Safety summary

What happened

On 15 June 2016, Sydney Trains’ maintenance staff identified the 64 crossover points^[1] (64 points) at Clyde yard as unfit for service and arranged to book the points out of use. 63B points on the Up Main line were also booked out of service to prevent rail traffic from operating over 64 points.

On 18 June 2016, Sydney Trains’ maintenance staff obtained a Track Occupancy Authority (TOA) to protect civil rectification work on 64 points. The protective limits of the TOA extended only to defined clearance points on either side of 64 points and did not include 63B points.

At approximately 0530, as the repairs neared completion, two members of a signal maintenance team (SMT) tasked to test and certify the operation of 64 and 63B points, arrived at Clyde yard. Both members of the team entered the danger zone near 63B points where train W510 struck and fatally injured one worker.

What the ATSB found

Sydney Trains’ work-planning process, involving multiple work groups, did not assure the consideration of worksite safety for all tasks undertaken by each involved party over the duration of the work and when returning the rail infrastructure into service.

The Protection Officer (PO), who was part of the civil maintenance team, was aware of the signal team’s work tasks but did not consider these in his worksite protection arrangements. The PO had briefed the civil maintenance team, but did not brief the signal team, and the signal team did not seek a pre-work briefing before commencing work on-track. The PO was not provided with a briefing on the scope of the signal team work and did not provide protection at 63 points.

The signal team assumed their workplace was within the limits of the TOA and did not plan their own worksite protection. The signal team entered the danger zone unprotected and unaware of the approach of W510, and the Clyde Signaller did not recognise the signal team were in an unprotected area.

Network communications by various parties in Sydney Trains were not in accordance with the principles underpinning the network rules.

Although not contributing to the accident, the ATSB also found that Sydney Trains’ preference to keep the Up Main operational influenced the selection to use the clipped and locked 63B points to protect the worksite at 64 Points. The worksite protection method presented an increased risk in that if track workers inadvertently exited the worksite, they would be in the immediate vicinity of operational main line rail traffic.

The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite.

Finally, the lack of use of train headlights at night and the absence of any supplementary lighting (such as beacons) may have increased the likelihood of a train driver not seeing workers in the danger zone.

What has been done as a result

Sydney Trains delivered on a number of safety actions and commitments following the incident.

Some of the direct actions to address the contributing factors to the incident were:

• Review and validation of proposed worksite protection plans is required through Sydney Trains’ Corridor Safety Centre.
• Increased numbers of rail safety coaches and mentors, with a required coaching session for all Protection Officers at least once per year.
• Protection Officers are required to implement a form of worksite protection at least once every quarter to remain eligible to be re-certified as a Protection Officer, this activity is monitored by the Corridor Safety Centre.

Additionally, Sydney Trains established a Post Incident Assurance Group (PIAG) to respond to the incident. This group established key focus areas to promote the safety of workers and avoid future incidents. These areas included; Worksite protection, Culture, Planning for maintenance work and Safety critical communications.

The PIAG later established the Safety Focus Program, which included key initiatives:

• Safety Focus Sessions
• Safety Culture Program
• Improvements to Protection Officer selection and training
• Signal Key Switch Project
• Safety Critical Communication Enterprise Wide Program
• Maintenance Access Planning Project, and
• ATRICS ASB.

Safety message

This accident highlights the importance of planning and integrating safety across the entire scope of work. It also highlights the importance of briefing all workers and all workers seeking a safety briefing about the worksite protection plans before work commences and when circumstances change.

__________

1. 64 points was a set of crossover points, designed to allow rolling stock to cross over from one track to the other over the set of points. Crossover points have two ends (turnouts) that attach to the two rail lines. 64 points allowed trains to cross over from the Up storage siding to the Down through road (see Figure 7).

Safety analysis

Planning for the full scope of work

For any track rectification work, the section of track requiring work needs: firstly, to be booked out of service; secondly, worked upon and rectified; and thirdly, tested and booked back into service. At each stage, where workers are required to access or occupy the rail track, suitable safety measures are implemented to protect those people on track.

Each phase of work can be and was often completed independently.

For the work on 64 points crossover, 63 and 64 points were booked out of service on 16 June 2016. The signals team booked out and clipped 63 points and arranged their own protection to do this safely. The civil team booked out 64 points and arranged their own protection to do this safely.

For the rectification works on 64 points crossover, the civil team implemented safety measures that protected the workers at 64 points.

For the electrical testing of 63 and 64 points prior to booking them back into service, the SMT could have done this independently of the civil team. However circumstances on the night meant the two work teams and their tasks interacted.

At no point prior had there been any discussion about planning for the work teams to interact and how to manage safety of the workers should this scenario occur.

Sydney Trains’ system controlled this scenario by requiring the PO or Supervisor to provide a pre-work brief and for the PO to ensure all workers sign the pre-work briefing form. In the vast majority of cases, this singular control had been effective.

For the work on 64 points crossover, the local management chose to conduct the work under emergency provisions and planning was completed close to the start of works.

The job did not go to plan with significant delays to the start time and during the job. At the time the SMT arrived on site to electrically test points and “support the civil team”, the PO and Supervisor were pre-occupied managing the work and did not brief the SMT.

Sydney Trains’ planning process for emergency works was ineffective in that it tolerated local management at Clyde Network Base triggering the repair of the defective sleepers under emergency work provisions to expedite the return of a siding track into service for stabling race day trains the following day without consideration of the full scope of work.

The responsibility for coordinating access to the track for the repair work and planning for worksite protection subsequently transferred on the night of the works from local managers to the CMT team leader, SMT team leader and PO respectively. The CMT team leader and PO were directly involved in planning the sleeper rectification work and its worksite protection. The SMT members were not involved in planning the work and the SMT Electrician only received instruction from the Signals Team Leader via an e-mail read at the commencement of the SMT Electrician’s night shift.

The instruction contained in the e-mails from the Signal Team Leader to the SMT Electrician were ambiguous appearing to link 63 and 64 points to the proposed civil works. This likely influenced the perception of the SMT Electrician that the 63B points were part of the civil task and the assumption that they would therefore be within the limits of the protections implemented by the PO.

Although the PO was aware of the requirement for the SMT to attend at the Clyde yard toward the end of the civil work, the PO directed his attention to the immediate task of accessing the track and implementation of worksite protections for the commencement of civil work at 64 points. The SMT members were not asked and did not attend the pre-work briefings involving the CMT workgroup conducted by the PO at either the Clyde yard or PN yards.

It was likely that the PO considered the SMT were functioning as a separate workgroup managing their own protections. Consequently, there was no consideration in the planning for the civil work, or the associated worksite protections, of the scope of work intended by the SMT as a part of the civil workgroup or as a separate workgroup interfacing with the civil group to remove an IBA and return rail infrastructure into service.

Fatigue management

Circadian effects, time on task (including breaks between shifts) and inadequate sleep opportunity are some of the recognised primary risk factors for fatigue related performance degradation. The Signal Mechanic and the Signal Maintainer were working to their normal rostering pattern and mostly likely the least affected, if at all, by fatigue.

The Civil Protection Officer and the Civil Team Leader were rostered on a day shift and then after a 4-5 hour break returned for the emergency overtime shift. The length of the break in between shifts was significantly less than that applied from the Sydney Train’s typical rostering principles requiring a minimum of 12 hours’ rest to allow for recovery and sleep. The break, considering time allocated for commuting, meals and hygiene, allowed for considerably less than 5 hours sleep, which according to Dawson and McCulloch (2005), would be ‘inconsistent with a safe system of work’. With the limited sleep obtained and limited sleep opportunity provided between shifts; it is likely that the Protection Officer and Civil team Leader were experiencing levels of fatigue known to affect performance. However, in the context of the work tasks they were involved in on the night and their performance of these tasks, the ATSB did not consider their level of fatigue influenced decisions made on the night of the accident.

The planning and approval processes for the emergency works at Clyde yard did not consider, in the case of the PO and Civil team leader, the possibility and consequences of worker fatigue during the emergency overtime works arising from limited rest opportunity between shifts, time on task and extended wakefulness increasing the risk of fatigue and fatigue-related errors. With the absence of oversight by line management, the risk control for the management of fatigue relied solely on self-assessment by the workers onsite.

Worksite protection arrangements

At about 1900 on 17 June 2016, the PO contacted the Clyde Signaller to initiate discussion about the night’s work. At that point, the PO was seeking advice whether the permit to work within the PN yard adequately protected the worksite and the need to take out a TOA from Sydney Trains. Over the following 5 hours, multiple phone conversations between the PO and various parties discussed the work and necessary protection arrangements.

While the PO participated in a number of these discussions, many were between various operations staff to determine how to apply the proposed protection arrangements. By about 2320, the train controller confirmed that a TOA was required and advised the PO there was no problem with using 63B points clipped and locked in the normal positon as protection against trains entering the worksite from the main line.

The PO repeatedly raised his understanding that if the protecting controlled absolute signal was within 500 m of the worksite, an occupancy of the main line was required to provide a 500 m separation between the worksite and the worksite protections, he was not aware the Network Rules afforded an alternative option but accepted the advice of other operations staff.

Following the completion of the pre-work briefing and an hour later, the PN permit to work, members from the civil work group accessed the danger zone at 64 points to undertake preparatory work. Although no trains were in the area at that time, and with points 63B clipped in the normal positon mechanically preventing access by trains from the main line, CMT personnel had entered the danger zone and commenced work around 2 hours before the required safety measures were in place through the authorisation of TOA 35.

By the time civil works neared completion, there was no record of the SMT members participating in a pre-work briefing with the PO before accessing the worksite to commence their work. At this time, the civil workgroup members were preoccupied with packing up equipment. Around the same time, the PO was arranging with operations staffs to take out another TOA (as TOA 35 was to expire), so the civil team leader could complete a final inspection of the track before returning it to service. The civil team member’s and PO’s attention was almost certainly directed toward completing their tasks as soon as possible and not the activity of the SMT.

There were recollections of discussions between SMT and CMT members upon the SMT entering the civil group’s worksite area and when commencing tests of the electrical functionality of 64 points. None of the discussions pertained to the limits of the TOA or extent of worksite protections.

There were variances in recollections between the civil team leader, SMT Electrician and PO of the content of the verbal exchanges that occurred regarding the TOA and worksite protection arrangements in place. It is likely that:

• The PO understood the SMT and their task were separate to the civil task and workgroup, and therefore assumed they would arrange their own worksite protections to undertake the electrical testing of points as experienced on previous occasions when a signals work group were involved with a civil work group.
• The SMT members were aware a TOA was in place protecting the civil worksite but were not alerted to the TOA limits and details of worksite protections during the verbal exchanges with civil team members onsite.
• The SMT members had formed an assumption, based on information provided to them at the beginning of their rostered shift that, points 63B were included in the civil scope of work and would therefore lie within the limits of the TOA.

There was no evidence that the SMT received, or sought to receive, a formal pre-work briefing from the PO about the rail safety component of worksite protection prior to commencing their work on 64 points. The Sydney Trains’ network rules for work in the rail corridor placed responsibility on the PO and Site Supervisor to brief workers, but did not similarly compel a worker arriving at a worksite to ensure they sought out the PO/Site Supervisor, explained their task, and did not commence any work until the requirements of pre-work briefing were completed.

The absence of an understanding of the TOA limits and its associated protections, together with the lack of track signals, flags/lights or any additional facility to remind/alert workers of the worksite limits, the SMT members unknowingly exited the protected worksite area and into the immediate vicinity of operational main line rail traffic.

The SMT Electrician commenced the removal of the point clip potentially compromising the effectiveness of the protections associated with TOA 36. Although the SMT Electrician was in mobile phone contact with the Clyde Signaller and narrating his intended actions, the Clyde Signaller did not realise the SMT had exited the protected worksite area. This was likely due to the Clyde Signaller directing attention toward fulfilling TOA 35 with the Outer Board Controller.

Following the fulfilment of TOA 35 at 0600, the subsequent issuance of TOA 36 maintained worksite protections for the Sydney Trains network. However, the authority to occupy the track provided by the PN permit to work expired at 0500. There is no record of an extension of the PN permit to work between 0500 and the fulfilment of TOA 36 at 0654.

Worksite protections of a TOA

The fundamental principles of the work-on-track rules were to provide clear separation between track workers and trains. A TOA achieved this through providing exclusive track occupancy for track workers undertaking work on track.

Under a TOA, worksite protection (track signals, flags/lights) was normally placed at least 500 m from the worksite and blocking facilities applied to all entry points into the TOA limits. In effect, this provided a buffer zone of at least 500 m outside a worksite, plus a further train exclusion zone in excess of 500 m from the worksite. That is, trains must stop at the protecting controlled absolute signal. If a train inadvertently passes the protecting signal, then the train will trigger the audible track signal warning devices at least 500 m before reaching the worksite (Figure 15). This delivered an additional level of control to track workers by providing advice of an approaching train.

Figure 15: Worksite protection

Source: NPR 701 Using a Track Occupancy Authority – modified and annotated for clarity

The TOA rule (NWT 304) and procedure (NPR 701) also provide for a scenario where the protecting controlled absolute signal may be less than 500 m from the worksite, so long as points can be clipped and locked for a different route. It was this scenario that was considered for the night of 17 June 2016.

In this case, the authority (TOA 35) defined the limits as the track between 23L signal and 24R signal. This also reflected the worksite boundaries since both signals were relatively close to 64 points. No further protection was provided on the main line, since 63B points were already clipped and locked. Consequently, the main line remained available for unrestricted rail traffic while work was undertaken on 64 points (Figure 16). This method did not provide advice of approaching trains on the Up Main.

Figure 16: Worksite protection

Source: ATSB

Under the arrangements implemented on 17/18 June 2016, the buffer zone between the worksite and unrestricted main line rail traffic was considerably less than 500 m, noting the distance between the worksite and 63B points was about 50 m. It is evident that under this arrangement, there is an increased probability, a track worker could move along the track, inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. The arrangement did not include any additional audible or visual warning devices for approaching trains, or any facilities for reminding track workers of the worksite limits.

In addition, the arrangement allowed main line rail traffic to operate normally over the facilities used for protecting the TOA limits and worksite, a condition not permitted under any other protection arrangement defined in the TOA rules.

The worksite protection method presented an increased risk, in that track workers might inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. Sydney Trains network rules and procedures for a Track Occupancy Authority did not identify the increased risk associated with the chosen worksite protection method.

Conspicuity of track workers on or about the track

Unless needed for safety, Sydney Trains network rules required drivers to extinguish train headlights within selected metropolitan areas. At the time, Sydney Trains was accredited to operate with headlights off based upon a risk assessment that highlighted the potential hazards of the headlight glare dazzling approaching train crews or other persons in or adjacent to the railway.

In low ambient light conditions, high-visibility garments rely on light reflected from their surface to be directed back along the path of the incoming light beam. An observer will not gain the benefit of a retroreflective article unless he/she is observing it from a position closely aligned with, usually just behind, the light source.^[24]

On the morning of 18 June 2006, the area near 63B points presented as a low light condition. The SMT members were using handheld torchlights directed towards their work (63B points).

Although the Sydney Trains safe work instruction mandated the use of flashing beacons at a fixed worksite or by individual workers in the danger zone, neither the CMT nor SMT members deployed flashing beacons at the worksite or worn individually during the works at the Clyde yard on the 17 and 18 June 2016.

Since the accident, Sydney Trains engaged a team of human factors specialists to conduct a review of the use of personal flashing beacons. The study found that personal flashing beacons were ineffective in many situations due to the beacon being lost within other artificial lights within the driver’s field of view. They also found use of beacons transfers the responsibility of safety to the driver and may provide a false sense of security to the rail safety worker. The study further found the beacon may be out of the driver’s line of site depending on the location the beacon is worn on the rail safety worker.

While addressing risks associated with headlight glare, the practice of extinguishing the headlights and reverting to visibility lights may have increased the risk that a train driver would not sight workers on or about the track during times of low ambient light conditions.

Effective communications

Network procedures prescribing the rules for spoken and written communication in the network acknowledged that effective written, radio and telephone communication was essential for safety in the network. The voice recordings of the telephone conversations between the train controller/s, Clyde Signaller and PO in determining the method for applying worksite protections associated with the TOA were conversational, centred toward discussing pros and cons of the protection options available under the rules for using a TOA. The conversations occurred over a five-hour period between the parties (at remote locations from each other) and featured some minor misunderstandings/confusion, which resulted in several repeat exchanges to clarify views. While there was a considerable exchange of information, combined with sporadic distractions to perform other functions associated with the individuals’ respective roles, the parties understood and agreed on the requirement for an authority and that the clip on 63B points provided worksite protection within the TOA, avoiding an occupancy on the main line.

Other voice recordings between the parties addressing the safeworking arrangements for the TOA were also primarily conversational and in some instances subjected to sporadic distractions. Although the parties did not adhere to the procedures for spoken and written communication, the information relayed and recorded on the TOA’s was correct and understood by the Clyde Signaller and the Civil Team.

A telephone conversation occurred between the SMT Electrician and the Clyde Signaller immediately before the collision during which the SMT Electrician asked the Clyde Signaller to operate 64 points to confirm the correct operation. The SMT Electrician advised testing of 64 points was complete before commenting that he had to take the point clip off 63. The Clyde Signaller did not respond to the SMT Electrician, remaining silent as the SMT Electrician walked towards 63B points. As occurred on previous occasions, the Clyde Signaller’s attention diverted briefly during the call toward another task, which was to communicate the fulfilment of TOA 35 to the Outer Controller. When returning to the call with the SMT Electrician, in which the SMT Electrician mentioned difficulty in removing the point clip, the Clyde Signaller did not recognise that the SMT members were in the danger zone and unprotected from the approaching train W510.

Although the network procedures require spoken communication to be clear, unambiguous and agreed to its meaning before being acted upon, the information relayed during the telephone conversation between the SMT Electrician and the Clyde Signaller during testing of the points was insufficient to alert either party that 63B was an unprotected work area.

__________

24. Rail Industry Safety and Standards Board, Australian Standard AS 741:2019 Australian rail Personal protective equipment – Minimum requirements

Appendices

Appendix A – Bio mathematical modelling

Bio-mathematical models are tools for predicting operator fatigue levels, performance levels and the provision of opportunity for rest, based on an understanding of scientific relationships between work hours, sleep and performance. All bio-mathematical models have limitations that must be understood to ensure their appropriate use within an FRMS.

Sydney Trains’ assessment of rosters for managing fatigue risk is based primarily on the use of a bio-mathematical fatigue-modelling program known as Fatigue Audit Interdyne (FAID).

FAID requires hours of work as a single input.

“It assigns a recovery value to time away from work based on the amount of sleep that is likely to be obtained in non-work periods, depending on the length and time of day that they occur” (Roach, Fletcher and Dawson, 2011)

FAID does not predict fatigue but rather predicts sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep (Dawson and others, 2011).

The ATSB used FAID and Fatigue Avoidance Scheduling Tool (FAST®). FAST is a software decision aid designed to assess and forecast performance changes induced by sleep restriction and time of day. No planning software, including FAST, can predict fatigue or fatigue-induced errors in all cases for all individuals.

Both FAID and FAST have been applied in investigation RO-2016-008 for consideration, with full awareness of the limitations of these systems.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Work-planning process and multiple work groups

Safety issue number: RO-2016-008-SI-01

Safety issue description: The Sydney Trains’ work-planning process, involving multiple work groups, did not assure the consideration of worksite safety for all tasks undertaken by each involved party over the duration of the work and when returning the rail infrastructure into service.

Network Communications

Safety issue number: RO-2016-008-SI-02

Safety issue description: The network rules and procedures require communications to be clear, brief and unambiguous. Network communications by various parties in Sydney Trains were not in accordance with the principles underpinning the network rules.

TOA limitations

Safety issue number: RO-2016-008-SI-03

Safety issue description: The worksite protection method presented an increased risk, in that track workers might inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. Sydney Trains network rules and procedures for a Track Occupancy Authority did not manage the increased risk for the chosen worksite protection method.

Worksite protection pre-work briefing

Safety issue number: RO-2016-008-SI-04

Safety issue description: The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite.

Additional safety actions

Sydney Trains delivered on a number of safety actions and commitments following the incident.

Some of the direct actions to address the contributing factors to the incident were:

• Review and validation of proposed worksite protection plans is required through Sydney Trains’ Corridor Safety Centre.
• Increased numbers of rail safety coaches and mentors, with a required coaching session for all Protection Officers at least once per year.
• Protection Officers are required to implement a form of worksite protection at least once every quarter to remain eligible to be re-certified as a Protection Officer, this activity is monitored by the Corridor Safety Centre.

Additionally, Sydney Trains established a Post-Incident Assurance Group (PIAG) to respond to the incident. This group established key focus areas to promote the safety of workers and avoid future incidents. These areas included; Worksite protection, Culture, Planning for maintenance work and Safety critical communications.

The PIAG later established the Safety Focus Program, which included key initiatives;

• Safety Focus Sessions
• Safety Culture Program
• Improvements to protection officer selection and training
• Signal Key Switch Project
• Safety Critical Communication Enterprise Wide Program
• Maintenance Access Planning Project, and
• ATRICS ASB.

The occurrence

In the early morning of 18 June 2016, a civil maintenance team (CMT) neared completion of their work to replace sleepers under the crossover at 64 points in the Clyde Yard, New South Wales. A Track Occupancy Authority (TOA) protected the civil team’s worksite from approaching rail traffic.

A signal maintenance team (SMT) comprised of an electrician and mechanic were to then test and certify the operation of 64 points, and another set of points (63B) that had been booked out of service previously. During the testing, both members of the SMT left the area protected by the TOA to work on 63B points. As the SMT worked on the track at 63B points, an interurban passenger train (W510) travelling along the same track struck and fatally injured the SMT Mechanic.

Events triggering the civil task at 64 points

On 15 June 2016, a team of civil and signal engineering staff from Sydney Trains’ Clyde Network Base undertook an inspection of track infrastructure at Clyde Yard in response to ongoing drainage issues causing damage to the track and signalling equipment.

During the inspection, team members identified deficiencies associated with 64 points involving subsidence in the track formation material and decaying timber sleepers. The team categorised the deficiencies as an E2^[2] defect and arranged Infrastructure Booking Authorities^[3] (IBA) to remove 64 points and other signalling infrastructure from service. As an E2 defect required action to minimise risk within 24 hours, the team also recommended booking 63B points out of service to prevent trains accessing 64 points from the Up^[4] Main Line (Figure 1).

On 16 June at 1020,^[5] network based signal staff booked 63 points (A and B end) out of service and applied a point clip^[6] to the ‘B’ end. On completion, the signal staff issued the signaller at Clyde Signal Box (Clyde Signaller) with IBA number 160616TPA, recording that 63B points were out of service. At 1340, network-based civil workers applied point clips to 64 points, issuing a separate IBA number 160616 to the Clyde Signaller.

The Clyde Signaller later identified the train plan could not be met for the Rosehill race event scheduled for 18 June 2016, as the IBA 160616 affected access to the siding leading off 64 points to allow storage of additional passenger trains on race day.

Planning of the civil task

On 17 June, the Assistant Area Manager, West Signal Box operations, sought advice from civil maintenance staff about the possibility of returning 64 points to service in time for the scheduled race day trains. Maintenance staff relayed the request to the manager for civil works based at the Clyde Network Base (Manager Civil), who initially denied the request due to the unavailability of sufficient materials, labour and plant.

After another request from train operations staff, the Manager Civil contacted the civil maintenance team leader (CMT Leader) who agreed to arrange labour for the repairs to the track at 64 points as an ‘emergency call-out’. Later that afternoon, the CMT Leader confirmed the availability of resources for the repair work to commence that night.

The civil maintenance team (CMT) were tasked with replacing a pattern of four timber sleepers under 64 points that had rotted, potentially affecting the safe operation of train services. The replacement of the sleepers would restore the condition of the track to comply with the Sydney Trains infrastructure standard. The Manager Civil allocated work tasks to the Protection Officer (PO) and CMT Leader near the end of their day shift. The expectation was that the work later that night would take about three hours to complete.

At 1442, the Signals Team Leader e-mailed the night shift SMT Electrician informing him the civil team would be fixing civil issues on 63 and 64 points that night and identified where the SMT Electrician would find the IBA and a handwritten disconnection list for various signalling infrastructure.

Figure 1: Site map of Clyde showing area of civil works and involved points

Source: Sydney Trains, annotated by ATSB

Arranging worksite protection for the civil task

At about 1900, the PO telephoned the Clyde Signaller to discuss the planned work and to enquire whether a Track Occupancy Authority (TOA) (see Network Rules) was required from the Clyde Signaller or if protections through the Pacific National Clyde Yard Master (PN Clyde Yard Master) were sufficient, as the PO understood 64 points to be within the PN yard^[7]. The Clyde Signaller referred the PO to Pacific National for clarification.

About an hour later, the PO telephoned the Clyde Signaller to discuss further the rail infrastructure affected by the work. After confirming that the Clyde Signaller controlled 64 points, the PO discussed the requirement for a TOA to protect the worksite. There were several interruptions during the telephone call while the Clyde Signaller attended to other tasks. The PO informed the Clyde Signaller that he and the CMT Leader had to postpone discussions, as they needed to attend to a call-out at another location. They agreed to meet at the Clyde signal box on their return to continue planning the protection arrangements. In the meantime, the Clyde Signaller informed the Train Controller for the Goods Board (Goods Controller) of the PO’s plan for protecting the work in the Clyde Yard.

At about 2100, the SMT members commenced their rostered shift and began planning their night’s work, including reviewing e-mails from the signals team leader. About 30 minutes later, all of the CMT members had returned to work and signed on for their overtime shift at the Clyde Network Base. Shortly after, the SMT Electrician spoke to CMT members seeking additional information about the proposed work, who advised the SMT Electrician to contact the PO.

At about 2200, the PO provided a worksite protection pre-work briefing to the five members of the CMT, who each signed the worksite protection pre-work briefing form recording their attendance. The SMT were not asked and did not attend this briefing. However, the SMT Electrician reported making multiple attempts to contact the civil team in an attempt to understand the scope of works and timings. The SMT Electrician also recalled that around this time he contacted the PO who advised that the start time for the work on track was unknown.

At 2215, the Goods Controller contacted Infrastructure Control staff (ICON) enquiring if they knew of the civil work at Clyde Yard 64 points. ICON was not aware as Clyde Network Base had not informed them of the work. ICON undertook to confirm what was happening and contacted the CMT Leader to establish if they were to work on 64 points. ICON called the Goods Controller back to confirm that the civil team were working out protection with the Clyde Signaller, and to expect to hear from them.

Shortly after, the PO contacted ICON enquiring if they knew of the work at 64 points and again discussed the possible requirements for implementing a TOA. The PO and ICON discussed whether this required possession of the Main line as the PO maintained that the protecting signal must be greater than 500 m from the worksite^[8] even though locking 63B points in the normal position already excluded rail traffic accessing 64 points from the main line. ICON questioned whether the PO really needed to take possession of the Up Main line referring the PO back to the Goods Controller.

The PO contacted the Goods Controller advising the need to take possession of the Up Main line and explaining that while locking 63B points in the normal position prevented rail traffic accessing 64 points, the points were within 500 m of the worksite. The Goods Controller referred the PO back to the Clyde Signaller to determine the TOA requirements.

Shortly after, the PO and the CMT members signed a ‘permit to work’ enabling access to the Pacific National (PN) managed portion of the Clyde yard. Around the same time, the PO contacted the Goods Controller advising the PN Clyde Yard Master would place blocking facilities^[9] (blocks) in Clyde Yard preventing access to the worksite from the east and that the last PN train into the yard would arrive at approximately 0130.

While waiting for the last PN train to arrive, the CMT commenced some preparatory work in the PN yard area under the permit to work. During these preparations, members of the CMT accessed the track at 64 points to mark out the pattern for sleeper replacement and to remove some track fastenings. The work to remove the sleepers did not commence until after the last train had cleared and protection arrangements were in place for an excavator to cross tracks and access the worksite at 64 points (see Civil task at 64 points below).

At 2306, the Clyde Signaller and the Train Controller for the Outer Board (Outer Controller) discussed the protection needed for the work. The Outer Controller sought clarification of why a TOA would include the Up Main line to which the Clyde Signaller identified the 63B points were within 500 m of the worksite. The Outer Controller expressed the view that with 63B points clipped and locked in the normal position he could not see a risk, as trains could not access the worksite. The Clyde Signaller sought clarification if additional signal protections on the main line were necessary. The Outer Controller repeated that the only identified risk was from rail traffic entering from the east end of the yard, as the clip and lock on 63B points prevented rail traffic entering from the west end of the yard.

Shortly after, the Clyde Signaller contacted the PO confirming the work could go ahead with 63B points clipped and locked in the normal position. The PO again questioned the proposed protections, as 63B points were within 500 m of the worksite. The Clyde Signaller told the PO of the discussion with the Outer Controller and that they could not see a problem as long as 63B points were in the normal position and locked. The Clyde Signaller then advised the PO that the Outer Controller wanted to talk to him.

The PO contacted the Outer Controller repeating his view that protections had to be located 500 m from the worksite for a TOA. The Outer Controller replied ‘not necessarily’ and discussed with the PO that 63B points locked in the normal position ‘eliminated the risk’. The PO understood that the points excluded trains from the worksite but expressed an uncertainty about what protections were required and who would be approving them (Goods Controller or PN Clyde Yard Master). The Outer Controller informed the PO that an authority (TOA) was required, and advised he would talk to the Clyde Signaller about it.

The PO and Clyde Signaller then met at the Clyde signal box to discuss the details of the TOA in person before the Clyde Signaller called the PN Clyde Yard Master to inform him of the proposed arrangements for the TOA. The PN Clyde Yard Master was satisfied with the arrangements as long as it did not affect train movements in Clyde yard.

At 0005 on 18 June, the Clyde Signaller called the Outer Controller^[10] to seek authorisation for the TOA. After going through the TOA details, and confirming the section was clear of traffic, and the signals had been set and blocks applied, the Outer Controller advised that TOA 35 had been authorised at 0011.

Civil task at 64 points

There was a delay to the start of the civil works until 0131 to clear a freight train movement into the PN yard before the CMT’s excavator could cross the tracks to access the worksite. After the freight train cleared, the Clyde Signaller advised the PO that he had placed blocks on several points (54, 56, 57, 60) to exclude rail traffic and protect the excavator as it accessed the worksite. The PO repeated the point numbers and recorded their details on the worksite protection plan.

At 0222, the Clyde Signaller informed the Outer Controller the IBA on 63B points would impact on the Race day program as the points were required to access the Up-storage siding. In a subsequent three-way telephone hook-up between them and ICON, the ICON representative informed the Clyde Signaller and the Outer Controller that he would get signals staff on the following day shift from Clyde Network Depot to book 63B points back in at about 0630. Around this time, the SMT Electrician contacted the PO advising they were in transit to the worksite when the PO asked them to collect a chainsaw en-route. The SMT arrived at Clyde yard at about 0318 and delivered the chainsaw before departing about 20 minutes later and returning to Homebush to wait for the work on 64 points to be completed.

At 0420, the PO called the Clyde Signaller to request an extension of TOA 35 by one hour to 0600, as the work was taking longer than expected. The Clyde Signaller confirmed the request with the Outer Controller before contacting the PO and extending the TOA.

Completion of the civil task and commencement of electrical testing of points 63 and 64

At 0523, the SMT Electrician contacted the PO to enquire on the progress of the civil works. He reported that he informed the PO that the SMT would not return until the TOA was back in place. The PO confirmed that the civil works were just about finished. Shortly after, the SMT arrived at the worksite and the SMT Electrician recalled that the PO told him there was a TOA in operation that would expire at 0600, but did not go into the details of the area that the TOA covered. The SMT Electrician recalled that there was no pre-work briefing provided by the PO and the SMT did not sign the pre-work briefing form. The PO recalled that he did not meet with the SMT on their return, so no pre-work briefing was possible.

At 0541, the SMT Electrician telephoned the Clyde Signaller to test the operation of 64A/B points. After removing a clip and lock, the SMT Electrician confirmed the correct operation of that point to the reverse and normal positions. The SMT Electrician then told the Clyde Signaller he would call him back when he got to the other end of 64 points.

At 0547, the PO contacted the Outer Controller to inquire if he could get a second extension to TOA 35. The extension of time was required to inspect the track before booking it back in to service. The Outer Controller advised the PO to contact the Clyde Signaller to arrange, as they could not extend a TOA more than once. The PO contacted the Clyde Signaller who then called the Outer Controller to arrange the second TOA, which was authorised as TOA 36. The Clyde Signaller then called the PO to provide details of the new TOA, confirming it was authorised and to fulfil TOA 35.

At 0604, the SMT Electrician telephoned the Clyde Signaller to complete testing of 64 points. The SMT Electrician then told the Clyde Signaller, ‘okay, I’m finished with 64…. Just got to take the point clip off 63’. The SMT Electrician then commenced walking toward 63B, while maintaining the mobile telephone connection with the Clyde Signaller. The Clyde Signaller asked the SMT Electrician to ‘hold on a minute’ while he contacted the Outer Controller to advise the time that TOA 35 was fulfilled.

Around the same time, the SMT Electrician had begun removing the point clip and lock from 63B points but had difficulty, so he called out to the SMT Mechanic to bring a podger (metal crow bar).

At 0607, the SMT Mechanic arrived at 63B point with the bar and took over removal of the point clip and lock. Both members of the SMT had entered the danger zone unprotected and unaware of approaching train movements. Concurrently, train W510 travelling on the Up Main line at a speed of about 67 km/h passed through Clyde Station and approached 63B points.

The SMT Electrician recalled he was conversing with the Clyde Signaller regarding the IBA for 63B points while opening the lid to the point machine to check for lock and detection when he noticed the approaching train and yelled a warning to the SMT Mechanic. About the same time, train W510 passed over 63B points, striking and fatally injuring the SMT Mechanic.

Figure 2: 63B points in normal position prevents movements towards 64 points

Source: ATSB

Post-collision

The collision caused the air brakes on the train to apply^[11] and the train came to a stand about 20 seconds and 200 m later. The train driver contacted the Clyde Signaller informing him that the train had come to a stand after striking something then losing the air, and he could not build air pressure back up. The Clyde Signaller informed the train driver that the train had struck a worker on the track.

At 0611, the Clyde Signaller called the Outer Controller and requested the emergency services to attend to the site. The Outer Controller commenced notifications, initiated incident management procedures and commenced diverting other rail traffic from the area. He arranged with the Clyde Station Duty Manager and Sydney Trains Security for Police and Ambulance to arrive on site. At 0615, the Incident Response Commander received notification and arrived on site at 0653. A supporting Incident Response Commander arrived on site at 0720.

__________

2. E2 (Emergency 2) is a category in Sydney Train’s maintenance standards. An E2 category defect required an action to minimise the risk to rail operations within 24 hours under normal operations.
3. An Infrastructure Booking Authority (IBA) informs Network Control Officers that infrastructure is temporarily or permanently removed from service (‘booked out of use’), or installed or returned to service (‘booked into use’).
4. Trains travelling toward Sydney are referred to as Up trains while trains travelling from Sydney are referred to as Down trains. The tracks that they travel on are referred to as ‘Up’ or ‘Down’ lines.
5. All times referred to in this report are Australian Eastern Standard Time (EST).
6. A point clip manually secures a point switch to the stock rail. A point clip can be used when the points are in either the normal or reverse position and is padlocked to prevent unauthorised removal.
7. 64 points were in the PN yard but under the control of the Clyde Signaller.
8. The Network Rules require the protecting signal for a worksite to be at least 500 m from the worksite. Unless a set of points can be clipped and locked to prevent access to the portion of track within the TOA limits, the distance between the signal protecting the limits of the TOA and the worksite must not be less than 500 m (see REF _Ref11830590 \h \* MERGEFORMAT NWT 304 Track Occupancy Authority for more information).
9. A ‘blocking facility’ is ‘A facility or device used by a Competent Worker to prevent either the unintended issue of an Occupancy Authority, or the operation of points or signalling equipment’.
10. Due to a shift change, this was now a different person to who the Clyde Signaller had made the previous arrangements
11. The brakes automatically applied on W510 when the trip valve activated and air pressure in the brake pipe was vented and lost. The trip valve is an assembly on the brake pipe that connects the automatic braking system through each car for the entire length of the train. It is a mechanism mounted on the leading axle box of a train to stop a train should it pass a signal at stop without authority. Its arm vents the brake pipe pressure when struck. The venting causes an emergency application of the air brakes and the train to lose power. In this incident, it is highly likely that the trip valve was activated by the physical impact with the SMT Mechanic.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• NSW Police
• NSW Trains
• Pacific National
• Rail Industry Safety and Standards Board (RISSB)
• Sydney Trains
• The Bureau of Meteorology
• The Office of the National Rail Safety Regulator
• The Sydney Trains protection officer
• The Sydney Trains work group leader (Civil Worksite Supervisor)
• The Sydney Trains Signaller Clyde signal box
• The Sydney Trains Work Group Leader (Signal Electrician)
• The Sydney Trains Train Controller
• The Sydney Trains Team Leader signals
• The Sydney Trains Group Manager, Safety and Standards
• The Sydney Trains Group Manager, Rail Corridor Safety
• The Sydney Trains Systems Support and Assurance Specialist
• Transport for NSW, Asset Standards Authority.

References

RailSafe Glossary July 2012 Version 7.0

Rail Industry Safety and Standards Board (RISSB, Dec 2010). National Guideline Glossary of Rail Terminology.

Sydney Trains General Rule NGE 200 − July 2014.

RailCorp General Rule NGE 204 − November 2008.

RailCorp General Rule NGE 212 − November 2008.

Sydney Trains Network Local Appendices NLA 200.

Sydney Trains Network Local Appendices NLA 206.

Sydney Trains Network Procedure NPR 701 − March 2016

Sydney Trains Network Procedure NPR 703 − March 2016

RailCorp Network Procedure NPR 707 − July 2012.

RailCorp Network Procedure NPR 711 − December 2010.

Rail Safety National Law National Regulations (2012) − Made under the Rail Safety National Law (NSW).

Sydney Trains Network Form NRF 002 − July 2014

Sydney Trains Network Form NRF 003 − July 2014

RailCorp Network Rule NSY 500 − August 2005.

Sydney Trains Network Rule NTR 406 – July 2014.

Sydney Trains Driver Route Knowledge Diagrams – Main West Line, maps 02 to 05.

Sydney Trains Work on Track Rule NWT 300 − July 2014.

Sydney Trains Work on Track Rule NWT 304 − March 2016.

Sydney Trains Work on Track Rule NWT 308 − March 2016.

Sydney Trains Work on Track Rule NWT 310 − July 2012.

Sydney Trains Working Safely Handbook – June 2014

Technical Note – TN 036:2015 Update to passenger trainstop braking, braking, and traction performance requirements

Train Operating Conditions (TOC) Manual – April 2016

Transport NSW Engineering standard ESR 0001 – 600 RSU – Minimum Operating Standards for Rolling Stock – Multiple Unit Train Specific Interface Standards, Version 1.5, December 2012.

Duncan, J., Martens, S., Ward R. (1997) Restricted attentional capacity within but not between sensory modalities. Nature 387, 808-810. www.nature.com/articles/42947

Redick, T. S., Shipstead, Z., Meier, M. E., Montroy, J. J., Hicks, K. L., Unsworth, N., Kane, M. J., Hambrick, D. Z., Engle, R. W. (2016). Cognitive predictors of a common multitasking ability: Contributions from working memory, attention control, and fluid intelligence. Journal of Experimental Psychology: General, 145(11), 1473–1492. http://dx.doi.org/10.1037/xge0000219

Taoka, George T, Brake Reaction Times of Unalerted Drivers, ITE Journal, March 1989

Taylor, J. (2011). Technology: Myth of Multitasking. Is multitasking really more efficient? www.psychologytoday.com/au/blog/the-power-prime/201103/technology-myth-…

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to:

• NSW Coroner
• NSW Police
• NSW Trains
• Pacific National
• Sydney Trains
• The Office of the National Rail Safety Regulator
• The Sydney Trains Protection Officer
• The Sydney Trains Work Group Leader (Civil Worksite Supervisor)
• The Sydney Trains Signaller Clyde signal box
• The Sydney Trains Work Group Leader (Signal Electrician)
• The Sydney Trains Train Controller
• The Sydney Trains Team Leader Signals
• Transport for NSW.

Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.

Findings

From the evidence available, the following findings were made with respect to the track worker fatally injured when struck by train W510, Clyde, New South Wales on 18 June 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Sydney Trains’ work-planning process, involving multiple work groups, did not assure the consideration of worksite safety for all tasks undertaken by each involved party over the duration of the work and when returning the rail infrastructure into service. [Safety Issue]
• The PO civil was aware of the signal team’s work tasks but did not consider these in his worksite protection arrangements.
• The PO had briefed the civil team, however did not brief the signal team, and the signal team did not seek a pre-work briefing before commencing work on-track.
• The PO civil was not provided with a briefing on the scope of the SMT work and did not provide protection at 63 points.
• The signal team assumed their workplace was within the limits of the TOA and did not plan their own worksite protection.
• The signal team entered the danger zone unprotected and unaware of the approach of W510.
• The Clyde Signaller did not recognise the signal team were in an unprotected area during his communication with the signal team, possibly due to being distracted on other tasks.
• The network rules and procedures require communications to be clear, brief and unambiguous. Network communications by various parties in Sydney Trains were not in accordance with the principles underpinning the network rules. [Safety Issue]

Other factors that increased risk

• Sydney Trains’ preference to keep the Up Main operational influenced the selection to use the clipped and locked 63B points to protect the worksite at 64 Points.
• The worksite protection method presented an increased risk, in that track workers might inadvertently exit the worksite, and subsequently be in the immediate vicinity of operational main line rail traffic. Sydney Trains network rules and procedures for a Track Occupancy Authority did not manage the increased risk for the chosen worksite protection method. [Safety Issue]
• The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite [Safety issue]

Other findings

• The workers were conducting work during the circadian low and in poor environmental conditions. It is possible that this contributed to an increased level of fatigue in some of the workers on duty that night, but was unlikely to have influenced decisions made contributing to the accident.
• The lack of use of train headlights at night and the absence of any supplementary lighting (such as beacons) may have increased the likelihood of a train driver not seeing workers wearing reflective clothing and subsequently sounding the train horn.

Context

Location

Clyde Yard is located in the Main Western rail corridor approximately 20.660 km^[12] by rail from Sydney Terminal (Figure 3). Clyde is a junction of the Main West and Carlingford rail lines.

Figure 3: Location of Clyde

Source: NatMap, Railways of Australia, Geoscience Australia, annotated by ATSB

Clyde Yard is on the northern side of the Main Western line and is utilised by Sydney Trains for through movements and stabling of passenger trains and by Pacific National for the stabling of freight trains and limited maintenance activities.

Track layout at Clyde

The Up and Down Main lines and Up and Down Suburban lines at Clyde, between Auburn (18.551 km)^[13] and Granville (21.148 km), are part of the Sydney Trains-controlled Metropolitan Rail Area network. Sydney Trains was responsible for track maintenance, signalling, network control and incident management functions in this corridor. The posted track speed for the Up Main line through Clyde station and over 63B points was 80 km/h for electric passenger services.

The Clyde signal box provided the control and monitoring function for all signals and points on the Up Main line around the 63 and 64 points together with other signalling equipment within the area of control. This area encompassed the Main West line spanning approximately 1.2 km to include the entry/exit to/from the Carlingford line, Pacific National freight yard (Country end) and Auburn Maintenance Centre (Country end). The control area abutted Auburn signal box (on the Sydney side) on the Down Main, Suburban, Relief and Through Roads, Granville signal box (on the Countryside) on the Up Main and Suburban lines, and Parramatta Road signal box on the Carlingford line.

The Pacific National rail freight yard consisted of a system of tracks used for shunting and marshalling of freight trains (Figure 1). The PN Clyde Yard Master^[14] was responsible for coordinating, managing and directing the safety of all rail movements within the PN yard area.

Operational interfaces and staff involved

Train Controller

The primary responsibility of train controllers is to manage train paths for the safe and efficient transit of rail traffic. Train controllers and their supervisory staff were located within the Rail Management Centre (RMC) at Sydney Central Station along with representatives of other supporting functions including ICON, customer and information services, security, train crewing and train monitoring. The RMC provided 24/7 integration and coordination of all operational train services (both Sydney Trains and non-Sydney Trains services) in the area bounded by Nowra, Macarthur, Newcastle and Lithgow. For the works at Clyde on 17–18 June, the train controllers (Goods Controller and Outer Controller) had visibility of the layout and status of the points, signals and other monitored equipment at Clyde via an overview (mimic) panel.

Signaller at Clyde Signal Box

The primary responsibility of the Signaller is to issue Occupancy Authorities and control points, signals and other signalling equipment to manage routes for the safe and efficient transit of rail traffic through the area of their control. The Signaller is also responsible for issuing work on track authorities (LPA and TOA) and work on track methods.

The signaller at the Clyde signal box (Clyde Signaller) was a Sydney Trains employee with 34 years’ rail experience. The Clyde Signaller held the required qualifications and competency for the role performed and was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.

Although the Clyde Signal Box was located in close proximity to the worksite, the Clyde Signaller could not physically see the civil worksite at 64 points or persons moving within the worksite or yard area on 17-18 June 2016. This is because the signalling system is an electronic system that does not require a line of sight for the signaller to operate. In this instance, the Clyde Signaller’s work station faced away from the windows that looked out to the Clyde Yard and the worksite location (Figure 4 and 5). The Clyde signaller was not required or expected to watch the actual work activities in the Yard.

Figure 4: Clyde Signaller’s workstation

Source: ATSB

Figure 5: Daylight view of Clyde yard from Clyde Signal Box

Source: ATSB

Civil Maintenance Team

The civil maintenance team (CMT) comprised:

• A PO (responsible for managing worksite protection)
• an acting team leader (CMT Leader) responsible for managing the rectification work
• three civil infrastructure workers under the direction of the CMT Leader
• a third party contract excavator operator.

All members of the CMT, except the excavator operator, were Sydney Trains employees based at the Clyde Network Base. All the Sydney Trains CMT members had worked their rostered day shift between 0700 and 1500 prior to returning to work at 2130 to repair 64 points on an overtime shift.

The Protection Officer

A Protection Officer (PO) was responsible for managing the rail safety component of worksite protection to keep the work site and the workers in the work site safe from rail track movements. The PO was a Sydney Trains employee with five years rail experience. The PO held the required qualifications including a worksite protection competency (protection officer level 2) for the role performed and was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.

On 17 June, the PO commenced his rostered shift at 0539, although the PO was not involved in the planning of the repair work, he concluded his shift at 1500 with the understanding that the CMT would return later the same day and commence an overtime shift at 2130 and he would be arranging protection for this emergency work.

Signal Maintenance Team

The Clyde Network Base signals work group comprised two signal electricians and two signal mechanics, a Senior Signals Engineer and Signals Team Leader. The signals work group were responsible for checking signals and points were operable before going back into service, conducting out-of-course repairs and minor routine maintenance to signalling equipment and points throughout the rail network bounded by Clyde, Macdonaldtown, North Strathfield, Sefton and Marrickville. Additional areas of responsibility included the Up and Down Yards at Clyde, the Carlingford line, the Olympic Loop line, the Goods line at Chullora and Enfield Yard. The signals work group regularly worked with the civil maintenance teams undertaking repairs to track and other civil infrastructure.

General supervision and tasking of signal maintenance staff was the responsibility of the Senior Signals Engineer and Signals Team Leader. However, as these positions worked weekday business hours, there was little interaction outside business hours, with tasking routinely made via notes or e-mail.

The signal maintenance team members (SMT) involved in the accident included a signal electrician (SMT Electrician) and a signal mechanic (SMT Mechanic).

On the 17 June 2016, the Signals Team Leader emailed the SMT Electrician with the tasking and instructions for their shift that night. The Signals Team Leader wrote:

Tonight [CMT] will be chucking a few new timber in points in Clyde Up Yard. They are planning on starting at 2200. They will only be fixing the civil issues on 63 and 64 points not cleaning the rusty rails. On my shelf there is a disconnection list and IBA for you. Hopefully it goes smoothly. Also I’ve chucked a two Loc’s at CLJ onto T4 but it won’t let me attach them to this email so I sent a different one.

The SMT Electrician was a Sydney Trains employee with 13 years’ rail experience. The SMT Electrician held the required qualifications for the role performed as well as competencies in worksite protection (protection officer level 3). The SMT Electrician was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.

The SMT Mechanic was a Sydney Trains employee with 26 years’ rail experience. The SMT Mechanic held the required qualifications for the role performed as well as competencies in worksite protection. The SMT Mechanic was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.

Network Rules

The Sydney Trains Network Rules prescribe the requirements to manage safety on the network for train operations and working in the rail corridor.

NWT 300 Planning work in the rail corridor

Network Rule NWT 300 Planning Work in the Rail Corridor required a safety assessment of the work and of its potential to intrude on the danger zone. Work in the danger zone must use one of the protection methods listed below and not begin until the required safety measures were in place:

• one of three authorities:
  • Local Possession Authority (LPA)
  • Track Occupancy Authority (TOA)
  • Track Work Authority (TWA)
• or method of protection:
  • Absolute Signal Blocking (ASB)
• or safety measure:
  • Lookout Working.

The level of safety must not be reduced to allow rail traffic movements and each work on track method had mandatory minimum safety measures with the highest protections provided by an LPA to the least provided by Lookout Working.

The preferred methods for working on track were the LPA and TOA. In addition to the safety assessment and selection of protection method, Network rule NWT 300 required the PO to:

• brief workers about the rail safety component of worksite protection
• make sure that the rail safety component of the work is done safely
• keep records about the method used for working safely on track and protection arrangements, and
• communicate with the Network Control Officer about the work.

Sydney Trains form NRF 015 Worksite Protection Plan defined the type and format of information recorded by an assigned PO. In completing the worksite protection plan for the civil works at Clyde 64 points, the PO had several discussions with operational staff to determine the protection arrangements for the work.

The PO’s initial plan for the TOA included locating worksite protection (track signals, flags/lights) on the main line, to provide the specified distance of 500 m between the worksite and the worksite protections. However, the Train Controller advised that there was no need for an occupancy on the main line, as with the 63B points clipped and locked in the normal position trains could not access the worksite area from the main line.

To clip and lock points, a qualified rail safety worker fits and secures a mechanical clamp to the track securing the point blades to the desired lie (normal or reverse). Once installed, the lie of the points cannot change until the point clamp is removed; ensuring the direction of any rolling stock movement is only possible in the configured direction (Figure 6).

Figure 6: Application or removal a point clip

Source: Sydney Trains, annotated by ATSB

NWT 304 Track Occupancy Authority

The basic principle of work-on-track rules is to provide clear separation between track workers and trains. A Track Occupancy Authority (TOA) achieves this by authorising exclusive occupation of track within specified limits for undertaking work on track, for an agreed period. Sydney Trains’ Network Rule NWT 304 Track Occupancy Authority prescribed the rules for authorising, issuing and using a TOA. The rule defines the TOA limits as being between yard limits, or between defined clearance points,^[15] or may be a combination of the two. The worksite lies within the TOA limits and has defined boundaries/limits.

The network rule (NWT 304) defined the requirements for protecting both the TOA limits and for protecting the worksite. The rule stated:

Protecting TOA limits

- All points of entry into the TOA limits must be protected.

- The Signaller must apply blocking facilities^[16] to prevent unauthorised rail traffic entry into the TOA limits.

In addition:

Protecting Worksites

- Worksites must be protected by three Railway Track Signals and red flags/red lights placed at least 500m from each side of each worksite.

Worksite within 500m of TOA limits

- Unless a set of points can be clipped and locked to prevent access to the portion of track within the TOA limits, the distance between the signal protecting the limits of the TOA and the worksite must not be less than 500m.

A second document, NPR 701 Using a Track Occupancy Authority, provides additional information regarding the procedures for using a TOA, including some examples illustrating the methods for protecting worksites.

Figure 7 illustrates the typical protection arrangements for a worksite on straight track. A signal at least 500 m from the worksite is required for the ‘Protecting Controlled Absolute Signal’. Blocking facilities applied to the protecting controlled absolute signal provides the primary method for excluding rail traffic from the worksite.

If a train driver inadvertently passes the protecting controlled absolute signal, the train would subsequently pass over the worksite protection (track signals, flags/lights) 500 m before reaching the worksite. This, in effect, provides a second layer of defence whereby the train driver receives a warning that they are approaching a worksite and must take action to prevent entry into the worksite.

Figure 7: Worksite protection

Source: NPR 701 Using a Track Occupancy Authority

Figure 8 illustrates the protection arrangements for a worksite where the protecting controlled absolute signal is within 500 m of the worksite, but a set of points is available to route trains on a track other than the one containing the worksite. In this scenario, the points must be set, clipped and locked for the alternative route to prevent trains accessing the TOA limits and the worksite contained within. The signaller could also apply blocking to the point controls as part of the protection arrangements.

Figure 8: Worksite protection

Source: NPR 701 Using a Track Occupancy Authority

When implementing the TOA on the night of 17 June 2016, the PO thought protection had to be implemented as per the scenario illustrated in Figure 7. That is, the facilities providing worksite protection were to be located on the main line, at least 500 m from the worksite.

However, after several discussions with train controllers, signallers and ICON, the PO was made aware the application of protections could be done as illustrated by the scenario in Figure 8. That is, since the IBA on 63B points meant they were set, clipped and locked for the main line, rail traffic was excluded from the track containing the worksite. The scenario also negated the requirement to place worksite protections (track signals, flags/lights) 500 m from the worksite. The solution proposed by Sydney Trains’ operations staff provided the operational advantage of not occupying the main line, leaving it active for the passage of rail traffic.

Worksite protection arrangements

The Network Rules for work on track require the PO to brief the workers about the site-specific hazards and the protection measures in place before work begins. The Site Supervisor may also provide a briefing of the work planned. The PO must record details of the worksite protection pre-work briefing and the workers who attended the briefing, or amendment to the briefing, on the Network Form NRF 014 Worksite Protection Pre-work Briefing.

Additionally, the Sydney Trains’ guidance document Working Safely Handbook advised it was a responsibility of all workers to ensure they attend a pre-work brief before starting work.

Implementation of the worksite protection and pre-work briefing for civil works

The PO undertook the worksite protection pre-work briefing with the CMT members at the Clyde Yard. The briefing documentation included the Worksite Protection Plan (WPP), Pre-work Briefing form (PWB) and documentation specific to the use of an excavator under live overhead wiring.

The WPP and PWB required the PO to produce or attach a diagram/map to represent the worksite protection arrangements. The PO in this instance used a Drivers Route Knowledge Diagram (DRKD) to illustrate the location of points, signals, tracks, protections and safe areas.

The DRKD did not identify all signals and points used by the PO and Clyde Signaller to protect the movement of the excavator when crossing the tracks to access the worksite (Figure 9).

Figure 9: Photograph of PO’s work plan with annotation on the DRKD

Source: ATSB, annotated by ATSB

The PO annotated the DRKD to record that the Clyde Signaller applied blocking facilities to 54, 56, 57 and 60 points that were outside the limits of TOA 35. The limits of TOA 35 were the Clyde end of Storage Siding to Down through Road between 23L Signal and 24R Signal and indicated by a light green highlighted area on the DRKD (Figure 9). In order to protect the limits of the TOA, the Clyde Signaller placed 23L and 24R signals at stop and applied manual blocking facilities on the route and track (including points) ahead of those signals. The application of the blocking facilities was a second layer of control to prevent the inadvertent clearing of the signals and movement of points.

NGE 204 Network communication

The procedure NGE 204 Network communication prescribed the rules for spoken and written communication in the network. In principle, Sydney Trains required that communications must be clear, brief and unambiguous, relevant to the task, and agreed as to its meaning before being actioned.

If the communications related to safeworking arrangements, parties must utilise the 24-hour clock, phonetic alphabet, spoken numbers and standardised terminology to identify items such as train and signal identifiers.^[17] The procedure mandated the receiver of the message repeat the message back to the sender for communications such as a work on track authority and work on track train running information. NGE 204 contained a ‘WARNING’ that:

Qualified Workers must not assume that a receiver has understood a message before the receiver confirms that the message has been understood.

After returning to work, the PO communicated with various train controllers and the Clyde Signaller to discuss the civil work requirements, and establish the work location in the Clyde yard relative to areas of control and the method for applying worksite protections. Similarly, the train controllers, Clyde Signaller and PO communicated to establish and record details of the safeworking arrangements associated with the TOA’s.

Passenger service W510 and train crew

Train W510 was an intercity electrical multiple unit passenger service operated by NSW Trains. W510 was crewed by a driver and a guard. It consisted of the lead set V26 made up of cars 8081 (lead car), 9105, 9037 and 8077; and the rear set V21 made up of cars 8032, 9032, 9036 and 8036.

The service departed from Lithgow at 0338 and was on schedule. The service, carrying 49 passengers, had just departed from a scheduled stop at Granville and was travelling according to ‘proceed’ signal indications on the Up Main Line toward the next scheduled stop at Strathfield. The train was travelling at 67 km/h at the time of the accident. The collision activated a trip mechanism causing the release of brake pipe air and automatic application of the train brakes. The train continued for a further 19 seconds travelling approximately 200 m before coming to a stop.

Train crew

The driver had 20 years’ rail experience, which included 16 years’ driving passenger and freight trains. The driver, from the NSW Trains depot at Lithgow held the required qualifications for the role performed. The driver was assessed fit for duty in accordance with the requirements of the National standard of Health Assessment for Rail Safety Workers.

The guard was travelling in the last carriage 8036, and did not have any involvement in the accident sequence.

External train lighting

The Rail Industry Safety Standards Board (RISSB) coordinated the development of Australian Standards, Codes of Practice, Guidelines and Rules for the rail industry.^[18] RISSB developed a standard for rail traffic lights and markers.^[19] Adoption of the RISSB product was not mandatory and it was the responsibility of the Rail Transport Operator to develop a train lighting standard relevant to the safety risks being managing within its network. Sydney Trains, as an accredited rail transport operator,^[20] developed a train lighting standard specific to its network requirements.

Sydney Trains lighting standard

Network rule NTR 406 Using train lights prescribed the use of train headlights for the Sydney Trains Network requiring:

Trains must have a working headlight fitted to the leading locomotive, and travel with the headlight switched on, when the train travels beyond the:

- Sydney area, including intermediate branch lines, bounded by Helensburgh, Macarthur, Emu Plains and Cowan, or

- Newcastle area, including intermediate branch lines, bounded by Newcastle, Fassifern and Islington Jct, or

- Wollongong area, including intermediate branch lines, bounded by Thirroul and Unanderra.

NOTE Unless headlights are needed for safety, trains fitted with headlights must have their headlights switched off when travelling through the areas prescribed above.

Switching headlights offHeadlights must be switched off during approach to another train.Headlights must be switched off or dimmed during approach to:

- A motor vehicle on a nearby road

- A platform

- A signal box

- A location where shunting is in progress

Headlights may be switched off to prevent back-reflection into a driver’s or track vehicle operator’s eyes.

Before headlights are temporarily switched off, visibility lights, if fitted, must be switched on.

Sydney Trains rules therefore required the driver of train W510 must, unless needed for safety, have the headlights switched off as it was operating within the Sydney metropolitan area and near the Clyde Station platform and Clyde Signal Box.

Event recorders from W510 and the Clyde Station CCTV footage confirmed the driver had extinguished the headlights of train W510. The leading car displayed two white marker lights; two visibility (ditch) lights and one coupler light (Figure 10).

The marker lights (top left and right) indicated the front (white) or rear (red) of a train. Ditch lights (bottom left and right) illuminated the track immediately in front and improved detectability of the train. The coupler light provided illumination to assist train crew in coupling/uncoupling passenger cars when required.

Figure 10: Train lighting on front of W510 as it approached Clyde Station

Source: Sydney Trains, annotated by ATSB

The primary purpose of visibility lights was to improve detectability of the train by road users. The engineering standard detailing the minimum operating standards for rolling stock^[21] specified the visibility lights were to project at least 25 m in front of the vehicle at top of rail and then be aimed/turned cross-eyed to between a minimum of 7.5 degrees and maximum of 15 degrees to the longitudinal centreline of the vehicle (Figure 11).

Figure 11: Side view and Top view of visibility light aiming

Source: RSU 600 Series – Minimum Operating Standards for Rolling Stock – Multiple Unit Train Specific Interface Standards v 1.0

Figure 12, taken from a similar Sydney Trains K-Set type car showing the typical illumination pattern and forward illumination of the track provided by the visibility lights.

Figure 12: Similar train type showing visibility (ditch) lights illuminating track ahead

Source: ATSB

Environmental factors

The morning of 18 June 2016 was cool and cloudy with 4.8 mm of rainfall recorded in the 24 hours to 0900. The overnight minimum temperature was 12.4 °C as recorded by the Bureau of Meteorology at Sydney Olympic Park, approximately 5.3 km (East) from Clyde station.

At the approximate time of the accident, there was little ambient lighting in the area around 63B points. The floodlighting used by the CMT during the sleeper replacement works was off and the CMT team leader and SMT were working on the tracks using torchlight.

CCTV footage from Clyde Station and the nearby Auburn Maintenance Centre illustrated the likely level of ambient lighting present and the presence of steady rainfall around the time of the accident (Figure 13).

Figure 13: CCTV footage depicting environmental conditions as W510 passed through Clyde station moments before the accident

Source: Sydney Trains, annotated by ATSB

A site visit on 22 June 2016 conducted at a similar time to the accident photographed the ambient lighting conditions at 63B points (Figure 14). The train service shown had a similar lighting configuration to the lead car on train W510. A slight increase in illumination in close proximity to the front of the train due to the visibility lights is evident.

Figure 14: Ambient lighting near 63B points on 22 June 2016

Source: ATSB

Conspicuity of workers on or about the track

All rail safety workers when on or about the track, are required to wear approved Personal Protective Equipment which included high-visibility safety vests/wet weather attire with reflective markings.

The SMT Electrician was wearing standard cotton drill pants and high visibility reflective shirt and the SMT Mechanic was in similar attire but additionally wearing a recommended wet weather jacket that also had high-visibility reflective striping over the shoulders, with a cross on the back and strips around the cuffs. In darkened conditions, reflective clothing exhibit little utility unless they were self-illuminating, or exposed to some form of external light source that caused them to reflect.

To mitigate risk in low light conditions, Sydney Trains Safe Work Instruction D2015/7605 Use of Flashing Beacons in the Danger Zone at night^[22] required workers to display a flashing beacon when entering the Danger Zone at night. Sydney Trains identified the use of flashing beacons as an effective means of improving the visibility of workers operating within the danger zone at night. The beacons were designed to increase rail traffic driver’s visibility of workers at night. Each workgroup required at least one beacon, with additional beacons displayed where there was a distance of more than 50 m between workgroups. Positioning of the beacons were required to ensure they are clearly visible to approaching train drivers.

The Sydney Trains instruction and related SafeTracks bulletins identified that:

The use of flashing beacons does not reduce or replace the requirements in the Network Rules or Procedures relating to worksite protection.

Neither the CMT nor SMT members deployed flashing beacons at the worksite or wore them individually during the works at the Clyde yard on the 17 and 18 June 2016.

Fatigue management

The National Transport Commission (2008) defines fatigue as:

A human condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep. It includes physical, cognitive, psychological and physiological dimensions that interact with each other to reduce human performance and lead to uncontrollable sleep onset.

Humans cycle through numerous circadian rhythms with daily peaks and troughs. The National Rail Safety Guideline on Management of Fatigue in Rail Safety Workers (NTC 2008) highlights aspects of circadian rhythms that are relevant to fatigue management of rail safety workers. Alertness, physical and mental performance both reach their circadian low in the early morning (between about 0300 and 0500) when the physiological drive for sleep is greatest. The occurrence happened shortly after the circadian low.

Sydney Trains were required to manage the risk of fatigue in its rail safety workers. This included scheduling of work to allow for sufficient sleep opportunity as well as systemic management of fatigue through Fatigue Risk Management Systems. The Sydney Trains Fatigue Risk Management program included procedures on how to manage fatigue risk and the rostering principles outlined the safe hours of work (maximum of 12 hours) and rest (minimum of 12 hours) for typical hours of duty and planned overtime.

The operating procedure for the management of fatigue risks^[23] outlined a risk management approach to identify, assess and implement control measures to mitigate risk exposure to rail workers in workgroups and worksites where shift work and extended hours’ arrangements were undertaken.

The investigation explored the possibility that the time of day, working during the circadian low point (3am to 5am) and the rostered work hours may have contributed to an increased feeling of fatigue in some of the workers on duty that night.

The ATSB assessed the probable fatigue levels of the SMT members, the CMT Leader, the PO and Clyde Signaller. Information taken into account included sleep (quantity and quality) in the previous 24 hours, workload, time at work, work break (rest and food) opportunities, and the use of two bio-mathematical fatigue models (FAST and FAID).

Of the workers assessed, shift duration and the time of day affected them equally and were assessed to have a moderate likelihood that their alertness on duty may have been affected.

Only the PO and the CMT Leader were assessed as likely to be experiencing a level of fatigue known to affect performance. However, in the context of the work tasks they were involved in on the night and their performance of these tasks, the ATSB did not consider their level of fatigue influenced decisions made on the night of the accident.

Drug and alcohol testing

The Rail Safety National Law (NSW) prescribed the post-incident testing of a rail safety worker for the presence of a proscribed drug or alcohol. The legislation required rail safety workers involved in a prescribed incident to undergo a breath test and provide a sample (oral, blood, or urine) within 3 hours of an incident. The Shift Manager within the RMC coordinated the testing of Sydney Trains rail safety worker/s directly involved in a prescribed incident.

Between 0640 and 1000 on 18 June 2016, the two-crew members from W510, PO, Clyde Signaller and the SMT Electrician undertook the testing and all parties returned a negative result.

The toxicology results from the post-mortem showed no presence of alcohol or other drugs in the deceased.

__________

12. All kilometres are measured from No.1 platform at Central railway station, Sydney Terminal.
13. The rail kilometrages shown for Auburn and Granville stations were referenced from NLA 200 and NLA 206 respectively.
14. The PN Clyde Yard Master was also responsible for liaising with third parties and where required authorising and issuing ‘permits to work’ to those whom required to undertake work within that defined area. On the night of the accident, the PN Clyde Yard Master was also responsible for ensuring that rail traffic within their defined area did not enter the work area. The PN Clyde Yard Master did not have visibility of the worksite, equipment or individuals involved with the work on 64 points, 63 points, or that area of the danger zone more generally.
15. A clearance point or clearance location is defined as a location that, once clear of rail traffic, allows a following movement. Source: RailSafe Glossary
16. Blocking facilities are a facility or device used by a Qualified Worker to prevent the unintended issue of an Occupancy Authority, or the operation of points or signalling equipment.
17. RailSafe NPR 721 Spoken and written communication.
18. www.rissb.com.au/about/our-role-in-industry/
19. Australian Network Rules And Procedures (ANRP 4005) Rail Traffic Lights and Markers
20. The Office of the National Rail Safety Regulator (ONRSR) as a Rail Transport Operator accredits Sydney Trains and Sydney Trains has a duty to manage the risks associated with their operation. ONRSR monitors Sydney Trains implementation of their safety management system.
21. Transport NSW Engineering standard ESR 0001 – 600 RSU – Minimum Operating Standards for Rolling Stock – Multiple Unit Train Specific Interface Standards, section 8.1
22. SWI was created 02/04/2014 and approved by the GM Network Maintenance.
23. Operating Procedure 08: Manage Fatigue Risks, SMS-08-OP-3129, v1.1, 14 September 2015

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 10 June 2016, the pilot of an Agusta S.P.A A109S helicopter, registered VH-XPB, prepared to conduct a private flight under the instrument flight rules^[1] from Sydney Airport to Ellerston, New South Wales (NSW), with three passengers on board. As the planned arrival time at Ellerston was after dark, the pilot contacted ground personnel at Ellerston before departure, who advised there was lighting at the helicopter landing site (HLS). The pilot also entered the coordinates of the HLS into the helicopter’s global positioning system (GPS). The elevation of the HLS was 1,720 ft above mean sea level (AMSL).

The helicopter departed Sydney at about 1738 Eastern Standard Time (EST). During the cruise at 8,000 ft AMSL, the helicopter entered cloud, with the cloud base at about 4,500 ft. When about 10 NM from Ellerston, the pilot commenced a descent to the calculated lowest safe altitude^[2] of 6,500 ft.

When about 3 NM from Ellerston, with the property in sight, the pilot commenced a descent to 3,500 ft, to ensure adequate terrain clearance for arrival overhead the GPS position of the helipad (Figure 1). During the descent, the pilot sighted the lights from the buildings at Ellerston and visually confirmed they were at the intended location.

Figure 1: Ellerston property

Source: Google earth – annotated by ATSB

At about 1838, the helicopter arrived overhead the GPS position for the helipad. The pilot sighted a red beacon, but as they had expected to see the illuminated hangar and helipad, became unsure of the location of the HLS. The pilot reported that they then descended to about 2,500–3,000 ft and tracked to the west and north-west towards other lit buildings and then to the east back over the red light, but did not see any illumination indicative of a HLS. The pilot then elected to track towards the buildings of the homestead and descend to verify their exact location.

At about 1841, the helicopter descended to 2,286 ft (according to recorded data) in the vicinity of the Ellerston clubhouse and nearby buildings which the pilot reported were all well illuminated and visible. The elevation of the terrain at that point was 1,770 ft with rising ground to the north and south-east up to 2,250 ft (Figure 1). The pilot reported that they were then sure of their exact location, and assessed that the red light must be on the hangar next to the HLS.

The pilot then commenced a right turn to position for an approach from 2 NM to the north-east of the HLS. At about 1842, as the aircraft was positioning for the approach, the pilot received a ‘landing gear’ warning from the radio altimeter. This warning is generated whenever the helicopter is below 200 ft above ground level (AGL) without the landing gear extended. The pilot immediately raised full collective and commenced a climb to 4,000 ft AMSL tracking towards the south. A low rotor RPM occurrence was recorded on the aircraft computer at 1842, indicative of a rapid raising of the collective.^[3]

After climbing to 4,000 ft, the pilot turned to track towards the red light from the south-south-west, and saw a flashing bright torch light near the red light indicating the HLS. The pilot then positioned the helicopter to the north-east of the HLS and commenced an approach. During the approach, ground personnel shone car headlights from the sealed area, which confirmed to the pilot that the helicopter was approaching the helipad. At about 50 ft AGL, the pilot was able to identify ground features at the helipad and continued with the landing.

After landing, the passengers disembarked and the pilot refuelled the helicopter. The pilot then conducted a ferry flight to Camden Airport, NSW. After arriving in Camden, the helicopter was pushed into a well-lit hangar, at which stage damage to the helicopter was detected. It was apparent that the helicopter had struck a tree branch, causing damage to the right-side landing lights, horizontal stabiliser, vertical fin and rotating beacon (Figure 2). It was unclear exactly when the helicopter had struck a tree.

Figure 2: Damage to right landing light of VH-XPB

Source: Helicopter operator

Pilot comments

After overflying the buildings and positively establishing the helicopter’s position, the pilot turned right to track north. A line of hills ran north-south from that area. The pilot was then attempting to maintain about 500 ft AGL and when the 200 ft radio altimeter ‘landing gear’ warning sounded, the helicopter was either descending (without the pilot realising) or maintaining altitude, but heading towards rising ground.

The pilot assessed that the helicopter probably struck a branch when the 200 ft warning sounded. The pilot did not hear or feel the collision, but at the time the warning sounded, the pilot rapidly raised full collective and their workload was high. If the collision with the tree branch had occurred later during the approach to the helipad, the pilot thought they would have heard or felt it due to lower airspeed and engine power settings. The pilot was not aware of having struck anything and no damage was detected during refuelling at Ellerston.

The pilot had landed at Ellerston three times previously in daylight but had not been there at night. After speaking to ground personnel prior to the flight, the pilot was expecting the sealed area and helipad to be illuminated. When there was no illumination visible from above, in the vicinity of the helipad, the pilot became confused as they could see the red light but not the helipad. In response, they orbited to confirm their position and then to determine where the helipad was in relation to that position. They were then trying to get visual reference with the landing site and remain at a safe height above the terrain and any obstacles.

Due to the overcast cloud, there was no celestial illumination, and as the area was surrounded by high ground, it was a black hole. In that situation, the pilot’s attention was split between looking outside to establish their position relative to the landing area, and inside at the instruments to maintain altitude and speed.

On a dark night, pilots need to apply greater safety margins such as use of the autopilot to reduce pilot workload, and maintaining a greater height above terrain until the landing site has been positively identified and an approach commenced.

Aircraft satellite tracking data

The helicopter was fitted with a satellite tracking system which recorded the time and the helicopter’s position, height and speed, at 2-minute intervals. The 200 ft warning occurred between two of the recorded points, so the exact position and altitude of the helicopter at that time was not recorded.

Operator report

The helicopter operator conducted an investigation and found the following factors contributed to the incident:

• It was assumed by the company that the pilot was familiar with the layout and positioning of the Ellerston village and helipad because they had operated there on multiple occasions during daylight in the same aircraft, and they had discussed lighting arrangements with ground staff prior to the flight.
• The helipad did not have the appropriate edge lighting to identify it as a HLS for night operations.
• After flying overhead and realising the need to orbit to identify the helipad, the pilot should have nominated a vertical limit of 3,500 ft and a horizontal limit of 2 or 3 NM to prevent inadvertent controlled flight into terrain. A descending turn while scanning between ground lights and instruments in a pitch-black environment creates a very high workload. Planning the descent with absolute limits is critical to maintaining situational awareness. The use of autopilot in this situation can also aid in reducing workload while scanning outside.
• Although the pilot was highly experienced and current with regard to regulatory requirements, lack of training in the conduct of ‘black hole’ approaches (recognised as a particularly demanding exercise) was identified as a factor.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Helicopter operator

As a result of this occurrence, the helicopter operator has advised the ATSB that they are taking the following safety actions:

• Introduction of night, black hole approach training and controlled flight into terrain avoidance technique training for all pilots who conduct night and IFR operations. This is to include both inflight and simulator training.
• No company pilot will be authorised to fly into the Ellerston helipad at night without specific familiarisation training from the local pilot.
• It is recommended that the Ellerston HLS be assessed against standard HLS lighting requirements for any future night operations.
• All private helipads with potential for night operations are to be risk assessed and documented procedures produced.
• Adjustment of the radio altimeter warning decision height for the A109 is limited to the standard 200 ft and 150 ft alerts. A variable decision height warning device is to be investigated.
• The company will increase the reporting rate on the satellite-tracking device from 2-minute to 1-minute intervals.

Safety message

The ATSB publication Avoidable Accidents No. 7 - Visual flight at night accidents: What you can't see can still hurt you explains how suitable strategies can significantly reduce the risks of flying visually at night.

The extra risks inherent in visual flight at night are from reduced visual cues, and the increased likelihood of perceptual illusions and consequent risk of spatial disorientation. Situational awareness with respect to the relative position of terrain and obstacles is fundamentally important during the conduct of limited visibility operations.

Aviation Short Investigations Bulletin- Issue 52

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

1. Instrument flight rules permit an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules. Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC, while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
2. The lowest altitude which will provide safe terrain clearance at a given place.
3. A primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity. Raising or lowering the collective lever increases or decreases the main rotor lift, which increases or decreases main rotor drag. The collective lever is also connected to the engine anticipators, which respond to raising or lowering of the collective by increasing or decreasing engine power to compensate for the changes in main rotor drag and govern the main rotor speed.

What happened

On the morning of 16 June 2016, a student and instructor planned to conduct a training flight in a Piper PA-28-161 aircraft, registered VH-IPO (IPO), from Mangalore Airport, Victoria.

The planned flight included time in the Mangalore training area before returning to the airport for circuit training. The aircraft departed Mangalore at about 0940 Eastern Standard Time (EST).

After completing the planned training area manoeuvres, the instructor conducted an orbit and asked the student to identify significant geographical points within the training area. At this time, the instructor noticed the tachometer indicated a slightly lower engine power output than expected for the selected throttle position. The instructor suspected carburettor icing^[1] and applied carburettor heat.^[2] This resulted in an immediate further drop in power and the instructor also reported the engine running slightly rough. After 10–15 seconds the power level returned to normal. After a further 10–15 seconds, the instructor selected the carburettor heat off and instructed the student to return to Mangalore. During the return flight, the instructor periodically applied carburettor heat without further indications of carburettor icing.

As the aircraft descended to Mangalore, the student selected carburettor heat on and joined the circuit for runway 36. Due to traffic in the circuit, the student conducted two go-arounds.^[3] After the second go-around, the aircraft re-joined the circuit, and the student prepared the aircraft for another approach. As the student prepared to turn onto the base leg, they applied the carburettor heat. At that time, the instructor observed a large drop in RPM. The instructor then took control of the aircraft and immediately turned onto the base leg. During the turn, the engine failed, and the instructor continued the turn to track directly to runway 36. The instructor carried out the engine failure checklist, but was unable to restart the engine. The instructor then broadcast MAYDAY^[4] on the Mangalore common traffic advisory frequency.

As the aircraft descended toward runway 36, the instructor assessed that they did not have sufficient altitude to glide to the runway. The instructor identified a field to the south of runway 36 and outside of the airport perimeter as suitable for a forced landing. As the aircraft descended through about 200 ft above ground level, the instructor conducted the shutdown checklist and landed the aircraft in the selected field.

The instructor and student were not injured in the incident and the aircraft was not damaged.

VH-IPO

Source: Aircraft operator

Operator comment

The operator of IPO provided the following comment:

An engineer inspected the aircraft after the incident. The exhaust system, engine controls, fuel system and ignition system were inspected. Engine tests and a flight test were also performed. All checks indicated no faults with the aircraft or contaminants in the fuel system.

Carburettor icing

Induction icing, often referred to as carburettor icing, is the accumulation of ice within the induction system of an engine fitted with a carburettor. This ice forms as the decreasing air pressure and introduction of fuel reduces the temperature within the induction system. The temperature may reduce sufficiently for moisture within the air to freeze and accumulate. This build-up of ice restricts airflow to the engine, leading to a reduction in engine performance.

Environmental conditions influence the likelihood of carburettor ice forming, as shown by the Civil Aviation Safety Authority (CASA): Carburettor icing probability chart.

On the morning of the engine failure, the Mangalore aerodrome weather information service reported the following weather conditions.

Table 1: Weather conditions at Mangalore Airport on 16 June

Time	Temperature	Dew point
1000	8.6 °C	8.6 °C
1015	9.4 °C	9.1 °C
1030	9.6 °C	7.5 °C
1045	10.1 °C	7.3 °C
1100	10.6 °C	6.9 °C
1115	10.9 °C	6.5 °C

The carburettor icing probability chart shows the conditions at Mangalore Airport placed IPO in the serious icing zone for carburettor icing at the time of the incident (Figure 1). Carburettor icing could be expected at any power setting.

Figure 1: Carburettor icing probability chart showing prevalent conditions in yellow

Source: CASA modified by ATSB

The first indication of carburettor icing is normally a reduction in power produced by the engine. If not corrected by the pilot this may lead to rough running of the engine and engine failure.

When operating in conditions conducive to carburettor icing, pilots should use carburettor heat to prevent and remove ice build-up. After selecting carburettor heat, engine performance may deteriorate further as the ice is melted before engine performance returns to normal. This may take up to 30 seconds.

Instructor comment

The instructor of IPO provided the following comments:

On the two circuits prior to the engine failure, the student selected carburettor heat on prior to turning onto the base leg of the circuit with no indications of carburettor icing.

After the second go-around, the student joined a shortened downwind. The time period when the carburettor heat was selected off, where the carburettor ice appeared to form was very short and occurred at a very high-power setting.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

• The operator has increased instructor and student awareness of carburettor icing probability and symptoms for early detection. The operator has issued all instructors and students with a copy of the CASA article Ice kills.
• The operator will review relevant company briefs to include carburettor ice probability and prevention.
• The operator has recommended the company operations manual be reviewed to mitigate against flying outside of gliding distance to the runway during circuit training.

Safety message

This incident highlights the insidious nature of carburettor icing and the speed with which carburettor icing can occur in favourable environmental conditions. The incident also reinforces the need for pilots to be aware of the risk of carburettor icing at all times during the operation of aircraft fitted with a carburettor.

• The ATSB article Melting moments: Understanding carburettor icing provides valuable information to assist pilots in understanding and preventing carburettor icing.
• The article Piston engine icing produced by the European Strategic Safety Initiative provides in-depth information to assist pilots in identifying and managing carburettor icing.

Aviation Short Investigations Bulletin- Issue 52

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Carburettor ice is formed when the normal process of vaporising fuel in a carburettor cools the carburettor throat so much that ice forms from the moisture in the airflow which can restrict the airflow and interfere with the operation of the engine.
2. Carburettor heat is a system within the aircraft engine, selectable by the pilot, which draws heated air into the carburettor to prevent or attempt to remove ice.
3. Go-around, the procedure for discontinuing an approach to land, is a standard manoeuvre performed when a pilot is not completely satisfied that the requirements for a safe landing have been met. This involves the pilot discontinuing the approach to land and may involve gaining altitude before conducting another approach to land.
4. MAYDAY is an internationally recognised radio broadcast for urgent assistance.

What happened

On 17 June 2016 at about 0055 Eastern Standard Time, a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, departed Melbourne Airport, Victoria, on a freight service to Launceston, Tasmania. After arriving overhead Launceston, the flight crew proceeded to conduct an instrument approach for runway 32L. However, due to adverse weather condition, the crew were unable to land and a missed approach was conducted.

On completion of the missed approach, the captain (CA) initiated a left turn to re-position the aircraft for a second approach. A short time later, while responding to a call from the airport groundsman about the weather conditions, the CA handed control of the aircraft to the first officer (FO).

While the captain instructed the FO to maintain the turn, subsequent manoeuvring had not been discussed. The resultant flight path led to the aircraft entering an area with a minimum permitted altitude of 5,800 ft. While the crew had commenced a climb, the aircraft had not reached that minimum altitude and entered the area at about 4,400 ft. In response, air traffic control issued a safety alert for terrain and instructed the crew to climb the aircraft above the minimum safe altitude.

What the ATSB found

The ATSB found that the instrument approach briefing conducted by the flight crew did not ensure that there was a shared understanding of how the aircraft would be manoeuvred on completion of the published missed approach. That resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.

The ATSB also identified that flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.

What's been done as a result

In response to this occurrence the operator issued a flight standing order that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring. In addition, the approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.

The effective management and manipulation of the aircraft, following a missed approach, was included as a discussion item and exercise in the operator’s recurrent simulator training program.

Safety message

This occurrence highlights the value of having a clear, and where appropriate, shared plan. A common understanding between flight crew prevents additional workload associated with clarifying intentions during busy events, such as during and after missed approaches.

Operators and flight crew should consider including appropriate missed approach considerations, such as intended flight path, crew actions, terrain clearance and air traffic control requirements, into their approach briefings, regardless of the existing environmental conditions.

Safety analysis

Flight below the minimum sector altitude (MSA) occurred following a missed approach that was conducted due to poor weather conditions. While the flight crew assessed that the safety of the aircraft was never in doubt, there was confusion as to how the aircraft was to be manoeuvred on completion of the missed approach.

This analysis will examine the aircraft’s flight path following the missed approach, and factors that contributed to the flight below MSA.

Prior to commencing descent, the crew conducted a normal approach briefing. The prevailing weather conditions at Launceston airport were such that the flight crew were required to conduct an instrument landing system (ILS) approach. The weather conditions also meant that it was reasonably foreseeable that they would need to conduct a missed approach. While an instrument approach briefing was conducted prior to descent, and covered the standard components including the missed approach segment, there was no discussion of how the aircraft would be subsequently manoeuvred.

A missed approach following an ILS approach is not common as the associated low weather minima usually permits the landing to be completed. As such, planning how the aircraft is to be manoeuvred in the event of a missed approach may not always be considered in detail. Additionally, tracking and altitude requirements following a missed approach are often provided by air traffic control (ATC), particularly in the case of larger commercial aircraft such as VH‑XMO.

Additionally, with the exception of situations such as simulator training, missed approaches are often unexpected. Consequently, the safe conduct of a go‑around and subsequent manoeuvring relies on a shared appreciation to avoid the need to clarify intentions during an already busy period. Irrespective of the weather conditions, a thorough go‑around briefing, that gives consideration to factors such as initial and subsequent flight paths, crew actions and co‑ordination, terrain clearance and ATC requirements, offers an effective means of ensuring that a common appreciation exists.

Although air traffic control (ATC) services were available en route and during descent, Launceston Tower was closed when the aircraft arrived. Consequently, the normally tower‑controlled Class D airspace below 1,500 ft became non-controlled Class G airspace. This meant that, in the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace at 1,500 ft and an ATC clearance would be required prior to manoeuvring beyond the published missed approach.

The approach and missed approach flight paths were aligned to enable the aircraft to descend and climb clear of terrain. The missed approach path positioned the aircraft within a sector that had an MSA of 3,200 ft. Any manoeuvring outside of that sector required the crew to climb the aircraft to the relevant sector MSA prior to entry. In this case, the left turn was towards a sector that had an MSA of 5,800 ft. Alternatively, climbing straight ahead on the missed approach track to 5,800 ft would have enabled the crew to manoeuvre the aircraft as required within 10 NM (19 km) of the airport.

On completion of the missed approach, the captain commenced a left turn with the intention of positioning the aircraft for a second approach. While a continuous left turn may have maintained the aircraft within the 3,200 ft sector, this manoeuvre had not been discussed during the approach briefing. As a result, when the CA handed control of the aircraft to the FO, the left turn was stopped on a south-easterly heading.

The south-easterly flight path resulted in the aircraft tracking towards a sector with a MSA of 5,800 ft while at an altitude of 3,200 ft. Although the crew had commenced a climb, the aircraft had only achieved an altitude of 4,400 ft when it entered the 5,800 ft sector. As a result, ATC issued a safety alert for terrain proximity. ATC also issued instructions for an immediate climb to 5,800 ft and later, to 6,300 ft.

Although the aircraft was never in immediate danger of colliding with terrain, it was operated over an area and at an altitude less than that prescribed for safe flight. Had the required clearance been obtained prior to manoeuvring, ATC would have provided the crew with appropriate tracking and altitude requirements. Additionally, without the flight path monitoring and timely altitude alerts provided by ATC, the risk of collision with terrain may have increased.

Had the approach briefing included a discussion about subsequent manoeuvring, both crew members would have had a shared understanding of the expected flight path. Such a discussion would have provided the crew with an opportunity to discuss alternative tracking, minimum safe altitude requirements, and the need to obtain a clearance.

Findings

From the evidence available, the following findings are made with respect to the flight below lowest safe altitude involving Boeing 737, registered VH-XMO at Launceston Airport, Tasmania on 17 June 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The instrument approach briefing conducted by the flight crew did not ensure there was a shared understanding of how the aircraft would be manoeuvred following completion of the published missed approach.
• The absence of an established, and shared, manoeuvring plan, resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
• On completion of the missed approach, the flight crew did not obtain an onwards airways clearance prior to further manoeuvring. That negated the terrain clearance assurance that would otherwise have been provided and increased the risk of conflict with other aircraft.

Other findings

• The flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• flight crew
• aircraft operator
• Airservices Australia.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew and operator of VH-XMO, Airservices Australia and the Civil Aviation Safety Authority (CASA).

Submissions were received from CASA and the aircraft operator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

The occurrence

On 17 June 2016 at about 0055 Eastern Standard Time^[1], a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, was scheduled to operate a freight service from Melbourne, Victoria, to Launceston, Tasmania. The flight crew consisted of a training captain (CA) as the pilot flying^[2] and a first officer (FO) under training as the pilot monitoring. This flight was the FO’s ninth sector operating the B737 aircraft.

The flight crew signed on for duty in Melbourne at about 1910. The duty included a return flight to Sydney, New South Wales, followed by a return flight to Launceston. A review of the weather for the duty indicated relatively benign conditions for Melbourne and Sydney. However, the Launceston forecast included cloud at 1,500 ft above the ground and periods of light rain. A temporary reduction in visibility to 4,000 m and cloud down to 1,000 ft were also forecast, together with heavier rain showers. Those weather conditions required the flight crew to carry an alternate. In this case, the aircraft carried sufficient fuel to operate to Launceston and return to Melbourne.

The flight to Sydney and return was uneventful. Approaching Melbourne, the flight crew obtained a weather update for Launceston. That update forecast cloud at 1,000 ft, reducing temporarily to 500 ft with continuing rain showers. Automated weather observations for Launceston at 0000, recorded visibility of 5,000 m in rain and overcast cloud at 100 ft. While the observed weather conditions were below those required to land, the CA reported that adverse weather conditions at Launceston historically fluctuated.

The flight departed Melbourne for Launceston at about 0055. On board the aircraft was sufficient fuel to operate the flight to Launceston, conduct three instrument approaches and, if required, return to Melbourne. The flight crew continued to monitor the Launceston weather conditions en route. Subsequent automated observations showed little or no improvement to the weather.

Prior to descent, the flight crew conducted an approach briefing for Launceston. That briefing included discussions covering the expected instrument landing system^[3] (ILS) approach for runway 32L (Figure 1), and the missed approach should it be required. The operator’s low visibility procedures were also covered. Those procedures required that, approaching the minima, the CA was to scan both the aircraft instruments and outside for the runway. The FO’s primary task was to monitor instruments and the aircraft’s flight path.

Descent was commenced at about 0125. Automated weather observations for Launceston at 0113, recorded visibility of 9,000 m in rain showers and overcast cloud at 200 ft. At about 0131, air traffic control (ATC) advised the crew that, based on the latest automated weather observations, conditions on the ground were, 300 m visibility and overcast cloud at 200 ft. The crew were subsequently cleared to leave controlled airspace on descent and to conduct an instrument approach to runway 32L.

Launceston tower control services were generally available between the hours of 0600 and 2200. As the tower was closed, the controlled Class D airspace below 1,500 ft above mean sea level (AMSL) had reverted to non‑controlled Class G airspace. In the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace above 1,500 ft AMSL and a clearance would be required prior to any subsequent manoeuvring on completion of the published missed approach.

The aircraft passed overhead Launceston at about 0136. The flight crew then proceeded to descend the aircraft in accordance with the prescribed ILS approach procedure. The minimum altitude for landing of 750 ft (202 ft above the runway threshold) was reached at about 0145. As the crew could not see the runway, a missed approach was conducted.

At about 0147, the aircraft levelled off at the missed approach altitude of 3,200 ft. About 20 seconds later, the CA initiated a left turn by selecting the autopilot heading bug to a south‑westerly heading. The CA’s intention was to continue the left turn and position the aircraft overhead the airport for a second instrument approach. The FO reported being surprised by the turn and immediately thought that they should climb the aircraft.

Figure 1: Launceston instrument landing system approach chart for runway 32L with relevant minimum safe altitudes required for manoeuvring, in instrument meteorological conditions or at night, circled in red.

Source: Airservices Australia modified by the ATSB

After advising ATC that they had conducted a missed approach, ATC asked the crew to confirm that they were on the published missed approach. The flight crew confirmed this and advised ATC that they were turning back towards Launceston. At about the same time, the CA responded to a radio call from the Launceston Airport groundsman and handed control of the aircraft to the FO. While the CA did instruct the FO to keep the turn going, to where, or onto what heading was not discussed.

While the CA was talking to the groundsman about the weather, the FO observed the radio altimeter become active. The radio altimeter provides an indication of aircraft height above the ground up to 2,500 ft. In response to the radio altimeter activation, the FO advised the CA that they should climb the aircraft.

By about 0148, the aircraft was turning left through a heading of 140 degrees and climbing through 3,900 ft. The aircraft was also approaching the boundary of the 3,200 ft minimum sector altitude^[4] (MSA). At about the same time, ATC asked the crew to confirm that they would be remaining within the 3,200 ft sector and advised that otherwise they needed to be at 5,800 ft. The crew responded by advising they were climbing to 5,800 ft.

The aircraft subsequently entered the 5,800 ft MSA sector at about 4,400 ft, on a steady heading of about 110 degrees, and about 3.5 NM (6.5 km) southwest of the airport. As the aircraft was below the required MSA, ATC issued a safety alert for terrain and instructed the crew to climb immediately to 5,800 ft.

In response, at about 0149, the crew advised ATC that they were climbing to 6,000 ft. ATC acknowledged the call and asked the crew if they would be entering the holding pattern overhead Launceston. The crew reported that they were maintaining 6,000 ft and asked ATC to standby.

At about 0150, the aircraft was in a left turn, maintaining 6,000 ft and about 5 NM (9 km) to the southeast of the airport. ATC advised the crew that they were about to enter an area with a higher MSA and to climb immediately to 6,300 ft or higher. The crew acknowledge the altitude requirement and advised ATC that they would be returning to Melbourne. A short time later, as the aircraft had not yet reached 6,300 ft, ATC reissued the instruction to climb immediately to 6,300 ft.

The aircraft was subsequently cleared to climb to its cruise altitude and returned to Melbourne.

__________

1. Eastern Standard Time (EST) was Coordinated Universal Time (UTC) + 10 hours.
2. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. Instrument Landing System (ILS): A precision instrument approach system which normally consists of the following electronic components: VHF Localiser, UHF Glideslope, VHF Marker Beacons.
4. Minimum Sector Altitude (MSA): The lowest altitude which may be used which will provide a minimum clearance of 1,000 ft above all objects located in an area contained within a sector of a circle of 25 NM or 10 NM radius centred on a significant point, the aerodrome, or helicopter, reference point.

Safety issues and actions

Proactive safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The aircraft operator, Express Freighter Australia, has made the following amendments to their training and procedures:

• A flight standing order was issued that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring.
• The approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
• A ‘Hot Topic’ discussion item – post missed approach manoeuvring and management, was added to the recurrent simulator training program.
• The recurrent simulator training program, released in December 2016, included exercises that reinforce the enhanced arrival and approach briefing requirements. Crews were required to demonstrate appropriate inflight management and manipulation subsequent to completion of a published missed approach.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 7 June 2016 at about 1000 Western Standard Time (WST), a Fokker F28 MK 0100 aircraft, registered VH-NHF, departed on a charter flight from Christmas Creek to Perth, Western Australia. On board were five crewmembers and 28 passengers.

The aircraft was on climb to the planned cruise altitude of FL 340^[1] and the weather was generally clear and smooth with intermittent icing conditions. The first officer was the pilot flying (PF) and the captain was the pilot monitoring (PM) for this flight.^[2]

As the aircraft climbed through FL 200, the flight crew heard a ‘whistling’ noise. They did not notice any other abnormal indications and after about one minute, the noise stopped. At about FL 305, a loud ‘whooshing’ noise was heard by the flight crew on the flight deck and the three cabin crewmembers who were standing in the forward galley.

The cabin crew believed the noise was coming from the forward lavatory, so one cabin crewmember inspected the lavatory, but could not identify where the noise was coming from. The PM checked the aircraft pressurisation indications located on the cockpit overhead panel and noticed that the cabin altitude^[3] indicated 6,000 ft as expected, but the cabin pressure rate of climb had increased from about 200–300 ft/min to about 500 ft/min^[4] (Figure 1). This indicated to the PM that they were losing cabin air faster than the pressurisation system could pressurise the aircraft.

Figure 1: F28 cabin pressure gauges

Source: Operator annotated by ATSB

The PM contacted air traffic control (ATC) to request a level-off at FL 320, rather than their planned level of FL 340. At about this time, the cabin manager informed the flight crew that the cabin crew had heard a ‘suction’ noise from the forward lavatory, but could not identify the source of the noise. The PM asked the cabin manager to cautiously inspect the forward lavatory again. The flight crew then received a ‘PACK 1’^[5] level 2 warning^[6] in the cockpit and the associated emergency procedure displayed on the multi-function display unit (MFDU). The first step of the procedure was to turn off the affected air-conditioning pack and wait two minutes for the pack to cool before attempting a reset. When the PM turned off air-conditioning pack 1, they noticed the cabin pressurisation rate of climb increase to in excess of 2,000 ft/min.

The PM contacted ATC again and requested a descent to FL 250 and received a clearance from ATC to initially descend to FL 290 due to an airspace boundary. Before the PF was able to start the descent, the flight crew received an ‘auto-throttle 1’^[7] level 1 warning. At about this time, the PM informed the cabin manger that they were about to activate the seat-belt sign because an ‘excessive cabin altitude’ warning was imminent and the emergency oxygen would deploy.

Before the two minutes passed for the air-conditioning pack reset, the ‘excessive cabin altitude’^[8] level 3 warning activated. The flight crew performed their initial drill,^[9] which included donning their oxygen masks. The PM then checked the cabin altitude, noticed it was indicating in excess of 25,000 ft and that the passenger emergency oxygen had deployed, and made a PAN^[10] call to ATC. They received a clearance for an immediate descent to 10,000 ft, and the PF initiated an emergency descent.

As the aircraft descended, the cabin crew performed their ‘sit-fit-advise’^[11] drills for deployment of passenger emergency oxygen and the flight crew performed their ‘emergency descent procedure’. The flight crew completed their ‘excessive cabin altitude’ procedure during the descent and then discussed their requirements for flight at 10,000 ft, which included alternate destination options. The PF levelled the aircraft at 10,000 ft and the flight crew completed the ‘emergency descent procedure’, which included a public address that emergency oxygen was no longer required.

The flight crew completed the air-conditioning pack and auto-throttle emergency procedures. After air-conditioning pack 1 was selected on, the cabin altitude decreased to 1,500 ft and the PACK 1 fault did not return for the rest of the flight. The PM left the seat belt light on for the remainder of the flight, but gave permission for the cabin crew to leave their seats to check on the needs of the passengers.

The cabin crew checked on the condition of the passengers and noted that one passenger wished to continue using supplemental oxygen. The cabin crew facilitated the passenger’s request and provided them with portable oxygen for the remainder of the flight.

ATC contacted the aircraft for a progress update and provided the latest weather details for Newman, Meekatharra and Perth. The flight crew diverted the aircraft to Newman Airport, which was the closest option with company ground services. The crew advised ATC that an ambulance was required on arrival.

The aircraft landed at Newman at about 1100. Paramedics were available on arrival at Newman to provide assistance, but were not required.

F28 pressurisation – general description

Bleed air is compressed air taken from the compressor stage of the engine. Bleed air is used for several functions including pressurisation, air-conditioning and anti-icing. For pressurisation, the bleed air is supplied to the two air-conditioning packs located underneath the floor of the flight deck, which are used to control the temperature of the air prior to distribution into the flight deck and cabin (Figure 2).

Cabin pressure is regulated by the outflow valves, which control the outflow of air from the cabin in either automatic or manual mode. Controls for automatic and manual mode of operation are located on the flight deck. In automatic operation, the differential pressure^[12] of 7.46 psi provides a cabin pressure altitude of 8,000 ft at an aircraft altitude of 35,000 ft (FL 350). The outflow valves will normally limit the maximum pressure differential in automatic and manual mode to 7.65 psi and the cabin pressure altitude to 12,000 ft plus or minus 1,500 ft, provided airflow from the air-conditioning pack(s) is available. An excessive cabin altitude warning is presented at 10,000 ft. The cabin is automatically depressurised upon landing and there are two negative pressure relief valves to prevent negative cabin pressure.

When one pack is selected off, the respective pack main valve shuts off bleed air supply and the other pack increases its output flow rate to 140 per cent of the normal flow rate. A single pack is capable of maintaining cabin altitude by itself at the maximum operating altitude of FL 350. Air-conditioning pack 1 is located underneath the floor of the flight deck on the left-hand side, which is just forward of the forward lavatory.

Figure 2: F28 bleed air supply

Source: ATSB

Captain (PM) comments

The captain provided the following comments:

• No systems associated with air-conditioning/pressurisation were recorded as unserviceable before the flight.
• The emergency unfolded ‘very quickly’ with multiple faults and therefore knowledge of the emergency drills and procedures needed to be ‘second-nature’. By the time they had performed their initial drills and checked the deployment of the passenger emergency oxygen, the cabin pressure altitude was already indicating in excess of 25,000 ft.
• The loud ‘whooshing’ noise was similar to the noise heard in the simulator during rapid decompression training.
• They did not feel any physiological effects during the loss of pressure and responded in accordance with their training.
• Their simulator training was comprehensive, allowing them to follow procedures while maintaining sufficient ‘spare mental capacity’ to deal with all the problems that unfolded in a logical and methodical manner.

Cabin manager comments

The cabin manager provided the following comments:

• One passenger reported to them there was an unusual smell and the PM indicated to them that this was probably from the failed air-conditioning pack.
• Prior to the oxygen mask deployment, they felt a sensation in their ears, ‘like on a descent’. Another cabin crewmember commented to the cabin manager that they looked pale, and another cabin crewmember reported to them that they felt a loss of breath.
• After the instruction to sit down for the expected excessive cabin altitude, they were concerned that the sleeping passengers might not get their oxygen masks on when they deployed.
• About two minutes after sitting down, they heard a loud bang and the passenger emergency oxygen deployed.
• Some passengers had trouble fitting their oxygen mask, so the cabin crew used a combination of hand signals and verbal communication to assist them while remaining in their jump seats.
• They felt that the incident was managed in a ‘textbook’ manner.
• Another member of the cabin crew reported to them that they saw sticky tape covering the emergency oxygen in the forward lavatory, which prevented its deployment.

Maintenance findings and corrective actions

The operator’s maintenance investigation of the incident found the following:

• There was a visual indication of duct over-temperature on air-conditioning pack 1.
• There was a controller fault on air-conditioning pack 1 and the flight deck temperature control was not working. The controller was replaced.
• A ‘heavy leak’ was found from the recirculation duct during investigation of air-conditioning pack 2. The recirculation duct was replaced.
• One of the outflow valves was found to be a ‘bit sticky’. The primary and secondary outflow valves were replaced. However, this did not have any effect on the pressurisation test results.
• There was a ‘massive leak’ from the inlet and outlet of air-conditioning pack 1. Pack 1 was removed and a large hole found in the plenum duct^[13] (Figure 3). The plenum duct and primary and secondary heat exchanger were replaced on pack 1. Aircraft pressurisation was then tested and found to be serviceable (including operations with either pack 1 or pack 2 turned off).

Figure 3: Ruptured plenum duct

Source: Operator

Operator comments

The airline operator provided the following comments:

• The pack 1 fault was triggered by a compressor outlet overheat switch, which is located in the compressor outlet duct of the number 1 air-conditioning pack.
• The auto-throttle 1 fault was probably linked to the leaks in the air-conditioning ducts, which resulted in a conflict between the demands of the pressurisation computers and the operation of the auto-throttle system.
• The reason why the passenger emergency oxygen did not deploy in the forward lavatory is under investigation.
• The depressurisation can be attributed to pack 2, being the sole air supply, having a ‘heavy’ recirculation duct leak, which would not allow pack 2 to pressurise the aircraft.

Similar occurrence

On 11 April 2016 VH-NHF suffered a number 2 bleed valve fault, which was reset once and then failed a second time. The pilots initiated a return to Perth. During the transit, the number 1 bleed valve failed. The pilots initiated their emergency drills, which included the use of emergency oxygen and a precautionary descent to FL 140. The excessive cabin altitude warning did not activate and during the descent, the number 1 bleed valve was reset. A normal approach and landing was performed at Perth.

ATSB comment

Air-conditioning pack 1 is located on the left side of the aircraft underneath the floor of the flight deck, just aft of the left seat, which places it close to underneath the floor of the forward lavatory. The pack 1 plenum duct likely ruptured at about FL 305 to produce what the aircraft captain described as a loud ‘whooshing’ noise and what the cabin manager described as a ‘suction’ noise. According to Flight Safety Foundation Human Factors and Aviation Medicine, the immediate donning of oxygen masks by the flight crew, following an ‘excessive cabin altitude’ warning, is the essential first step to surviving a high-altitude depressurisation.

The subsequent maintenance investigation found duct leaks from both air-conditioning systems. However, only the leak from air-conditioning pack 1 triggered an alert to the pilots, and that fault was associated with an overheat condition. In accordance with the operator comments, the rapid increase in the cabin pressure altitude rate of climb, which occurred when the flight crew turned pack 1 off, indicates that pack 2 alone could not supply a sufficient quantity of air to the distribution ducting to maintain cabin altitude. The systems were only able to re-pressurise the aircraft following the descent to 10,000 ft (the demands on the pressurisation system were substantially reduced) ^[14] and the successful reset of pack 1.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

As a result of this occurrence, the operator has advised the ATSB that they are taking the following safety action:

All parts removed from the number 1 air-conditioning pack will be forwarded to the manufacturer, or authorised repair organisation, for further technical investigation to determine the cause of the failure of the plenum duct.

Safety message

The incident started in a subtle manner as an unusual noise, then quickly escalated to a compound emergency. After some initial uncertainty regarding the noise, the flight crew quickly recognised the true nature of the emergency that was unfolding. The captain and cabin manager both commented that the emergency then unfolded in accordance with their expectations and there were several factors that assisted their emergency management. These factors included:

• their training experiences, which they felt closely matched their emergency experience
• procedural knowledge of their initial drills
• the fact that their colleagues were trained to the same level as themselves.

This incident highlights the importance and value of high-quality training for both flight crew and cabin crew. Quality training clearly assists in equipping crewmembers with the required knowledge and confidence to effectively respond to a time critical emergency. A sound understanding of emergency procedures is particularly important in ensuring that crews not only respond to an emergency appropriately, but also retain the capacity to deal effectively with other potentially complicating factors. Similarly, a sound understanding of aircraft systems supports effective crew decision making with respect to the best course of action when confronted with abnormal circumstances.

Additional information regarding how to respond to an aircraft depressurisation is provided in the following ATSB education bulletins:

• Staying safe during an aircraft depressurisation – Passenger information bulletin (AR-2008-075 (1))
• Aircraft Depressurisation – Cabin crew information bulletin(‑AR2008075 (2)).

Aviation Short Investigations Bulletin- Issue 52

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 340 equates to 34,000 ft.
2. Pilot flying (PF) and pilot monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and aircraft flight path.
3. Altitude corresponding to pressure inside the cabin. 6,000 ft cabin altitude corresponds to an atmospheric pressure of 6,000 ft (See REF _Ref457385838 \h \* MERGEFORMAT F28 pressurisation – general description below).
4. Engine compressor bleed air is used to supply pressurised air through ducting to the two air-conditioning packs. The air-conditioning packs then deliver air at a flow rate, pressure and temperature that maintains suitable conditions in the aircraft. The pressurisation system normally operates in automatic mode, but has a manual back-up mode if required.
5. This warning refers to the number 1 air-conditioning pack.
6. There are three levels of warning; 1, 2 and 3, level 3 being the highest level of warning. When a higher level of warning is activated the associated procedure is prioritised on the MFDU, replacing any active lower level warning procedures.
7. Auto-throttle is linked to the automatic flight control system so that engine thrust is varied automatically according to the flight profile of the aircraft.
8. The excessive cabin altitude warning activates at about 10,000 ft cabin altitude, and the passenger emergency oxygen automatically deploys at about 14,000 ft cabin altitude. The deployment of passenger emergency oxygen is indicated in the cockpit and the pilots must manually deploy the system if it fails to deploy automatically. This check is included in the ‘excessive cabin altitude’ procedure.
9. Immediate actions performed from memory before reference to the checklist.
10. An internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
11. Sit down, fit oxygen masks and advise passengers.
12. Pressure difference between the external atmosphere and aircraft cabin.
13. The plenum duct houses air at positive pressure (pressure higher than surroundings), and equalises pressure for a more even distribution in order to manage irregular supply or demand.
14. The pressure difference between 30,500 ft aircraft altitude and 6,000 ft cabin altitude is about 7.51 psi, whereas the pressure difference between 10,000 ft aircraft altitude and 1,500 ft cabin altitude is about 3.81 psi (1 atmosphere = 14.7 psi). Therefore, at 10,000 ft, the demands on the pressurisation system were substantially reduced.

What happened

On 7 June 2016, at 0418 Eastern Standard Time (EST), the pilot of a Fairchild SA227-DC, registered VH-HPE (HPE), departed Brisbane Airport, Queensland, for a flight to Mount Isa, Queensland. The flight included intermediate stops at Rockhampton and Richmond. The pilot was the only person on board the scheduled freight flight.

Prior to commencing the flight, the pilot reviewed the weather and NOTAM^[1] information. The pilot noted there was no NOTAM information for Richmond Airport for the expected arrival time.

After completing the first leg of the flight, HPE departed Rockhampton for Richmond 30 minutes later than scheduled, at about 0615. The expected arrival time for Richmond was about 0810.

At about 0800, the aerodrome reporting officer (ARO) arrived at Richmond Airport with a work crew to undertake pre-planned work. The planned work was to remove plant growth from around the runway lights. The ARO conducted a pre-work safety briefing which included the work crew actions in the event of an aircraft arrival. The ARO then gave the two available hand-held VHF radios to the workers in the two works vehicles working within the runway strip. The ARO did not have a VHF radio in their vehicle and they were the only person qualified to broadcast on the common traffic advisory frequency (CTAF) used by aircraft, which uses VHF. All other works vehicles carried UHF radios.

At about the same time, the pilot of HPE broadcast on the Richmond CTAF advising they were 40 NM to the east and conducting a straight-in approach to runway 27. The pilot received a full response from the aerodrome frequency response unit (AFRU).^[2]

After the brief, the workers undertook the required task in three groups. One group positioned at the eastern end of the runway and a second group at the western end of the runway while the ARO remained at a mid-point along the runway (Figure 1). While the work groups conducted the plant removal, the pilot of HPE activated the pilot activated lighting.^[3] The workers in the groups at each end of the runway observed the lights illuminating and immediately began to vacate the runway strip.^[4] The pilot made a further broadcast when 20 NM east of Richmond, and received only a short response from the AFRU.

At about 0815, as the aircraft joined a 5 NM final approach to runway 27, the pilot reported that they sighted a vehicle on the runway threshold moving clear of the runway strip. The pilot then broadcast on the Richmond CTAF and broadcast again passing 3 NM on final approach to the runway. They received no response to the broadcasts apart from the AFRU short response.

As HPE approached the runway, the pilot reported that they noticed vehicles and equipment at the far end of the runway and witches hats along the edge of the bitumen. As the vehicles and equipment had moved clear of the runway strip, the pilot continued the approach. At a height of about 100-200 ft above ground level, the pilot reported that they observed a person inside the runway strip near the bitumen of the runway and conducted a go-around.^[5]

The pilot then re-joined the circuit, and observed that all workers and equipment were clear of the runway. The pilot conducted a second approach and landed without incident.

No persons were injured, and the aircraft was not damaged in the incident.

Figure 1: Richmond Airport 

Source: Google Earth, modified by the ATSB

Aerodrome reporting officer (ARO) comment

The aerodrome reporting officer provided the following comments:

• The works procedures for Richmond Airport require a NOTAM to be provided for all works within the runway strip exceeding 30 minutes duration. As the ARO did not expect the works to exceed 30 minutes duration, no NOTAM was provided.
• The ARO elected to conduct the works on a Tuesday, as no passenger service was scheduled for that day.
• The ARO receives no notification of the actual expected arrival time of the scheduled daily freight service, therefore they were not aware that the service was running late and did not check the airport movement log. Had the ARO checked the log they would have delayed the works until after the aircraft had departed.
• The work crews carried two hand-held VHF radios for communicating with aircraft. While broadcasts from aircraft further than 5 NM from Richmond Airport may not be heard, calls within 5 NM are generally received.
• The runway lights were activated about 15 minutes prior to the aircraft landing.
• HPE conducted a straight-in approach to runway 27. In the past, aircraft arriving overflew the airport prior to approaching to land which the ARO believes is a safer procedure.
• All workers and equipment were clear of the runway strip at the time HPE arrived. However, the workers and equipment positioned themselves just outside the runway strip. It may have appeared to the pilot that the workers and equipment were not clear.

Pilot comment

The pilot of HPE provided the following comments:

• When approaching Richmond Airport an inbound radio broadcast was made. The AFRU provided a full response, which confirmed that their radio was working correctly and no radio broadcasts from other sources had been recently made within the Richmond CTAF.
• No radio call was received from the work crew before or after the incident.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Airport operator

As a result of this occurrence, the airport operator has advised the ATSB that they are taking the following safety action:

Change to works procedure

Prior to conducting works within the runway strip, the flight log is to be reviewed to ensure no flights are scheduled to arrive while work is in progress.

Safety message

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One identified concern is Safety around non-controlled aerodromes.  

This incident shows the importance of communication and ensuring that the systems exist and are used to minimise the likelihood of communication break downs. Effective communication between all parts of the aviation system, along with robust systems in place to support the individuals, is essential for safe operations.

• The ATSB booklet, A pilot's guide to staying safe in the vicinity of non-controlled aerodromes provides information to assist pilots to safely operate around non-controlled aerodromes.
• The Airservices Australia document An airside driver’s guide to runway safety provides information to assist ground personnel to operate safely at both controlled and non-controlled aerodromes.

Aviation Short Investigations Bulletin - Issue 53

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

------- 

[1]     A Notice To Airmen (NOTAM) advises personnel concerned with flight operations of information concerning the establishment, condition or change in any aeronautical facility, service, procedure, or hazard, the timely knowledge of which is essential to safe flight.

[2]     Aerodrome frequency response unit provides an automatic response when pilots transmit on the traffic frequency for that particular aerodrome. If no other transmissions have been received by the AFRU within the previous 5 minutes the AFRU will respond with a pre-recorded voice message comprising aerodrome identification followed by ‘CTAF’. If a transmission has been received within the previous 5 minutes the AFRU will respond with only a short tone.

[3]     Pilot activated runway and taxiway lighting is activated by a series of timed transmissions using the aircraft’s very high frequency radio, on either a discrete or the local airport communication frequency.

[4]     Runway strip is a prepared area provided around the runway to reduce risk of damage to an aircraft running off of a runway and also provide an obstacle-free area for aircraft using the runway during take-off and landing.

[5]     Go-around, the procedure for discontinuing an approach to land, is a standard manoeuvre performed when a pilot is not completely satisfied that the requirements for a safe landing have been met. This involves the pilot discontinuing the approach to land and may involve gaining altitude before conducting another approach to land.

Safety summary

What happened

At about 0025 on 30 May 2016, freight train 9305 derailed at a fractured welded rail joint at Katunga in northern Victoria. The train consisted of two locomotives and 37 flatbed wagons carrying empty containers. Twelve wagons located mid-consist (wagon positions 6 to 17) derailed resulting in severe damage to about 350 m of track. There were no injuries.

What the ATSB found

The ATSB found that the fracture was at a flash butt weld joining early twentieth century rail. The weld contained microscopic defects within the crystalline material structure that indicated improper material processing during flash butt welding, and had probably existed for many years.

It was concluded that the fracture was probably the result of higher than normal loading due to inadequate support of the rail. The loss of effective support was probably the result of deteriorated sleeper condition. The deferral of the replacement of select sleepers through the location had increased the potential for rail fracture, although it was not possible to directly link this decision to this fracture.

The condition of the fracture surfaces indicated that the fracture was probably present for several days prior to the passage of train 9305. After the rail’s fracture, the loosening of the track fasteners allowed the lateral misalignment of the rail ends that led to the derailment of the train. The regime that may have detected the fractured rail before the track deteriorated to an extent that would result in derailment was ineffective for this track and its condition.

What's been done as a result

V/Line has revised their Technical Maintenance Plan schedule to clarify that front of train inspections cannot be used to replace hi-rail patrols on the Tocumwal line.

Further, V/Line intends undertaking a risk review of the appropriateness of its current condition based responses for sleeper condition, as set out the V/line standard for inspection and assessment. The ATSB has recommended that V/Line completes the risk review and implements safety actions to reduce the likelihood of derailment following a rail fracture.

Safety message

Systems of inspection should be designed to ensure detection of rail fractures before track deteriorates to a condition that results in train derailment. 

Context

Location

The derailment occurred on a section of tangent track about 180 m north of the Spences Road level crossing (Figure 5).

Figure 5: Derailment location in Katunga, Victoria

Source: MapInfo Professional annotated by Chief Investigator, Transport Safety (Victoria)

Infrastructure

The line between Shepparton (182 km) and Tocumwal (252.6 km) was classified by V/Line as Class 4[6] track. The V/Line standard[7] for Class 4 track construction specified timber sleepers with non-resilient fasteners, sleeper plates, 47 kg/m rail (80 lb/yd[8] for existing track) in maximum lengths of 82 m mechanically jointed. The load limit for the Shepparton to Tocumwal line was 19 t axle load at a maximum speed of 65 km/h. Higher axle loads were allowed for approved locomotives.

At the derailment location, the track (considered ‘existing track’) consisted of 80 lb/yd rail that had been welded to form approximately 27.5 m lengths that were mechanically joined by fishplates. Rail was secured to timber sleepers using base plates and dog spikes. The sleeper spacing from centre to centre was 600 mm at the location of the fracture. The rolling marks indicated that the rail through the area was manufactured in Lorain, USA in the period 1911-1913. The rolling marks on the fishplates indicated that they had been manufactured by BHP in Australia in 1958. The topography of the incident area was flat, with sand and gravel soil with good drainage. The 27.5 m section of rail at the derailment location had been fabricated by flash butt welding two 7.7 m lengths to either end of a 12.1 m length of rail.

The flash butt welding process consists of heating the rail ends by means of an electric arc struck between the ends, and when in a plastic state forcing the rail ends together to effect the weld. Flash butt welding was usually undertaken in a factory facility. The date these welds were made is unknown, but was probably within the first half of the twentieth century.

Rail traffic

From January to May 2016, the freight rail traffic in the Up direction averaged 1.2 trains per day and the average tonnage was about 2000 t, mostly loaded. Under loaded conditions, the maximum wagon axle load is about 19 t. In the same period, the rail traffic in the Down direction also averaged 1.2 trains per day and the average tonnage was about 700 t, mostly unloaded.

Metallurgical examination of rail

Rail Chemistry

The steel rail had a carbon content varying between 0.50 and 0.75 per cent. The steel also contained small percentages of manganese, silicon, phosphorus and sulphur.

The rail head hardness was typical of rail material utilised in Australia before 1985 and was appropriate for the application.

Weld fracture

The rail head at the fractured weld had been battered on both sides of the break. Both ends were battered to a depth of about 10 mm. Mechanical damage to this depth indicated the passage of bi-directional rail traffic over the broken joint after fracture. There was also significant mechanical damage to the fracture surfaces and corrosion. At the intersection of the web and the foot, the fracture surface exhibited a region of predominantly intergranular fracture where significant grain boundary oxidation was observed (Figure 6).

Figure 6: Fractured weld ends, the Up-side rail is on the left and the Down-side rail on the right. The area of intergranular fracture is identified.

Source: ALS Global annotated by Chief Investigator, Transport Safety (Victoria)

The damage to the fracture surfaces had destroyed a significant amount of the fracture detail. The undamaged fracture surfaces of the rail head and web exhibited a coarse dimpled appearance consistent with instantaneous overload fracture. These features were indicative of ductile-fast fracture.

The fractured rail was longitudinally sectioned and evaluated by macro etching. The macro etching confirmed that the rail had been flash butt welded at the failed point. The macro etching revealed that the parent material was homogenous with no significant segregation of non-metallic inclusions.

In addition to the parent material, the evaluation revealed three distinct areas; a weld fusion line, a weld flash Heat Affected Zone (HAZ) and a HAZ produced during pre-heating prior to welding (Figure 7). The two Heat Affected Zones are consistent with in-plant flash butt welding processes. The fusion line hardness of the subject rail was consistent with the parent-rail material hardness. The peak HAZ hardness was 264HV (Vickers), 2.5 mm from the break and is not excessive for the application.

Figure 7: Macro etched longitudinal section of rail on the left showing that the fracture had occurred predominantly in the HAZ adjacent to the weld fusion line. The rail prior to sectioning is shown on the right.

Source: ALS Global annotated by Chief Investigator, Transport Safety (Victoria)

Laying rail and managing stress

Mechanical joints

In jointed track, the mechanical joints have an expansion gap (Figure 8) that results in stress free rail within a defined temperature range. This longitudinal rail movement at the joint reduces the probability of rail fractures in cold temperatures due to rail contraction. Correct joint set-up and ongoing maintenance is required to ensure joints perform this function.

A mechanical joint adjacent to the fractured weld on the east rail was visually and mechanically examined (Figure 8). Based on bolt torques and wear on the fishing surfaces, the examination concluded that the rail had been expanding and contracting at the mechanical joint.

Figure 8: Mechanical joint adjacent to fractured weld on the East rail

Source: Chief Investigator, Transport Safety (Victoria)

A mechanical joint on the west rail opposite the joint on the east rail was also examined. Again, the abrasive wear on the fishing surfaces was consistent with the expansion and contraction of the rail at the mechanical joint.

V/Line construction standards[9] specified the method of laying rail to achieve design levels of maximum tensile and compressive stress. For jointed rail of 27 m length, the standard specified that the gap between rail ends should be 11 mm (the nominal maximum gap) for rails laid at a rail temperature between -2 °C to 7 °C, and fully closed (rail ends butted together) when laid at rail temperatures of 35 °C to 38 °C. The standard also specified other gap requirements for installation temperatures between 7 °C and 35 °C. If laid in this manner, at temperatures below the lower range (-2 °C to 7 °C) the rails would be in tension, and at temperatures above the upper range (35 °C to 38 °C) the rails would be in compression.

Gaps at seven pairs of mechanical joints on the Up side (towards the crossing) of the fractured weld were measured following the derailment, at an ambient temperature of about 15 °C. Gaps on the Up leg averaged 12 mm[10] and the gaps on the down leg averaged 10 mm. There was no indication that these joints had been recently lubricated, however there were signs that the joints were working.[11]

Creep measurements 

Creep is the longitudinal movement of rail caused by the motion of rail traffic on the line. Creep typically takes place on grades, where trains brake and in the direction of predominant or loaded traffic. Rail creep can affect the stress condition of the rails. Creep monitoring points (monuments) are located alongside the track (one kilometre apart) and regular measurements are taken to ensure that the longitudinal movement of the rail is within acceptable limits.

Creep measurements recorded at the 228 km point between 2009 and April 2016 indicated a slow movement of the rails in the Up direction (towards Melbourne). The location of the weld fracture (227.8 km) was between the Spences Road level crossing and 228 km. The creep measurements indicated movement towards the fixed point of the crossing.

Track inspection

V/Line’s track inspection and maintenance procedure required track patrol inspections, general inspections and detailed inspections to be carried out at specified frequencies. For the Shepparton to Tocumwal line, track patrol inspections were required to be performed by road-rail vehicle or front of train riding once a week. General inspections by track walking and detailed inspections by a track geometry recording vehicle were to be carried out annually. Ultrasonic testing using a rail flaw detection (RFD) vehicle was to be conducted every two years.

The maintenance procedures provided specific guidelines for the assessment of non-welded joints (mechanical) and welded joints. Cracks in fishplates, loose or damaged bolts, rail-end batter and joint gaps are identified as areas for assessment in mechanical joints. For general inspection of rails and welded joints, corrosion, gauge corner or other cracking, piped rail, corrugations, shelling, rust streaks, and damaged rail were specified areas of assessment.

The most recent track patrol inspection before the incident was completed on 24 May 2016. This inspection, conducted from the front of a train, did not identify any defects at the derailment location.

A ‘Work Order’ for the most recent track walking inspection before the derailment for this section (182 to 253 rail km) records that it was completed on 30 October 2015 with no noted defects at the derailment location.

Measurement of the track geometry was carried out in March 2016 and no abnormal readings were recorded in the vicinity of the broken rail weld (227.8 km).

Rail flaw detection

The annual ultrasonic testing for internal rail defects involved operating an RFD vehicle. When a defect was detected by the RFD car, the location was noted and a manual inspection using hand-held ultrasound equipment was carried out. The defect was then categorised according the class of rail line, type and size of defect.

The last RFD inspection on the Shepparton to Tocumwal section of track was carried out about 12 months before the derailment on 5 May 2015 and no defects were observed at the location of the weld fracture. Following the derailment, recordings of the ultrasonic response at the fracture location were reviewed and there were no identifiable indications of microscopic material defects at the fracture location.

Detailed track condition inspection

A detailed asset inspection was conducted in 2014. The inspection identified 13 ineffective sleepers from 227.700 and 228.000 km, including three nominally within 50 m of the fractured weld. The Work Orders to replace the sleepers were subsequently cancelled, and V/Line advised that the sleeper replacement did not occur.

Train and crew information

Pacific National freight train 9305 consisted of two locomotives XR553 and XR554 hauling 37 flatbed wagons carrying empty containers. The containers were interspersed evenly on the wagons along the train. The trailing load of the consist had a total mass of 971 t, and the total mass including locomotives was 1215 t. The total length of the train was 768 m.

Train 9305 was crewed by two drivers who were appropriately qualified and certified for the route. The drivers were tested for the presence of alcohol after the derailment and returned zero results.

Post-incident rolling stock inspection

Inspection of the leading bogie of the first wagon that derailed identified the presence of wear in the friction wedge pockets. This wear was within condemning limits[12] and there were no signs that the bogie had been hunting. Wheel tread damage was the result of the derailment. The condition of the rolling stock did not contribute to the derailment.

-------

[6]  Categorised as a Major Freight Line.

[7]  Use and Laying of Rail, Document No: NIST 2650.

[8]  About 40 kg/m.

[9]  Use and Laying of Rail – NIST 2650, p.13.

[10]  While the nominal maximum (nominal) joint gap is 11 mm, greater gaps can exist in practice due to variations in bolt diameter and wear or elongation of rail holes. It is not uncommon to find joints that can extend to a gap of 15 mm.

[11]  Expansion and contraction of the rail at the mechanical joint.

[12]  A permissible limit determined by the use of a specific gauge.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• V/Line Pty Ltd
• ALS Industrial Pty Ltd
• Asciano Limited
• Speno Rail Maintenance Australia Pty Ltd

References

Use and Laying of Rail – NIST 2650 – V/Line Procedural document.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from V/Line Pty Ltd and The Office of the National Rail Safety Regulator (ONRSR). The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Safety analysis

Derailment

The derailment occurred as a result of a fracture at a flash butt welded rail joint. The condition of the fracture surfaces indicated that the fracture had occurred prior to the passage of train 9305. Battering of the fractured rail indicated bi-directional traffic across the fracture, and corrosion and fracture surface damage suggested the fracture had been present for several days.

The battering of rail head ends indicated that vertical displacement of the rail had been possible in the period following the fracture. In addition, dog spikes on the Up-side of the fracture had been lifted and were loose suggesting that the passage of trains had resulted in the deterioration of rail fixings around the fracture. This deterioration was sufficient to allow the development of a lateral discontinuity at the fracture during the passage of train 9305 resulting in the derailment of the train.

Weld fracture mechanism

The fracture occurred predominantly in the Heat Affected Zone adjacent to the weld fusion line and fracture surfaces were consistent with instantaneous overload fracture.  

Pre-existing defect

Metallographic examination of the fracture exhibited a mixed mode (transgranular and intergranular) cracking mechanism. The fracture surface at the foot-web intersection of the fractured weld exhibited a predominantly intergranular brittle fracture mode (Figures 6 and 9).

Figure 9: Photomicrograph of the etched microstructure of the rail fracture surface. The foot-web intersection of fractured weld exhibited an intergranular fracture mode.

Source: ALS Global annotated by Chief Investigator, Transport Safety (Victoria)

Intergranular brittle fracture occurs by separation at or adjacent to the grain boundaries (where significant oxidation was observed). This type of fracture is indicative of improper material processing during flash butt welding.

History of weld failures

V/Line advised that there were about 330,000 flash butt welds and about 180,000 thermit welds[13] on their operating network. From 2005 to 2015, there were 59 flash butt weld failures, 27 thermit weld failures and a range of other fractures (Figure 10). The flash butt failures represented 15 per cent of the total annual rail failures and the failure rate is similar to other welded connections on the network.

Figure 10: Rail failures from 2005 to 2015.

Source: V/Line Pty Ltd, annotated by Chief Investigator, Transport Safety (Victoria)

Loading of rail

Rail tension

There was no evidence to suggest that rail creep or frozen joints had resulted in higher than normal rail tension. The rail joints between the fracture and level crossing were ‘working’ and so provided for rail expansion and contraction. In addition, the recorded rail creep was southwards towards the crossing making high rail tension in cold weather less likely.

Temperatures recorded at Tocumwal (24 km from Katunga) indicated low overnight temperatures during the last week of May, with a minimum of 3 °C. Considering the measured joint gaps between the fracture and the crossing, these low overnight temperatures probably resulted in some tension in the Up (east) rail. However, this tension is unlikely to have been excessive and would have been within the normally expected range. It was therefore concluded that excessive rail tension was not likely to have contributed to the fracture.

Bending stress

In the absence of excessive rail tension, higher than normal bending stress within the rail most likely led to the fracture. The failure mechanism by instantaneous overload, as confirmed by metallurgical examination, is consistent with this loading scenario.

Bending stresses are developed in a rail during the passage of a train and increase when the support provided to the rail is inadequate or uneven. Site observations identified that support of the rail was probably compromised by the deteriorated condition of sleepers.

Following a period of dry weather, the month of May received more than double its normal rainfall and this may have had some influence on the condition of the support.

Asset condition

Inspections

A walking inspection seven months prior to the derailment and weekly track patrols were scheduled in accordance with network procedural requirements and there was no specific deficiency in the application of the inspection regime identified.

However, in this instance these inspections did not identify a deterioration in track support at the derailment location. The absence of any rail top defects or other track geometry anomalies through this location may have reinforced a belief that sleepers were providing adequate support.

Deferment of sleeper replacement

Asset assessments in 2014 had identified several ineffective sleepers through this location and work orders were raised for sleeper replacement. V/Line advised that these work orders were subsequently cancelled. It was not possible to identify whether those sleepers identified for replacement directly influenced the rail fracture leading to this derailment. However, the action to defer sleeper replacement probably increased the risk of rail fracture through the location.

The documentation clarifying the rationale for cancelling the replacement of sleepers could not be identified by V/Line. Several factors might influence decisions to cancel work orders including judgements as to the serviceability of the track, risks associated with the type and volume of traffic, funding and resource allocation. In this instance, the rationale for the deferment of the work program could not be ascertained due to the lack of documentation. Assessing the risk of deferring a work program and documenting the process is crucial to ensuring a verifiable and transparent decision making process.

The fracture

Pre-fracture weld defect

It is unlikely that the defects found within the weld would be detected by ultrasonic testing used in an automated RFD vehicle or currently available train borne monitoring equipment. The defects that were located on grain boundaries within the crystalline material structure were small and discontinuous and would produce specular multi-directional ultrasonic responses. These responses would produce a multi peak indication similar to lower level ‘noise’ signals and would be expected to be below the threshold that would cause a defect alarm. The microscopic defects observed would need to propagate by fatigue to produce a macroscopic planar defect before a detectable ultrasonic return signal could be produced. While some microscopic fatigue was observed, it had not progressed to macroscopic levels in this case.

Fracture detection

The condition of the fracture surfaces indicated that the fracture was probably present for at least two days prior to the derailment. Rail fractures cannot be completely eradicated and the network has about 30 fractures per annum. Therefore, there is a strong imperative to identify the presence of the fracture before the track deteriorates to a condition that could cause derailment.

The fracture was present during the passage of several trains. In the previous 48 hours, three Melbourne-bound and one Tocumwal-bound trains had traversed the location, one in daylight hours. There were about two trains per day preceding this. However, there were no rough riding or track irregularities reported by train drivers prior to the derailment even though other trains had travelled over the fracture. Given the section was jointed, it may have been difficult for train crew to detect the presence of the fracture.

A track patrol inspection was carried out by front of train riding on 24 May 2016, six days before the derailment. It is unknown whether the fracture was already present, although track patrol by hi-rail may have been a more effective means of detecting the fracture. If the fracture occurred after this patrol, there were no other means of identifying this fracture.

Once the rail had fractured, the configuration and condition of the track meant that dog spikes probably became dislodged relatively quickly reducing the opportunity for the fracture to be identified by track patrol prior to the loss of gauge. Risk mitigation measures used to identify fractured rail were not effective for the configuration and condition of this track.

------

[13]      Exothermic welding using molten metal to join rail ends. This method of connection is normally conducted on site and
 uses an Aluminothermic reaction to create the heat necessary to melt the joining metal.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

Rail fractures

Safety issue number: RO-2016-007-SI-01

Safety issue description: The inspection regime to identify rail fractures was ineffective for the condition of this track.

Safety recommendation description: The ATSB recommends that V/Line completes the risk review and implements safety actions to reduce the likelihood of derailment following a rail fracture.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

V/Line has advised that, since the derailment of freight train 9305, a joint servicing program has been completed, with all mechanical joints lubricated, bolts repaired, and fishing surfaces lubricated. V/Line has also redeveloped its ultrasonic inspection and assessment standard to include more specific instructions and requirements for ultrasonic testing, including a requirement to report non-sizable defects in more detail. Further, it has conducted ultrasonic inspections of an additional 100 flash butt welds and 50 thermit welds on the Tocumwal line. They reported that no defects were detected during these inspections.

The Occurrence

Train journey

At about 1915[1] on 29 May 2016, Pacific National freight train 9305 departed Tottenham Yard, Melbourne, bound for Tocumwal in New South Wales (Figure 1). The train was being operated on the V/Line broad gauge network by a crew of two and consisted of two locomotives hauling 37 flatbed wagons carrying empty containers.

Figure 1: Route of freight train 9305

Source:  Copyright Map Data Google 2016 with annotations by Chief Investigator, Transport Safety (Victoria)

The train proceeded to Craigieburn and then onto Seymour. From Seymour all trains are required to work to safeworking by train order.[2] A train order was issued at about 2215 to travel from Seymour to Shepparton and the train arrived at Shepparton without incident. A second train order was issued at about 2335 at Shepparton for the journey to Tocumwal.

At about 0025 when travelling through Katunga at about 61 km/h, the train crew felt a ‘bump’ and rough riding near the 228 km rail post. Shortly after there was a loss of brake pipe pressure resulting in a brake application. In response to this, the driver released the locomotive independent brake[3] and continued powering to maintain the train couplings in a draft condition.[4] The train then came to a stand with the lead locomotive about 295 m past the 228 km post.

Once the train had stopped, a crew member investigated the cause of the brake application. On observing the derailed wagons, the crew advised Centrol[5] and secured the train. There were no injuries to the public or the train crew.

The derailment and damage

The train had derailed at a fractured flash butt welded rail joint in the east rail at about the 227.8 km mark (Figure 2).

Figure 2: Fractured rail

Source:  Chief investigator, Transport Safety (Victoria)

The passage of train 9305 over the fractured rail had disturbed the joint sufficiently to laterally misalign the rail ends, such that a wheel flange impacted with the rail head on the Down-end. This resulted in further disarrangement of the rail and a loss of guidance for the following wagons. It is probable that the trailing axle of the leading bogie of wagon six was the first to derail.

Of the twelve wagons that derailed, wagon six, seven and eight stayed upright and generally followed the track alignment, while the rear bogie of wagon nine veered to the east of the track. The tenth wagon and the following eight wagons veered to the east of the line causing a separation between the ninth and tenth wagons. The separation caused the loss of brake pipe pressure and the subsequent application of the train brakes. The locomotive and the first nine wagons travelled about 137 m from the separated section of the train (Figure 3).

Figure 3: Separated section of train and track damage, looking towards Tocumwal

Source:  Chief investigator, Transport Safety (Victoria)

Wagons 10 to 17 ended in various states of disarrangement (Figure 4). The leading end of wagon 18 had lifted off the bogie centre bowl while the last nineteen wagons remained on the track. The derailment resulted in about 350 m of track damage.

Figure 4: Disarranged wagons separated bogies and damaged track

Source:  Chief investigator, Transport Safety (Victoria)

 ----

[1]  The 24-hour clock is used in this report and is referenced from Eastern Standard Time (EST), UTC +10 hours.

[2]  Railway safeworking by train order involves the use of a paper instrument issued by a train controller authorising the driver to proceed into and through the nominated single-line section.

[3] An air brake system that operates on the locomotive independent of the train air brake system.

[4] A condition that maintains the coupler forces throughout the train in tension.

[5]  Central Control - The operational control centre for Victoria's regional rail network.

Findings

The following findings are made with respect to the derailment of freight train 9305 at Katunga, Victoria on 30 May 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• There were microscopic defects within the weld zone that were probably the result of improper material processing during the flash butt welding of the joint.
• The loading of the rail at the weld was probably higher than normal due to inadequate support of the rail, and this inadequate support was not identified.
• The rail fracture was not detected before the passage of train 9305.
• The inspection regime to identify rail fractures was ineffective for the condition of this track. [Safety Issue]
• During the passage of train 9305, the rail ends at the already fractured weld laterally misaligned resulting in the derailment of the train.

Other factors that increase risk

Remediation works to replace deteriorated sleepers was deferred by V/Line. 

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 5 June 2016, the pilot of a Cessna 206 floatplane, registered VH-NTK, was taking off from the Southport Broadwater about 6 km south-east (SE) of Southport Airport, Queensland, for a charter flight with two passengers on board.

The wind was blowing from the west-north-west (WNW) at about 18 kt, with gusts of variable speed. The take-off direction to the north-west (NW) was too restrictive due to the presence of boats in the area, so the pilot elected to begin the take-off towards the south-west (SW) (Figure 1). Taking off to the SW would be through a jet-ski course and a crosswind from the right. Once clear of the jet-ski course, the pilot intended to veer right onto a more westerly (into wind) heading to complete the take-off.

The pilot set 20° flap and left the water rudders^[1] in the down position to assist with directional control at the start of the take-off run. The pilot applied full power to start the take-off run and the aircraft pitched^[2] backwards into the plowing position.^[3] The pilot retracted the water rudders about five seconds into the take-off run, and about two seconds later, pitched the aircraft forward from the plowing position into the step position.^[4] As the aircraft pitched forward onto the step it veered to the left onto a south-south-west (SSW) heading (this increased the crosswind experienced – see textbox 4 in Figure 1). The pilot maintained the aircraft on this heading until they sighted barrels in the water that were used to mark the jet-ski course.

The pilot could not prevent the veer to the left, even with full right rudder, so after sighting the jet-ski course barrels, the pilot pitched the aircraft backwards into the plowing position to improve directional control on the water.^[5] The pilot then alternated pitching the aircraft between the plow and step position in order to gradually veer to the right onto a more westerly heading (textbox 5 in Figure 1).

As the aircraft was passing a SW heading and was turning towards WSW, the right wing lifted and the aircraft rolled^[6] to the left. The roll continued, despite the application of full right aileron by the pilot, until the left wing impacted the water. The aircraft rotated to the left through about 270° and the nose and propeller ploughed into the water. The aircraft then came to a stop in an upright position, facing in a westerly direction (Figure 1).

The pilot assessed the condition of the aircraft and elected not to evacuate the passengers. The aircraft was then towed to shore by a jet-ski. There were no injuries and the aircraft was substantially damaged (Figure 2 and 3).

Figure 1: Approximate take-off path and key events

Source: Google earth modified by ATSB

Figure 2: VH-NTK left wing damage

Source: Owner

Figure 3: VH-NTK rear strut fracture (view of the left float facing forwards)

Source: Owner

Pilot comments

The pilot provided the following comments:

• the force that veered the aircraft to the left occurred when they pitched the aircraft forward from the plow position to the step position
• they were turning the aircraft right through SW towards WSW when it rolled
• they were holding full into wind (right) aileron control and therefore expected the left wing to lift prior to the right wing
• when they rolled to the left they were ‘shocked’ by the crosswind and ‘surprised’ they could not control the floatplane
• they estimated the strength of the gust that lifted the right wing was about 8–10 kt
• they had about 110 litres of fuel in the left wing tank and about 60 litres in the right wing tank, which may have contributed to the left roll
• the floatplane rolled left at about 30–35 kt airspeed
• the crosswind limit is 20 kt
• the take-off speed is 41 kt with 20° flap set.

Left turn effect

There are four distinct propeller forces, each of which produce a left turning force on an aeroplane, as follows:

• Torque effect: As the engine internal parts and propeller rotate clockwise, as viewed by the pilot, an equal force tries to rotate the aircraft in the opposite direction. This force places more weight and consequently more hydrodynamic drag on the left float of a floatplane.
• Slipstream effect: The clockwise spiralling motion of the propeller slipstream means that the slipstream strikes the left side of the vertical fin. This produces a yawing^[7] moment to the left.
• P-factor: In a nose high attitude the ‘bite of air’ of the downward moving blade of the propeller is greater than the ‘bite’ of the upward moving blade, which moves the centre of thrust to the right side of the propeller disc. This also produces a yawing moment to the left.
• Gyroscopic effect: The rotating propeller behaves like a gyroscope. As such, any time a force is applied to deflect the propeller from its plane of rotation, the resultant force is 90° ahead in the direction of rotation, and in the direction of the effective force (Figure 4). As such, the gyroscopic effect results in a yawing motion to the left when the aircraft is pitched forward from the plow position to the step position.

Figure 4: Gyroscopic effect

Source: FAA pilot’s handbook of aeronautical knowledge

Additional information is available from the United States Federal Aviation Administration (FAA) Pilot’s handbook of aeronautical knowledge, chapter 5: Aerodynamics of flight.

Crosswind take-off

According to the FAA Seaplane operations handbook, crosswinds can present special difficulties for floatplane pilots. If the aircraft turns towards the wind during a crosswind take-off, then centrifugal force will combine with the wind force to produce a rolling moment in the opposite direction to the turn (Figure 5). If strong enough, the combination of wind and centrifugal force may lift the upwind wing and submerge the downwind float, rolling the aircraft until the downwind wingtip strikes the water. This is known as a water‑loop (Figure 6).

Centre of gravity^[8] location also affects the floatplane’s handling characteristics on the water. If the centre of gravity is located to one side of the centre-line, such as a fuel imbalance between the tanks, one float must support more weight and therefore displace more water than the other float, resulting in more water drag on that side (Figure 7).

Figure 5: Effect of wind force and centrifugal force

Source: FAA seaplane operations handbook

Figure 6: Water-loop

Source: FAA seaplane operations handbook

Figure 7: Effect of fuel imbalance on centre of gravity

Source: FAA seaplane operations handbook

ATSB comment

The pilot reported that it was the force from the forward pitching motion of the aircraft from the nose-high plowing position to a nose-level step position that resulted in the aircraft veering left from the planned take-off path. The force that produces this motion is the gyroscopic effect. At the time of the uncommanded roll to the left the aircraft was turning right with a strong crosswind from the right and more fuel distributed in the left tank than in the right tank. These factors probably combined to elevate the risk of submerging the downwind float and lifting the upwind wing, resulting in a water-loop.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Changes to operating procedures

The operator is updating their operations manual to incorporate the following procedural changes:

• The channel at the operating base is orientated north-south, which restricts movements orientated east-west, therefore if the wind is forecast to gust more than 20 kt from the west, or within 30° either side of west, the take-off must be rejected.
• If the aircraft veers to the left during the take-off run and requires full control inputs, then reject the take-off.

Safety message

This accident highlights the risk of a water-loop event during a crosswind take-off in a floatplane. The combined forces acting on a floatplane have the potential to significantly reduce the margin of control available to the pilot. The FAA Seaplane operations handbook provides several recommended crosswind take-off techniques, including the considerations associated with arcing manoeuvres during take-off. If an arcing manoeuvre is to be attempted then the FAA handbook recommends placing the centrifugal force and wind force on opposite sides, and reducing the radius of the arc as the floatplane speed increases.

Refer to the FAA Seaplane operations handbook for a detailed explanation of the recommended crosswind take-off techniques.

Aviation Short Investigations Bulletin - Issue 50

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Retractable control surfaces on the back of each float that can be extended downward into the water to provide more directional control when taxiing. They are attached by cables and springs to the air rudder and operated by the rudder pedals in the cockpit.
2. The term used to describe the motion of an aircraft about its lateral (wingtip-to-wingtip) axis.
3. A nose high, powered taxi characterised by high water drag and an aftward shift of the centre of buoyancy. The weight of the floatplane is supported primarily by buoyancy, and partially by hydrodynamic lift.
4. The attitude of the floatplane when the entire weight of the aircraft is supported by hydrodynamic and aerodynamic lift, as it is during high-speed taxi or just prior to take-off. This position, which is also referred to as the planing position, produces the least amount of water drag.
5. When on the step position the keel of the floats tend to resist turning motion.
6. Term used to describe movement of an aircraft about its longitudinal axis.
7. Term used to describe the motion of an aircraft about its vertical or normal axis.
8. Point through which resultant force of gravity acts, irrespective of orientation; in uniform gravitational field, centre of mass.

 

What happened

At 0856 Central Standard Time (CST) on 25 May 2016, a Piper PA-32, registered VH-NKA (NKA), departed Darwin Airport, Northern Territory (NT) for a business flight to Oenpelli Airport, NT. On board were a pilot under supervision, a supervising pilot and two passengers. The pilot under supervision was the pilot flying (PF), with the supervising pilot acting as pilot monitoring (PM),^[1] observing the flight and providing assistance.

At 0926, a Cessna 210, VH-SQT (SQT), departed Jabiru Airport, NT, for a scenic flight over Kakadu National Park and the East Alligator River, NT. On board were the pilot and five passengers. SQT initially proceeded in an easterly direction before progressing north along the river (Figure 1).

At about 0930, the PF in NKA assessed the expected weather conditions at Oenpelli and elected to make a straight-in^[2] approach to runway 12. At this time, the PF made an inbound broadcast on the Jabiru-Oenpelli common traffic advisory frequency (CTAF), advising their position as 50 NM west of Oenpelli. The PF then descended the aircraft from the cruising altitude of 9,500 ft and made a further broadcast on the Jabiru-Oenpelli CTAF as the aircraft reached 15 NM from Oenpelli. The pilots of NKA received no response to these broadcasts.

Figure 1: Overview of incident location

Source: Google Earth, annotated by ATSB

As SQT reached Cahill’s Crossing, 7 NM south of Oenpelli Airport, the pilot broadcast on Jabiru-Oenpelli CTAF, advising that they would be tracking north via the East Alligator River towards Flying Fox Island and operating not above 800 ft. The pilot did not receive a response to this broadcast.

At 0952, the PF in NKA established the aircraft on a 5 NM final approach leg to the runway at Oenpelli Airport at an altitude of 1,000 ft and configured the aircraft for landing. At the same time, the pilot of SQT continued to follow the East Alligator River north making continuous shallow turns left and right to maximise their passenger’s view. As SQT began a right turn, the pilot observed the shadow of another aircraft (subsequently determined to be NKA) tracking towards the shadow of their own aircraft. The pilot of SQT continued the right turn and assessed the position of the sun in relation to the shadow on the ground to establish the position of NKA. The pilot of SQT sighted NKA in close proximity and instinctively descended the aircraft to avoid a collision.

At this time, the PM in NKA, observing the high workload of the PF, elected to broadcast advising they were 4 NM from Oenpelli conducting a straight-in approach for runway 12.

At about the same time, the pilot of SQT broadcast on the CTAF to establish contact with NKA and advise of the near collision. The pilots of each aircraft communicated without difficulty following the incident.

The pilot of SQT estimated that the aircraft passed at the same altitude and a distance less than 100 m at the closest point. The pilots of NKA did not see SQT.

The pilots and passengers of both aircraft were not injured in the incident and the aircraft were not damaged.

Pilot Comment

The pilot of VH-NKA:

The supervising pilot of NKA provided the following comments:

• No radio calls were heard from the pilot in SQT prior to the incident, despite having experienced no communication difficulties prior to, or after the incident.
• Their view of SQT would have been obscured by the aircraft’s right wing as SQT approached their aircraft.
• The change to the Jabiru-Oenpelli CTAF was made slightly later than the usual distance of about 70 NM from Oenpelli Airport. This may have led to the pilots missing the departure call from the pilot in SQT.
• The pilot in command expressed concern at the planning of a low-level scenic flight through the extended centreline^[3] of an aerodrome at a distance of 3 NM.

The pilot of VH-SQT:

The pilot of SQT provided the following comments:

• No radio calls were heard from the pilots in NKA prior to the incident despite hearing calls from other aircraft. The radio in use was tested immediately afterward and found serviceable.
• The incident occurred at the point they would normally make a radio call for transiting abeam Oenpelli Airport. The pilot spotted the shadow of NKA just as they were about to make the call.
• The avoiding action required was forceful, inducing slight negative ‘G’.^[4] Had the pilot taken no avoiding action the two aircraft would have collided.
• The pilot did not expect an aircraft on approach to Oenpelli airport at a distance of 4 NM from the runway to be as low as 800 ft.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator of VH-SQT

As a result of this occurrence, the operator of SQT has advised the ATSB that they have taken the following action:

Communications procedure

The communication procedures for scenic flights using this route have been changed. They will now include a broadcast when the aircraft are 3 NM from Oenpelli Airport, stating that the aircraft will be passing through the extended centreline of runway 12, operating at not above 800 ft.

Safety message

This occurrence highlights the importance of effective communications. Where this effectiveness is compromised, pilot lookout becomes increasingly important. The ATSB publication Limitations of the See-and-Avoid Principle provides information on developing effective lookout techniques.

The Civil Aviation Safety Authority (CASA) publication CAAP 166-2(1) Pilots’ responsibility for collision avoidance using ‘see-and-avoid’ provides information which can increase the probability of sighting traffic.

Fly neighbourly advice

ERSA - GEN - SP contains a fly neighbourly advice for pilots operating in the Kakdau National Park. Pilots intending to fly over Kakadu National Park should obtain, read and comply with the Kakadu Fly Neighbourly Agreement.

Aviation Short Investigations Bulletin - Issue 51

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Pilot Flying (PF) and Pilot Monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and aircraft flight path.
2. An approach directly to the runway from the present position of the aircraft without joining the standard approach circuit or overflying the aerodrome.
3. A theoretical line drawn out from and in line with the runway. The aircraft is required to be aligned along this extended centreline at a point no less than 3 nm from the runway threshold during a straight-in approach.
4. The unit of measurement for measuring vertical acceleration within an aircraft. 1 G is equal to the force of gravity at the earth’s surface. In flight, g load values represent the combined effects of flight manoeuvring loads and turbulence. This can be a positive or negative value.

What happened

On 20 May 2016, the pilot of an Airbus Helicopters EC 130 T2 helicopter, registered VH-ZVO (ZVO), was conducting a ferry flight from Port Kembla to Bankstown Airport, New South Wales, with an engineer, who was also a crewmember, on board. At about 1437 Eastern Standard Time (EST), the pilot of ZVO contacted Bankstown Tower air traffic control (ATC), advising they were at 2RN approach point at 1,000 ft and inbound to Bankstown (Figure 1). The aerodrome controller (ADC) cleared ZVO to track to Bankstown via the Choppers South approach point at 500 ft.

Figure 1: Bankstown Airport and Choppers South

Source: Airservices Australia, annotated by the ATSB

At the same time, an instructor and student of a Piper PA-28-181 aeroplane, registered VH-MJT (MJT), were conducting circuit training on runway 29 left (29 L) at Bankstown Airport. At about 1438, the instructor advised the ADC that they were on the downwind circuit leg for a glide approach,^[1] and a touch-and-go landing. The ADC cleared MJT for the touch-and-go landing in response. Soon after, the instructor set the throttle to idle to simulate an engine failure, and the student commenced a glide approach.

At about 1439, the pilot of ZVO called at Choppers South at 500 ft and the ADC cleared ZVO to overfly the runways midfield (which included crossing all three runways – 29 left, centre and right), at 500 ft and then to join the circuit on the downwind leg for a landing at taxiway N1 (Figure 2). The ADC also advised the pilot of ZVO of traffic, which was another helicopter then overhead the runways and outbound via Choppers South. The pilot of ZVO saw, and reported sighting, that helicopter.

The ADC reported that they then observed MJT on final approach, about 100 m short of the runway threshold, and assessed that they were on a normal approach path. The ADC also observed ZVO pass the outbound helicopter and then, concerned about the outbound helicopter’s proximity to restricted airspace (R555), had a brief look at the tower situational awareness display (TSAD) to check their track.

The instructor of MJT reported that as the aeroplane approached the runway threshold on final approach, it was still at about 400–500 ft above the runway, which they assessed as too high to safely complete the landing. The student therefore commenced a go-around^[2] procedure, applied full power, and moved to the left of the runway centreline. The radar data showed MJT descended to about 300 ft during final, and an off-duty controller who observed the incident, estimated MJT then continued to descend to between 100 and 200 ft on short final before conducting a go-around.

The controller looked up from the TSAD and sighted MJT in the go-around. The controller estimated that MJT was at about 250–350 ft above the runway and about 250–300 m beyond the runway threshold.

As ZVO crossed the airport boundary, the engineer sighted the aeroplane (MJT) and alerted the pilot. The pilot then saw MJT in the go-around, at the same height as ZVO, and immediately conducted a left turn to increase separation between the helicopter and the aeroplane. MJT was about midfield (half way along the runway) when the instructor sighted the helicopter (ZVO) taking avoiding action.

At about 1441, the controller advised the pilot of ZVO of MJT as relevant traffic, and watched as the helicopter turned through 360° and passed MJT.

At that time, the instructor of MJT reported that they broadcast, stating that they were going around. On the recorded audio from the ADC frequency, about 8 seconds after the ADC advised ZVO of MJT, the instructor of MJT can be heard to start to broadcast, but was then over-transmitted by another radio broadcast.

The instructor of MJT estimated that the helicopter was within about 30–50 m horizontally and at the same height as MJT. The pilot of ZVO estimated the aeroplane was about 200 m away, and the ADC estimated the proximity to be about 120 m.

ZVO then continued to land at N1 as cleared. MJT continued to conduct circuits.

Figure 2: Bankstown Airport showing indicative tracks

Source: Airservices Australia, annotated by the ATSB

Aerodrome control and radio frequencies

There were two tower frequencies and ADC positions at Bankstown, with ADC1 having responsibility for arrivals and departures on runways 29 right/11 left and 29/11 centre; ADC2 was responsible for the training circuit with runway 29 left/11 right. However, these were combined when the traffic volume allowed. When not combined, the two aerodrome controllers were required to coordinate with each other if helicopters were operating inbound or outbound via Choppers South and therefore crossing the circuit traffic midfield over the runways.

The two Tower frequencies at Bankstown were combined at the time of the incident, and one controller occupied the ADC position. When combined, pilots of aircraft operating on either the circuit Tower frequency or the other Tower frequency would have been able to hear transmissions on the other frequency. Although the pilots of ZVO and MJT had different radio frequencies selected, they were combined such that the transmissions on both frequencies could be heard on either.

Pilot comments

Instructor of VH-MJT

The instructor of MJT commented that they were not aware of ZVO before sighting it after the pilot of ZVO had taken avoiding action and the ADC had issued the traffic alert. Despite having heard a couple of radio calls regarding helicopters, they were not aware of ZVO tracking via Choppers South or that they would be crossing the runways at 500 ft.

There was a tailwind component, which may have contributed to the aircraft being high on final. The automatic terminal information service (ATIS) current at the time indicated an occasional downwind of 4 kt. The ATIS was changed about 10 minutes after the incident, and the runway direction changed to 11, with the wind reported to be from 150° at 8 kt.

The instructor stated that if an approach is unstable,^[3] conducting a go-around is standard procedure. The instructor also stated that it would be valuable for aircraft in the circuit to be advised by ATC if a helicopter is approaching from Choppers South and crossing midfield at 500 ft. Additionally, advising the helicopter pilot when there is an aircraft on final would be valuable information.

After the incident, the instructor spoke to the Tower controller by telephone, and reported that they were advised that to avoid a similar situation, pilots should broadcast that they are going around before commencing the go-around. The instructor commented that a pilot’s priority is to aviate first and control the aircraft, then to communicate later.

The instructor also commented that at a non-towered aerodrome, there would not be an aircraft passing across the midfield at 500 ft (without a broadcast). The procedure could be addressed such that either the helicopters do not pass directly through the circuit, or the aircraft on final approach and the helicopter pilot are both given traffic information regarding each other.

Pilot of VH-VZO

The pilot of VZO provided the following comments:

• They did not hear any call from the pilot of the aeroplane, nor was there any call from Tower that the aeroplane was conducting a go-around.
• Even if a pilot broadcasts conducting a go-around, sometimes the aircraft can be hard to see on finals. They did not see the aeroplane at first, but their passenger saw it going around. They do not expect to see another aircraft at the same height when crossing the runways at 500 ft.
• They were not aware of the other aircraft at all before they saw it – they had not heard a call and were not aware of any aircraft in the training circuit. They did not know to look there for other aircraft traffic.

Controller comments

The aerodrome controller reported that they were monitoring an outbound helicopter on the TSAD when MJT commenced the go-around. As soon as they sighted the potential conflict, VZO had commenced a left turn and the ADC gave MJT as traffic to VZO.

An off-duty controller, who was in the ATC tower at the time of the incident, commented that in Class D airspace, pilots have responsibility to see and avoid VFR aircraft and ATC has a responsibility to provide relevant traffic information to assist them to do that. In normal circumstances, an aircraft in the circuit and a helicopter tracking across the runway at 500 ft would not need to know where each other was as they are ‘segregated’. Additionally, providing traffic information that was not useful, may lead pilots to switch off to essential information. However, in the go-around procedure, they were relevant traffic and the controller would pass the traffic. Usually their response would be to pass traffic to the helicopter first as they were generally in a stage of flight with a lower workload and are more manoeuvrable than fixed wing aircraft.

En Route Supplement Australia

The ERSA entry for Bankstown included the following under the heading Class D:

‘CAUTION: HELICOPTERS OVERFLY RUNWAYS MIDFIELD AT 500FT.’

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Airservices Australia

As a result of Airservices internal investigation into the occurrence, a Standardisation Directive (SD) has been developed for publication on 28 June 2016. The SD aims to educate controllers on the key lessons learned from the occurrence.

Specifically, the SD Clarifies that

• an aircraft cleared to land is also cleared to conduct a go-around
• helicopter tracking which crosses an operational runway as described in ERSA must not be relied on to assure segregation of overflying helicopter traffic from the possible go-around or missed approach of aircraft using the runway
• where the possible go-around or missed approach path of a landing aircraft is in potential conflict with a helicopter overflying, controllers are required to provide traffic to both aircraft in anticipation of the possible go-around or missed approach rather than in response to the go-around or missed approach.

Operator of VH-MJT

As a result of this occurrence, the operator of MJT has advised the ATSB that they are taking the following safety actions:

Induction training amendment

Company induction training will be expanded to cover more details with regards to helicopter activities at each base.

Safety message

The possibility that an aircraft will go around from an approach should always be considered by ATC and pilots, with respect to the separation of air traffic.

The adage ‘aviate-navigate-communicate’ remains a fundamentally effective prioritisation guide for pilots. Nonetheless, under some circumstances, it may be prudent to broadcast intentions early, particularly when those intentions vary from an expected or anticipated course of action. This may be particularly important where the potential for a conflict with other traffic is elevated, such as in an area of high traffic density. Timely broadcasts provide greater opportunity for other pilots to focus their lookout, and for ATC to react to the changing circumstances.

The Civil Aviation Safety Authority booklet, Class D airspace, advises pilots that when operating in Class D airspace, they must sight and maintain separation from other aircraft. Pilots and ATC have a dual responsibility to maintain situational awareness of other traffic.

Aviation Short Investigations Bulletin - Issue 50

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Throttle set to idle to simulate an unpowered approach.
2. A flight path taken by an aircraft after an aborted approach to landing.
3. An unstabilised approach is an approach during which an aircraft does not maintain at least one of the following variables stable: speed, descent rate, vertical/lateral flight path and in landing configuration, or receive a landing clearance by a certain altitude.