Safety summary

What happened

On 4 December 2015, a Scoot Boeing 787-9 aircraft, registered in Singapore as 9V-OJC (OJC) was operating a scheduled passenger flight from Changi International Airport, Singapore, to Perth International Airport, Western Australia. At about 1743 Western Standard time, OJC commenced an instrument landing system (ILS) approach to runway 21 at Perth.

During the approach, the aircraft’s autopilot flight director system (AFDS) entered a degraded mode, and presented the crew with information that they erroneously believed represented the glideslope. The crew followed the displayed information, which resulted in a descent below the designed approach path and the subsequent activation of the aircraft’s enhanced ground proximity warning system. The crew conducted a go-around, and completed an uneventful approach and landing.

What the ATSB found

During the approach, a disturbance of the ILS glideslope signal occurred, likely due to an aircraft taxiing for take‑off on runway 21, resulting in OJC capturing the ILS glideslope prematurely. Because of this, the AFDS entered a degraded mode, presenting the crew with information extrapolated from a previous position, rather than updated glideslope information.

While taking actions to reset the AFDS, the crew continued descending as per the presented information, without identifying cues that indicated the information was unreliable. This resulted in an abnormally high rate of descent, leading to a descent below the designed approach path, and activation of the aircraft’s enhanced ground proximity warning system.

The flight crew were likely experiencing higher than normal workload, due to a combination of the high speed approach and troubleshooting the unexpected glideslope indications. This reduced the effectiveness of cockpit communication and delayed correction of the aircraft’s low altitude.

What's been done as a result

The aircraft operator advised they communicated the essential elements of this event and associated AFDS implications (including primary flight display and head-up display indications) to the pilot group. Pilots have been reminded to monitor the basic flight instruments and relevant check heights during the approach, in addition to the aircraft calculated guidance.

Stabilised approach criteria and associated callouts and actions have also been emphasised. In addition, the importance of energy management and use of the HUD to monitor appropriate descent path information has been highlighted.

Safety message

Flight crew are reminded that when conducting an ILS approach in visual conditions, ILS signal paths are not protected by air traffic control, and may be subject to interference. The aircraft’s flight path needs to be constantly monitored to ensure that guidance presented to the flight crew is valid. Constant monitoring will also ensure that early action can be taken to correct any deviation from the approach path.

The occurrence

On 4 December 2015, a Scoot Boeing 787-9 aircraft, registered in Singapore as 9V-OJC (OJC), was operating a scheduled passenger flight from Changi International Airport, Singapore, to Perth International Airport, Western Australia. The first officer was the pilot flying (PF), and the captain was the pilot monitoring (PM)^[1]. Also on the flight deck was a second officer conducting his first observation flight as part of his training on the 787 aircraft.

During the descent into Perth, Air Traffic Control (ATC) cancelled the normal speed restriction of a maximum of 250 kt below 10,000 ft, and requested the flight crew maintain 280 kt. This higher‑than‑normal speed was required to allow sequencing with other arriving traffic.

At about 1736 Western Standard Time,^[2] as the aircraft was approaching 9,000 ft, the crew contacted the Perth approach controller and were instructed to maintain 9,000 ft. About a minute later, they were cleared to descend to 5,000 ft. At this time, the flight crew had a conversation about the speed they were flying being higher than the operator’s guidelines, which recommended a speed no greater than 250kts below 5,000 ft. The captain subsequently instructed the first officer to maintain the higher speed, as per the ATC instructions.

At 1740, after being cleared to descend to 4,000 ft, the crew reported to the controller that they were still maintaining 280 kt. In response, the approach controller advised the crew to resume their desired speed. The standard arrival speed at this point was 230 kt.

At 1741, the flight crew were cleared for a further descent to 2,500 ft and were given clearance to conduct the Runway 21 Instrument Landing System^[3] (ILS) approach (Figure 1). At 1742, the approach controller instructed the crew to reduce speed for the approach. After 30 seconds, the crew were instructed to reduce speed further to 170 kt. At this time, the aircraft was approaching waypoint HAIGH, the initial approach fix (IAF) of the ILS approach, at an altitude of 2,600 ft and with an airspeed of about 240 kt. The published arrival speed from HAIGH was between 160 kt and 185 kt.

At 1743:13, both the ILS localiser (LOC) and glideslope (G/S) functions appeared to have been captured normally, with flight crew noting green indications for both on the flight mode annunciation panel. At this point, the aircraft was clear of cloud and the flight crew had the runway in sight. The Perth Automated Terminal Information Service identified the visibility as greater than 10 km, and the cloud as ‘FEW’^[4] at 3,000 ft.

At 1743:32, the aircraft was directed by ATC to slow to the minimum approach speed. At 1744, the aircraft approached the outer marker (OM) (Figure 1) while descending through an altitude of about 1,000 ft, with a descent rate of about 1,800 fpm and an airspeed of 184 kt. This altitude was about 500 ft below the required height for this point of the approach, with a descent rate about double that required to maintain the glideslope.

A review of recorded Continuous Parameter Logging flight data after the incident indicated that, at around the time of the glideslope capture, there was a three‑second disturbance to the glideslope signal. This disturbance should have appeared as a slight oscillation of the glideslope indications on both the primary flight displays (PFDs) and the head-up displays (HUDs). The flight crew later reported that they did not notice the disturbance. The data further showed that the glideslope was prematurely captured by the autopilot flight director system (AFDS). As a result of the temporary disturbance, the AFDS entered a degraded mode of operation several seconds after the disturbance. At the time this occurred, 1743:36, the aircraft was at a distance of about 7 DME^[5] (about 13 km) from the Runway 21 threshold, and past the initial approach fix waypoint HAIGH, descending through 2,120 ft with a descent rate of about 1,300 feet per minute (fpm) and an airspeed of 206 kt.

Figure 1 - Perth runway 21 ILS approach chart used by Scoot flight crew

Red boxes show the expected height at the outer marker (1480 ft when 4.5 nm from runway threshold), required altitudes to maintain the three degree glideslope for the approach, and the expected decent rate in feet per minute to maintain the glideslope for a range of approach speeds.

Source: Jeppesen annotated by ATSB

In the degraded mode, the glideslope flight path was no longer tracked by the AFDS, and instead the AFDS entered an attitude-stabilising mode based on the inertial data existing at that time. The resulting descent rate guidance displayed to the flight crew on the flight director was higher than that required to maintain the published 3° approach path.

The flight crew did not recall seeing any of the indications in the flight deck about the degraded AFDS mode, which should have normally displayed as both an amber line displayed through the G/S active mode text on the PFD, and as a line through the G/S active mode text on the HUD. In addition, an ‘AUTOPILOT’ caution message should have been displayed on the engine indicating and crew alerting system (EICAS). The flight data indicated that the autopilot was manually disconnected at 1743:38, two seconds after the AFDS entered the degraded mode, and the flight directors were cycled off then on again at 1743:45 with the intention of resetting the AFDS. The LOC and V/S modes then became active.

At 1744:24, the flight crew received an aural ‘GLIDESLOPE’ alert from the aircraft’s enhanced ground proximity warning system, indicating an excessive deviation below the required glideslope approach path. The flight crew later recalled that it was after receiving the ‘GLIDESLOPE’ caution alert that they observed a line through the G/S text on their PFDs and failure mode indication on the HUDs. The first officer reported also observing an ‘AUTOPILOT’ caution message on the EICAS at about this time. These indications are consistent with the AFDS degraded mode. Flight data indicated that the crew were taking action to respond to the degraded mode just prior to the aural alert. Resetting the flight directors resulted in the LOC and Vertical Speed (V/S) modes becoming active. The G/S mode remained armed, but did not become active.

In response to the alert, the captain then instructed the first officer to ‘power up’ and stop further descent. The first officer did not respond at this point, as he was reportedly still managing the energy of the aircraft to slow the approach down, and assessing the caution messages received.

As the aircraft passed over the OM, it descended through 930 ft with an airspeed of 180 kt, and a descent rate of 1,700 fpm. The required height at this point was 1,480 ft, the target approach speed was 156 kt, and a descent rate of about 850 fpm. The procedural approach speed limit was 160 kt. At this time, the captain took control of the aircraft with the intention of arresting the descent rate, correcting the flight path, and continuing the approach. However, the first officer advised the captain that the approach was outside the company’s stable approach criteria and recommended they conduct a go-around. As this was occurring, the flight crew visually observed that the precision approach path indicator (PAPI)^[6] lights were all red, indicating the aircraft was significantly lower than required for the approach, and commenced a go-around.

At about 1745, the Perth Tower controller asked the crew to confirm they had visual reference with the runway, and to check their altitude. At that stage the aircraft had climbed to an altitude of 650 ft. The crew responded to the controller, advising that they were conducting a go-around.

A minimum altitude of 590 ft (520 ft above the ground) was recorded at 1744:47, when the aircraft was at 3.5 DME (5 km) from the runway, at a position where the glideslope height was 1,160 ft. The time between the first aural ‘GLIDESLOPE’ caution and commencement of the climb in the go-around was 23 seconds.

The aircraft subsequently conducted another ILS approach to the same runway. There was no signal disturbance during that approach and the ILS was conducted in accordance with the prescribed procedure. The aircraft landed at about 1758.

__________

1. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
3. The instrument landing system is a ground-based precision approach and landing aid. The main elements are (1) the localiser antenna, which provides centreline guidance; (2) the glideslope antenna, which provides a nominal 3° descent guidance; (3) the marker beacons (outer, middle and inner), which are used for altimetry checks and to indicate what stage of the approach has been reached; and (4) the approach lights (Distance Measuring Equipment (DME) and/or Global Navigation Satellite System (GNSS) may be used in lieu of marker beacons).
4. When measuring cloud cover, the sky is broken up into eighths (oktas). ‘FEW’ cloud equates to 1 to 2 oktas of cloud.
5. Distance measuring equipment (DME): DME display provides pilots with a distance measurement in nautical miles to the relevant DME station. In this case, the runway 21 touchdown point.
6. Precision Approach Path Indicator (PAPI): a ground based system that uses a system of white and red lights used by pilots to identify the correct approach path to the runway when conducting a visual approach.

Context

Personnel information

Both the captain and the first officer held all licences, medical certificates and training required to operate the aircraft at the time of the incident. There was also a second officer on the flight deck who was completing an observation flight as part of his 787 training.

Both the captain and first officer had previously operated the Boeing 777 aircraft, and completed the conversion training to the Boeing 787 aircraft within six months of this occurrence.

The captain had over 18,000 total flying hours, with over 15,000 hours as pilot in command (PIC) at the time of the occurrence, including 373 hours on the Boeing 787, 338 hours of which were as PIC.

The first officer had over 5,300 hours total flying hours, with 152 on the Boeing 787, including 62 as pilot in command under supervision.

Evidence collected about the pilot rosters and sleep patterns prior to the occurrence indicated that fatigue was not likely to have been a contributing factor in this incident.

Instrument landing system signal interference

In certain conditions, the integrity of an instrument landing system (ILS) is not protected, and signal disturbances may be experienced, even while the flight crew are conducting an instrument approach. Pilots may experience ILS beam bends and other interference in circumstances where the critical or sensitive areas of the ILS are not protected.

Disturbances to ILS localiser and glideslope courses may be caused by fixed structures, such as buildings (static distortion), or moving vehicles or aircraft (dynamic distortion). The total ILS course distortion is determined by the summation of static and dynamic distortion, and this is used to define critical areas near each localiser and glideslope antenna. ^[7] The critical area is surrounded by a sensitive area. These areas will differ for each approach. Figure 2 shows an example of the critical and sensitive areas around an ILS antenna.

Figure 2: Example of glide path critical and sensitive area dimensions

Source: International Civil Aviation Organisation Annex 10 (2018)

Different levels of protection of the critical or sensitive areas of the ILS are provided by ATC depending on the:

• type of approach being conducted
• position of the aircraft on the approach
• weather conditions at the time.

For low-visibility approaches, when the cloud ceiling is at or below 600 ft, or the visibility is less than 2,000 m, no aircraft or vehicle is permitted to enter the critical areas when an arriving aircraft is within the outer marker, or 4 NM (7.4 km) from the threshold if there is no outer marker. The sensitive area will only be protected if the cloud ceiling or visibility is below that required to conduct a Category 1 ILS approach.

Flight crew are requested to inform ATC if they are conducting an autoland or coupled approach. This does not, however, ensure the critical area will be protected. When the cloud ceiling is above 600 ft, or the visibility is greater than 2,000 m, neither the ILS critical or sensitive areas are protected. When an area is protected, all aircraft will be held at a holding point which is outside of the protected area.

While the weather conditions were suitable for the flight crew to conduct a visual approach, it was not standard practice to assign visual approaches to foreign carriers, unless specifically requested by the pilot, and only after the pilot reported having the runway in sight. In this case, the flight crew had the runway in sight, but had not reported this to the controller while they were continuing with the instrument approach, nor were they required to.

Around the time of the glideslope disruption experienced by OJC, a Boeing 737 taxied from Terminal 1 and took off on Runway 21 (Figure 3). The ATSB assessed that the movement of that aircraft likely caused the signal disruption.

Figure 3: Perth Airport runway 21 showing location of glide path antenna, holding points and path of taxiing aircraft prior to take-off.

Image shows the holding points for runway 21 at Perth. Between the holding points is the critical area which may be disrupted by an aircraft or vehicle movement. The red arrow shows where the 737 taxied onto the runway, likely causing a disturbance to the glideslope.

Source: Google, annotated by the ATSB.

Approach speeds

As OJC descended, ATC requested the aircraft maintain a higher than usual speed (280 kt) to maintain separation with other aircraft. The Scoot operations manual advised flight crew that their speed should be reduced to below 250 kt by 5,000 ft, subject to ATC requirements.

An Airservices Australia safety bulletin current at the time of the occurrence (2015), stated

Standard Terminal Area Arrival Speeds (STAAS) were introduced to improve safety and efficiency by bringing more predictability to arrival sequences at Brisbane, Sydney, Melbourne and Perth airports.

The STAAS speeds for an aircraft arriving were:

• 250 kt at or below 10,000 ft
• 230 kt between 20 NM and either 10 NM or the initial approach fix, unless otherwise specified on the approach chart
• Between 185–160 kt between either 10 NM or the initial approach fix and 5 NM
• Between 150–160 kt within 5 NM of the runway threshold.

On the Runway 21 ILS approach chart (Figure 1), the published maximum speed was 185 kt at the initial approach fix (HAIGH) and 160 kt from 5 NM. Guidance to pilots in the Airservices Australia Aeronautical Information Publication identified that:

Aircraft are expected to continue at previously specified speeds, commence speed reduction prior to the next promulgated speed and be at the speed by the specified point.

ATC may vary the published speeds where required for traffic management.

Air traffic control provided the following instructions to the flight crew:

• At 1740:16, passing 20 NM, the crew were instructed to descend to 4,000 ft and reduce speed from 280 kt to desired speed
• At 1741:34, passing 14.75 NM, the crew were instructed to descend to 2,500 ft and were cleared for the ILS approach
• At 1742:22, around 11 NM, the crew were instructed to commence speed reduction for the approach
• At 1742:55, around 9 NM, the aircraft was instructed to reduce speed to 170 kt
• At 1743:32, around 7 NM, the crew were instructed to reduce to minimum speed, as the traffic ahead had slowed.

The speed change instructions were issued as the aircraft was descending and setting up to capture the localiser and glideslope for the approach, and during the early stage of the approach. As per the controller instructions, the crew were requested to reduce over 110 kt of speed in under four minutes. The flight crew reduced the speed from 280 kt to just below 200 kt in this time, having flown approximately 18 NM.

Guidance from the Flight Safety Foundation (2009) suggested deceleration on a 3° glideslope is difficult for an aircraft in a clean configuration (gear and flaps up), and can be around 10-20 kt per nautical mile with approach flaps and landing gear down. Additional deceleration can be achieved with deployment of speed brakes.

Head-up display

The head-up display (HUD) is one of the major differences between the Boeing 777 and 787 aircraft. Pilots completing a conversion course between the aircraft must complete training on HUD use, and are required to maintain currency in its use. Both pilots had completed this training.

Gibb, Grey and Scharff (2010) explain:

A head-up display projects aircraft status information to pilots to minimise their head-down time and allow more time to view the external scene outside the aircraft.

They note that the HUD is:

designed to remedy the problems associated with pilots shifting lens accommodation as they changed their gaze from close cockpit displays to far outside environmental objects.

While generally beneficial for flight crew in maintaining situational awareness, one issue which can arise with HUD use is that pilots cannot focus on both the HUD information and the outside environment simultaneously, and attention may become focused on one to the expense of the other (Crawford and Neal 2006, Nichol 2015). Wickens et al (2013) identified research showing that pilots using a HUD may be slower at identifying and responding to an unexpected event than when shifting focus between a scan of the primary flight display and the outside environment.

Additionally, as HUD displays are monochromatic, the way standard alerts displayed on the primary flight appear in colours such as green, amber and red are changed for display on the HUD (FAA, 2010). Nichol (2015) stated:

This results in the removal of a layer of information normally provided by colour coding. While the use of identical symbology and similar layout mitigates this somewhat, lack of colour is nevertheless something that pilots will take some time to adjust to.

Communication

At the time of the localiser and glideslope capture, the first officer was the pilot flying and the captain was the pilot monitoring.

In the sequence of events provided by the operator, the captain noted the aircraft was getting low, and instructed the first officer to stop the descent. The first officer reportedly did not take action at this time, as he was assessing the cautions displayed on the PFD and EICAS.

The Captain then took over flying duties from the first officer and arrested the descent. At this time, the first officer called for a go-around either two or three times. After the aural glideslope alert was sounded, the captain increased engine power and commenced the go-around. Flight data indicates that this occurred just prior to 1745.

The flight crew identified later that some standard procedural calls on the approach had been omitted during the first approach.

The approach controller coordinated handover of OJC with the tower controller between 1743 and 1744, advising that he had instructed the flight crew to reduce to minimum speed, and that there was minimum spacing between OJC and the previous aircraft. The flight crew were then instructed to change to the tower frequency. Thirty seconds later, the tower controller called the approach controller to say that the aircraft looked low. The approach controller advised that communication with the aircraft had already been transferred to the tower controller.

At 1745, prior to the go-around call from the crew, the tower controller instructed the flight crew of OJC to check altitude. At this point the crew had commenced the go-around.

Related occurrences

Subsequent Scoot occurrence

On 20 April 2016, another Scoot Boeing 787-9, registered 9V-OJD, also experienced a glideslope anomaly on the runway 21 ILS approach to Perth Airport.

In this occurrence, the flight crew observed a fluctuation of the glideslope indications, which was followed by an unusual pitch-down of the aircraft and an abnormally high rate of descent of about 1,400 fpm. The flight crew recognised the abnormal flight director commands as being the result of a glideslope disturbance, due to safety information released by the operator to their crew following the 4 December 2015 event. The autopilot was disconnected and the aircraft hand-flown to regain and maintain the appropriate flight path. The glideslope signal returned to normal function a short time later and the remainder of the approach and landing were uneventful. Following the landing, air traffic control informed the flight crew that an aircraft had departed from Runway 21 while the Boeing 787 was conducting the approach.

Both the ATSB and Boeing analysed the aircraft flight data and determined the event to be similar to the occurrence on 4 December 2015.

Other similar occurrences

A search of the ATSB database showed a number of similar occurrences had been reported to the ATSB in the five years from the start of 2015 to the end of 2019. These occurred across Australia, including on Runway 21 at Perth Airport. In most of these events, it was identified that an aircraft was taxiing, or taking off during the time of the glideslope or localiser interruption.

ATSB Investigation AO-2017-023

On 12 February 2017, a Boeing 747-47UF (freighter) aircraft was operating from Honolulu, United States to Sydney, Australia. The captain was the pilot monitoring (PM), and the first officer was the pilot flying (PF) . Shortly after the turn onto the final approach, the PF called ‘glideslope captured’ and the aircraft started to descend. However, the PM’s primary flight display was still showing the aircraft below the glideslope.

The PM crosschecked the PF’s display and noticed the glideslope was captured, then checked their own display and noticed there was a failure flag displayed for the glideslope. The PM again crosschecked the PF’s display, noticed there was a failure flag for the PF’s glideslope, and instructed the PF to disconnect the autopilot and stop the descent. During this process, a minimum safe altitude-warning alert appeared for the air traffic controller, who instructed the flight crew to conduct a go-around. At the time the 747 intercepted the localiser, another aircraft was on the taxiway within the ILS critical area.

__________

7. The critical area is a volume of airspace encompassing lateral and vertical dimensions based around the localiser and glideslope antennas to protect the ILS signal transmissions to airborne aircraft in poor weather.

Safety analysis

The aircraft’s descent below the approach path glideslope occurred in daylight visual conditions following a disturbance to the glideslope signal. This analysis will examine the likely source of the glideslope disturbance, subsequent autopilot operation, and factors that contributed to the abnormal descent profile.

Glideslope disturbance

The glideslope signal disturbance occurred at about the same time that a Boeing 737 aircraft taxied and departed on runway 21. As the movement of that aircraft was in the vicinity of the ILS critical area, it was likely that this aircraft’s proximity to the antenna as it entered and lined up on the runway caused the interference to the glideslope signal.

As this event occurred in day visual flight rules conditions, and 9V-OJC was outside the outer marker of the approach when the disruption occurred there was no requirement for air traffic control to protect the ILS critical area. While weather conditions did not require the conduct of an instrument approach, it was normal for all international aircraft arriving at Perth to be sequenced via the prevailing runway instrument approach.

Approach flight path

The glideslope signal disturbance caused the autopilot flight director system (AFDS) to capture the glideslope prematurely. When an anomaly between the aircraft’s expected and actual flight paths was detected, the system by design entered into a degraded mode of operation.

The speed of the aircraft was high (206 kt) at the time the aircraft entered the degraded mode. As the descent rate required to maintain the designed glideslope is directly proportional to the speed of the aircraft, the calculated descent rate at that point in time was also relatively high. In the degraded mode, the AFDS maintained the aircraft in an attitude-stabilising mode, and in this case, with a higher-than-required descent rate. As the speed of the aircraft reduced, the difference between the required and actual descent rate increased.

A review of the recorded data indicated that glideslope mode failure indications appeared on both the primary flight displays and the head-up displays, however the flight crew did not recall seeing this initially. In addition, an ‘AUTOPILOT’ caution message should have been displayed on the engine-indicating and crew‑alerting system, but again the crew did not see this at the time. As they did not notice any warnings, the crew continued to descend as per the displayed flight director information. The crew reported they only observed the indications after hearing the aural ‘GLIDESLOPE’ caution.

Recorded flight data indicated that the crew manually disconnected the autopilot, and deselected and reselected the flight directors after the autopilot entered the degraded mode, when the aircraft was at 2,150 ft. The flight crew did not recall these actions, likely due to the workload at the time.

The actions of disconnecting the autopilot and re-selecting the flight directors re-set the AFDS, resulting in localiser (LOC) and vertical speed (V/S) modes becoming active with the glideslope (G/S) mode armed. However, as the aircraft’s flight path was diverging below the glideslope, the glideslope approach mode did not become active.

Based on analysis of the recorded flight data, it appears that, following autopilot disconnect and re-selection of the flight directors, the flight crew did not confirm the activation of the glideslope approach mode. As the aircraft was diverging below the glideslope in V/S mode, the glideslope mode remained in the armed (white) mode and not the active (green) mode. Consequently, rather than providing guidance to maintain the glideslope, the flight directors were providing guidance to maintain the descent rate approximate to that which existed when the modes were reselected.

This led to a descent rate about 1,000 feet per minute higher than was required for the approach, and in excess of the permitted rate of descent to comply with the operator’s stabilised approach procedures. Based on the flight path flown, it appears likely the flight crew misinterpreted the flight director commands as guidance to maintain the glideslope.

Workload

Periods of high workload are a normal function of the various stages of a flight, particularly during take-off, approach and landing. Workload during these periods is managed by following standard operating procedures and effective communication and teamwork, both between the pilots and with air traffic control.

While pilots are trained to operate under a range of conditions, familiarity and recency with an aircraft type can affect a pilot’s ability to manage these high-workload situations. The pilot flying had experience on the Boeing 777, but had only been operating on the Boeing 787 for a few months, and was likely still developing expertise specific to this aircraft type.

The Boeing 787 was also the first aircraft where the pilot flying had experienced using a head-up display. While head-up displays have been identified to be preferred by pilots over traditional head-down displays, they are known to have a potential inattentional blindness effect, meaning that pilots may inadvertently focus on one piece of information to the detriment of others (Gibb, Grey and Scarff, 2010).

The high-speed descent clearance given to the crew of OJC, while not unusual, was continued below the operator’s normal limit of 5,000ft. The air traffic controller directed the crew to use ‘desired speed’, an instruction that permitted the crew to reduce speed, but the flight crew did not slow the aircraft. The crew only began slowing the aircraft when cleared for the approach. This put OJC closer to the proceeding aircraft and, to ensure separation was maintained, the controller directed the crew to reduce speed to 170 kt, then to minimum speed. This was a relatively large speed reduction, to be completed in a limited time, which resulted in a further increase in workload for the crew.

The high-speed descent and subsequent high-speed approach also meant that there was limited opportunity for the crew to identify any abnormal attitude changes associated with the glideslope disturbance. In interview afterwards, remarks by the pilot flying about being mindful of the need to slow down, the deviation from normal speeds, the time taken to process the meaning of indications displayed on the HUD and PFD, and the communication and control changes between the crew were likely indicative of a higher-than-normal workload.

About 25 seconds after capturing the glideslope, the autopilot was manually disconnected and the pilot monitoring (captain) made several rapid changes to the flight directors and approach modes. Those actions appear to have been performed in response to the unusual indications displayed following the glideslope disturbance. They also appear to have been actioned without the usual action and confirmation as required by normal standard operating procedures.

As a consequence of not confirming the status of the reselected modes, both flight crew members appear to have experienced a degree of autopilot and flight director mode confusion. The crew incorrectly assumed that the correct glideslope information was being displayed, and did not notice any indications to the contrary. The high workload may also explain the discrepancy between when the flight crew thought they disconnected the autopilot and when the recorded data indicated the disconnection occurred.

Reports from the flight crew that they missed making, and/or did not hear some of the required standard approach calls, including the altitude crossing check at the outer marker, indicate some task-shedding occurred due to the high workload.

Findings

From the evidence available, the following findings are made with respect to the flight below minimum altitude involving Boeing 787, registered 9V-OJC, on 4 December 2015.

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The aircraft prematurely captured the runway 21 glideslope as a signal anomaly occurred, most likely caused by another aircraft taxiing to take off on the same runway. This resulted in the autopilot flight director system reverting to a degraded mode of operation.
• Following disruption to the glideslope, the crew descended the aircraft unaware that the information they were following was taking them below the ILS glideslope, leading to activation of the aircraft's ground proximity warning system.
• The flight crew were likely experiencing higher than normal workload, due to a combination of the high speed approach and troubleshooting the unexpected glideslope indications. This reduced the effectiveness of cockpit communication and delayed correction of the aircraft’s low altitude.

Safety issues and action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Scoot

As a result of this occurrence, Scoot has advised the ATSB that they communicated the essential elements of this event and the associated autopilot flight director system implications and primary flight display and head-up display (HUD) indications to the pilot group. Pilots have been reminded to monitor the basic flight instruments and relevant check heights during the approach, alongside the aircraft calculated parameters. Stabilised approach criteria and associated callouts and actions have also been emphasised, and the importance of energy management and use of the HUD to monitor appropriate descent path information have been highlighted.

This communication assisted the captain in the event on 20 April 2016 in identifying the glideslope disruption shortly after it occurred.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the crew of 9V-OJC
• Scoot
• Airservices Australia
• Boeing.

References

Airservices Australia (2015), Safety Bulletin – Standard Terminal Area Arrival Speeds. 23 January 2015.

Crawford, J and Neal, A (2006), A Review of the Perceptual and Cognitive Issues Associated with the Use of Head-Up Displays in Commercial Aviation. International Journal of Aviation Psychology, Volume 16, Number 1 pp 1-19.

Federal Aviation Administration (2010); Advisory Circular AC-25.1322-1 Flightcrew Alerting. US Department of Transportation, Federal Aviation Administration.

Flight Safety Foundation (2009), Approach and Landing Accident Reduction Toolkit Briefing note 4.2 – Energy Management. Flight Safety Foundation.

Gibb, R, Gray, R and Scharff, L (2010), Aviation Visual Perception. Ashgate, United Kingdom

International Civil Aviation Organisation (2018); Annex 10 – Aeronautical Telecommunications Volume 1 Radio Navigation Aids. Seventh Edition, July 2018. International Civil Aviation Organisation.

Nichol, RJ (2015), Airline Head-Up Display Systems: Human Factors Considerations. International Journal of Economics and Management Sciences, Volume 4, Issue 5.

Wickens, CD, Hollands, JG, Banbury, S and Parasuraman, R (2013); Engineering Psychology and Human Performance. Fourth Edition. Pearson Education.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the crew of 9V-OJC, the operator, Airservices Australia, Boeing, the Civil Aviation Safety Authority, the National Transportation Safety Board (United States) and the Transport Safety Investigation Bureau (Singapore)

Submissions were received from the operator, the Transport Safety Investigation Bureau (Singapore) and Boeing. The submissions were reviewed, and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 4 December 2015, the pilot of an Air Tractor AT-502B aircraft, registered VH-PTF, was conducting aerial spraying operations from Dalby Airport, Queensland.

The pilot had commenced duty for the day at about 0500 Eastern Standard Time (EST). At about 1200, the pilot took a short meal break. During the break, the pilot was provided with a map of the next area to be sprayed, which included a number of gas wells. Each gas well was on a gravel pad, with an antenna that posed a potential hazard to low-flying aircraft. The pilot was advised that there were no other known hazards, such as powerlines, in the area.

The aircraft was fuelled and 1,600 L of liquid chemical loaded into the aircraft hopper. The aircraft departed at about 1210, and tracked towards the field to be sprayed, which was about 13 NM to the south-west. The pilot then overflew the area to inspect the field, first at about 100 ft above ground level (AGL), then at about 50 ft AGL. The pilot noted the wells on the gravel pads, and verified that there were no powerlines in the treatment area. The pilot also saw a solar panel a short distance from a well, located in the crop and not on a separate pad (Figure 1). The pilot did not see an antenna at the site of the solar panel at that time.

Figure 1: Field showing well on gravel pad and solar panel

Source: Google earth – annotated by ATSB

The pilot elected to use the solar panel as a reference point and established a plan for the spraying. The aircraft then climbed and tracked a short distance away, and the pilot set up the GPS in readiness to commence the spray run.

The pilot commenced the first spray run, tracking towards the solar panel. As the aircraft came within about 20-30 m of the panel, the pilot noticed a pole behind the panel, protruding about 3 m above the crop, with an antenna on it. The pilot immediately conducted a climb to avoid the pole and antenna, but the aircraft struck the pole (Figure 2).

The pilot’s primary concern was to check that the aircraft was still controllable. The pilot conducted a climb to a safe height and checked the flight controls and all controls responded normally. The pilot could not see any damage to the aircraft or any fuel venting from the tanks. The pilot then checked the engine instruments and all indications were normal. There was a slight vibration, which the pilot assessed as possible damage to a panel on the airframe, or a blade of the spray pump used to disperse the load. The pilot therefore switched the pump off, but the vibration continued.^[1]

Figure 2: Bore with solar panels and pole (after collision)

Source: Aircraft operator

At that stage, the pilot decided that it was not necessary to dump the chemical load. The pilot decided to land as soon as practicable and assess the damage to the aircraft. They elected to return to Dalby, where there were emergency services available. The pilot broadcast on the UHF radio advising the company that the aircraft had struck a pole, was still flying normally, and would be returning to the airport. However, as the aircraft was relatively heavy, the pilot elected to spray about 500-600 L of the chemical, at a higher flow rate than normal, to reduce the load prior to returning to land.

During the return flight, the aircraft still had a minor vibration. The pilot overflew the runway at Dalby to check the wind direction and speed before joining the circuit. The pilot conducted the approach about 5 kt faster than normal, due to the weight of the aircraft and the unknown effect of the damage caused by the collision with the pole. The aircraft landed safely at about 1240, and the pilot was uninjured. The aircraft sustained damage to the left wing and the propeller (Figure 3).

Pilot comments

The pilot provided the following comments:

• Most of the gas wells had an antenna on a pole, similar to the one the aircraft struck, however they were of a considerable height and on a gravel pad. The pilot had assumed that the gas company equipment was located on gravel pads.
• The galvanisation on the pole had no shine and it blended into the background of the crop. A line of trees beyond the crop also made the pole difficult to see. It would have stood out more clearly against a blue background of sky.
• The solar panels were located on a ground water quality bore, with the (pole and) antenna for satellite transmission.
• Pilots from the same company had previously conducted spraying operations in that field, but the pole had not been in place then.

Figure 3: Damage to propeller (left) and wing damage (right)

Source: Aircraft operator

Safety message

This incident highlights the importance of communication in identifying risks for low-level flying operations. Additionally, unknown hazards can be very difficult to see. The use of clearly visible markings may help pilots identify hazards during a field inspection. Pilots can then make a plan to avoid them during spraying operations.

The ATSB report Wirestrikes involving known wires: A manageable aerial agriculture hazard, cautioned pilots to conduct an aerial reconnaissance to confirm the location of wires and other hazards. Having a plan and a procedure to minimise the risk of collision with hazards is a valuable mitigation strategy. Further risk management strategies for agricultural operations are detailed in the Aerial Application Pilots Manual.

Aviation Short Investigations Bulletin - Issue 47

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The aircraft was fitted with a wind-driven spray pump. Occasionally a blade can separate and cause vibration. If the pilot switches the pump off and the vibration ceases, they have isolated the source of vibration,

Safety summary

What happened

At about 2106 Eastern Standard Time, on 16 November 2015, a pilot boarded Madang Coast for its transit into Townsville, Queensland. The master and pilot completed the master-pilot information exchange, which included the berthing plan at Berth 10. As the ship approached the berth, the first line ashore, the forward spring, was looped over a bollard on Berth 10. The forward mooring party made two turns around the first post of the bitts and held onto the spring line. However, shortly after, as weight came onto the line, the line slipped on the post and fell slack.

Madang Coast started moving off the berth towards a ship on the opposite berth. Despite repeated efforts to hold on to the line, it continued to fall slack. Subsequently, Madang Coast‘s bow made contact with the shore end of Berth 10 and its port quarter with the ship on the opposite berth. Both ships sustained minor damage and there were no injuries.

What the ATSB has found

As Madang Coast came alongside the wharf, the forward spring line slipped and could not be used to manoeuvre against. After the spring line slipped, the distance from the stern to the wharf was too far for the aft mooring party to throw any heaving lines ashore. Hence, the stern’s movement away from the wharf continued.

The shipping agent requested a tug reduction for the ship’s berthing. The acting regional harbour master, pilot manager and the ship’s master were all unaware that the agent’s application was made without the master’s knowledge.

The pilotage service did not have documented guidance procedures for berthing or any associated contingencies. The risk management processes were not sufficiently mature nor resilient enough to effectively identify and mitigate risks in pilotage services.

What's been done as a result

The Port of Townsville Limited (POTL) Pilotage Services has completed a review of, and subsequently updated and fully implemented a safety management system (SMS). The SMS included detailed berthing, operations and emergency procedures amongst others. The qualifications and training requirements for licensing pilots for the number of observation, supervised and check trips have significantly increased.

The tug reduction requesting procedure has been updated and now requires a declaration by the ship’s master that an assessment of the intended manoeuvre(s) to and/or from berths have been undertaken.

Safety message

Risk management issues associated with the safe pilotage of ships are commonly known by all parties involved. However, the reality as opposed to the hypothesised scenarios are not always understood nor acted upon. Numerous incidents and their subsequent findings already provide the answers to many of retrospective questions that are asked. Where internal risk management processes may fail to address those questions, forward thinking can. Effective risk management systems and processes can lead to the identification, collation and assessment of found hazards, and, thus, provide the most appropriate mitigation measures.

The occurrence

At 1636 Eastern Standard Time^[1] on 13 November 2015, the 105 m general cargo ship Madang Coast arrived at the outer anchorage, Townsville, Queensland, from Port Moresby, Papua New Guinea. At 1930 on 16 November 2015, the ship weighed anchor and started its approach towards the Townsville Harbour pilot boarding ground (Figure 1). The bridge team consisted of the master, the chief mate as the officer of the watch (OOW), and a seaman as the helmsman.

Figure 1: Section of navigational chart Aus 257 showing Madang Coast’s track into Townsville Harbour

Source: Australian Hydrographic Service, annotated by the ATSB

At 2106, a Townsville pilot boarded Madang Coast and was escorted to the bridge, where he asked the master for full ahead manoeuvring speed (Appendix A). The master and pilot then commenced the master-pilot information exchange. During the exchange, they discussed information regarding the ship, the inward passage and the berthing plan.

The agreed berthing plan involved a bow-in shallow angle approach, to berth starboard side alongside, without a tug or a lines boat.^[2] The ship would approach the wharf with minimum headway and the forward mooring party would run a forward backspring line as the first line ashore. With tension on the spring line and rudder hard-over to port, this should bring the ship in bodily, parallel to the berth. The aft mooring party would then run a stern line ashore to control the stern. The remaining mooring lines would then be run ashore forward and aft.

The master relayed the berthing plan to the second mate via his UHF radio. The second mate was in charge of the forward mooring party, consisting of himself, the bosun and a seaman. He acknowledged the instructions.

At 2146, Madang Coast entered the harbour basin at a speed of 5 kt.^[3] The pilot continued to reduce the speed as he manoeuvred the ship across the harbour to Berth 10. By 2149, with the speed at 3.6 kt, the pilot asked for stop and shortly after asked for dead slow astern. At 2151, with the ship just over two cables^[4] from the berth, the pilot asked for slow astern with the speed now 3.2 kt.

Figure 2: Madang Coast’s approach to Berth 10 showing times at each position

Source: Australian Hydrographic Service, annotated by the ATSB

At about 2153, the pilot advised the master he could see the bridge marker on the wharf, the approximate position of the ship’s bridge when the ship was in its final position alongside. Shortly after, stevedores waiting on Berth 10 for the ship’s arrival advised the pilot via VHF radio that the ship’s bow had just entered the berthing pocket. At that time, the wind was from the north at about 11 to 16 kt.

At 2156, the pilot asked for stop and the master set the ship’s controllable pitch propeller (CPP) to zero pitch with about 100 m to run ahead (Figure 2 and Figure 3). Madang Coast was now parallel to, and about 15 m off the wharf, at a speed of 1.8 kt. Shortly after, when the bridge marker was about midships, the ship’s stern started to slowly move away from the wharf.

At 2157, with 25 m to run ahead, the pilot used astern pitch to further reduce the ship’s speed. About 30 seconds later, the forward mooring party threw a heaving line^[5] ashore and started running out the forward spring line as the stevedores heaved it ashore.

Figure 3: CCTV images of Madang Coast’s attempted berthing at Berth 10

Source: Port of Townsville, annotated by the ATSB

Shortly after 2158, the line was ashore and was looped over a bollard on Berth 10. The CPP pitch was reduced to zero, with the ship’s speed now at 0.8 kt ahead. The master then informed the second mate to hold on to the forward spring line. The second mate relayed this to the bosun and seaman and they made two turns around the first post of the bitts^[6] and manually held onto the working end of the line. At about 2159, as weight came on the forward spring line, the ship’s bow began to pivot towards the wharf. Shortly after, the spring line slipped on the bitts and it fell slack. The bow continued to pivot towards the wharf and the stern continued to move away from it.

At 2201, with the wind effect acting on Madang Coast’s accommodation block at the stern of the ship, the stern drifted away from the berth and towards an oil/chemical tanker (Lynda Victory), on the opposite berth. The master instructed the second mate to hold on to the spring line again and the pilot requested tug assistance from the Townsville vessel traffic service (VTS). About 30 seconds later, tension came on the spring line but only for a short time before it fell slack again.

By that time, the pilot and master could see that the spring line was not holding, and they thought the windlass drum end brake had slipped. The master instructed the second mate to take up the slack and hold onto the mooring line. As the spring line was on the bitts, not the drum end, any slack needed to be heaved in manually by the forward mooring party. This was not an easy or quick task, and as the ship continued to move ahead, more line continued to pay out.

Over the next minute, the pilot and master waited for the slack to be taken up and line secured. During this time, the ship’s stern moved further from the wharf, due to the action of an astern movement and the wind effect. When the forward mooring party finally heaved the spring line in manually, the tension came on the line momentarily, and then it started paying out again.

The master then instructed the second mate to take up the slack, and for the line to be heaved in again. The forward mooring party then removed the line from the bitts and manually carried it to the windlass drum and started heaving the line in. However, as weight started to come on the line, it slipped again once on the drum end. The ship continued to move away from the wharf.

At 2202, the pilot tried to recover control and used ahead pitch with full port rudder to bring the ship back towards the berth. However, the spring line continued to slip and pay out. As the ship continued to close on the shore end of Berth 10, the pilot ordered the port anchor to be dropped, and held on the brake at one shackle.^[7]

At 2203, the port anchor was let go and held on the brake. Immediately thereafter, the crew also let go the starboard anchor. By 2205, Madang Coast’s bow had made contact with the shore end of Berth 10 and its port quarter with Lynda Victory. The port quarter moved a short distance aft along Lynda Victory’s hull, coming to rest at 2207 and remaining in this position awaiting the arrival of the tug (Figure 4).

At 2242, a tug arrived off Madang Coast’s starboard quarter and by 2306, the ship was all fast alongside Berth 10 without further incident.

Upon inspection, it was found that Madang Coast and Lynda Victory both received scrape marks and small indentations to the shell plating. Minor damage was also found along the edge of Berth 10 where Madang Coast’s bow had made contact. On 17 November 2015, the ship’s classification society surveyed Madang Coast and found minor indentations that did not affect its structural integrity. The ship subsequently sailed from Townsville on 18 November 2015.

Figure 4: Madang Coast in contact with Lynda Victory and the wharf

Source: Port of Townsville

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Lines boat, a boat used to transfer berthing lines from ship to shore.
3. One knot, or one nautical mile per hour equals 1.852 kilometres per hour.
4. One cable equals one tenth of a nautical mile or 185.2 m.
5. A heaving line is a small diameter rope attached to a mooring line. It has a weighted end that is thrown to the shore allowing the mooring line to then be pulled across.
6. A rectangular base welded to the deck of the ship, upon which two vertical bitts are welded.
7. One shackle equals 90 ft or 27.43 m.

Context

Madang Coast

At the time of the incident, the 105 m Madang Coast was registered in Papua New Guinea, classed with DNV GL, and managed by Consort Express Lines, Papua New Guinea. The ship had a crew of 15, consisting of a Sri Lankan master and 14 Papua New Guinean nationals.

The master had 18 years of seagoing experience and held a master’s certificate of competency. He had sailed as master for 1 year on a sister ship to Madang Coast, with frequent port calls into Townsville. He had joined Madang Coast about 3 months before the incident.

The second mate had over 5 years of seagoing experience and held a watchkeeping deck officer’s certificate of competency. He had joined Madang Coast about 10 months before the incident.

The bosun had 30 years of seagoing experience and had sailed as bosun for 15 years. He had joined Madang Coast about 4 months before to the incident.

Propulsion

Madang Coast was fitted with a left-handed turning^[8] controllable pitch propeller (CPP) which rotated at a constant speed, in the same direction. Ahead and astern movements were controlled by adjusting the degree of pitch applied to the propeller blades.

During an astern movement, the propeller creates a transverse force on the ship’s hull, commonly called cut. Consequently, the stern would move to port causing the bow to sheer to starboard. As the astern pitch increased, this effect would also increase.

Further, when the pitch is set at zero, the equivalent of ‘stop’ for a fixed pitch propeller, Madang Coast would creep slowly ahead. These characteristics had been noted on the pilot card:

Bow swings to starboard when astern propulsion. Vessel creeps ahead when pitch is set at ‘0’.

Madang Coast was also fitted with a 280 kW bow thruster and a Becker rudder.^[9]

Mooring equipment

Madang Coast’s forward mooring deck equipment and fittings consisted of two windlass drum ends,^[10] two pedestal rollers^[11] and four twin bollard bitts (Figure 5). The mooring plan usually involved using five mooring lines forward (three head lines and two spring lines) and five mooring lines aft (three stern lines and two spring lines). The head lines and stern lines were heaved in by taking turns around the rotating drum end and then manually pulling on the line to create friction for it to grip the drum.

A spring line was usually the first line ashore and held onto (prevented from paying out) by making at least two turns around one post of twin bollard bitts. The remaining spring lines were tensioned using the same method as for the head/stern lines.

When in position alongside, each mooring line was made fast by making six complete turns around one post on a set of bitts. However, due to the limited number of bitts, two lines were made fast on the same set of bitts.

Figure 5: Mooring deck equipment

Source: ATSB

Port procedures

Maritime Safety Queensland (MSQ) is responsible for improving maritime safety for shipping and recreational craft through regulation in Queensland, amongst other functions. The Transport Operations (Marine Safety) Regulations 1994 describe the pilotage areas. A Regional Harbour Master (RHM) controls the pilotage areas within their region and has the authority to direct the master of a ship to navigate or operate a ship in a prescribed way.

Each pilotage area has a Port Procedures and Information for Shipping Manual. The manual details mandatory regulations, procedures, and services to be observed. The manual also contained guidelines and information to assist masters, owners and agents of ships arriving and departing the area.

In Queensland, an online booking and port movement information website, Queensland Shipping Information Planning System (QSHIPS), is used to book any shipping movements. Shipping agents are required to enter ship arrival details, such as berthing information and tug requirements, directly into the booking system, at least 48 hours in advance.

MSQ’s vessel traffic services (VTS) manage the system and are responsible for updating QSHIPS as changes occur. They are responsible for informing relevant personnel such as pilots, tug and lines boat crews and port marine services of any changes.

Port of Townsville operations

The Port of Townsville is the third largest port in Queensland and averaged 1,440 vessel movements and 12 million tonnes of cargo per annum. That is more than 75 per cent of the state of Queensland’s metals cargoes and more than 12 per cent of the state’s total international cargo trade.

Townsville Inner Harbour

Berth 10 (Figure 6) was located on the western side of the harbour and formed a finger pier between Ross Creek and Berth 9. Due to its proximity to Ross Creek, ships approaching the berth pocket may be affected by tidal streams flooding and ebbing into and out of the creek. Berth 10 was designed as a roll-on/roll-off, and general cargo berth for ships up to 300 m.

Figure 6: Townsville Inner Harbour

Source: Maritime Safety Queensland

Tugs

Two tugs were available for towage in Townsville. Shipping agents booked tugs on behalf of ships’ masters via the QSHIPS programme for which they were charged a fee for service. Outside of normal working hours, the tugs were not manned, unless a booking had been made.

MSQ’s Port Procedures^[12] detailed tug usage guidelines^[13] for the Port of Townsville. The number of tugs required was determined by the berth, the ship’s length and if it was to be swung prior to berthing. For Berth 10, a ship of Madang Coast’s length and berthing starboard side alongside required one tug.

However, ships with operable and efficient thrusters and/or enhanced ship-handling capabilities could have the tug requirements reduced. During a ship’s first inbound transit, a pilot would assess and make recommendations for subsequent transits to the RHM for consideration. As Madang Coast was fitted with a bow thruster and Becker rudder it met the requirements of enhanced manoeuvrability and hence had an allowable tug reduction from one to no tugs.

Tug reduction request

The Port of Townsville Limited (POTL) Pilotage Services’ Standard Operating Procedures (SOPs) provided the following guidance for ordering of tugs:

It is not a Pilot’s responsibility to order tugs.

VTS advise agents of tug requirements in accordance with the Port Procedures Manual and the order is made directly by the agents to the tug company for the port. Variations in addition to the prescribed for a particular job are at the pilot’s discretion.

Any reduction to the prescribed no [number] of tugs for a movement has to be approved by the RHM.

Therefore, when a pilot determined the use of a tug was required, they were able to use their discretion to request it. This decision could be taken either after reviewing the daily shipping schedule, on the way to the ship or upon boarding it. However, there would be a delay to the berthing, as if the tugs were not ordered for a specific shipping movement then they were not manned nor on standby. The delay could be up to 2 hours before the tugs were available. These delays, along with the associated commercial pressures of turnaround times and tug costs are among the many factors that can influence the decision-making process.

On 13 November 2015, three days prior to the berthing, the shipping agent submitted a request to the RHM for a tug reduction for Madang Coast’s 16 November 2015 berthing. The shipping agent did not consult the ship’s master about this request, nor was he required to at that time.

The acting RHM (ARHM) consulted the port guidelines and Madang Coast met the requirements for a tug reduction:

An operable and efficient Bow / Stern thruster: means a fully operational, sufficiently immersed bow thruster, adequately powered relative to ship’s size and prevailing weather conditions.

He then discussed the application with the pilot manager and it was agreed that the ship could berth without the use of a tug. The ARHM granted the reduction and the shipping agent was notified. The shipping agent updated QSHIPS and the shipping schedules, which were sent out twice a day, noted that Madang Coast was to berth without a tug.

Lines boats

A lines boat is a small vessel that is used to tow mooring lines from the ship to the wharf when the distance is too great for the crew to use a hand-thrown messenger line or the mooring line is to large or heavy to be easily handled manually.

MSQ’s Port Procedures stated, amongst others, that a lines boat was required for the following cases:

all ships with an LOA [length overall] >150m at berth 10

all vessels berthing without tugs (with or without thrusters) – use of a line[s] boat is at the discretion^[14] of the pilot berthing the vessel.

Pilotage

On 2 November 2013, the responsibility for the management and delivery of pilotage services in Queensland ports was transferred from MSQ to the various port authorities. Pilotage Services, now a division of the POTL, managed and provided the pilotage services in Townsville. Ownership of the application and approval process for pilot licences and exemptions remained with MSQ. Pilotage was compulsory for all ships over 50 m, unless the RHM had issued an exemption.

Pilot training content and approach

At the time of the incident, a pilot’s training consisted of theoretical and practical observation, study and assessment. MSQ issued training requirements^[15] that specified what training had to be completed for each level^[16] within each area endorsement (Appendix B). POTL Pilotage Services provided the training and practical assessments. The RHM assessed the theoretical knowledge and issued the pilotage certificate. The pilotage certificate consisted of a licence valid for 5 years, and an area specific endorsement, valid for 2 years.

Each level of pilotage, from trainee (level 4) to unrestricted (level 1), required the pilot to complete a number of observation trips of qualified pilots conducting trips at that level. They were then required to conduct trips under supervision, and then check (assessment) trips.

Additionally, every pilot, at intervals of less than 2 years, had to undertake a check (assessment) of two pilotage trips (an arrival and departure) with a licenced check pilot. Further, after an incident, or if a pilot expressed a concern about berthing, they were sent on observation trips with other pilots.

The pilot

The pilot assigned to Madang Coast held a current foreign going master’s certificate of competency, an unrestricted pilot’s licence, and a check-pilot^[17] licence for Townsville. He had 12 years’ experience at sea and a further 10 years of pilotage in various Australian and New Zealand ports prior to joining MSQ in 2011.^[18] He had piloted Madang Coast and a sister ship into and out of Townsville on numerous occasions.

Pilotage Services procedures and guidance

The Ports Australia Australian Port Marine Safety Management Guidelines (2015) provided a framework to encourage systemised evaluation of risk, and suggest ways to address and minimise the risk. The Guidelines were not considered a regulatory requirement, rather, they represented a ‘good practice’ framework for a Port Marine Safety Management System (SMS). These guidelines recommended the following:

Ports should develop standard berthing plans containing minimum agreed requirements following consultation with affected parties

It was also recognised in the guidance that passage plans were subject to change and it was important not to constrain a master or pilot’s need to react to unforeseen circumstances.

Pilotage Services Safety Management System

In 2011, the Townsville pilotage services, then part of MSQ, developed a Pilotage SMS (PSMS) for the Townsville Pilotage Services. At the time of the occurrence, the SMS document (and therefore the berthing guidelines within) had not been approved, as some of the pilots and the pilot manager disagreed with aspects of it. Therefore, there was not an approved working document, and it remained as a draft format.

In August 2013, an audit of the Townsville Pilotage Service’s 2011 draft PSMS was completed 2 months before MSQ divested itself of pilotage services. The RHM noted that documented procedures for deviating from the passage plan, contingency plans and emergency situations for the pilotage area were in the process of being developed. Further, with reference to the 2011 draft PSMS, they noted the document presented had not been formally adopted by Townsville Pilotage Services as it was still under review prior to adoption.

In 2014, POTL Pilotage Services’ SOPs were implemented, which included elements of the 2011 draft PSMS. The SOPs detailed reference material, duties and responsibilities and passage plans amongst others. In a November 2014 audit, the RHM again recommended the POTL Pilotage Service to develop documented procedures for contingency plans and emergency situations, this time through the pilot meeting minutes. In addition, with regard to emergency situations, the audit also recommended that pilots discuss various scenarios during pilot meetings. This was to develop awareness and identify options to consider in the event of an emergency once past the point of no return.

In November 2015, an audit was completed 11 days prior to the incident. The RHM noted the POTL Pilotage Service now operated under the POTL’s existing SMS.^[19] It was also noted that procedures were in place for deviating from the passage plan and that the procedures for emergency situations were discussed and documented at pilot meetings in the minutes. However, the RHM recommended that the POTL document standard operating procedures for emergency situations during pilotage.

Berthing manoeuvre guidance for Berth 10

At the time of the incident, there was no published guidance in the SOPs for berthing ships in Townsville. The only guidance for berthing a ship was detailed in the 2011 draft PSMS. The draft PSMS included guidance for when swinging a ship to port or starboard when berthing port side alongside. Additionally, when no swing was required, the ship was to be berthed starboard side alongside.

General guidance from the draft PSMS for berthing at Berth 10 included:

Smaller vessels, berthing without tugs, often berth starboard side to (head in) to the berth.

Due to the nature of the cargo worked and the size of the vessels that call at this berth tugs are often not required.

In general pilots require a shore end back spring line to be run first as this provides the potential to prevent the vessel from moving too far into the shore end of the pocket.

Specific guidance for berthing when no swing was required included:

Pilots vary the angle of approach to the berth allowing for:

1. prevailing conditions – wind direction and strength
2. tidal streams in and out of the creek
3. tug allocation and/or thruster/s and/or planned use of anchor/s
4. vessel speed.

Pilots reduce speed gradually and maintain heading using helm, thrusters, tug/s and/or anchors.

Once inside the pocket the vessel is positioned parallel to the berth and manoeuvred alongside using tug/s, thruster/s, the line’s launch and/or mooring lines.

Berthing method

Previous berthing methods

Madang Coast had berthed starboard side alongside at Berth 10 on six previous occasions in as many months without incident, and over 20 times in total. Three methods had been used to berth the ship during the previous 6 months (Table 1). The methods included dredging an anchor,^[20] using a tug, and using a forward back spring to manoeuvre against.

Table 1: Madang Coast’s berthing history at Berth 10

Source: POTL Pilotage Services, berthings between April and September 2015

It was not unusual practice for a tug not to be ordered when the wind was from the north, as the ship had berthed without incident on those occasions. However, on one arrival a tug was used as the tide was ebbing and the wind was from the south-east (acting on the ship’s beam, pushing the ship onto the berth).

The berthing method used by a pilot depended on a number of factors, such as wind direction and force, windage, draught, tidal conditions, use of a tug and/or lines boat and characteristics of the ship.

Pilot’s berthing plan

The pilot’s plan for berthing Madang Coast on 13 November 2015 involved approaching the berth at a shallow angle with minimal headway (Figure 7).

As the ship approached the berth, the forward mooring party were to run a forward back spring line and when instructed, hold onto the line.

As weight came onto the line, the forward movement of the ship would bring it slowly alongside. A short ahead movement of the ship’s propulsion and with the rudder hard-over to port would swing the ship’s stern in and the bow thruster could be used to maintain the bow’s position. Once alongside, the ship’s final position could be adjusted by using the head and stern mooring lines and/or main engine.

Figure 7: Planned berthing manoeuvre

Source: ATSB

Safety management

A safety management system can be defined as a planned, documented and verifiable method of managing hazards and associated risks. Key operational safety risks can be identified by incorporating processes and practices for:

• managing operational safety matters
• incident reporting
• holding regular meetings
• collation and analysis of safety information.

The benefits of doing so include an increased ability to identify, assess and mitigate safety risks. Relevant references such as the National Marine Safety Committee’s National Marine Safety Guidance Manual refer to risk management in SMSs:^[21]

The primary objective of a pilot organisation is to manage the risk to life, vessels, the environment within the port or pilotage area, during pilotage. A pilot organisations’ SMS should address all significant risks identified using a recognised methodology.

However, only the Townsville Pilotage Service’s 2011 draft PSMS included risk management guidance such as:

Every pilotage involves an assessment and the formulation of a plan in order to minimise and mitigate the risk inherent to the operation. For a majority of pilotage operations this risk is planned for and dealt with by adhering to Regulators legislation, terminal requirements and this PSMS.

Further, the 2011 draft PSMS also contained further guidance for ‘Operational Controls as Threat Barriers’.^[22] The guidance detailed that the barriers listed in the draft PSMS were not all of the available options and pilots should use any as required.

Safety reporting

The pilots were required to report all marine incidents^[23] and near misses to the pilotage manager as soon as practically possible. The Pilotage Information Management System (PIMS) was used to report marine incidents, other incidents not defined as a marine incident and other information.

PIMS was a voluntary reporting system for Australian ports. After a report was logged into PIMS, it was automatically distributed to all Townsville pilots and the pilot manager. The reports could also be sent to the RHM and the Australian Maritime Safety Authority (AMSA). The reported information could potentially benefit another pilot in the same port or other ports or alert the pilotage manager of action required regarding a vessel. Any PIMS reports raised were also added to the minutes of pilot meetings for discussion.

Pilotage meetings

Pilotage meetings were typically held every 2 to 3 months. The pilotage manager arranged the meetings and sent an agenda to all attendees. All pilots and the RHM were expected to attend and POTL managers and other guests were invited as required. Those who could not attend were noted as apologies. The meeting agenda generally covered administrative matters, port authority and berth updates, navigational issues, PIMS reports and, on occasion, contingency plan discussion points, amongst others. Meeting minutes were taken and promulgated to all attendees. In general, the minutes provided a brief overview of the agenda and any subsequent outcomes.

The pilot manager and RHM indicated that besides general issues, PIMS reports were discussed and anything of concern could be raised as an agenda item. They also outlined that the pilot meetings were used to discuss policies and to facilitate consultation with people outside of the pilot group.

Weather

At 1550 on 16 November 2108, the Bureau of Meteorology issued a Coastal Waters Forecast for the Townsville coast:

Winds: North-easterly 10 to 15 knots, reaching up to 20 knots offshore north of Cape Bowling Green in the evening. Winds decreasing to about 10 knots in the late evening.^[24]

At 2200, the wind speed at the entry to the Sea Channel was 13.7 kt from 004° and at Townsville’s airport^[25] was 10 kt from 010°.

Effect of wind

When a ship reduces speed and during berthing, the effect of the wind can create difficulties for a ship with an all aft accommodation (Figure 8). With the wind abeam or abaft the beam and the ship stopped in the water, the superstructure and funnel offer a cross-section to the wind. Further, the area of freeboard^[26] from forward of the bridge to the bow also needs to be considered. The centre of effort of the wind (W) acts upon the combination of these two areas and it is further forward than expected.

When considering the underwater profile of the ship, the position of the pivot point (P)^[27] is close to midships when stopped. The centre of effort of the wind and the pivot point are close together and the wind creates a minimal turning influence on the ship.

However, when the ship is making headway the pivot point moves forward but the centre of effort of the wind remains where it is. This creates a turning lever between P and W, and depending on the strength of the wind, the ship will develop a swing of the bow into the wind.

This effect increases at lower speeds as the pivot point moves further forward. Therefore, as the speed reduces the effect of the wind progressively increases.

Figure 8: Effect of wind with headway

Source: The Nautical Institute, modified by the ATSB

Previous occurrences

In September 2015, several months prior to the incident, a PIMS report had been raised for a ship’s contact with Berth 4. The ship had two tugs allocated for berthing due to generator issues. Strong south-easterly winds had been experienced leading up to the pilotage, with the wind from the south-east at about 20 to 25 kt. After boarding the ship, the pilot confirmed the tug attendance with the duty tug master.

However, during transit of Platypus Channel, the master of one tug informed the pilot that the other tug had been cancelled the previous day. The pilot then queried this with the Vessel Traffic Services Officer, who confirmed it, as the ship’s generator had been repaired the previous day. Hence, the ship had reverted to its normal tug allocation of one tug for a ship of her length. The pilotage continued without issue, but upon berthing the ship made contact with the wharf. The pilot attributed this to having only one tug for berthing in those wind conditions. He stated that he would have requested two tugs for berthing, but as the ship already had been allocated one tug, he did not make this request.

__________

8. When viewed from astern, looking forward, a left-handed turning propeller is seen to rotate anti-clockwise.
9. A spade-type rudder with flap. The Becker-type rudder has a moving flap on the trailing edge. When the rudder moves, a mechanical linkage diverts the flap to a higher angle to maximise the sideways thrust.
10. Drum ends are driven by a horizontal axle that is usually shared by a mooring winch or the anchor windlass.
11. A pedestal roller is generally used to change the direction of lead of a mooring or other line on deck.
12. Maritime Safety Queensland Port Procedures and Information for Shipping – Townsville.
13. Port Procedure and Information for Shipping – Townsville – July 2015, Section 9.
14. Pilots discretion was referred to in the draft PSMS as ‘variations in addition to the above guidelines are at the pilot’s discretion. Pilots are to exercise this discretion to ensure safety of the vessel i.e. during strong winds’.
15. Record of qualifications and training for Queensland Port Pilots for the Pilotage area of Townsville.
16. Area endorsement levels are based on ship lengths.
17. A check pilot is licensed under regulation as a pilot and is authorised to assess an applicant's competence to be issued a new or renewed Licence or Pilotage Area Endorsement.
18. At the time of employment, MSQ provided pilotage services in Queensland. His employment was transferred to the Port of Townsville Limited, when MSQ divested itself of its pilotage service division.
19. Document POTL 1023 R(2) Port of Townsville Pilot Services Standard Operating Procedures. R(2) introduced on 13 May 2015. R(3) was added to the quality document system in March 2016.
20. Term used to describe the towing of an anchor at a short stay.
21. The revised guidelines were developed by the National Marine Safety Committee (NMSC) in conjunction with Ports Australia, the Australian Marine Pilots Association and Marine Safety Queensland, in 2008.
22. Amongst others, the PSMS detailed the following as threat barriers: the generic passage plan, the ship’s passage plan, the master-pilot exchange, weather forecasts and warnings, pilot training and the PSMS. The latter two indirectly feed into enacting of contingency plans.
23. An incident resulting in the loss of a person from a ship, the death of a person, a collision, a stranding, material damage or danger of serious damage to a ship amongst others.
24. Cape Bowling Green is 65 km east by south of Townsville. The BoM defines evening as 1900 to 2000 and late evening as after 2100.
25. Townsville’s airport is approximately 7 km west of the port.
26. Vertical distance from the waterline to the upper deck.
27. The itinerant vertical axis about which a ship rotates during a turn.

Safety analysis

As the Madang Coast approached the berth, the first mooring line ashore was looped over a bollard on Berth 10. However, shortly after, as weight came onto the mooring line, it slipped on the post of the twin bollard and fell slack. Madang Coast started moving off the berth and the stern drifted towards a ship alongside, on the opposite berth. Despite repeated efforts by the ship’s forward mooring party crewmembers to hold onto the mooring line, Madang Coast‘s bow made contact with the shore end of Berth 10, and its port quarter with the ship on the opposite berth.

This analysis will examine Madang Coast’s berthing plan, the Port of Townsville Limited (POTL) Pilotage Services guidance for berthing, tug reduction processes and the procedures for pilotage risk management, contingency planning and pilotage best practice.

Guidance for berthing

Madang Coast’s berthing

The pilot assigned to Madang Coast prepared the Townsville Pilotage Plan for its arrival prior to boarding. The plan detailed the wind and tidal conditions, and that a forward spring line would be the first line ashore.

When the first line was run ashore, the forward mooring party made two turns around one post of twin bollard bitts. The mooring party commonly used this method and it required the working end of the line (free end) to be continuously manned and held on to by an operator to maintain tension. On this occasion, when tension came onto the line, the mooring party could not hold onto it and it started to pay out. During interview, the forward mooring party crewmembers stated this berthing was different to previous berthings, as the ship was coming alongside faster than they would normally expect.

The ship had approached the wharf at about 1.8 kt and astern pitch on the ship’s controllable pitch propeller (CPP) was used to reduce the speed to about 0.8 kt, when the spring line was run ashore. Consequently, the left-handed turning CPP led to the stern starting to cut to port and move away from the berth. Further, the effect of the wind progressively increased as the ship’s speed slowly reduced, exacerbating the movement away from the wharf.

The master instructed the second mate to pick up the slack in the line. He expected this would be achieved quickly, as he and the pilot had assumed the spring line had been run around a pedestal roller and onto the windlass drum end. However, the master and the pilot had a different comprehension of the situation to that of the forward mooring party.

Despite the repeated efforts of the forward mooring party to recover and hold onto the mooring line, the ship’s stern moved further from the wharf. Without the spring line to manoeuvre against, the ship’s movement went unchecked. Hence, it is likely that the ship’s approach speed in combination with the use of only two turns of the spring line around the twin bollard post contributed to the spring line slipping.

Contingency planning

Contingency planning is a risk management tool, which provides additional controls to avoid and effectively manage adverse events. Anticipation of, and preparation for, a possible event during the non-time pressured planning phase, makes the reaction to that event more effective. The reaction may then be one from a known and practised range of options, rather than an unknown, instantaneous reaction in an unexpected, time-pressured and stressful situation. Further, such planning allows for the identification of single points of failure, which can then be mitigated for they have a chance to occur. Learning only from real emergencies is not practical and therefore, should be enhanced through training, ideally simulation in a controlled environment.

At the time of the incident, the Port Procedures stated:

The master and pilot should exchange information regarding navigational procedures, local conditions and rules and the ship's characteristics. The proposed manoeuvres should be discussed with the master before commencing the pilotage.

The pilot is the local knowledge expert and is employed to conduct the ship because of this specific knowledge. Madang Coast’s pilot had prepared the pilotage plan for its arrival and detailed the wind and tidal conditions, that the spring line would be the first line ashore and that no tugs had been ordered. The pilot and master had discussed and agreed the berthing manoeuvre, using a forward spring line only. This was deemed a routine berthing and had been completed successfully without incident before. However, contingency plans were not detailed or discussed during the master-pilot exchange (MPX).

It was only after the spring line had continued to slip and the ship continued to move off the berth that the pilot considered contingencies. These included requesting a tug, dropping an anchor and running stern lines to control the stern’s movement. However, it would take considerable time for a tug to attend. In addition, stern lines could not be run ashore as the distance from the stern to the berth was now too far for lines to be run ashore nor was a line’s boat in attendance. Further, when the pilot instructed the master to let go the port anchor, the bow was too close to the wharf for the anchor to be effective in preventing the bow from contacting Berth 10. Consideration of single points of failure during the planning of the berthing, such as the spring line slipping, should have resulted in mitigations such as those listed above being in place earlier in case the planned for potential adverse event eventuated.

The berthing plan relied solely on the use of the forward spring line to manoeuvre the ship alongside. It had not been risk assessed nor had contingencies been considered. As a result, a single failure at such a late stage of the berthing meant that the incident could not be avoided.

Pilotage Services Standard Operating Procedures

Risk management

At the time of the incident, POTL Pilotage Services standard operating procedures (SOP) risk management process only referred to marine incident reporting and the use of Pilot Information Management System (PIMS). That is, the PIMS reports submitted by pilots were the main source of safety risk management. Although promulgated to all pilots, the reports were only discussed as a group during the pilotage meetings, which were held about every 2 to 3 months. Several pilots had questioned the effectiveness of PIMS as a safety reporting system. There was a perception amongst the pilots that the reports were infrequently logged, and could be used to highlight their own errors, or used as a punitive tool. Even so, the pilots were keen to see PIMS used more frequently, to report a wider range of safety issues and to learn from each other.

Between November 2013 and November 2015, the pilot meeting minutes show that PIMS reports were discussed. However, the minutes only included minimal information related to PIMS reports and did not include detailed outcomes or details of what was actually discussed. In addition, they did not record any discussion points arising from a PIMS report submitted 2 months prior to the incident, which involved a tug reduction and subsequent contact with a berth. Without detailed minutes of discussion points or incorporation of agreed outcomes into the SOPs, any learning opportunities remained with those at the meeting and were lost to those who could not attend.

Further, without structured processes to identify, collate and assess hazards and risks, there was a reduced likelihood of effective management of potential risks associated with pilotage. Therefore, at the time of the incident, the risk management processes were not sufficiently mature nor resilient enough to effectively identify and mitigate risks in pilotage services.

Berthing methods and best practice

At the time of the incident, there was no specific guidance for berthing methods nor manoeuvres, such as standardised berthing plans. There was a perception among several pilots that standardised berthing plans were the same concept as prescriptive methods. The imposition or enforcement of them may restrict the ability of a pilot to respond to an unplanned situation, as a pilot may then attempt to return to the standard plan, rather than adapt to an evolving situation.

All pilots were exposed to the different berthing manoeuvres used by other pilots during observation and supervised trips when undertaking an area endorsement. These trips enabled the pilots to observe their peers’ methods of berthing ships. They then either developed their own or followed other pilots’ techniques and methods. The area endorsements were seen as the main way to refresh the pilots’ knowledge. Hence, the pilots used a variety of individualistic berthing methods to berth ships in the absence of standard berthing plans.

Further, as pilots continued to progress through the competency levels, they could do so by using their own berthing manoeuvre preferences and hence, becoming less familiar and practised with other manoeuvres and less likely to conduct them.

Standardised plans, when incorporating best practice can provide an understanding of the ‘how, when and why’ of things being done and allow for contingencies. The Ship Handler’s Guide outlines that a proactive instead of reactive approach will also enable the better transfer of knowledge to new pilots. As no two pilotages are the same, guidance for berthing methods, for example at Berth 10, could be developed using the collective combined knowledge and experience of the pilots. When used in combination with a risk based framework, the overall flexibility could be enhanced through the development and incorporation of effective contingency plans. Guidance that is revised, amended, briefed and debriefed could also be used for training pilots and provide opportunities for continuous development and knowledge sharing.

Port procedures

Tug usage and reduction guidelines

On 13 November, the shipping agent submitted a request for a tug reduction, as was the usual practice for Madang Coast. Following a review of the guidelines and a discussion with the pilot manager, the acting Regional Harbour Master (ARHM) approved the tug reduction request subject to the weather at the time. This information relayed to the shipping agent and Townsville Vessel Traffic Services (VTS). Further, the daily shipping schedule^[28] detailed that no tugs were booked for the ship.

The ARHM, pilot manager, and master were all unaware that the agent’s request was made without the master’s knowledge. During interview, the master stated he had expected a tug to assist berthing due to the wind conditions at the time. This was despite him not requesting nor liaising with the shipping agent to organise this. When he was informed of the tug reduction by the pilot during the MPX, he did not object and allowed the pilotage to continue.

Neither the Port Procedures nor the SOPs included a requirement to consult with a ship’s master before the removal of tugs was approved. The pilot became aware of the tug reduction after he reviewed the daily shipping schedule on 16 November. Whilst this tug reduction process followed the Port Procedures, those directly involved in the pilotage were not consulted.

Audit findings

At the time of the contact, Marine Safety Queensland’s (MSQ) Port Procedures Manual stated that the MPX should include ‘general agreement on plans and procedures including contingency plans for the anticipated passage’.^[29] However, the SOPs did not contain any passage or berthing contingency plans for the Townsville pilotage area.

The 2014 and 2015 audits included findings regarding procedures for emergency situations:

Procedures for emergency situations for the pilotage area. Pilots will discuss various scenarios during the pilot meetings to develop awareness and identify options to consider in event of an emergency once past the point of no return.

Procedures for emergency situations within the pilotage area to be added as an independent section in the Pilotage SOP's.

However, in the period between the 2014 and 2015 audits, only two scenarios were discussed at the pilot meetings, and the outcomes and plans were not minuted as required by the audit finding, nor added to the SOPs.

External auditing is an invaluable tool for identifying areas for improvement. However, for it to be effective both parties need to have a follow-up process that ensures audit findings are appropriately monitored, actioned, and closed out in a timely and appropriate manner.

__________

28. The shipping schedule detailed movements from 1630, 16 November to 2359, 18 November 2015.
29. Port procedures and information for Shipping – Port of Townsville. Pilotage, Section 8.5.

Findings

From the evidence available, the following findings are made with respect to the contact made by Madang Coast on 16 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• As Madang Coast came alongside the wharf, the forward spring line slipped and could not be used to manoeuvre against. This was likely a result of the mooring line holding arrangement and the ship’s approach speed.
• As the ship approached the wharf, the combination of wind effect and astern movement moved the stern away from the wharf. As the spring line could not be used to manoeuvre against, the stern could not be brought back.
• The pilotage plan did not identify nor consider contingencies for single points of failures, therefore when the mooring line slipped, the contact with the wharf and adjacent ship could not be avoided.
• The Port of Townsville Limited Pilotage Service risk management processes were not sufficiently mature nor resilient enough to effectively identify and mitigate risks during pilotage. [Safety issue]

Other factors that increased risk

• The Port of Townsville Limited Pilotage Services’ Pilotage Service Safety Management System did not have documented guidance on berthing manoeuvres nor any associated contingencies. [Safety issue]
• The Port Procedures manual for Townsville allowed shipping agents to request a tug reduction without the knowledge of the ship’s master. [Safety issue]
• The regional harbour master and the pilotage service did not have processes in place to follow up audit findings, to ensure that they were appropriately monitored, actioned and closed out in a timely manner. [Safety issue]

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the marine industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are provided separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Risk management

Safety issue number: MO-2015-007-SI-01

Safety issue description

The Port of Townsville Limited Pilotage Service risk management processes were not sufficiently mature nor resilient enough to effectively identify and mitigate risks during pilotage.

Contingency planning

Safety issue number: MO-2015-007-SI-02

Safety issue description

The Port of Townsville Limited Pilotage Services’ Pilotage Service Safety Management System did not have documented guidance on berthing manoeuvres nor any associated contingencies.

Tug reduction process

Safety issue number: MO-2015-007-SI-03

Safety issue description

The Port Procedures manual for Townsville allowed shipping agents to request a tug reduction without the knowledge of the ship’s master.

Audit response

Safety issue number: MO-2015-007-SI-04

Safety issue description

The regional harbour master and the pilotage service did not have processes in place to follow up audit findings, to ensure that they were appropriately monitored, actioned and closed out in a timely manner.

Additional safety action

Following this contact, the ATSB was advised the following addition safety action has been taken:

MSQ has implemented a Continuing Professional Development framework (CPD), developed by the Australian Marine Pilotage Institute (AMPI). The CPD applies to all marine pilots licenced by MSQ for providing pilotage services in Queensland ports. The focus is on improved pilotage training by making it contemporary and relevant to pilots’ needs in their ports. As the training is more progressive, new developments and initiatives within the pilotage profession can be identified and incorporated. Current pilots have a transitional period of 3 years to obtain sufficient professional development to be eligible for consideration of renewal of their pilot licence. See Appendix C for details.

General details

Ship details

Appendices

Appendix A – Pilot card manoeuvring information

Appendix B – Townsville Pilotage training requirements

Source: MSQ (2015 requirements)

Appendix C – Updated Townsville Pilotage training requirements (in red)

Source: MSQ (2016 requirements)

__________

30. Trainee pilots observe qualified senior pilots conducting pilotage trips.
31. A mentoring trip by a qualified senior pilot to train a conducting pilot
32. An assessment of a conducting pilot’s competence as a pilot

Sources and submissions

Sources of information

The sources of information during the investigation include:

• the crew of Madang Coast
• the Port of Townsville pilots
• the Regional Harbour Master for Townsville
• the Australian Border Force
• the Port of Townsville
• Maritime Safety Queensland.

References

Maritime Safety Queensland (MSQ) 2015, Record of qualifications and training for Queensland Port Pilots for the Pilotage area of Townsville, MSQ, Brisbane. Available at www.msq.qld.gov.au

Maritime Safety Queensland (MSQ) 2015, Licensing and Training of Marine Pilots in Queensland, MSQ, Brisbane. Available at www.msq.qld.gov.au

Maritime Safety Queensland (MSQ) 2015, Port Procedure and Information for Shipping – Townsville, MSQ, Brisbane. Available at www.msq.qld.gov.au

National Marine Safety Committee, 2015, National Marine Safety Guidance Manual – Guidelines for Marine Pilotage Standard in Australia (Edition 2), Sydney.

Port of Townsville Limited 2015, Pilotage Services – Standard Operating Procedures, Townsville.

Port of Townsville Limited 2016, Pilotage Services – SMS Part 1 - Standard Operating Procedures – POT 123, Townsville.

Port of Townsville Limited 2016, Pilotage Services – SMS Part 2 – Townsville Port Operations – POT 1836, Townsville.

Port of Townsville Limited 2016, Pilotage Services – SMS Part 6 – Emergency Management Procedures, Townsville, Abbort Point & Lucinda – POT 1935, Townsville.

Rowe, Captain RW (with Russell, Captain PJD). The Ship Handler’s Guide, The Nautical Institute in conjunction with the Warsash Maritime Centre, London.

Townsville Pilotage Services 2011, Pilotage Safety Management System, Townsville.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from the pilot, the Australian Maritime Safety Authority, Maritime Safety Queensland and the Port of Townsville. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 2 December 2015, BHP Billiton (BHPB) train M03544 was loaded with iron ore at Yandi, Western Australia (WA). The train departed Yandi at about 2211 Western Standard Time (WST) and travelled north towards Port Hedland, WA, on the Newman main line.

At about 0530 on 3 December 2015, the train controller based in Perth was alerted to a dragging equipment detector (DED) alarm at the 67 km mark at Walla. Seven seconds later, train M03544 recorded a loss of brake pipe air pressure before the train came to a stop with the lead locomotive positioned near the 64.188 km mark, about 3 km from the DED.

The train controller contacted the train driver, advising that DED alarms had activated on both the east and west tracks. The train driver informed the controller that a loss of brake pipe air pressure had resulted in an uncommanded brake application bringing the train to a stop.

Shortly afterwards, as the driver walked towards the rear of the train to determine the cause of the loss of air pressure, he found that the train had separated and derailed.

What the ATSB found

The ATSB investigation identified that train M03544 derailed due to a broken rail. A fracture of the rail was probably initiated by the rapid growth of a detectable, yet unidentified, fatigue‑related transverse defect(s) in the west rail near the 67 km mark during the passage of the train.

The investigation also identified that the condition of the rail in the vicinity of the fracture contributed to relatively frequent failures in that area.

Finally, ultrasonic defect testing of the rail was undertaken in the heat of the day, potentially masking defects due to compressive forces in the rail.

What's been done as a result

In response to this occurrence, the operator of the train and track, BHP Billiton, took measures to improve track condition and reduce in-service rail defects by:

• accelerating the re-railing of 833 kilometres of track, including replacement of the track in the vicinity of the fracture
• the introduction of processes to:
  • reduce the initiation of rolling contact fatigue cracks in rail track
  • improve rail defect detection to prevent fatigue cracks from progressing to track failure.

Safety message

Early detection, assessment, and effective management of track defects is critical to minimising the risk of derailment and maintaining safe rail operations. Therefore, it is essential that track maintenance and infrastructure fault detection be of a high standard.

The occurrence

On 2 December 2015, BHP Billiton (BHPB) train M03544 was loaded with iron ore at Yandi, Western Australia (WA). The train departed Yandi at about 2211 Western Standard Time (WST) and travelled north towards Port Hedland, WA, on the Newman main line.

At the about 0221 the following morning, the train stopped for a driver changeover at the 199.447 km mark at Garden (Figure 1). The train resumed its travel to Port Hedland at about 0244.

Near Turner (Figure 1), at about the 119 km mark, the train driver of southbound train M03568 carried out a roll-by inspection as it crossed train M03544. The driver of train M03568 observed no defects on train M03544.

When the rear of the train had passed the 108 km mark, the train controller based in Perth observed that the track remained occupied. The controller contacted the train crew and issued an operational speed restriction of 60 km/h. The controller also requested maintenance staff to inspect the track infrastructure to determine the cause of the occupation.^[1]

At about 0527, on approach to the 67 km mark, the train was travelling at a speed of about 61 km/h on a descending grade under dynamic brake.

At about 0528, the lead locomotives passed the dragging equipment detector (DED) located at the 67.01 km mark. About 2 minutes later, the train driver applied a brake command to manage train speed.

Figure 1: Map of the Pilbara region showing the derailment location

Source: Geoscience Australia annotated by ATSB

At 0530:29, the train controller was alerted to a DED alarm. At this time, the lead locomotives were about 2.35 km past the location of the DED detector (the train was 2.83 km in length).

About 7 seconds later, the train recorded a loss of brake pipe air pressure. As a result, the train came to a stop at 0531:24 with the lead locomotive positioned near the 64.188 km mark (about 3 km from the DED).

The train controller contacted the train driver advising that DED alarms had activated on both the east and west tracks. The train driver informed the controller that a loss of brake pipe air pressure had resulted in an uncommanded brake application bringing the train to a stop.

Shortly afterwards, the train driver began walking towards the rear of the train to determine the cause of the loss of brake pipe air pressure.

The train driver found that two ore cars located at positions 80 (OC 2266) and 81 (OC 6182) in the ‘B’ rake portion of the train had separated (Figure 2). The gap between the cars was about 350 m but they had not derailed. At position 85 (OC 8934), the driver found the trailing axle on the trailing bogie had derailed. The next four ore cars (that is, immediately trailing OC 8934) had derailed and overturned onto the west side of the track but had remained coupled.

Trailing the four derailed cars on the west side of the track, there was a gap of about 20 m. The next group of 21 ore cars (positions 90 to 110) had derailed in the vicinity of the 66.950 km mark. The first 10 of these ore cars were severely damaged and had concertinaed to both the west and east sides of the west track. Some of the cars had come to rest at 90° to the direction of travel. A number of the derailed ore cars pushed the east track laterally out of alignment for about 10 m in an easterly direction.

The remainder of the cars, from position 111 through to the end of the train (position 132), had remained on the track.

The derailment resulted in significant damage to 26 ore cars (Figure 3) but no one was injured.

Following the clean-up of iron ore, vehicles, wayside equipment and track materials, 50 m of the east track and 200 m of the west track was rebuilt. Operations on the Newman mainline east and west tracks recommenced on 5 December 2015.

Figure 2: Diagram of the ore cars near the 67.0 km mark

Source: BHP Billiton, annotated by ATSB

Figure 3: Derailed, loaded iron ore cars located in the rear portion of train M03544

Source: BHP Billiton

__________

1. The cause of the track occupation was later identified as the result of a broken flash-butt weld at the 107.8 km mark.

Context

The Australian Transport Safety Bureau (ATSB) did not attend the incident site. The information presented in this section of the report and the analysis section that follows is principally based on information provided to the ATSB by BHP Billiton (BHPB), including reports commissioned by BHPB.

Location

Walla Siding is located on the Newman Railway in the Pilbara region of Western Australia (WA). The Newman Railway carries iron ore from seven inland mines to two port facilities at Port Hedland (Figure 1). The railway generally runs in a north-south alignment with the track kilometre distance starting at zero from Port Hedland and increasing as it runs south. Walla Siding is located about 60 km south of Port Hedland.

Weather

Weather conditions at the time of the derailment were fine and clear. The temperature ranged from a minimum of 23.0 °C to a maximum of 32.7 °C.

Train M03544 and its crew

Train M03544 was a heavy haul, bulk iron ore service operated by BHPB. The train was 2.83 km in length and had a total weight of about 41,562 t. The train was hauled by four EMD SD70 ACe locomotives. There were two locomotives positioned at the front of the train, and a rake of 132 ore cars (‘A’ rake). Another two locomotives were positioned in the middle of the train, with a further 132 trailing ore cars (‘B’ rake) (Figure 4).

Figure 4: Typical arrangement of BHPB iron ore train consist

Source: ATSB

The crew consisted of two train drivers, one working the train and the other travelling passenger. The train driver commenced shift at 2200 on 2 December 2015. The driver had worked two shifts following a rest and recreation break and had had 8 hours rest before boarding the train at Garden (Figure 1). He had 30 years of train driving experience. He had been assessed and reaccredited as a mainline locomotive driver on 15 January 2015.

The driver was tested for the presence of alcohol and other drugs following the derailment, returning a negative result.

Locomotive data extracted after the derailment verified the train speed was 61 km/h through the point of derailment. The train driver had maintained the operational speed restriction of 60 km/h imposed by the train controller near the 108 km mark.

The investigation found that improper train handling or excessive speed did not contribute to the derailment.

Rolling stock

The BHPB ore trains are operated as unit trains using a variety of ore car types including A Goninan and Co/Lynx Engineering (GOLYNX), Qiqihar Railway Rolling Stock (Group) Company (QRRS) and Bradken. The typical arrangement of the ore car fleet comprises of rotary couplers on the ‘A’ end and a fixed coupler on the ‘B’ end (Figure 5). An electronically controlled pneumatic (ECP) braking system was fitted to these ore cars. The ore cars operating with isolated brakes in train M03544 was less than 1.5 per cent of the total braking capacity, and this proportion was within BHPB’s operating standard.

Figure 5: Typical BHPB ore car arrangement

Source: BHP Billiton, annotated by ATSB.

BHPB used a trip-based maintenance strategy where ore cars were serviced after 246 return trips from Port Hedland to the Newman mine sites. ^[2] This return trip interval between maintenance equated to the ore cars being serviced about every 210,000 km.

An assessment of maintenance records for the ore cars in train M03544 found that 21 cars in ‘A’ rake were due to be serviced. Two of these ore cars had maintenance requests as the return trip service interval had been exceeded. The majority of the cars in ‘B’ rake had completed 34 trips. In total, 7.9 per cent of ore cars had exceeded the maintenance interval.

An inspection of the derailed ore cars found no evidence of fractured wheels or failed axle bearings. Data extracted from the wayside hotbox detector (HBD) site located at the 84 km mark found no evidence of high bearing temperatures in train M03544 before it derailed.

Wheel impact load detection (WILD)^[3] sites on the Newman network recorded two ore cars in train M03544 with ‘severity 2’ (intermediate level) peak load impacts of 31 t and 31.2 t. These ore cars were located in ‘A’ rake at positions 31 and 37 respectively. Both ore cars had ‘cut-out requests’ noted on the wayside equipment alarm report, indicating that these vehicles were scheduled to be inspected and removed from service for repair.

There were no excessive wheel impact loads detected in ‘B’ rake of train M03544 and preceding train M0356.

There was no track defect recorded in the vicinity of the 67 km mark on the day of the derailment. The signalling system maintained a continuous track circuit before the arrival of train M03544.

A review of the train’s payloads found ore car 8667 at position 61 in ‘B’ rake was slightly heavier than the majority of other ore cars in the consist, with a gross weight of 162.7 t. Ore car 8667 was located 25 cars ahead of ore car 8934, the first car to derail near the 67 km mark. Although more heavily loaded, the loading on car 8667 conformed to BHPB transit mass standards.

Visual inspections of the rolling stock, reviews of maintenance records, wayside monitoring detection systems and data concluded it was unlikely that a significant rolling stock defect had initiated or contributed the derailment of train M03544.

Rail impacts on wheels

The four ore cars immediately ahead of the first derailed ore car, 8934 (Figure 22), were quarantined and transferred to Mooka where an inspection found rail impact marks on the left wheel tread surfaces. The ore cars were transferred to Port Hedland where the iron ore was dumped. The wheel sets were removed from ore cars 8819 and 3290 at the ore car repair shop where a detailed examination of the wheel tread surfaces was carried out. Single impact marks found on each left wheel of ore cars 8819 and 3290 were consistent with impacts with a broken rail head. The impact marks generally increased in magnitude relative to their trailing position and ore car 8934 (that is, the first derailed car).

Wheelset number 2L of ore car 8934 showed four wheel tread surface impact marks (Figure 6 & Figure 7). In the direction of wheel travel/rotation, the impact marks were intermittently spaced, generally oval-shaped about 45 mm long and angled at about 90° to the wheel flange.

Figure 6: Ore car 8934 - wheelset 2L impact marks from broken rail segments

The top photo shows the radial spacing of the rail impact marks viewed from the back of the wheel. The bottom photo shows three of four corresponding rail impacts looking from the front of the wheel. Enlarged details of the four rail impact marks are shown in Figure 7.

Source: BHP Billiton, annotated by ATSB.

Figure 7: Enlargements of the four rail impact marks ore car 8934 - wheelset number 2L

Numbered 1 – 4, corresponding rail impact bruises on the wheel tread surface (Figure 6) on ore car 8934 - wheelset #2L. All impact marks are transverse, angled about 90° across the tread surface.

Source: BHP Billiton.

Track infrastructure

The BHPB iron ore railway was a standard gauge track structure constructed with 68 kg/m rail fastened with resilient clips to concrete sleepers. The rails were continuously welded and joined with flash-butt^[4] and aluminothermic^[5] welds. The sleepers were contained in a crushed rock ballast and BHPB operated trains of 40 t axle loads over its track infrastructure.

In the direction of travel, the west track through the location of the derailment was tangent on a downhill gradient varying between -0.22 per cent and -0.8 per cent. Maximum track speed was prescribed at 75 km/h. The majority of loaded trains traverse the west track with empty trains returning via the east track.

The BHPB specification SPEC-073-C-12006 described the assessment and classification and response to rail defects with ratings for three levels of severity. A severity level 1 required more urgent attention than that of a severity level 3 (Table 1).

Table 1: Rail defect severity ratings

Track geometry inspections

As part of the process in determining track condition, a series of track geometry parameters such as vertical and horizontal alignment, cross level variation, twist and gauge are considered. Potential track defects are examined and their severity determined with reference to defined defect limits for each track geometry parameter. The defined limits were documented in the BHPB standards.

A track geometry car is used to measure the track accurately and compare the results against a table of defect limits, which allows an appropriate response category to be allocated based also on rated track speed. Personnel conducting track patrols and unscheduled inspections also assess the severity of potential defects based on their knowledge and experience but do not normally take measurements.

On 27 November 2015, two severity 3 defects were found on the west track at the 67.052 km and 67.038 km locations. These were classified as severity 3 geometry defects requiring inspection within 28 days and repair within 12 weeks.

Rail and welded joint inspections

Patrol inspections were usually performed on the track between Port Hedland and Yandi while travelling in a road/rail vehicle at intervals not exceeding 2 days. Patrol inspections looked for visible rail defects such as broken rails, damaged rail surfaces or rail deformation. General inspections were performed for all new rail welds, and in response to previously identified defects or unusual rail conditions.

Continuous, detailed non-destructive test inspections (NDT) were carried out using vehicle-mounted and/or manual (handheld) ultrasonic test methods to detect internal and surface rail defects (See the section titled Ultrasonic tests – west track). Manual ultrasonic testing was used to verify the integrity of new aluminothermic and flash-butt welds and to confirm the size of suspected defects identified by continuous testing or visual inspection.

Identified rail defects were assessed within a series of defect categories such as transverse defect,^[6] horizontal/vertical split or weld defect in the rail head, web, or foot.^[7] The classification, position and size of defects were analysed with reference to a table of defect limits and associated severity codes. The severity codes defined the appropriate response required to control any risk to railway operational safety.

Rail defects were assessed within three levels, where a severity level 1 (red) broken weld defect must be removed before the passage of the next train. Severity level 2 defects (yellow) were to be generally actioned through regular reassessment or removed within 24 hours of discovery. A severity 3 level (blue) defect generally required a response time of 48 hours with daily reassessments and removal as soon as practically possible.

According to BHP Billiton Iron Ore, aluminothermic welds, and to a lesser extent flash-butt welds, were known to exhibit an increased frequency of defects and broken rails relative to those which occurred in parent rail. For this reason, all defects associated with welds may be classified separately to those in parent rail, or in cases where the generic defect types (for example, transverse defect) are identical, classified at a higher severity levels.

Welding records showed that the insulated rail joint^[8] (IRJ) located at the 67 km mark was replaced on 5 September 2015 (Figure 8).

Figure 8: West track, location of repairs to rail sections near the 67 km mark

Video image capture of the west track showing the east and west rail near the insulated rail joints at the 67 km mark. There were a number of welds in close proximity (orange arrows).

Source: Rail Technology International, annotated by ATSB

Tamping

All BHPB track tamping was carried out based on data from the dynamic track recording vehicle and track geometry defect exceedance reports. Geometry defects exceeding thresholds over a longitudinal distance greater than 2 m contributed to increased maintenance and potentially a derailment.

A review of track maintenance records found that hand tamping was carried out at the 67.01 km mark on 30 September 2015. The records showed that about 1 month later (on 28 October 2015), the track was machine tamped on the west track between the 66.0 km to 66.9 km locations.

A track geometry report dated 24 November 2015 identified three defects located between the 65.5 km and 68.7 km locations on the west track. Low rail height was reported in this section but no significant anomalies were found.

A review of the track condition index^[9] for 400 m north and south of the 67 km mark found no extraordinary geometry conditions.

Insulated rail joints

Records showed repairs on the west rail were carried out on 5 September 2015 to the broken IRJ at the 67.00 km mark. The most recent previous break of the IRJ at the same location had occurred on 25 June 2015.

The routine 3-monthly inspections of IRJs were found to have been carried out. On 20 November 2015, an inspection of the IRJs on the east and west tracks at the 67 km mark was carried out with no defects identified.

Rail height

The height of new rail was 185.7 mm. On tangent track, a minimum height wear limit of 166 mm was applied.

On the Newman west track for a distance of up to 10 m either side of the IRJ at the 67.0 km mark, rail height was measured at about 183 mm. The rail height on each side of those higher rail sections was about 11 mm lower at 172 mm (Figure 9).

Figure 9: Graph showing the variation in rail height near the IRJ at the 67 km mark

Source: Rail Technology International

Broken rails (west track)

An inspection of records listing broken rail defects for the period 1 January and 3 December 2015 showed three rail breaks on the west track between the 66 km and 68 km marks. On 2 November 2015, an aluminothermic weld repair was carried out on the west rail at the 67.27 km mark. Two other aluminothermic weld repairs to the east rail were made at the 67 km mark on 25 July 2015 and a second break on 24 September 2015 at the 67.01 km mark was recorded.

Rail grinding

Rail grinding is carried out to re-profile the rail head and in the process, removing small rolling contact fatigue (RCF) cracks. This grinding reduces the likelihood of RCF cracks developing into transverse defects deeper into the rail head, which can result in a rail break (usually under a loaded train).

A review of BHPB records showed that rail grinding on the west track through the location of the derailment was in accordance with the specification at the following locations:

• 2 October 2015 – 65.5 to 74.8 km
• 20 August 2015 – 64.6 to 67 km
• 26 May 2015 – 65.8 to 73.2 km.

Ultrasonic tests - west track

Ultrasonic rail testing involves passing sound waves into the rail and monitoring the echo returned by the sound waves reflecting off internal and external surfaces (reflectors). Defects within the rail (Figure 10) create reflectors which return unique echo patterns depending on their type, location and size. Examination of the echo patterns allows an operator to deduce the existence, type and size of suspected rail defects.

Figure 10: Rail defect types

Source: Australian Rail Track Corporation Non-Destructive Testing of Rail (for Internal & Surface Defects) ETE-01-03.

Ultrasonic inspections of rail on the BHPB network were carried out at intervals based on rail haulage rates measured in million gross tonnes (MGT). The minimum rail inspection frequency is 5 MGT and was conducted through the contracted services of Rail Technology International (RTI) using a road-rail vehicle.

Limitations of ultrasonic testing

Ultrasonic rail testing relies on detecting an echo from sound waves reflecting off internal and external surfaces (reflectors). Detection of defects using this method requires skilled operators and the ability of the equipment to detect a clear echo reliably is dependent on a number of factors, such as:

• Grease, dirt or uneven rail surfaces (due to shelling, pitting and/or worn rail profiles) can reduce the quality of the interface between the ultrasonic probe wheels and the rail surface.
• The geometry of the defect may reflect the sound waves away from the probe wheels thereby attenuating the echo signal received by the ultrasonic test equipment.
• Low reflectivity of the defect surfaces may result in greater attenuation of the reflected sound waves than those of a surface with high reflectivity.
• Equipment calibration.
• Compressive forces within the rail (due to high rail temperature) may push the surfaces of a defect together such that the sound waves are transmitted through the defect rather than reflecting off the surfaces of the defect.

A review of one of BHPB’s internal investigation reports^[10] for this occurrence noted that ‘small transverse defects are easier to detect when the track is cooler’. The review also noted that:

…previous ultrasonic inspections of track were only carried out at night, where the advantage of ultrasonic testing, when the rail is cool and with reduced thermal stress, allowed for greater detection of transverse defects. The night inspections were carried out on the Mt Newman railway, however this practice ceased many years ago for non-technical reasons...

This review recommended that consideration should be given to reintroducing the practice of night inspections.

Assessment of data

The last ultrasonic test carried out on 29 November 2015, four days before the derailment, found a severity 1 transverse defect at the 67.280 km mark on the west rail. The defect was located in the rail head at an aluminothermic weld joint. The defect was removed 2 days later with replacement rail aluminothermically welded in-situ.

Between 1 January and 28 November 2015, two other severity 1 defects (Table 1) were detected on the west track between the 66 km and 68 km marks on the Port Hedland to Yandi line. These defects were also removed. In this period, one severity 3 defect was found on the west rail at the 68.197 km mark, about 1.2 km from the location of the derailment.

__________

2. Ore cars with higher trips were allowed to operate with asset protection and condition monitoring systems where the wheel condition permitted (i.e. where flange, and tread condition remained within prescribed tolerances).
3. Wheel Impact Load Detector (WILD) is a safety system used to identify defective wheels by measuring the dynamic impact on railway track.
4. The fusion welding of rail ends by electric arc heating and contact under high pressure.
5. A welding process in which an aluminothermic reaction takes place within a crucible and the resultant metal flows into a mould enclosing the rail ends that are to be joined.
6. Transverse defects are progressive fractures that spread across the width of the rail.
7. Not all under-foot defects are detectable by ultrasonic or visible inspections.
8. A rail joint manufactured and assembled such that the joined rails are electrically insulated from each other.
9. Track Condition Index (TCI) is a single unit of measurement of track condition in any one 100 m segment of track. This value is calculated through the application of weightings to returned geometrical measurements. Geometrical parameter weightings have been defined based on their influence to track performance. (BHP Billiton Track Engineering CoP v2.1)
10. NTS Ultrasonics Pty Ltd REVIEW: DERAILMENT INVESTIGATION REPORT: WALLA 67 KM. 3/12/2015.

Safety analysis

Broken rail section

Following derailment of train M03544, BHP Billiton (BHPB) commissioned a series of investigations into the incident. The investigations concluded that the derailment most likely occurred due to a broken rail on the west track near the 67 km location. The cause of the broken rail was attributed to an undetected transverse defect that likely resulted from rolling contact fatigue (RCF). The defect was found in a 1.1 m length of rail retrieved from the derailment site (Figure 11).

Figure 11: Broken rail with fatigue cracks

Source: BHP Billiton

The provider of ultrasonic rail testing for the occurrence track, Rail Technology International (RTI), disagreed with BHPB’s finding as they concluded that that 1.1 m length of rail was ‘highly unlikely’ to have been in service at the time of the derailment. This conclusion was based on a number of factors such as weld finish, appearance/condition of the fracture surface, and size and number of defects. The ATSB conducted a review of the evidence and concluded:

• The weld finish in the 1.1 m section was consistent with welds in the vicinity of the 67 km mark.
• The oxidised appearance/condition of the fracture surfaces resulted from water being used onsite to wash the surface in preparation for detailed photography.
• Specialist metallurgical examination of the section concluded that the fracture surfaces were only lightly corroded. That was consistent with a relatively recent failure.

Additionally, the rail height on the west track was about 172 mm, except for a 20 m section of 183 mm height rail in the vicinity of the 67 km mark. The height of the recovered length of rail was consistent with the rail height west track near the 67 km mark.

Finally, there were four welds at about 5 m intervals in each rail of the west track near the 67 km mark. The welds closest to the insulated rail joint (IRJ) joined rail of similar height, whereas the outer welds joined rail of different heights. The weld in the recovered section of rail indicated joints of similar height rail.

Considering all of the above, the ATSB concluded that the 1.1m broken section of rail was probably in service immediately prior to the derailment and not from a previous rail failure.

While the RTI report suggested the more likely cause of the derailment ‘would be a failure of wheel, bogie or axle’, no specific evidence was provided to support that conclusion. Furthermore, there was no evidence of rolling stock failure found onsite (both rolling stock and prior track scarring) that contributed to the derailment and the general disposition of the derailed cars was consistent with failure of the track rather than rolling components of the train. However, there were contact marks on the wheels consistent with track discontinuity. It was considered most likely the witness marks on the wheel occurred as the west rail suffered multiple fractures near the 67 km mark under the passage of ore cars.

The ATSB considered the potential influence of the higher than normal forces on the rail recorded by the wheel impact load detector during the passage of train M03544, as well as the preceding train. The magnitude of the impact forces, were not considered sufficient to initiate derailment but may have contributed to rapid failure of a weakened section of rail.

Specialist analysis of the recovered rail found that the fracture initiated at two fatigue‑related transverse defects (Figure 12), with the remainder of the fracture occurring relatively quickly due to overload associated with passage of train M03544.

Figure 12: Large fatigue crack in rail section

Source: BHP Billiton

Rail stress-free (neutral) temperature

The area surrounding the 67 km point had been subjected to several maintenance activities, including a few days before the derailment. The records showed that a length of rail was installed at about the 67.150 km mark when the rail temperature was about 65 °C. That, along with other activities, would most likely increase the stress-free temperature of the track in that area. An increase in stress-free temperature had the effect of shifting the effective operating envelope of track structure.

According to BHPB, the stress-free track temperature was 40 °C. This specification was based on midpoint average minimum and maximum temperatures expected for that time of year (summer). If the stress-free temperature of rail is too low, there is a higher risk of track buckling in warmer weather. Conversely, if the stress-free temperature is too high, there is a higher risk of rail breaks in cooler weather. Given the time of the derailment (about 0530) and higher stress-free temperature, it was most likely that the track temperature was lower than the stress-free temperature. This meant that the rail was most likely in a state of tensile force (that is stretched), excluding track buckle as a cause for the derailment.

Rail at a temperature 20 °C below stress-free temperature is unlikely to cause a catastrophic failure in itself. The dynamic nature of a passing loaded train (high load, high cycle) could expose a weakness in the track or rail structure under tensile stress. This weakness could lead to a rail break. A rail break allows the rail to separate, and the separation depends on how much below stress-free temperature the rail temperature is. The greater the difference between these temperatures, the greater will be the separation.

The wider the gap on the rail running surface, the more passing wheels will pound the opening. Successive wheel impacts lead to further deformation, increased running surface discontinuity, and increased risk of derailment.

The most recent rail breaks (25 July and 24 September 2015) had a recorded gap of 60 mm and 90 mm respectively, a significant discontinuity of the running surface increasing the risk of derailment.

The BHPB investigation report noted that broken rails in the recent past had not led to derailment. The following from a report authored by the Institute of Railway Technology at Monash University for BHPB is also relevant.

Straight breaks or vertical fractures, for example from a single isolated transverse defect or a defective weld, generally present a very low risk of derailment, and to the author’s knowledge, none have occurred despite a considerable increase in the incidence of broken rails since 2012.

Therefore, derailment risk is greatly increased with incorrectly stressed rail. In the event of a broken rail, the gap will widen increasing the running surface discontinuity.

Track condition

The ATSB reviewed the BHPB-commissioned specialist reports that it used to determine the findings of its investigation.

One of the BHBP reports, in discussing the scoping of track locations for re-railing, revealed that the section between 60 km and 73 km locations of the west track was in poor condition, noting that:

… extensive areas where the rail asset integrity was less than adequate (ballast condition, head height, numerous aluminothermic welds, rolling contact fatigue (RCF) developing into TD due to grinding debt^[11] etc.).

According to BHPB, delays and changing priorities resulted in the section of track between 66 km and 69.5 km being deferred from the re-rail plans until April 2016.

The BHPB report concluded:

The general condition of the rail was such that failures occurred frequently and further rail failure could be expected unless the asset integrity is improved. Rail failure may lead to derailment if circumstances reinforce each other resulting in cascading failures culminating in derailment. At the time of derailment the following rail related factors resulted in a high risk of rail failure:

- the existence of a grinding debt resulting in an increased risk that RCF cracks become TD’s;

- extensive areas where the rail head height is of concern; and

- a high number of aluminothermic welds.

The rail condition, high axle loads combined with wheel impact loads exacerbate the rate of rail failure. Some “wheel impact breeding hot spots” initiate the development of high impact wheels which spread defects through the weakened rail network.

The rail failure KPI set during the FY 16 budgeting process is one failure per week. This KPI benchmarks poorly against heavy haul rail industry. The setting of a KPI at this level indicates a lack of knowledge of what best in class should or could be. A benchmarking review performed in September / October 2015 has identified this as something to be addressed and consequently the KPI is (as of February 2016) being reconsidered to drive improvements.

There is history of over reliance on aluminothermic welding with knowledge that such welds will generate more failures.

The finding and conclusions of BHPB’s reports indicated that the general condition of the rail on the west track in the vicinity of the rail fracture was poor and contributed to relatively frequent failures in that region.

Ultrasonic testing

The 1.1 m section of fractured rail found onsite (Figure 11) contained one large and two small areas of fatigue cracking. Initially, BHPB assessed that the rail defect that led to the fracture was not detected during RTI’s last ultrasonic rail inspection on 29 November 2015.

However, after analysis of the RTI data, BHPB concluded that a large transverse defect was detectable but not identified by the individual operator conducting the inspection. That conclusion was disputed by RTI on the basis that BHPB had misinterpreted the ultrasonic signature of a weld in that location as being that of a transverse defect.

The ATSB reviewed RTI ultrasonic recordings from the 29 November inspection (RTI replayed the data via proprietary software and captured the information in a video file). The ATSB viewed the video file 50 m on either side of the IRJ at the 67 km mark (see Figure 8). Approaching the area of interest (in the direction of travel in Figure 8), ultrasonic signatures were evident about 5 m from the IRJ. No other significant signatures were identified.

The ATSB also reviewed previous ultrasonic recordings for the same location on 15 and 25 November and compared them with those of 29 November. No ultrasonic indication was recorded on 15 November and a small indication was recorded on 25 November (Figure 13). Ultrasonic indications from the nearby IRJ at the 67 km mark where also compared for those three dates and found to be largely consistent. The consistency of the IRJ ultrasonic signatures supported a conclusion that the signals for the rail position shown in Figure 13 were indicative of a developing rail defect.

Figure 13: Ultrasonic indications 
(left – 15 November, centre – 25 November, right – 29 November)

Source: Rail Technology International

Specialist reports commissioned by BHPB, and authored by NTS Ultrasonics and Aben Technical Services, also assessed the variations in signatures at that location across the three dates in November 2015. Those reports both supported a conclusion that the signals were indicative of a developing transverse defect, with the NTS Ultrasonics report stating that:

…From these data traces it seems that the transverse defect has grown very quickly between 25/11 and 29/11.

Based on signal variations, the NTS report also stated that the accuracy of some of the data across these three runs may have been affected by ultrasonic probe positioning and calibration issues. Neither of these reports discussed differences between ultrasonic signatures associated with welds compared to transverse rail defects. The Aben report did however discuss interpretation of the 29 November 2015 signature as follows:

The indication as seen on 29-11-2015 run bears a marked resemblance to the end of rail head indications as seen in the IRJs... A large vertical TD [transverse defect] is geometrically very similar to the rail end in an IRJ, and the lack of any indications from areas below the head of the rail once again points to a head only discontinuity.

Based on a review of the ultrasonic data in the area of the rail failure, and all of the available specialist reviews, the ATSB concluded that the developing defect transverse defect was probably detectable.

Finally, the NTS Ultrasonics report, in discussing factors that can adversely affect the identification of defects, stated:

… Rail flaw detection is one of those occupations where the operator must be fully alert all the time, not unlike air traffic control and other high attention occupations. In some circumstances operators can be distracted from monitoring the system, and sometimes overloaded with data from the system. As highlighted in the Aben report, when a lot of data is coming in (from many closely spaced welds, for example), the operator may feel under pressure to move through the data quickly and perhaps not giving each data set the attention it warrants. Misclassification is a possibility, and the successful performance of these systems must depend on the experience of the operators.

Crossing train control area boundaries requires radio contact with track controllers, and this may be distracting. Apparently the 67 km mark is close to such a boundary.

Ultrasonic testing of the tracks was conducted during hours most likely when the rail temperature was higher than the stress‑free temperature of 40 °C. Rails at a higher temperature are subjected to compressive forces. These compressive forces may mask certain rail defects, such as transverse cracks. It was noted by staff onsite that the grind markings were on the rail head. Data from the most recent RTI inspection did not appear to be affected by the grind markings on the rail head.

The RTI report (in response to the initial BHPB report) commented that since the start of 2015, RTI had reported 247 transverse defects in parent rail and 131 transverse defects in welds.

The specialist report authored by NTS Ultrasonics stated:

The advantages of testing rail at night when the track is cooler (lower thermal stresses) was established many years ago on the Mt Newman line, but the practice was dropped for non-technical reasons.

Consideration should be given to reintroducing this practice.

In its recommendations, the BHPB derailment investigation report stated that:

BHPBIO should obtain clarification from RTI on how the following factors affect detection of rail defects including details on mitigating controls that address the variability of these factors:

- Calibration of equipment;

- Rail stresses;

- Probe contact;

- Gain settings;

- Rail crown conditions including wear and foreign contamination like oils;

- Noise filtering;

- Rail profile; and

- Track geometry.

The following from the NTS report is relevant to the limitations of ultrasonic testing:

To a large extent, the basic principles of ultrasonic rail flaw detection were established by the mid-1980s and have not changed much since. The use of digital technology has made data presentations, data storage, and instrument control better, but the underlying ultrasonic technology has barely changed in over 30 years. Other inspection technologies such as eddy current and ACFM have seen recent development for rail, but are not complete inspection technologies. Perhaps a review of the current “state of the art” in rail flaw detection could recommend useful combinations of technology to be considered for future inspection contracts as well as setting useful directions for research and development. It is possible that rail flaw detection will develop in useful ways if the end users of the services are more pro-active in asking for reasonable improvements and helping provide the resources to make it happen.

__________

11. Insufficient profile grinding of the rail head to ensure the removal of rolling contact fatigue cracks.

Findings

From the evidence available, the following findings are made with respect to the derailment of the loaded BHP Billiton iron ore train M03544 near Walla, Western Australia on 4 December 2015.

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Train M03544 most likely derailed as a result of passing over a fractured section of rail.
• The fracture of the rail probably resulted from rapid growth of undetected fatigue‑related transverse defect(s) in the west rail near the 67 km mark during the passage of train M03544.
• The fatigue‑related transverse defect was probably detectable, but not identified during ultrasonic testing of the rail.
• The general condition of the rail on the west track, in the vicinity of the rail fracture, contributed to relatively frequent failures in that area. [Safety issue]

Other factors that increased risk

• Ultrasonic testing was undertaken in the heat of the day when rail temperatures were high, potentially masking defects due to compressive forces in the rail.

Safety issues and actions

The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Rail condition

The general condition of the rail on the west track, in the vicinity of the rail fracture, contributed to relatively frequent failures in that area.

Safety Issue: RO-2015-023-SI-01

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• BHP Billiton ICAM investigation report (rev 4)
• ALS Global Examination of failed rail section ex – Newman Main Line (91HM0474 Rev 1)
• ABEN Technical Services W15-0109 - Derailment Review - Rail Testing Aspects
• Rail Technology International 67km Derailment Response
• NTS Ultrasonics Review: Derailment Investigation Report
• Institute of Railway Technology Review of Investigation Reports (Monash/RT/2016/1140)
• International Heavy Haul Association 2015 Managing the Transition from Rail Wear to Rolling Contact Fatigue in a Heavy Haul Environment
• BHP Billiton Standard - Code of Practice Track Engineering - Number: 0002664 Version: 2.1

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to BHP Billiton, Office of the National Rail Safety Regulator, and Rail Technology International.

Submissions were received from BHP Billiton and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 15 October 2015, the pilot of an experimental, amateur-built Titan Tornado aircraft, registered N4070F, departed Warrenton-Fauquier Airport, Virginia, United States on a private flight through the local region. Approximately 40 minutes into the flight on the return leg to the departure airport, the aircraft sustained a total engine power loss, which required a forced landing onto a roadway near Mitchells, Virginia. The aircraft was substantially damaged during the landing however, the pilot was not injured.

As the accident occurred in the United States, the National Transportation Safety Board (NTSB) was responsible for investigating this accident. As part of its investigation, the NTSB notified the Australian Transport Safety Bureau (ATSB) as the State of Manufacture of the engine. In accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation, the ATSB appointed an Accredited Representative to assist the NTSB liaise with the engine manufacturer and initiated an investigation under the Australian Transport Safety Investigation Act 2003.

The ATSB has concluded its Accredited Representative support to the NTSB investigation, case number ERA16LA016. The NTSB is finalising its investigation report which can be found at www.ntsb.gov.

Any enquiries regarding the investigation and report should, in the first instance, be directed to the NTSB.

Safety summary

What happened

At about 1450, near Rawlinna, WA freight train 5PM9 operated by SCT Logistics derailed during a severe storm. There was a combination of 59 vehicles located immediately behind the locomotives. The train broke into two sections, where 39 vehicles had either derailed or overturned, generally to the south side of the track. A fire started within one refrigerated food van about 500 m from the front of the train and later burned itself out. There were no dangerous goods involved in the accident and no fuel spillage.The derailment damaged approximately 550 m of track. There were no physical injuries to the train drivers, but the two relief drivers were badly shaken when the crew van rolled on its side.

What the ATSB found

The ATSB found that the configuration of multiple PBHY ‘High Cube’ vehicles provided a large side surface area that was susceptible to high wind forces. A localised downdraught of cold air in the form of a microburst on the north side (driver side) of the train produced severe winds that were sufficient to initiate the overturning of eight coupled lightly loaded PBHY vehicles. Other laden vehicles, including another eight PBHY vehicles, the crew van and in-line fuel tanker, had progressively derailed and overturned towards the front of the train. These vehicles had derailed through the transference of the rotating force through the couplers, due to rollover of adjacent vehicles.

What's been done as a result

SCT Logistics advised that on 15 December 2015 a rail safety alert was distributed to operations staff advising drivers to slow trains to speeds no greater than 70 km/h when experiencing severe weather conditions involving strong cross winds.

SCT Logistics is also reviewing and amending their Risk Assessment Register – Mainline Operations to include elements of risk to operations due to adverse weather conditions.

The effects of severe weather on safe train operations will be included in a review of driver training modules.

Safety message

This, and similar previous incidents, highlights how rail operators should consider the effects of severe weather conditions involving strong winds and how this can affect the safety of train operations.

Within the geographical regions of their operations, operators should implement risk management strategies to minimise the likelihood of train derailment when severe weather conditions are forecast.

Derailed vehicles looking east

Source: ATSB

The occurrence

SCT Logistics (SCT) train 5PM9 departed Forrestfield (near Perth) on 3 December 2015 and arrived at Kalgoorlie (Figure 1) at 0952^[1] on 4 December.

Weather information^[2] released at 0523 on 4 December 2015 had forecast that severe storms would extend from Kalgoorlie to Forrest, Western Australia. The forecast included damaging winds with a high potential of ‘microbursts’^[3] and the possibility of small hail. Temperatures for the region ranged from 36 °C to 40 °C.

Figure 1: Location

The map illustrates the key locations relevant to the route of train 5PM9. The derailment occurred about 18 km west of Rawlinna.

Source: Base map copyright Australasian Railways Association, annotated by the ATSB.

Train 5PM9 departed Kalgoorlie at 1010 and about 2.5 hours later stopped at Zanthus for a driving crew change. The new driving crew were advised that the air conditioning on lead locomotive SCT 012 had failed. The train departed Zanthus at 1317. While travelling towards Rawlinna, the second driver telephoned the maintenance help desk seeking assistance to rectify the air conditioning failure that saw SCT 012’s cabin temperature rise to 38.8 °C with the windows open.

After departing Naretha at about 1424, the second driver commented to the driver about the lightning and storm to their north that drew closer as the train headed towards Rawlinna.

About five minutes before the accident, the second driver received a call from the maintenance technician who gave options for repairing the air conditioning in the locomotive cabin. The second driver also advised that when he was required to complete safe working paperwork with the windows closed, the cabin temperature would rise to 39.9°C. While the second driver was analysing the air conditioning fault, a gale force northerly wind with heavy rain struck the driver’s side of the locomotive. The drivers said the locomotive lurched violently to the right and left, and it was very noisy with reduced visibility. At the time, the train was travelling at about 94 km/h.

The intensity of the wind was so strong it was forcing rainwater under the (now closed) left side-sliding window into the driver’s cabin. As the driver was reaching for a cloth to stop the water, he felt a bump in the train. Suspecting that he may have knocked the automatic brake handle while reaching for the cloth, he looked at the driver’s console and noticed a flash of the vigilance light.

Both drivers felt a large pull on the train and thought it may have come apart. When seeing the illuminated sanding light on the console and a loss of air, the driver bailed off ^[4] the independent brake to stretch the train and minimise the risk of derailed trailing vehicles overrunning the crew van and locomotives.

The second driver looked in the rear view mirror, and saw rail vehicles derailing and rolling onto their sides. The first vehicles to derail appeared to be about 10 vehicles behind the locomotives, with subsequent vehicles progressively derailing towards the front of the train. As the train slowed, it jerked backwards and forwards. All the vehicles derailed to the south of the track, including the crew van and in-line fuel tanker coupled immediately behind locomotive SCT 008 (Figure 2).

Figure 2: Leading end of train showing overturned crew van and trailing vehicles.

Looking in the direction of travel, this photo shows how the vehicles progressively derailed towards the front of the train while rolling onto their sides south of the track. Source: ATSB

Data extracted from the locomotives confirmed a steady rise in the airflow volume through the brake pipe indicating that vehicles had separated from the leading end of the train. This lasted for about 26 seconds until the train stopped and the driver moved the throttle to idle. The locomotives had travelled a distance of 472 m from when the airflow volume started to increase. The front of the train came to a stop near the 1420.750 km^[5].

Post occurrence

At about 1451, the second driver made an emergency call on the ICE (In-cab Communications Equipment) radio to the Australian Rail Track Corporation (ARTC) Network Control Officer (NCO) located at Mile End, South Australia. He advised the NCO that train 5PM9 had derailed and that the crew van and in-line fuel tanker had rolled onto their sides and there was a fire in the pileup of vehicles (Figure 3) about 500 m behind the crew van.

At about 1458, the NCO contacted the infrastructure maintainer that was carrying out a track inspection between Rawlinna and Naretha. The NCO requested the maintainer go to the derailment location to assist the train crew. At this time, the maintainer was about 110 km from where the train derailed.

At about 1459, the NCO contacted two signal maintenance workers who were maintaining a point machine at the eastern end of the Rawlinna crossing loop to assist the train crew.

When the drivers alighted the locomotive they described the wind at gale force with heavy rain. They quickly went back with a fire extinguisher to check on the wellbeing of the two drivers that were resting in the crew van. One of the drivers climbed onto the side of the overturned crew van and kicked the jammed doors of the vestibule and kitchen open. He found both drivers were uninjured but badly shaken and assisted their exit onto the ground and to shelter in the cabin of the trailing locomotive.

Figure 3: Panoramic view of derailed vehicles and containers

The second driver moved quickly to shut down the generator set that was still powering appliances in the overturned crew van. He then disconnected the fuel lines on the in-line fuel tanker to ensure there was no spillage of diesel.

It was evident that the fire had started in a refrigerated wagon containing food products, probably initiating at the refrigeration unit. The fire was inaccessible for the crew to safely extinguish. The fire subsequently extinguished naturally without spreading to other freight.

The second driver continued to check the train and contacted the ARTC Train Transit Manager (TTM) to update him of the current situation as well as requesting advice about placing protection at each end of the train. At about 1652, he informed the TTM that the rear of the train was protected. The train control graph shows that at 1754 the drivers placed protection at the front of the train. In the meantime, the driver contacted SCT operations centre providing further information about the derailment and state of all drivers.

The signal maintainers, who had already arrived at the derailment site, confirmed that the train crew were uninjured and later contacted the NCO to provided further details of location, vehicles derailed, and the train crew condition. The maintainer also advised that the weather had abated with occasional light rain and winds.

At about 1707, the infrastructure maintainer arrived on site to assist the train crew and assess track damage. Later, with the assistance of the signal maintainers, the crew of train 5PM9 were transported by road to Naretha. At Naretha, they met with Pacific National train 5PS6 that transported the SCT crew back to Kalgoorlie.

On 6 December 2015, the removal of derailed vehicles and track restoration works commenced. To assist the recovery effort and to reduce the amount of time before the resumption of east-west services, track maintenance crews constructed a deviation track on the northern side of the original track alignment to bypass the derailment site. The deviation track opened for traffic about 4 days later on 10 December 2015. On 10 February 2016, with rehabilitation works complete and the new track laid, the deviation track was removed and services recommenced over the original alignment.

__________

1. The 24 hour clock is used in this report to describe the local time of day, Western Standard Time (WST)
2. Weather information provided by the Early Warning Network (EWN) is an online weather warning subscription service.
3. A microburst is a small column of exceptionally intense and localised sinking air that results in a violent outrush of air at the ground.
4. Bail off is a term used to describe the action of: 1) preventing the locomotive(s) brakes from applying automatically during a train brake application, or 2) releasing the locomotive(s) independent braking during a train brake application.
5. Distance in rail kilometres from the reference point located at Coonamia, South Australia.

Context

Location

Rawlinna is located on the interstate rail network, approximately 375 rail km east of Kalgoorlie, Western Australia (Figure 1). The derailment occurred about 18 km west of Rawlinna near the 1421 km mark.

Track information

The ARTC manages the railway where the derailment occurred, with the movement of rail traffic controlled from the ARTC’s Network Control Centre West located at Mile End in South Australia.

The standard gauge (1435 mm) track at the derailment location consisted of 47 kg/m rail fastened to concrete sleepers by resilient clips. The track formation comprised sand/clay based soil, topped with a capping layer and overlaid with ballast to a nominal design depth of 250 mm – forming the track bed. The track bed supported prestressed concrete sleepers spaced nominally at 667 mm centres.

Approaching from Kalgoorlie, the track through the derailment site was tangent^[6] and the terrain was slightly undulating. The track gradient leading to the derailment site transitioned from a gentle rising grade^[7], and was level through the location of the derailment. The maximum track speed was 115 km/h.

Train and crew of 5PM9

Train 5PM9 was a freight service operated by SCT between Perth and Melbourne. The train consisted of two locomotives (SCT012 leading and SCT008 trailing) hauling an in-line fuel tanker, a crew van and 57 freight vehicles. The train was 1390.7 m in length and had a trailing mass of 3060 t.

The crew consisted of four qualified drivers who had commenced duty at Forrestfield, near Perth on 3 December. The plan was for the drivers to work the train in pairs, operating in rotating relay shifts through to Adelaide, South Australia.

The driver and co-driver in charge at the time of derailment had extensive operations and train driving experience. They were assessed as fit for duty in accordance with the requirements of the National Standard for Health Assessment of Rail Safety Workers.

On-site inspection and examination of train data found there was no anomaly in the train speed, train handling, rolling stock condition, or operational performance leading up to the derailment.

No dangerous goods were listed on the consignment sheet for train 5PM9, however there was extensive loss of containment of foodstuffs because of the derailment.

Weather

Weather Forecast

Subscribers to the Early Warning Network (EWN) are provided with a daily Weather Condition overview that is based on information sourced from the Australian Bureau of Meteorology (BoM). The EWN overview issued on 4 December 2015 to the ARTC and SCT at 0523 stated:

Yesterday (3/12/2015) across southern Western Australia severe storms produced a gust of 102km/h at Kalgoorlie. Today severe storms will remain likely but will extend east to Forrest from Kalgoorlie. Damaging wind gusts are the main threats due to the high potential of microbursts but some small hail cannot be ruled out. An extreme fire danger is also current today. Tomorrow expect a few showers and storms to continue east of Zanthus with the further chance that some of these may be severe while some showers and rain/thunder may occur around Kalgoorlie tomorrow night.

The forecast also provided a table of warnings at four prime locations, Kalgoorlie, Zanthus, Rawlinna, and Forrest. All locations had forecast wind speeds of between 15-20 km/h and maximum temperatures between 36 °C and 40 °C. The EWN forecast also alerted subscribing organisations about the ‘high chance of severe storms’ for these four locations.

Post event observations

Commencing at about 1230, thunderstorms progressively developed across the forecast area. Radar images had identified strong cells mainly south and southeast of Kalgoorlie. At about 1400, a thunderstorm developed east of the main activity area peaking between 1440 and 1450. The timing of this thunderstorm corresponds with the time that 5PM9 derailed (Figure 4).

Figure 4: Satellite images
 

Satellite images showing the cloud masses travelling generally in a south-easterly direction near Rawlinna, WA between 2:30 pm and 3:00 pm (WST) Image Source: Satellite images from Himawari-8 operated by the Japan Meteorological Agency (JMA) and sourced from the Bureau of Meteorology.
Annotated by ATSB

At about 1400, the EWN also recorded widespread lightning activity starting at about 40-50 km north of the railway line. The lightning moved slowly in a southerly direction. At about 1440, there was increased intensity near the railway line (Figure 5).

Figure 5: Thunderstorm lightning lifecycle recorded north of Rawlinna, WA – 4 Dec 2015

Lightning strikes are displayed as crosses (ground events) or triangles (cloud events). The strikes are colour coded to indicate changes in the time of strike. Blue indicates 60 minutes prior to the image capture and transition to red indicating 30 minutes prior to the image capture. The image illustrates that lightning strikes had moved slowly in a southerly direction towards the railway line.

Image Source: Map data 2015 Google Imagery 2015 TerraMetrics

The EWN reported ‘lightning tends to occur near the transition between the downdraught and updraught indicating the downdraught would have been close to the railway line. At this time, the likely effect would have been a strong out flow of winds and heavy rainfall that could have caused flash flooding.

Microbursts

Intense local weather conditions can often develop that are difficult to detect on standard synoptic charts. A downdraught of cold air usually causes severe winds in thunderstorms. The BoM describes a localised downdraught as downburst, and if they are less than 4 km across, they are referred to as a microburst (Figure 6). Very severe downdraughts (or microbursts) can produce wind speeds of more than 200 km/h while only affecting areas of up to 1 km wide.

Figure 6: Diagram of thunderstorm downdraught/microburst

Microbursts often have wind gusts in the 90-100 km/h range – but briefly in small geographic areas. The descending air is forced to spread out laterally near the earth’s surface, often creating severe wind squalls with associated dust.

Source: WDRB Meteorologist Jeremy Kappell.

In this instance the EWN reported that: ‘Severe weather produced was most likely microburst winds. Microbursts often have wind gusts in the 90-100 km/h range – but briefly in small geographic areas’.

The descending air is forced to spread out laterally near the earth’s surface, often creating severe wind squalls with associated dust, similar to that experienced by the crew of train 5PM9.

Wind induced lateral forces, especially that acting on the side of a rail vehicle, contributes significantly to body roll and potential vehicle rollover.

The ATSB closely examined the possibility that the severe environmental conditions at the time of the derailment may have led to a vehicle rollover scenario. Similarly, the factors that serve to resist rollover were also examined.

There was no radar coverage in the vicinity of the derailment site however the ARTC have automatic weather stations located at Rawlinna and Zanthus (Figure 1). Data was recorded at both sites, at 10-minute intervals.

Recordings at Zanthus (about 153 km west of the derailment site), showed the maximum wind speed was 72 km/h at 1430 (about 20 minutes before the derailment). The maximum wind speed 10 minutes before and after this time was no greater than 31km/h.

At the time of the derailment (1450), the maximum wind speed recorded at Rawlinna (about 18 km east of the derailment site) was 15 km/h. Twenty minutes after the derailment (1510), the maximum wind speed at was recorded at 43 km/h.

On 4 December 2015, the recorded average wind direction for both locations was NNE.

Considering the weather systems in the area at the time, it is probable that the downdraught of cold air in the form of a microburst created wind speeds significantly higher than those recorded at the Rawlinna and Zanthus weather stations.

Local weather observations

While working about 18 km east of the derailment site, the two signal maintenance workers observed weather squalls approaching from the north and west. After receiving the call from the NCO requesting their assistance for the crew of 5PM9, the maintenance workers stated that the road was ‘very muddy with large puddles from the recent storm, with water still running along the road a couple of kilometres from the derailment site’. When they arrived at the derailment site about 23 minutes later, they said the storm had passed and reported that ‘it was quite still', and later, ‘there was light rain and wind at times, but not strong’.

Track inspections

The ARTC conducts regular on-track inspections by road / rail vehicles. On the 4 December 2015, the ARTC track inspector commenced a routine on-track inspection and travelled west from Forrest, WA.

At about 1200 the inspector travelled through the locality of Rawlinna. About 20 minutes later the inspector passed the 1421 km mark before taking his vehicle off track near the 1427 km mark to allow for the passage of freight train 5PM1.

Following the derailment later that day, the inspector reported that when travelling through the location of the derailment, near the 1421 km mark:

• the temperature was in upper thirties;
• there were no misalignments;
• no track defects or anything unusual was observed.

PBHY ‘High Cube’ vehicles

Figure 7: Diagram of SCT Logistics PBHY ‘High Cube’ class vehicle

Source: SCT Logistics (diagram not to scale)

In 2005, SCT Logistics (SCT) engaged the Royal Melbourne Institute of Technology University (RMIT) to carry out wind tunnel testing on three rail vehicle profiles.^[8] The tests looked at the aerodynamic forces caused by winds that are considered to have a significant influence on vehicle roll-over. Wind tunnel testing determined the relationship between wind angles and the coefficient used to calculate wind force acting on a specific wagon area and shape.

Tests were carried out using 1/15th scale models of a SCT high cube vehicle having a total height of 5590 mm (Figure 7), a ‘high cube’ vehicle with an extra 300 mm added to the roof profile (5890 mm), and a double stacked container well wagon.

The primary objective of the study was to determine if increasing the size of the SCT ‘high cube’ wagon would result in an increased risk of roll-over when compared to commonly used double stacked well wagons. The results of the study also provide the information required for calculating the effects of wind on the wagons involved in the derailment at Rawlinna on 4 December 2015.

Train 5PM9’s consist report shows that the eight PBHY ‘high cube’ vehicles, positioned 13 to 20 behind the locomotive, were unloaded, having a tare weight of 29.60 t each. The total side area of the standard height PBHY vehicle was 105 m² (Figure 8). This configuration is more susceptible to wheel unloading due to wind force. That is, the configuration has a large side surface area, light weight and relatively high centre of side area.

In calculating the percentage of wheel unloading, a simplified method assumes that the vehicle’s centre of mass acts continuously at the centre point between the two rails (that is, the vehicle suspension is rigid and does not permit body roll). For a train travelling at 90 km/h, 100% wheel unloading on a PBHY class of vehicle was calculated to occur when the effective wind speed^[9] is about 80 km/h and acting at an angle of between 60 degrees and 80 degrees relative to the direction of travel.

Figure 8: Vehicle profile and side area showing elements used in the estimation of forces acting on a PBHY vehicle

Consideration of body roll

Under normal operating conditions, a vehicle will oscillate on its bogies and suspension, and external forces such as wind loading can increase vehicle body roll from side to side. The consequence of this movement is the vehicle’s combined centre of mass will also shift from side to side, significantly affecting the calculations for predicted rollover risk due to wind. The magnitude of this movement for the same roll angle will increase as the height of the centre of mass increases above rail level. The critical elements are the roll angle and the height of the centre of mass above the rail level.

In this case, the eight-coupled PBHY vehicles (positioned 13 to 20 behind the locomotive) were not loaded. Considering the PBHY vehicle weights documented in SCT’s manifest report for the train, the combined centre of mass was calculated at 1200 mm above rail level. Table 1 illustrates the calculated results for predicted 100% wheel unloading for different roll angles of vehicle tilt.

Table 1: Wind speed and angle for predicted 100% wheel unloading

There were also eight loaded PBHY vehicles in the consist at the leading end of the train. These were positioned 5 to 12, immediately behind the crew van and coupled in front of the empty PBHY vehicles mentioned above. The gross mass of these vehicles ranged from 79.33 t to 50.37 t, averaging about 64 tonnes each. The centre of mass for this configuration was calculated as increasing to about 2100 mm above rail level.

As described previously, as the height of the centre of mass above the rail level increases, so too does the lateral shift in centre of mass for the same roll angle.

To identify the influence that centre of mass has on wind induced vehicle rollover, calculations were made with the vehicle’s mass increased to 64 t and the centre of mass raised to 2100 mm above the rail level. All other dimensions remained constant.

Table 2 shows the results for predicted 100% wheel unloading at different roll angles when raising the centre of mass to 2100 mm above rail level.

Table 2: Centre of mass lowered to 2.1 m above rail level

It is evident from the calculations that higher vehicle mass serves to maintain wheel-rail contact at higher wind speeds. However, if a higher mass vehicle begins to tilt, the higher centre of mass serves to increase the potential for wheel unloading and rollover to occur at lower wind speeds.

Consideration of coupled wagons

The second driver described the first wagons to rollover as appearing about 10 vehicles behind the locomotives, suggesting that the empty wagons were most likely the first to derail. This is consistent with the analysis suggesting that lightly loaded wagons were more susceptible to rollover due to strong wind forces.

In this case however, it was also observed that subsequent wagons progressively rolled over towards the front of the train. That is, the loaded wagons considered less susceptible to rollover also began to roll and derail.

It was noted that the couplers on the PBHY wagons involved in this derailment had a bottom retention shelf. Couplers incorporate a bottom shelf to help prevent a mating coupler from falling to the ground, in the event that it had separated from its wagon due to failure. The intent is to reduce the risk of derailment of the following vehicles due to a dislodged coupler passing beneath a wagon.

However, in the context of this derailment, the bottom shelf coupler ensured the adjacent wagon remained coupled during the rollover sequence. This transferred the rotating force between wagons via the coupler. Consequently, the loaded wagons which may have been less susceptible to rollover from wind induced force, also had a rotating force applied through the couplers. This, in conjunction with the higher centre of mass was likely sufficient to cause the progressive rollover of the loaded wagons towards the front of the train consist.

Similar derailments investigated by the ATSB

In its previous published investigations and reports, the ATSB identified a number of factors that should be considered in reducing a vehicle’s risk of wind-induced rollover. These investigations are:

2006012 Tarcoola, South Australia

On 1 November 2006, the ATSB commenced an investigation into a derailment of a freight train near Tarcoola, South Australia. The final report stated it was possible that the combined effects of strong winds at the time and the vehicles’ natural oscillations while travelling could have been sufficient to initiate overturning and derailment of the vehicles lightly loaded with double stacked freight containers. ATSB Tarcoola Investigation Report – RO2006012

RO-2008-013 Loongana, Western Australia

On Tuesday 11 November 2008, freight train 2PM6 derailed on the Nullarbor Plain approximately 11 km west of Loongana in Western Australia. The investigation found that the combined effects of atmospheric wind and induced wind due to train movement was likely to have been sufficient to initiate the overturning and subsequent derailment of a lightly loaded, double stacked vehicle and other vehicles. ATSB Loongana Investigation Report – RO-2008-013

RO-2010-012 Cadney Park, South Australia

On Thursday 25 November 2010, freight train 4DA2 derailed on the Central-Australia Railway line, about 5 km south of Cadney Park in South Australia. The investigation determined that a severe weather event, with very strong winds associated with thunderstorm activity, were of sufficient magnitude to initiate the rollover and subsequent derailment of a group of lightly loaded double-stacked container vehicles. ATSB Cadney Park Investigation Report – RO-2010-012

Common elements of each investigation found:

• Severe localised wind events generated from the downdraught of cold air in the form of a microburst had created wind speeds significantly higher than forecast,
• the freight vehicles provided large side profiles that were susceptible to high side wind forces,
• the freight vehicles were lightly loaded or carrying empty double stacked containers and,
• the combined effects of atmospheric wind speeds due to train movement and vehicle body roll were most likely sufficient to initiate the overturning of the lightly loaded freight vehicles.

__________

•  
  6. Straight track with no applied cant.
  7. A measure of the rate at which the railway is inclined (rising or falling). Gradients are signed +ve (rising) or –ve (falling) in respect of the direction of travel.
  8. Tests were conducted by the School of Aerospace, Mechanical and Manufacturing Engineering at RMIT University for SCT Logistics prior to production of the SCT PBHY High Cube vehicle fleet.
  9. The effective wind speed is a calculation that considers both the speed/direction of the train and the atmospheric wind speed/direction.
  10. Wind angle describes crosswind yaw angle in the direction of train travel. Results were derived from calculations under a range of crosswind yaw angles, from a full head wind to a crosswind (10-degree increments, 0–90 degrees).

Safety analysis

SCT response to severe weather information

At about 0915 (ESDT) on 4 December 2015, the SCT Operations Centre in Victoria received a EWN weather forecast report from the ARTC Train Transit Manager advising severe weather conditions for the Kalgoorlie to Forrest track section.

The table attached to the EWN weather forecast included severe weather alerts and comments at key locations along the rail corridor commencing at Kalgoorlie and east to Cootamundra, NSW. The table listed four colour-coded properties that included three alert levels ranging from amber (heightened alert) to black (severe network disruption) (Table 3). The green colour code signifies no threats for a given region.

Table 3: Part table showing severe weather warnings between Kalgoorlie and Forrest issued on 4 December 2015 by the Early Warning Network

The EWN weather forecast also contained weather forecasts for the next two days, Saturday 5 December to Monday 7 December 2015. These three days contained high and extreme temperature alerts, however no severe wind alerts were forecast for this period.

The forecast of severe storms on 4 December stating ‘damaging wind gusts are the main threats due to the high potential of microbursts’ was the prompt for SCT to remain vigilant about the weather threats affecting the safety of their trains travelling through those regions.

RISSB Rail Hazard Register

The Rail Industry Safety and Standards Board (RISSB) is owned by its rail industry members and is responsible for the development and management of rail industry standards, rules, codes of practice and guidelines.

The RISSB has developed a Rail Hazards Register for committees and development groups engaged in the process of developing new RISSB standards.

The items within the RISSB hazards register were compiled with the extensive assistance of rail industry member expertise and also notes that the itemised list is not exhaustive.

The RISSB hazards register was published on17 March 2015. For the specific risk of vehicles overturning, 11 related factors were shown for derailment (5.28). The register also contains references to another RISSB document that uses fault tree diagrams to describe foreseeable hazards and controls. (Table 4).

Table 4: RISSB Rail Hazard Register - Section 5: for Rolling stock, Vehicles overturning (extract)

Items listed in Table 4 that were relevant to the derailment of 5PM9 are 5.28.1.1, 5.28.1.4 and 5.28.1.5.

SCT Logistics is a RISSB member and has ready access to the register for guidance in the management and maintenance of their risk assessment documentation.

SCT Logistics assessment of weather risks

The SCT Logistics Risk Assessment Register – Mainline Operations was compiled in October 2009. At this time, SCT was transitioning from an operator that contracted the services of a ‘hook and pull [1]’ provider to one that purchased a new locomotive fleet, and directly employed and trained their own train crews.

The SCT risk assessment register identified nine main groups of hazards and risks including:

• Derailment, Train to train collision, Train to object collision, Train collision with infrastructure, Train to motor vehicle collision at level crossing, Fire on train, Explosion on train, Rolling stock runaway and Worker falls from train.

Considering previous similar derailments investigated by the ATSB (noted above) and the derailment of SCT train 3MP9 near Malbooma, SA [2] in 2014, SCT were aware of the derailments and operational hazards associated with weather related events.

SCT’s awareness of weather event risks were not reflected in the risk register and did not identify, assess or record any weather related hazards that could potentially affect the safety of its train operations.

Additionally, although risk management and mitigation notes in SCT’s risk assessment register state that reviews and updates will occur when required or at least annually, the last recorded update to the register was about three years before the derailment of 5PM9 near Rawlinna, WA.

Driver training

SCT contracts Registered Training Organisations (RTO) for the delivery of training for their train crews. The training packages adopted by the RTO’s are developed by the Transport and Logistics Training Skills Council (TILSC)[3].

A review of qualifications achieved by SCT driving crews show two TILSC modules that were likely to include training elements about the awareness of specific weather conditions that may affect the safety of train operations. The modules were titled Responding to abnormal situations and emergencies when driving a train (TLIF4110) and Operate train with due consideration of route conditions (TLIC4023).

An examination of the TILSC documentation shows them to be a framework of qualifications which generally reference a client organisation’s documented procedures and instructions. For example, TLIF4110 includes two elements referring to the identification and response to abnormal situations.

1. Identify abnormal situations and emergencies when driving a train.

1.2.   Implications of abnormal situations and emergencies are evaluated in accordance with workplace requirements, and safe working requirements and procedures.

1.3.   Hazards are identified, risks are assessed, and risk control measures are implemented.

2. Respond to abnormal situations when driving a train.

2.1.   Abnormal situations are responded to in accordance with organisational procedures, received instructions from relevant personnel, regulatory requirements and emergency response plan, as required.

2.2.   Responsibilities are fulfilled in accordance with organisational procedures, and safe working and/or regulatory requirements.

2.4.   Information is provided to relevant personnel as requested in accordance with regulatory and organisational procedures.

In each case, the performance criteria is generalised and refers to information that should be included within individual organisational procedures. Consequently, the RTO would require the organisational procedures to ensure that specific organisational needs are combined within the driver training modules.

Extreme weather events such as damaging winds, rain and flooding, are conditions that a driver may be required to identify and respond to ensure safety of train operations. Experienced train drivers are generally aware of the effects of wind on their train, however train handling in extreme weather was not included within TLI training or SCT documents.

Before the derailment of train 5PM9, SCT had not developed procedures defining the effects of extreme weather events related to the operation of their freight train services. Consequently, SCT locomotive drivers did not receive formal training with respect to understanding severe weather events, the associated risk of these events, and risk mitigation strategies to minimise the likelihood of train derailment.

--------

[1]     Rolling stock and locomotives are owned by SCT Logistics however; a third party contracts train crews and train operating functions.

[2]     RO-2014-006 Derailment of freight train 3MP9 near Malbooma, SA on 10 April 2014

[3]     The Transport and Logistics Industry Skills Council is one of 11 independent, not-for-profit Industry Skills Councils established by the Australian Government.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 5PM9 near Rawlinna, Western Australia on 4 December 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The PBHY ‘High Cube’ vehicles provided a large side surface area that was susceptible to high wind forces and subsequent wheel unloading.
• It is probable that the downdraught of cold air in the form of a microburst near Rawlinna, WA created wind speeds significantly higher than the winds recorded at the ARTC weather stations located at Rawlinna and Zanthus.
• The combined effects of atmospheric wind, induced wind due to train movement and vehicle body roll, was very likely to have initiated the overturning of the lightly loaded, coupled group of PBHY vehicles.
• It is likely that the transference of rotating force through the couplers, due to rollover of adjacent vehicles, contributed to the rollover of the loaded PBHY vehicles, crew van and in-line fuel tanker.

Other factors that increased risk

• The SCT Logistics Risk Assessment Register – Mainline Operations was not updated in accordance with the SCT safety management system and did not identify and assess extreme weather hazards that could affect safe operations of their intermodal freight train services.
• The SCT Logistics locomotive drivers received no formal training with respect to understanding severe weather events, the associated derailment risk, and mitigation strategies to minimise the likelihood of derailment.

Other findings

• Rail vehicles that are loaded will generally display a greater resistance to wheel unloading and wind induced rollover.

Safety actions

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Additional safety action taken by SCT Logistics

On 15 December 2015, SCT Logistics issued a safety alert (1215-01) to train crews and rail managers advising that to reduce the risk of a rollover/derailment:

• ‘the combination of high cross winds with trains travelling at track speeds hauling empty wagons may increase the risk of rollover/derailment. These events are extremely difficult to predict with any accuracy in advance of the occurrence’.
• ‘Initial engineering advice is that the risk of rollover/derailment is reduced by decreasing speed’.
• ‘As a precaution, it is recommended that drivers reduce their train speed to 70 km/h when experiencing severe weather conditions involving strong cross winds. Once clear of these conditions normal track speed may be resumed’.

SCT Logistics is also reviewing and amending the Risk Assessment Register – Mainline Operations to include elements of risk to operations due to adverse weather conditions.

The effects of severe weather on safe train operations will be included in a review of driver training modules.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• SCT Logistics
• The Australian Rail Track Corporation
• The Australian Bureau of Meteorology
• The Early Warning Network (EWN) weather warning subscription service.
• The drivers of train 5PM9.

References

ATSB Investigation: 2006012 - Derailment of Train 3DA2K – Tarcoola, South Australia, 1 November 2006.

ATSB Investigation: RO-2008-013 - Derailment of train 2PM6 – near Loongana, Western Australia, 11 November 2008.

ATSB Investigation: RO-2010-012 - Derailment of freight train 4DA2 near Cadney Park, South Australia, 25 November 2010.

ATSB Investigation: RO-2014-006 - Derailment of freight train 3MP9 near Malbooma, SA on 10 April 2014.

Australian Standard AS 7509.2, Railway Rolling Stock - Dynamic Behaviour - Part 2: Freight Rolling Stock.

Australian Industry and Skills Committee, TLIC4023 - Operate train with due consideration of route conditions

Australian Industry and Skills Committee, TLIF4110 - Responding to abnormal situations and emergencies when driving a train

Australasian Railways Association, Railways of Australia Map.

Rail Industry Safety and Standards Board (RISSB) – Australian Code of Practice – Loading of Rail Freight – May 2011.

RISSB Glossary of Railway Terminology ver1 December 2010.

RMIT University, An Experimental Investigation of Aerodynamic Properties for Rollover Risk of Double Stacked Container Wagons.

Satellite images from Himawari-8 operated by the Japan Meteorological Agency (JMA) and sourced from the Australian Bureau of Meteorology.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from SCT Logistics, the Australian Rail Track Corporation and ONRSR. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Discontinuation notice

Section 21 (2) of the Transport Safety Investigation Act 2003 (the Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.

On 19 November 2015, the ATSB was notified of an occurrence involving an Airbus A321, operated by Jetstar Airways. During take-off on 29 October 2015, the flight crew encountered difficulty rotating the aircraft.^[1] A subsequent passenger count found that passengers had not been allocated seats in accordance with the aircraft’s weight and balance requirements, making the aircraft nose heavy.

The ATSB initiated investigation AO-2015-139 on 23 November 2015. Later, the ATSB became aware of three previous events involving the same operator. They were initially investigated as related occurrences as part of AO-2015-139. On 8 September 2017, due to the common factors involved, the ATSB changed the investigation type to a safety issues investigation and it was re‑numbered AI-2015-139. A fifth occurrence, also involving the same operator, was added to the investigation scope in October 2017. A summary of each occurrence is provided at the end of this notice.

On these five separate occasions, and probably others, aircraft were loaded with incorrect passenger distributions or with incorrect passenger numbers used to determine the aircraft's weight and balance. This placed increased operational pressure on flight and cabin crews and, on at least one occasion, adversely affected aircraft performance during take-off. Records show that there were other flights where erroneous passenger loading was discovered before pushback.

Four of the occurrences followed the introduction of a new type of mobile boarding manager (MBM) device used to scan passenger boarding passes and tally the passengers as they boarded. In each case, technical faults and/or erroneous operation of the MBM led to incorrect passenger loading information being provided to flight crews. On two of those occasions, passenger seating allocations were erroneous after a late change of aircraft type.

The ATSB obtained and analysed a large amount of evidence, mostly information from the operator, and interviewed relevant operational personnel during the initial occurrence investigation. However, there were significant and ongoing difficulties in obtaining documentation associated with the project to introduce then new MBM in 2015 and some related matters.

The ATSB strives to use its limited resources for maximum safety benefit and considers that:

• The operator’s organisational context has significantly changed in the 3 years since the investigation began, likely making some of the organisational aspects of the investigation no longer relevant.
• The operator conducted internal safety investigations into the relevant occurrences, and there is significant overlap between the operator’s findings and the ATSB’s provisional findings. The operator has taken action to address those issues in regular consultation with the Civil Aviation Safety Authority.
• The potential safety issues identified to date provide only limited benefit to the greater aviation industry.
• Significant further investigation work would be required to obtain sufficient information to develop provisional investigation findings into safety issues that meet the ATSB’s standards for rigour and defensibility.
• Based on the available information, the risk controls currently in place and the operating context, the ATSB considers any undetected passenger loading problem associated with the identified limitations were very unlikely to have a significant operational impact.

Consequently, the ATSB has discontinued this investigation, and will communicate all additional provisional safety issues and learnings to the operator to reduce future risk. These included limitations in the management of passenger load discrepancies and late aircraft changes, support for concourse staff, management of the then MBM development project,^[2] and the framework for operational change. The investigation information collected and analysed to date remains available as reference material for future ATSB investigations.

Summary of occurrences

• On 16 June 2015 an Airbus A321 registered VH‑VWY was being prepared for a flight from Sydney, New South Wales (NSW), to Hobart, Tasmania, after the scheduled Airbus A320 aircraft became unavailable. After the passengers had boarded, the flight crew identified that the aircraft was loaded too nose heavy for take-off, because the passenger distribution in the cabin was too far forward. To balance the aircraft, the captain ordered the underfloor cargo to be rearranged in a manner that contravened the aircraft’s loading requirements and then continued the planned flight. It was later established that passenger seating allocations had been determined using the seat map for an A320 instead of an A321.
• While processing passenger data after an Airbus A320 registered VH‑VFQ departed Brisbane, Queensland for Newcastle, NSW on 6 October 2015, ground staff discovered a passenger count discrepancy between the final boarding report and the central check-in computer. The flight crew were contacted and an in-flight passenger count found that 15 more passengers were aboard than accounted for during pre-flight planning. This affected the flight crew’s weight and performance calculations, but the minor effect of the increased weight had not been noticed by the crew on take-off. The flight crew amended the calculations prior to approach and landing.
• During a flight from Brisbane to Melbourne, Victoria on 19 October 2015, the crew of an Airbus A320 registered VH‑VQG identified a passenger count discrepancy after a cabin crewmember mentioned the large number of passengers on board to the flight crew. They found that 15 more passengers were aboard than accounted for during pre-flight planning. This affected the flight crew’s weight and performance calculations, but the minor effect of the increased weight had not been noticed by the crew on take-off. The flight crew amended the calculations prior to approach and landing.
• On 29 October 2015, an Airbus A321 registered VH‑VWT was being operated from Melbourne to Perth, Western Australia, after the scheduled Airbus A320 aircraft became unavailable. During take-off, the pilot flying needed significantly more control input than normal to rotate the aircraft. After conducting a passenger count, the crew found that the passenger distribution in the cabin was too far forward, making the aircraft nose heavy. The crew moved six passengers to the rear zone for the remainder of the flight, and amended the weight and balance calculations prior to approach and landing. It was later established that passenger seating allocations had been determined using the seat map for an A320 instead of an A321.
• While processing passenger data after an Airbus A320 registered VH‑VGR departed Sydney for Melbourne on 23 October 2017, ground staff discovered an unusual discrepancy between the provisional and final boarding reports. The flight crew were contacted and an in-flight passenger count found that 22 more passengers were on board than accounted for during pre-flight planning. This affected the flight crew’s weight and performance calculations, but the minor effect of the increased weight had not been noticed by the crew on take-off. The flight crew amended the calculations prior to approach and landing.

_______________

[1]     Rotate: lift an aircraft’s nose on take-off.

[2]     The operator reported to the ATSB that it has subsequently introduced a fully redesigned MBM without these issues.

What happened

On 19 November 2015, at about 1455 Eastern Standard Time (EST), a Jabiru J430 aircraft, registered VH-SZQ (SZQ), departed Kingaroy for Goondiwindi, Queensland (Qld). The pilot was the only person on board the private flight.

Earlier that day, the pilot had departed Bundaberg, Qld, where the aircraft engine had undergone maintenance that involved the installation of six new engine cylinder barrels and new piston rings. To ensure that the new cylinders barrels and rings would wear together to form a good seal, the pilot adjusted the engine RPM about every 15 minutes and closely monitored the engine oil pressure, oil temperature, cylinder head temperature (CHT) and exhaust gas temperature (EGT) gauges. Each of the six cylinders had a CHT and EGT sensor installed.

During the cruise at about 6,500 ft, and about 40 minutes after departing Kingaroy, abeam Dunmore, the pilot heard a noise coming from the aircraft engine, which then started to vibrate. The pilot moved the engine throttle control to the idle position, and about 8 seconds later the pilot heard a metallic noise and the engine stopped.

The pilot established the aircraft in a glide and looked for a suitable forced landing area. An airstrip was identified on an electronic world aeronautical chart (WAC), about 4 NM to the left of track, which the pilot initially navigated towards. The pilot was unable to locate the strip and subsequently turned towards a property where they could see people, houses, sheds and a highly visible white road (Figure 1).

Figure 1: Map showing the relevant features of the landing area

Source: Google earth, modified by the ATSB

At about 4,000 ft, the pilot selected a landing area on the road between the houses and a cattle grid (landing area A in Figure 2). SZQ entered on the downwind leg for a left circuit with the final approach towards the west. The pilot identified power lines close to the road (landing area A) and as they were unsure if they crossed the road, selected the road beyond the cattle grid as the land area (landing area B in Figure 2). The pilot completed the downwind and forced landing checks, and left the electrical master switch on to adjust the flap position when required.

At about 50 feet on final approach, the pilot was able to see that the power lines were far enough away from the road of landing area A that they would not be a hazard, and elected to land on the initial landing area selected. The pilot selected full flap and selected the electrical master switch off. The pilot side-slipped^[1] the aircraft to descend quicker. Consequently, the pilot realised that the aircraft’s speed was too fast to land on landing area A and extended to the second landing area, landing area B, and climbed slightly to clear the cattle grid.

The left main landing gear collided with the grid and failed, partially remaining attached to the aircraft. The pilot flared for a landing and the left landing gear dug into the ground and swung the aircraft to the left. The aircraft subsequently collided with a fence and came to a stop about 100 m beyond the cattle grid. The pilot exited the aircraft. The pilot was not injured. The aircraft was substantially damaged.

Figure 2: Diagram representing the circuit pattern and landing areas

Source: Google earth, modified by the ATSB

Pilot comment

The pilot reported that there was thick smoke in the area from fires some distance away. The smoke only affected the horizontal visibility, which was reduced to 6 km. The wind was light with no obvious signs to determine the local wind direction. The temperature was about 28 ⁰C.

The pilot indicated that there was about 12 minutes from when the engine stopped to landing so they had time to analyse the situation. The pilot felt prepared for the forced landing due to the quality of the flight instruction they had received over the years. The pilot reported that no distress call was broadcast to air traffic control.

The pilot reported that prior to the departure from Bundaberg, three circuits were conducted in SZQ. After landing, maintenance personnel inspected the engine and no defects were reported. The pilot did not notice any issues with the engine prior to the failure.

The pilot indicated that the engine total time in service since new was about 756 hours and the time since a bulk strip/rebuild was about 187 hours.

Engine certification

The aircraft was an amateur-built Jabiru J430 and was operated as an experimental aircraft, issued with an experimental certificate. The original equipment manufacturer (OEM) (Jabiru Aircraft) manufactured the aircraft engine. The engine was installed on the aircraft in 2006 at the time of the aircraft build. In 2013 during an engine bulk strip/rebuild, part of the engine was modified with the installation of non-OEM parts resulting in the engine having a unique configuration. As the aircraft was an amateur-built aircraft, the original owner/builder certified for the installation of those parts. The annual inspection of the engine that was conducted prior to the most recent maintenance was conducted at an aircraft maintenance organisation.

Examination of the failed engine at the engine OEM

The failed engine was first examined at the engine OEM, and the Civil Aviation Safety Authority (CASA) was present at the examination. The engine examination identified the reason for the engine failure as a defect in the valve train where the valve head had made contact with the piston, resulting in significant secondary damage to the number 6 piston and cylinder. The three most likely reasons for the failure were identified by CASA as:

• The most recent maintenance event introduced a foreign body or dislodged existing deposits (of carbon) into the system, allowing debris to enter the valve guide/stem resulting in a sticking valve with the subsequent resulting damage of piston to valve contact.
• A sticking number 6 exhaust valve due to reduced clearances between the valve guide/stem. The effect of thermal expansion with non-OEM parts suggests that there is a possibility that original design clearances were not maintained.
• Incorrect clearances within the valve train, resulting in overheating of the valve stem and subsequent necking and cracking at the base of the stem, releasing the valve head into the cylinder. This was assessed as the least likely failure mode, as the levels of observed blackening (overheating) under the rocker covers was considered to be of a degree that would not result in this type of failure.

The examination concluded that the damage observed had the hallmarks of a sticking valve as opposed to a burned valve. Due to the substantial secondary damage destroying most of the evidence, an absolute conclusion could not be made.

Engine examination at the organisation that assisted in the last maintenance on the engine

The organisation that assisted the original owner/builder to bulk strip/rebuild the engine in 2013, and assisted in the most recent maintenance, conducted a second separate examination of the failed engine and noted the following:

• In 2013, the original owner/builder was provided assistance to bulk strip/rebuild the engine (builder assist bulk strip/rebuild), and some CAMit Aero Engine (CAE) components were installed. This did not include replacing the pistons.
• The maintenance immediately prior to the engine failure was to fit new CAE cylinder barrels and rings and engine oil inhibiting jets to the intake ports. The new owner (not the original owner/builder) advised that the engine EGT was too high and a different carburettor main fuel jet was installed.
• The number 6 cylinder failed resulting in the engine stopping.
• The head of the number 6 exhaust valve was separated from the stem. The valve stem fracture area had severe mechanical damage after its separation but there was no sign of a fatigue fracture. The valve stem was ‘S’ bent in the semi-closed position which would indicate that the valve was not fully open when a possible mechanical collision with the piston was encountered. There was no evidence of significant heat damage to the valve stem (Figure 3).
• The number 6 piston had completely dis-integrated (Figure 4).

Figure 3: Failed valve head and valve stem

Source: Organisation that assisted in the last maintenance, modified by the ATSB

Figure 4: Recovered parts of the number 6 piston

Source: Organisation that assisted in the last maintenance

• No damage was observed in the valve train such as bent pushrods or damaged rocker arms and adequate clearance was evident in the valve guide.
• It is possible that this engine had been run at a high EGT during maximum power settings since the engine bulk strip/ rebuild.
• Four small pieces of piston skirt were identified and showed signs that they were fractured before the failure. The shiny, peened surface of the fracture faces appeared to indicate cyclic compressive forces to a crack surface during engine operation.
• An inspection of the remaining pistons for evidence of cracks revealed that the five other pistons were also cracked before the engine failed (Figure 5). The cracks all initiate at a stress raiser between the piston skirt and the piston-pin boss web. This stress raiser is machined into the piston during original manufacture for jigging purposes.
• It is most likely that an initial partial failure of the number 6 piston skirt allowed piston debris to lodge between one side of the head of the valve and the valve seat. The next stroke of the piston would then collide with the partially closed valve bending the valve head about the obstruction and generating enough leverage to fracture the head off the valve stem; initiating the final destruction of the cylinder components.
• The high EGTs reported would indicate that detonation^[2] could have been encountered on multiple occasions, which would apply excessive stress at the stress raisers on the piston skirts.

Figure 5: Location of crack detected in all five pistons and example of crack location shown on a piston assembly

Source Organisation that assisted in the last maintenance and CASA, modified by the ATSB

Engine fuel type

The owner reported that the aircraft’s engine had been operated for a period of time on Australian premium unleaded motor spirit (MOGAS) of 95 RON (Research Octane Number). A little while prior to the accident, the owner identified a Jabiru service letter Alcohol, Lead, Compression Ratio: Fuel Guidance JSL007-6 effective date 12 August 2015 and has since only been using Australian aviation gasoline (AVGAS). The service letter is applicable to experimental models, in all models and variants of Jabiru engines and is available from the Jabiru website.

The service letter discussed that when burning a fuel in a piston engine, one of the most important characteristics of the fuel is how much load it can take without detonation. Detonation results in excess temperature and pressure in the engine and in extreme cases can break pistons or cause other damage very quickly. The service letter notes that operators use MOGAS at their own risk and recommends where possible the use of AVGAS. AVGAS is a fuel specifically designed for aircraft use and is subject to very strict documentation and quality assurance. The vast majority of MOGAS blends have lower octane ratings and are therefore less resistant to detonation than AVGAS blends. Many automotive MOGAS blends rely on highly volatile components. During storage, those volatiles can be lost rapidly and the fuel’s performance can degrade significantly in a relatively short period. The service letter notes that it is possible for MOGAS to lose several points from its octane rating while stored, leaving the engine vulnerable to detonation.

The organisation that assisted in the last maintenance indicated that it is possible that light detonation on previous flights may have overstressed the piston at the stress raiser and initiate a fatigue failure of the number 6 piston. The examination of the engine pistons and cylinders did not extend to analysing the combustion deposits for evidence of detonation from previous flights.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Organisation that assisted in the last maintenance

As a result of this occurrence, the organisation that assisted in the last maintenance has advised the ATSB that they are taking the following safety actions:

• All CAE pistons will be modified to minimise the stress raiser that was found in the non-CAE pistons installed on SZQs engine, which will reduce the detonation sensitivity of the pistons.
• A survey of CAE engine owners will be conducted asking questions relating to their engine EGTs to gauge the risk of similar failures.
• Maintenance advice to check all reused pistons for cracks and to modify the stress raiser will become standard practice.
• A test engine has been subjected to similar conditions to enable more accurate failure mode analysis in the future.

Safety message

Pilots should consider the effect an in-flight engine failure at different altitudes has on the time available to manage that failure and identify a suitable forced landing area. In this instance, the pilot had about 12 minutes from the engine failure to landing and was able to consider the options, with enough time to manoeuvre towards a different area (road on property) when the first was not suitable. Regularly updating forced landing options during a flight is particularly important in the event of a time critical situation.

CASA Flight Safety Australia magazine July-August 2007 article Emergency: staying in control is available from the CASA website. The article discusses that reporting an emergency is important when time permits, just in case not everything goes to plan. It is not an inconvenience: it’s what air traffic controllers are trained and qualified to do. They are skilled in dealing with emergencies and providing professional appropriate assistance. Where emergency situations arise, an early in-flight emergency notification will assist in expediting the desired outcome – a safe landing.

The accident also highlights the importance to owners and operators to remain aware of information published by the aircraft and engine manufacturer.

The ATSB has recently published an analysis of reported engine failures: Engine failures and malfunctions in light aeroplanes (AR-2013-107) and is available from the ATSB website. That report found that over the six years between 2009 and 2014, there were 322 engine failures or malfunctions involving single-engine piston aeroplanes up to 800 kg maximum take-off weight. Valve train related fractures were one of the most common failures found.

Aviation Short Investigations Bulletin - Issue 49

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Flight manoeuvre where the flight path is inclined downwards and there is a steady loss of height without significant change in airspeed. The longitudinal axis of the aircraft is markedly displaced from the flightpath.
2. Detonation is the uncontrolled explosion of the fuel/air mixture in the combustion chamber of a piston engine cylinder, as distinct from an even and progressive burning. Light to medium detonation may result in some mechanical damage.

On 11 November 2015, a Jabiru J160 aircraft, Recreational Aviation Australia (RAAus) registration 19-7549, sustained a partial loss of engine power while enroute from Gunnedah to Cessnock, NSW. Unable to maintain altitude, the pilot elected to divert to Scone aerodrome. However, due to an increasing rate of descent, the pilot conducted an emergency landing into an open field near Scone. The aircraft landed without incident.

Blockage of the wing fuel tank filler vent cap was found during the subsequent inspection of the aircraft fuel system. Partial disassembly of the engine also identified that the number-four cylinder had sustained a broken inlet valve spring.

The Civil Aviation Safety Authority (CASA) commenced an investigation into the circumstances surrounding the engine power loss. CASA requested the technical assistance and oversight of the Australian Transport Safety Bureau (ATSB) in conducting a detailed examination of the occurrence aircraft and its engine. To facilitate this assistance, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

A report detailing the examinations and ATSB's findings was provided to CASA, RAAus and the aircraft manufacturer, on 30 May 2016. Enquiries relating to the investigation should be directed to CASA on 131 757.

Figure 1: The engine from Jabiru J160 aircraft, RAAus registration 19-7549

______________

The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.

What happened

Early on the morning of 11 November 2015, a Watco freight train, 4K26, was travelling southbound on the Frenches to East Northam rail line in Western Australia. The train was travelling at about 60 km/hr along a section of track as it approached a left corner, approximately 3 km north of Northam (Figure 1). As the train rounded the corner, the driver saw a hot air balloon in close proximity to the rail tracks. The driver observed that the balloon was low to the ground and inside the rail corridor,^[1] to the left side of the track (Figure 2).

Figure 1: Location of incident with rail line (white) showing direction of travel of the train, the approximate width of the rail corridor (yellow), the direction of travel of the hot air balloon (orange dashed line) and the approximate position of the hot-air balloon (red mark)

Source: Google maps. Modified by ATSB

Figure 2: View from train driver’s cabin as the train rounded the corner with the approximate position of the fences (yellow) either side of the rail line marking the rail corridor

Source: Watco driver’s video, modified by ATSB

The driver estimated that the balloon was approximately 200–300 m in front of the train and applied full service brakes. However, the driver realised there would be insufficient distance for the train to come to a complete stop before passing the balloon. At the same time as applying the brakes, the driver also sounded the train’s horn to warn the balloon that the train was approaching. The driver slowed the train to about 20 km/hr as it passed the balloon.

Figure 3: Picture from the train driver’s cabin just before the train passed the balloon’s position with the approximate position of the fence on the left side (yellow)

Source: Watco driver’s video, modified by ATSB

The Kavanagh Balloons E-300, registered VH-LPG, had taken off east of Northam earlier in the morning for a scenic flight, with the pilot and 16 passengers on board. The pilot’s initial intention was to land in a paddock to the west of the rail line. However, the prevailing wind meant that this was not an option. Instead, they elected to land in the paddock east of the railway line, as the pilot judged it to be the most suitable location in the area. Also, flying to an alternative landing site may have unnecessarily impinged on fuel reserves with the prevailing winds and weather conditions on the morning.

The pilot crossed the rail line from the south-west to the north-east at a height of approximately 50–60 ft, and then descended to around fence top height. The pilot’s intention was to land inside the paddock, just after the fence line at the edge of the rail corridor. As the train came around the corner, the hot air balloon was on descent to the paddock. When the train passed the balloon, the pilot reported the basket was just above fence height and moving away from the rail tracks. The balloon crossed over the fence and landed in the paddock without incident.

Pilot comments

The pilot of the balloon made the following comments in relation to the event:

• Crops in the centre of the paddock and a powerline limited the available landing space, which meant the pilot was landing close to the fence.
• The pilot had landed in the same paddock on many occasions without problems.
• The pilot did not recall hearing the train horn or brakes until the train passed the balloon.

Train driver and observer comments

The train driver and observer made the following additional comments:

• The driver and observer saw the balloon in the distance, however due to the winding track it was not possible to see the location of the balloon relative to the track, until the train came around the bend.
• They were unable to discern the direction of travel of the balloon.
• When they saw the balloon, they believed a collision was likely.
• They suggested that an awareness of the train schedule by balloon operators may avoid a similar event.

Proactive safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Balloon operator

The balloon operator is amending the Low Flying Operations section of their Operations Manual to include the following:

A minimum height of 50 feet shall be maintained when the flight path of the balloon will cause it to cross over a road reserve or rail corridor.

Safety message

Rail corridors are areas where access is strictly controlled as the presence of non-authorised or unexpected personnel and/or vehicles may pose a danger to the safety of rail operations and personnel. Trains require significant distance to come to a complete stop and may not be able to avoid colliding with an obstruction that is on, or near, the tracks.

Operators of balloons or other aircraft that may fly at low-level in the vicinity of rail tracks should consider and minimise risks when operating in these environments.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Rail corridor: The rail corridor is defined ‘fence line to fence line’ either side of the rail tracks. Where there is no fence line, the corridor may be defined as a specified distance either side of the outside rail of the rail track. Any person/vehicle inside the rail corridor is considered to be in close proximity to the rail tracks