit, slightly higher than normal to maintain glide capability in case the leak got worse and affected the engine’s operation. The visibility through the windscreen had reduced and by the time OWS turned onto the base leg of the circuit, oil was streaming down the side windows. On the final leg of the circuit, the pilot saw the runway lights blurring ‘like in heavy rain’. He conducted a normal landing, taxied to the parking bay, and shut down the engine. The aircraft was not damaged and no one was injured.
After landing, the pilot checked the aircraft and found oil on the engine cowling (Figure 1) and dripping/pooling on the tarmac. When the engine cowling was opened, a small amount of smoke could be seen coming from where oil had contacted hot engine parts.
Figure 1: Oil on the outside of the engine cowling
Source: RFDS
Propeller shaft seal replacement
The aircraft operator (RFDS) investigated the incident and identified that the propeller shaft seal had been incorrectly assembled (Figure 2). The seal had been replaced at Jandakot on 6 August 2017 (the day before the incident) after which the aircraft had flown to Meekatharra, a flight of about 1 hour 40 minutes.
Figure 2: Propeller shaft seal assembly at the time of the incident
Source: Pratt & Whitney Canada, modified by the ATSB
The day before the occurrence, the on-call licensed aircraft maintenance engineer (engineer) at the Jandakot maintenance base was asked to check an engine oil leak on OWS. When he examined the engine, he found oil on the engine cowling and the forward part of the engine. Having removed the oil, he investigated further by running the engine three times without any further evidence of an oil leak.
The engineer then contacted the engineering manager to discuss the defect. Based on their experience and the signs of the oil leak, they decided that the engineer would replace the propeller’s shaft seal.
When replacing the seal, the engineer assembled the parts in the order that he recalled from disassembly, and the diagram in the engine manufacturer’s, Pratt & Whitney Canada (P&WC), illustrated parts catalogue (IPC). He recalled that the half flat spacer was located forward of the seal—the same as the IPC (Figure 3). After replacing the seal, he ran the engine and no oil leaks were evident.
Figure 3: Propeller shaft seal assembly parts diagram in the IPC
Source: Pratt & Whitney Canada, annotated by the ATSB
The RFDS investigation found that the IPC was not intended to be used for seal replacement nor did it show the correct order of parts in the seal assembly. Only the P&WC engine maintenance manual (EMM) was intended to be used for maintenance, including propeller shaft seal replacement. The diagram in the EMM showed the half flat spacer correctly located aft of the seal (Figure 4). The EMM assembly procedure permitted the positions of the seal and the seal spacer shown in Figure 4 to be interchanged. In both configurations however, the half flat spacer was to be installed aft of the seal. The engineer had referred to the EMM but had not identified the discrepancy between the seal assembly diagrams in the IPC and the EMM.
Figure 4: Propeller shaft seal assembly diagram in the EMM
Source: Pratt & Whitney Canada, annotated by the ATSB
The RFDS investigation also identified that in the time leading up to the incident the engineer had worked extended work hours, and had had 4 days off in the previous 27 days. The engineer also indicated to RFDS that he had been feeling tired when replacing the seal as he had not slept well the previous night. He also indicated receiving a work-related phone call while replacing the seal which he believed was a distraction.
Safety analysis
The oil leaked from the propeller shaft seal assembly because parts of the seal had not been assembled in the correct order. As the half flat spacer had been placed forward (instead of aft) of the seal, the seal was compressed and was pushed against the seal runner (Figure 2). In that configuration, the friction from the rotating seal runner resulted in abnormal wear of the seal allowing engine oil to leak.
When assembling the propeller shaft seal, the engineer had used the indicative diagram in the IPC instead of the diagram in the EMM, which showed the correct order of parts. He did refer to the EMM but did not notice that the assembly procedure and diagram in it were different to the diagram in the IPC. He also relied on his memory to recall the order in which the parts were removed, which may have been affected by fatigue associated with longer working hours and disrupted sleep.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Shortly after VH-OWS took off from Meekatharra Airport the pilot saw oil leaking from the engine on to the windscreen. In response, he turned the aircraft back and safely landed at the airport.
Engine oil leaked from the aircraft’s propeller shaft seal as it had not been correctly assembled when replaced the previous day.
When assembling the propeller shaft seal, the engineer used an indicative (but technically incorrect) diagram in the engine manufacturer’s illustrated parts catalogue instead of the correct sequence detailed in the manufacturer’s maintenance manual. He also relied on his memory of disassembling the seal, which may have been affected by fatigue associated with disrupted sleep and recent longer working hours.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Royal Flying Doctor Service
The aircraft operator, RFDS, advised the ATSB that the following safety action had been taken:
Maintenance engineers have been reminded that the use of memory, IPCs and engineering by comparison, are not suitable methods for conducting aircraft maintenance.
The engineers have also been reminded to use the EMM and associated diagrams for the maintenance, including the propeller shaft seal assembly.
Engineer’s overtime is being monitored while a more permanent solution for workplace fatigue management is being considered.
Transport Canada
Transport Canada, Canada’s transport safety regulator, advised the ATSB of the following safety action, which it believes will mitigate future risk of this type of occurrence.
Pratt & Whitney has initiated a manual revision for the IPC to add an illustration of the most current (post service bulletin) configuration of the seal assembly, and amend the EMM to add a caution in the reduction gearbox maintenance practices section.
Safety message
Maintenance engineers should ensure that the appropriate technical documents are used for any maintenance task (Civil Aviation Safety Authority (CASA) maintenance poster Check the data also refers). In this occurrence, use of the inappropriate technical document resulted in the incorrect assembly of the propeller shaft seal, which then leaked.
The CASA publication Safety Behaviours: Human Factors Resource Guide for Engineers, notes that many maintenance engineers use personal sources of unapproved technical documents. A common problem faced by engineers is the requirement to follow procedures and time pressures to complete maintenance. A better understanding of these demands to complete the maintenance by operators and maintenance organisations could help them identify informal work practices and areas for improvement, including the use of appropriate technical documents.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 29 August 2017, freight train 8279 (one locomotive and 23 wagons) was travelling north from Mackay, Queensland. At about 0945, after passing over the Wintons Road level crossing, about 64 km north of Mackay, the train driver observed a truck approaching the next level crossing. The unsealed crossing (ID 5318) provided vehicle access between Wagoora-Yalboroo Road and the Bruce Highway. It was equipped with passive traffic control devices (stop signs).
The train driver sounded the train horn while observing the truck slow and stop at the crossing. The train driver noticed that the truck appeared to be facing slightly away from the approaching train when stopped, before it then proceeded to cross the track in front of the train. The train driver gave a second sustained sounding of the horn, placed the brake handle into the emergency position, before moving to the foot-well for protection.
Soon after, train 8279 collided with the driver’s cab of the truck. The truck driver sustained fatal injuries. The train driver was shaken but otherwise unhurt.
What the ATSB found
The truck driver’s ability to sight the approaching train was probably restricted due to the truck’s cab-design and the likelihood that the vehicle stopped at an angle to the railway track. Once the truck proceeded into the path of the train, there was insufficient time for the train driver to stop the train before colliding with the truck.
The investigation also noted that road vehicles had progressively cut the corner when entering/exiting the private road, resulting in the gradual widening of junction at Wagoora-Yalboroo Road. This could influence the position of road vehicles when stopped at the crossing and in turn, affect the ability for drivers of some larger vehicles to sight an approaching train.
In considering the Queensland government’s long-term level crossing safety strategy, the ATSB found that private (occupation) crossings had been specifically excluded. However, the ATSB notes that providing unrestricted public access to a private (occupation) crossings could present a level of risk similar to that of a public road crossing. While the program has achieved a wide range of positive safety initiatives and improvements, the ATSB found that exclusion of private (occupation) crossings from the strategy potentially removes an opportunity to further improve safety outcomes for all level crossing users across Queensland.
What's been done as a result
While the Queensland Level Crossing Safety Group (QLCSG) focus remains on the higher risk public level crossings, they acknowledge that private (occupational) level crossings also require management under the Rail Safety National Law. Stakeholders of the QLCSG agree to review the status and treatment at private level crossings used by the public (such as in this case). Where appropriate, private crossings will be included as a subset of public level crossings for the purposes of their safety strategy.
Queensland Rail (QR) conducted an audit of level crossing ID 5318. The installation was found to be consistent with the QR standard. However, some enhancements were identified and programmed for installation under routine maintenance activities.
With respect to all private (occupation) crossings in Queensland, QR is liaising with private property owners to enter into licence or interface agreements to ensure the safe operation and use of the private level crossings. Where appropriate, private crossings would be closed or, if used by the general public, upgrade to public crossing status.
Safety message
Truck drivers are reminded that cabin designs can limit their view to the left out of the passenger window. As a result, when stopped at a rail level crossing, this can influence the distance away a train approaching from their left can be seen. Taking care to maximise this sighting distance is important to ensure a safe crossing.
Rail operators and governments should continue to implement programs for improved safety at railway level crossings. This should include considering safety strategies for private (occupation) crossings, especially where the level of risk may be similar to that of a public road crossing.
The occurrence
On 27 August 2017, train 8279 departed Acacia Ridge, Brisbane, Queensland, for Stuart Yard in Townsville. Train 8279 consisted of one locomotive (2813) and 23 wagons. The train was 480 m in length, with a total weight of 1370 t.
On the morning of 29 August 2017, train 8279 arrived at Mackay, about 964 km[1] north of Brisbane. A crew change was undertaken, before train 8279 departed Mackay at about 0845 Eastern Standard Time (EST), and continued traveling north.
At about 0937, train 8279 passed through a crossing loop at Calen (1018.590 km). The track largely runs parallel to the Bruce Highway (to the west) with sugar cane fields on both sides. About 8 km after the crossing loop, the track tops a rise before turning in a more westerly direction and descending towards Wintons Road level crossing. Wintons Road is a sealed road with active traffic control devices (flashing lights) at the level crossing.
At about 0945, train 8279 passed over the level crossing at Wintons Road (Figure 1). Soon after, while travelling at about 84 km/h,[2] the train driver observed a dust cloud ahead and assumed it was a vehicle travelling on the parallel unsealed road to the north—Wagoora-Yalboroo Road. The train driver then sighted a truck approach the next level crossing (1028.693 km). The unsealed level crossing was equipped with passive traffic control devices (Stop signs).
The train driver sounded the train horn while observing the truck slow and stop at the crossing. The train was about 230 m from the crossing. The train driver described the truck as having stopped at an angle facing away from the approaching train. The truck then proceeded to cross the track in front of the train. The train driver immediately gave a second sustained sounding of the horn (about 3 seconds), placed the brake handle into the emergency position, before moving to the foot-well for protection.
Figure 1: Aerial view of the level crossing approach and road alignment
The truck was travelling west along Wagoora-Yalboroo Road before turning left towards the railway crossing and the Bruce Highway. The train was also travelling west, parallel to the road. Source: Google Earth, annotated by ATSB
A few seconds later, train 8279 collided with the driver’s cab of the truck. The train travelled a further 640 m before stopping. Shortly after, the driver of train 8279 contacted the Queensland Rail Network Control Centre to report the collision.
The truck driver sustained fatal injuries. The train driver was shaken but otherwise unhurt.
Level crossings provide for traffic management where a railway line and road intersect. Crossings are usually categorised as either public crossings or private crossings. Public crossings provide unrestricted access to all road users (the general public) for everyday use. Private crossings (or ‘occupation’ crossings) are on private land and are often exclusively used by the landowner.[3]
The collision on 29 August 2017 occurred at a crossing defined by Queensland Rail (QR) as an Occupation/Private rail crossing, QR ID number 5318. The road provided vehicle access between Wagoora-Yalboroo Road and the Bruce Highway, and was about 120 m in length.
Standards for traffic control devices at railway crossings
Australian Standard 1742.7:2016 Manual of uniform traffic control devices, Part 7: Railway crossings, prescribes the requirements for road markings, roadside signs and configuration of traffic controls at railway crossings throughtout Australia. The standard states that the requirements are:
…not applicable to railway crossings provided for the exclusive use of the occupier of private land or by other people with the knowledge and agreement of the occupier (sometimes known as ‘occupation’ crossings).
While crossing ID 5318 was classified as an occupation crossing, the road provided unrestricted access between Wagoora-Yalboroo Road and the Bruce Highway. Consequently, the crossing was almost certainly used as a public thoroughfare, in which case the requirements of Australian Standard 1742.7:2016 may apply. The minimum treatment specified in the standard was a RX-1 assembly (Give-way sign), subject to documented conditions.[4]
In 1997, QR engaged a consultant to develop an organisational standard for all occupation crossings on their rail network. The consultant report recommended a RX-2 assembly (Stop sign) as the standard for all occupation crossings. This recommendation exceeded the minimum treatment requirement of Australian Standard 1742.7:2016[5] and was consistent with the installation at crossing ID 5318 (Figure 2).
The consultant report also recommended minimum sighting distances at occupation crossings. For train speeds of 100 km/h on single track, the minimum sighting distance for a vehicle stopped at the stop sign was recommended as 450 m. QR records indicate that sighting distances at occupation crossing ID 5318 was in excess of 700 m.
In general, the traffic control devices installed at occupation crossing ID 5318 were consistent with the requirements documented in the QR organisational standard.
Figure 2: Traffic control devices at occupation crossing ID 5318
RX-2 assembly (Stop sign) to Australian Standard 1742.7:2016. Source: AS1742.7 and Queensland Rail
Environmental conditions
The closest Bureau of Meteorology (BOM) weather station was at Proserpine, about 56 km north of occupation crossing ID 5318. At 0900 (about 45 minutes before the collision), the weather was clear with a light south-easterly breeze and the temperature was about 22 °C.
The train driver reported seeing dust from a vehicle travelling on Wagoora-Yalboroo Road. Considering the road was north of the track and the wind was from the south-east, any dust would have been blown away from the railway line. It is very unlikely that the dust would have obscured the truck driver’s vision of the approaching train.
The weather conditions were unlikely to have been a factor in the collision.
The sun’s azimuth[6] and altitude[7] was 52° 09’ 51” and 43° 42’ 47” respectively. Therefore, the sun was relatively high in the sky, and to the north-east.
In this instance, train 8279 was approaching from the east. For a vehicle stopped at the crossing, the sun would have been almost directly behind the truck driver at an altitude of about 43° above the horizon (Figure 3).
It is unlikely that sun-glare or any other sun related effects would have been a factor in the collision.
Figure 3: Sun position and sighting direction of truck driver
The sighting direction for the truck driver was towards the east. The sun was almost directly behind the truck driver at an altitude of about 43° above the horizon. Source: Google Earth, annotated by ATSB
Road vehicle
The vehicle was a 1983 Scania model P112 series 2, twin-steer truck and had been fitted with a flat tray body in May 2017 (Figure 4). The vehicle had a tare mass of 12.2 t and a gross vehicle mass of 26.5 t. Inspection, registration, insurance and modification certificates were all current.
The ATSB noted that the truck had a relatively prominent B-Pillar (Figure 4). The B-pillar of heavy vehicles is a feature known to obscure a driver's vision. It is likely that, under some conditions, a driver of this truck would experience a restricted view to the left due to the vehicle’s B-pillar.
Figure 4: Road vehicle
The vehicle was a 1983 Scania model P112 series 2, twin-steer truck fitted with a flat tray body. The vehicle was loaded with a storage container, fuel tank and air compressor (inset). Note that under some conditions, it is very likely the truck driver’s vision to the left may be restricted due to the vehicle’s B-pillar. Source: Qld Police, Annotated by ATSB
At the time of the accident, the vehicle was loaded with a storage container, fuel tank and air compressor (Figure 4, inset). All were securely mounted on the flat tray body.
The storage container was relatively lightly loaded; an oil drum secured to the container frame, with a number of smaller fluid containers and hand tools stored on racks. The fuel tank[8] was found to be full (about 1650 lt).
There was no indication that the vehicle was overloaded. Similarly, and considering the fuel tank was full, it is unlikely that any load shift would have affected vehicle dynamics.
The damaged vehicle was examined by the Queensland Police Vehicle Inspection Unit. The inspection found an amount of water retained in the air (brake) system tanks. However, the report noted the train driver’s observations that the truck had stopped at the crossing before proceeding, suggesting the brakes appeared to have been operating immediately prior to the incident. The report concluded that there were no obvious or apparent mechanical defects that could have contributed to the cause of the incident.
Road vehicle driver
The truck driver was appropriately qualified and had extensive experience driving heavy vehicles.
Fatigue
In the context of human performance, fatigue is a physical and psychological condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep.[9] Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission.[10] Fatigue impairment has been identified as causal in many transport related accidents.
The truck driver’s work-hours were generally between 0630 and mid-afternoon. The driver had worked these times in the three days prior to the incident, having previously come off of a three-day break. It was evident that work was generally undertaken during daylight hours. There were also sufficient off-duty hours at night, providing ample opportunity for restorative sleep prior to commencing work the next day. In addition, full rest-days were provided, giving the opportunity for recovery away from the work environment.
On the day of the incident, the truck driver started work at 0630. He had worked in an on-site shed until about 0800 before travelling out to the cane fields in the truck. The accident occurred at about 0945, less than half way through the driver’s normal workday. It was considered unlikely that the effects of fatigue were present either leading up to or at the time of the collision.
Medical and toxicology
Post-mortem examination found no evidence of any significant natural disease. Similarly, toxicology testing revealed no evidence of alcohol or drugs in blood and urine.
Looked but did not see
Research has shown that, in road accidents, critical/important information may have been detectible but the motorist did not attend to or notice it because their mental resources were elsewhere.[11] Furthermore, research into a phenomenon known as ‘inattentional blindness’[12] has shown how a person may fail to detect an object even though they were looking directly at it.
The human mind has limited resources for perceptual and memory processing. To cope with this limitation, a mechanism called ‘attention’ acts as a filter to focus this resource on specific tasks. Research suggests that inattentional blindness can occur when attention is mistakenly filtered away from important information[13] and can be affected by mental workload, expectation, conspicuity and capacity.
In this case, the vehicle driver approached the railway crossing and was observed to have stopped at the stop sign, albeit at an angle facing away from the approaching train. It is possible that the driver looked towards the approaching train, but did not see or perceive its approach. Soon after stopping, the truck driver proceeded into the path of the train.
Expectancy
Expectancy can be understood as the extent to which an event or condition is expected to occur or be present at a particular time and place. An individual’s expectation can influence their attention to (and preparation for) that event or condition.[14]
Studies undertaken into motorist behaviour have found that drivers who are familiar with a railway crossing are more likely to be involved in a crossing incident than drivers unfamiliar with the crossing.[15] An influencing factor is where motorists familiar with a crossing with relatively low train frequencies, don’t expect a train since they are rarely seen.
The frequency of train movements across the railway crossing was relatively low—about 15 train movements per day. Therefore, while the truck driver was aware of the railway crossing due to regularly working in the area, the probability of him encountering trains was relatively low. It is therefore possible that the truck driver’s familiarity with the railway crossing and a low expectation of encountering a train contributed to him not noticing the approaching train.
Driver distraction
Distraction can be understood as a type of inattention, where a person’s attention is diverted by a particular event or object. Driver distraction has been more specifically defined as ‘the diversion of attention away from activities critical for safe driving toward a competing activity (occurring) voluntarily or involuntarily.’[16]
Driver distraction can involve a range of factors either inside or outside a vehicle that draw on limited human physical, visual and cognitive resources, and can result in a degradation of the driver’s performance. For example, eating, drinking, operating devices integral to (or brought into) the vehicle (such as a mobile telephone), and smoking, are all activities that may distract from the driving task.[17]
While the source of distraction may often be physical, it can also be non-physical. For example, a situation where task-irrelevant thoughts interfere with task-relevant thoughts, may contribute to distraction and decrease task performance. A research study into the effects of irrelevant thoughts and cognitive task performance concluded that ‘when the proportion of irrelevant thoughts to relevant thoughts increases, performance suffers.’[18]
The truck driver was the sole occupant, so distraction by another person did not occur. The truck driver had a mobile phone, but there was no evidence of it being used at the time of the incident.
Based on the available evidence, there was nothing to indicate that the truck driver’s attention had been diverted by a distracting object or event.
It is possible, however, that the truck driver’s thoughts were directed towards other tasks. That is, rather than thinking about the task of look for an approaching train, the driver’s attention may have been directed towards some other task-irrelevant thoughts.
Summary of driver behaviour
Other than witness observations, there was very little objective evidence for verifying driver behaviour. The truck was observed stopping at the crossing before the truck driver proceeded into the path of the train. There was no evidence to suggest that the effects of fatigue, drugs, alcohol, or any medical condition contributed to the collision.
In the absence of any evidence to the contrary, it is possible that the truck driver looked towards the approaching train but did not see or perceive its approach. It is also possible that distraction and a low expectation of encountering a train contributed to him not noticing the approaching train. However, the combination of the truck’s cab-design (B-pillar) and that it stopped at an angle facing slightly away from the approaching train likely restricted the truck driver’s ability to sight the train.
Rail vehicle
Freight train 8279 was operated by Aurizon and consisted of one locomotive (2813) and 23 wagons. The train was 480 m in length with a total weight of 1370 t.
The train was crewed by a single driver, who had about nine years’ train driving experience. At the time of the collision, the train driver was appropriately qualified, assessed as competent and medically fit for duty.
The train driver was rostered to start work on 29 August 2017 at 0700, having had the previous two days off. The driver took control of train 8279 at 0830, about 75 minutes before the accident. It was considered very unlikely that train driver fatigue contributed in any way to the collision.
Following the accident, the train driver undertook routine drug and alcohol testing which returned a negative result.
Conspicuity
Conspicuity refers to an object’s ability to capture attention. Physical factors that affect the conspicuity of an object include size, contrast and movement. The approaching train was large and travelling relatively quickly. However, from the truck driver’s perspective, the perception of size and speed are likely to have been low due to its distance away (more than 200 m) and angle of approach (almost directly towards the truck driver).
The Rail Industry Safety and Standards Board (RISSB) develop and publish Australian Standards for the rail industry. Australian Standard AS 7531:2015 Rolling stock standard – Lighting and Visibility documents the requirements for lighting and rolling stock visibility and is applicable to new and existing locomotives.
The Australian standards states that the front of locomotives shall have areas of high visibility colour, either yellow, orange, orange-red or red. Locomotives shall also have white marker lights and at least one white headlight, mounted at least 2.3 m above the rail. The standard also makes reference to a requirement for visibility lights. The RISSB standard stated:
The primary purpose of locomotive visibility lights is to enhance the visibility of the front-end locomotive of a train from the perspective of a driver of a motor vehicle approaching a level crossing.
The two white visibility lights are mounted on either side of the locomotive front, between 600 mm and 1200 mm above the top of the rail. The standard stated that lights must alternately flash on and off when the horn is sounded and continue flashing for at least fifteen seconds after the horn has been sounded.
QR also publish their Interface Standards (MD-10-194, dated 23 July 2014) which prescribes the minimum requirements for rolling stock operating on QR infrastructure. The QR standard was largely consistent with the RISSB standards regarding colour, headlights and marker lights. While the QR standard also included the requirement for visibility lights, it did not make mention of any requirement for visibility lights to flash when the horn is sounded.
In this case, the front of locomotive 2813 was painted yellow as per the RISSB and Queensland Rail visibility standards.
The operational condition of the 2800 class locomotives headlights is a parameter recorded on the locomotive data log. In this case, the data log for locomotive 2813 indicates the headlights were illuminated on hi-beam while approaching the level crossing. Figure 5 also shows that both the headlights and the marker lights were still illuminated after collision.
To improve conspicuity, the front of locomotive 2813 was painted yellow and its headlights were illuminated. Source: Qld Police
The 2800 class locomotives also have visibility lights, which sit to the side of the coupler behind a perforated protection plate (Figure 5). The lights are manually controlled by the train driver and operate continuously when switched on, but do not flash when the horn is sounded.
When photographed following the collision, one of the visibility light was destroyed as a consequence of the collision and the other was not illuminated (Figure 5). The ATSB noted that a photograph of the driver’s overhead console indicated the switch controlling the visibility lights was in the off position.[19] The train driver advised that it is normal to travel with the visibility lights on, and recalled that the lights were on in this case.
Discussions with other drivers of 2800 class locomotives noted that it is routine to operate the train with the headlights and visibility lights on. When stopping at a station or crossing loop, a driver might turn the visibility lights off and switch headlights to low beam to avoid light glare affecting an opposing train/driver. However, when departing, drivers usually turn on both the locomotive generator field and the visibility lights at the same time, since these switches are adjacent each other. In this case, it was not unexpected that the headlights remained on after the train stopped following the collision and the train driver had secured the locomotive, as this would be normal practice when stopping. However, it could not be confirmed at what time the visibility lights were switched on or off, since the operational condition of the visibility lights is not a parameter recorded on the locomotive data log.
Locomotive 2813 incorporated all lighting and visibility features documented in the QR interface standard. However, an enhancement documented in the Australian standard (flashing lights when the horn is sounded) was not included on locomotive 2813.
In this instance, the headlights were switched on, but the condition of the visibility lights could not be verified. While visibility lights, and their flashing feature if available, may capture a road vehicle driver’s attention under some conditions, it is unknown if it would have resulted in a different outcome in this case.
Audible devices
Given the size and weight of most trains it is not possible to brake at anywhere near the rate of a road vehicle. Heavy freight and locomotive hauled passenger trains normally take in excess of 1 km to stop from high track speeds, even if the train driver initiates an emergency application of the brakes.
In an event such as this, by the time the train driver observes a truck begin to move into the path of the train, there is insufficient time to take any avoiding action to prevent the collision other than sounding the whistle and applying the brakes. In this specific case, the brakes had only barely begun to take effect (speed reduced from 84 km/h to 83 km/h) as train 8279 traversed the crossing.
Historically, audible devices have been considered an important component in the systems used to warn motorists of an approaching train. However, soundproofing, air conditioning and entertainment systems in modern vehicles have generally reduced the effectiveness of audible warnings.[20] Similarly, surrounding sounds such as vehicle engine noise (potentially significant for heavy vehicles) and other road noises (nearby traffic) may reduce the ability for a vehicle driver to hear the sounding of a train horn.
In this case, the driver of train 8279 sounded the locomotive horn twice while approaching the level crossing. The first sounding was when the truck was observed having stopped at the crossing. The second sustained sounding was when the truck was observed starting to move into the path of the train, at which point the train driver placed the brake handle into the emergency position, before moving to the foot-well for protection.
Once the truck moved forward onto the crossing, a collision was inevitable considering the proximity of train.
For this accident, there was no evidence to suggest that factors such as sun-glare, mechanical defect, fatigue, drugs, alcohol, or medical condition contributed to the collision. Similarly, the traffic control devices installed at this location were consistent with Queensland Rail’s design standards for private (occupation) crossings.
In this case, the train driver described the truck as having stopped at an angle facing away from the approaching train. Consequently, the truck driver’s ability to sight a train approaching from the left was examined further.
The ATSB also examined the long-term programs and strategies for improving safety outcomes for all level crossing users across Queensland.
Vision obstructions due to vehicle
While most vehicles exhibit features that may obscure a driver's vision, it is particularly true for heavy vehicles. Considering the cab-design of the vehicle involved in this incident (Figure 4), it is very likely that under some conditions, the driver’s vision to the left would have been restricted due to the vehicle’s B-pillar.
The Queensland Police conducted visibility testing using a vehicle with very similar side window and B-pillar configurations.[21] Testing showed that clear visibility was available to 90° for a normally seated driver simply turning the head to look out the passenger side window. If the driver was to lean forward over the steering wheel, the angle of vision increased to about 100°. However, vision beyond 100° to the left was not possible through the passenger side window (Figure 6).
Figure 6: Road vehicle visibility testing
Road vehicle visibility testing indicated a complete restriction to driver visibility beyond 100°, when the driver was looking out the left side passenger window. Source: Qld Police, annotated by ATSB
Table 1 shows the results of the Queensland Police road vehicle visibility testing and is presented in terms of road vehicle angle relative to the rail line. As this angle decreases, a road vehicle driver is required to look further to the rear of 90° to sight along the rail line. It is evident from testing, that sighting objects through the passenger side window is significantly reduced if the road vehicle stops at an angle to the rail line. If the vehicle angle relative to the rail line was less than 80°, the driver would be unable to sight the full distance along the rail line, even when leaning forward over the steering wheel.
Table 1: Road vehicle visibility – test results
Vehicle angle relative to rail line and approaching train
Sighting distance along rail line for a truck driver seated normally and looking left
Sighting distance along rail line for a truck driver leaning forward and looking left
90°
Full train approach visibility
Full train approach visibility
85°
53 m
Full train approach visibility
80°
26 m
Full train approach visible
75°
17 m
54 m
70°
12 m
26 m
Results from road vehicle visibility testing on a vehicle similar in configuration to the incident vehicle, based on a stopping distance of 2.5 m before the rail line. Note, the measured results have been rounded to the nearest metre. Source: Qld Police
The Austroads Guide to Road Design provides guidance to road designers on the geometric design of all types of road intersections and crossings. The Queensland Department of Transport and Main Roads (TMR) publish their Road Planning and Design Manual that largely accepts the requirements documented in the Austroads publication.
The Austroads guide notes that there are no design rules dealing with visibility from vehicles, but makes reference to published information regarding restrictions due to vehicle design[22] (Figure 7). Considering the published restrictions due to vehicle design, TMR policy was that road centre lines should be designed to intersect at between 70° and 110° in both urban and rural situations.
Figure 7: Sight restrictions due to vehicle design
The Austroads guide notes that vision form the cab of a vehicle becomes increasingly difficult to the side and rear of the vehicle. The rectangle represents a vehicle; the circle represents the vehicle driver. Note the area highlighted indicating where vision from a truck may be restricted due to the vehicle’s B-pillar. Source: Austroads Guide to Road Design Part 4A: Unsignalised and Signalised Intersections, Annotated by ATSB
The tests undertaken by Queensland Police showed similar results to the limitations documented in the road design guidelines. That is, vision out the left side passenger window became increasingly difficult as the angle increased to 20° behind 90°. At an angle variation of 20°, a driver in the test vehicle would only be able to sight another vehicle approaching from the left when it was within about 26 m.
Road vehicles are capable of braking relatively quickly. In the context of a road intersection, the driver of an approaching road vehicle is likely to sight another vehicle starting to enter the intersection and take action to avoid an imminent collision.
However, given the size and weight of most trains it is not possible to brake at anywhere near the rate of a road vehicle, nor is it possible to rapidly accelerate or decelerate a train. Therefore, at railway level crossings, it is much more important for the driver of the road vehicle to take action to avoid a collision.
At level crossings protected by Stop signs, motorists are required to stop in order to look for any approaching trains. Consequently, sufficient sighting distance must be available for a motorist to see an approaching train in time to make an informed decision whether it is safe to proceed over the crossing. Australian Standard 1742.7:2016 includes design criteria for calculating sighting distance requirements at level crossings protected by Stop signs. For the configuration at occupation crossing ID 5318, at least 430 m sighting distance is required to provide adequate time for a large road vehicle to accelerate from stop and safely clear the crossing before the arrival of an approaching train. When considering the results of the visibility testing, this could only be achieved if the road vehicle has stopped at an angle greater than 80° to the rail line.
At the accident location, the private road intersected the rail line at an angle of about 90°. However, the junction between the private road and Wagoora-Yalboroo Road (approximately 19 m from the railway crossing signage) showed evidence of widening at its eastern corner. Both roads were unsealed, so widening probably occurred gradually as road vehicles progressively cut the corner when entering/exiting the private road. Consequently, the effective centre line of the road varied from the designed 90° (Figure 8). The ability for a road vehicle to cut the corner and enter the private road at an angle, combined with a relatively short distance to the crossing, may influence the positioning of larger vehicles when stopped at the crossing.
Figure 8: Road angle
The design angle for the road centre line at the level crossing was approximately 90° to the rail line. However, due to widening of the road junction eastern corner, the effective centre line of the road varied from the designed 90°. Source: Qld Police, annotated by ATSB
In this case, the train driver described observing the road vehicle having stopped at the crossing, but it appeared to be angled facing slightly away from the approaching train. Considering both the train driver observation and the geometry of the private road, the angle between the vehicle direction and the railway was very likely less than 90°. Visibility testing suggested that at almost any angle less than 90°, the truck driver’s ability to sight sufficient distance along the rail line would have significantly reduced. However, there is insufficient evidence to determine the exact angle the vehicle stopped, nor what action the truck driver may have taken to check for an approaching train before proceeding over the crossing.
Railway level crossing safety strategy
A 2009 study found there were about 21,800 road/railway level crossings in Australia. Of these, about 8,800 were public road crossings and 13,000 were classified as private/occupation crossings.[23] While the number of private crossings is relatively high, they are normally provided for the exclusive use of a landowner to access private land. Private crossings are not intended as a thoroughfare for access by the general public, consequently the lower usage of the road lessens the level of risk that may arise from the crossing.
The Office of the National Rail Safety Regulator (ONRSR) publishes a document titled Policy - Railway crossings. The policy focus is on addressing public crossings which are generally considered a greater safety risk to road users. However, it notes that the application of the policy with respect to private crossings should also be considered in relation to risk. That is, regardless of a level crossing being defined as public or private, a rail infrastructure manager is still required to eliminate or minimise the risk that may arise from railway crossings, so far as is reasonably practicable. The policy states that ONRSR expects to see continuous improvement in the safety of railway crossings and ultimately seeks a reduction in the number of railway crossings.
The ONRSR policy refers to a Rail Industry Safety and Standards Board (RISSB) guideline for the consolidation of level crossings.[24] The guideline acknowledges that managing risk so far as is reasonably practicable may include permanently closing the level crossing to road/pedestrian traffic. The guideline suggests that multiple level crossings in close proximity (within a five kilometre distance or less) present prime opportunities for consolidation.
In July 2012, the Queensland government (Department of Transport and Main Roads) published their Level Crossing Safety Strategy 2012-2021 as a ‘…commitment to further improve safety outcomes for all level crossing users’. The document detailed 12 key strategies, one of which is to ‘…eliminate level crossings where appropriate’.[25]
There are multiple stakeholders (state/local government and rail/road organisations) involved in managing safety risk at railway level crossings in Queensland. The Queensland Level Crossing Safety Group (QLCSG) provides a forum to bring these stakeholders together to work collaboratively to address the 12 key safety strategies. The QLCSG is chaired by the Department of Transport and Main Roads. Queensland Rail and the infrastructure manager for level crossing ID5318, is a stakeholder and active member of the group.
The QLCSG has documented[26] a number of achievements since the launch of the safety strategy. While increased education and enforcement has been significant, there has also been progress made with respect to reducing the number of level crossings in Queensland. This has been achieved by closing level crossings where possible, grade separations (overpasses), the closure of branch lines and by not introducing new level crossings onto the network.
It is evident that the strategy and actions to date are generally consistent with the ONRSR policy in that the removal of unnecessary or rarely used public level crossings has been considered.
However, the level crossing safety strategy and the QLCSG report both state that private (occupation) crossings are excluded and that private crossings are considered a workplace health and safety matter. Notwithstanding the exclusion, the QLCSG advised that issues in managing private (occupation) crossings has occurred informally in the past and will continue.
With respect to managing risk, the objective of work health and safety legislation[27] is largely consistent with that of rail safety legislation.[28] That is, the duty imposed is to eliminate or minimise the risk to health and safety, so far as is reasonably practicable.
As part of the management of risk at level crossings, Queensland Rail undertake data collection and assessment of all crossings (public and private) on their network. The data and assessments help guide Queensland Rail’s programs for ensuring level crossings (public and private) are maintained in accordance with their documented standards. While crossing ID 5318 provided vehicle access similar to that of a public crossing, the data recorded relatively low risk scores for most elements of the assessment. The ATSB noted that the annual average daily traffic recorded at the crossing was 100 vehicles per day, seasonal. The seasonal notation suggested that the traffic was very likely associated with cane production and less likely associated with general public. However, it was also likely that much of the traffic used the crossing as a thoroughfare between the two public roads, rather than for the sole purpose of accessing a small strip of cane field adjacent the railway track.
While crossing ID 5318 was classified as a private (occupation) crossing, its unrestricted access as a thoroughfare between two public roads likely presented a level of risk similar to that of a public road crossing. Consequently, the strategies for addressing the risk should be consistent for those used as a public thoroughfare whether the crossing is a public or a private (occupation) crossing.
It was reported that the truck driver in this case was travelling between properties located on the Wagoora-Yalboroo Road and another located on the opposite side of the Bruce Highway. It is evident that in this case, crossing ID 5318 was being accessed as a thoroughfare between Wagoora-Yalboroo Road and the Bruce Highway.
There were a number of level crossings in the relative vicinity of crossing ID 5318 (both public and private). Of specific relevance was the Wintons Road level crossing, located about 900 m east. Wintons Road is a sealed road with active traffic control devices (flashing lights) at the level crossing. For the truck in this case, traversing the railway track at the Wintons Road level crossing was a viable and safer alternative for crossing the railway track (Figure 9).
However, road related issues should also be taken into account when considering alternative routes. For example, information provided the truck operator (Fox Hall Harvesting Group) suggested that road signage near the Wintons Road – Bruce Highway road intersection may pose sighting issues for drivers of larger vehicles such as tractors and trucks.
Some cane harvesting vehicles are not permitted to operate on the highway. Consequently, in some cases, the sole access to property may be via a private (occupation) crossing. However, the ATSB notes that this scenario is consistent with the intention of a private (occupation) crossing and its provision should not encourage unrestricted public access as a thoroughfare.
Figure 9: Chosen route (red) and alternative route (orange)
The truck was travelling between properties located on the Wagoora-Yalboroo Road and another located on the opposite side of the Bruce Highway via crossing ID 5318. There was a viable and safer alternative for travelling to the intended destination via Wintons Road with active traffic control devices (flashing lights) at the level crossing. Source: Google Earth, annotated by ATSB
In the absence of measures preventing unrestricted public access and considering the proximity of an alternative crossing with active traffic control devices (flashing lights), it is possible that crossing ID 5318 might present an opportunity for Queensland Rail to consider consolidation as encouraged by documented level crossing safety policies and safety strategies.
The exclusion of private (occupation) crossings from the Queensland level crossing safety strategy potentially removes an opportunity to further improve safety outcomes for all level crossing users across Queensland. This is especially the case for crossing ID 5318 and other private (occupation) crossings with a similar configuration, where unrestricted public access may present a level of risk similar to that of a public road crossing.
From the evidence available, the following findings are made with respect to the collision between freight train 8279 and truck, at level crossing ID 5318 near Yalboroo, Queensland on 29 August 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
After stopping at the stop sign, the road vehicle driver then proceeded onto the level crossing and into the path of the train.
There was insufficient time for the train driver to stop the train before colliding with the truck.
The combination of the truck’s cab-design and the likelihood that the vehicle stopped at an angle less than 90° to the railway track likely restricted the truck drivers sighting of the approaching train.
Other factors that increased risk
Some private (occupation) crossings in Queensland, such as crossing ID 5318, provide unrestricted public access between two public roads. These crossings present a level of risk similar to that of a public road crossing where either a higher level of treatment may be applicable with respect to traffic control devices, or closure may be a consideration.
The exclusion of private (occupation) crossings from the Queensland level crossing safety strategy potentially removes an opportunity to further improve safety outcomes for all level crossing users across Queensland. This is especially the case for crossing configurations where unrestricted public access may present a level of risk similar to that of a public road crossing.
The combination of the widening of junction at Wagoora-Yalboroo Road with the relatively short distance to the railway crossing could influence the position of road vehicles when stopped at the crossing and in turn, could affect the ability for drivers of some larger vehicles to sight an approaching train.
Other findings
While there is insufficient evidence to determine conclusively, there are a number of other factors that may have influenced why the truck driver proceeded onto the level crossing:
The truck driver looked towards the approaching train, but did not see or perceive its approach (inattentional blindness).
The truck driver’s familiarity with the railway crossing and a low expectation of encountering a train contributed to him not noticing the approaching train.
The truck driver’s attention may have been directed towards some other task-irrelevant thoughts.
The traffic control devices installed at occupation crossing ID 5318 were consistent with the requirements documented in the Queensland Rail organisational standard.
It is unlikely that sun-glare or any other environmental conditions contributed to the collision.
There were no obvious or apparent mechanical defects to the truck that could have contributed to the collision.
The locomotive was relatively conspicuous in colour (yellow), its headlights were illuminated and the train driver had sounded the train whistle twice while approaching the crossing.
For both the truck driver and the train driver, it is unlikely that the effects of fatigue, drugs, alcohol, or any medical condition contributed to the collision.
There was a viable and safer alternative for the truck to travel to the intended destination. This alternative involved traversing the railway track via a sealed road with active traffic control devices (flashing lights) at the level crossing.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action taken by Aurizon
External communications – Aurizon has ongoing engagement with local authorities (and in this case Mackay Regional Council) prior to sugar seasons, for the purpose of raising awareness of above rail operations during the sugar crushing.
Internal communications – In addition to the existing ‘pre-start’ and ‘tool box’ talks provided for rail traffic crew, specific information has been shared with rail traffic crew subsequent to this occurrence to reinforce procedures and re-remind rail traffic crew of increased presence of vehicles due to the cane crushing season and to continue to report all occurrences as required and to continue to report near misses as required.
Proactive safety action taken by Queensland Rail
On the 6 November 2017, Queensland Rail (QR) conducted an audit (site survey) to confirm site distances and the signage has been installed to the QR standard. The result of this audit found that the level crossing had appropriate sighting distance and signage for the controls in place in accordance with QR’s level crossing standard for private crossings. It is assumed that during cane season the crossing is used by the land owner’s trucks and harvesting equipment and it appears the crossing is well maintained.
Whistle boards are installed at the 428 m from the crossing to the south and 375 m from the north. The audit identified that additional whistle boards should be installed at 250 m either side of the crossing due to the rail line speed of 100 km/h and that the R26 sign has started to fade and should be replaced. These will be addressed by the local asset manager under routine maintenance activities.
Independently to this incident occurring, QR had already put in place an audit programme to assess all private crossings, upgrade them to the QR standard as necessary, and seek to enter into interface agreements. This programme was progressing at the time of the accident. Although the programme had not yet covered the specific location of this crossing at the time of the accident, QR is actively working towards improving or eliminating private crossings.
QR is requesting the relevant party (local government or landholder) enter into an appropriate licence or interface agreement with Queensland Rail for the safe operation and use of the private level crossings. Audits have so far been completed within the Far North, North West and Mackay regions of Queensland. To date, the audits have identified eight crossings for closure (as they are no longer required by any party) and eight crossings that will be changed from a private status to a public status crossing as they appear to be used by the general public. One crossing has been identified as requiring relocation. As at May 2018, licence/interface agreements for 85 crossings have been sent to relevant parties in the shire areas noted above and 15 licence/interface agreements have been formalised.
QRl reviews its level crossing standard on a 2 yearly basis and the current review is due to be completed in 2019. It has been identified in this review that consideration needs to be given to the frequency of audit of private level crossings.
Proactive safety action taken by Fox Hall Harvesting Group
Fox Hall Harvesting Group advised that they are prepared to erect no access signs as well as private property signs on both sides of the access road. They are also prepared to consider lockable gates and a fence on the boundary between the property and the railway easement to stop public use.
ATSB comment:
The ATSB acknowledges the willingness of the property owner to take action preventing public use of the private crossing. However, it is noted that any action should be done in consultation with the rail operator to ensure unintended hazards are not introduced.
Proactive safety action taken by the Queensland Level Crossing Safety Group (QLCSG)
At the QLCSG meeting held on 30 May 2018, the responsibilities under the Rail Safety National Law in relation to private (occupational) level crossings was acknowledged as being the primary means by which to manage safety at these locations. It was agreed that the QLCSG should remain focused on the higher risk public level crossings. However, in recognition of ATSB’s draft finding, it was also agreed that rail infrastructure managers would undertake a one-off review of private level crossings that are being used by the public (similarly to Yalboroo). The intent would be to review their status and treatment, and where assessed, include them as a sub-set of public level crossings for the purposes of the Strategy and QLCSQ functions.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Aurizon
Queensland Rail
Queensland Police Service
Office of the national rail safety regulator
Bureau of Meteorology
Crew of freight train 8279
References
Australian Government, Geoscience Australia
Australian Level Crossing Assessment Model ALCAM
Australian Standard 1742.7:2016 Manual of uniform traffic control devices, Part 7: Railway crossings
Australian Standard AS 7531:2015 Rolling stock standard – Lighting and Visibility
Austroads Guide to Road Design Part 4A: Unsignalised and Signalised Intersections
Ackerman C. (1989): Vehicle Characteristics (Course notes titled Traffic Engineering Practice edited by Ogden and Bennett for Monash University, Melbourne)
Battelle Memorial Institute (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.
Green, M (2004), Inattentional Blindness & Conspicuity. Retrieved 13 March 2007 from www.visualexpert.com
Green, M. & Senders, J. (2004). Human error in road accidents. Retrieved 13 March 2007 from www.visualexpert.com
Mack, A. & Rock, I. (1998), Inattentional Blindness. MIT Press: Cambridge, USA
National Transport Commission (2008). National Rail Safety Guideline. Management of Fatigue in Rail Safety Workers.
Office of the National Rail Safety Regulator – Policy: Railway crossings
Pennie S. Seibert and Henry C. Ellis, Memory & Cognition (1991), Irrelevant thoughts, emotional mood states, and cognitive task performance, 507-513.
Queensland Department of Transport and Main Roads Road Planning and Design Manual
Queensland Department of Transport and Main Roads Level Crossing Safety Strategy 2012-2021
Yeh, M. & Multzer, J. (2008). Driver Behaviour at Highway-Railroad Grade Crossings: A Literature Review from 1990-2006. Human Factors in Railroad Operations. United States Department of Transportation, Federal Railroad Administration: Washington DC.
Young, K.L., Regan, M.A., & Hammer, M. (2003). Driver Distraction: A review of the literature. Monash University Accident Research Centre. Available from: www.monash.edu.au
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the next of kin, the crew of train 8279, Aurizon, Queensland Rail, Queensland Police Service, the Queensland Department of Transport and Main Roads, the trucking company and the Office of the National Rail Safety Regulator.
Submissions were received from the crew of train 8279, Aurizon, Queensland Rail, Queensland Police Service, the Queensland Department of Transport and Main Roads, the trucking company and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 18 August 2017, the pilot of a Robinson R44 II helicopter, registered VH-LGN, was conducting a private flight from Noonamah, Northern Territory (NT) to Channel Point, NT, with three passengers on board. At about 1400 Central Standard Time,[1] after a 20-minute flight, the helicopter was flying about 500 ft above a beach at Channel Point in preparation for landing. Weight and balance information provided by the pilot indicated that the helicopter’s centre of gravity was toward the forward limit but within the allowable range.
The pilot reported that the helicopter’s airspeed was about 50 kt as he commenced a descending right turn, intending to land on the beach. During this time, a ‘bounce’ developed through the airframe. The pilot initially moved the cyclic[2] aft to reduce airspeed, the bounce increased to a violent shaking, both fore and aft, and side to side. The pilot then moved the cyclic forward to increase airspeed and lowered the collective,[3] with the intent to conduct an immediate landing.
Just prior to landing, the pilot raised the collective and flared the helicopter. Despite this, the helicopter landed heavily, damaging the skids and the main rotor blade severed the tail boom. The helicopter stopped in an upright position and all four occupants vacated the helicopter without injury.
Related occurrences
The nature of the airframe shaking, as described by the pilot, was similar to an occurrence investigated by the United States National Transportation Safety Board (NTSB) (ANC09GA040) in 2009. In that occurrence, the pilot described severe vibrations and oscillations to the point where the pilot felt like the helicopter was going to come apart. The pilot conducted an emergency landing and landed hard, with the main rotor contacting the tail boom. The NTSB report noted several other similar occurrences of severe airframe vibration from 2006 and 2007, which also resulted in the pilots conducting emergency landings. The vibrations or oscillations have also been referred to as ‘mast rocking’ or ‘chugging’.
Based on information provided by Robinson Helicopters, the NTSB report indicated that the oscillation was associated with fore and aft movement of the rotor mast (Figure 1). The manufacturer had conducted flight tests related to the oscillations and determined that they ‘may develop during operation at high gross weight, at about 90-100 kt airspeed’. Additionally, the tendency to develop oscillations was exacerbated by flying with a forward centre of gravity (although still within the approved envelope) and by entering a 30° left banked turn. A right banked turn could also exacerbate the oscillation, but it was more easily initiated in a left turn.
The mast oscillation was attributed to lack of firmness of newly-installed gearbox mounts and the manufacturer introduced stiffer mounts (part number A653-2) in June 2007 to counter the problem. The rubber in the mounts was found to harden with heat and compression during service and the issue was therefore more likely to affect low-hour helicopters. As such, there was only a requirement to change to the new, stiffer mounts during routine replacement of the original (A653‑1) parts.
In relation to oscillations, the following information was incorporated as Safety Tip 19 in the Robinson R44 Pilot’s Operating Handbook (October 2011):
Use caution when loading the helicopter near the forward CG limit and remember that CG shifts forward as fuel is burned. Near the forward CG limit, a fore-aft oscillation may develop during steep turns or autorotations. To stop this oscillation, return to straight and level powered flight. Oscillation may take several seconds to dissipate.
Figure 1: Location of the main rotor gearbox and forward gearbox mounts
Source: Robinson Helicopter Company, modified by the ATSB
Helicopter maintenance
Review of maintenance documentation showed that VH-LGN had 1,609 hours total time in service and 45 hours since the last 100-hour inspection on 14 July 2017. The airframe logbook indicated that replacement of the main rotor gearbox transmission mounts was conducted at that service. The airframe logbook recorded that the forward main rotor gearbox transmission mounts were replaced with the incorrect (superseded) part number A653-1, instead of the required A653-2 parts.
The A653-1 and A653-2 parts were the same size and shape. They were distinguished by the -2 parts having a large, handwritten ’H’ in yellow ink on the top and edge of the mount (Figure 2), in addition to the labelling on the parts’ packaging. The availability of the -1 part was due to their continued installation on the smaller, Robinson R22 helicopters. The engineer who had changed the mounts had referenced the correct maintenance information at the time, but was unable to recall or reconcile the circumstances that resulted in him obtaining and fitting the incorrect part number mounts.
Figure 2: A653-2 gearbox mount installed
Source: Robinson Helicopter Company
Analysis
The onset of the mast oscillations, as described during this occurrence, was largely consistent with the flight conditions described in Safety Tip 19 in the Robinson Pilot’s Operating Handbook. While the pilot’s actions in this occurrence did not follow the recommendation listed in the Safety Tip, his actions were consistent with those from previous occurrences and also in accordance with Safety Tip 7, which recommends making a safe landing if unusual sound or vibration begins in flight.
Incorrect forward main rotor gearbox mounts were installed in the R44 helicopter during recent maintenance. The manufacturer had previously found that these softer forward gearbox mounts increased the likelihood of the onset of oscillations associated with mast rocking in Robinson R44 helicopters. The onset of the airframe oscillations experienced by the pilot in this occurrence were therefore consistent with the manufacturer’s findings.
The circumstances that resulted in the installation of the incorrect parts was not clear. However, this type of error highlights the importance of extra vigilance around visually and dimensionally‑similar parts.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
As the pilot commenced a descending right turn, the unexpected onset of severe fore and aft mast oscillations resulted in the pilot conducting an immediate landing that significantly damaged the helicopter.
The maintainer had inadvertently installed incorrect forward main rotor gearbox mounts, which had previously been found to contribute to the initiation of fore and aft mast oscillation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 1136, on 12 August 2017, The Airplane Factory Sling 4 amateur-built aircraft, registered VH-BEG, departed Caloundra Aerodrome, Queensland, for a local private flight. There was a pilot and three passengers on board.
At 1143, the flight returned to Caloundra. Pilots of other aircraft reported that at the time wind conditions were light and aligned with runway 05.
The pilot positioned the aircraft to join the circuit for runway 12. The pilot of another aircraft advised runway 05 was in use and the pilot of VH-BEG then manoeuvred the aircraft to join the circuit for runway 05. While on the final leg of the circuit, the pilot selected full flap and observed parachutists descending to the right of the runway 05 threshold.
As the aircraft approached the runway, the pilot became concerned that the parachutists might drift into the path of the aircraft and focussed on the location of the parachutists. He then detected that the aircraft had deviated above and to the right of the desired approach path. The pilot then reduced power to idle and commenced a forward slip[1] to attempt to increase the approach angle and regain the desired approach path. As the aircraft approached the runway 05 threshold, he stopped the forward slip and began a left turn toward the threshold.
During the left turn, the aircraft aerodynamically stalled and the aircraft rolled to the left. Almost immediately, the left wing tip struck the ground and the aircraft collided with terrain. The fuselage fractured at the engine firewall, the engine was pushed rearward and intruded into the cabin.
The aircraft came to rest inverted and was destroyed (Figure 1). The pilot and all three passengers suffered serious injuries.
The figure shows the wreckage of VH-BEG after emergency services had attended. Source: Queensland Police
Video footage
Video footage taken by the passenger in the left rear seat captured the final eight seconds of the flight.
The footage showed the aircraft in a forward slip with the nose yawed[2] to the right and tracking parallel to, but right of, the runway extended centreline (Figure 2). The indicated airspeed was 58 kt,[3] and the tachometer indicated idle power. The forward slip then stopped and the aircraft turned left toward the runway threshold. At the same time, the descent rate increased.
Figure 2: Images from video footage
The figure shows images of the aircraft during the approach prior to the accident. The aircraft is shown in a forward slip (left) and at the beginning of the turn toward the runway 05 threshold (right). Source: Passenger, annotated by ATSB
The aircraft approached the runway threshold on a heading of about 010 degrees magnetic, and appeared to be undershooting the threshold. Pitch angle then increased, an aerodynamic stall occurred, and the aircraft rolled rapidly left. As the aircraft rolled, the slip indicator displayed a full right deflection, indicating that the aircraft had entered an incipient left spin. The footage stopped as the left wing impacted the ground.
Pilot comments
The pilot of the aircraft provided the following comments:
The pilot reported calculating the weight and balance of the aircraft prior to the flight using the aircraft electronic flight instrumentation system (EFIS) and using average weights for all occupants. He recalled the EFIS showing the aircraft weight and balance to be within the approved range.
He did not consider conducting a go-around.
The aircraft was fitted with a stall warning system, however, this did not activate prior to the accident.
Aircraft weight and balance
Weight and balance limitations were contained in the aircraft’s Pilot’s Operating Handbook (POH). The limitations defined the gross weight and centre of gravity limits. The maximum take-off weight of the aircraft was 920 kg and the aircraft was fitted with four seats.
The limits of the permissible centre of gravity range were defined as a percentage of mean aerodynamic cord (MAC):[4]
The forward limit of the permissible range was 18 per cent MAC up to a gross weight of 840 kg, above this weight, the forward limit was 24 per cent MAC.
The rear limit of the permissible range was 28 per cent MAC up to a gross weight of 700 kg, above this weight, the rear limit was 31 per cent MAC.
The empty weight of the aircraft was 461 kg. The weight of the front seat occupants was 190 kg and the weight of the rear seat occupants was 175 kg. The pilot estimated that at the time of take-off there was about 93 kg of fuel on board and reported that no items were carried in the baggage compartment.
Based on the above weights, the estimated take-off weight for the accident flight was 919 kg. The take-off centre of gravity position was 33.1 per cent MAC, and the zero fuel weight[5] centre of gravity position was 35.7 per cent MAC.
The centre of gravity position was outside of the permissible range for the entire flight (Figure 3).
Figure 3: Graphical representation of the aircraft centre of gravity for the accident flight
The graph shows the permissible centre of gravity range along with the calculated take-off and zero fuel weight centre of gravity positions. Source: Aircraft manufacturer, modified and annotated by ATSB
The pilot reported calculating the weight and balance to be within the permissible range using average weights.
The Civil Aviation Safety Authority advisory publication CAAP 235-1(1) Standard passenger and baggage weights provides the following guidance for using standard, or average, weights when calculating aircraft weight and balance:
Standard weights should not be used in aircraft with less than seven seats.
Because the probability of overloading a small aircraft is high if standard weights are used, the use of standard weights in aircraft with less than seven seats is inadvisable. Load calculations for these aircraft should be made using actual weights arrived at by weighing all occupants and baggage.
The New Zealand Civil Aviation Authority publication Weight and Balance contains the following information regarding the effects of operating an aircraft outside of the rear centre of gravity limit:
Your aircraft has centre of gravity limits, and any loading that puts the centre of gravity outside of those limits will seriously impair your ability to control the aircraft. The more aft the centre of gravity, the more unstable the aircraft. Forward pressure on the elevator control and full nose-down trim may be necessary to keep the aircraft from pitching up and stalling.
The further aft the centre of gravity is, the harder it is to recover from a stall.
ATSB comments
VH-BEG loading
Using the weight of the front seat occupants from the accident flight and allowing for no fuel and no baggage, the ATSB calculated that the maximum weight able to be carried in the rear seats of VH-BEG, while remaining within the allowable centre of gravity range, was just 118 kg. Using 105 kg of fuel as ballast, this weight increased to 148 kg. This allowed for 15 minutes of flight fuel and a 45-minute fuel reserve to be carried within the 920 kg maximum allowable take-off weight.
It was also found that when allowing for full fuel and any weight in the front two seats, the aircraft also required weight in the rear seats, or the baggage compartment, to ensure the centre of gravity was not located forward of the allowable range.
Warnings regarding weight and balance limitations included in the Sling 4 POH are shown in Figure 4:[6]
Figure 4: Warnings contained in POH
The figure shows warnings contained within the Sling 4 POH. Source: Aircraft manufacturer
Amateur-built aircraft regulations allow for some variance in construction which can lead to differences in the longitudinal balance and loading of individual aircraft. Pilots of amateur-built aircraft are reminded to be familiar with the weight and balance capabilities and limitations of their aircraft.
The weight and balance calculation blank form on page 6-13 lists the location of the front seats as 1959mm aft of the datum. The correct figure is 1902mm, as detailed on page 6-4.
The pilot did not use the POH to calculate the weight and balance, therefore the error did not contribute to the accident. However, pilots of Sling 4 aircraft should ensure that weight and balance calculations are conducted using the correct figure.
Safety analysis
The flight was conducted with the centre of gravity aft of the rear limit. This had the effect of making the aircraft less stable and more susceptible to an aerodynamic stall. This also made recovery from a stall more difficult.
After detecting that the aircraft had deviated from the desired flight path, the pilot attempted to continue the approach by manoeuvring the aircraft at low level and low speed. The aircraft was loaded outside of the permissible centre of gravity range, and the manoeuvring further reduced the remaining margins of controllable flight until the aircraft stalled and control was lost.
During the manoeuvring, the aircraft stalled and entered an incipient spin. The stall and incipient spin occurred at a height from which recovery was not possible and the aircraft collided with terrain.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The aircraft centre of gravity position was aft of the rear limit.
During the approach, the aircraft stalled and entered an incipient spin at a height from which recovery was not possible and the aircraft collided with terrain.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence:
Aircraft manufacturer
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety action:
Change to documentation
The position of the front seats in the blank form on page 6-13 of the Sling 4 Pilot’s Operating Handbook, version 1.6 will be corrected to show 1902mm aft of the datum.
Safety message
This incident highlights the critical importance of operating an aircraft within prescribed limitations at all times.
After detecting that the aircraft had deviated from the desired approach path, the pilot did not conduct a go-around. While the aircraft centre of gravity was located outside of the permissible range, a go-around, rather than manoeuvring at low speed and low level, may have prevented the accident from occurring.
The Flight Safety Foundation Approach-and-landing accident reduction tool kit Briefing note 6.1 – Being prepared to go around, stated that the importance of being go-around-prepared and go-around-minded must be emphasised because a go-around is not a frequent occurrence.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 2000 on 12 August 2017, the fishing vessel Mako departed San Remo, Victoria, bound for fishing grounds about 3 hours away. Once clear of Cape Woolamai, Mako maintained a steady course (210°) and speed to the south-west. At the same time, the container ship Glasgow Express was passing Cape Liptrap heading north-west. The ship was bound for Melbourne, Victoria, and was maintaining a steady course (299°) and speed. From about 2030 the vessels were on a collision course.
No avoiding action was taken by either vessel and, at about 2246, they collided.
What the ATSB found
The ATSB found that a proper lookout by ‘all available means’ was not being maintained on either vessel.
Glasgow Express’s bridge team saw and monitored Mako visually from about 2200. However, a full appraisal of the situation using other instruments or means available on the bridge (such as radar) was not done. As a consequence, the situation was misinterpreted and the risk of collision was not identified. Therefore, no avoiding action was taken.
Prior to handing over the watch at 2230, Mako’s watchkeeper identified Glasgow Express by radar and visually. However, the information was misinterpreted and it was concluded that the Glasgow Express was passing clear, ahead of the fishing boat, and no avoiding action was taken. Then, after taking the watch, Mako’s second watchkeeper did not see the Glasgow Express until moments before the collision.
In addition, Mako was under way with all external lights on. This made the vessel more easily seen, but reduced the ability for Glasgow Express’s bridge team to accurately visually appraise the situation. The bright lights also reduced Mako’s watchkeeper’s night vision and ability to distinguish features beyond the glare of the lights.
The ATSB also noted that Mako, similar to other fishing vessels of this design, had a large fishing net winch drum mounted on deck forward of the wheelhouse. This winch drum restricts forward vision and may limit the ability to maintain a proper lookout unless accounted for in on-board procedures and training.
What's been done as a result
Glasgow Express’s operator undertook a fleet-wide information and education program which outlined the incident and emphasised the need to use all available means to maintain safe navigation in accordance with the collision regulations.
Safety message
The ATSB continues to see collisions between trading ships and small vessels. A common contributing factor has been the failure to use all available means to accurately appraise a situation and the risk of collision.
The ATSB reinforces to masters, owners, operators and skippers of all vessels the importance of a proper lookout by all available means including radar. Proper use of radar equipment including long range scanning and radar plotting allows for early detection, assessment and warning of vessels posing a risk of collision. This allows the watchkeeper sufficient time to take early and considered action to avoid collision in accordance with the International regulations for preventing collisions at sea, 1972 (as amended) (COLREGs).
The occurrence
Overview
On the evening of 12 August 2017, the timber-hulled fishing vessel, Mako, collided with the container ship Glasgow Express, about 15 NM south of Cape Woolamai, Victoria. Both vessels had been on settled courses and speeds for at least 2 hours before the collision. Despite both crews detecting and monitoring the other vessel, both vessels maintained their respective courses until they collided.
Mako
Earlier that evening, at 2000,[1] the 14.2 m long Mako (Figure 1) departed the fishing harbour in San Remo, Victoria, for a 3 day fishing trip. On board were the skipper and one deckhand. They had provisioned and fuelled the boat earlier in the day and were planning to be at their intended fishing grounds, in Bass Strait, at about 2300. In preparation for departure, the skipper had started and checked the boat’s navigational equipment (radar, chart plotter and VHF radio) and ensured the navigation lights were operating.
Figure 1: Mako alongside in San Remo after the collision
Source: ATSB
The crew reported that as they sailed out the channel, all deck working lights and external lights were on as they set the paravanes (stabilising arms). The lights remained on as the skipper steered the vessel out to sea. At about 2030, they passed the heads at San Remo at a speed of about 6 to 6.5 knots[2] and the skipper set a course of about 210°, which he intended to keep until nearing the destination. He took the watch while the deckhand settled in and went below for a rest.
The weather was overcast with light rain showers and about 15 knot winds from the south-west. The boat was rolling moderately in seas from the south-west and sea spray occasionally passed over the deck. The spray and light rain splattered the wheelhouse windows with water droplets.
At about 2230, the skipper roused the deckhand to take the watch while he rested prior to reaching the fishing grounds. During his watch the skipper had monitored a number of ships on the boat’s radar and visually. He passed on information regarding his last sighting of a ship that he determined was passing from port to starboard, ahead and well clear of Mako. All else seemed clear. He then lay down to rest on the bunk in the wheelhouse, immediately behind the conning position, and the deckhand took over. The deckhand reported that he did not verify the sighting of the ship or its echo on the radar as he settled in for the watch.
Glasgow Express
Meanwhile, at 2000, some 40 NM to the south-east of Mako, the 281 m long Glasgow Express (Figure 2) was en route from Sydney to Melbourne. At that time, the navigation watch changed and the second mate took over as officer of the watch (OOW), assisted by an ordinary seaman as lookout. The ship was south of Cape Liptrap, with a speed of 13.5 knots, on a course of 299°, bound for the pilot boarding-ground off the entrance to Port Phillip (Figure 3). The bridge log book recorded conditions as cloudy with good visibility, with the ship working moderately in rough seas with winds at Force 6[3] (22 to 27 knots) and a sea state of 5.[4]
Figure 2: Glasgow Express
Source: Hapag-Lloyd
At 2200, the lookout left the bridge to complete routine safety rounds. The second mate reported that, at about this time, he visually identified a well-lit vessel (Mako) about 3 points[5] to starboard of the bow. He watched the target and concluded it was on a similar course as the ship, and estimated it would pass more than 1 NM to starboard as Glasgow Express overtook it.
At about 2230 the lookout returned to the bridge and reported all was well on the safety rounds. He went to his lookout position on the starboard side of the bridge and also identified the vessel to starboard. The lookout reported the sighting to the second mate and together they agreed that the vessel was ahead of them, they were overtaking it, and that it would pass well clear of the ship. They also concluded the target was a fishing boat maintaining a similar course to their own. The lookout then maintained visual observation of the target. The second mate stated he did not attempt to identify, confirm and/or track the target on the radar located adjacent to the lookout’s position.
Following the collision, some data was downloaded from the Glasgow Express’s voyage data recorder (VDR). This data showed that, at 2222, an intermittent echo appeared on Glasgow Express’s S-band radar. This echo was Mako; 2.5 points to starboard and 5.5 NM from the ship. From 2232 onward, the echo would have been consistently visible on this radar.
The collision
At 2234, Mako and Glasgow Express were about 3 NM apart on converging courses. Mako’s deckhand had not observed the ship and was unaware of its presence. Glasgow Express’s bridge team continued to observe the brightly-lit Mako and to assumed that their ship would overtake and pass well clear, and to port of it. The Glasgow Express’s second mate continued to rely on visual observations for his understanding of the situation.
The fishing boat and the ship continued on their respective courses without change until, at 2246, in position 38° 45.5’ S 145° 13.6’ E, they collided (Figure 3).
Figure 3: Composite excerpt of Glasgow Express’s navigational chart (Aus 801) showing vessel tracks to collision
Source: Hapag-Lloyd; Australian Hydrographic Service; annotations by ATSB
Moments before the collision, Mako’s deckhand become aware of a light on the port beam, visible out the window of the portside wheelhouse door. He went to the door, shielded his eyes and looked out in time to see Glasgow Express’s bow bearing down on the fishing boat. He then saw the ship’s side and felt the impact. The skipper was immediately roused from his rest and moved the engine control lever to full astern. The boat was turned to starboard by the passing ship and the port stabiliser arm made contact with the ship’s side.
Shortly before impact, Glasgow Express’s second mate became aware of the immediate danger. He directed the lookout to take the wheel, engage hand steering and turn immediately, hard to port. At the same time, he sounded the ship’s whistle. The ship turned to port as the fishing boat contacted the hull on the starboard side in the region of cargo hold number 2—about 50 m aft of the bow.
After the collision
The fishing boat scraped down the starboard side and then passed aft of the ship. The fishing boat’s port stabiliser arm broke off and was dragged alongside by its lines. The skipper cut the stabiliser arm free and then attempted to determine the condition of the deckhand and the boat. The deckhand was shaken but otherwise unhurt. Inspection of the bow and forecastle revealed damage to the bow but no ingress of water.
GlasgowExpress continued to turn to port and slowed. The second mate called the master to report the collision and the master, who had been asleep in his cabin, hurried to the bridge. As the ship continued to turn, the second mate called Mako on the radio seeking information and offering assistance.
Over the following minutes the situation calmed. Radio contact continued between the ship’s master and the fishing boat skipper and shore authorities were alerted to the incident. The Australian Volunteer Coast Guard station at Hastings was alerted and activated its rescue boat to go to Mako’s assistance.
The ship’s master confirmed the condition of the fishing boat and crew and kept Glasgow Express standing by. The ship then escorted Mako back toward San Remo and the approaching coast guard boat. At 0130 on 13 August, Mako was taken under escort by the coast guard rescue boat and Glasgow Express was released. At 0200, the master resumed the ship’s passage toward Melbourne.
Mako was escorted to San Remo and at about 0300 was safely alongside.
Figure 4: Composite representative image showing the scale and approximate point of collision
Source: Hapag-Lloyd; ATSB
Damage
Mako suffered significant damage from the collision. The stem post was broken and the forecastle space was opened to the outside (Figure 5). However, the boat had remained otherwise watertight and did not take on any water. In addition, about 1 m of the bow was stoved in, the sheer strake[6] was marked and scratched for several metres along the port side, and the port stabiliser arm had broken away and the stabiliser arm mounting structure, including the boat’s main mast, had been pushed to starboard.
Figure 5: Damage to Mako
Source: ATSB
Glasgow Express was inspected while alongside in Melbourne. Scratch marks from Mako’s stabiliser arm were visible from the impact point, about 50 m aft of the bow on the starboard side, to the stern (Figure 6). No other damage was found.
Figure 6: Scratches along the side of Glasgow Express
The container ship Glasgow Express and the fishing vessel Mako collided at about 2246 on 12 August 2017. At the time the vessels were about 15 NM south of Cape Woolamai, Victoria. Both vessels had been settled on course and speed for at least 2 hours before the collision.
This analysis will examine the incident, collision avoidance requirements and the relationship to the lookouts kept on both vessels. It will also assess the relevance of automatic identification systems (AIS) and voyage data recorders (VDR) to this incident.
The collision
At 2036, Mako was settled on a course of about 210° at a speed of about 6 knots. At the same time, 31 NM to the south-east, Glasgow Express was settled on a course of 299° at a speed of 12 knots. From this point the two vessels were on a collision course unless some avoiding action was taken.
Glasgow Express’s officer of the watch (OOW) first sighted Mako at about 2200. Together, the OOW and the lookout mistakenly interpreted the visual information and agreed that they were overtaking the fishing vessel. No action was taken to use any other bridge equipment to confirm the actual situation, despite Mako being visible on the S-band radar intermittently from 2222, and continuously from 2232 (Figure 7).
On board Mako, visual and radar information was also misinterpreted, and it was assumed that Glasgow Express was passing well clear and ahead of the fishing vessel. As a consequence, the risk of collision was not identified and no avoiding action was taken.
At 2234 the two vessels were 3 NM apart and clearly visible to each other. However, the risk of collision was not identified on either vessel. As a consequence, no avoiding action was taken until the collision occurred 12 minutes later.
Figure 7: Glasgow Express's S-band radar image at 22:21:41 with the progress of Mako overlaid to the time of the collision
Source: Hapag-Lloyd with annotations by ATSB
Lookout and collision avoidance
Industry requirements and guidance
The International regulations for preventing collisions at sea, 1972 (as amended) (COLREGs) apply to all vessels at sea, including fishing vessels. The COLREGs require every vessel to maintain a proper lookout by ‘all available means’ so as to be able to make a full appraisal of the situation and to determine the risk of collision.
Specific mention is made in the regulations of the proper use of radar equipment to obtain early warning of the risk of collision. The regulations also warn against making assumptions based on scant information.
In addition, the COLREGs advise, among other things, that the risk of collision:
…shall be deemed to exist if the compass bearing of an approaching vessel does not appreciably change…
Other guidance and regulations[7] require that masters and all persons engaged in watchkeeping duties observe the standards and guidance regarding watchkeeping set out in Sections A-VIII/2 and B-VIII/2 of the International Convention of Training, Certification and Watchkeeping for Seafarers (STCW code).[8] The STCW code states that the officer in charge of the navigational watch is the master’s representative and is primarily responsible at all times for the safe navigation of the ship and for complying with the COLREGs.
STCW guidance on the principles to be observed in keeping a navigational watch require that:
a proper lookout must be maintained at all times
using all available means
fully appraising the situation and the risk of collision
in compliance with the COLREGs.
In performing a navigational watch, the STCW code requires that the OOW, among other things:
shall take frequent and accurate compass bearings of approaching vessels as a means of early detection of risk of collision
take early and positive action to avoid collision and ensure the actions are effective
use radar in compliance with the COLREGs
ensure that radar echoes are detected as early as possible
ensure that plotting and/or systematic analysis of radar echoes is commenced in ample time.
With regard to interaction between vessels, the COLREGs also state that any vessel overtaking any other shall keep out of the way of the vessel being overtaken. Furthermore, in a crossing situation where a risk of collision exists, the vessel which has the other vessel on its starboard side shall keep out of the way of that other vessel and shall as far as possible avoid crossing ahead of it.
Glasgow Express
The operator of Glasgow Express, Hapag-Lloyd Ship Management, has established and introduced a Safety Management (and Environmental Protection) System (SMS) throughout its fleet in accordance with the ISM Code.[9] This structured and documented system, in the form of a Safety Management Manual comprising the ISM Main Manual and ISM Emergency Plans, enables company personnel to effectively implement company policy.
The SMS includes guidance and procedures in relation to the navigation of the ship and maintaining a navigational watch. These procedures provide general guidelines for proper performance of the navigational watch, with reference to applicable and relevant rules, regulations and industry guidance. In particular, the SMS procedures require that at all times ships need to be navigated in compliance with the COLREGs, the master’s standing orders, and the STCW Code, as well as the knowledge and application of the guidance contained in the Bridge Procedures Guide.[10]
Glasgow Express’s OOW sighted the brightly-lit Mako at about 2200, at a distance of 11 NM. From that point, the OOW, and later the lookout, visually monitored it. They concluded, from their observations, that they were overtaking the fishing vessel, and believed the white lights were directed toward the stern of the fishing vessel and that one of them was its sternlight. Although the bright lights made Mako easily visible, initially this was at a distance significantly beyond that which its navigation lights are required to be visible (2 NM for sidelights and sternlight).[11]
As the vessels closed on each other, the bright decklights would have acted to obscure Mako’s navigation lights. In addition, the sidelights were positioned aft and inboard of Mako’s stabilising arms. In a seaway, these arms would have intermittently obscured the sidelight. To the observers on Glasgow Express, this would have made an accurate and complete appraisal of the situation, such as Mako’s heading, difficult based only on the vessel’s lights.
Having visually identified the presence of Mako, the OOW should then have made attempts to verify this target using other equipment, in particular the radar, and by monitoring its bearing over time. However, the OOW did not seek further information to confirm the visual sighting, including that he was seeing the fishing boat’s sternlight. A full appraisal of the situation using ‘all available means’ was therefore not made. Discussion between the OOW and lookout merely resulted in confirmation of the incorrect assumptions they had made.
Had the situation been confirmed by radar or by any other means, the overtaking scenario would quickly have been exposed as false. Confirmation by these means would have made it clear that the two vessels were in a crossing situation, with Glasgow Express as the give-way vessel. Regardless, the regulations required both the give-way vessel and the overtaking vessel—which Glasgow Express assumed that it was—to keep out of the way of the other vessel.
Furthermore, Figure 7 shows that for at least 25 minutes before the collision, Mako maintained an unchanging bearing in relation to Glasgow Express. As stated in the COLREGs, this is indicative of a collision situation. Glasgow Express’s OOW reported that he recalled first seeing the lights of Mako at about 2200. Mako’s bearing would have remained unchanged from this point. Therefore, there were more than 45 minutes in which the situation could have been clarified.
Notwithstanding this, the radar in operation on Glasgow Express was not set up to automatically acquire and track targets, in accordance with the practice of good seamanship. It is also usual practice to set up a radar guard zone, to provide warning of any target approaching within the minimum safe passing distance. Had this been done, an audible and visual alarm would have sounded as soon as the radar detected that the target, Mako, was on a collision course.
A proper lookout by ‘all available means’, as required by company and ship procedures, the master’s expectation and the regulations was not maintained on board Glasgow Express. Had the visual information, and the unchanging bearing of the target, been confirmed using radar, the risk of collision would have been clear. Effective avoiding action could have then been taken in time to prevent a collision.
Mako
As Mako departed San Remo, the skipper was aware that there was shipping traffic in the area through which Mako would pass. He set the radar and monitored a number of vessels both on the radar and visually. After the incident, the skipper recalled that he had seen a ship passing ahead and across Mako from port before he roused the deckhand to take the watch. He said he could see this ship’s starboard navigation light and concluded it would pass well clear of Mako. He passed this information on to the deckhand during handover at about 2230. The deckhand did not verify this sighting, or its echo, on the radar as he settled in for the watch.
Ship traffic information from AIS data and from Glasgow Express’s radar images show that there was a number of ships in the area on the evening of 12 August. However, after about 2100, the only ship passing port to starboard near Mako was Glasgow Express. It is likely, then, that the ship Mako’s skipper recalled observing was Glasgow Express. He had misinterpreted the situation and the danger posed by Glasgow Express when assuming it would pass clear.
Furthermore, Mako had all its decklights on throughout its voyage. Under the COLREGs, fishing vessels are not entitled to do this, and should have only their navigation lights on, unless actually ‘engaged in fishing’.[12] These bright floodlights served to reduce the effectiveness of Mako’s watchkeeper’s night vision and thus the ability to distinguish features beyond the glare of the lights. This was exacerbated by sea spray and light rain obscuring the windows. This reduced the likelihood that Mako’s watchkeeper would have visually identified the presence of Glasgow Express.
In addition, many fishing vessels are constructed with the working deck located forward of the wheelhouse. Some, such as Mako, are also fitted with fishing net winch drums on the working deck. These winch drums can be of substantial size and, as a result, create blind sectors and obscure the view forward from the wheelhouse (Figure 8). Current regulations[13] (available at www.amsa.gov.au) limit the extent of such obstructions. However, these regulations have not been applied retrospectively and consequently, older vessels, such as Mako, continue to have equipment mounted on the foredeck obscuring the field of vision from within the wheelhouse.
Large equipment mounted on the foredeck presents as a significant risk to maintaining a proper lookout by watchkeepers. However, in this case, given the relative bearing of the Glasgow Express, it is unlikely that the winch drum significantly affected the ability of Mako’s watchkeeper to detect the other vessel. Nevertheless, it is important that this limitation in vessel design is recognised and understood by fishing boat crews in order to account for blind sectors and prevent future collisions.
Figure 8: View from the conning position in Mako’s wheelhouse
Source: ATSB
In summary, Mako was brightly lit in contravention of the COLREGs and a proper lookout as required by the COLREGs and prudent seamanship was not being maintained. Misinterpretation of radar information and limitations posed by the glare from the decklights combined with other factors led to Glasgow Express not being identified as a collision risk. As a consequence, no avoiding action was taken.
Navigation equipment requirements for domestic commercial vessels
The Australian Maritime Safety Authority (AMSA) is responsible for the safety of vessels and the seafarers who are operating in the domestic commercial industry. At the time of the collision, Mako was in survey with AMSA as a Class 3B domestic commercial vessel (DCV). Under current legislation, Class 3B vessels are required to carry an AIS Class B receiver/transmitter unit. However, grandfathering of survey arrangements for older DCVs (built before July 2013) allows them to continue to operate under the survey requirements that existed before the introduction of the national standards. Built in 1980, Mako was not required to have an AIS unit fitted to comply with survey requirements, and an AIS unit was not fitted on Mako at the time of the collision.
AIS is a VHF radio broadcasting system that transfers packets of data including course, speed and other pertinent vessel details. The system enables AIS-equipped vessels and shore-based AIS stations to send and/or receive identification information that can be displayed on an electronic chart, computer display, compatible radar or standalone unit. In this way, the information received can provide the navigational watchkeeper with immediate information regarding traffic in the area. This information can then be used as part of the all available means to assist the watchkeeper in making a full appraisal of the situation and of the risk of collision.[14]
Had Mako been fitted with and used an AIS transceiver, and depending on how the equipment was configured, the watchkeeper could have been alerted to the presence of Glasgow Express on 12 August. This information could then have been used to correctly appraise the situation and the taking of necessary action to avoid a collision. For this reason, it would be prudent for older vessels, such as Mako, to carry and use this equipment.
Glasgow Express was fitted with an AIS Class A receiver/transmitter unit, as required by SOLAS.[15] Had Mako carried and been using an AIS this would have been detected by equipment on Glasgow Express. The ship’s radar could have automatically acquired and tracked Mako, triggering alarms if the vessel was to approach too closely, within a prescribed distance. The risk of collision would then have been readily apparent to the OOW and appropriate action could have been taken.
That said, the actions of Glasgow Express’s OOW, and the VDR recording, show that the ship’s radars were not set up to acquire and track AIS targets. It is, therefore, likely that even if Mako had been carrying an AIS, it would have made little difference to the actions on board Glasgow Express.
Previous collisions between ships and small vessels
The ATSB has been concerned about the number of collisions between trading ships and small vessels for many years. From 1990 to 2017, 63 collisions between trading ships and small vessels (excluding attending tugs) were reported to the ATSB or its predecessor. Of these, 38 were investigated. These safety investigations have consistently shown that keeping a proper and effective lookout and taking early avoiding action in accordance with the COLREGS could have prevented those collisions in almost every instance.
In a 2014 safety investigation report,[16] the ATSB issued a Safety Advisory Notice (MO-2014-006-SAN-019) to industry, which stated:
The Australian Transport Safety Bureau reinforces to masters, owners, operators and skippers of all vessels, the importance of taking all necessary measures to ensure that a proper and effective lookout, in accordance with the collision regulations, is kept at all times and early avoiding action in accordance with those regulations is taken to prevent collision.
Unfortunately, these types of collisions are still occurring. While measures to prevent collisions might appear straightforward, the recurrent contributing factors in collisions between ships and small vessels indicate that further effort is required from operators and crews to implement such measures.
Human performance aspects that are relevant to some of these collisions include expectancy and confirmation bias. Expectations are based on past experience and other sources of information, and they strongly influence where a person will search for information, what they will search for and their ability to notice and recognise a target or relevant aspect of a situation (Wickens and McCarley 2008). If the expectations are incorrect, then a person will be less likely to detect the target or a relevant aspect of the target (such as the heading or speed).
People generally seek information that confirms or supports their hypotheses or beliefs, and either discount or do not seek information that contradicts those hypotheses or beliefs. When the available information is ambiguous, it will generally be interpreted as supporting the hypothesis. This confirmation bias is an inherent aspect of human decision-making and has been demonstrated to occur in a wide range of contexts (Wickens and Hollands 2000).
If an assessment of another vessel’s heading and speed is based on limited or incomplete information, there is a significant likelihood it will be incorrect. However, aspects such as expectancy and confirmation bias mean an initial incorrect assessment may not be effectively identified and corrected. Accordingly, it is imperative that crews follow the relevant requirements and guidance, and use all available means when looking out for, and then monitoring, other vessels.
Small vessels can improve their detectability with aids such as AIS transceivers and radar reflectors. An AIS transceiver can also assist small vessel crews in the early detection of ships and provide important dynamic and static ship information.
For ships, allowance must always be made for crew errors, and systems must be robust enough to detect errors or omissions before an accident results. Configuring the ship’s radar to automatically acquire and track other vessels fitted with AIS and triggering alarms if the vessel was to approach too closely is one solution currently available to compensate for human fallibility.
In addition to many previous ATSB investigation reports, a number of ATSB safety bulletins also highlight collision risks to educate seafarers and mariners. These documents and other safety information about marine safety issues are available on the ATSB website.
Voyage data recorder data and recovery
All ships of 3,000 gross tonnage or more, constructed on or after 1 July 2002, are required to carry a VDR to assist with accident investigation. Glasgow Express was fitted with a Simplified Voyage Data Recorder (S-VDR). The S-VDR consisted of the final recording medium contained in the protective capsule, which held at least 12 hours of data, and a removable compact flash memory card, which could be preserved by the crew following an incident.
Glasgow Express’s crew initiated the save procedure following the collision on 12 August 2017, and removed the compact flash memory card from the system. The S-VDR continued in an operational state, with data on the protective capsule being overwritten. However, the compact flash memory card installed at the time the save function was initiated was not of sufficient size to record the previous 12 hours of data.
Upon ATSB investigators attending the vessel the data loss was identified, and a subsequent review and download of the data contained within the protective capsule was performed. Radar images and parametric data at the time of the incident were able to be retrieved, however, the bridge audio data had already been overwritten.
In addition to providing beneficial information to investigations following an incident or accident, appropriate use of the data recorded on VDRs can be of value to operators for such things as analysing vessel performance. Further, routine download of data by crews would ensure they are familiar with the operation and requirements of the system fitted to the vessel. This would then allow for effective recovery of data in the case of an incident or accident.
From the evidence available, the following findings are made with respect to the collision between the container ship Glasgow Express and the fishing vessel Mako on 12 August 2017 about 15 NM south of Phillip Island, Victoria. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
A proper lookout using ‘all available means’ was not maintained on board Glasgow Express. In particular, radar was not used and the relative bearing of the other vessel was not monitored over time.
A proper lookout was not maintained on board Mako. In particular, radar was not effectively used, and little if any visual sightings were conducted after it was (incorrectly) assessed that Glasgow Express was passing clear.
Mako was operating with all decklights on while under way. Although the bright lights increased the ability of Glasgow Express’s crew to detect the presence of the vessel, they also made it more difficult to determine its navigation lights and accurately and completely appraise the situation. In addition, glare from the lights likely made it more difficult for the crew of Mako to visually detect the presence of other vessels.
Other factors that increased risk
Mako did not have an Automatic Identification System (AIS) transceiver fitted, nor was such a unit required to be fitted because of the age of the vessel. Had an AIS been carried, the presence of Glasgow Express could have been alerted to Mako’s crew. In addition, relevant information about Mako, such as heading and speed, would have been available to the bridge team on Glasgow Express.
As with many other fishing vessels, Mako had a fishing reel mounted forward of the wheelhouse, which significantly obstructed the watchkeeper’s ability to maintain a visual lookout forward. This increased the risk of objects not being detected and therefore of collision.
Other key findings
Glasgow Express was fitted with a voyage data recorder, and the crew attempted to download the data following the collision. However, due to the use of an undersized memory card, not all of the available information was able to be effectively downloaded and made available to the safety investigation.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Hapag-Lloyd Ship Management
Hapag-Lloyd Ship Management, Glasgow Express’s operator, notified the ATSB that the incident had prompted a fleet-wide information program outlining details of the incident. The program emphasised that the officer of the watch was responsible for ensuring safe navigation at all times in accordance with collision regulations and using all available means.
In addition to this, voyage data recorder annual performance test procedures were amended to include ensuring the correct memory card is fitted.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the master and watchkeepers of Glasgow Express
the owner, skipper and deckhand of FV Mako
Hapag-Lloyd (operator of Glasgow Express)
the Australian Maritime Safety Authority (AMSA)
the Australian Volunteer Coast Guard
the Federal Bureau of Marine Casualty Investigation (BSU), Germany
Marine and Safety Tasmania (MaST)
Maritime Safety Victoria.
References
Australian Maritime Safety Authority 2013, Information for Seafarers regarding Watchkeeping Standards, AMSA, Canberra. Available at www.amsa.gov.au.
Australian Maritime Safety Authority 2015, Marine Order 28 (Operating standards and procedures) 2015, AMSA, Canberra. Available at www.amsa.gov.au.
Australian Maritime Safety Authority 2016, National Standards for Domestic Commercial Vessels,Part C Design and construction, Section 1 Arrangement, accommodation and personal safety, AMSA, Canberra. Available at www.amsa.gov.au.
International Chamber of Shipping 2016, Bridge Procedures Guide, Marisec Publications, London.
International Maritime Organisation, The International Convention for the Safety of Life atSea (SOLAS) 1974 as amended, IMO, London.
International Maritime Organisation, The International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (STCW), 1978, as amended, IMO, London.
International Maritime Organisation, 1995, International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code) as amended, IMO, London.
International Maritime Organisation, 1995, Seafarer’s Training, Certification and Watchkeeping (STCW) Code, 1995, as amended, IMO, London.
International Maritime Organisation, 1997, Resolution A.861(20) Performance Standards for Shipborne Voyage Data Recorders, IMO, London.
International Maritime Organisation, 2004, Resolution MSC.163(78) Performance Standards for Shipborne Simplified Voyage Data Recorders (S-VDRs), IMO, London.
International Maritime Organisation, 2006, Resolution MSC.214(81) Adoption of Amendments to the Performance Standards for Shipborne Voyage Data Recorders (VDRs) (Resolution A.861(20)) and Performance Standards for Shipborne Simplified Voyage Data Recorders (S-VDRs), IMO, London.
International Maritime Organisation 2012, MSC.333(90) Adoption of Revised Performance Standards for Shipborne Voyage Data Recorders (VDRs), IMO, London. Available at: http://www.imo.org/en/KnowledgeCentre/
Lee WU, Parker J 2007, Managing Collision Avoidance at Sea, The Nautical Institute, London.
The United Kingdom Hydrographic Office (UKHO), 2004, The Mariner’s Handbook, 8th edn, UKHO, Taunton, England.
Wickens CD & Hollands JG, 2000, Engineering psychology and human performance, 3rd edition, Prentice-Hall International Upper Saddle River, NJ.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the master and watchkeepers of Glasgow Express, the owner, skipper and deckhand of FV Mako, Hapag-Lloyd, the Australian Maritime Safety Authority (AMSA), the Federal Bureau of Marine Casualty Investigation (BSU), Germany and Marine and Safety Tasmania (MaST).
Submissions were received from AMSA and Hapag-Lloyd. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
333-MO-2017-007
Occurrence date
12/08/2017
Location
About 15 NM south of Cape Woolamai in the Bass Strait
On 15 August 2017, the pilot of a Robinson R44 helicopter, registered VH-HBV (HBV), conducted a private ferry flight from Cooktown to Mossman, Queensland. After refuelling in Mossman, the helicopter departed for a short ferry flight to Julatten, Queensland. The pilot was the sole occupant of the helicopter.
At about 1520 Eastern Standard Time,[1] the helicopter approached the landing site in a northerly direction. The pilot conducted an orbit at about 300–500 ft above the site to assess the conditions and then commenced the approach.
Just prior to touchdown, the pilot pulled back on the cyclic.[2] As a result, the tail rotor struck the ground behind the helicopter. The pilot felt the tail contact the ground through the airframe and pedals. The helicopter shuddered violently and yawed[3] rapidly to the right.
As the helicopter completed a 360 degree turn with the skids about 3–5 ft above the ground, the pilot lowered the collective[4] in an attempt to land on the helipad. The helicopter was still yawing as the skids contacted the helipad. It rolled over, the main rotor blades struck the ground and the helicopter came to rest on its left side.
The pilot was uninjured, and the helicopter sustained substantial damage (Figure 1).
Figure 1: Accident site showing damage to VH-HBV
Source: CASA
Pilot comments
The pilot commented that there were trees along the approach to the landing site, but it did not require a steep approach path and consequently he conducted a shallow approach. The wind at the time was from the south-east at 10 to 15 kt, but, due to the sheltered location, there was no wind at the landing site.
A company helicopter had landed shortly before HBV, and was parked on the front of the pad. The pilot commented that he may have looked at that helicopter as he touched down, which led to pulling back on the cyclic. HBV was an older model R44 helicopter than the pilot had flown previously and he reported that when the cyclic was in the neutral position, it sat slightly further forward than he was accustomed to. The pilot also commented that had he rolled off the throttle immediately after the tail rotor struck the ground, it would have reduced the helicopter’s rate of rotation and potentially prevented the rollover. He stated, however, that he did not recognise the developing situation, and roll off the throttle, before the helicopter began yawing. He also reported being unable to land the helicopter until it had rotated through 360° due to concern about terrain contact. Finally, the pilot recalled that he rolled off the throttle upon lowering the collective but the yaw did not stop completely prior to the skids contacting the ground.
The chief pilot, who witnessed the accident, indicated that the helicopter came in with the tail a bit lower than normal, the tail rotor struck a small mound of dirt, and the tail rotor and gear box detached. He commented that the pilot only weighed about 65 to 70 kg and, without any passengers or gear on board, the centre of gravity of the R44 is quite aft and the tail is therefore lower than when more heavily loaded. He further stated that the fuel tank was about three-quarters full, and the helicopter was within weight and balance limitations.
Safety analysis
The pilot applied aft cyclic just prior to touchdown, which resulted in a slightly tail-low attitude for landing. The tail stinger would normally contact the ground and prevent a tail rotor strike. However, because the ground sloped away behind the concrete landing pad, the stinger was over the slope, allowing the tail rotor to strike the ground and detach without prior warning (Figure 2).
Following separation of the tail rotor and gearbox, the helicopter yawed rapidly to the right through 360° in response to the torque associated with the still‑powered main rotor. As the pilot did not roll the throttle off quickly enough to reduce the rate of yaw of the helicopter prior to lowering the collective, the helicopter was still yawing when the skids contacted the ground. Consequently, it rolled over and the main rotor blades struck the ground.
Figure 2: Sloping ground away from helipad and tail rotor strike marks
Source: Queensland Police
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot applied aft cyclic just prior to touchdown, resulting in a tail-low attitude.
The ground sloped downwards away from the landing pad and as a result, the tail stinger did not protect the tail rotor from ground contact.
The tail rotor struck the ground and detached, resulting in the helicopter yawing rapidly to the right. The pilot did not roll off throttle to reduce the yaw rate prior to lowering the collective, which probably led to the helicopter rolling over as the skids contacted the ground.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
Helicopter operator
As a result of this occurrence, the helicopter operator has taken the following safety actions:
Company pilots were briefed immediately following the accident, and subsequently trained, with regard to flying alone or with very little cargo. R44s are inclined to have a nose-high attitude when light, which often results in tail and stinger encroaching too close to terrain.
The company hazard register was updated to highlight the issue and company pilots were required to read the updated register. Pilots were advised that higher flare and slower approaches can mitigate the hazard.
Company pilots were briefed regarding hazards associated with helicopter landing sites and bush landing sites with sloping terrain and any obstacle that may come into contact with tail rotor or helicopter.
Retraining of company pilots in special procedures, including the conduct of hovering autorotations was conducted between October and November 2017. The operator assessed that use of this technique would have reduced the damage to the helicopter.
Safety message
This occurrence highlights that a loss of tail rotor thrust at low speed and low height above the ground requires an immediate and correct response to maintain control of the helicopter. It is therefore important that pilots are primed for this emergency, particularly during the approach and departure phases of flight.
The United States National Transportation Safety Board Safety Alert Loss of tail rotor effectiveness in helicopters states that due to safety concerns, training for loss of tail rotor effectiveness (LTE) is rarely conducted in an actual helicopter. While this incident involved the detachment of the tail rotor rather than aerodynamic LTE, the stated pilot responses to LTE are applicable here and consistent with the manufacturer’s emergency procedures.
The US Federal Aviation Authority Advisory Circular 90-95 stated under effective recovery techniques (for LTE), that collective pitch reduction will aid in arresting yaw rate but may cause an increase in the rate of descent. If the rotation cannot be stopped and ground contact is imminent, an autorotation (i.e. rolling off throttle) may be the best course of action. While the pilot’s action in lowering the collective during this occurrence may have reduced the yaw rate, following the manufacturer’s emergency procedure for a loss of tail rotor thrust during hover will provide the best outcome when close to the ground. That is, if uncommanded yaw is experienced that cannot be stopped by application of opposing tail rotor pedal:
fully roll off the throttle and allow the helicopter to settle while controlling any drift
raise the collective just before touchdown to cushion the landing.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1615 Eastern Standard Time (EST), on 8 August 2017, the Aerodrome Reporting Officer (ARO) of Middlemount Airport, Queensland, inspected the runway prior to the arrival of two aircraft. The ARO found no abnormalities with the runway or runway lighting.
The first aircraft was an Embraer EMB-135LR, registered VH-JGB, operated by JetGo Australia as a charter flight from Brisbane, Queensland. On board the aircraft was a training captain, a captain under line training, a cabin crewmember and 23 passengers.
The captain under training had recently joined the aircraft operator. This was his second flight with the operator, and first to Middlemount. The flight was also his second flight on the aircraft type, having completed aircraft type training in a simulator.
During the flight, the flight crew reviewed the company briefing package for Middlemount and noted that the runway was not equipped with visual approach slope guidance.[1]
At 1643, the captain under training, acting as pilot flying,[2] positioned the aircraft on the downwind leg of the circuit for runway 11 at Middlemount. The flight crew elected to extend the downwind and final circuit legs beyond the standard length to allow the captain under training to familiarise himself with higher terrain to the north-west of the airport and radio masts in the vicinity of the runway 11 approach path. During the final approach leg, the training captain observed that the aircraft appeared to be slightly below the desired approach profile but determined that it did not require him to take corrective action.
At 1647, the aircraft landed on runway 11. The flight crew did not detect anything abnormal during the landing. The ARO observed the landing and noted that the aircraft appeared to touchdown early. The aircraft then taxied to parking normally.
A runway inspection was not carried out prior to the arrival of the second scheduled flight. The second flight arrived without incident, the ARO noted that the touchdown point for this flight appeared to be in the normal touchdown zone (Figure 1).
Figure 1: Overview of runway 11 threshold
Image shows the positions of the beginning of the runway, runway threshold lights, aiming point markers and touchdown zone. Source: Google earth, annotate by ATSB
At about 1840, the ARO conducted an inspection of the runway prior to the departure of the two aircraft. During the inspection, the ARO identified two damaged runway threshold lights (Figure 2) and fresh tyre marks (Figure 3) about four meters further along the runway from the damaged lights. The ARO immediately proceeded to VH-JGB, and advised the flight crew that he believed they had damaged the runway threshold lights during their landing. The training captain inspected the aircraft tyres and landing gear and determined that the aircraft had not sustained any damage.
Figure 2: Damaged runway threshold lights
Images shows the damage to the runway threshold lights (left and centre), and a tyre mark on a damaged light (right). Source: Airport operator, annotated by ATSB
At about 1935, the ARO cleared the debris and determined the runway to be serviceable.
At 1954, VH-JGB departed runway 11 at Middlemount for Brisbane. After the aircraft arrived at Brisbane, an engineering inspection of the aircraft found no damage.
No persons were injured, and the aircraft was not damaged in the incident.
Figure 3: Runway 11 threshold
Image shows the damaged runway lights, touchdown tyre marks and runway light debris. Source: Airport operator, annotated by ATSB
Training captain comments
The training captain made the following comments:
Middlemount is the only airport the operator regularly serves which does not have visual approach slope guidance.
The selected touchdown aim point was the aiming point markers.
During the late stages of the approach, the demands of acting in the pilot monitoring role and monitoring the captain under training resulted in a very high workload.
Captain under training comments
The captain under training made the following comments:
In his previous role, the captain under training received extensive training and operational experience in conducting approaches without visual approach slope guidance. These operations were on the Beechcraft King Air 200 turboprop aircraft. He had extensive experience in jet aircraft. However, the incident flight was the first time he had conducted an approach without visual approach slope guidance in a jet aircraft.
The simulator training provided by the company included narrow runway operations and approaches without visual approach slope guidance. The captain under training also commented that he would have liked to have received more simulator training for visual approaches without slope guidance, and it would be beneficial if these types of approaches were conducted later in the line training phase.
While the approach appeared to be slightly lower than normal, as the aircraft descended through about 500 ft above ground level, the training captain called ‘stable’, indicating the approach was within tolerances. This reassured the captain under training that the approach was proceeding normally.
The demands of operating a new aircraft type, with new operating procedures, to a runway without visual approach slope guidance resulted in a very high workload during the approach.
Aerodrome reporting officer comments
The ARO made the following comments:
There was no defined procedure in place to conduct runway inspections. However, where possible, runway inspections were carried out before and after JetGo arrivals. The second flight arrived about 15 minutes after VH-JGB. The time period between the two arrivals did not allow for a runway inspection.
The ARO regularly observed JetGo arrivals and had a good understanding of the expected touchdown point.
Flight recorders
The aircraft was equipped with a flight data recorder which recorded the flight data associated with the occurrence.
Approach path
The flight data shows (Figure 4) that at 16:47:10, the aircraft was positioned on about a three-degree approach path. At this time, the descent angle increased until the aircraft flared for landing.
Figure 4: Graphical representation of recorded flight data
The data plot shows the main landing gear air/ground switch position, engine power, ground speed and pressure altitude. A representative three degree approach path and the landing are annotated. Source: ATSB
Touchdown point
The recorded touchdown point of the aircraft was consistent with the fresh tyre marks observed by the ARO.
Flight crew workload
The flight crew reported that during the approach they experienced a period of very high workload.
The flight crew also reported not detecting anything abnormal during the landing and first becoming aware of the incident when notified by the ARO.
Under conditions of stress, an individual’s attention will channel or tunnel. Focus on peripheral tasks will be reduced and centralized on to main tasks. What differentiates a main task from a peripheral task depends on what the individual perceives to be of greatest importance or greatest salience. Tunnelling of attention can result in either enhanced performance or reduced performance, depending on the nature of the task and the situation.
Aircraft operator report
The aircraft operator conducted an investigation into the incident and provided the following observations:
The flight crew felt no urgency to land the aircraft before the touchdown zone due to performance limitations. The calculated landing distance required was 1,306 m, and the landing distance available was 1,550 m.
During the landing flare, the captain under training reported having to raise his head to maintain visual contact with the runway and had difficulty in determining if the landing would be before the aim point. An incorrect seating position likely contributed to the collision with the runway lights.
Standard length downwind and final circuit legs, along with a correct seating position and corrective callouts by the training captain would have been more representative of the simulator training received by the captain under training.
Safety analysis
During final approach the aircraft descended below the final approach path, and the aircraft landed prior to the selected aim point. Prior to landing, the main landing gear tyres collided with two runway threshold lights.
This was the captain under training’s first approach without visual slope guidance in a jet aircraft. Combined with the demand of operating a new aircraft under new operating procedures, resulted in a high workload for the pilot under training during the approach. The training captain also experienced a high workload due to the demands of acting in the pilot monitoring role and monitoring the captain under training.
The high workload of the flight crew during the approach, along with the absence of approach slope guidance, likely reduced the flight crew’s ability to detect the flight path deviation.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The aircraft descended below the desired approach path and landed prior to the selected aim point. Prior to landing, the aircraft collided with two runway threshold lights.
A flight involving a captain under line training, with high workload during final approach associated with the line training, along with the absence of approach slope guidance, resulted in the flight crew not detecting that the aircraft had descended below the desired approach path.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Changes to procedures
Landings at Middlemount will be made by captains only.
Line training flights will not operate to Middlemount.
Training for operations without approach slope guidance will be conducted as standalone training following a period of consolidation of line flying after the completion line training.
Flight crew education and training
Aircrew notices were circulated to all flight crew, providing education on operations without vertical profile guidance and Middlemount operations. The landing technique contained within the FCOM was amended to include addition information regarding runway visual illusions.
The flight crew involved in the incident underwent additional training in approaches without visual approach slope guidance prior to resuming operations to aerodromes without visual approach slope guidance.
Safety message
The ATSB has identified descending too low on approach as a risk area requiring heightened attention. When compared to other phases of flight, the approach and landing has a substantially increased workload and is traditionally the phase of flight associated with the highest accident rate. Flight crews must continuously monitor aircraft and approach parameters, and the external environment to ensure they maintain a stable approach profile and make appropriate decisions for a safe landing.
The impact of workload can be insidious, the affected individual not realising an increase until it has reached a high level. The best way of managing workload is to reduce the level of work demands and distractions. If the work demands cannot be reduced, then another option is to ensure the flight crew have the experience, skills and techniques to effectively manage their task demands. Overall, high workload can have significant effects on flight crew performance and needs to be monitored and managed using a systemic approach, particularly for less experienced flight crew, but also flight crew who have recently undertaken a new role.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 2 August 2017, the pilot of a Robinson R22 Beta II helicopter, registered VH‑HGU and operated by Cloncurry Mustering Company, departed Cloncurry Airport, Queensland, on a ferry flight in preparation for an aerial mustering operation. About 3 minutes after take-off, the pilot experienced a loss of control and the helicopter broke-up in-flight. The helicopter collided with terrain about 7 km north-north-west of Cloncurry. The pilot, who was the only occupant, was fatally injured and the helicopter was destroyed.
What the ATSB found
The ATSB found that the helicopter had recently undergone a 2,200-hour overhaul and this was the first commercial flight since that time.
The on-site examination established that the bellcrank in the helicopter cyclic control assembly was missing a fastener, which allowed the assembly to disconnect in-flight. The ATSB concluded that it was likely that the fastener’s self-locking nut was either not reinstalled or it was inadequately torqued during the overhaul. While it could not be determined what had occurred to result in this condition, it was noted that Cloncurry Air Maintenance (CAM) did not use the work-pack to record and track all maintenance activities during the overhaul, which extended over a period of almost 4 months.
The ATSB noted that, in the years leading up to the accident, the CAM workforce structure had changed in a manner that reduced the levels of its qualifications and experience. In the month leading up to the accident, the CAM workforce was operating at a very high workload, which likely exceeded their workforce capability and reduced the chief engineer's capacity to oversight maintenance activities.
Cloncurry Air Maintenance (CAM) had limited internal independent oversight of maintenance activities to evaluate its quality performance. The organisation was subject to both contracted and regulator audit activities in the years leading up to the accident. The ATSB reviewed two of the work-packs sampled during the audits and noted that discrepancies in their maintenance documentation practices were visible to the auditors. However, the auditors had not identified any issues associated with those practices, and therefore, the audits were of limited benefit to CAM.
It was also established that CAM were re-using the MS21042L-series nuts on critical fasteners without replacing them with D210-series corrosion resistant nuts in accordance with the manufacturer's instructions. However, the ATSB also found that the re-use of self-locking nuts was a common and accepted industry practice.
What's been done as a result
Cloncurry Air Maintenance have improved their maintenance practices, which has included progressive certification for tasks, adopting the helicopter manufacturer’s checklists for their inspections, removing all untracked MS-series self-locking nuts from stores, and completing inspections of the flight controls on all the Cloncurry Mustering Company helicopters with nil defects reported.
In March 2019, the Australian Transport Safety Bureau issued a safety advisory notice advising all Australian maintenance personnel for Robinson helicopters to ensure that before re-using a self‑locking nut, that the correct part number is fitted, and that the D210-series corrosion-resistant nuts are used for reassembly of critical fasteners in accordance with the Robinson Helicopter Company instructions for continued airworthiness.
As a result of this accident and other investigations by the Civil Aviation Safety Authority, the regulator issued airworthiness bulletin 67-005: Robinson Helicopter Flight Controls – Independent Inspections. The bulletin highlighted the need for independent inspections to be conducted and ‘recorded consecutively with each adjustment made during rotor tracking and balancing’ activities. In addition to several recommendations, the bulletin identified several human factor elements that could impact maintenance inspection performance, and highlighted the need for extra caution to be exercised during post-maintenance flights as per the guidance provided by Robinson.
Safety message
Although verbal communications are an important method of explaining and understanding problems, they are not a reliable means for capturing essential tasks over an extended time‑period. This accident highlights the importance for maintenance organisations to consider the human factors elements associated with their practices, capture them in their documented quality control procedures, and ensure they are complied with.
Audits are essential for independently verifying the effectiveness of an organisation's processes and procedures. This accident reinforces the importance of auditors inspecting the evidence collected during an audit to ascertain whether or not the requirements are being met, specifically conformance with the relevant standards. Audits may also be used to identify potential underlying human factors issues, which may be raised as an opportunity for improvement to inform the auditee of best industry practices.
The occurrence
On the morning of 2 August 2017, the pilot of a Robinson R22 Beta II helicopter, registered VH‑HGU and operated by the Cloncurry Mustering Company (CMC), was conducting a ferry flight from Cloncurry Airport, Queensland in preparation for an aerial mustering operation at a station to the north of Cloncurry.
The helicopter had departed from Cloncurry Airport just after first light, at about 0659 Eastern Standard Time.[1] The pilot’s colleagues reported observing the pilot warming up the engine and then take-off with a normal profile to the north. They also stated that the helicopter sounded normal on departure.
Shortly after the helicopter departed, staff from CMC and their maintenance organisation, Cloncurry Air Maintenance (CAM), observed a plume of smoke to the north. A company pilot noted that the smoke was in the general direction of VH-HGU’s track and was drifting towards the west. The pilot attempted to contact the accident pilot via mobile phone at 0713, but the call went to message bank. The company pilot departed with a colleague in another R22 towards the smoke.
The helicopter wreckage was located about 7 km north-north-west of Cloncurry Airport at about 0718 (Figure 1). The pilot was fatally injured and the on board global positioning system device indicated the accident occurred at about 0702.
Figure 1: VH-HGU accident site
Source: ATSB
On landing near the wreckage, the company pilot made a phone call to report the accident, and activated an emergency beacon to assist the emergency services with locating the site. The pilot noted there was very little soil disturbance, normally associated with main rotor blade strikes to the ground during an accident sequence. The pilot also considered the location of the accident site was consistent with the track the accident pilot would have flown to the station for the contracted work. Soon after, the emergency services arrived at the accident site and took control of the scene. The accident was not considered survivable.
Another company pilot, who departed Cloncurry just prior to the accident pilot, reported hearing no communications on the company’s mustering radio frequency. At 0702:29, an unidentified transmission occurred on the Cloncurry Airport common traffic advisory frequency. However, it was only momentary (about 1 second duration) and did not contain any voice data.
Powerline inspection
The most significant feature near the accident site was the Ernest Henry Mine high voltage powerlines, about 70 m to the west of the accident site. The first responders from CMC noted the powerlines were intact and that no other aircraft were known to be in the area at the time. Staff from the powerline company attended the site with a remotely piloted aircraft to inspect the pylons and lines. On completion of that inspection, they concluded there was no evidence of impact damage.
The pilot started flying training in 2002, and had been employed by the Cloncurry Mustering Company (CMC) since 2004, and held a Commercial Pilot Licence (Helicopter) with a flight instructor rating for low‑level helicopter operations and aerial-mustering. The pilot’s most recent flight review was on 15 November 2016 in an R22 helicopter. The pilot held a Class 1 Aviation Medical Certificate with no restrictions and an expiry date of 2 February 2018. On 6 January 2017, 10,000 flying hours experience was recorded on the pilot’s medical examination questionnaire.
On 1 August 2017, the night before the accident flight, the pilot went to bed at about 2000. The next morning, the pilot left home for work at about 0530. Several colleagues spoke with the pilot between 0600 and 0700 at the company’s hangar facility at Cloncurry Airport and reported the pilot’s demeanour as normal.
From the operator’s records, the accident occurred on the pilot’s third consecutive day of flying, which included 12.2 hours flying in the previous 2 days. Prior to that period, the pilot had not flown for 8 days. The time of the accident was not in the circadian low period and did not include an extended period of duty.
Helicopter information
General information
VH-HGU was a two-seat Robinson Helicopter Company (RHC) R22 Beta II helicopter, serial number 4335, powered by a 4-cylinder, carburettor Textron Lycoming O-360-J2A engine (Figure 2). It was manufactured in 2008 and registered in Australia in July of the same year. The helicopter was added to the CMC fleet on 16 February 2017.
Figure 2: Example R22 helicopter
Source: Queensland Police Service
Drive system
Engine power is transmitted to a V-belt sheave bolted to the engine output. The V-belts transmit power to the upper sheave, which transmits power forward to the main rotor and aft to the tail rotor. Flexible couplings[2] are located at the main gearbox input (forward flexible coupling) and at each end of the tail rotor drive shaft (intermediate and aft flexible couplings).
Rotor systems
The main rotor has two blades mounted to the main rotor hub by coning hinges.[3] The hub is mounted to the main rotor shaft by a teeter hinge. Droop stops for the main rotor blades, mounted near the top of the main rotor mast, provide a teeter hinge friction restraint, which normally prevents the rotor from teetering (rocking) while stopping or starting. Elastomeric teeter stops,[4] mounted in brackets in-line with the main rotor blades, limit the teetering during normal flight conditions and will provide a damage witness mark if there is excessive teetering of the main rotor system in-flight. The main and tail rotor systems are fitted with pitch links to transmit the flight control inputs to the rotor blades.
Flight controls
Primary controls are actuated through push-pull tubes and bellcranks. Flight control operation is conventional. The tail rotor pedals change the pitch of the tail rotor blades, and therefore the thrust, of the tail rotor system, which provides directional control. The collective[5] lever controls the amount of thrust (lift) produced by the main rotor disc. Raising or lowering the collective lever will raise or lower the swashplate,[6] which will alter the pitch on both main rotor blades to increase or decrease the main rotor thrust. The collective lever also incorporates a twist grip to provide the pilot with full manual control of the engine throttle.
The cyclic[7] control tilts the main rotor disc to point the rotor thrust in the desired direction of flight. Fore-aft movement of the cyclic provides the longitudinal (pitch) control of the main rotor disc. Forward movement will tilt it down at the front and up at the back, and aft movement will tilt it up at the front and down at the back. There is a single push-pull tube connection to the swashplate at the rear of the main rotor mast to provide the pitch control. Left-right movement of the cyclic provides lateral (roll) control of the main rotor disc. There are two push-pull tubes connected to the swashplate, either side of the main rotor mast, to tilt the disc left or right.
Recent maintenance history
The helicopter had accumulated about 4,365 hour’s total time-in-service at the time of the accident. When CMC acquired VH-HGU, in February 2017, it had about 80 hours remaining before it was due for its second 2,200-hour overhaul. Therefore, the operator’s maintenance organisation, Cloncurry Air Maintenance (CAM), completed a 100-hour inspection at the time of the acquisition and the helicopter was operated by CMC until the 2,200-hour overhaul was started on 12 April 2017.
The 2,200-hour overhaul involved the disassembly, inspections, reassembly and checks of the helicopter. All flight control push-pull tubes were sent for non-destructive testing and found serviceable. The helicopter was reassembled and a weight and balance, and fuel calibration was completed. The flight controls were rigged and then the helicopter was subject to a 100-hour inspection before a ground run, track and balance[8] of the main rotors, and autorotation RPM check were completed on 28 July 2017.
On 31 July 2017, a 15-minute local area flight was conducted to confirm the serviceability of the helicopter. Following that flight, CAM staff certified for all the tasks in the 2,200-hour overhaul work-pack, including independent inspections[9] of the engine and flight controls, and issued the maintenance release.[10]
The next time the helicopter was operated was the accident flight.
Loading and performance
The ATSB’s calculations indicated the helicopter was within the prescribed weight and balance limits for the flight. Using the local environmental conditions, the out-of-ground‑effect[11] hover performance weight was within limits at the helicopter’s certified maximum all-up-weight of 622 kg.
Meteorological information
The weather conditions recorded at Cloncurry Airport at 0700 included a wind speed of 1 kt from 100°, a temperature and dewpoint[12] of 14 °C and 5 °C respectively, and a QNH[13] of 1015 hPa. The Cloncurry aerodrome forecast[14] for the period from 0400 to 1600 included a wind speed of 6 kt from 170° and CAVOK[15] conditions. Given the insignificant conditions, the ATSB determined that it was very unlikely that the weather contributed to the circumstances of the accident.
Global positioning system data
The pilot’s Garmin GPSMAP196 navigation device was recovered from the wreckage for examination and analysis by the ATSB. The global positioning system (GPS) had several track logs, which included the accident flight and a previous mustering flight.[16]
Figure 3 depicts the helicopter’s GPS track from take-off to the accident site, and Figure 4 depicts the position of the main wreckage relative to the last reliable GPS data point and vicinity to the powerlines. Table 1 provides the data points for the accident flight. The ATSB considered the final data point (14), which was beyond the accident site, to be an unreliable point for the purpose of analysis as it very likely represented a predictive point.[17]
Figure 3: Accident flight GPS track
Source: Google Earth, annotate by the ATSB
Figure 4: Accident site datum relative to the last reliable GPS data point
Source: Google Earth, annotated by the ATSB
From Table 1, the changes in altitude and vertical speed were all positive from the departure point to the last reliable data point (13). In addition, the average ground speeds between the data points were relatively stable leading up to point 13. This suggested the helicopter had a reasonably steady climb flight profile. At point 13, the helicopter was about 279 ft above the local terrain, and about 82-148 ft above the height of the Ernest Henry powerline towers.[18]
The pilot was a patient of the Cloncurry Flinders Medical Centre since 2005, which included flight crew medical examinations by the local designated aviation medical examiner (DAME). In 2011, after a diagnosis of mild hypertension, the pilot started a prescribed daily dose of 150 mg Irbesartan.[20]
Post-mortem and toxicology results
The post-mortem examination established that the pilot received extensive injuries associated with a rapid deceleration and the cause of fatality was ruled as multiple injuries as a result of the accident. The examination also found 75 per cent eccentric stenosis[21] in the mid segment of the left anterior descending artery of the pilot’s heart. This was characterised as severe atherosclerosis.[22] The forensic pathologist reported:
It is theoretically possible that this may have precipitated abnormal heart rhythm leading to pilot incapacitation and subsequent accident. This scenario can be neither confirmed nor excluded on the basis of autopsy examination.
A low concentration of alcohol was detected in the blood, which was considered to be ‘likely post‑mortem contamination, probably due to decomposition’. No drugs, including Irbesartan, were detected.[23]
Specialist advice
In consideration of the forensic pathologist’s scenario, the ATSB conducted a follow-up on the pilot’s health with the Cloncurry DAME, the CASA Principal Medical Officer (PMO) and the Director of the Clinical Forensic Medicine Unit for the Queensland Department of Health.
The PMO noted the other arteries and heart were found with no discernible abnormality, therefore, the conditions had not dispersed through the cardiovascular system. The PMO also reported that it could not be determined with certainty if the pilot experienced abnormal heart rhythm unless the heart was being actively monitored. Queensland Health reported that the ‘consequences of high blood pressure as a clinical issue were not noted in the autopsy report. In particular, there was no evidence of a stroke and no indication of a heart attack’.
The Cloncurry DAME reported the dosage of Irbesartan was moderate and that it ‘would have been unlikely to cause any symptoms of hypotension causing dizziness or disorientation’. Queensland Health and the PMO reported that missing a single dose of Irbesartan would not be likely to cause any issues clinically.
Wreckage and impact information
The wreckage examination included an initial on-site inspection, followed by a review of the accident site images. The photographic review resulted in a second accident site visit to excavate the wreckage and retrieve a component of interest, which was the bellcrank from the cyclic control assembly.
Initial on-site examination
The helicopter wreckage was located amongst termite mounds, in a sparsely treed area. The main wreckage had been subject to a significant post-impact fire, which had reduced the cabin area to ash, molten aluminium, and fibreglass mat. The airframe was oriented south-east on a heading of about 140°, which was in the opposite direction to the helicopter’s recorded flight path. Small pieces of debris were scattered around the wreckage in a radius of about 20 m in most directions. The windscreen perspex was unburnt, shattered into small pieces and contained in an area of about 2 m2 just forward of the cabin area. All the major components were identified within the debris field (Figure 5).
Figure 5: Main wreckage
Source: ATSB
The airframe impacted the ground on the front left. Compression damage to the forward vertical firewall of the helicopter indicated that it impacted with a high rate of descent.
The helicopter’s main rotor disc had severed the tailcone and tail rotor driveshaft, leaving paint transfer on the driveshaft and tailcone. There were multiple strikes to tail components, which included the tail rotor hub and vertical stabiliser, generating a pattern of tail strike debris. The pattern was noted to be in a semi-circular arc on the right side of the main wreckage with respect to the direction of the GPS track. This was consistent with the helicopter tracking away from the airport and towards the powerlines at the time of the tailcone strike.
The main rotor blades exhibited rearward and upward bending, and there was no evidence of rotor blade ground strike marks or damage to the surrounding termite mounds. This was consistent with a significant loss of main rotor energy before ground impact, which was a near vertical impact. The teeter stops were destroyed by fire, but one teeter stop bracket was damaged and the associated main rotor blade spindle tusk[24] had a slight bend. This indicated the teeter stop bracket was struck by its respective main rotor blade spindle.
There was no evidence of any significant tension on the tail rotor driveshaft aft flexible coupling and little evidence of bending on the severed aft section of driveshaft (Figure 6). This indicated it was likely a power-on, high energy, main rotor strike to the tail.[25] The section of driveshaft forward of the severed section exhibited elongation and a bending overload, which indicated it was rotating during the break-up sequence. Therefore, the damage to the driveshaft was consistent with the main rotor disc striking the tail under normal engine power and rotor speed conditions.
Figure 6: Severed tail rotor driveshaft
Source: ATSB
The forward flexible coupling of the driveshaft exhibited significant tension. According to RHC, flexing of the main rotor mounts will change the angle of the input yoke of the main gearbox, which will cause the yokes at the flexible couplings to move apart. The tension on the forward flexible coupling, damage to the teeter bracket, and angle of the tailcone strike were consistent with a large rearward tilt of the main rotor disc in-flight past its normal limits.
On completion of the ATSB’s initial onsite inspection, the operator and next-of-kin buried the wreckage adjacent to the impact site.
Excavation
During the photographic review of the wreckage after the initial on-site inspection, the ATSB noted an anomaly with a flight control bellcrank (part number A958-1) in the cyclic control assembly. The fastener,[26] which attached the horizontal push-pull tube (part number A121-1) to the bellcrank, was missing. The remaining bellcrank fasteners were all attached. The missing fastener was part of the longitudinal cyclic control, which controls the fore-aft tilt of the main rotor disc (Figure 7). The RHC R22 Illustrated Parts Catalog (IPC) showed that the flight controls should be secured at the bellcrank with a National Aerospace Standard (NAS) 6604-15 bolt and D210-4 self-locking nut.[27]
Figure 7: Longitudinal cyclic control
Source: Robinson Helicopter Company, modified by the ATSB
The ATSB returned to Cloncurry in February 2018, and with the assistance of the pilot’s next‑of‑kin, the next of kin’s support persons, and the Cloncurry State Emergency Service personnel, excavated the majority of the buried wreckage and retrieved the bellcrank minus the missing fastener hardware. In addition to the bellcrank, the ATSB retrieved several pieces of resolidified metal to examine for the presence of hardware (bolt, standard washer, lockwasher, rod-end and self-locking nut).
In May 2018, the next-of-kin, who had continued excavating the remainder of the wreckage, sent a bolt with the same part number as the missing bolt (NAS6604-15) to the ATSB.[28] Following receipt of the bolt, the ATSB, in consultation with RHC and the next-of-kin, verified that all the remaining NAS6604-15 bolts were still attached to their respective assemblies.[29] This included the bolts not identified in the IPC as they are not normally accessible. As such, the bolt recovered from the excavated wreckage was considered very likely to be from the missing fastener. Figure 8 depicts the bellcrank and bolt.
Figure 8: Bellcrank with missing fastener (left) and bolt (right)
Source: ATSB (left) and next-of-kin (right)
Effect of loss of longitudinal cyclic control
The ATSB enquired with RHC about the expected response of the main rotor system to a disconnection of longitudinal cyclic control. They advised that:
During straight and level flight the A121-1 push-pull tube is under compression load. This pushes the cyclic aft [pilot’s cyclic stick]. A bungie cord is attached to the forward end of the tube (pulling aft, below the cyclic pivot point) to counteract the forces and neutralizes the loads felt by the pilot. The loads increase with airspeed.
With reference to Figure 7, a compression load on the A121-1 push-pull tube is consistent with a force tilting the main rotor disc aft and pushing downwards on the aft vertical push-pull tube. In forward flight, the advancing main rotor blade is at a higher airspeed than the retreating blade, which increases the lift on the advancing blade relative to the retreating blade. The reaction to this dissymmetry of lift is that the advancing blade flaps up and the retreating blade flaps down, which the pilot corrects with forward cyclic input as airspeed increases (Wagtendonk, 2011). Therefore, a disconnection of the longitudinal cyclic control in forward flight will result in the rotor disc tilting aft, potentially striking the tailcone.
Tests and research
Following identification that the rear fastener for the cyclic assembly horizontal push-pull tube was missing from the bellcrank, a number of items were recovered from the accident site and retained for further examination at the ATSB’s technical facilities in Canberra. The items included:
the bellcrank – part number A958-1
a bolt – part number NAS6604-15 (recovered by the next-of-kin on 16 May 2018)
metallic debris (that had melted during the post-accident fire then resolidified on cooling)
a number of loose nuts and washers
a jackshaft – part number A337-1 – including attachment nuts and bolts
the forward support assembly – part number A014-6.
A summary of the main findings from the examination is provided here, for full details of the examination refer to Appendix A – Materials examination report. The scope of the examination was to analyse the bellcrank and related components to determine how the fastener came to be missing. In addition, the metallic debris recovered from site was examined to determine if any additional fastener parts were entrapped within the solidified mass.
Bellcrank and related components
The bellcrank and torque tube yoke assembly had been subject to significant mechanical damage such that the rod ends had fractured in overstress and the left side of the yoke assembly and bellcrank plate had significantly distorted. While the distortion of the plates was similar where the fasteners remained in position, the plates had been pushed together where the fastener was missing (Figure 9). The yoke assembly also exhibited heat damage in this area, with the left side moulding around the bellcrank plate. The combination of mechanical and heat damage meant that an exemplar bolt could not be reinserted through the bellcrank.
Figure 9: Bellcrank showing deformation observed on the torque tube yoke assembly and bellcrank plates
Source: ATSB
The bolt holes where the fastener was missing did not exhibit gross deformation or elongation of the holes to indicate that the fastener assembly had been forcibly removed during the accident sequence. Yellow colouration was observed around the other bolt holes where the fasteners had remained in position. While some yellow colouration was observed around the bolt hole of the missing fastener, it was much less than for the other holes, and none was observed around the internal surfaces of the hole (Figure 10).
Figure 10: Bellcrank internal surfaces with yellow colouration
Source: ATSB
Robinson reported that the yellow residue surrounding the fasteners was from the cadmium plating on the bolts, washers and screws.[30] The remnants of cadmium plating from the fastener assembly components had melted and subsequently oxidised during the post-accident fire. The residue surrounding the bolt hole for the missing fastener indicated the missing bolt was previously torqued, resulting in a transfer of cadmium from the washer to the bellcrank. However, as there was no outward flow, or streaking, as per the remaining fasteners, RHC considered it ‘highly unlikely that the missing bolt was present during the fire’.
The combination of the above observations indicated that the missing bolt was not fitted to the bellcrank at the time of the impact with terrain and post-impact fire.
The remaining two bolts installed on the bellcrank were identified as NAS6604-15 bolts and the nuts were consistent with the MS21042L4/NAS1291 nut-type with manufacturer markings consistent with Ronson Manufacturing Inc.
Metallic debris
The metallic debris was dissolved, and a number of fasteners and other components were recovered. However, examination of the pieces did not identify any parts from the missing fastener.
Recovered bolt
The solitary bolt found on 16 May 2018 by the next-of-kin was identified as a NAS6604-15 bolt. The bolt had the same manufacturer identification (‘LFC’) as the other two bolts fitted to the bellcrank, but exhibited greater fire damage (Figure 11).
Figure 11: Comparison between the bolts removed from the bellcrank (left and centre) and the fire damaged bolt (right) subsequently recovered from the accident site
Note: The recovered bolt is shown after it had undergone ultrasonic chemical cleaning.
Source: ATSB
The recovered bolt was thermally damaged from the post-accident fire, but was otherwise in good condition with no evidence of distortion along its length or to the threads. A small groove was identified on the thread flank, which was likely from contact with a self-locking nut during installation (Figure 12).
Figure 12: Magnified image of the bolt found 16 May 2018 showing thread groove
Source: ATSB
Jackshaft
Examination of the jackshaft assembly recovered from the wreckage found that three of the four self-locking nuts had the same manufacturer markings as the nuts fitted to the bellcrank. Fire damage precluded identification of the markings on the fourth nut.
Semi-quantitative chemical analysis of the nuts was conducted using a scanning electron microscope equipped with an Oxford energy dispersive x-ray spectrometer. The analysis confirmed that all four nuts were consistent with a carbon/alloy steel. While the spectrometer cannot determine the exact amount of alloying additions, the spectrographs for the four nuts were inconsistent with the CRES (corrosion resistant – stainless steel) D210-4 nuts specified to be used by RHC. Specifically, the nickel, chromium and molybdenum additions, where detected, were not of sufficient quantities to designate the nuts as stainless steel (see Previous safety issues - self-locking nuts).
Maintenance of the cyclic control assembly
During their interviews with the ATSB in 2018, the CAM staff[31] could not recall the specific details of the work they individually performed on the cyclic control system of VH‑HGU during the 2,200‑hour overhaul. However, they were able to provide a description of the normal process they followed for the removal, inspection, installation and inspection of the cyclic control assembly. The physical process, as described by CAM staff, was consistent with the process published and described by RHC.
Removal
The removal process involved the vertical push-pull tubes being unscrewed from the bellcrank and yoke rod-ends, then the remaining components from the cyclic stick through to the bellcrank would be removed from the airframe as a single unit. After removal from the airframe, the length between the bolt holes for the horizontal push-pull tube would be measured for use during reassembly. There was no record of this measurement in the work-pack for VH-HGU, however, the maintenance manual provided a standard length that could be used for the installation.
The horizontal push-pull tube forward fastener would then be disconnected from the cyclic stick and the horizontal push-pull tube unscrewed from the bellcrank rod-end. Therefore, the bellcrank fasteners were not required to be disassembled during this part of the process. The cyclic stick is separated from the torque tube, but the bellcrank can remain attached to the torque tube with the fasteners and rod-ends fitted, as neither of these components required non-destructive testing.
Inspection
The bellcrank is inspected for cracks and corrosion, and the rod-ends are tested for axial and radial play (Figure 13). According to RHC, the play in the rod-ends can be checked without removal from their respective fastener. The CAM staff reported that the rod-ends would initially be checked for play without their removal, and then only removed for measurement with a dial test indicator if there was doubt. The chief engineer reported that the rod-end would be replaced if it had reached half the permitted tolerance as the wear will accelerate and it was preferable to replace them at the 2,200-hour overhaul, rather than at a 100-hour inspection.
Figure 13: Rod-end and spherical bearing play limits
Source: Robinson Helicopter Company, annotated by the ATSB
There was no record in the work-pack to indicate that any of the bellcrank rod-ends were replaced or disturbed for inspection. However, other than what the maintenance manual specified for the overhaul, disturbances of the flight controls were not recorded in the work-pack unless a part was replaced. Several rod-ends from other assemblies were replaced during the overhaul, and they were accounted for by a cross-check between the ‘parts list’ and ‘aircraft worksheet’ sections of the work-pack.
Installation
After removal and disassembly, the push-pull tubes and cyclic stick would then be stripped of their paint and sent for non-destructive testing. All parts for VH-HGU were found serviceable from non‑destructive testing, and on return, they were painted and re-assembled. One of the apprentices reported the cyclic assembly could be removed and installed by an individual, but it was more common to use two persons, ‘depending on what was going on’. In August 2017, the chief engineer could not recall who refitted the parts returned from non‑destructive testing. The installation was certified as having been performed by the AME (aircraft maintenance engineer). However, in February 2018, the AME could not remember anything about this work.
The AME reported that the chief engineer would normally inspect the cyclic when re‑assembled, and again when it was installed. After installation, the chief engineer would assist the AME with the rigging process and then perform an ‘inspection and make a list and get them to fix it… and then get [head engineer] in to check’. The fourth year apprentice was reportedly involved in the disassembly, reassembly and rigging, but was unsure about the first year apprentice’s involvement. The first year apprentice was reportedly involved in the disassembly, but was at trade school 1–13 July 2017, and missed some of the reassembly.
According to RHC, if the cyclic assembly is installed and the horizontal push-pull tube has the incorrect length between bolt holes, then it is easier to remove the aft rod-end (bellcrank fastener) to make the length adjustment. However, this is most likely to be discovered during the rigging process and compensated for by adjusting the vertical push-pull tube lengths or pitch links, unless it is excessively far from the specified dimension. The chief engineer reported that for the rigging adjustments they ‘generally do it on the upper push-pull tubes—wind them all the way in and then adjust at the top—sometimes the lower push-pull tube, but don’t recall having any trouble with the accident helicopter’.
The head engineer reported that the cyclic assembly fasteners are torqued and torque striped[32] before the assembly is installed, which is when the independent inspections for correct assembly would be performed. After installation, the head engineer would perform an independent inspection for correct fitment and clearances. The head engineer would then provide a list of discrepancies to the chief engineer, and then re‑inspect after any adjustments had been made. As the work-pack was not used to record discrepancies and adjustments, it could not be determined if any discrepancies were found or if any adjustments were performed.
100-hour inspection
After the helicopter had been assembled and the flight controls rigged, the next step in the overhaul procedure was for a 100-hour inspection to be performed. For VH-HGU, this inspection was certified by the AME and chief engineer using a CAM form, which was a one-page abbreviated checklist. The CAM checklist condensed the RHC R22 maintenance manual certification requirements from 226 items to 19 items. Consequently, each item in the CAM checklist accounted for between 1-30 separate inspection items. However, the CAM checklist specifically stated that the 100-hour inspection checklist was to be used in conjunction with RHC maintenance manual.
Figure 14 shows a comparison of the CAM checklist item (left) with the RHC R22 maintenance manual (right) for the removal of the horizontal cover cyclic box cover, belly panel and vertical panel. The depiction below of the maintenance manual is one of three pages under the heading 4 task certifications. Inspection of the cyclic push-pull tubes, bellcrank and fasteners were items 19, 20 and 26. These items were covered as item 4 in the CAM abbreviated checklist.
Figure 14: Comparison of the CAM 100-hour inspection checklist (left) and the R22 maintenance manual (right)
Source: Cloncurry Air Maintenance (left) and Robinson Helicopter Company (right), annotated by the ATSB
Certification for the work
Item 18 of the CAM checklist was for the installation and closure of all access panels on completion of the 100-hour inspection. At interview in August 2017, the chief engineer reported that the certification for independent inspections was after the rigging, but before the panels were installed and the fuel tanks calibrated. However, the work-pack suggested that the fuel calibration was recorded before certification for independent inspections, which was the last entry in the ‘aircraft work-sheets’ section of the work-pack.
At the completion of the 100-hour inspection, the helicopter was to undergo a ground run, track and balance of the main rotors, autorotation RPM check and flight check. The work-pack showed that the AME certified for the ground check and run-up, a fanwheel and tail rotor balance, the track and balance of the main rotor and autorotation RPM check.
Of note, the AME was not qualified to ground run the helicopter, and the pilot for the track and balance flights was reportedly following the chief engineer’s instructions for the flights, not the AME. The pilot and chief engineer both reported that several flights were required for the track and balance of the main rotor, with adjustments made between the flights.
No entries in the work-pack were found for any track and balance adjustments, or for the check flight, which was required to follow the track and balance, and autorotation RPM check flights. The chief engineer reported that they were not using the maintenance manual checklists for these steps of the overhaul procedure. Instead, loose paper was used, which was not retained in the work-pack. Therefore, it was unknown what adjustments were made to the helicopter.
The work-pack showed that the AME certified for all the tasks in the aircraft work-sheets on 31 July 2017 and the chief engineer certified for the supervision on the same date.[33] Although there was no date recorded for the certification for independent inspections, it was considered likely that it was on the same date as this was the last entry in the work-sheets. Similarly, the 100‑hour inspection certification was also not dated, but considered likely to have also occurred on the same date.
The ATSB noted that the single date certification at the end of the overhaul was not in accordance with the CAM Maintenance Procedures Manual (MPM). The MPM Part 6.10: Scrutiny of Work and Certification, required progressive certification for each ‘item as it is completed on the work package’.
Organisational and management information
Organisational structure
Cloncurry Mustering Company’s primary operations were cattle mustering and other airwork from their main base at Cloncurry Airport. The majority of maintenance conducted on their fleet of 23 R22 and four R44 helicopter’s was performed by CAM, which was an associated company. In addition to this, CAM also performed work on external helicopters for other operators.
The facilities in Cloncurry were used by both CAM and CMC, and they had the same managing director (MD) and shareholders. The shareholders included the MD, chief engineer and several of the CMC senior pilots, including the accident pilot. The chief engineer for CAM also held the position of maintenance coordinator [34] for CMC.
One of the key positions in an operator’s organisational structure is the Head of Aircraft Airworthiness and Maintenance Control (HAAMC). The position of HAAMC provides an interface with maintenance organisations for the planning and preparation of maintenance activities, and an independent check of the completion of those activities when an aircraft is returned to service.
The MD was issued with the CMC HAAMC approval by CASA in June 2005. According to the letter of approval, the HAAMC ‘has the responsibility for all airworthiness matters relating to the aircraft operated under the AOC [Air Operator Certificate]’. Within the CMC operations manual, the responsibilities of the HAAMC were delegated to the maintenance coordinator (chief engineer). The ATSB considered this a pragmatic decision, as the chief engineer was the individual most suitably qualified and experienced for the role and responsibilities. However, it resulted in the two key positions of interface between CAM and CMC for maintenance and airworthiness matters being held by the same person.
Cloncurry Air Maintenance
Maintenance approval
Cloncurry Air Maintenance had a Certificate of Approval for the maintenance of piston-engine helicopters with a maximum take-off weight not exceeding 3,175 kg. Their approval included the maintenance of airframe, engines, engine components, and electrical components fitted to, or eligible to be fitted to, R22 and R44 helicopters. In accordance with Civil Aviation Regulation1988, Section 30, CAM had a documented set of quality control procedures, published as their Maintenance Procedures Manual (MPM).
Workforce
In 2013, the CAM workforce comprised of four licenced aircraft maintenance engineers (LAMEs) and two apprentices. By the time of the accident, in August 2017, the workforce structure had changed to two LAMEs (the chief engineer and head engineer), one AME and three apprentices. All of these employees had been trained by CAM from the time of their apprenticeships.
The division of work for CAM required the chief engineer to manage the CMC helicopters, while the head engineer managed the external helicopters. The two LAMEs would support each other for independent inspections, with the chief engineer certifying for the independent inspections of external helicopters, and the head engineer certifying for the independent inspections of CMC helicopters. The AME and two apprentices were allocated to the CMC helicopters and the third apprentice allocated to support the head engineer working on the external helicopters. The two apprentices working on the CMC helicopters were a first year and fourth year apprentice. The first year apprentice was required to attend trade school and therefore not always present.
The chief engineer reported that it was difficult to recruit a LAME workforce into Cloncurry, due to its remote locality, and that alternative apprenticeship schemes might be perceived as less demanding with more attractive remuneration. The MD believed that the LAME recruitment problem was not limited to their business and that it was a wider problem, which also affected businesses on the east coast.
Workload
The cattle mustering season from April to September required an increase in the maintenance workload through the middle of the year to keep the CMC helicopters operating. The CAM hangar space facility was divided between a main area, where several helicopters could be parked for 100-hour inspections, and two separate 2,200-hour overhaul rooms dedicated for one CMC helicopter and one external helicopter.
At interview, none of the maintenance staff could recall any specific details associated with the disassembly and reassembly of the cyclic control assembly during the overhaul on VH-HGU. All staff reported it was a busy period and that the overhaul was routinely interrupted for 100-hour inspections. In the month of July 2017, 21 100-hour inspections were commenced on CMC helicopters and 20 were completed, in addition to progressing the overhaul of VH-HGU to completion on 31 July (plus one external helicopter in overhaul).
Robinson reported that a 100-hour inspection should take about 24 labour-hours to complete. Therefore, to complete 20 inspections in the month of July would require about 480 labour‑hours. This would have required about three qualified staff (LAME/AME) working full time on the 100 hour-inspections for CMC helicopters, plus additional staff to progress the overhaul of VH-HGU. A calendar break-down of the 100-hour inspections and 2,200-hour overhauls for the CMC helicopters over the months of July and August is provided at Appendix B – Maintenance workload.
Quality assurance
Internal audits
Part 8 of the CAM MPM described the purpose of their internal audit program was:
…to ensure that the effectiveness and performance of the Company and the procedures documented in the Maintenance Procedures Manual are continually being measured and assessed.
As they did not have a quality manager position, and none was required, CAM contracted an external auditor to perform their internal audits. The ATSB reviewed the two internal audit reports produced for CAM in 2015 and 2016, and noted that each had been performed by a different auditor.
The December 2015 audit included a review of three work-packs and ‘nil findings’ were recorded against them. The November 2016 audit included a review of one work-pack and ‘nil defects’ were recorded. Both audit reports concluded with ‘nil non-conformances’, ‘nil requests for corrective action’ and ‘nil suggestions for system improvement’.
The work-pack sampled for the 2016 audit was for an R22 100-hour inspection. The ATSB reviewed this and noted the CAM 100-hour inspection abbreviated checklist was used and that all work was certified on the same day as performed by one LAME. In this instance, a single certification was provided for the ground check, run up and all 19 items on the abbreviated checklist.
Civil Aviation Safety Authority oversight
The CASA Cairns office was responsible for oversight of CAM. In the period from June 2013 to January 2018, 22 entries were made in the CASA database for their oversight of CAM. They included nine references to ‘nil’ or ‘no major issues’ and five references to CAM as a ‘compliant organisation’
On 13 May 2015, an audit was conducted on CAM by one CASA airworthiness inspector for one day. On 22 June 2015, the auditor entered into the database for CAM ‘recent audit carried out on Western Planes [plains] Sweep – compliant organisation’. The May 2015 visit was their last audit of CAM prior to the accident on 2 August 2017.
2015 audit
In the May 2015 CASA audit report summary, the auditor reported that CAM ‘was assessed against the regulatory requirements within the system listed below (scope)’. The elements included:
maintenance activity
data and documents
tooling and equipment
stores and distribution.
The auditor assessed CAM compliance against the MPM and did not identify any breaches of the regulations. Two observations were issued as opportunities for improvement.[35]
The audit report stated that:
Control of Maintenance Activity was assessed compliant when audited against Chapter 6 of the MPM. The Chief Engineer is conducting all duties as detailed in the MPM and controls the company workpacks and maintenance activities.
Sampling was conducted on three workpacks…with no issues identified.
The ATSB obtained a copy of the 2,200-hour overhaul work-pack sampled by the auditor. This was for an R22 helicopter, for which the overhaul was completed in 2015. The work-pack omitted several steps of the overhaul procedure, specifically, there were no entries for the 100-hour inspection, ground run, run up and check flight. While the track and balance was recorded and certified in the work-pack, there were no records for any adjustments. The entire work-pack was certified with a single date, which indicated progressive certification was not employed as required by the CAM MPM.
The auditor’s notes did not reveal any further information about the CAM audit than what was recorded in the report. However, of note, the auditor did not retain copies of the work-packs sampled. Instead, the auditor’s notes included photographs of the front pages of the work-packs. The report was certified by the auditor and approving officer on 25 May 2017.
2018 audit
After the accident, on 10–11 April 2018, CASA conducted an unscheduled Level 1 surveillance audit of CAM. The team comprised one airworthiness inspector and one engineering officer. During the course of the CAM audit, several findings were identified as airworthiness matters. This resulted in the expansion of the scope of the audit to include CMC.
The expansion of the scope resulted in CASA issuing two reports, one for CAM (the maintenance organisation) and one for CMC (the operator). The audit sampled several work-packs, which included the 2,200-hour work-pack for the R22 helicopter that started overhaul on 1 August 2017. The auditors made similar findings to what the ATSB noted for the work-pack for VH-HGU and the CASA 2015 audit of CAM. They included the following issues:
Use of abbreviated checklists: The certification points in the company abbreviated 100-hour inspections checklists did not reflect the content of the inspection items listed under them in accordance with the RHC R22 maintenance manual. The use of abbreviated checklists relied on the maintenance staff continually referring to the maintenance manual to identify all the inspection items under each heading. The inspectors recommended CAM review the suitability of using abbreviated inspection checklists.
Independent inspections: The 2,200-hour work-packs sampled found one independent inspection performed at the end of the overhaul. Given the scope of the overhaul and level of disassembly, reassembly and adjustments required, the auditors recommended that independent inspections are certified progressively and noted that additional inspections would be required for each adjustment of flight control components during the tracking and balancing procedure.
Flight without a maintenance release: The chief engineer confirmed that it was their standard procedure to complete the flying tasks within the 2,200-hour overhaul before issuing a new maintenance release. Therefore, the helicopters were being flown without a valid maintenance release.
Maintenance coordinator responsibilities: A number of helicopters were released to service without complying with their approved maintenance program. The CMC operations manual required the maintenance coordinator check all maintenance was completed before an aircraft was returned to service.
Previous occurrences involving fasteners
CASA R44 service defect report
On 17 May 2018, another operator’s Robinson R44 helicopter completed a 2,200-hour overhaul, which included the replacement of the flight control hydraulic servo assemblies. The overhaul was certified by a LAME and with an accompanying independent inspection certification. On 26 February 2019, the operator submitted a service defect report to CASA following a pilot report of ‘deterioration of flight control inputs along with banging sound coming through airframe’.
On inspection, the bolts used to secure the hydraulic servos to the support bracket were found to have insufficient torque. The MS21042L-series nuts had not been replaced with D210-series nuts (see Re-use of self-locking nuts below), and no Palnuts®[36] were fitted as secondary locking devices in accordance with the instructions for continued airworthiness. The inadequate torque allowed movement of the servos, which resulted in elongation of the NAS6600-series bolts and the bracket bolt holes. Of note, despite the insufficient torque and elongation of the bolts, the MS21042L-series self-locking nuts fitted to the bolts had not failed or undone.
United States National Transportation Safety Board (NTSB/AAR-13/01)
On 7 December 2011, a Eurocopter AS350-B2 helicopter, operating as a ‘Twilight tour’ sightseeing trip, crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were fatally injured, and the helicopter destroyed. The United States National Transportation Safety Board (NTSB) found that the accident was a result of an in-flight disconnect of the flight controls, specifically, the separation of the servo control input rod from the main rotor fore-aft servo, which rendered the helicopter uncontrollable. The bolt, washer, self‑locking nut, and split pin that normally secured the input rod to the fore-aft servo were not found. It was concluded that the hardware had been improperly secured during maintenance the day before the accident
The NTSB found there was inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate post-maintenance inspections. They reported the contributing factors included personnel fatigue for the mechanic and inspector, and the lack of clearly delineated maintenance task and inspection steps.
On 12 October 2011, the pilot of a Robinson R22 helicopter, registered VH-JNP, was performing aerial work near Saxby Downs, Queensland, when a rattling noise from behind the cabin was heard by the pilot, who also noted the clutch light had illuminated. The pilot opened the clutch actuator circuit breaker and, at the same time, noted a burning rubber smell. The pilot made an immediate precautionary landing and shut down the helicopter.
The problems with the helicopter’s drive system were traced to the clutch assembly where a group of MS21042L-4 self-locking nuts on the drive belt upper sheave had cracked and fractured. This premature nut failure had stemmed from the likely embrittling effect of residual hydrogen generated during the cadmium electroplating process applied during manufacture. All of the affected self-locking nuts were identified as Airfasco Industries Fastener Group (affected batches identified as 12 June 2009, 23 October 2009 and 19 October 2010). They were fitted in April 2011, at the last 2,200-hour overhaul. Since that time, the helicopter had operated for a further 408 hours and was subject to four 100-hour inspections during that period.
On 4 February 2011, a Robinson Helicopter Company R44 Astro helicopter, registered VH‑HFH, commenced circuit operations at Cessnock Airport, New South Wales. Following a landing as part of a simulated failure of the hydraulic boost system for the helicopter’s flight controls, the instructor elected to reposition the helicopter to the apron. As the helicopter became airborne, it became uncontrollable and collided with the runway and caught fire. The pilot survived, but the instructor and a passenger were fatally injured.
The ATSB found that a fastener had detached from a hydraulic-boost servo, rendering the helicopter uncontrollable. The hydraulic-boost servo was repaired and functionally tested by the manufacturer in February 2009. The servo spent the majority of its time as a spare in storage before it was installed on VH-HFH in October 2010 during the last 100-hour inspection. The helicopter accrued 93.6 hours in-service prior to the accident. The bolt was recovered and noted that there was no distortion, and its threads and shank were visually undamaged. However, the remaining fastener parts were not recovered.
Previous safety issues – self-locking nuts
Hydrogen embrittlement
In the final investigation report of AO-2011-016, as mentioned above, the ATSB examined three cracked self-locking nuts from other R22 helicopters, of the same specification as that fitted to the detached fastener on the accident helicopter. These nuts were found to have cracked due to hydrogen embrittlement. Specifically, the report stated that:
When high-strength steel, which has been exposed to hydrogen is sufficiently stressed, it can fail prematurely in a sudden, brittle manner. In the case of the examined self-locking nuts, the source of hydrogen was likely to have been from the cadmium plating process that was specified during manufacture for corrosion resistance. Under conditions of sustained stress, such as that associated with an assembled fastener, plus any residual tensile stresses from manufacturing, the presence of hydrogen can result in brittle cracking, typically less than 1 week from the time of application of the sustained stress.
In response to the identification of the hydrogen-embrittled self-locking nuts, the ATSB raised the following safety issue (AO-2011-016-SI-01 – Self-locking nut failure) on 30 April 2012, affecting owners and operators of RHC helicopters:
A number of self-locking nuts from other aircraft, of the same specification as that used to secure safety-critical fasteners in VH-HFH, were identified to have cracked due to hydrogen embrittlement.
During the course of the investigation the ATSB was provided with three self-locking nuts from other aircraft that had cracked in service. Detailed examination of those nuts identified that they had failed due to hydrogen embrittlement. In response to that finding, the ATSB notified the helicopter manufacturer, the Civil Aviation Safety Authority (CASA) and the United States National Transportation Safety Board and Federal Aviation Administration.
At the time of publishing that investigation report and safety issue, RHC had reported the following proactive safety action in response to the safety issue:
In response to the identification of hydrogen-embrittled self-locking nuts during this investigation, the helicopter manufacturer issued service letters (SL-58, SL-38 and SL-01),[37] which detailed the hydrogen-embrittlement risk, including the expected failure characteristics.
The Civil Aviation Safety Authority also reported the following proactive safety action at the time of publishing:
In response to the identification of hydrogen-embrittled self-locking nuts, CASA issued Airworthiness Bulletin 14-002, on 12 October 2011, alerting aircraft owners, operators and maintenance personnel to the possibility of in-situ failures of MS21042 and NAS1291-series self-locking nuts. The bulletin provided background information on previous occurrences and the mechanism and hazards associated with hydrogen embrittlement, and recommended that:
Pilots and maintenance personnel closely monitor the occurrence of hydrogen-induced delayed cracking in high-strength steel standard aircraft hardware, such as nuts via close inspection following installation and thereafter at Daily / Preflight and periodic inspections.
Before simply replacing cracked/failed nuts with new items, consider contacting the manufacturer for advice regarding replacement of associated fasteners which may have suffered over-loading as a result of the failure of one of more nuts.
Report all MS21042 and NAS1291-series nut failures to CASA via the SDR [Service Difficulty Reporting] system.
Re-use of self-locking nuts
As explained above, cracking from hydrogen embrittlement of nuts fitted to Robinson helicopters has been previously identified.[38] In October 2014, RHC published service letters for the R22 (SL‑64), R44 (SL-50) and R66 (SL-09) helicopters on the subject of D210 Corrosion-Resistant (CRES) Nuts.[39] The service letters stated that, whenever maintenance that involves the disassembly and reassembly of a critical fastener is performed, the MS21042L or NAS1291-series nut should be replaced with a D210-series nut. The R22 maintenance manual was amended in October 2014 to incorporate what was stated in SL-64. For specific instances of cracked nuts, RHC have published service bulletins for their replacement within a compliance period.[40]
The R22-series maintenance manual included the following information under section 1.300 Fastener Torque Requirements:
D. Critical Fastener: A critical fastener is one which, if removed or lost, would jeopardize safe operation of the helicopter. This includes joints in the primary flight control system, and non-fail-safe structural joints in the airframe, landing gear, and drive system.
CAUTION: D210-series nuts, which supersede MS21042L-series and NAS1291-series nuts, are required on critical fasteners.
In the course of interviewing maintenance personnel employed by CAM, the ATSB noted a low‑level of awareness of the need to replace self-locking nuts with the D210-series nuts when critical fasteners were reassembled. However, the staff were aware of the limitation on the re-use of them, specifically, that they could not be reused if they had lost their friction torque. It is a standard practice within sectors of the aviation industry to re-use self-locking nuts provided the nut cannot be turned onto the bolt thread by hand and the published torque value for the fastener is achieved.[41]
During the course of the investigation, the ATSB spoke with another maintenance organisation, who reported that they employ the same practice of re-using self-locking nuts, and RHC confirmed that the described practice was considered acceptable. The United States NTSB reported on this practice as accepted by the manufacturers of light helicopters in their accident report AAR‑13/01.[42] They noted that guidance on the re-use of self-locking nuts was provided by Eurocopter (now Airbus Helicopters), Sikorsky, Bell and the United States Federal Aviation Administration.
In December 2018, the ATSB received the accident helicopter’s jackshaft, which had the fasteners attached. The jackshaft was one of a number of parts within the flight control system that was disassembled and sent for non-destructive testing during the 2,200-hour overhaul. The bellcrank was not subject to non-destructive inspection and therefore not required to be disassembled. In late January 2019, the ATSB completed semi-quantitative chemical analysis of the nuts fitted to the jackshaft and found they were consistent with a carbon/alloy steel, and therefore not consistent with D210-series stainless steel corrosion-resistant nuts. The nuts fitted to the jackshaft had similar markings to the nuts fitted to the bellcrank, which were consistent with MS21042L/NAS1291-series nuts.
At the time of the reassembly of the accident helicopter, the current R22 Illustrated Parts Catalog listed the part number D210-4 for the nuts fitted to the jackshaft, and RHC confirmed there were no alternate part numbers to the D210-series nuts.
In consideration of the evidence, the ATSB concluded that the industry practice of re-use of self‑locking nuts on Robinson helicopters may result in the omission to install D210-series nuts when critical fasteners are reassembled. Therefore, as part of this investigation, the ATSB issued a safety advisory notice (AO-2017-078-SAN-001) on 28 March 2019.
Memory-related errors
In the 2008 ATSB research report An Overview of Human Factors in Aviation Maintenance (AR-2008-055), it was noted that ‘poor maintenance procedures can lead to a range of errors including memory lapses, technical misunderstandings, and rule violations’.
Certification for a task after an extended period of time, in which multiple similar tasks were performed, can result in the misattribution of the source of memory at the time of certification. Misattribution of the source of a memory occurs when an individual recalls an item or fact from a past experience, but attributes it to an incorrect source of experience (Schacter, 1999). In the case of aviation maintenance, certifying for an inspection on aircraft A, when in fact it was performed on aircraft B, would be an example of possible source misattribution.
Closely related to source misattribution is the phenomena of suggestibility. The difference is that suggestibility includes an overt suggestion (Schacter, 1999). Presenting maintenance staff with a work-pack of recorded tasks for certification may introduce the suggestion of work completed, particularly if this is associated with the knowledge of a serviceable assessment from an operational check. This could result in staff certifying for tasks because they are listed on the work-pack for certification, rather than because they remember performing them.
Source misattribution and suggestibility are examples of retrospective memory errors at the time a certification is made. However, maintenance documentation is also important for prospective memory, which is remembering to complete a task in the future. According to Dismukes and Nowinski (2007), prospective memory is distinguished by three features: (1) an intention to perform an action at some later time when circumstances permit; (2) a delay between forming and executing the intention, typically filled with activities not directly related to the deferred action; and (3) the absence of an explicit prompt indicating that it is time to retrieve the intention from memory.
If an inspection of a system identified a requirement for re-work, and the re-work was completed at a time that the inspector was not available to re-inspect the work, then an omission to re-inspect would be an example of a possible prospective memory error. In this case, recording the disturbance (re-work) in the work-pack would provide a prompt to all relevant staff members that an independent inspection is required before the aircraft can be released from maintenance.
On the morning of 2 August 2017, the pilot of a Robinson R22 Betta II helicopter, registered VH‑HGU and operated by Cloncurry Mustering Company (CMC), departed Cloncurry Airport, Queensland on ferry flight in preparation for aerial mustering operations at various stations. About 3 minutes after take-off, the pilot experienced a loss of control and the helicopter broke-up in-flight. The helicopter collided with terrain about 7 km north-north-west of Cloncurry. The pilot, who was the only occupant, was fatally injured and the helicopter was destroyed. The accident flight was the first commercial flight of the helicopter after completing its second 2,200-hour overhaul.
While the pilot’s post-mortem examination identified coronary atherosclerosis, there was no evidence of a heart attack or stroke. Although it was noted that any conclusions could not be based on the examination alone. Despite this, the witnesses who encountered the pilot on the morning of the accident reported the pilot’s demeanour as normal. Further, a review of the GPS data did not find any indication of the pilot operating the helicopter erratically or attempting a descent to land. Therefore, it was unlikely that the pilot had experienced a medical event during the flight.
This analysis will discuss the likely reasons for the accident, the maintenance human factors issues of tracking tasks and workload, and organisational factors related to the quality assurance of the maintenance practices.
Loss of control and in-flight break-up
The condition of the tail rotor driveshaft indicated the tailcone was severed under normal engine power and rotor speed conditions. During a photographic review of the wreckage evidence, the ATSB noted the rear fastener for the cyclic assembly horizontal push-pull tube, which connected it to the bellcrank, was missing. All other bellcrank fasteners were in situ, and correctly assembled. The bellcrank and a bolt, believed to be from the missing fastener, were then recovered from the wreckage for examination.
The heat damage to the bolt, and lack of cadmium residue surrounding the bellcrank bolt hole, indicated the fastener was not fitted during the fire. In addition, the deformation of the bellcrank plates at the location of the missing fastener indicated the fastener was not fitted when the yoke and bellcrank were bent. Further, there was no damage to the bolt or bellcrank bolt holes to indicate the bolt was forcibly removed during the accident sequence. Therefore, it was concluded the bolt had separated from the bellcrank before impact. The absence of the fastener would have resulted in a disconnection of the longitudinal cyclic control. This in turn would have allowed the main rotor disc to tilt aft beyond the normal operating limits (rigging limits), striking the tailcone. Therefore, the severed tailcone was consistent with the separation of the longitudinal cyclic control in forward flight conditions.
The separation of the longitudinal cyclic control would result in the pilot losing pitch control of the main rotor disc. It was very likely that this occurred with little or no warning to the pilot, as there was no indication in the GPS data of an attempted landing. In addition to the loss of pitch control, the severed tail rotor driveshaft would have resulted in the pilot losing directional control. The impact damage and lack of ground witness marks from the main rotor blades, indicated that the helicopter broke-up in-flight.
Therefore, the loss of cyclic control was considered unrecoverable and was consistent with the helicopter colliding with the ground with a very high deceleration after the tailcone was severed.
Separation of the bolt
On consideration as to why the bolt had separated from the cyclic control bellcrank assembly, the ATSB had considered that the self-locking nut failed due to (1) over-torqueing, (2) fatigue cracking, (3) hydrogen embrittlement, (4) loosening, or (5) it was either not installed or was inadequately torqued. The most likely scenario was that the self-locking nut was either not reinstalled or was inadequately torqued.
Over-torqueing
The recovered bolt did not exhibit any damage (elongation) to the grip or threads to indicate it was exposed to excessive torque. Therefore, failure of the nut from over-torqueing was considered very unlikely.
Fatigue cracking
For the bellcrank, the design of the assembled joint is such that loads experienced by the fastener are predominantly a combination of tension within the bolt from axial preload of the joint as the nut is torqued to specification, shear loading of the bolt from operation of the cyclic, and high and low frequency dynamic loading from the rotor system, engine and other rotating components. In each case, the nut is under compression, rather than tension, predicating the likelihood of a nut failure by fatigue to be unlikely.
Hydrogen embrittlement
There have been several previous instances of self-locking nuts found cracked due to hydrogen embrittlement. In 2014, Robinson Helicopter Company released a service letter, which introduced the replacement by attrition of existing MS21042L-series and NAS1291-series nuts with D210‑series corrosion‑resistant nuts. However, in this case the evidence did not support hydrogen embrittlement as a failure mechanism of the missing nut due to the following:
The known batches of affected nuts were Airfasco, and the markings on the nuts installed on VH-HGU were not consistent with this manufacturer.
VH-HGU had been manufactured in 2008, prior to the manufacture of the affected batches of nuts in 2009 and 2010.
The nuts fitted to the bellcrank of VH-HGU had been in service for many years. Delayed hydrogen embrittlement generally occurs in the order of days and weeks, not years. In this time, the maintenance schedule meant there were many opportunities where the nuts would have been visible for inspection.
None of the remaining nuts on the bellcrank, or from the same manufacturer in other locations, exhibited any evidence of cracking associated with hydrogen embrittlement.
Therefore, failure of the self-locking nut from hydrogen embrittlement was considered very unlikely.
Loosening
While the repeated re-use of a self-locking nut could result in degradation and loss of its self‑locking capability, Cloncurry Air Maintenance (CAM) staff were aware of the limitation on their re-use, specifically that they could not be re-used if they had lost their friction torque. Previous work by the ATSB found that a MS21042L-series self-locking nut could be re-used up to 15 times without compromising the friction torque. The cyclic control is not disassembled during the 100‑hour inspection as the non-destructive inspection of parts is only performed at the 2,200-hour overhaul. If the bellcrank was disassembled at each 2,200-hour overhaul, then the nut would only have been re-used twice since production. So while it is possible that the nut had been re-used during the service life of the helicopter, separation of the bolt from the bellcrank from loosening of the nut as a result of a loss of torque in-service was considered unlikely.
Not installed or inadequately torqued
The bolt and bellcrank were found at the accident site and neither exhibited any physical evidence to indicate the fastener may have been predisposed to premature failure. The evidence indicated that the bolt was not installed in the bellcrank at the time of impact, which was about 3 minutes after take-off. It was therefore likely that the self-locking nut was either not installed, or that it was inadequately torqued, at the time of take-off. As it is not possible that there could have been ongoing operation of the helicopter with the nut not attached to the fastener, the most likely reason that the nut was either not installed or inadequately torqued on the accident flight, was due to the maintenance activities that were conducted during the previous 2,200-hour overhaul, completed 2 days prior to the accident.
The maintenance personnel could not recall the details of their work performed on the helicopter. However, they indicated that the bellcrank fasteners would not normally be disturbed when removing the cyclic assembly. Further, although there was no maintenance recorded to indicate that the fastener was disturbed during the overhaul, there were several reasons why the fastener may have been disturbed.
The possible reasons for disturbance of the fastener included inadvertent disassembly to separate the horizontal push-pull tube from the bellcrank, disassembly to measure play in the rod-end with a dial test indicator, or disassembly to adjust the length of the horizontal push-pull tube during the flight control rigging process. There were no records of any of these disturbances in the work‑pack. However, the ATSB noted that disturbances of the flight controls were not recorded in the work-pack, except for the standard overhaul requirements and for the replacement of parts.
The work-pack recorded several certifications for inspections. These inspections would have provided maintenance personnel with the opportunity to observe the bellcrank assembly. It could not be determined why none of these inspections detected an anomaly with the bellcrank fastener.
However, it was noted that the organisation’s maintenance practices relied significantly on human memory. The chief engineer and the head engineer both reported that after they conducted their inspections, they would provide a list of corrective actions. As these defects and corrective actions were not being tracked in the work-pack, and the maintenance staff were carrying a significant workload in the month leading up to the accident, their practices were considered to be conducive to a memory-related error event. These factors are discussed further in the following sections.
Maintenance practices
The 2,200-hour overhaul was the largest scope of maintenance activity for an R22 helicopter. It involved the disassembly of the helicopter, inspections and replacement of a significant number of parts with new or overhauled parts, and reassembly of the helicopter. A ground check and run up is required before the disassembly to capture any additional work for the overhaul. A 100-hour inspection, ground check, run up, track and balance, flight check, and weight and balance are conducted after reassembly and before return to service.
In order to track the progress of work, the CAM Maintenance Procedures Manual (MPM) required all tasks to be progressively certified. That is, certified at the time each item of work was completed. For VH-HGU, the aircraft worksheets were all certified at the end of the overhaul period, on 31 July 2017. Additional disturbances of the flight controls for adjustments and inspections were not recorded. Therefore, without recording all tasks and practicing progressive certification, the work‑pack was not an accurate record of the condition of the helicopter while under maintenance, or of all the work performed on completion of the overhaul.
In addition to the normal certification, any disturbance of the flight controls required an independent inspection. This required the inspector to verify that the work was carried out in accordance with the approved maintenance data and check that the system functioned correctly. The certification for independent inspections was not dated, but considered likely to be 31 July 2017 as it was the last entry in the aircraft worksheets. If it was on this date, then the helicopter was operated for the track and balance, autorotation RPM check and local area flight, without certification for independent inspections. As the disturbances of the flight controls for adjustments were not recorded in the work-pack, the integrity of the independent inspection process was reliant on informal methods of communicating additional work requirements and reporting their completion for re-inspection.
The work-pack included the 100-hour inspection, for which CAM had introduced an abbreviated checklist where a single certification could apply up to 30 separate inspection items. There were no dates recorded for the certifications, but they likely occurred on 31 July 2017. This suggested the checklist was not used to track the 100-hour inspection tasks and manage any interruptions during the process.
When the ATSB reviewed work-packs from other maintenance activities in 2015 and 2016, and the observations made by the Civil Aviation Safety Authority (CASA) audit of 2018, it was apparent that the maintenance documentation practices for VH‑HGU were not an isolated case. The evidence suggested a systemic issue within CAM of not using the maintenance documentation to track the condition of helicopters while under maintenance and to record all maintenance activities.
The use of work-packs at CAM was consistent with the culture of recording and certifying for maintenance for oversight purposes, rather than for quality control in accordance with their MPM. Circumventing the quality control procedures may render them ineffective as a means for ensuring all tasks have been completed correctly.
Extended periods of time between performing and certifying for tasks increased the likelihood of an individual’s memory being subject to source misattribution or suggestibility, or combination of both, when the certification was made. Omissions to record and capture all flight control disturbances in the work-pack increased the likelihood of a prospective memory error during the overhaul period. Therefore, the maintenance practices at CAM exposed the organisation to an increased risk of memory‑related errors and the omission of tasks.
Organisational structure and workload
In the period 2013 to 2017, the CAM workforce structure changed from a majority of licenced aircraft maintenance engineers to three apprentices with one aircraft maintenance engineer and two licenced aircraft maintenance engineers. CAM undertook maintenance for CMC helicopters as one part of its operation, as well as maintenance of helicopters from external operators as another part. With one licenced aircraft maintenance engineer and apprentice assigned to the external helicopters, and one apprentice attending trade school in the period leading up to the accident, there were effectively three members of staff for the CMC helicopters (chief engineer, aircraft maintenance engineer and a fourth-year apprentice).
Further, the structure of the workforce required the chief engineer to assume responsibility for the planning, supervision and coordination of maintenance for the CMC jobs. When the ATSB attempted to obtain details about the maintenance of the cyclic assembly on VH-HGU, the staff consistently reported that they could not recall specific details, and that it was a busy period with the overhaul constantly interrupted for 100-hour inspections. The month leading up to the accident included 20 100-hour inspections on CMC helicopters, which was consistent with the staff reports of it being a busy period.
The ATSB used a labour-hour plan to review the CAM staffing levels over this period and established that 100-hour inspections should have taken about 480 labour-hours. This equated to a requirement for three full-time qualified staff members, in addition to what was required to progress the overhaul for VH-HGU.
The volume of work and turn-around times were consistent with the peak mustering season and the staff reports of regular interruptions to the overhaul for other jobs. If the workforce structure does not change as the production requirements increase, it is likely that junior personnel will be allocated more responsibilities. This may occur concurrently with less supervision if the supervisor’s workload must also increase to deliver the production goals.
Therefore, the volume of work and interruptions to the overhaul in the month of July 2017, combined with the low levels of staff experience and qualifications, and maintenance practices, increased the risk of a maintenance error event. In addition, the intensity of the work likely reduced the chief engineer’s capacity to effectively supervise all the activities related to the CMC helicopters.
Internal independence
The CMC-CAM managing director was the CASA approved Head of Aircraft Airworthiness and Maintenance Control. This position is intended to provide an interface with maintenance organisations for the planning and preparation of maintenance activities, and an independent check of the completion of those activities.
The managing director, who had a pilot background, had delegated the Head of Aircraft Airworthiness and Maintenance Control responsibilities to the position of maintenance coordinator, which was filled by the chief engineer at the time of the accident. This decision resulted in the same individual holding the two key positions of airworthiness and maintenance management within CMC and CAM. As a result of this structure, the chief engineer had a considerable number of responsibilities and there was no independent assurance of maintenance quality from the Air Operator Certificate holder. In addition, there was no requirement for CAM to have a quality manager to routinely monitor, measure and evaluate the organisation’s performance, and advise the managing director and chief engineer of the results.
In the absence of an independent maintenance coordinator or quality manager, the organisation was operating with very few checks and balances. In addition, the ATSB noted that all maintenance staff, including the chief engineer, were trained through their apprenticeships at CAM. The home‑grown workforce, combined with no permanent internal independent oversight, limited CAM’s exposure to alternative maintenance practices and continuous improvement.
Audit oversight
In the absence of a quality manager for CAM, the role of internal audit was managed by contracting an external auditor. The ATSB reviewed the two internal audits performed in 2015 and 2016, and noted there were no findings, no requests for corrective action and no suggestions for improvements. Upon review of the work-pack sampled in the 2016 audit, the ATSB noted there was no evidence of progressive certification, an abbreviated 100-hour inspection checklist was used, and a single certification was made for the entire 100‑hour inspection on the airframe, ground check and run up.
The observations of the sampled work-pack suggested it was not used to track the progress of maintenance, which presented the risk of the omission of inspections during periods of interruptions. In contrast, the Robinson Helicopter Company maintenance manual checklist for the 100-hour inspection provided points of certification for each item. Chapter 6 of the CAM MPM included the requirements to conduct maintenance in accordance with approved data and to progressively certify for each item as it is completed. Use of the Robinson Helicopter Company checklist would have provided the auditor with evidence that approved data was used and current, and that it facilitated progressive certification, thereby demonstrating that requirements were being met.
Similarly, in 2015, CASA performed their last system-based audit of CAM prior to the accident. The auditor sampled three work-packs, which included a 2,200-hour overhaul for an R22, with no issues identified. The reported criteria for the sampling was Chapter 6 of the CAM MPM. The ATSB’s review of that work-pack found that it did not capture all the requirements of the overhaul procedure or progressive certification. Therefore, it did not conform to Chapter 6 of the MPM. However, a post-accident audit conducted by CASA identified a number of findings similar to those observed by the ATSB.
From the ATSB’s review of the sampled work-packs, it was noted that the maintenance practices employed by CAM during the overhaul of VH-HGU were present before the helicopter was acquired by CMC in February 2017 and entered overhaul. These practices were visible to auditors engaged in internal and external audits of CAM and indicated that the work-packs were not being used for progressively recording and tracking tasks. Consequently, the audits were missed opportunities to identify and recommend improvements to the practices employed by CAM staff, which limited their benefit to CAM as a quality assurance tool.
Re-use of self-locking nuts
In the course of interviewing personnel employed by CAM, the ATSB noted a low level of awareness of the need to replace MS21042L/NAS1291-series nuts with the D210-series nuts when critical fasteners were reassembled. In accordance with the R22 maintenance manual, critical fasteners include a self-locking nut in their assembly. It is a standard practice within sectors of the aviation industry to re-use self-locking nuts provided the nut cannot be turned onto the bolt thread by hand and the published torque value for the fastener is achieved.
In December 2018, the ATSB received the accident helicopter’s jackshaft, which had the fasteners attached. The jackshaft was one of a number of parts within the flight control system that was disassembled and sent for non-destructive inspection during the 2,200-hour overhaul. In late January 2019, the ATSB completed semi-quantitative chemical analysis of the nuts fitted to the jackshaft and found they were consistent with a carbon/alloy steel, and therefore not consistent with D210-series stainless steel corrosion-resistant nuts.
At the time of the reassembly of the accident helicopter, the current R22 Illustrated Parts Catalog detailed the part number D210-4 for the nuts fitted to the jackshaft, and RHC confirmed there was no alternate part number to the D210-series nuts. Therefore, the ATSB concluded that the industry practice of re-use of self‑locking nuts on Robinson helicopters may result in the omission to install D210-series nuts when critical fasteners are reassembled.
Findings
From the evidence available, the following findings are made with respect to the loss of control and in-flight break-up involving the Cloncurry Mustering Company Robinson R22 helicopter, registered VH-HGU, 7 km north-north-west of Cloncurry Airport, Queensland, on 2 August 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
About 3 minutes after take-off, a bolt separated from the cyclic control bellcrank, which resulted in an unrecoverable loss of control, in-flight break-up and collision with terrain.
The bolt separated from the bellcrank during flight, likely due to either the self-locking nut not being reinstalled or inadequate torque of the nut on completion of the 2,200-hour overhaul. The accident flight was the first commercial flight after the 2,200-hour overhaul.
Other factors that increased risk
Cloncurry Air Maintenance had adopted a number of practices, which included using abbreviated inspection checklists, not recording all flight control disturbances and not progressively certifying for every inspection item as the work was completed, which increased the risk of memory-related errors and the omission of tasks. [Safety Issue]
The number of helicopters for which maintenance was performed in the month leading up to the accident likely exceeded the workforce capability, given the staffing levels and qualifications. This likely reduced the capacity of the chief engineer to conduct oversight activities and increased the risk of a maintenance error not being captured.
Cloncurry Air Maintenance had limited internal independent oversight and increased reliance on audits for the evaluation of its quality performance. This was partly due to:
the absence of an independent maintenance coordinator or quality manager, and
all maintenance staff had worked almost exclusively for Cloncurry Air Maintenance, which limited the organisation's exposure to other maintenance practices.
The most recent contracted audit of Cloncurry Air Maintenance, performed as part of the organisation's quality activities, and the previous audit conducted by the Civil Aviation Safety Authority, did not provide any observations of error-conducive maintenance practices, although they were present at the time. These were missed opportunities to identify and recommend improvements to the tracking and certification of maintenance tasks.
During reassembly of the helicopter after the 2,200-hour overhaul, self-locking nuts, consistent with MS21042L-series nuts, were re-used on critical fasteners without replacing them with D210-series corrosion resistant nuts in accordance with the manufacturer's instructions for continued airworthiness. The D210-series nuts were introduced to reduce the risk of hydrogen embrittlement cracking from the MS21042L-series and NAS1291-series nuts.
Other findings
There was no recorded maintenance on the helicopter to indicate that the bellcrank fastener was removed, and it was not always necessary to disassemble it during the 2,200-hour overhaul. However, there were several reasons why it could have been disturbed. These included disturbance as part of the disassembly of the cyclic control assembly, disassembly to inspect the attached rod-end with a dial test indicator, or disassembly to adjust the length of the horizontal push-pull tube as part of the main rotor rigging process. However, based on the evidence available, the ATSB could not establish if any of these tasks were performed.
On completion of the helicopter's 2,200-hour overhaul, there were several certifications for inspection of the cyclic control assembly. The reason why these inspections did not detect an anomaly with the cyclic bellcrank fastener could not be determined.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Cloncurry Air Maintenance had adopted a number of practices, which included using abbreviated inspection checklists, not recording all flight control disturbances and not progressively certifying for every inspection item as the work was completed, which increased the risk of memory-related errors and the omission of tasks.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence:
Australian Transport Safety Bureau
ATSB safety advisory notice to maintenance personnel for Robinson helicopters
In March 2019, the Australian Transport Safety Bureau issued a safety advisory notice advising all Australian maintenance personnel for Robinson helicopters to ensure that before re-using a self-locking nut, that the correct part number is fitted, and that the D210-series corrosion-resistant nuts are used for reassembly of critical fasteners in accordance with the Robinson Helicopter Company instructions for continued airworthiness.
On 5 June 2019, the Civil Aviation Safety Authority released airworthiness bulletin (AWB) 67-005 Issue 1: Robinson Helicopter Flight Controls – Duplicate Inspections [independent inspection]. The purpose of AWB 67-005 was to advise all operators and maintainers of the need to replace MS2104 hardware during removal or replacement of such hardware and the requirement to complete a duplicate inspection of each stage of maintenance on the primary flight controls.
On 20 June 2019, the Civil Aviation Safety Authority released AWB 67-005 Issue 2: Robinson Helicopter Flight Controls – Independent Inspections. Issue 2 highlighted the need for independent inspections to be conducted and ‘recorded consecutively with each adjustment made during rotor tracking and balancing’ activities. In addition to several recommendations, Issue 2 identified several human factor elements that could impact inspection performance, and highlighted the need for extra caution during post-maintenance flights in accordance with Robinson Helicopter Company safety notice SN-43:
…any work completed on the flight control system deserves special attention because a flight control disconnect is almost always catastrophic.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Civil Aviation Safety Authority
Cloncurry Air Maintenance
Cloncurry Flinders Medical Centre
Cloncurry Mustering Company
Ergon Energy
Pilot’s next-of-kin
Queensland Department of Health
Queensland Police Service
Robinson Helicopter Company
United States National Transportation Safety Board.
References
Australian Transport Safety Bureau 2019, AO-2016-156: In-flight break-up involving Robinson R44, VH-ZNZ, 41 km NW Mossman, Queensland, 18 November 2016, ATSB, Canberra.
Australian Transport Safety Bureau 2014, AO-2011-135: Embrittled nut and related failures Robinson R22 Beta helicopter, VH-JNP, 22 km N of Saxby Downs, Queensland, 12 October 2011, ATSB, Canberra.
Australian Transport Safety Bureau 2012, AO-2011-016: Loss of control, Robinson Helicopter R44 Astro, VH-HFH, Cessnock Airport, New South Wales, 4 February 2011, ATSB, Canberra.
Australian Transport Safety Bureau 2008, AR-2008-055: An Overview of Human Factors in Aviation Maintenance, report prepared by A Hobbs, Canberra.
Dismukes, K and Nowinski, J 2007, ‘Prospective memory, concurrent task management, and pilot error’. In AF Kramer, DA Wiegmann and A Kirlik (Eds.), Series in human-technology interaction. Attention: From theory to practice (pp. 225–236), Oxford University Press.
National Aerospace Standard, NAS6603 thru 6620, Bolt, tension, hex head, close tolerance, alloy steel, long thread, reduced major dia., self-locking and non-locking, 160 KSI Ftu, Revision 8, June 12, 2009.
Schacter, LD 1999, ‘The seven sins of memory: Insights from psychology and cognitive neuroscience’, American Psychologist, vol. 54, no. 3, pp. 182-203.
United States National Transportation Safety Board 2013, NTSB/AAR-13/01: Loss of Control, Sundance Helicopters, Inc. Eurocopter AS350-B2, N37SH, Near Las Vegas, Nevada, December 7, 2011, NTSB, Washington.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, Cloncurry Air Maintenance and Cloncurry Mustering Company personnel, pilot’s next-of-kin, pilot’s designated aviation medical examiner, Queensland Department of Health, Queensland Northern Coroner, Robinson Helicopter Company and the United States National Transportation Safety Board.
Submissions were received from the Civil Aviation Safety Authority, Cloncurry Air Maintenance and Cloncurry Mustering Company, pilot’s next-of-kin, pilot’s designated aviation medical examiner, Queensland Northern Coroner and the Robinson Helicopter Company. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Appendices
Appendix A – Materials examination report
Introduction
Following a review of the site images for the wreckage of VH-HGU and impact information, a critical fastener from the cyclic control system was identified to be missing. The cyclic is one of the primary controls that a pilot must use during flight. It allows flight to be controlled in any direction of travel by tilting the main rotor disc. The cyclic stick within the R22 cabin was coupled to a non‑rotating swashplate by a mechanical linkage comprising push-pull tubes, pivots, a bellcrank and its associated fasteners (e.g. bolts and nuts, rod ends, spacers and washers). The underfloor bellcrank provided the linkage between the horizontal and vertical push‑pull tubes. It transmitted horizontal push-pull tube movement to vertical movement that tilted the swashplate, producing an associated tilting of the main rotor disc.
The missing fastener was normally installed in the bellcrank, connecting through the rod end of the horizontal push-pull tube (Figure A1). Due to the criticality of this fastener in relation to the operation of the cyclic control and its absence predicating an in-flight loss of control, several items from the wreckage were recovered from the accident site. The retained items were examined in closer detail at the ATSB’s technical facilities in Canberra. They included:
bellcrank (part number A958-1) and associated componentry
recovered pieces of metallic debris
jackshaft (part number A337-1) and associated componentry
a single NAS6604-15 bolt
additional loose nuts and washers
forward support assembly (part number A014-6).
Figure A1: View looking upwards of an exemplar R22 control system, showing the bellcrank and location of the missing fastener
Source: ATSB
Scope
The scope of the examination was to analyse the bellcrank, yoke, and related components to determine how the fastener came to be missing, and to examine the pieces of metallic debris to determine if any additional components could be recovered. The jackshaft shared the same fastener type as the bellcrank assembly and was examined for comparative purposes. Additionally, the forward support assembly was used to verify the presence and security of NAS6604-15 bolts.
Examination
Bellcrank fasteners
The missing bellcrank fastener was an assembly of components comprised of the following (Figure A2):
NAS6604-15 bolt
NAS1149F0432P washer
A115-1 spacer
B332-441 lockwasher
D210-4 nut
rod-end.
Figure A2: Modified image from the R22 Illustrated Parts Catalog showing missing fastener assembly components and location
Source: Robinson Helicopter Company, annotated by the ATSB
Specified bolt
The current Robinson Helicopter Company (RHC) R22 Illustrated Parts Catalog (IPC) showed that the horizontal and vertical push-pull tubes from the cyclic control assembly were required to be attached to the bellcrank with a National Aerospace Standard (NAS) 6604-15 bolt[43] and D210-4 nut. The NAS specification listed the material type as alloy steel, grade 4140, 4340, or 8740. Table A1 provides the bolt dimensions from that specification.
Table A1: NAS6604-15 bolt specifications
Bolt
Thread UNJF-3A
Width (flats) (in)
Shank diameter (in)
Thread length (in)
Grip length (in)
Length (in)
Height (head) (in)
NAS6604-15 bolt
0.2500-28
0.429- 0.439
0.2485- 0.2495
0.425
0.938
1.363
0.125
Specified nut
Prior to 2014, the specified nut was an MS21042L-series or NAS1291-series. However, RHC issued a R22 service letter SL-64, D210 Corrosion-Resistant (CRES) nuts, on 13 October 2014, which addressed potential cracking of MS21042L-series nuts.
The D210-series CRES nuts, which supersede MS21042L-series and NAS1291-series nuts, are not susceptible to cracking. The service letter directed that when performing maintenance that involved disassembly of a critical fastener (joints with a secondary lock), the fastener should be reassembled using a D210-series nut. The IPC was updated in February 2017 to reflect these changes. Table A2 provides the dimensions of the nuts.
The recovered bellcrank remained attached to the torque tube yoke assembly, which had fractured at the termination of the attached stiffening brackets. The submitted assembly exhibited significant damage as a result of mechanical and heat effects. All remaining rod ends, including those attached to the vertical push-pull tubes and collective fork assembly, had fractured in overstress (Figure A3).
Figure A3: Side view of the bellcrank as received, location of missing fastener circled
Source: ATSB
The torque tube yoke assembly had separated from the bolt for the lateral cyclic vertical push-pull tube rod end on the left side, and was distorted from a combination of mechanical impact and heat. The left side of the yoke assembly exhibited significant distortion, and had been plastically deformed inward, towards the right side. The left bellcrank plate had been distorted in a similar way, causing the two plates to come together at the location of the missing fastener. The yoke assembly also exhibited heat damage in this area, with the left side moulding around the bellcrank plate (Figure A4).
Figure A4: Side view of the bellcrank as received showing deformation of yoke and plate
Source: ATSB
Following initial visual examination and photography, the bellcrank was removed from the torque tube yoke assembly for further examination. The bellcrank exhibited distortion from a combination of mechanical stress and heat effects. The two plates of the bellcrank had been deformed along the length between the vertical push-pull tube and torque tube attachment ends (Figure A5). Where the fasteners remained in position, the two plates had deformed in parallel. However, as above, where the fastener was missing, the two plates of the bellcrank had been pushed closer together.
Figure A5: Bellcrank following removal from the torque tube and showing parallel deformation of both plates
Source: ATSB
Closer examination of the bellcrank plates showed that a yellow residue had been deposited around the holes where the bolts had been in position. However, there was minimal residue around the hole where the fastener was missing (Figure A6). The manufacturer advised the residue was likely cadmium plating from components within the fastener assembly that had melted during the fire. They were also of the opinion that the minimal residue observed around the hole where the fastener was missing was likely from cadmium plating transfer from a previous installation. The presence of cadmium within the residue was confirmed by semi-quantitative chemical analysis using a scanning electron microscope (SEM) equipped with an Oxford energy dispersive x-ray spectrometer (EDS).
Figure A6: Bellcrank internal surfaces showing the cadmium plating residue
Source: ATSB
There was no evidence of deformation or elongation of the bellcrank fastener hole to suggest that the nut and bolt had detached forcefully during the collision. The surface of the bellcrank in the region adjacent to the missing bolt, and the internal surface of the bolt hole, was rippled as a result of high temperatures associated with the fire. Minor damage in the form of scrapes and dents were observed in the region adjacent to the bolt hole of the missing fastener, coincident with where it had been in contact with the torque tube yoke assembly (Figure A7).
Figure A7: Comparison between the bolt hole where the fastener was missing (left) showing deformation due to heat and a bolt hole where a fastener remained in position (right)
Source: ATSB
An exemplar bolt could not be inserted through the bellcrank bolt holes where the fastener was missing. This was due to a combination of misalignment of the two plates as a result of impact damage, and the heat damage observed on the internal surfaces of the holes.
Remaining bellcrank bolts
Markings on heads of the two remaining bolts from the bellcrank indicated they were a NAS6604‑15 bolt. The marking ‘LFC’ stamped on the bolt head identified the manufacturer (Figure A8). As per United States Department of Defence Handbook, MIL-HDBK-57G (IS) 16 October 2012, Listing of Fastener Manufacturer’s Identification Symbols, the manufacturer was likely to be: LFC Industries, Texas, USA.
Figure A8: Bolt head markings from one of the remaining bellcrank bolts
Source: ATSB
Remaining bellcrank nuts
The nuts of the two remaining fasteners were stamped with an ’R’ symbol on two of the hexagon flats on opposite sides. As per United States Department of Defence Handbook, MIL-HDBK-57E Listing of Fastener Manufacturer’s Identification Symbols, the nuts were most likely manufactured by Ronson Manufacturing Inc. (Figure A9). The two remaining nuts were in relatively good condition, with no evidence of any cracking or damage observed. The chemical analysis results, provided in Table A3, confirmed the nuts were manufactured using 4037 alloy steel. Measurements and chemical analysis confirmed that they were consistent with MS21042‑L4/NAS1291-series nuts.
Figure A9: Nut markings from one of the remaining fasteners (left) and relevant page from MIL-HDBK-57 showing manufacturers marks (right)
Source: ATSB
Table A3: Chemical analysis results for a nut removed from the bellcrank
Specification
Fe
C
Mn
Si
S
P
Ni
Cr
Mo
Cu
V
Al
Bellcrank nut
Bal
0.39
0.75
0.26
0.01
0.01
0.05
0.19
0.23
0.12
0.01
0.023
Alloy 4037
-
0.35-0.40
0.70-0.90
0.15-0.35
0.04
0.35
-
-
0.20-0.30
-
-
-
Units are weight %
Additional recovered bolt
The bolt found on 16 May 2018 by the pilot’s next-of-kin displayed the same markings as those that remained in position on the bellcrank (NAS6604-15 manufactured by LFC) (Figure A10). The surfaces of the bolt were severely heat affected, with areas of material loss and areas where additional material had adhered to the surface. Ultrasonic chemical cleaning of the bolt was unable to remove much of the adhered material. There was no damage observed to the head, shank or threads of the bolt. A dial indicator was used to check the bolt run-out, which confirmed it to be straight without significant distortion along the length.
Figure A10: NAS6604-15 bolt found 16 May 2018
Source: ATSB
Closer examination of the bolt threads confirmed significant heat damage, and a small groove located on the second to third threads from the end of the bolt (Figure A11). Other than the small groove, the bolt threads did not show any other markings such as grooves, score marks or galling.[44] A similar marking was observed on the other bellcrank bolts. This indicated that a nut had been installed at some point on the examined bolt. The bolt was examined using a scanning electron microscope equipped with an Oxford energy dispersive x-ray spectrometer. No evidence of remnant cadmium plating was detected on the bolt surfaces.
Figure A11: Magnified image of the NAS6604-15 bolt found 16 May 2018 showing thread groove
Source: ATSB
Radiography of metallic debris
Aluminium alloy portions of the helicopter had melted during the post-accident fire and then resolidified into blobs of metallic debris. The debris was gathered from the wreckage and submitted to the Australian National University for radiography[45] to determine the presence of entrapped hardware (e.g. nuts, bolts, washers) that may have been similar in size or shape to the components from the fastener assembly missing from the bellcrank.
While some samples did show evidence of steel componentry, including nuts and bolts, within the solidified metallic debris, nothing was identified that was similar in size or shape to a NAS6604-15 bolt, D210-4 nut, or MS21042-L4/NAS1291-series nuts. The fasteners identified were too long or short, threaded the entire length, were a complete assembly (nut was still attached), had a different shaped head or were attached to other componentry (Figure A12).
Figure A12: One of the metallic pieces recovered from the accident site and the corresponding radiograph that highlighted the presence of entrapped steel hardware
Source: ATSB (left) and Australian National University (right)
Dissolution of metallic debris
Following the suspected recovery of the missing bolt from the bellcrank, an internal technical review of the radiography questioned if that technique was capable of resolving a small part, such as a D210-4 or MS21042-L nut. When taking into account potential for hydrogen embrittlement and cracking of the MS21042-L series nuts, it was considered that, if the nut had fractured into thirds, it may not have been visible on the radiographs. As such, the metal pieces were dissolved in a caustic soda (sodium hydroxide) solution. The resulting solution was sieved using a 352 mesh (minimum captured particle size of 1.5 mm) to recover the entrapped hardware.
A number of fasteners and other components were recovered following dissolution of the aluminium (Figure A13). The missing nut to the bellcrank fastener was not amongst the entrapped hardware. Neither a D210-4 nor MS21042-L series (whole or in part) nut was among the recovered items.
Figure A13: Recovered items following dissolution of the metallic debris
Source: ATSB
Additional hardware
Additional hardware was received in June 2018 by the ATSB, which included:
additional fastener parts (four small bags of nuts and washers)
forward support assembly (part number A014-6) with two NAS6604-15 bolts.
The samples were examined to identify the fastener designations, verify that the NAS6604-15 bolts were installed and to determine if any of the nuts may have been the missing nut.
The received nuts were examined in the ATSB laboratories with the measurements and observations recorded (Table A4). Due to fire damage, some of the markings on a number of the nuts were unable to be determined.
‘c’ and ‘k’ on basevertical line on opposite flats
The forward support assembly (A014-6) was part of the landing gear, and the IPC showed that it should contain two NAS6604-15 bolts.[46] Due to fire damage, the markings on the heads of the two bolts from the forward support assembly were illegible. However, the bolts were measured and the results consistent with the requirements for a NAS6604-15 bolt Table A5.
Table A5: Results from bolt examinations
Width (flats) (in)
Shank diameter (in)
Thread length (in)
Grip length (in)
Length +/-0.015 (in)
Height (head) (in)
NAS6604-15 bolt
0.429- 0.439
0.2485- 0.2495
0.425
0.938
1.363
0.125
A014-6 bolts
11.16mm (0.439in)
0.249
0.429
0.935
34.74mm (1.368in)
0.126
Jackshaft
Maintenance records showed that the jackshaft had undergone maintenance, including non‑destructive testing, on or around 25 May 2017 during the 2,200-hour overhaul. The testing involved the removal of the fasteners, and as per the R22 service letter SL-64, updated IPC and maintenance manual, the nuts on the jackshaft should have been changed to the new D210‑series nuts at this time.
Examination of the four nuts showed them to be similar to those remaining in the bellcrank. Specifically, they were of a similar size, and three of them exhibited the same markings ‘R’ on the flats (Figure A14). Due to heat damage, no markings were able to be resolved on the fourth self-locking nut. Analysis of the four nuts from the jackshaft assembly was performed using the EDS and showed that all four nuts were consistent with a carbon/alloy steel, not stainless steel. The geometry, markings and chemistry indicated they were MS21042-L4/NAS1291-series nuts.
Figure A14: Jackshaft assembly (left) and magnified view of one of the nuts (right)
Source: ATSB
Discussion
Separation of the fastener from the bellcrank
The investigation considered when separation of the fastener from its installed position within the bellcrank was likely to have occurred. A number of observations indicated that the fastener was not in position at the time of the impact with the ground:
There was an absence of significant physical damage to the bolt holes where the bolt was missing and surrounds. That is, no gross deformation or elongation of the holes to indicate that the fastener assembly had been forcibly removed during the accident sequence.
The bellcrank and torque tube fork assembly had been subject to significant mechanical damage such that the rod ends had fractured in overstress and the left side of the yoke assembly and bellcrank plate had significantly distorted. While the distortion of the plates was similar where the fasteners remained in position, the plates had been pushed together where the fastener was missing.
Rippling was observed on the internal surfaces of the bolt hole, considered to be evidence of heat damage, and the bellcrank was twisted/distorted such that a new bolt was unable to be inserted into the hole. The two remaining bolts could be easily reinserted into their respective holes following removal.
Yellow colouration was present on the inside of the bellcrank around the two fasteners that had remained in position. This was likely from the oxidised cadmium plating from the installed hardware including nuts, bolts and washers. No such colouration was observed around the internal surfaces of the bellcrank holes where the fastener was missing. This indicated that the bolt and associated hardware was not in position at the time of the post-impact fire. A minimal amount of residue was observed around the hole on the nut side of the bellcrank, likely from material transfer from the lock washer. This suggested the fastener had been previously installed.
Bellcrank – the missing fastener
A solitary bolt excavated from the accident site and submitted by the next-of-kin exhibited the markings of a NAS6604-15 bolt. It also exhibited the same manufacturing mark as that on the other bolts fitted to the bellcrank. As all the other NAS6604-15 bolts were accounted for—on the bellcrank, forward support assembly, main rotor head yoke assembly and inside main rotor blades —it was very likely that this was the missing bolt from the bellcrank. The bolt was in relatively good condition, and except for thermal effects from the post-accident fire, it showed no damage on the head, shank or threads. One small groove was observed on the second to third thread flank, which was potentially from engagement with a self-locking nut during assembly. There did not appear to have been any galling or thinning of the threads, which is damage that would be expected from multiple installations of a MS21042-L4 nut.
Jackshaft
Examination of the jackshaft assembly recovered from the wreckage of VH-HGU showed that three of the four nuts had the same manufacturer markings to the nuts in position on the bellcrank. There were no discernible markings on the fourth nut. The same manufacturer’s mark was also observed on the forward support assembly, and it was considered very likely that the nuts were original from manufacture.
The ATSB’s chemical analysis of the nuts confirmed that all four were consistent with a carbon/alloy steel. Though the analysis was semi-quantitative, the spectrographs of the four nuts were inconsistent with the CRES (corrosion resistant – stainless steel) D210-4 nuts specified in the Robinson R22 IPC. The nickel, chromium and molybdenum additions, where detected, were not of sufficient quantity to designate the nuts as stainless steel. The nuts fitted to the jackshaft were therefore likely MS21042-L4/NAS1291-series nuts.
Conclusion
The following is a summary of the main findings made during examination of the bellcrank and associated components, other recovered items and the jackshaft from VH-HGU:
Due to the observed damage on the bellcrank and torque tube fork assembly, the horizontal push-pull tube fastener assembly was not in position at the time of the impact with terrain.
The remaining bolts from the bellcrank were consistent with a NAS6604-15 bolt and the nuts were consistent with an MS21042L4/NAS1291-series nut.
The solitary bolt found on 16 May 2018 was consistent with an NAS6604-15 bolt, and had the same manufacturer mark as the bolts that had remained in position. As the other NAS6604-15 bolts were accounted for, it was very likely that this was the missing bolt from the bellcrank.
The self-locking nut from the missing bellcrank fastener assembly was not recovered in the wreckage, including in the pieces of metallic debris when dissolved.
The nuts on the jackshaft assembly were not changed to D210-4-series nuts as per the Robinson instructions for continued airworthiness when they were removed to perform non‑destructive testing on the jackshaft (part number A337-1) during the 2,200-hour overhaul.
Appendix B – Maintenance workload
Figure B1 and Figure B2 depict the progression of the 100-hour inspections (yellow) and 2,200‑hour overhauls (green) by Cloncurry Air Maintenance for the Cloncurry Mustering Company in the month prior to and following the accident (red).
Figure B1: CAM maintenance jobs for CMC in July 2017
Source: ATSB
Figure B2: CAM maintenance jobs for CMC in August 2017
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
