Safety summary

What happened

On 29 December 2015, Pacific National grain train 9156 was travelling on the V/Line regional network from Carwarp in north-western Victoria to Geelong. The train consisted of two locomotives and 40 wagons.

At about 1713, the train was passing over the William Street level crossing in Ouyen travelling at about 40 km/h and was braking to stop at Ouyen Railway Station. As it crossed William Street, 12 loaded grain wagons located mid-consist derailed. The train came to a stand straddling the crossing. There were no injuries to train crew or members of the public.

There was extensive damage to the derailed wagons, trackside infrastructure and about 200 m of track. Community power, water and gas services were also disrupted. The level crossing was closed for three days and the rail line closed for five days.

What the ATSB found

The ATSB found that the derailment was probably the result of a track lateral misalignment that developed during the passage of train 9156. Over time the track had bunched at the William Street level crossing increasing the potential for a lateral misalignment in the hot conditions of that day.

Several safety factors were identified in this investigation that were similar to factors found in the investigation of a derailment at Nunga (8 km south of Ouyen) that had occurred seven weeks earlier. The asset management systems used to identify problematic levels of rail creep (the longitudinal movement of rail over time) did not incorporate algorithms to flag rail creep that had accumulated over an extended period. In addition, the management systems did not adjust creep measurements for fixed points. The network relied on this asset management system to identify problematic creep and there was no other supplementary system of identifying rail creep in jointed track.

V/Line had also identified deficiencies in the training and development of track maintenance personnel across its network and had commenced restructuring its training to address these deficiencies.

What's been done as a result

Given that this event occurred shortly after a similar derailment at Nunga (RO-2015-022), several safety actions are common to both occurrences. Following both events, V/Line made changes to its asset management system to better address cumulative creep and to correct for fixed points.

V/Line has also updated its network standard for the inspection and assessment of lateral stability, developed training materials for rail adjustment and the management of stress in rail, and undertaken additional training of track maintenance personnel.

Safety message

Asset management systems, track standards and training should provide a complementary suite of systems for the effective management of rail creep of jointed track and track stability in extreme weather conditions.

The occurrence

At 1615 on 29 December 2015, Pacific National grain train 9156 departed the grain facility at Carwarp (Figure 1), bound for Geelong. The train consisted of locomotives G542 and XR554 and 40 grain wagons having a total trailing mass of 3,037 t. Each wagon was loaded to a mass of about 76 t. The train was being operated by a crew of two persons who were qualified and medically fit to perform their respective duties.

Figure 1: The location of the derailment at Ouyen between Carwarp and Geelong

Source: Google Earth annotated by Chief Investigator, Transport Safety (Vic)

The journey between Carwarp and Ouyen was uneventful. The train was to stop at Ouyen Railway Station a short distance beyond the William Street level crossing for a change of crew. As the train approached Ouyen, the train crew observed that signal aspects and points were set to permit them to proceed on the mainline towards the station.

On the approach to and when passing over the William Street level crossing, the crew did not notice any track irregularity. The driver was controlling the train’s approach to Ouyen station with dynamic braking and after passing across William Street supplemented this with an air brake application. It was shortly after the air brake application, with the train travelling at about 40 km/h, that the crew experienced what they believed to be a runout (when the status of the couplings change in an uncontrolled manner from being in compression to being in tension) together with a rapid loss of brake pipe air pressure.

As a result of the loss of brake pipe air, the train quickly came to a stop. It was identified that twelve wagons (the 25th to 36th) had derailed at the William Street level crossing (Figure 2).

Figure 2: View of derailed train at the William Street level crossing.

Source: Chief Investigator, Transport Safety (Vic)

There were no injuries as a result of the derailment and a car that was stopped on the east side of crossing and a motorbike stopped on the west side were not impacted. There was severe infrastructure damage ahead of, and at, the level crossing (Figure 3).

Figure 3: Track damage on the approach side of the William Street level crossing

Source: Chief Investigator, Transport Safety (Vic)

Post-incident

As a result of the derailment, a range of community services including gas, water, and power were interrupted for several hours. The road crossing was closed for three days and the line closed for five days.

The train crew were tested for the presence of drugs and alcohol and recorded nil results. The locomotive event recorders were analysed and no evidence was identified to suggest that train handling contributed to this occurrence.

The first seven bogies to derail were inspected and no evidence was identified to suggest that they may have contributed to the derailment.

Previous event

This derailment in Ouyen followed a derailment seven weeks prior at Nunga, about 8 km south of Ouyen. That derailment was also investigated by ATSB and reported under RO-2015-022.

Context

Location

Ouyen is a rural town in north-western Victoria with a population of about 1,100. The derailment occured immediately to the north of the William Street level crossing located 509.492 km^[1] from Melbourne.

Weather

The forecast maximum temperature for the area was 35 °C. The recorded temperature in the region on the day of the derailment was also about 35 °C with 12.4 hours of sun.^[2]

Track infrastructure

The regional rail network, that includes the section of track from Carwarp to Ouyen, is managed by V/Line.

Approaching Ouyen from the 511 km post the track was undulating. There was a sag before the 510 km post, then an uphill grade (Figure 9). The track then crested before a slight undulation through to the William Street crossing where it decended on another slight grade towards to the yard and station. The track approaching and through the crossing had a right-hand curve of about 2000 m radius (Figure 4).

Figure 4: Approach to the William Street level crossing from Carwarp. The photograph was taken after track restoration that did not include the turnout on the Melbourne side of the crossing.

Source: Chief Investigator, Transport Safety (Vic)

Infrastructure layout

About 31 m on the Carwarp side of William Street there was a colour light Home signal to protect the crossing and control the movement of south-bound trains into Ouyen (Figure 5).

About 26 m beyond the crossing there was a set of facing points that provided access to and from the Ouyen yard. Their normal position was to be set and locked for the mainline.

Figure 5: Track layout and key features (not to scale)

Source: Chief Investigator, Transport Safety (Vic)

Track construction

The line between Carwarp and Ouyen was classified as Class 3 (minor passenger and major freight line) although it was not servicing passenger traffic. The line speed for freight traffic was 80 km/h.

Nominal track construction was timber sleepers and sleeper plates (baseplates) supporting mechanically jointed 47 kg/m rail in 82 m lengths affixed with non resilent fasteners. Intermittent boxed anchoring of rail was used to reduce rail movement (Figure 6). Ballast for new and upgrade works was required to be 300 mm deep under the sleeper and level with the sleeper top, and extend at least 400 mm beyond the sleeper ends.

The track condition was fair with a good ballast profile (Figure 6). The condition of sleepers varied, with intermittent higher quality sleepers used to supplement sleepers that were nearing end-of-life.

Figure 6: Undisturbed track on the Carwap side of the derailment site, showing intermittent higher quality sleepers and typical ballast condition. Rail was affixed with dog-spikes with intermittent use of box anchoring to reduce rail creep.

Source: Chief Investigator, Transport Safety (Vic)

Recent track works

In order to address multiple Temporary Speed Restrictions (TSRs) between Carwarp and Ouyen, substational track works were conducted in the section in May and June 2015. The scope of works included the renewal of 28,000 sleepers, ballast top up, and resurfacing. Rail adjustment^[3] was not included in the scope.

William Street level crossing

The William Street level crossing was located at 509.492 km. It was sealed with bitumen and consisted of a dual-gauge concrete sleepered track panel with 47 kg/m rail fixed using resilient fasteners.^[4]

When reinstated following the derailment the configuration was similar except timber sleepers were used (Figure 7).

Figure 7: The William Street level crossing after reinstatement, similar in construction to the pre-derailment installation except timber sleepers used instead of concrete.

Source: Chief Investigator, Transport Safety (Vic)

Rail joint measurements

Rail joints behind the derailed train (on the Carwarp side) were inspected following the derailment. Through 30 December all joints remained closed in the continuing hot weather. The joints were reassessed in the early morning on 31 December and all joints had opened by varying amounts. Measurements were taken between 0630 and 0700 with a stable mean rail temperature of 21.6 °C (Figure 8).

Figure 8: Measurement of the gap at the second joint to the north of the derailed train on the left (Up) rail.

Source: Chief Investigator, Transport Safety (Vic)

Measurements (Figure 10) were taken at joints on the undisturbed track over a distance of about 900 m including through the location of the 510 km creep monument (Figure 9).

Figure 9: The 510 km post and creep monuments on uphill grade approaching Ouyen.

Source: Chief Investigator, Transport Safety (Vic)

Figure 10: Joint gap measurements taken on the morning of 31 December 2015 at a mean rail temperature of 21.6 °C

Source: Chief Investigator, Transport Safety (Vic)

Rail gaps were found to progressively increase the further the distance from the rear of the train. Gaps as high as 20 mm were measured even though the nominal maximum gap in rail joints is 11 mm. This was probably the result of variations and wear in bolts and holes and it is probable that all joints in this track could extend to a gap of at least 15 mm.

Considering the data for the three rail joints to the north of the derailment site, the mean rail temperatures at which these joints would close was estimated to be about 26 °C for the Down leg and 32 °C for the Up leg.

Installation of jointed track and lateral stability

Jointed track

Jointed track made of 82 m welded lengths of rail has expansion gaps (nominally 11 mm) that provide a range of 12 degrees in rail temperature in which the rail is stress free.

V/Line construction standard NIST-2650 Use and Laying of Rail specified procedures to ensure that rails were installed to achieve design optimum levels of stress in weather extremes. For jointed 82 m lengths of rail, correctly installed rails are effectively stress free within the working limits of the expansion gap at rail temperatures of between about 26 and 38 °C. At temperatures below this range, the gap should be fully open and contracted rails would be in tension, and at temperatures above 38 °C joints would be expected to be fully closed and rails in compression.

The temperature range at which jointed rail is stress free can be affected by rail creep, the longitudinal movement of rail over time. Creep can result in rail bunching in some areas and being stretched in others. Bunching results in excess rail through a location, and the lowering of the stress free temperature range.

Rail behaviour in hot conditions

Rail temperatures in excess of 50 °C in the region are not uncommon. Rail temperatures can typically be 50 per cent more than ambient^[5] or higher, depending on several environmental factors including solar radiation. As a result, in hot weather, rail temperatures normally exceed the nominal upper limit of the stress free temperature range (38 °C), resulting in rails being in a longitudinally compressed condition. Track stability then relies on rail fastenings and track supporting formations, including ballast, to resist the forces that induce rails to buckle (move laterally) when in compression.

Where there has been creep resulting in the bunching of rail, the rail will enter a state of longitudinal compression at a lower temperature to that intended. As a result, in hot weather these compressive forces will be greater and lateral buckling forces on fixings and track support higher. The potential for the lateral misalignment of rail is therefore increased.

Inspection and other measures for managing lateral stability

Regimes

The condition of track to withstand hot weather is managed by V/Line in a number of ways, including:

• general inspections
• the management of rail creep
• heat related speed restrictions (WOLO^[6]) and heat patrols.

General inspections

For Class 3 track, V/Line procedures specified weekly track patrols that were expected to identify the following defects and conditions that may relate to lateral stability:

• lateral misalignments
• poor track geometry
• sharp or flat areas in curves
• track movement.

The most recent track patrol through this location prior to the derailment was conducted by road-rail vehicle on the day of the derailment (29 December 2015); no defects were identified.

For Class 3 track, V/Line procedures also specified annual walking inspections. The most recent walking inspection was conducted on 1 July 2015 and did not identify any conditions at the derailment location requiring remedial action.

Management of rail creep

Rail creep changes the stress condition of the rails and therefore its management over time is a critical part of ensuring track stability. Creep that results in the bunching of rail at a particular location will result in higher compressive forces within the rail, increasing the potential for a rail to buckle. This is most likely to occur on the approaches to fixed points such as turnouts and level crossings.

V/Line managed creep using permanent trackside points called creep monuments that are typically 1 km apart. V/Line procedures required each creep measurement at each monument to be compared with the previous measurement and also to be assessed for long term accumulation (cumulative creep) since the creep point was last reset (Figure 11).

Figure 11: V/Line limits for rail creep

Source: V/Line network standard NIPR- 2708

Track maintenance personnel measured rail creep in the autumn and spring of each year. These measurements were recorded in a centralised asset management system and creep exceedance reports generated. These exceedance reports were then assigned to track supervisors for remediation.

The asset management system used by V/Line changed on 1 July 2015. Both the previous and new system had been tailored by V/Line to meet its business requirements. Both systems included algorithms for evaluating the ‘creep since previous measurement’ criterion but neither evaluated cumulative creep.

Additional heat-related controls

Additional controls to manage the risk of rail misalignment in hot weather included reduced train speeds (WOLO) and heat patrols. For this section of line, WOLO precautions were implemented when temperatures were forecast to exceed 36 °C. This temperature was consistent with or lower than other Australian regional networks and was established in the context of the condition of the network and other network measures for controlling track lateral stability.

The forecast (and actual) maximum temperature on 29 Decmber 2015 was 35 °C and as a result these heat-related controls were not applied.

Network standards for lateral stability in hot weather

At the time of this occurrence V/Line had two standards for maintaining lateral stability.

NIPR-2708 Inspection and Assessment of Lateral Stability (2013) specified track conditions to observe during inspections, instruction on creep measurement and joint gap assessment, and guidance on temperatures at which gaps should be closed and open. The standard did not include significant guidance material on understanding creep, nor tools for assessing joint gaps over a range of rail temperatures.

NIPR-2751 Management of Infrastructure During Hot Weather (2009) was a brief instruction on speed restrictions and heat patrols in hot weather and seasonal restrictions on track maintenance activities.

Following a number of heat related derailments, V/Line commenced a review and redevelopment of its standards for the assessment of track lateral stability. The reviews were not complete at the time of this (Ouyen) derailment.

Training for track maintenance personnel

Track inspection and maintenance training consisted of nine stages commencing at Way Maintainer and culminating at Supervisor (Figure 12). The stages used training components aligned with industry competencies as described in the Transport Logisitics Training Package TLI10.

Figure 12: Progression steps for track maintenance personnel

Source: V/Line

Certified training

Qualification as a Track Inspector required technical training to Certificate II level. Progression to Ganger was dependent on the application of these Certificate II competencies on-the-job, and then the successful completion of the Certificate III training in Transport and Distribution (Rail Infrastructure).

For experienced Gangers selected to progress to Supervisor, further formal training consisted of a range of management and workplace courses, including the Certificate IV in Training and Assessment. Refresher training or assessment in the core competencies associated with maintaining rail infrastructure in Certificate II and III was not a specified requirement.

Training 1999 to 2013

The Victorian regional network was privatised in 1999 after which it was managed by several private entities before returning to public management under V/Line in 2007. During this period of private management, Technical Inspector and Ganger training was conducted by private training providers under their Registered Training Organisation (RTO) accreditation. This continued during V/Line’s management of the network until 2013. On-the-job training and mentoring was by local arrangement.

Internal audits (by V/Line) of maintenance personnel competencies identified gaps in knowledge, and as result V/Line brought the technical training of Technical Inspectors and Gangers ‘in-house’ in 2014. V/Line advised the ATSB that, since 2014, the new regime of internal training involved considerably more mentoring and rigorous assessment. Refresher technical training for those with existing qualifications was also being considered.

Track supervisor for Ouyen

The Track Supervisor for Ouyen had 28 years track maintenance experience and had completed all requisite training required for a Track Supervisor including Certificate III in Transport and Distribution (Rail Infrastructure) in 2004 and a Certificate IV in Training and Assessment in 2012.

Mildura Rail Corridor Freight Upgrade Project (Line rehabilitation)

Project scope

In 2008 and 2009 there was a major upgrade of the Mildura rail corridor, that included the track through Ouyen. The project included:

• Sleeper and fastener replacement and upgrade works
• Formation restoration and ballast shoulder rehabilitation
• Track surfacing works
• Rail joint rehabilitation
• Level crossing upgrade works
• Rail stress and lateral stability management works.

Rail stress and lateral stability management works

This component of the project scope included the final de-stressing of track and rail joint gap correction on completion of all works. The work components pertinent to the final rail adjustment included:

• preparation of a Rail Stress and Lateral Stability Management Plan
• measuring rail joint gaps and carrying out corrective works
• carrying out work to ensure that the neutral temperature and the rail joint gaps were within tolerance.

Project documentation specified that at the end of project works, a rail neutral temperature of between 35 and 48 °C was acceptable, and where the calculated rail neutral temperature was between 32 and 35 °C, V/Line approval was required. For jointed track, the rail neutral temperature was defined as the temperature at which the joint gap became closed.

Rail adjustment at Ouyen

Records indicate that there were no rail adjustment works between the William Street level crossing and the 510 km post as part of this upgrade project. There were minor repair works to two mechanical joints (one on each rail) about 40 m to the north of the level crossing. There were no other works on joints between the level crossing and the 510 km post.

Neutral (stress free) temperature

The project undertook joint gap measurements and neutral temperature calculations to identify rail adjustment requirements to meet the allowable stress free temperature at project end. For the works module north of the William Street level crossing, the project’s calculation (Figure 13, scenario A) identified a neutral temperature of 35 °C for the Up rail (meeting the permitted figure), and 34 °C for the Down rail (that would be permitted if approved by V/Line).

The project based its calculations for this module on an average rail length of 73 m. This average was obtained by dividing the total module length (802 m) by the number joints (11).

Further analysis of the project data using the joint gap measurements for a four joint subset of the module joint data (positions 3 to 6 from the crossing)^[7] shows that bunching was probably more severe near the crossing. The calculated localised rail neutral temperatures (across these four joints) are at or about the 32 °C project threshold^[8] (Figure 13, scenario B).

Figure 13: Estimated neutral temperatures calculated by the project (scenario A) and for a four joint subset of this data (scenario B) nearer to the crossing.

Source: Based on joint gap measurements taken as part of the Mildura Rail Freight Corridor Upgtade Project

Similar occurrences

Derailment of train 9130 at Emu on 12 February 2014 (RO-2014-003)

On 12 February 2014 at around 1400, ten wagons of a loaded grain train travelling south from Birchip to North Geelong derailed at Emu in North Central Victoria. Emu is located about 230 km south of Ouyen.

The ATSB investigation concluded that the derailment was the result of the lateral misalignment of the track that developed during the passage of the train in the hot conditions of that day. It was found that V/Line’s processes for responding to identified rail creep defects did not ensure remedial action before the onset of warmer seasonal conditions.

Derailment of train 9150 at Nunga on 9 November 2015 (RO-2015-022)

On 9 November 2015 at around 1530, the trailing wagon of a loaded grain train travelling south from Carwarp derailed immediately ahead of the Janiels Road level crossing in Nunga (8 km south of Ouyen). The ATSB concluded that rail creep over a prolonged period had resulted in the bunching of rail on the north side of the crossing. This rendered the rails vulnerable to lateral instability in the hot weather and a lateral misalignment developed during the passage of the train. Safety issues identified included:

• Asset management systems that were used to identify problematic levels of rail creep did not evaluate nor assess cumulative creep. [Safety Issue]
• There was no supplementary system of inspection that was effective in identifying rail creep in jointed track. The network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep. [Safety Issue]
• The procedures for measuring, assessing and remediating rail creep in spring did not ensure creep defects were addressed in a timely manner and prior to the onset of hot weather. A creep defect identified by the spring measurements was not corrected before the derailment. [Safety Issue]
• Asset management systems used to identify problematic levels of rail creep did not correct for fixed points between creep monuments. [Safety Issue]

__________

•  
  1. Rail kilometres from a reference point in Melbourne.
  2. Sunshine observations are from Mildura airport.
  3. Rail adjustment is the process of adding, removing or adjusting rail to reduce the risk of rail fracturing or buckling at temperature extremes.
  4. Pandrol fastclips and e-clips.
  5. Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010.
  6. WOLO was a railway telegraph code to notify of heat-related restrictions, and continues to be used in the industry.
  7. The two joints closest to the crossing have not been included in the calculations, as project documentation suggests that the rail length was something less thatn 82 m. The precise joint spacing between these two joints is not known.
  8. The project was not required to undertake localised assessment, but rather look at the complete module (that contained 11 joints in this instance).

Safety analysis

Track lateral instability

Creep is the longitudinal movement of rails and track caused by the action of traffic over time. It is most likely to occur on grades, at locations where trains brake, and in the direction of predominant traffic tonnage. Rail is also prone to bunching on the approach to level crossings. This was the scenario at the William Street level crossing with loaded traffic predominant in the Up direction (travelling south) and rail bunching on the north side of the crossing.

A creep monument was located 508 m to the north of the level crossing at the 510 km post. The measured values of rail creep at this location are shown at Figure 14. A corrected value for the level crossing fixed point (giving creep standardised to creep/1000 m) is also included.^[9]

Figure 14: Measurements at the creep monument located at the 510 km post

Source: Tabulation of V/Line supplied data

Calculations based on this 510 km post creep data and post-incident measurement of joint gaps between the 510 km post and the derailed train, suggest that there was uneven distribution of rail creep between these points. More severe localised bunching in the 250 m before the crossing is probable. Estimations suggest that the joint gaps close to the crossing were probably fully closed at a rail temperature of about 20 °C or lower.^[11] This reduced the rail stress free temperature resulting in higher compressive forces in the rails in hot conditions.

In the ambient and solar conditions of the afternoon of the 29 December 2015, the rail temperature was probably in the mid-50s °C and the rails in a state of longitudinal compression. It is probable that the track-train dynamics generated by the passage and braking of train 9159, in combination with this compression, resulted in lateral forces that could not be contained by the rail and track support, and at least one of the rails moved laterally.

The hypothesis of misalignment under the train is supported by the train crew in that they did not observe any misalignment in the track as they approached and traversed the level crossing. The derailment occurred soon after the application of the air brakes, which would indicate that the braking probably triggered the track misalignment event.

Asset management systems

Cumulative creep

V/Line network standards identified that creep could occur over a short period or may accumulate over time. Since the resetting of the creep in 2009, there had been regular southward creep in both rails at the 510 km measurement point (Figure 15).

Figure 15: Trend in creep measurements at the 510 km monument
 

Source: Graphical representation of V/Line supplied data

By 2014, cumulative creep had exceeded defect criteria. However, the asset management system did not flag this exceedance. Neither the previous nor the new systems included algorithms to identify and assess creep that had accumulated since the last creep reset. The asset management systems only compared creep measurements with the previous two readings. As a result, the slow but regular rail creep southward towards the William Street level crossing was not identified for remedial action.

Correction for fixed points

The asset management system did not correct the creep measurements to take account of the William Street level crossing acting as a fixed point. Given that the monument was about 500 m from the crossing, a correction would have effectively doubled the creep measurements. This would have resulted in the system identifying several creep defects for closer inspection in the years prior to the derailment.

Creep near fixed points

The movement of rail between the 510 km creep monument and the William Street level crossing was uneven and the creep measurements at the 510 km mark did not fully reflect the localised bunching of rail at the crossing.

Other track inspections

The scope of annual walking inspections included checking that joints were not frozen or had incorrect gaps. However, the consistent assessment of gaps requires inspection within a specific (and known) rail temperature range and it was unlikely that the annual walking inspection would provide a reliable assessment of rail stress condition.

There was no other inspection regime that might have consistently identified changes in rail stress condition at high-risk locations. As a result, the network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep.

The creep between the 510 km creep monument and the level crossing was also uneven. There was no structured inspection regime that may have identified any localised issues at the crossing. This and two other recent heat related derailments^[12] have all occurred close to a fixed point.

Maintenance personnel

Training

Internal audit by V/Line across its network had identified gaps in maintenance personnel knowledge and raised concerns about outcomes of external training conducted between 1999 and 2013.

Loss of experienced personnel together with inconsistency in the training outcomes probably resulted in these gaps. V/Line brought training ‘in-house’ in 2014 with the aim of improving training and rectifying latent gaps in personnel knowledge. These reforms had not been fully implemented at the time of this derailment.

Track standards

The network standards for the management of creep and track lateral stability of the Victorian regional network comprised the minimum amount of information required by maintenance personnel to undertake their role. The standards were limited in the information included to support an understanding of creep, and the standard for assessing rail joint gaps did not include information on the expected gaps over a range of rail temperatures.

V/Line had recognised the limitations of these network standards and had initiated a review.

Rail adjustment and resetting of creep in 2009

At the conclusion of the Mildura Rail Freight Corridor Upgrade Project in 2009, the rails to the north of the William Street crossing already had a degree of bunching. The mean temperature at which the joint gaps closed was at the lower end of the acceptable range and near the crossing bunching was more severe.

By resetting the creep to zero at this point in time without any rail adjustment, the record of residual southward creep towards the William Street level crossing was lost.

__________

9. For the 510 km measurments, the distance to the level crossing (509.492) is 508 m, resulting in a correction to creep readings of 1000/508 (about a factor of 2).
10. Creep was reset to zero in 2009 at the completion of major rail works.
11. Estimations are approximate and are subject to a number of variables.
12. RO-2014-003 (Emu) and RO-2015-022 (Nunga).

Findings

From the evidence available, the following findings are made with respect to the derailment of train 9156 at Ouyen on 29 December 2015.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Rail creep over a prolonged period resulted in the bunching of rail on the north side of the William Street level crossing. This rendered the rails vulnerable to lateral instability in hot weather and a lateral misalignment developed during the passage of train 9156.

Safety issues previously identified^[13] and contributory safety factors in this occurrence are:

• Asset management systems that were used to identify problematic levels of rail creep did not evaluate nor assess cumulative creep. [Safety Issue]
• Asset management systems used to identify problematic levels of rail creep did not correct for fixed points between creep monuments. [Safety Issue]
• There was no supplementary system of inspection that was effective in identifying rail creep in jointed track. The network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep. [Safety Issue]

Other factors that increased risk

• Across the network there were gaps in the knowledge of track maintenance personnel that were probably the result of deficiencies in training and development. In addition, network standards for the assessment of track lateral stability, including creep management, provided limited information and tools for maintenance personnel. [Safety Issue]
• The movement of rail between the 510 km creep monument and the William Street level crossing was uneven and the bunching was more severe near the crossing. The creep measurements at the 510 km mark did not fully reflect this localised rail bunching.

Other findings

• A reduced rail neutral temperature probably existed when the rail creep values were reset in 2009.

__________

13. ATSB investigation RO-2015-022 (Nunga).

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

In this instance, several safety issues and safety actions are in common with ATSB investigation RO-2015-022 into the Nunga derailment that occurred shortly before the Ouyen derailment. The combination of both incidents triggered safety action by V/Line.

Rail creep

Safety issue number: RO-2015-029-SI-01

Safety issue description: Asset management systems that were used to identify problematic levels of rail creep did not evaluate nor assess cumulative creep.

Correcting rail creep for fixed points

Safety issue number: RO-2015-029-SI-02

Safety issue description: Asset management systems used to identify problematic levels of rail creep did not correct for fixed points between creep monuments.

Other track inspections

Safety issue number: RO-2015-029-SI-03

Safety issue description: There was no supplementary system of inspection that was effective in identifying rail creep in jointed track. The network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep.

Track maintenance personnel training and development

Safety issue number: RO-2015-029-SI-04

Safety issue description: There was an identified gap in the knowledge of track maintenance personnel that was probably the result of deficiencies in training and development. In addition, network standards for the assessment of track lateral stability, including creep management, provided limited information and tools for maintenance personnel.

Sources and submissions

Sources of information

• V/Line Pty Ltd
• Pacific National Pty Ltd
• Interface Rail Engineering (regarding the Mildura Rail Corridor Freight Upgrade Project)

References

V/Line Standards, Procedures, and Work Instructions

Mildura Rail Corridor Freight Upgrade Project Scope of Works and Project Data

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to V/Line, Pacific National, the Office of the National Rail Safety Regulator and Interface Rail Engineering (extract only provided regarding the Mildura Rail Corridor Freight Upgrade Project).

Submissions were received from V/Line, the Office of the National Rail Safety Regulator and Interface Rail Engineering. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 24 December 2015, the pilot of a Glasair Sportsman GS-2, registered N666GM, was conducting a private flight from Southport, Queensland, to Moruya, New South Wales (NSW). The pilot was the only person on board.

The pilot landed at Mudgee, NSW, to add fuel, before continuing to Moruya. While en route between Mudgee and Moruya, the aircraft collided with a large bird, believed to be a wedge-tailed eagle. At the time of the birdstrike, the aircraft was cruising at about 5,500 ft above mean sea level,^[1] over mountainous terrain, and below a solid layer of cloud. The autopilot was engaged, but not in a mode that would hold a set altitude. The airspeed was about 140 kt.

The bird broke through the windscreen on the left side of the aircraft and struck the pilot. The collision left the pilot with serious facial injuries and they were temporarily unable to see (due to the effects of the impact). The pilot had been wearing a headset and spectacles, which were both dislodged and damaged during the collision.

Following the birdstrike, the aircraft entered an uncommanded and rapid descent. The extreme wind-rush and noise, combined with the effects of their serious injuries, meant that the pilot was not immediately aware that the aircraft was descending.

Despite the extreme circumstances, the pilot recovered sufficiently to manually override the autopilot and control the aircraft sufficiently to prevent a collision with terrain. Although the pilot continued to have difficulty seeing, they were able to apply full power and establish the aircraft in a climb. Following recovery from the initial urgency of the situation, the pilot was able to settle the aircraft in level flight, clear of the surrounding terrain.

The pilot elected to leave the autopilot engaged to assist with aircraft control, because the circumstances made it extremely difficult to continuously monitor airspeed and the flight path of the aircraft. With the autopilot still engaged, the pilot made overriding manual corrections to the flight path as required.

The pilot was able to locate the microphone of the headset by following the headset cord (by hand). The headset itself was substantially damaged and the pilot could only locate the microphone and one broken ear-cup. The pilot transmitted a MAYDAY^[2] call using the damaged headset, hopeful that the microphone was functional despite the apparent damage. Air traffic control (ATC) received the MAYDAY call at about 1300 Eastern Daylight-saving Time (EDT) (see later section titled Air traffic control aspects).

Under the circumstances, the pilot was unable to ascertain an accurate position, so just referenced Mudgee and Moruya in the MAYDAY call. Damage to the headset prevented the pilot receiving transmissions, so they were unable to hear any acknowledgement of the MAYDAY call, and consequently were unsure if the transmission was successful. In addition to the MAYDAY call, the pilot attempted to communicate with an associate via a text message, in the hope that their associate may be able to alert relevant authorities.

The pilot succeeded in navigating the aircraft away from the more mountainous terrain. The aircraft was still tracking towards Moruya, but because Moruya was over an hour away, and with high terrain en route, the pilot began considering diversion options. By referencing an iPad mounted in the cockpit, the pilot was able to identify a built-up area, and track towards that area in anticipation of being able to locate an aerodrome. The pilot sent another text message to their associate with updated information, and made another MAYDAY call. Although uncertain at the time, the pilot believed that the built up area was the city of Bathurst, and was broadly aware of the location of Bathurst Airport relative to the city.

The pilot had been flying with the autopilot engaged, holding a high nose attitude, at relatively low airspeed (with the engine at full power) to try to reduce the wind rush and noise. The pilot had also selected half flap, to provide some margin over the aerodynamic stall^[3] speed. Although concerned about aircraft controllability and the effect of their injuries, the pilot disconnected the autopilot in order to navigate the aircraft towards the anticipated location of the airport. While handling the aircraft carefully, mindful that the birdstrike may have damaged the wings and/or tail section of the aircraft, the pilot was able to locate and overfly Bathurst Airport.

Although unable to see the windsock, the pilot decided that runway 35 was the preferred runway under the circumstances. The pilot made another emergency (MAYDAY) call and positioned the aircraft for a landing via a wide circuit. Despite continuing problems with the wind-rush and noise, and the effect their injuries, the pilot concentrated on maintaining a safe airspeed during the approach, and landed successfully.

After landing, the Airport Safety Officer met the aircraft and provided the pilot with parking instructions. The pilot shut the aircraft down and medical services were called. Aside from the damage to the windscreen (Figure 1) and some relatively minor marks around the propeller, there appeared to be no other damage to the aircraft. The remains of the bird were retrieved from the cockpit (Figure 2).

Figure 1: Damage to the aircraft windscreen

Source: Bathurst Airport Staff

Figure 2: Some of the bird remains retrieved from the cockpit

Source: Pilot

Pilot comments – use of the autopilot

At the time of the birdstrike, the autopilot was set to hold the heading selected by the pilot, and neutral/zero vertical speed (level flight). This was in anticipation of entering a climb and manoeuvring when a suitable gap appeared in the overlying cloud cover. In this mode, however, the autopilot allowed the aircraft to descend rapidly following the birdstrike. The pilot believed that had the autopilot been set to hold a specific altitude, the aircraft may have maintained that altitude rather than entering an uncommanded descent. Under the circumstances, given the extent to which the pilot was incapacitated (particularly immediately following the birdstrike), altitude hold mode may have been preferable.

Additionally, the pilot believed that continuing to use the autopilot following the birdstrike was a good strategy, given the effect of their injuries and their inability to see clearly. While use of the autopilot reduced the likelihood of a loss of control, the pilot was still able to manually override the autopilot to adjust the flight path of the aircraft as required.

Air traffic control aspects

The pilot’s initial MAYDAY call indicated that the aircraft had been involved in a birdstrike and that the pilot was unable to see. The call also included reference to aircraft control difficulties and mentioned Mudgee and Bathurst. ATC acknowledged the call and initiated a Distress Phase.^[4] ATC requested the callsign and location of the aircraft, which were not included or not clear from the MAYDAY call, but there was no response from the pilot. ATC attempted to establish contact with the incident pilot through the pilot of another aircraft who also heard the MAYDAY call, but those attempts were also unsuccessful. ATC also asked the pilots of other aircraft in the area to maintain a listening watch on relevant frequencies.

The pilot of the incident aircraft transmitted another MAYDAY call about a minute after the initial call, indicating that the aircraft was over hills and the windscreen was broken. The pilot added that they had no headset, and repeated that they were unable to see. No further calls or details were received by ATC from the pilot.^[5]

Among other activities in response to the situation, ATC contacted the Airport Safety Officer at Bathurst Airport to see if they were aware of any aircraft that was missing or experiencing difficulty. At that point, the Airport Safety Officer was unaware of the situation, and unable to provide any information.

At about 1330, the Airport Safety Officer at Bathurst airport contacted ATC to advise that an aircraft with a broken windscreen was in the process of landing. Several minutes later, they called ATC again, this time to inform them that the aircraft had landed at Bathurst. The Airport Safety Officer was able to provide more relevant information, following which ATC cancelled the DISTRESFA.

ATSB comment

In 2014, the ATSB published a research report (AR-2014-075) titled Australian aviation wildlife strike statistics.The report provides some insights into the nature and characteristics of birdstrikes, and comments that a birdstrike involving a general aviation aircraft is more likely to cause aircraft damage than a birdstrike involving an air transport category or military aircraft.

The August 2010 edition of the Flight Safety Foundation magazine, AeroSafety World, includes an article titled Bird Strike Mitigation Beyond the Airport. The article includes some comments relevant to this occurrence, including:

While general aviation airplanes typically do not have the same engine ingestion concern as transport category jets, their overall design and certification make them much less able to resist damage from bird strikes. Mid-size to large birds can penetrate the windshields and can cause pilot incapacitation or disorientation, resulting in loss of control. The drag caused by the loss of the windshield has also resulted in accidents because enough thrust is not always available to overcome the huge drag increase. Likewise, collision-caused deformation of wing or tail surfaces can increase stall speed considerably and affect handling qualities, especially at slower speeds.

If birds are encountered en route, on climb or descent, the flight crew should pull up — consistent with good piloting technique — to pass over the birds. If birds see the aircraft, they will treat it as an obstacle, but may misjudge the closing speed because the threat is usually beyond their experience.

Birds may turn or dive as avoidance maneuvers, but they rarely climb. So pulling up is the best and fastest avoidance maneuver.

Safety message

Birdstrikes continue to present a serious hazard to aviation, and can cause substantial damage. Such damage has the potential to significantly adversely affect the performance and handling qualities of an aircraft. In this case, despite the damage to the aircraft and their injuries, the pilot effectively managed an extremely challenging situation, resulting in a positive outcome.

This accident highlights to pilots the importance of regular position updates with respect to in-flight diversion options. An ongoing awareness of diversion options may assist pilots in dealing effectively with a stressful and challenging in-flight emergency, particularly where time is critical.

When declaring an emergency, pilots are encouraged to relay as much relevant information as reasonably possible. Although in this event, the damage to the aircraft and injuries to the pilot made all communications very difficult, positional information and information with respect to the intentions of the pilot may be critical to an effective response by emergency services.

Aviation Short Investigations Bulletin - Issue 49

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The aircraft was over mountainous terrain at the time of the birdstrike, suggesting that the height above ground level was substantially less than 5,500 ft.
2. MAYDAY is an internationally recognised radio call for urgent assistance.
3. Aerodynamic stall is a term used when the wing is no longer producing enough lift to support the weight of the aircraft.
4. A Distress Phase (DISTRESFA) is an emergency phase declared by ATC when there is reasonable certainty that the aircraft and its occupants are threatened by grave and imminent danger and require immediate assistance.
5. The pilot remembered making more emergency calls than the two initial MAYDAY calls, but ATC did not receive the later calls.

Safety summary

What happened

On 30 October 2015, following the completion of planned track maintenance work undertaken by the Australian Rail Track Corporation, a safe working irregularity occurred on the rail corridor between Allandale and Farley in the Hunter Valley region of NSW.

While exiting the rail corridor, a road vehicle involved in the maintenance work became bogged in a drain. The vehicle was located outside the danger zone, and therefore there was no requirement to employ a work on track method to retrieve the vehicle. Nevertheless, the protection officer in charge of the worksite made a safety assessment to exclude rail traffic from the portion of track to ensure the presence of workers in the rail corridor did not alarm a driver of an approaching train.

The protection officer contacted the network controller and requested controlled signal blocking. During this conversation and a subsequent conversation, the parties did not confirm their common understanding about the location of the worksite. Consequently, when controlled signal blocking was put into effect, a train had already passed the signal and was travelling toward the worksite.

Workers on the site assumed the track was protected and were preparing to remove the vehicle when they noticed an approaching train.

There were no injuries to people or damage to property.

What the ATSB found

The Australian Transport Safety Bureau found that communication between the protection officer and network controller resulted in the misunderstanding of information that contributed to a safe working irregularity where controlled signal blocking was issued with a train (HV130) located between the protecting signal and the worksite.

The rule and procedure associated with the issuing of controlled signal blocking did not manage the sequential communication of sufficient information to identify the worksite location before controlled signal blocking was acted upon.

There is also no requirement in the rule or procedure applicable to controlled signal blocking to keep a permanent record detailing the specific information relating to its implementation, therefore increasing the likelihood of error during the read-back process.

What's been done as a result

The Australian Rail Track Corporation has undertaken a review of ANWT 308 controlled signal blocking and will be seeking to amend and retitle ANWT 308 controlled signal blocking to ANWT 308 absolute signal blocking. The revised rule will include the requirement for the network control officer and protection officer to keep a permanent record about the Absolute Signal Blocking details. Including when the protection officer requests absolute signal blocking, the network control officer is informed of the location of the worksite and that the protection officer must identify the signals to be set and kept at stop with blocking facilities applied.

Safety message

It is vital that individuals planning work in the rail corridor ensure the communication of sufficient information to validate the worksite location in relation to approaching train movements.

The occurrence

What happened

On 30 October 2015, the Australian Rail Track Corporation (ARTC) scheduled track maintenance work (placement of ballast) to occur between Braxton and Farley on the Up main north line, Hunter Valley in NSW. To facilitate the work, the network controller^[1] at the ARTC network control centre north (NCCN) situated at Broadmeadow issued the protection officer^[2] a work on track authority.^[3] The authority excluded rail traffic from the defined track section between Allandale and Farley, permitting safe access for the work to proceed (Figure 1).

Figure 1: Location of the Allandale to Farley track section

Source: Base map Australasian Railways Association, annotated by the ATSB

At about 0856, the track work was completed and the protection officer contacted the network controller to fulfil the work on track authority and return the track for rail traffic.

While travelling on the access road within the rail corridor, a maintenance vehicle became bogged in a drain. The vehicle was situated approximately five metres from the nearest rail of the Up Relief line.

The protection officer contacted the network controller to report the situation and requested permission to work within the rail corridor to retrieve the vehicle. The network controller authorised the work to commence, but only outside of the danger zone.^[4] After initial attempts to recover the vehicle failed, they decided that a front-end loader was required to free the vehicle.

Although the recovery of the vehicle would not infringe on the danger zone, the protection officer was concerned that approaching train drivers may become alarmed when sighting the front-end loader and workers close to the running line. With this in mind, the protection officer decided to utilise controlled signal blocking^[5] (CSB) to exclude rail traffic from the Up Relief line adjacent to the proposed worksite.

At about 1022, the protection officer contacted the network controller to obtain a CSB and nominated signal AE88UR as the controlled signal.^[6] The protection officer also mentioned that a train was currently passing their location. The network controller referred to the Phoenix train display monitor at their workstation to establish train activity in the area, and noted that train HV130 was approaching signal AE88UR.

At that point in time, the protection officer had not yet informed the network controller of their location, which was at the 198.260 km mark about 6.6 km ahead of signal AE88UR (Figure 2). Coincidently, a second train (MB916) was in the section near the proposed worksite and bogged vehicle (Figure 2).

In an attempt to identify the train adjacent the worksite, the network controller asked the protection officer if they had obtained the locomotive number of the train that had just passed them. Unable to provide this, the network controller advised the protection officer to call back in five minutes. The intent was to allow time for the train to move clear of the protection officer’s location.

Figure 2: Extract of Phoenix replay showing indications displayed to the network controller at 1022 on 30 October 2015

Figure depicts the location of trains MB916 and HV130 travelling on the UP Relief Line when the protection officer requested controlled signal blocking from the network controller. Train MR981 on the Down Main (upper line shown in the screenshot) had no relevance to this occurrence. Source: Australian Rail Track Corporation

At about 1026, the protection officer again contacted the network controller to request CSB on signal AE88UR. During the discussion, the network controller requested the kilometre location of the proposed worksite. Initially, the protection officer could not provide this information, but after consulting with other workers in the group, confirmed that the worksite was located at the 198.260 km mark.

The network controller also informed the protection officer that a train was in the section (ahead of signal AE88UR) and it had gone past signal UR200.6. The network controller asked if the train was well clear of the worksite, to which the protection officer responded ‘yes’. However, the protection officer was referring to a train (MB916) that had recently cleared the proposed worksite, while the network controller was referring to a train (HV130) that was still approaching the worksite location (Figure 3).

Figure 3: Extract of Phoenix replay showing indications displayed to the network controller at 10:28 am on the 30 October 2015

Figure depicting the location of train HV130 as it approached the worksite at the 198.260 kilometre mark. At this time, the network controller had issued the protection officer with Controlled Signal Blocking. Source: Australian Rail Track Corporation.

Prior to finalising the CSB, the network controller requested the protection officer to repeat back the details relating to the CSB. While repeating back information, the protection officer stated that UR200.6 (signal ID) had passed the worksite, instead of the train number. The network controller corrected the protection officer, advising it was ‘Hunter Valley 130’ that had passed signal UR200.6 and the train was now approaching signal UR198.8.

During the subsequent conversation, the network controller mentioned that when the protection officer initially requested the CSB, train HV130 was passing signal AE88UR. The conversation finished with the network controller confirming that signal AE88UR was in the stop position with blocking facilities applied to prevent the signal from clearing. The network controller informed the protection officer that they were ‘…right to proceed there on your CSB at AE88UR…’

At about 1031, approximately 1 minute and 15 seconds after issuing CSB, train HV130 passed unexpectedly through the worksite location. There was no injury to people or damage to property.

__________

1. A Qualified Worker who authorises, and may issue, occupancies and Proceed Authorities, and who manages train paths to ensure safe and efficient transit of rail traffic in the ARTC Network.
2. The Qualified Worker responsible for protection.
3. An authority in the form of a Local Possession Authority, Track Occupancy Authority or Track Work Authority to perform work on track
4. Everywhere within 3m horizontally from the nearest rail and any distance above or below this 3m, unless a safe place exists or has been created.
5. A method used by Qualified Workers to carry out work on track using controlled signals set and kept at STOP.
6. A signal that is, or may be, controlled or operated by a Signaller or a Qualified Worker.

Safety analysis

Communication

It was evident that a misunderstanding occurred between the protection officer and network controller, relating to the relative location of the worksite and the trains in the vicinity.

Based on the recorded communication exchange and the available visual cues from the train display monitor, the network controller likely formed an understanding that the protection officer was located at or near to signal AE88UR. This was the result of a number of factors:

• The communication began by discussing the requirements for CSB at signal AE88UR.
• The conversation coincided with both a train passing the worksite (MB916) and a train passing signal AE88UR (HV130).
• When asked, the protection officer could not provide the locomotive number of the train that had passed the worksite therefore the train identity was not verified.
• The protection officer, at that time, had not communicated the location of the worksite by providing the km mark or any other location reference.

During the second conversation (5 minutes after the initial request), the network controller had preconceived the protection officer’s location in the field, based on their previous information exchange. However, the protection officer and the network controller missed a number of cues in respect to the movement of train HV130 relative to various signal locations, which may have resolved the misunderstanding and identified that train HV130 was approaching the worksite. This was likely the result of confirmation bias^[7], which is a phenomenon were humans seek to confirm assumptions rather than disconfirm them. As a result, it is likely that the protection officer and network controller perceived only the information that confirmed their individual assumption and not the contradicting information.

Phoenix train display system

The network control centre north at Broadmeadow used the Phoenix train display system to provide real time train monitoring through a graphical display. The system also allowed the network controller to interact directly with the rail network in controlling signals, points and other signalling equipment. The Phoenix system displays location names, signal numbers, point numbers, and train numbers. However, it does not display kilometre marks along the track segments of the network.

It was the normal practice for operational staff to communicate their location on the rail network to the network controller by providing a kilometre mark. The ARTC Glossary defined ‘location’ as: ‘A place in the ARTC network with a designated name, identification number or kilometreage’.

On the day of the occurrence, during the later stages of the communication exchange, the protection officer provided the network controller with a kilometre mark to indicate the location of the worksite. In the absence of kilometreage detail on the train display monitor, the potential for misunderstanding between the protection officer and network controller increased. While other ancillary systems/documents may have existed to help correspond kilometreage and display references, these were not readily available to the network controller at the time as they were being utilised by another user.

ARTC Network Rules and Procedures

The ARTC had a documented suite of rules and procedures relevant to protecting personnel undertaking work on the ARTC rail network. If work was to be performed in the danger zone, one of the following five methods for working safely on track were to be applied – Local Possession Authority, Track Occupancy Authority, Track Work Authority, Controlled Signal Blocking or Lookout Working.

On the day of the safe working irregularity, the protection officer identified that the work for recovery of the vehicle would not intrude on the danger zone. Therefore, there was no requirement to employ a work on track method to retrieve the vehicle. Nevertheless, the protection officer decided to exclude rail traffic from the portion of track to ensure the presence of workers in the rail corridor did not alarm a driver of an approaching train. The method of protection chosen for excluding rail traffic from the worksite was suitable in this instance.

ARTC rules and procedures for Controlled Signal Blocking

ARTC rule ANWT 308 – Controlled Signal Blocking and procedure ANPR 703 – Working Using Controlled Signal Blocking prescribed the requirements for applying CSB on the ARTC network. In principle, the rule and procedure provided instruction and guidance to operational staff on how to implement the CSB method of protection when working in the danger zone.

Rule ANWT 308 stated that a protection officer may request CSB and that they must seek confirmation that the relevant signals have been set at STOP, blocking facilities applied, and that no rail traffic is approaching the worksite. The rule provided no requirement to communicate the location of the worksite. Procedure ANPR 703 stated that a protection officer must communicate the location of the work, but provided no guidance on a method to clearly define and identify the location.

On this occasion, the protection officer communicated the location of the work as required by the procedure. However, a misunderstanding occurred between the protection officer and the network controller since the method used to identify location (km mark) when requesting CSB did not provide a common reference for both parties.

Rail industry safety and standards

The Rail Industry Safety and Standards Board (RISSB) was responsible for the development and management of rail industry standards, rules, codes of practice and guidelines, all of which had national application.

One of their objectives was to develop, manage and promote a suite of standards, rules, guidance materials and other documents, including the ACOP^[8] and ANRP^[9], to assist the rail industry to manage rail safety, improve efficiency and achieve safety outcomes through standardisation, interoperability and harmonisation. Many rail operators draw down on the RISSB documentation for developing their network specific rules and procedures. Controlled signal blocking is a common method of worksite protection used by the rail industry throughout Australia. The ATSB examined the RISSB ANRP to identify the potential for similar inconsistencies between the rule and procedure.

The RISSB rule and procedure equivalent to the ARTC rule and procedure were ANRP 3011 –Absolute Signal Blocking (ASB) and ANRP 3012 – Using Absolute Signal Blocking.

Although the objectives for both sets of rules and procedures were similar, a number of requirements in the RISSB documents did not have corresponding requirements in the ARTC documents. The tables below illustrate the variances (highlighted in bold) between the respective sets of rules (Table 1) and procedures (Table 2).

Table 1: Comparison of prescribed actions between the RISSB and ARTC rules

Table 2: Comparison of prescribed actions between the RISSB and ARTC procedures

The rules prescribed the actions required for implementing an ASB/CSB. The procedures described the methodology and sequencing of these actions to ensure the effective implementation of the rules.

While the ARTC rule did not specifically state that the protection officer communicate the worksite location, the ARTC procedure did. However, a key difference between the ARTC and the RISSB procedure was the RISSB’s inclusion of options for additional identifiers^[10] for describing a location. The provision of such identifiers may provide a location reference common to both parties and assist the network controllers with identifying a worksite location with respect to the protecting signals and any approaching rail traffic.

The combination of identifiers communicated by a protection officer should be consistent with the information readily available to the network controller.

The ARTC rule also varied from the RISSB rule in that the ARTC does not specifically require a permanent record with the implementation of CSB. In the rail industry, it is common to produce permanent records on appropriately formatted documents for the safe working arrangement. The document not only provides a permanent record, but also acts as a checklist to standardise the communication steps required in the process, ensuring that important details are not overlooked.

On the day of the occurrence, the network controller requested that the protection officer repeat back the details relating to the CSB. The absence of a permanent (written) record made it more difficult to verify CSB details through a read-back process, increasing the likelihood of errors as occurred in this case.

__________

7. Confirmation bias (or confirmatory bias) is a tendency to search for or interpret information in a way that confirms one's preconceptions.
8. Australian Code of Practice
9. Australian Network Rules and Procedures
10. Permanent structures in or near the rail corridor, which are identifiable by the NC. Example – points, signals, platforms, level crossings, overpasses…

Findings

From the evidence available, the following findings are made with respect to the safe working irregularity that occurred between Allandale and Farley, NSW on 30 October 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

A misunderstanding of information relayed during spoken communications occurred when identifying the location of the proposed worksite with respect to rail traffic.

Other factors that increased risk

The Australian Rail Track Corporation rule and procedure for Controlled Signal Blocking did not ensure the sequential communication of sufficient information to identify the worksite location before the CSB was acted upon. The Controlled Signal Blocking rule and procedure did not specify a location referencing method that was common and verifiable to both the protection officer and the network controller.

The Australian Rail Track Corporation rule and procedure for the implementation of Controlled Signal Blocking did not specify a requirement to keep a permanent record about the details. The absence of a permanent (written) record made it more difficult to verify details through a read-back process, increasing the likelihood of errors.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Safety action taken by the Australian Rail Track Corporation

The Australian Rail Track Corporation has undertaken a review of ANWT 308 Controlled Signal Blocking and will be seeking to amend and retitle ANWT 308 Controlled Signal Blocking to ANWT 308 Absolute Signal Blocking. The revised rule will include the requirement for the network control officer and protection officer to keep a permanent record about the Absolute Signal Blocking details. Including when the protection officer requests Absolute Signal Blocking, the network control officer is informed of the location of the worksite and that the protection officer must identify the signals to be set and kept at stop with blocking facilities applied.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• Rail Industry Safety and Standards Board

References

• Australian Rail Track Corporation Procedure – ANPR 721 Spoken and Written Communication (NSW) Issue/Revision 2.0, 11 October 2015
• Australian Rail Track Corporation Procedure – ANPR 703 Working Using Controlled Signal Blocking (NSW) Issue/Revision 2.0, 11 October 2015
• Australian Rail Track Corporation Rule – ANWT 308 Controlled Signal Blocking (NSW) Issue/Revision 2.0, 11 October 2015
• Australian Rail Track Corporation Rule – ANWT 300 Planned Working in the Rail Corridor(NSW) Issue/Revision 3.0, 11 October 2015
• Australian Rail Track Corporation Rule – ANGE 204 Network Communication (NSW) Issue/Revision 2.0, 11 October 2015
• RISSB Australian Network Rules and Procedures 3011 – Absolute Signal Blocking, Version 1.5 | 19 June 2015
• RISSB Australian Network Rules and Procedures 3012 – Using Absolute Signal Blocking, Version 1.5 | 19 June 2015

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to:

• Australian Rail Track Corporation
• protection officer
• network controller
• Office of the National Rail Safety Regulator

Submissions were received from the Australian Rail Track Corporation, the Office of the National Rail Safety Regulator and the network controller. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 18 October 2015, a commercial fishing vessel, FV Jubilee sank in coastal waters in the Canterbury Bight, New Zealand. All three crew members that were on board did not survive the sinking.

The New Zealand Transport Accident Investigation Commission (TAIC) opened an investigation into the accident (TAIC MO-2015-203). As part of their inquiries, TAIC subsequently recovered a portable electronic device that may have contained information to assist the investigation.

On 15 December 2015, TAIC requested support from the ATSB to examine the electronic device and download any information that might be stored on its internal memory. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

The ATSB successfully recovered the contents of the portable electronic device and provided a copy to the NZ TAIC.

TAIC is responsible for, and will administer the release of the final investigation report into this accident. Any enquiries regarding the TAIC investigation should be directed to the:

Deputy Chief Investigator of Accidents
Transport Accident Investigation Commission
Level 16, AXA Center
80 The Terrace
PO Box 10-323, Wellington
New Zealand

Telephone: +64 4 473 3112
Facsimile: +64 4 499 1510
Email: inquiries@taic.org.nz
Web: www.taic.org.nz

Safety summary

What happened

On 15 December 2015, train ND575 – a south bound empty bulk iron ore service operated by Rio Tinto, derailed on the Hamersley Railway east mainline, about 50 km north of Tom Price, Western Australia. As a result of the derailment, there was significant damage to track and rolling stock. There were no injuries.

What the ATSB found

The ATSB concluded that the derailment most likely began with a small horizontal track misalignment on the east mainline, just south of the Mt Brockman Road railway crossing. It was likely that the misalignment grew under train ND575, and eventually became large enough to cause the train to derail. The pathing of a large number of north-bound loaded ore trains on the east mainline probably caused a redistribution of longitudinal rail stresses south of the Mt Brockman railway crossing. This redistribution of rail stresses, coupled with extremely hot weather, and a track irregularity near the point of derailment, meant the track had a reduced capacity to withstand lateral forces, thereby increasing the likelihood of a track buckle event.

What's been done as a result

Rio Tinto have implemented a range of initiatives to reduce the risk of a similar occurrence including changes to operational and maintenance procedures, enhanced strategies for responding to minor track irregularities, and a strategy for balancing tonnage over the line.

Safety message

Early detection, assessment, and effective management of track defects are critical in minimising the risk of derailment and maintaining safe rail operations.

Derailed portion of train ND575, view looking north from ore car 20322

Source: Rio Tinto

The occurrence

On 15 December 2015, train ND575 operated as a routine empty bulk ore service from 7 Mile Yard, Dampier to Tom Price, Western Australia (Figure 1). The train departed 7 Mile Yard at 1004 and travelled on a section of double line, through to Brolga 27 (21.400 km),^[1] then on a section of single line through to Emu Yard (78.500 km). The onward passage from Emu Yard, on the east mainline (double line track) through to Possum Station (227.250 km) was uneventful.

During this time, a series of south bound empty ore trains (YC2155, PD1058, RC1889, BC824, TD1284, YC156 and RD1890), also travelling on the east mainline, passed over the Mt Brockman Road railway crossing (234.335 km) at speeds ranging from 79 km/h to 59 km/h.

Figure 1: Location map – Rio Tinto network

Source: Map data (c) OpenStreetMap (and) contributors, CC-BY-SA

The train departed Possum Station at 1614. At about 1619, after passing over the Mt Brockman Road railway crossing, the train driver reduced train power from notch 8 to notch 3 to maintain a track speed of not more than 80 km/h.

Shortly thereafter, the driver felt a small surge from the train, followed by an automatic emergency brake application. The driver looked back, towards the rear of the train, and saw a large dust cloud. He immediately ‘bailed off’^[2] the independent train brakes to prevent the trailing ore wagons from bunching behind the locomotives during braking. The train slowed down, and came to a stop about 1 km past the Mt Brockman Road railway crossing.

Post occurrence

The driver spoke to train control and advised that the train had come to a stand south of the Mt Brockman Road railway crossing, and some ore cars had probably derailed. After speaking to train control, he detrained and walked the length of the train to inspect for damage.

On completing the inspection, he returned to the cab and communicated with train control, advising that 56-ore cars had derailed (Figure 2). The derailed wagons were located in positions 71 through to 126, and there was about 450 m of track damage.

Figure 2: Derailed portion of train, ore car 35907 and 30907 in foreground near 234.500 km

Source: Rio Tinto, annotation by ATSB

Rio Tinto dispatched operations staff, investigation and recovery crews to site. An authorised person, while on-site, tested the train driver for the presence of drugs and alcohol; the results were negative.

The railway network was re-opened to rail traffic, on a restricted basis, using the west mainline. The east mainline was made operational for rail traffic by 18 December 2015, three days after the derailment.

__________

1. Measured from a zero reference mark at Dampier.
2. ‘Bail off’ is a term used to describe the action of: • preventing the locomotive(s) brake from applying automatically during a train brake application, or • releasing the locomotive(s) independent brakes during a train brake application.

Context

Location

The Hamersley railway is a privately owned rail network in the Pilbara region of Western Australia, built for carrying iron ore. The line shown at Figure 1 connects the port of Dampier at King Bay to a cluster of mine sites located about 250 km to the south, including the Nammuldi mine. The derailment occurred about 38 m south of the Mt Brockman Road railway crossing (Figure 3) on the Hamersley railway east mainline, 50 km north of Tom Price.

Rio Tinto own and manage the Hamersley railway.

Figure 3: Derailment site, near Mt Brockman Road railway crossing showing point of derailment (PoD) and location of derailed wagons.

Source: Rio Tinto, annotation by ATSB

Train and train driver information

Train ND575 was a regular Rio Tinto empty ore service operating from the port of Dampier, travelling south on the east mainline, to the Nammuldi mine. The train comprised three GE Evolution locomotives (HL8180 leading, HL8157 and RL8117 trailing) followed by 112 permanently coupled ‘pooled fleet ore cars’ sets.^[3] Each permanently coupled set of ore cars had an overall length of 18.667 m and tare weight of approximately 42 t. Train ND575 had an overall length of 2,160 m and was hauling a trailing mass of 4,704 t.

Train driver

The driver in control had extensive train driving experience. He had worked for Rio Tinto for about 16 years and had driven trains for about 27 years. He held the required qualifications to drive trains on the Hamersley network, and was route certified for the track where the derailment occurred.

An examination of the driver’s records confirmed that he had been assessed as meeting the medical standards prescribed by the National Standard for Health Assessment of Rail Safety Workers. A review of the driver’s roster by the ATSB determined that fatigue impairment was unlikely to have affected his performance. The driver said he felt well when signing on for duty, and at the time of the derailment.

Train handling

Locomotives HL8180, HL8157 and RL8117 were each equipped with data recorders (loco-logs). The loco-logs capture information such as date/time, speed, brake pipe pressure, throttle position, and distance travelled.

An extract of the data from the lead locomotive (HL8180) was used to derive the graph at Figure 4; from this data, it was found:

• Train ND575 was travelling at 78 km/h (2 km/h below the permitted track speed) as it passed over the Mt Brockman Road railway crossing.
• During the period 1619:35 through to 1619:42, the driver moved the throttle from position T8 to T3 thereby maintaining a train speed below the track speed limit of 80 km/h.
• The speed of train ND575 dropped from 79 km/h (1 km/h below track speed) to 73 km/h as ore cars in the group 71 to 94 (ore cars numbered 25332 to 20353) passed over the point of derailment (PoD).
• At 1620:04, the electronically controlled pneumatic (ECP) brake parameters changed, followed by an emergency brake application.
• At 1620:06, the driver throttles off from T3 through to Idle, and bails off.
• At 1620:08, there is evidence of an initial reduction in brake pipe pressure (BPP).
• At 1620:11, there is a major BPP reduction.
• Train slowed down, coming to a stand at 1620:23, about 1 km past the PoD.

Figure 4: Graph derived from loco-log data, lead locomotive THL8180

Source: Rio Tinto, graphed by ATSB

A review of loco-log data corroborated the driver’s recollection of the final moments of the event, and showed that train handling, and driver performance was unlikely to have been factors that contributed to the derailment.

Rolling stock – pooled fleet ore cars

Train ND575 was hauling 112 pooled fleet ore car pairs. Two of the ore cars, 30907 and 30910 (position 102 and 154 respectively), were instrumented ore cars (IOCs). Data from the IOC at position 102 (30907) was corrupt after 1620:10. This probably coincided with the time the ore car incurred catastrophic damage during the derailment sequence. The second instrumented ore car (30910) did not pass over the PoD, and continued to supply data throughout and after the derailment event.

An examination of the non-corrupted data from IOC 30907 indicated a significant change in coupler forces at about the time ore car set 25335/20335 (position 81/82 - Figure 5) traversed the PoD. Based on the IOC data, and subsequent examination of damage to ore cars and the track, it was resolved that this probably coincided with the derailment event, and that ore car set 25335/20335 derailed first. Although ore car set 25332/20332 (position 71/72) was also in a derailed state, it was probably dragged off the track by ore car set 25335/20335 through to 25321/20321 (position 73/74).

Figure 5: Looking north - derailed ore car 25332/20332 (foreground) and ore car 25355/20335 (background)

Source: Rio Tinto, annotation by ATSB

An onsite inspection of derailed ore cars found no evidence of component deterioration or damage that may have initiated the derailment. All ore cars were considered fit for purpose, and in compliance with Rio Tinto maintenance standards. A post-derailment review of Rio Tinto records established that all derailed ore cars were serviced in accordance with Rio Tinto’s engineering requirements, and that there were no outstanding maintenance issues.

An examination of data from trackside monitoring systems (RailBAM^[4] and WID^[5]) did not uncover any evidence of wagon overloading or wheel defects that may have contributed to the derailment.

Based on available evidence the ATSB considered unlikely that rolling-stock condition was a factor that contributed to the derailment.

Track information

The track from the port of Dampier to Tom Price comprised a combination of single line with crossing loops, and double line (east/west mainline) with crossovers. Rail traffic operated bi-directionally on the mainlines, a strategy used by Rio Tinto for balancing rail wear, and minimising stress build up in the rails.

The derailment occurred on the east mainline just south of Possum Station (227.25 km), about 50 km north of Tom Price. The track leading into the derailment site (travelling from north to south) was straight (tangent track) and on a slight upgrade followed by a slight downgrade towards the point of derailment (Figure 6). The track comprised standard gauge (1,435 mm), 68 kg/m continuously welded rail (CWR) mounted on concrete sleepers at 650 mm centres. The sleepers had resilient fasteners (Pandrol Clips) on a nominal 200 mm layer of ballast below the sleepers.

At the time of derailment, axle loads were limited to a maximum of 36 t. The speed limit for trains was 80 km/h. There were no further speed restrictions in place, approaching the derailment site.

Figure 6: Design track elevation – 230 km to 242 km, showing point of derailment and direction of train travel

Source: Rio Tinto, annotation by ATSB

Examination of the track

The post derailment examination of evidence established that there were no apparent signs of track spread at or before the PoD, so gauge widening was discounted. Similarly, there were no signs of any broken/fractured rail immediately at or before the PoD. The track near the PoD (Figure 7) showed evidence of a significant horizontal displacement of the track to the right, in the direction of train travel, and was indicative of a track misalignment/buckling event. The railhead^[6] at 234.373 km (Figure 7 – right image) showed evidence of wheel flange climb^[7] on the right side running rail (direction of travel) followed by witness marks (about 4 – 5 m in length) consistent with a wheel flange crossing the railhead.

Figure 7: Witness marks at PoD (234.373 km) shown by line of arrows on railhead

Source: Rio Tinto, annotation by ATSB

Damage to sleepers (Figure 7– right image and Figure 8) was only evident after the point where the wheel(s) dropped off the railhead. Beyond the drop-off point, the wheels and bogies of derailed ore cars advancing along the track progressively damaged the track structure, both within the four foot,^[8] and to the right side of the track (direction of travel).

Figure 8: Ballast condition before PoD indicate profile and quality in accordance with Rio Tinto requirements

Source: Rio Tinto, annotation by ATSB

As initially intact but derailed ore cars continued to move along the track, and bounce over sleepers, bogie wheels caused heavy damage within the four foot. This resulted in ore cars tilting to the left, dropping off their bogies, and eventually ejecting to the left side of the track. This gave rise to the multi-wagon pile-up shown at Figure 2.

Rio Tinto measured the rail profile, post derailment. The ATSB assessed these measurements for compliance against Rio Tinto standards. Side wear was negligible, vertical wear was about 14 mm. Measurements confirmed that the rail profile was within specified limits, and unlikely to be a factor that contributed to the derailment.

The ATSB assessed the ballast and ballast profile for compliance against Rio Tinto standards using photographs and other information provided by Rio Tinto. The amount of ballast (Figure 8) within the cribs,^[9] and the shoulder^[10] width and height was all in accordance with requirements. There was no indication of ballast fouling at or near the derailment site.

While the track leading into the derailment was in good condition, there was evidence of rail creep^[11] (Figure 9 – left image) between the PoD and the Mt Brockman Road railway crossing. The observed rail creep was in a northerly direction, that is, from the PoD towards the Mt Brockman Road railway crossing, which was acting as a fixed point. There was no observed rail creep at and to the north of the crossing (Figure 9 – right image).

Figure 9: Evidence of rail creep through resilient fastener at PoD

Source: Rio Tinto, annotation by ATSB

Track inspection and maintenance standards

Inspections of track visually, and by use of mechanised track geometry vehicles, are two of the main methods for identifying and assessing track defects. Rio Tinto’s Track and Civil Code of Practice, Volume 5 – Track Geometry (GN-R105) defined the criteria for assessing and recording the condition of track, and determining mandatory remedial maintenance actions. The standard identified two inspection routines: unscheduled and scheduled inspections.

Unscheduled

Unscheduled inspections were generally in response to defined events, such as extreme weather conditions known to increase the risk of geometry defects. Unscheduled inspections could also be triggered by third-party intervention, such as a train driver’s report of a rough riding track.

There were no train driver reports, regarding rough track/track quality near the PoD that resulted in an unscheduled inspection prior to the derailment.

Scheduled

Rio Tinto uses two main scheduled inspections methodologies for assessing track geometry and identifying defects. These comprise the visual inspections of track and the use of mechanised track geometry vehicles. GN-R105 mandated that inspections be carried out weekly (intervals not exceeding seven days) by track patrol (road/rail vehicle), two monthly by track geometry vehicle inspection, and six monthly by on-train inspections.

A review of maintenance records established that the track near the PoD (234.373 km) was:

• Regularly inspected by track patrol (road/rail vehicle). The last inspection was on 12 December 2015, three days before the derailment. No defects were identified.
• Regularly examined using a track geometry car US6. The last inspection was on 11 December 2015 (Figure 10 – red line), four days before the derailment. While the red line in Figure 10 shows that there was evidence of a growing horizontal track misalignment at the railway crossing, the magnitude of the misalignment was well below the Rio Tinto maintenance intervention limit (Figure 10 – ‘Critical Max’).

Figure 10: Graph showing growth of horizontal track misalignment at PoD from data obtained by track geometry car US6.

Source: Rio Tinto – annotations ATSB

Rio Tinto advised that they do not usually record the date of on-train inspections, and therefore, could not advise if the last on-train inspection was done within the six-month period leading up to the derailment. However, Rio Tinto had an established process for monitoring track condition through a range of parameters (longitudinal, vertical and lateral acceleration) that indicated the ride quality of the fleet of IOCs. This data was progressively being optimised, by Monash University (Victoria) for Rio Tinto, to assist with the determination and evaluation of track irregularities. The setting and monitoring of pre-determined IOC track irregularity limits was intended to allow Rio Tinto to instigate site inspections on an as required basis to enable a maintenance response strategy before exceedances are reached.

While examination of data recorded by the IOC fleet in the eight months prior to the derailment showed an increase in IOC suspension travel and bounce (potentially reflecting a degradation in track quality just south of the Mt Brockman Road railway crossing), the magnitude of the bounce was well below pre-determined intervention limits.

Environmental conditions

The closest Bureau of Meteorology weather station to the derailment site was located at Paraburdoo, about 100 km south of Possum Station. On the day of the derailment, the temperature recorded at Paraburdoo at 1500 was 42.3 °C. There was no rainfall recorded in the 24-hour period preceding the derailment. At the time of derailment (about 1620), the weather was fine and very hot, probably in excess of 43 °C. The minimum overnight temperature was 23.1 °C, a temperature differential of 20.7 °C. For the week preceding the derailment, the weather was dry and very hot; most days exceeded 40 °C.

Rio Tinto also measured actual rail temperature at specific sites along the track. The closest measuring station was at 224 km, about 10 km north of the derailment site. At the time of the derailment, rail temperature measured at the 224 km measuring station was 54.4 °C or 14.4 °C above Rio Tinto’s neutral rail temperature^[12] of 40 °C.

Other track misalignment occurrences

The ATSB has investigated eight previous derailments that were attributed to track misalignment/buckle events, namely:

• RO-2014-003 – Derailment of grain train 9130 at Emu, Victoria on 12 Feb 2014
• RO-2013-006 – Derailment of train 3MC1 near Locksley, Victoria on 12 Feb 2013
• RO-2013-002 – Derailment of freight train 3PS6 Yunta, South Australia on 17 Jan 2013
• RO-2010-015 – Derailment of train 1MP5 at Goddards, Western Australia on 28 Dec 2010
• RO-2009-004 – Derailment of freight train 6MB2 at Tottenham, Victoria on 30 Jan 2009
• RO-2008-012 – Derailment of train 3DA2 near Katherine, Northern Territory on 4 Nov 2008
• RO-2006-001 – Derailment of freight train 3AB6 Yerong Creek, New South Wales on 4 Jan 2006
• RO-2005-002 - Derailment of train 6MP4 Koolyanobbing, Western Australia and train 6SP5 Booraan, Western Australia on 30 January 2005 (two different events on the same day).

Although each of these occurrences was unique in its own right, and involved various track owners and rail operators, there are some common factors. These factors should be considered in mitigating the risk of derailment from track misalignment/buckling events. They include:

• The effects of track disturbing works need to be prudently managed, particularly during periods of hot weather.
• Rail de-stressing operations, if incorrectly managed, can result in high longitudinal track forces, increasing the risk of track buckling events.
• Ballast quality and profile is essential for providing resistance against lateral track movement.
• Effective creep monitoring points should be considered (particularly high-risk areas such as curves, and near fixed points, such as railway crossings, turnouts and bridge structures), to assist maintenance staff in determining the potential risk of track misalignment events.
• Organisations should consider appropriate ‘heat speed restriction’ strategies to lower the risk of derailment events arising from track buckling during periods of high ambient temperature.
• Management and quality assurance processes need to be robust to ensure that track work is carried out in accordance with prescribed standards.
• Trains travelling along a track, particularly in one direction, can result in a redistribution of longitudinal rail stresses along the track. A fixed point (level crossings, turnouts, bridge structures, etc.) can further compound the risk of longitudinal rail stress redistribution, resulting in increasing track-buckling risk.

__________

3. Each ‘pooled fleet ore car’ comprised two permanently coupled ore cars, each independently supported on a pair of bogies.
4. RailBAM® is a predictive monitoring system that detects and ranks wheel bearing faults and out-of-shape wheels (wheel flats) by monitoring the noise they make.
5. WIDS is an acronym for wheel impact detection system. The WIDS system is primarily used for detecting wheel flats but can be used for calculating the weight of rolling stock.
6. The upper part of the rail on which the wheels of rolling stock run.
7. A derailment in which a wheel flange will climb to the railhead.
8. The area between the rails of a standard gauge railway.
9. Ballast area between sleepers.
10. The ballasted section outside the sleeper ends.
11. The longitudinal movement of the rails in track caused by expansion or contraction of the rail or the action of traffic.
12. The stress free temperature for rail which is a theoretical temperature at which the rail is neither in tension nor in compression.

Safety analysis

Based on available evidence, the ATSB concluded that the derailment of train ND575 most likely originated at a horizontal track misalignment at 234.373 km on the east mainline, just south of the Mt Brockman Road railway crossing.

Track inspection and maintenance were found to be in accordance with Rio Tinto’s standards. Rolling stock and driver performance (train handling) were discounted as factors that contributed to the derailment.

The subsequent analysis focuses on track performance and operational demand, and track inspection philosophies as key areas of interest.

Track stability

Track integrity is of prime importance in the running of a safe railway, and is reliant on the inter-relationship of many track components, including the sub-base, ballast bed, sleepers, rail and fastening systems. Although continuously welded rail (CWR) provides significant advantages over traditional rail jointing methods (such as fish-plated track), track disturbing activities (for example, trains moving along a section of track, thermal expansion, resurfacing, undercutting and removal of rail defects) can have an effect on track stability, and result in track that is susceptible to buckling (horizontal misalignment).

Track buckling^[13] typically occurs when longitudinal compressive forces, induced by thermal expansion, rail creep and dynamic vehicle loads produce a lateral or vertical load that exceeds the passive restraining forces provided by the track structure. The cause of buckling is normally associated with the following factors:^[14]

• longitudinal rail forces (compressive rail forces)
• dynamic rail forces (vehicle interaction)
• lateral track resistance.

Longitudinal rail forces

Longitudinal rail forces, those along the length of the track, can be considerable and are particularly sensitive to rail temperature. The neutral temperature (Rio Tinto used a temperature of 40 °C) or stress free temperature for rail is a theoretical temperature at which the rail is neither in tension nor in compression. If the rail temperature is greater than the neutral temperature, the rail will be in compression, with an increased likelihood of track buckling. Conversely, if the rail temperature is less than the neutral temperature, the rail will be in tension, with an increased likelihood of the rail breaking.

Longitudinal rail forces are directly proportional to the difference between the rail neutral temperature and actual rail temperature.

The high temperature at the time of derailment meant that the rail was in compression with a greater likelihood of a track-buckling event.

Dynamic rail forces

The long-term effect of trains moving along a section of track can result in rail movement (creep) and an associated redistribution of longitudinal rail stresses. Typically, a train slowing into a fixed point (for example a railway crossing or bridge structure) encourages bunching of the rail in the direction of train movement, thereby increasing the compressive forces within the track.

The Mt Brockman Road railway crossing was a fixed point in the track structure. The point of derailment (PoD) of the south-bound train ND575 was about 38 m south of the crossing on the east mainline.

During the period 19 November through to 13 December 2015, 666 loaded ore trains travelled in a northerly direction on the east mainline, compared to just 16 empty trains travelling in a southerly direction. The predominant traffic tonnage was therefore travelling north towards the Mt Brockman Road railway crossing. These loaded ore trains were also approaching the railway crossing on a slight downhill gradient and in trying to maintain a track speed of 80 km/h were probably braking. Therefore, with trains braking and the predominant traffic tonnage into the crossing, this would cause rail bunching (high compressive forces) on the southern side of the crossing.

On 11 December 2015, four days before the derailment, data from the track geometry car US6 showed evidence of worsening^[15] horizontal track misalignment just south of the Mt Brockman Road railway crossing.

Observations (post derailment) between the PoD and Mt Brockman Road railway crossing clearly showed evidence of rail creep (Figure 9) through the resilient fasteners, and towards the railway crossing. The magnitude of the creep would have resulted in a significant increase in longitudinal compressive rail forces, exposing the track to an increased risk of buckling.

Lateral track resistance

Buckling resistance in the horizontal plane is contingent on the frictional interrelationship between sleepers and the surrounding ballast.^[16] A buckle will develop when the lateral force exerted on the track structure exceeds the track’s ability to resist those forces. If the frictional bond between the sleepers and ballast is reduced, the lateral force required to generate a misalignment is lowered. This may result in a track-buckling event, even in areas that were previously stable.

The track’s ability to resist lateral forces is influenced by:

• sleeper type and weight
• ballast quality
• compaction of ballast between sleepers
• ballast shoulder geometry.

Ballast quality (angularity/sharpness of the ballast stone) is of critical importance in maximising lateral track stability. Where the ballast within the crib, and/or shoulder, is deficient or in poor condition, the track will be more susceptible to misalignment due to a lack of lateral resistance.^[17]

Post derailment, the ballast and ballast profile was examined and found to be in good condition and was unlikely to have been a primary factor contributing to the derailment. However, there was evidence of increasing ore car bounce through this area (recorded by the IOCs in the eight months prior to the derailment). The bouncing of the ore cars would almost certainly cause a degradation of the frictional bonding between the ballast and sleepers, resulting in a reduction in lateral track resistance.

In conclusion, the pathing of a large number of loaded ore trains (travelling to Dampier) on the east mainline probably caused a redistribution of longitudinal rail stresses in a northerly direction towards the Mt Brockman railway crossing. The redistribution of rail stresses, coupled with the hot weather, and a degradation in track quality meant the track had a reduced capacity to withstand lateral forces increasing the likelihood of a track-buckling event.

__________

13. Substantial misalignment contributed to by longitudinal thermal stresses overcoming the lateral or vertical resistance of the track. Glossary of Railway Terminology.
14. Track Buckling Research in CWR from US DOT's Volpe Center. www.volpe.dot.gov/coi/pis/work/archive/buckling.html
15. All measured data was below maintenance response requirements.
16. Track Stability and Buckling - Rail Stress Management - Zayne Kristian Ole.
17. ‘Improved knowledge of CWR track’ - Coenraad Esveld.

Findings

From the evidence available, the following findings are made with respect to the derailment of train ND575, on the east mainline, about 50 km north of Tom Price, Western Australia on 15 December 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The integrity of the east mainline was compromised by a small horizontal track misalignment near 234.373 km. The misalignment probably grew under train ND575, becoming large enough to cause the train derailment.

Other factors that increased risk

• The pathing of a large number of north bound loaded ore trains, on the east mainline, probably caused a redistribution of longitudinal rail stresses south of the Mt Brockman railway crossing.. The redistribution of rail stresses, coupled with the extreme hot weather, and horizontal track misalignment (234.373 km) meant the track had a reduced capacity to withstand lateral forces, thereby increasing the likelihood of a track-buckling event near the point of derailment.
• There was evidence of a growing track misalignment near the point of derailment, however, available management systems were ineffective in alerting maintenance staff to the heightened risk of a track-buckling event.

Other findings

• The track was regularly inspected in accordance with Rio Tinto maintenance requirements.
• Train handling and driver performance were very unlikely to have been factors that contributed to the derailment.
• It is unlikely that the condition of rolling-stock was a factor that contributed to the derailment.

Safety issues and actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety actions in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.

Additional safety action taken by Rio Tinto

Rio Tinto has advised of the following proactive safety actions:

• Update the track geometry condition management process to consider minor irregularities in multiple geometry parameters.
• Utilise the instrumented ore car fleet for identification of sites at risk of rapid failure due to deterioration of minor irregularities in multiple ore car response parameters.
• Develop and implement an improved rail stress management process.
• Implement a tonnage balance strategy and deviation authority process.

Sources and submissions

Sources of information

The sources of information during the investigation – Rio Tinto

References

• RISSB National Guideline – Glossary of Railway Terminology
• Bureau of Meteorology – Weather Observations for Paraburdoo, Western Australia (15 December 2015)
• Rio Tinto: Asset Management Design Criteria – Rail Railway Route Infrastructure Civil & Track (DC-R001)
• Rio Tinto: Asset Management Design Criteria – Rail Railway Route Infrastructure Civil & Track (DC-R001, 30 August 2010)
• Rio Tinto: Incident Findings and Recommendations Report – Empty Train Derailment at 234.373 km MLETP (16 February 2016)
• Rio Tinto: Code of Practice – Track and Civil, Volume 5 Track Geometry (GN-R105, 24 December 2014).

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to:

• Driver of train ND575
• Office of the National Rail Safety Regulator
• Rio Tinto.

Submissions were received from Rio Tinto (incorporating the driver of train ND575) and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 21 December 2015, a Boeing 787-8 aircraft, registered VH-VKE, departed Melbourne, Australia on a scheduled passenger transport service to Singapore. Approximately 4 hours into the flight, just north of Australia, the airspeed indications became erratic. As a result, the autopilot disconnected and the Primary Flight Control reverted to a mode with fewer automated functions and protections. After approximately 17 seconds the airspeed values returned to normal.

Due to the latching nature of the Primary Flight Control mode reversion, the aircraft had to be manually flown for the remainder of the flight and because of this, the crew diverted the aircraft and made an uneventful landing in Darwin, Australia.

What the ATSB found

The ATSB found that the aircraft had entered an area of weather with high ice water content, which caused the pitot-static systems to become affected by ice. The flight control logic detected a resulting drop in airspeed, sufficient to revert to secondary mode.

What has been done as a result

Boeing revised the flight control software to reduce the chances of reverting to secondary mode in a short duration, erratic airspeed event.

In response to a previous, similar event on another B787-8, the FAA published an airworthiness directive warning flight crew not to make large abrupt magnitude flight control inputs in response to unrealistic drops in airspeed.

Boeing also revised the flight control software to limit the rate of elevator feel reduction with drops in airspeed. This will specifically allow the column to stay at a higher feel force to mitigate large and abrupt unintentional pitch inputs.

Safety message

In this case, the crew showed a high level of professionalism in response to a weather-related event. The crew demonstrated high levels of communication and coordination, promptly applied checklists and procedures.

The ATSB brings to the attention of all flight crews, the importance of following documented procedures and directives when encountering weather related events.

The occurrence

On 21 December 2015, a Boeing 787-8 (B787) aircraft, registered VH-VKE, departed Melbourne, Australia on a scheduled passenger transport service to Singapore. The flight, operating as Jetstar Flight 07, departed at 0140 UTC (1240 local time)^[1]. At 0550 UTC, the aircraft was in cruise, being operated at flight level^[2] (FL) 400. The first officer was the pilot flying (PF) and autopilot and autothrottle were engaged.

At the date of this occurrence an airworthiness directive (AD/B787/2013-24-01) relating to reducing the risk of engine icing was in effect, requiring avoidance of ice crystal icing^[3] conditions. As such, weather information with relevant en route icing conditions was used by the operator for the purposes of flight planning. In accordance with the AD, the crew manoeuvred around any observed weather conditions that had potential to cause icing to the engines.

Approaching waypoint CURLY, about 250 NM north of Darwin, Australia, the crew reported that a green coloured^[4] area, with magenta^[5] patches appeared ahead on their weather radar. This area was too close to avoid.

As a precaution the crew activated the seat-belt light. The aircraft entered an area of light turbulence which then increased to moderate. Concurrently with the increase in turbulence the crew noticed erratic airspeed indications on both PFDs, the autopilot disconnected and multiple EICAS^[6] messages were displayed including AIRSPEED UNRELIABLE and FLIGHT CONTROL MODE. The FLIGHT CONTROL MODE annunciation indicated that the aircraft flight control system had reverted to secondary mode^[7].

Shortly after the event, the captain took over the pilot flying role and the crew conducted the AIRSPEED UNRELIABLE checklist. The captain reported that this was a high workload situation and effective communication and coordination with the first officer greatly assisted the procedure.

The crew maintained an airspeed by setting a pitch angle and thrust level, as indicated in the applicable quick reference handbook table. Through comparison with this table, the crew were also able to identify the most accurate airspeed indication. The crew reported that at this stage it appeared that all indications had returned to normal.

The aircraft was 4 hours into an 8-hour journey, latched in secondary mode and could only be flown manually. Based on this, a decision was made to divert to Darwin, Northern Territory.

After jettisoning fuel to reduce the aircraft weight to maximum landing weight, the crew requested a straight-in approach and made an uneventful landing at Darwin airport.

Weather

A detailed meteorological analysis of the time and location of this event was conducted by the aircraft manufacturer’s specialists. The analysis showed that the area in question contained convective weather related to northern Australia’s monsoon season. These environmental conditions were highly conducive to ice crystal icing.

Airspeed indication system description

The B787 aircraft incorporated a pitot-static air-data reference system (ADRS), consisting of three independent pitot-static sensors. The sensed values from all three systems were input to a fault detection system that provided an airspeed value to the primary flight displays. This value was termed the voted airspeed.

The B787 also computed an angle of attack, synthetic airspeed (AOA speed) value that was available to the flight crew. This speed was derived from angle of attack and inertial data. Significant disparities between voted airspeed and AOA speed alerted the crew via AIRSPEED UNRELIABLE and the autopilot disconnecting.

If voted airspeed dropped to a specific threshold level, a reversion to a secondary flight control occurred. In secondary mode, the following functions of the flight control system were no longer available:

• Autopilot
• Auto speedbrakes
• Envelope protection
• Gust suppression
• Pitch compensation
• Roll/yaw asymmetry compensation
• Tail strike protection

Elevator and rudder inputs are also more sensitive at some airspeeds, and yaw damping^[8] is degraded. For the conditions of this event, secondary mode is a latched condition and once activated, normal mode can only be re-instated on the ground.

Flight data

Flight data from the occurrence shows that the voted airspeed value became erratic for approximately 17 seconds. The voted airspeed values deviated significantly below the independent AOA speed calculated by the aircraft flight computer. As indicated in Figure 1, the voted airspeed was NCD for more than 0.1 seconds twice throughout the event.

Figure 1: Graphical representation of flight data

This figure illustrates the discrepancy between the recorded values of voted airspeed and synthetic AOA speed. Within 5 seconds of the diverging values the autopilot and flight computer mode reversion had occurred. The airspeed disagreement lasted for a total of around 17 seconds.

Related occurrences

ATSB occurrence database

A review of the ATSB’s occurrence database between 2006 and 2016 found 11 other occurrences involving high-capacity air transport category aircraft experiencing pitot-static system icing. None of these occurrences involved B787 aircraft.

Overseas occurrences

On 13 March 2014, a B787 operator en route to RJNK (Komatsu Airport) reported a severe turbulence event at FL290 and the Flight Control system reverted to secondary mode. Review of flight data was conducted and showed that, the voted airspeed dropped below 30 knots for 0.25 seconds which caused the system to revert to secondary mode. Four minutes later, the crew (following published procedures) cycled the Primary Flight Computers (PFC) disconnect switch and were able to regain Normal mode for the remainder of the flight. Weather conditions were identified as the likely contributor to the occurrence.

On 12 May 2015, during the cruise phase of flight, a B787 operator experienced a reversion to secondary mode for the remainder of the flight. The aircraft continued to its final destination and the landing was uneventful. Weather conditions were identified as the likely contributor to the occurrence.

__________

1. Coordinated Universal Time (UTC): the time zone, equivalent to GMT, used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC.
2. Flight level: at altitudes above 10,000 ft. in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 370 equates to 37,000 ft.
3. At temperatures below freezing near convective weather, the aircraft can encounter visible moisture made up of high concentrations of small ice crystals.
4. The aircraft’s weather radar detected precipitation droplets. In simple terms, black indicated minimal rainfall, green indicated light rainfall, yellow is moderate rainfall and red indicated heavy rainfall.
5. Magenta indicated turbulence.
6. EICAS = Engine indicating and crew alerting system.
7. Secondary mode: a mode of the flight control system with less automated functions and protections available. More detail is contained in the Airspeed indication System description section.
8. A yaw damper is a device, independent of the autopilot system that applies rudder correction on order to reduce the lateral oscillations of an aircraft motion, with both rolling and yawing components (Dutch roll).

Safety analysis

Reasons for erratic airspeed indications

The weather analysis provided by the aircraft manufacturer’s meteorological specialists found that the erratic airspeed values likely resulted from ice crystal icing of the pitot-static systems. In this instance the icing affected the voted airspeed values for approximately 17 seconds.

Although there are three independent pitot-static systems for determining computed airspeed, adverse environmental conditions, as encountered during this flight, can affect all three simultaneously. On the B787, the synthetic AOA speed allows an independent source of airspeed as a comparison in order to validate the voted airspeed.

Once the airspeed values returned to normal, the ongoing flight was affected by the reversion and latching of the flight control computer to secondary mode.

Secondary mode reversion

A drop in recorded airspeed to, or below, a threshold level is referred to as a No Computed Data (NCD) state. Throughout the recorded airspeed fluctuations, there were two occasions where the value of voted airspeed went NCD for a sufficient time to revert the flight control system to secondary mode.

Boeing has taken action to revise the software in the flight control computer related to the secondary mode reversion. This revision has increased the time required in an NCD state to revert to secondary mode.

FAA Airworthiness directives

The FAA published an airworthiness directive (AD-2016-07-10) to advise crew not to make large magnitude abrupt control inputs as a response to sudden unrealistic drop in displayed airspeed at high actual airspeed. Abrupt control inputs in this condition could exceed the structural capability of the aircraft.

As a subsequent measure to the FAA AD, Boeing have revised the flight control software to limit the rate of elevator feel reduction, thereby reducing the risk of over controlling the aircraft at high speed.

Even though AD-2016-07-10 was published after this event, the crew actions were consistent with the directive in that they did not make any large changes to the control inputs.

Findings

From the evidence available, the following findings are made with respect to the erratic airspeed indications and subsequent flight control mode reversion on a Boeing 787-8, registered VH-VKE that occurred 250NM north of Darwin on 21 December 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The aircraft entered a region of high ice water content which caused icing of the three independent pitot sources and anomalous airspeed indications.
• Short duration anomalous airspeed indications caused the flight control computer to transition to secondary mode. In secondary mode, the autopilot and some auto-flight protections were unavailable to the flight crew.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Flight data
• Flight crew interviews
• Jetstar operational documentation (Quick reference handbook, flight crew operations manual)
• Boeing safety analysis results.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, Jetstar Airways, The Boeing Company and the Civil Aviation Safety Authority.

Submissions were received from The Boeing Company and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 19 December 2015, the pilot of a Eurocopter AS 350 helicopter, registered VH-NPS (NPS), was conducting fire control work near Glenbrook, New South Wales, with one crewperson on board. The fire control work included use of a Bambi Bucket (Figure 1) to drop water on the fires, slung under the helicopter by a 100 ft long-line.

Shortly before 1830 Eastern Daylight-saving Time (EDT), the pilot and crewperson decided they would cease operations for the day, due to the limited daylight remaining and the number of hours they had been on duty. The pilot elected to land the helicopter at Glenbrook helipad to refuel, before returning to base.

Figure 1: Bambi Busket

Source: sei.ind.com

The helicopter landed with the bucket and line in front of the helicopter, and the fuel drum to the right of the helicopter. While the engine was still running and the rotor blades turning, the pilot realised that the helicopter’s fuel cap was on the left side and therefore needed to turn the helicopter around to access the fuel drum.

The crewperson exited, stood in front of the helicopter and took hold of the long-line to ensure it remained clear during the turn. The pilot then lifted the helicopter to about 2 ft above ground level. The crewperson used hand signals to direct the pilot to conduct a right turn, walking to stay in front of the helicopter, manage the long-line, and remain in the pilot’s sight. After the helicopter had turned 180°, the crewperson gave the signal to lower the helicopter, which the pilot followed. As the helicopter lowered down, the tail rotor struck the bucket, which was on the ground behind the helicopter. The pilot detected the strike as a vibration through the pedals, and immediately moved the helicopter forward slightly, lowered the collective, and landed.

The tail rotor was damaged (Figure 2); the pilot and crewperson were uninjured.       

Pilot comments

The pilot was not looking at the bucket, which ended up behind the helicopter, but following the crewperson’s hand signals. The pilot commented that to minimise risk he should have lifted back up, turned the helicopter to the left, to keep the path ahead of the tail rotor in sight, and set the bucket back down in front of the helicopter, keeping the bucket in sight at all times.

While both the pilot and crewperson were highly experienced in helicopter operations, both had limited experience specifically in fire control work.

Operator report

The operator conducted an investigation into the incident, and identified several factors that may have contributed to the incident:

• Due to rostering requirements, an inexperienced fire operations pilot and crewperson were tasked together.
• The pilot was on their ninth successive day of duty.
• The pilot lost situational awareness of the bucket.
• Fatigue may have played a small role in reducing the pilot’s situational awareness of the bucket, and the pilot may not have been aware of this fatigue level.
• Task pressure to get the job done along with high workload due to last light requirements, crew transport and a request for the crew to continue water bombing, may have reduced situational awareness and crew communication.
• Time pressure may have contributed to the incident. As incident work is high-paced, it is important for the crew to slow down to allow all critical checks to be completed in an unhurried manner.
• The day had been extremely hot, highlighting the need for crew to remain well-hydrated, eat and take regular rest breaks.

Figure 2: Damage to VH-NPS tail rotor

Source: Helicopter operator

Safety action

Helicopter operator

As a result of this occurrence, the helicopter operator has advised the ATSB that they are taking the following safety actions:

Crew pairing

Where possible, pilots who are more experienced with a particular type of operation, such as fire control work, will be rostered with less experienced crewpersons and vice versa.

Fatigue management

The operator will monitor fatigue levels in a more robust manner, including crew self-reporting and managers monitoring their staff.

Training

The operator’s training strategy and practices will be overhauled, with a training package released by 30 March 2016. Pilots and crewpersons will be assessed on their understanding of the operations manual.

Safety message

This incident highlights the importance of effective risk assessment and crew communication. Careful risk assessment is particularly important where a non-standard manoeuvre is planned. Effective crew communication is vital to ensure that potential hazards are clearly identified and understood, and the associated risks are appropriately managed.

Aviation Short Investigations Bulletin - Issue 47

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 18 December 2015, the pilot of a Piper PA-31P aircraft, registered VH-OGW (OGW), operated patient transfer flights from Bankstown to Merimbula, Wagga Wagga, Griffith and return to Bankstown, New South Wales.

At the start of the day, the aircraft was fuelled to a total of 440 L, which the pilot entered into the on-board fuel computer. After landing at Merimbula, the pilot added fuel to a total of 650 L on board. However, the pilot inadvertently entered a figure equating to about 710 L into the fuel computer at that time, which was 60 L more than the actual fuel on board.

Prior to departing on the final sector from Griffith to Bankstown, the pilot reviewed the fuel requirements for the flight. Based on figures from the fuel computer, there was sufficient fuel on board for the aircraft to land at Bankstown with 140 L remaining; which was in excess of the minimum reserves required. Also on board for the flight were a nurse and a patient.

After departure from Griffith, the aircraft climbed to flight level (FL) 110.^[1] However, at FL 110, the aircraft encountered a headwind of about 20 kt. In order to conserve fuel, the pilot elected to descend to 10,000 ft, where the headwind decreased to about 10 to 15 kt.

At about 2300 Eastern Daylight-saving Time (EDT), the aircraft landed at Bankstown Airport. The following morning, prior to the first flight of the day, another company pilot dipped the aircraft’s fuel tanks, and assessed that only about 60 L of fuel remained after the previous flight. A minimum of 45 minutes of fixed fuel reserves, equating to 120 L, was required for the flight, hence the aircraft had landed the previous night with half the required fuel reserves remaining.

Wind

The forecast was for variable winds at 10 kt increasing to 20 kt above 10,000 ft. Based on the wind encountered on the previous sectors, the pilot expected a tailwind for the return flight.

Fuel calculations

The fuel computer provided the fuel flow and fuel consumed for each sector flown. The computer held two units: total fuel on board in US gallons (USG) as entered by the pilot; and fuel flow, which was calculated by fuel flow sensors in the fuel inlet lines. The fuel flow was displayed in USG per hour, and tallied the amount of fuel consumed in USG. The pilot could select to display the quantity of fuel remaining, which the computer calculated by subtracting the fuel consumed from the fuel on board figure entered by the pilot.

Before entering the fuel figures, the pilot converted the amount of fuel on board in L to USG as required for the computer. The incorrect figure entered at Merimbula may have resulted from a conversion error and/or a data entry error.

The pilot planned to land at Bankstown with 140 L of fuel remaining; and reported that the fuel computer indicated that 130-135 L remained after landing. The aircraft fuel gauges indicated that about 40 USG remained (150 L). Those figures corresponded with the pilot’s assessment of the planned fuel consumption and the headwind encountered during the flight.

Pilot comments

The pilot calculated that there was adequate fuel on board to meet the minimum fuel required for the flight plus a small excess; which would ensure the aircraft was below the maximum landing weight for the arrival to Bankstown, with fixed reserves intact.

The pilot had a total of 17.3 hours on the PA-31P aircraft type, although significantly more in the PA-31. The pilot had completed a company check flight in the aircraft that morning, and then operated three sectors prior to the incident flight.

The pilot had previously used the same type of on-board fuel computer in different aircraft, and assumed it was a reliable source for establishing the actual amount of fuel on board. However, the only reliable source approved by the operator, was to fill the fuel tanks to full, or to a known quantity and use a dipstick to crosscheck the fuel on board with the computer figure. The pilot stated that in aging aircraft, the fuel gauges were unreliable.

The pilot also commented that the dipstick provided a reliable indication of the fuel on board for the first flight of the day, but may provide an inaccurate reading if the aircraft was not parked on level ground.

Operator comments

The aircraft operator’s report into the incident stated that the pilot had not followed the fuel crosscheck requirements of the company operations manual.

Company flight crew subsequently verified that the fuel computer in that aircraft was accurate.

Safety action

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Notice to air crew

The aircraft operator issued a notice to air crew (NOTAC) immediately following the incident. The notice reminded company flight crew of the importance of adhering to the company’s fuel cross check requirements. The notice also advised of an impending amendment to the Operations Manual to clarify the specific fuel cross check requirements of the PA-31P.

The amendment stated:

PA31P aircraft have a calibrated dipstick provided and an on-board Shadin fuel computer installed. The dipstick must be utilised for visual confirmation of a known fuel amount to be entered into the Shadin. In the event the dipstick is lost and/or the Shadin is un-serviceable then check if fuel quantity can be visually seen at the bottom of the tank, if fuel is lapping at the entry point the aircraft has 300 litres on-board. A pilot shall not depart on any mission without a visual confirmation of this minimum 300 litres.

Visual fuel crosscheck using the dipstick must be completed to verify the accuracy of the Shadin and the accuracy of pilot input into the Shadin on each subsequent sector where fuel is not added.

Safety message

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns relates to aircraft fuel management.

Pilots are reminded of the importance of careful attention to aircraft fuel state. ATSB Research report AR-2011-112 Avoidable accidents No. 5 Starved and exhausted: Fuel management aviation accidents, discusses issues surrounding fuel management and provides some insight into fuel related aviation accidents. The report states that ‘accurate fuel management starts with knowing exactly how much fuel is being carried at the commencement of a flight. This is easy to know if the aircraft tanks are full, or filled to tabs’.

This incident highlights the need for pilots to use a known fuel quantity to obtain accurate fuel figures, and not rely on planned fuel consumption or a fuel calculator. Many factors can affect planned fuel consumption, including power and fuel mixture settings, variance in wind direction and strength, and holding or delays due to air traffic control. Furthermore, on-board fuel computers that rely on manual data entry may also be subject to error.

Aviation Short Investigations Bulletin - Issue 47

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 110 equates to 11,000 ft.

What happened

On the morning of 15 December 2015, a SOCATA TBM 700 aircraft, registered VH-YZZ (YZZ), departed Gold Coast Airport, Queensland for Lake Macquarie Airport, New South Wales. On board were the pilot and one passenger.

The flight to Lake Macquarie was uneventful and the pilot reported feeling well.

SOCATA TBM 700, VH-YZZ

Source: Martin Eadie/Airliners.net

Having not previously landed at Lake Macquarie, the pilot overflew the aerodrome, at approximately 1,500 ft above ground level, to confirm the airfield layout. After the overflight, the pilot joined the upwind leg and commenced a left circuit for runway 07 (Figure 1). The aircraft was configured for landing during this time and, when on final, the approach speed was set to 80 kt.

Figure 1: Indicative flight path of YZZ overflying Lake Macquarie Airport prior to joining the downwind and final legs of the approach to runway 07

Source: Google maps – modified by ATSB

When YZZ was on short final, the pilot began to feel ‘woozy’ and, shortly after, lost consciousness. Closed circuit television footage showed the aircraft descended onto the runway and bounced before impacting the runway in a nose-low attitude to the left of runway centreline. The nose-low impact collapsed the nose gear and caused the forward section of the aircraft to strike the runway, bending all four propeller blades. It was at this time that the pilot regained consciousness, approximately 5 to 10 seconds after losing consciousness. The aircraft then skidded on the runway before veering to the right, and onto the grass (Figure 2). The aircraft eventually stopped on the grass area next to the runway (Figure 3).

Figure 2: Final approach path of YZZ to runway 07 with the approximate positions the aircraft first impacted the runway, bounced, the second impact and the approximate path YZZ skidded along, and across, the runway before coming to a stop on the grass

Source: Google maps – modified by ATSB

Figure 3: YZZ post-accident showing the damage to the forward section of the aircraft as a result of the nose gear collapse and skidding on the ground

Source: Phil Hearne/Fairfax syndication

After YZZ had come to a stop, the pilot and the passenger detected a burning smell and made an emergency egress from the aircraft. Once they were safely clear of the aircraft, the pilot saw that there was no fire and that the smell was from the nose gear being jammed under the fuselage and skidding on the runway surface. The pilot then re-entered the aircraft and shut down the engine to ensure that the risk of fire was eliminated. Neither the pilot nor the passenger were injured in the accident, however the aircraft was substantially damaged.

Aircraft systems

All systems on the aircraft were functioning normally. There was no fault evident with any system that could have contributed to the pilot’s loss of consciousness.

Pilot comments

The pilot stated they were well rested, had eaten prior to and during flight and were appropriately hydrated. The pilot reported that they had no previous loss of consciousness events, nor were there any extra pressures or distractions that may have affected them during the flight.

Medical tests and monitoring after the accident found that the loss of consciousness was due to a previously undiagnosed heart condition.

Safety message

The health of flight crew is vitally important for the safe operation of aircraft. Ultimately, all flight crew are responsible for monitoring their own health and wellbeing. Any deterioration in health that may affect the performance of flight crew should be taken seriously.

While in this instance, the pilot had no indication of a health concern before to the event, it is important for pilots to assess their fitness to fly prior to flight. The following checklist provides a quick reference. A description of aeromedical factors is available in the US Federal Aviation Authority (FAA) Pilot’s Handbook of Aeronautical Knowledge.

Source: US Federal Aviation Administration

In February 2016, the ATSB released a research report into pilot incapacitation occurrences between 2010 and 2014. The report provides valuable insight into pilot incapacitation occurrences in high-capacity air transport, low-capacity air transport and general aviation.

The report highlights how pilot incapacitation can occur in any operation type, albeit rarely. Of interest, the research found that around 75 per cent of the incapacitation occurrences happened in high-capacity air transport operations (about 1 in every 34,000 flights). With the main causes being gastrointestinal illness and laser strikes. Low-capacity air transport and general aviation had fewer occurrences with a wider variation of causes of pilot incapacitation. These ranged from environmental causes, such as hypoxia, to medical conditions, such as heart attack.

Importantly, the report reminds pilots in general aviation, to assess their fitness prior to flight. Assessment of fitness includes being aware of any illness or external pressures they may be experiencing.

Aviation Short Investigations Bulletin - Issue 47

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At approximately 1600 Eastern Daylight-saving Time^[1] on 17 December 2015, the rostered driver of 109D arrived at Hornsby Maintenance Centre (HMC) to take charge of the train. The rostered driver was scheduled to meet with the preparing driver of 109D at 1606. However, when the rostered driver arrived at the train, he was unable to find the preparing driver and found the train’s controls were in an isolated state.

The rostered driver was in process of cutting in (starting up) the train when he received a bell from the guard on 109D. Confused by the bell, the rostered driver called the guard on the train intercom. The guard said they needed to conduct a ‘continuity test’^[2]. The rostered driver agreed then commenced with the continuity test.

Shortly after, another driver (passenger driver) arrived at the crew compartment guard side door and asked the rostered driver if he could travel as a passenger to Epping Station. The rostered driver agreed and continued with the continuity test.

At 1606, the HMC yard shunter approached 109D and provided a hand gesture (wave) to the rostered driver, which the rostered driver understood as a signal to depart from HMC. After a second wave from the HMC yard shunter, the rostered driver indicated his intent to depart. The rostered driver recalled feeling under pressure to depart the train and did not complete the continuity test or log onto the Metronet radio^[3] before departing the train.

At 16:08:22, 109D departed from signal HY4FRB on the Outwards Car Shed Road (OCSR). See Figures 1 and 2.

Figure 1: Train detected in block section after Signal HY4FRB
 

Source: Sydney Trains ATRICS^[4], annotated by ATSB

Figure 2: View from train driver’s cab to signal HY4FRB at HMC
 

Source: ATSB

As the train progressed along the OCSR towards signal HY82, the rostered driver and passenger driver recall discussing work schedules with each other.

The passenger driver asked the rostered driver for his route diagram^[5]. The rostered driver recalled seeing signal HY82 displaying a ‘proceed at caution’ indication (amber light) before attempting to locate the route diagram from inside his workbag, located on the nearby driver’s seat.

The rostered driver gave the route diagram to the passenger driver who looked at the diagram to confirm the scheduled arrival time at Epping station before handing it back to the rostered driver.

At 16:09:07, 109D appeared on the ATRICS board when the train occupied the block sections between signals HY4FRB and HY82. HY4FRB had a ‘proceed at caution’ indication and HY82 had a stop indication.

At 16:10:42, a yellow line from 534 points to Platform 3 Hornsby Station appeared on ATRICS, which indicated the Network Control Officer Hornsby Panel^[6] (NCOH) had requested the intended route for 109D. Additionally, ATRICS indicated 109D occupied the block section directly after signal HY82 (HY82AT) with signal HY82 displaying a stop indication. This was also reflected in the Weslock data log^[7]. This meant 109D had passed signal HY82 at stop – Signal Passed at Danger (SPAD). See Figure 3.

Figure 3: Route set for Platform 3 and 109D is occupying block section HY82AT

Source: Sydney Trains ATRICS, annotated by ATSB

Examination of the ATRICS and Weslock data showed that signal HY82 was at stop and 534 points were set to direct traffic towards platforms 1 and 2 (normal position) as train 109D approached. See Figure 4.

Less than one second before 109D passed signal HY82 at stop, the NCOH had requested a route from signal HY82 towards Platform 3, requiring 534 points to move to the reverse position.

Figure 4: Signal HY82 and 534 points. 534 points set for movement straight ahead (normal position)

Source: ATSB

Train 109D was able to pass signal HY82 and travel the seven metres to 534 points before the points could change position. As the lead bogie of the first carriage travelled over 534 points (still in the normal position), the points started to reverse position, directing the trailing bogie towards Platform 3. The opposing movements of the leading and trailing bogies caused the carriage to twist and eventually derail the train. See Figure 5.

Figure 5: 109D derailed over 534 points

Source: ATSB

At 16:10:57, 109D is indicated on ATRICS as occupying block HY82AT and block HY82BT. See Figure 6.

Figure 6: 109D occupying section HY82AT and HY82BT

Source: Sydney Trains ATRICS, annotated by ATSB

The leading bogie was confirmed to have travelled straight ahead as it triggered occupation of block section HY82BT. However, the trailing bogie of the first carriage and the remainder of the train had been diverted towards Platform 3 Hornsby Station (block section HY82AT).

The rostered driver recalled feeling the train twist in an awkward way as he passed over 534 points and applied the brakes to stop the train.

109D travelled 553 metres in 2 minutes and 20 seconds between Signal HY4FRB and Signal HY82, averaging a speed of 14.2 km/h. See Figure 7.

Figure 7: Path of 109D from OCSR to 534 points

Source: Sydney Trains NLA 302 Hornsby, annotated by ATSB

At 16:11, SPAD alarms sounded at Homebush Control Centre on the Hornsby ATRICS panel. The NCOH received alarms and attempted calls over the Metronet radio but was unable to speak with the caller.

At 16:14, the NCOH attempted to receive another call however was still unable to connect with the person on the other end.

At 16:15, the NCOH made contact with another driver on 167N, which was on the Up Main line and asked for confirmation whether 109D had derailed. The driver of 167N was able to confirm that 109D had derailed.

At 16:16, the driver of a nearby train, N24, called the NCOH. The driver of N24 could see the derailed train describing it to the NCOH as “a bogie in the dirt”. The NCOH requested the driver of N24 to pull up, to make an emergency stop.

The NCOH informed the Train Controller and Operations Controller at the Rail Management Centre (RMC) that 109D had SPAD and possibly derailed.

At 16:18, the NCOH made an emergency broadcast for all trains in the Hornsby Area to come to a stop. The NCOH attempted to contact 109D without success.

At 16:20, the Incident Rail Commander (IRC) was informed by the Shift Manager RMC of a SPAD coming out of the OCSR and was required to attend. The IRC advised he would be there in approximately 15 minutes.

At 16:21 the driver of N24 called the NCOH and provided a phone number of the passenger driver on 109D.

At 16:40, the IRC arrived at Hornsby and approached 109D from a side gate halfway between Hornsby Station and the sidings. The IRC recalled recognising a train technician and seeing another person on the track ahead near 109D.

The IRC contacted the Signaller and created a safe place utilising the disabled train^[8].

At 17:05, the IRC discussed the condition of the situation with the relevant disciplines (Overhead electrical, Signals, Civil and Train Technician). The IRC determined that the train could be pulled back from 534 points to release the interlocking of the signals caused by the presence of 109D occupying the block sections HY82AT and HY82BT.

At 17:17, the IRC had 109D propelled back to signal HY82. The IRC informed Train Control the movement was successful and standing train protection would remain with the train now standing on the down side of signal HY82.

By 18:15, Overhead electrical, Civil and Signals had certified the infrastructure fit for purpose.

Due to delays caused by the SPAD and derailment over 534 points, 109D remained at signal HY82 until after the peak period before being moved back into HMC.

Safety analysis

Driver distraction

The rostered driver allowed the passenger driver to ride in the driver’s cab to get to Epping Station.

While this practice has been accepted by the organisation, this situation heightens the risk of distraction to the driver operating the train. In this incident, both the rostered driver and passenger driver recall making conversation about their days and their work schedules as the train departed from HMC and traversed the OCSR towards signal HY82 and 534 points.

At the time of departure from HMC and onto the OCSR, the rostered driver passed two signals:

• The first signal, HY4FRB, when leaving HMC on the OCSR.
• The second signal, HY82, which was approximately 550 metres further along the OCSR and the signal that was passed at danger.

HY4FRB displayed a ‘proceed at caution’ indication (amber light), while HY82 displayed a stop indication (red light) for the duration of the incident.

The rostered driver recalls spotting a ‘proceed at caution’ indication when asked about the aspect of signal HY82. However, it is likely the signal with a ‘proceed at caution’ indication was HY4FRB. It is likely the rostered driver lost situational awareness and missed seeing signal HY82 due to being involved in conversation with the passenger driver.

Emergency communication systems

When train drivers prepare a train for service, they are required to log onto the Metronet train radio system to ensure they have communications with Train Control.

In this incident, there was a preventable delay in establishing communications between the Signaller and the train crew on 109D after the incident had occurred. Had the Metronet radio system been logged in, there would have been direct communications between the Signaller and the train driver of 109D.

Reliable communications between Train Control and train services, including train crew, is paramount for safe operations, especially during degraded and emergency situations.

Route familiarity

This was the first occasion the rostered driver had departed the HMC without supervision, since his familiarity training of the area approximately three months before.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The rostered driver of 109D was distracted by interaction with the passenger driver at the critical time of approach to signal HY82.
• Without being logged onto the Metronet radio system, effective communications could not be made between Train Control and 109D.
• This was the rostered driver’s first unsupervised departure from HMC onto the OCSR since being qualified as a driver.

Safety action

The ATSB has been advised of the following proactive safety action in response to this occurrence.

Sydney Trains

• Conducted briefings with train crew on compliance to network rules and procedures and a previously issued safe work instruction on eliminating in-cab distraction.
• Completed a major upgrade of the track and signalling in Hornsby yard. This included the reconfiguration of various tracks and points on through lines as well as the provision of new signalling, train stops and signal telephones.

Safety message

Train drivers must maintain situational awareness at all times when driving trains. Any driver riding as a passenger in the driver’s cab must respect the driver’s requirement to be vigilant and not engage in any way that may distract the driver in control of the train.

Rolling stock details

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylight-saving Time (ED-sT): Coordinated Universal Time (UTC) + 11
2. A continuity test is a check of the train’s air brakes and communications systems.
3. The Metronet radio is the closed communication system used between train drivers and Network Control Officers on the Sydney metropolitan rail network.
4. ATRICS (Advanced Train Running and Information Control Systems), is the software package developed for the Sydney metropolitan rail system. It is used to control the signalling system and provide feedback to train controllers about the position of points, status of signals and location of trains.
5. The driver’s route diagram is the driver’s work schedule for the day which typically includes times and train service numbers that the driver is required to meet.
6. The NCOH is one of many network control officers who manage the safe movement of trains around the network through operating track points and controlled signals.
7. Weslock is the precision data logging system and this information is similarly represented in the ATRICS.
8. Creating a safe place utilising standing rail traffic is colloquially known as ‘Standing Train Protection’. NTR 432 Protecting activities associated with in-service rail traffic is the procedure which describes this process.