On 10 April 2015, at about 1120 Central Standard Time (CST), the pilot of a Robinson R44 helicopter, registered VH‑LOL (LOL) was engaged in herbicide dispensing operations near Marion Bay on the Yorke Peninsula in South Australia.
Also on board were client representatives who were directing the noxious weed management operation and manually dispensing the chemical into each bush. In the course of traversing the field at low level in search of the weed, the helicopter struck a previously unidentified power line. The helicopter’s main rotor blade made initial contact with the power line and during the avoidance manoeuvre, the tail rotor blades also made contact, severing the blade tips (Figure 1). The pilot landed the helicopter safely. The helicopter was substantially damaged but the occupants were uninjured.
Figure 1: Tail rotor blade damage to VH-LOL
Source: Maintenance organisation
Power line identification
In preparation for the herbicide operations, the pilot conducted an aerial survey of the area. The aerial survey was a standard operating procedure to confirm the powerlines as previously advised by local sources. This survey identified main power lines running parallel to a boundary road and a secondary power line running parallel to the main lines (Figure 2). The secondary line effectively dissected the target area and operations were concentrated on sectors to the north and south of the secondary line. The location of the power lines were also mapped on the data logger that was being used to track the progress of the herbicide dispensing.
The unidentified powerline was a single wire that was strung between the poles supporting the main and secondary powerlines and traversed, unsupported, through the southern boundary of the operational area. It was not mentioned by the locals, nor marked on the data logger map. It was not readily discernible from the air although additional support poles did lead the wire away from the secondary power line towards a distant building.
Figure 2: Powerlines and boundary fencing
Source: Google Earth and modified by ATSB
Pilot comment
The pilot stated that the aerial survey of the powerlines confirmed the accuracy of the local knowledge and created a sense of confidence in him that all obstructions had been identified and accordingly mapped. In hindsight, a fully independent assessment by the pilot in command for the presence of powerlines in the target area may have located the single wire. The pilot had in excess of 14,000 hours operating at low level but not necessarily in powerline congested areas.
Risk management
The helicopter operator had documented a risk assessment of the planned operation, addressing aircraft operational considerations, environmental impacts, required personal protective equipment and herbicide management. The cabin occupants were also provided with a helicopter safety brief and formal induction prior to commencement of flight operations. Risk assessment outcomes and operational requirements were included in a specific job plan that was discussed in briefings with ground and flight crews at the beginning of the campaign. Briefings were also conducted with crews prior to the commencement of each day’s flying.
Wire awareness, detection and avoidance techniques were also documented in the company operations manual in various sections along with specific references to aerial agriculture publications where mitigation for such hazards are addressed.
ATSB comment
This accident provides a reminder to flight crews of the need for consistency in aerial surveys for powerlines, the establishment of standardised procedures for their identification and the need for independent assessment of their presence.
Single wires can be difficult to see and occur in the most unexpected places in rural areas. ATSB research article ‘Avoidable accidents No. 1 - Low level flying’ provides additional information on wire hazards associated with flight below 500’. The report is available at the ATSB website.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
The operator has reviewed the risk assessment and moved to standardise procedures and now place greater emphasis on employee inductions with a focus on hazards and published information relating to high-risk activities. Whilst the published information was generally available to company pilots, a greater focus on promulgating this information was recognised as beneficial. The use of non-permanent staff was to be reconsidered along with the dissemination and acknowledgement of receipt of safety critical information specific to the contracted flying program.
Operator client
Following a separate, internal investigation into the accident, the client updated its procurement processes. This update was to further ensure that contractor and project sponsor responsibilities were clearly defined in contracts and operational plans, with respect to:
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 11 November 2014, the pilot of a Cessna 210 aircraft, registered VH-MCE (MCE), conducted a charter flight from Numbulwar to Gove, Northern Territory with five passengers on board. During the cruise, about 60 NM from Gove, the ammeter gauge indicated a discharge. The pilot switched off all electrics and checked the circuit breakers, none of which had popped. About 5 minutes after completing the checks, the pilot selected the alternator master switch back to ON and the gauge indicated a positive charge.
About 10-15 NM from Gove, the ammeter again indicated a discharge. The pilot switched all electrics off including the aircraft avionics. When at about 4 NM from Gove and 1,500 ft, the pilot selected the landing gear lever to the extended position. He heard the landing gear motor activate, so assumed the gear had fully extended. As the pilot reduced the engine power, the engine ran roughly and backfired. The pilot observed the oil pressure gauge reading zero and the cylinder head temperature (CHT) decreasing. The pilot observed that the flaps had not extended, but due to the distraction of the engine malfunction, did not look outside to confirm visually whether the landing gear was extended. The pilot carried out the engine trouble checks, and as the engine problem ruled out the option to go around, committed to landing the aircraft.
The aircraft landed just beyond the threshold and on the centreline of runway 31 with the wheels retracted. When the pilot realised the wheels were retracted, he immediately selected the fuel to OFF. The aircraft sustained substantial damage and the pilot and passengers were uninjured.
A crimped electrical cable was found to have caused the alternator to stop charging the battery. The engine had not been inspected before the completion of the ATSB report and the cause of the engine issues were unknown.
On 12 April 2015, the pilot of a Cessna 404 aircraft, registered VH-JOR (JOR), conducted preflight preparations at Broome Airport, Western Australia. The planned task involved a positioning flight from Broome to Derby, before a charter flight with five passengers, from Derby to Pantijan aeroplane landing area (ALA), Western Australia. The distance from Derby to Pantijan was 117 NM, with an estimated flying time of 49 minutes. The pilot reviewed information about the Pantijan airstrip in company documentation and using Google earth (Figure 1). He also arranged for the condition of the runway to be assessed by a contact person at Pantijan and the pilot of a helicopter scheduled to arrive at Pantijan before JOR.
Figure 1: Pantijan ALA
Source: Google earth
Prior to departing Broome, the pilot received information regarding the serviceability of the airstrip at Pantijan, from the contact person at the airstrip. He was advised that the grass beside the landing area was long, with some termite mounds outside the wingspan of the aircraft. He was also advised that the threshold of runway 02 had grass cover and that midway along the strip the surface was soft. The pilot understood that the contact person had walked the strip to assess its condition, but that no vehicle had been available to drive across the landing surface. Due to rising terrain at the northern end of the airstrip, the pilot was advised to regard the strip as one-way and to land on runway 02, and depart from runway 20.
After arriving in Derby, the pilot weighed the passengers and baggage and loaded the aircraft for the flight to Pantijan. Baggage was loaded into the aircraft lockers and also stowed at the rear of the aircraft and secured with a cargo net. Some bags were placed on a rear seat and secured with seatbelts. After loading the baggage and passengers, the aircraft departed from Derby at 1346 Western Standard Time (WST).
When about 80 NM from Pantijan, the pilot of JOR heard the pilot of the helicopter, who he had spoken to prior to departure, broadcast that he was conducting an approach to the airstrip in the direction of runway 02. The pilot of JOR responded with his current position and did not receive any further communications from the pilot of the helicopter. As JOR approached Pantijan, the pilot observed fires in the area. The direction of the smoke indicated a tailwind of about 5 kt for a landing on runway 02.
At about 1430 WST, the aircraft arrived overhead Pantijan. The pilot slowed the aircraft, lowered the first stage of flap and descended to about 700 ft above ground level. He then conducted a circuit and a visual inspection of the entire length of the runway. The pilot observed that the runway was narrow and bordered by tall grass. The helicopter was parked adjacent to a shed about three quarters of the way along the runway and clear of the landing area. The sand on the airstrip appeared to be uniform in colour, with no obvious darker patches that may have indicated water. There was short grass at the threshold of runway 02 extending for about 200 m. A termite mound was located about half way along the runway and had been placed on its side and moved to the right of the runway centreline.
The pilot then conducted an approach to land on runway 02. The aircraft touched down at the pilot’s aiming point, about 50 m beyond the threshold, and the pilot applied moderate braking. The aircraft continued along the centre of the runway and, as it slowed through about 60 kt, the pilot applied left rudder to turn the aircraft slightly to the left and increase separation from the overturned termite mound. He felt the rudder pedals move to the full left position and the aircraft turned to the left. The pilot immediately applied right rudder in an attempt to counteract the turn, but the aircraft initially continued to veer left towards the edge of the runway.
The left main landing gear momentarily lifted off the ground and the aircraft tipped to the right. As the aircraft veered off the runway and entered longer grass, the pilot regained control of the aircraft and it started to turn right and return towards the runway. The nose wheel then collided with a runway marker and collapsed, resulting in the aircraft nose contacting the ground and the aircraft skidded to a stop (Figure 2). The pilot secured the aircraft and assisted the passengers to disembark. One passenger had a cut to the back of the head from a loose object and another sustained a bleeding nose. Three other passengers and the pilot were not injured, however the aircraft sustained substantial damage.
Figure 2: Accident site
Source: Aircraft operator (edited by the ATSB)
Pilot comments
Following the accident, the pilot found that where he had commenced the left turn on the runway, the ground was soft and appeared to have previously held standing water, although the surface was dry at the time. The runway marker was a 44-gallon drum, cut in half longitudinally and laid on the ground and it was obscured by long grass (Figure 3).
None of the baggage had come loose in the cabin; the only unsecured objects were phones, cameras and water bottles.
The pilot stated that when facing similar circumstances, he would select a landing path that did not require any planned directional changes during the landing roll, until the aircraft has decelerated to a safe taxi speed.
Figure 3: Drum runway marker
Source: Aircraft operator
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Company pilots operating beyond mobile phone coverage will be issued with a satellite phone. In this incident, access to a satellite phone may have enabled the aircraft pilot to communicate with the helicopter pilot on the ground and obtain further details regarding the condition of the airstrip.
The operators of remote airstrips will be reminded to follow the company’s runway inspection guide, which required a vehicle to assess the condition of the landing surface.
All company pilots will be reminded of the importance of maintaining directional control on unimproved (sand or gravel) airstrips.
Safety message
Airfields that are used infrequently or seasonally, potentially pose significant hazards to aviation. This incident highlights the importance of identification and management of any risks that might be associated with such an airfield. Potential hazards may be hard to identify, with objects possibly obscured by vegetation. Changes in the runway surface can be hard to detect visually and without a vehicle or some means to apply a similar force to that of a landing aircraft.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
During March 2015 three aircraft operating in Indonesia were involved in separate air safety occurrences:
Runway excursion – British Aerospace ATP-F, PK-DGI at Wamena airport, Papua, Indonesia on 31 March 2015
Runway excursion – Ayres S2R, PK-ELN at The Tajur Beras Airstrip, Kalimantan, Indonesia on 13 March 2015.
Hard Landing – Sikorsky S76C+, PK-FUP at Tanjung Dewa Island, East Kalimantan, Indonesia on 21 March 2015.
Investigations into the circumstances of these occurrences are being conducted by the National Transportation Safety Committee (NTSC) of Indonesia.
The NTSC requested assistance from the ATSB in the recovery of information from flight recorder equipment that was fitted to the aircraft. To facilitate this support and to provide the appropriate protections for the recorded information, the ATSB appointed an accredited representative in accordance with paragraph 5.23 of Annex 13 to the Convention on International Civil Aviation and commenced an investigation under the Australian Transport Safety Investigation Act 2003.
The ATSB successfully recovered data relating to the PK-DGI and PK-FUP occurrences and this information was provided to the NTSC in December 2015. Attempts to recover data from the AG‑NAV unit installed in PK-ELN were finalised in July 2016, however due to a damaged memory chip, no data for that occurrence was recovered.
The NTSC is responsible for releasing the final investigation report into these occurrences and can be contacted at:
National Transportation Safety Committee Ministry Of Transportation Republic Of Indonesia Transportation Building 3rd Floor Jalan Medan Merdeka Timur No. 5 Jakarta Pusat 10110 Indonesia
On 11 April 2015, the student pilot of a Piper PA-28 aircraft, registered VH-TXH (TXH), prepared to conduct a solo, local flight, from Moorabbin Airport, Victoria. The flight was to be the pilot’s second solo to the training area, where he was to practice simulated forced landings. The pilot inspected the aircraft, including checking the oil quantity and colour. He noted that the dipstick indicated 5.5 L of oil and the oil appeared to be of a golden colour. After completing the pre-flight checks, the pilot of TXH taxied the aircraft to the run-up bay and performed engine run-ups. He noted that all indications were normal and within the required performance limits.
At 11:29:06 Eastern Standard Time (EST), the pilot made a radio call to the Moorabbin surface movement controller (SMC) on the Ground frequency, advising that he was conducting a solo flight to the training area and requested a departure from runway 35 Right (35R). The SMC cleared TXH to taxi via taxiway A for a departure from runway 35R. TXH then taxied to the holding point for runway 35R, and, at 11:36:37, the pilot of TXH contacted the aerodrome controller – east (ADC1) on the Tower East frequency. He reported ready for take-off, and ADC1 cleared TXH for take-off.
At 11:37:08, the pilot of a Cessna 172 aircraft, registered VH-EUU (EUU), contacted the SMC and requested a clearance to taxi for a local private flight, with three passengers on board. The SMC cleared EUU to taxi to runway 35R via taxiway A, and the pilot commenced taxiing.
The pilot of TXH reported that the take-off run was normal, with the engine indications in the normal range. After rotation, when about 150 ft above ground level (AGL), the engine began to run roughly. The pilot lowered the aircraft nose slightly and within 2-3 seconds, the engine regained full power and the aircraft continued to climb. When approaching 500 ft AGL, the engine again ran roughly and partially lost power. The pilot suspected a fuel issue to be the cause of the rough running, and, as the fuel pump was still on, changed the selected fuel tank. The engine returned to producing full power and the pilot initiated a right climbing turn, leaving the fuel pump switched on. As the aircraft climbed, the engine lost power again.
At 11:37:58, the pilot advised ADC1 that he had a ‘spluttering engine’ and requested a return to land. ADC1 had observed TXH in the initial climb and noted that it did not appear to be climbing out normally and was then quite low, at an estimated 300 ft AGL. ADC1 initially responded that TXH was number one for runway 35R and then offered runways 22 or 31 if required. The pilot responded that he would use runway 22 (Figure 1).
ADC1 gave TXH priority to land over all other aircraft, advised the SMC of an aircraft with engine trouble, requested runway 22, and coordinated with the SMC for release of runway 22 (see section: Air traffic control). The SMC checked the crossing taxiways, helicopter traffic and for any works in progress that may have conflicted with the use of runway 22, then handed ADC1 the green runway strip for runway 22. ADC1 then placed the strip in the runway bay on the console. ADC1 also coordinated with the aerodrome controller – west (ADC2), who instructed a couple of aircraft in the circuit for runway 35 Left (35L) to go-around to ensure they remained clear of the crossing runway. ADC1 instructed the pilots of two aircraft that were in the circuit for runway 35R to go-around and another to conduct a full stop landing. The SMC reported then focusing on checking the runways and taxiways crossing runway 22. Taxiway A did not cross runway 22, and as the SMC remained seated, was unable to see EUU on taxiway A as it was obstructed by the tower console.
Figure 1: Moorabbin Airport, aircraft tracks and collision point
Source: Google earth annotated by the ATSB
At 11:39:06, ADC1 cleared TXH to land on runway 22. The pilot of TXH conducted a tight right turn towards runway 22 and as he was concerned about clearing the buildings on the approach to runway 22, he did not select any flap. After passing over the buildings, the pilot reduced the power to idle. He reported that the aircraft touched down about one third of the way along runway 22. ADC1 observed that TXH appeared to land about half way along the runway and did not decelerate normally after touching down. The SMC observed that TXH appeared very low on final approach to runway 22 and crossed the threshold travelling very fast. The ADC1 stated to the SMC and ADC2 controllers ‘he’s landed long’ and ‘gee he’s quick’.
The pilot of TXH assessed that he was not going to be able to stop the aircraft prior to the end of the sealed runway, but that there was a suitable grassed overshoot area beyond it, and maintained the aircraft on the runway centreline. ADC2 was standing up, and sighted EUU on taxiway A. ADC2 alerted the SMC to the Cessna (EUU) on taxiway A. ADC1 observed that EUU was then still north of the extended centreline of runway 22 on taxiway A.
As TXH approached the end of runway 22, the pilot of TXH sighted EUU taxiing on taxiway A to his right, and was unsure whether it was going to stop or not. He veered TXH to the right in an attempt to pass behind EUU and avoid a collision. At 11:39:25, the SMC directed EUU to ‘hold position, STOP, STOP’. The pilot of EUU braked immediately and as his body moved forward in response to the aircraft braking, he sighted TXH in his left peripheral vision. The pilot of TXH saw EUU brake suddenly.
The pilot of EUU assessed that if he stopped there, TXH would collide squarely with EUU, so he released the brakes and progressed forwards. The left wing of TXH then struck the tail of EUU and spun EEU around through about 180°. TXH continued veering to the right for about 20 m further before coming to rest on a grassed area (Figure 2).
Figure 2: Accident site
Source: Airport Operator
The pilot of TXH observed fuel spilling from the ruptured fuel tank and immediately exited the aircraft and reported that he was not injured. The pilot of EUU reported that he momentarily lost consciousness at the time of the collision, but came to within seconds. He then observed fuel leaking, and although feeling disoriented, he conducted a normal aircraft shut down, including switching off the aircraft electrics and fuel. He and the passengers disembarked and were treated for minor injuries. Both aircraft sustained substantial damage (Figures 3 and 4).
Figure 3: Damage to VH-TXH
Source: Airport operator
Figure 4: Damage to VH-EUU
Source: Airport Operator
Pilot comments
The pilot of TXH provided the following comments:
He did not declare an emergency as he assessed that he would be able to land the aircraft safely. He remained calm and focused on his approach to, and landing on, runway 22.
He wanted to ensure that if the engine failed completely he would have sufficient height to clear the buildings in the approach path of runway 22.
He did not have sufficient altitude to continue a circuit and land on 35R.
He was unable to stop the aircraft before the end of runway 22, but if there had not been an aircraft on the taxiway, he would have been able to stop safely in the overshoot area.
The pilot of EUU commented that as he was on Ground frequency and the pilot of TXH was on Tower frequency, he was not aware of TXH until he sighted it immediately prior to the collision. He reported that if he had been directed to stop earlier, it may have averted the collision.
Controller comments
The ADC1 controller provided the following comments:
The ADC1 offered the pilot of TXH the choice of runways to land on, but did not know what was achievable for the pilot or aircraft.
The ADC1 and ADC2 controllers both stood up when the pilot of TXH reported engine trouble.
The incident was a good example of how quickly things happen; about 90 seconds after an aircraft took off it was back on the ground and at least two aircraft had to be sent around in the interim.
The SMC reported checking the works strip under the runway designators in the console. The SMC scanned the eastern helicopter area, checked the taxiways that crossed runway 22 – ‘F’, ‘B’ and ‘C’ for any aircraft waiting to taxi, and did not see anything that may pose a risk to an aircraft landing on runway 22. Taxiway A was not a crossing taxiway for runway 22. The SMC reported that these scans were performed multiple times after the pilot of TXH advised of engine trouble. The SMC further commented that if TXH had maintained the runway centreline, the aircraft would not have collided.
Moorabbin Airport and weather conditions
Runway 22 at Moorabbin was 571 m in length, runway 35R was 1335 m. The wind was from 030° at about 7 kt, resulting in a tailwind on runway 22.
Air traffic control (ATC)
There were three ATC positions active at the time; a combined surface movement controller / coordinator position (SMC), an aerodrome controller – east (ADC1), and an aerodrome controller – west (ADC2). The three controllers were seated in the tower in that order from north to south facing towards the east, and were the only people in the control tower at the time. Runways 35L and 35R were the runways in use prior to the pilot of TXH reporting engine trouble. A runway in use is a runway under the control of an aerodrome controller. All runways are considered ‘active’ and a clearance is required to cross or enter any runway. The runways other than those in use, were held by the SMC. The ADC1 therefore required the release of runway 22 from the SMC prior to clearing TXH to land. The controller places the runway strips of the runways for which they hold responsibility, in the runway bay of the console.
Engineering inspection
A post-accident inspection of the engine of TXH found a small quantity of oil on the cylinders and some fouling of the spark plugs which may have led to the rough running.
Safety message
The ATSB publication Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft, found causes of partial power loss after take-off include fuel starvation, spark plug fouling, carburettor icing and pre-ignition conditions. A pre-flight safety brief that considers actions to take following a partial power loss after take-off, gives pilots a much better chance of maintaining control of the aircraft and of responding immediately. Such actions include landing immediately within the aerodrome, landing beyond the aerodrome, and conducting a turn back towards the aerodrome.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0730 (CDT) on 31 March 2015, intermodal freight train 2MP9 passed No. 1 signal at the southern end of the Mile End crossing loop (South Australia). The signal was displaying a 'Calling on/Low speed’ indication. The train proceeded at low speed, but subsequently collided with the rear end of intermodal freight train 2MP1, which was stationary on the main line. The collision resulted in moderate track damage and the derailment of three wagons at the rear of train 2MP1. There were no injuries to train crews.
What the ATSB found
The ATSB determined that the signalling and communications systems were operating correctly and as designed. The investigation found that the driver of train 2MP9, on receiving a ‘Calling on/Low speed’ signal indication, proceeded at a speed not greater than 25 km/h, but was unable to stop the train, ‘within half the distance the line ahead was clear’, as prescribed by the operational rules. The driver was aware that the operational rules stipulate that ‘block ahead may be occupied or obstructed’, but did not expect that train 2MP1 was stationary on the track so close ahead. As he approached train 2MP1, some stumpy vegetation and a low fence initially obscured his view of the empty flat wagons at the rear of the train. When the driver finally saw the rear of train 2MP1, he immediately made an emergency brake application, but was unable to stop the train before it collided with 2MP1.
The ATSB noted that the pathing of a train by a network control officer (NCO) onto a line occupied by a preceding train, when an alternate route is available and not obstructed, presents an elevated level of risk. Similarly, well thought out and clear communications between an NCO and crew of an approaching train, as to the proximity of a train occupying the track ahead, can significantly enhance situational awareness and reduce operational risk.
What's been done as a result
The Australian Rail Track Corporation (ARTC) and SCT Logistics have implemented a range of proactive strategies for enhancing the safe operation of train movements when entering an occupied section of track under a ‘Proceed restricted authority’ (PRA). This includes the use of all available infrastructure to reduce risk, encouraging communications between train drivers and NCOs where clarification of operational conditions is necessary, and a review of the National Train Communications System (NTCS) for the Adelaide area.
Safety message
Train drivers should carefully consider their obligations when accepting a ‘Calling on/Low speed’ signal indication in relation to sighting constraints, train speed and occupation of the track ahead. In circumstances where sighting constraints may exist, drivers should consider requesting further information from the NCO before moving through the track ahead.
NCOs should carefully consider the pathing of trains under their control, and the communication of information that may mitigate collision risk when dispatching trains.
The occurrence
The two drivers involved in the occurrence booked on for duty at the SCT Logistics Penfield Rail Freight Terminal (about 33 km north of the Adelaide CBD) in South Australia at 2100[1] on 29 March 2015. They worked train 6PM9 through to Horsham in Victoria, arriving at about 0500 (EDT) on 30 March. They rested in Horsham (motel accommodation) before resuming duty at 0100 (EDT) on 31 March. The drivers were rostered to join train 2MP9, a scheduled SCT Logistics (SCT) intermodal freight service, operating from Melbourne in Victoria through to Perth in Western Australia.
Train 2MP9 arrived in Horsham at 0208 (EDT). The crew changeover occurred as planned, with the train departing at 0216 (EDT). Train 2MP9 crossed with train 2XM2 in Tailem Bend, South Australia (120.298 km)[2]. While near Tailem Bend, the drivers of 2MP9 exchanged their respective driver/observer roles. This was the last driver exchange before the occurrence.
As train 2MP9 passed through Tailem Bend (about 0513), an Aurizon intermodal freight train (2MP1) also enroute from Melbourne to Perth was about 48 minutes ahead. Both trains continued on their journey towards Mile End (Figure 1).
Figure 1: Location map – Mile End, South Australia
Source: NatMap Railways of Australia
At about 0645, Aurizon train 2MP1 passed through Belair (22.510 km), at which time the SCT train 2MP9 was travelling the Ambleside (42.670 km) - Mt Lofty (30.972 km) section[3]. At about the same time, a change of shift was occurring at the ARTC Network Control Centre West (NCCW). The incoming Adelaide metro network control officer (NCO) familiarised himself with train movements coming under his control, which included 2MP1 and 2MP9.
At about 0700, the NCO set No. 1 signal (Figure 2) for 2MP1 to enter the Mile End crossing loop, on the main line. No. 44 signal had been pre-selected to clear for the Indian Pacific passenger train (1PA8), coming from the north, to enter the Adelaide Parklands Terminal (APT). No. 45 signal was at stop for 2MP1.
Figure 2: Mile End signal schematic
Source: ATSB
At about 0710, as train 2MP1 was transiting through the Mile End main line, train 2MP9 was passing through Belair and approaching Mile End from the south. At this time, the Indian Pacific was nearing Dry Creek (Figure 1), about 17 km to the north of Mile End. Signal No. 44 cleared to proceed at 0711:34.
2MP1 came to a stand on the main line fully within the Mile End crossing loop, about 200 m before signal No. 45. The rear end of the train was about 90 m from No. 4 signal. At about 0717 the NCO, in communication with the driver of 2MP1 (stationary Aurizon train), advised that the Indian Pacific was passing through Islington, about 8 km north of Mile End. He further advised that their train (2MP1) would be dispatched as soon as the Indian Pacific was clear of the main line and within the APT limits. At about 0723, the NCO pre-selected No. 45 signal. It was now set to automatically clear for train 2MP1 when the Indian Pacific was within the APT limits.
At about this time, train 2MP9 was passing through Hawthorn (suburb south of Adelaide), about 5 km south of Mile End. The train was now approaching NR8 signal displaying a caution/yellow aspect. This indication communicated that the next signal, No. 1 at Mile End, would be at stop. The driver continued towards No. 1 signal progressively reducing the train’s speed to a near crawl (1 km/h). At about 0738, with train 2MP9 about 500 m from No. 1 signal (Figure 3), the NCO selected the Calling on/Low speed signal so as to path 2MP9 into Mile End on the main line directly behind train 2MP1. The driver saw the No. 1 Calling on/Low speed signal clear and commenced to accelerate his train towards the maximum allowable speed of 25 km/h, but ready to stop should he see an obstruction on the track ahead.
Figure 3: Site overview near Adelaide Parklands Terminal (APT)
Source: Google Earth - annotations by ATSB
The Indian Pacific passed through Torrens Junction (3.281 km north of Mile End) at about 0737 and continued towards Mile End. As the Indian Pacific passed No. 44 signal at Mile End the NCO began to brief the driver of train 2MP1 (stationary Aurizon train) regarding the pending departure of his train.
By this time, train 2MP9 had passed under the Anzac Highway Bridge. It was traversing a sweeping left curve as it approached Mile End 6 points near the APT Access Bridge (Figure 3).
Train 2MP9 continued on a very mild down grade, reaching a speed of 25 km/h before entering a sweeping right curve. Just after clearing the APT Access Bridge, the driver was able to see the track to a distance of about 150 m ahead, which initially, to him, appeared clear (Figure 4).
Figure 4: Cab view post-collision reconstruction, about 150 m from the rear end of 2MP1
Source: SCT Logistics, annotations ATSB
After travelling, a further 40 m (Figure 5) the driver saw what appeared to be a series of empty flat wagons on the track ahead. He applied the train’s dynamic brakes (D8) and immediately followed this with an emergency brake application.
Figure 5: Cab view post-collision reconstruction, about 110 m from the rear end of 2MP1
Source: SCT Logistics, annotation ATSB
He was unable to stop the train before colliding with the rear end of 2MP1 (Figure 7) at an estimated speed of 22 km/h.
Figure 6: Cab view post image reconstruction, about 60 m from rear end of 2MP1
Source: SCT Logistics, annotation ATSB
Figure 7: Collision site - lead locomotive SCT009 in the background
Source: ATSB
About 9 seconds after the collision, the NCO contacted the driver of 2MP9 to advise that the train (2MP1) in front would be getting a signal shortly. The driver of 2MP9 responded indicating that he had already run into the back of train 2MP1.
Events post-collision
Following the collision, the NCO restored No. 45 signal to prevent the unintentional dispatch of Aurizon train 2MP1. The NCO then proceeded to close the track to other rail traffic and checked on the well-being of the drivers of both trains 2MP1 and 2MP9. The drivers of Aurizon train 2MP1 advised they were uninjured. The crew of SCT train 2MP9 advised they were shaken but otherwise uninjured. The driver of 2MP9 then de-trained, assessed the extent of collision damage and passed a damage report to the NCO and the management of SCT Logistics.
Accident investigation and recovery personnel were dispatched to site. The drivers and NCO were tested for the presence of drugs and alcohol. Recovery personnel commenced necessary restoration works with the track being re-opened to traffic later that day.
The collision occurred almost adjacent to the interstate Adelaide Parklands Terminal (APT), located at Mile End. The APT is about 2 km southwest of the Adelaide CBD, in South Australia. Leader Street and Victoria Street level crossings are located south of the Mile End crossing loop, 590 m and 1,160 m from No. 1 signal respectively. The two at-grade crossings are controlled by flashing signals, boom barriers and audible signals.
Figure 8: Site overview Train and train crew information
Source: Google Earth - Annotations by ATSB
Train 2MP9 was a regular SCT Logistics intermodal freight service that operates between Melbourne and Perth. The train was configured with three locomotives at the head of the train (SCT009 leading, then SCT011 and SCT012 trailing) followed by 61 wagons. The train had an overall length of 1,641 m and a gross mass 3,807 t.
Locomotive SCT009 was equipped with a data logger (Loco-log) used for capturing information such as date/time, speed, brake pipe pressure, throttle position and distance travelled.
Train 2MP1 was an Aurizon intermodal freight service that also operates between Melbourne and Perth. The train was configured with two locomotives at the head (6027 leading and 6006 trailing) followed by 51 wagons. The train had an overall length of 1,452 m and a gross mass 2,968 t.
Train 2MP9 – train management prior to collision
Analysis of data extracted from the Loco-log (SCT009) for train 2MP9 (Figure 9) established:
As the train approached No. 1 signal, the driver progressively reduced the train speed and reached a near crawl (1 km/h) before commencing to accelerate.
When train 2MP9 passed No. 1 signal it was travelling at a speed of 8 km/h and continued to accelerate, reaching a maximum speed of 25 km/h. The driver then set the throttle to idle.
Eight seconds later the driver applied the dynamic brakes (D8) and immediately followed this with an emergency brake application.
About 6 seconds after the emergency brake application, a sharp decrease in train speed was evident, probably coinciding with the time that train 2MP9 collided with train 2MP1.
Figure 9: Graph derived from Loco-log SCT009
Source: Data SCT Logistics, graphed by ATSB
About 15 seconds later (post-collision), train 2MP9 was at stop.
Loco-log data established that while approaching Mile End, the driver of 2MP9 was actively controlling/maintaining the train’s speed by applying a range of throttle commands.
Train crew
The driver in control of train 2MP9 commenced working in the rail industry in 1984. He was a qualified diesel/locomotive fitter before becoming a train driver in 2010. At the time of the collision, he was appropriately qualified and route certified. The observer had about six years train driving experience. He was appropriately qualified and had travelled over the route on six previous occasions. At the time of the occurrence, he was undertaking the final phase of route certification training.
Environmental conditions
At about 0730, the weather at Kent Town (2 km east of the Adelaide CBD) was fine. Temperature was about 14°C and the wind calm. No rain had fallen in the preceding 24-hour period. Sunrise occurred at 0727. The sun was almost due east and provided good visibility. Environmental conditions leading up to the occurrence were not extraordinary and were considered unlikely to have contributed to the collision.
Track information
The track from Melbourne through to Mile End (Adelaide) substantially comprised a single line (bi-directionally signalled) with crossing loops strategically located throughout its length. The crossing loop at Mile End (Figure 2) was documented[4] as having an available standing room of 1,656 m. The measured distance between signals 4 and 45 (Main Line) and between 4E and 45E (Crossing Loop) was 1,750 m.
The Mile End crossing loop was controlled by fixed colour light signals using track circuits for train detection. From No. 1 signal (Figure 3 and Figure 10) at the southern end of the Mile End crossing loop, the track leading into the collision site basically comprised two relatively tight sweeping curves, the first to the left followed by a curve to the right. The track is on a very mild down grade before entering the crossing loop. Sighting along this section of track was intermittently obstructed by fixed infrastructure (Anzac Highway Bridge and APT Access Bridge) in addition to low bushes and a small tree.
Figure 10: No. 1 signal showing position of Calling on/Low speed aspect
Source: ATSB
Code of Practice – Operational rules
ARTC’s Code of Practice for the Defined Interstate Rail Network – Glossary (Clause 3.2) defines an Occupancy authority as falling into one of two groups:
Proceed authority (PA): A formal authority for a train to proceed in the forward direction under normal operating conditions where exclusive occupancy of the track section to which it applies is guaranteed.
Proceed restricted authority (PRA): A formal authority for a train to move in the forward direction at restricted speed to enter the limits of a preceding train or track obstruction.
Clause 2.4.2 of ARTC’s Code of Practice for the Defined Interstate Rail Network – Operations and Safeworking, Rules prescribes the separation requirements for a train operating under a PRA as:
The safe working system shall allow the authorisation of a train to enter a route where one of the following conditions apply:
(a)The route is proved clear taking into account rollingstock gauge limits and an allowance for overhang.
(b)The route is occupied by another train that is not moving.
(c)The route is occupied by another train that has departed and is not returning.
At Mile End, occupancy authorities were communicated to train drivers using colour light signals. No. 1 signal at Mile End (Figure 10) controls northbound trains entering the main line (6 points set normal) and entering the crossing loop (6 points set reverse). No.1 signal comprises a group of coloured lights that convey the status of the track (block) ahead and communicates information such as permissible track speed and/or restrictions that define the way a train should be driven.
The correct display and interpretation of the signal by the train driver is essential for a train to move safely through the block ahead.
The indications and meaning that can be displayed by No. 1 signal at Mile End are described in theCode of Practice for the Defined Interstate Rail Network – Volume 3 - Operations and Safeworking Part 1: Rules, January 2013 (Table 3.1).
Table 1: Signalling Systems – Fixed Signal Indications, Meanings and Application
Source: ARTC
In Table 1, a Calling on/Low speed when given, stipulates ‘A speed which will enable a train movement to be stopped within half the distance the line is seen to be clear ahead, but which does not exceed 25 km/h’ (ARTC Code of Practice, Issue 2 May 2002). The driver in control of the train is required to be able to stop short of any obstruction on the track ahead.
With respect to this occurrence, No. 1 signal at Mile End was displaying a Calling on/Low speed indication, authorising a train (2MP9) to proceed at low speed and enter a route occupied by another stationary train (2MP1).
The signalling events were consistent with the PRA provisions documented in the ARTC Code of Practice.
Signalling and communications – Mile End crossing loop
Signals and points at Mile End were remotely operated from a network control centre located at Mile End in South Australia, using the ARTC’s Phoenix control system (Figure 11, left photo – Adelaide metro network control board). The Phoenix system is a non-vital[5] CTC[6] system that provides real time monitoring and control of field hardware including signals, points, track circuits and the associated management of train movements. The system also includes an event logger to capture signal, points, track and train movement data.
Figure 11: Adelaide metro network control board (left photo) and Harmon vital logic controller (right photo)
Source: ARTC
The fail-safe[7] interlocking functions for the Mile End crossing loop were achieved using a vital logic controller (VLC). The Harmon VLC (Figure 11, right photo) was programmed to facilitate the safe movement of trains and incorporates two distinct levels of computer coding:
The executive code, is common to each class of VLC and comprises the software routines that:
Ensure that all vital outputs are fully controlled.
Verifies the state of vital inputs and outputs.
Removes power to vital outputs in all cases where a system failure has occurred, thereby placing field equipment into a safe mode.
The manufacturer embeds the executive code within the VLC.
The geographic code depicts the track layout (geography) and the railway’s operational rules/procedures. Specialist software engineers conversant in the geographic coding language enter geographic coding. The railway owner defines the requirements for a specific track layout in a ‘Control Table’, which is a documented version of the signal interlocking requirements. Software engineers then translate and enter the control table information into the VLC.
As previously mentioned, if a train is occupying the track ahead, a Calling on/Low speed signal may only be cleared if that train is stationary. Examination of the Mile End control tables established that this interlocking requirement was achieved by verifying that the main line had been occupied for at least 3 minutes.
Examination of event logger data (Phoenix control system) established that train 2MP1 had been standing on the main line for about 27 minutes before No. 1 signal (Calling on/Low speed) was cleared for train 2MP9. The driver of train 2MP9 confirmed that No. 1 signal (Calling on/Low speed) cleared for his train as it approached No. 1 signal. He indicated the signalling system appeared to function correctly.
Based on the interview with the train driver, an examination of the signalling control tables and a review of the Phoenix event logger data files, the ATSB was satisfied that the signalling system operated correctly for train 2MP9.
Network Control Centre West (NCCW)
Mile End is the interface between two ARTC geographical areas of control, with individual NCOs being responsible for south and Adelaide metro boards (areas). The south board NCO controls train movements from (but not including) Mile End to Wolseley. The Adelaide metro board NCO controls train movements from (and including) Mile End to Dry Creek North/Dry Creek and to Pelican Point. Voice communication between trains and ARTC’s network control centre was achieved using ARTC’s National Train Communications System (NTCS).
Network control officer (NCO)
The NCO involved with the occurrence commenced his employment with the railways in 1979. He had extensive experience and had been engaged as train controller/NCO from about 1997 onwards.
The NCO’s records established that he had been assessed as meeting the medical standards prescribed by the National Standard for Health Assessment of Rail Safety Workers. He was appropriately qualified to control the Adelaide metro board. At interview, the NCO reported being in good health and well rested prior to signing on for duty on 31 March 2015. There was no evidence to suggest that the NCO’s performance was affected by fatigue.
Post derailment the NCO underwent drug and alcohol testing, the results of which were negative.
2MP9 train driver actions
The primary task for the driver of train 2MP9 was to safely negotiate the track ahead, including the correct interpretation of No. 1 signal and the correct application of the relevant operational rules. In this regard, the driver’s actions could be broadly influenced by:
the level of route knowledge, training, experience and/or task competency
factors affecting the driver’s attention to the primary task
fatigue, medical condition and/or toxicology (drugs and alcohol)
Route knowledge, training, experience and task competency
A review of the driver’s records established that he was:
Certified and current for the route – Horsham to Mile End, including the section of track from No. 1 signal through to the point of collision.
Trained and current with respect to operational rules.
Experienced as a train driver – had been driving for about 5 years. It was further established that he had a sound understanding of locomotive/train dynamics because of his background as a qualified diesel/locomotive fitter. Accordingly, it was concluded that the driver was competent to perform the driving task.
A review of Loco-log data (Figure 9) established that after passing No. 1 signal and prior to making an emergency brake application, the driver maintained a speed below 25 km/h. However, the speed of the train was such that the driver could not stop 2MP9 before colliding with the rear of train 2MP1.
During interview, the driver affirmed that he was familiar with the route and had regularly traversed the section of track where the collision occurred. He accurately explained the meaning of the Calling on/Low speed indication. The driver described that when given a Calling on/Low speed indication, the train must not exceed 25 km/h and must be controlled so that it can stop short of any obstruction, within half the visible sighting distance ahead.
Based on a review of the driver’s qualifications as well as interview evidence, it is unlikely that the driver’s route knowledge, training, experience and/or task competency were factors that contributed to the collision.
Attention: workload and distraction
Workload
Human performance is highly variable and subject to a number of influencing factors. The term ‘cognitive workload’, refers to a measure of the type or nature of work being undertaken with regard to its demands on an individual’s cognitive resources. Cognitive workload can be in overload where the demands on the working memory are excessive, or in underload, brought about by periods of relative inactivity and boredom[8]. Factors influencing workload can include the quantity and complexity of concurrent or consecutive tasks, as well as time requirements for their completion. An individual’s familiarity with a task will also influence their cognitive workload.
Distraction
Distraction can be understood as a type of inattention, where a person’s attention is diverted by a particular event or object. Driver distraction has been more specifically defined as ‘the diversion of attention away from activities critical for safe driving toward a competing activity (occurring) voluntarily or involuntarily.’[9]
Driver distraction can involve a range of factors either inside or outside a vehicle that draw on limited human physical, visual and cognitive resources, and can result in a degradation of the driver’s performance. For example, eating, drinking, operating devices integral to (or brought into) the vehicle (such as a mobile telephone), smoking, or conversing with another occupant are all activities that may distract from the driving task[10].
The lead locomotive SCT009 was fitted with an event logger. It recorded data such as date/time train speed, distance travelled, traction effort, throttle position and operation of the vigilance system.[11] The driver recalled that as train 2MP9 approached the collision site (rear end of train 2MP1), he was concentrating on driving the train, including observing the track ahead. An examination of the loco-log established that:
The driver was actively controlling/maintaining the train’s speed on approaching No. 1 signal, Mile End. He reduced the train’s speed, to a near crawl (1 km/h) before the signal cleared.
When No. 1 signal cleared – Calling on/Low speed, he accelerated the train up to the permitted speed of 25 km/h.
He maintained the train’s speed at or below 25 km/h.
He responded quickly and positively on seeing the rear end of train 2MP1, making an emergency brake application.
In this occurrence, there was no evidence to indicate that the driver’s attention to the task, and thus his capacity to perceive and interpret important information (observing train 2MP1), was negatively affected by workload or distraction.
Fatigue
In the context of human performance, fatigue is a physical and psychological condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep.[12] Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission.[13] Fatigue impairment has been identified as causal in many transport related accidents.
The driver involved in this occurrence was based at the SCT Logistics depot, Penfield. Examination of the roster shows that he had been on annual leave for 20 days prior to commencing duty at 2100 on 29 March 2015. He worked train 6PM9 through to Horsham in Victoria – arriving about 0500 (EDT) on 30 March. He rested in Horsham before resuming duty at 0100 (EDT) on 31 March, when he joined train 2MP9. For the first part of the journey (through to Tailem Bend), he worked as the observer. At approximately 0500, he swapped with the active driver and then drove train 2MP9 from Tailem Bend through to Mile End.
At the time of collision the driver had been in control of the train for about 2 ½ hours and was about 6 ½ hours into the rostered shift. When interviewed, the driver indicated that he had obtained a good sleep and was well rested prior to commencing shift. He had not noted feeling any effects of fatigue in the period prior to, or at the time of collision.
On balance, considering the driver’s hours worked, sleep opportunity, time of day, and his recorded driving responses/actions, it is considered unlikely that the driver was impaired by fatigue at the time of the occurrence.
Medical and toxicology
The driver and observer’s health records confirmed their health assessments were current. Both drivers had been assessed as meeting the required standard prescribed by the National Standard for Health Assessment of Rail Safety Workers. The ATSB’s investigation found no evidence to suggest that any medical or physiological factors had affected the driver or observer’s performance leading up to, or at the time of the collision.
Post-collision both drivers underwent drug and alcohol testing, the results of which were negative.
Other occurrences involving Calling on/Low speed movements
The ATSB has previously investigated one similar occurrence, (RO-2010-013), at Yass Junction, New South Wales on 9 December 2010. That incident involved a Calling on signalling related incident that resulted in the collision between two-grain trains, 3234N and 8922N.
The investigation concluded:
The driver of train 3234N was operating the train at a speed too fast for the prevailing conditions and intent of the Calling on signal.
At the time of the collision, it was dark with moderate rain. Sighting distance was limited by the curvature of the track, embankments, and the effective illumination of the train’s headlight.
The driver had expected to be told by the network controller if a train was stopped ahead so he could anticipate the location of the rear end of the train and drive accordingly.
While not contributing to the incident, the ARTC definition of restricted speed (at that time) required considerable judgement on the part of train drivers.[14]
The ATSB found that the speed of the train (being too fast for the prevailing conditions), was the primary factor in the Yass Junction collision. However, the ATSB also noted that providing the train crew with information regarding the status of the track ahead, probably offers an opportunity to reduce risk, by improving train driver awareness of upcoming risks.
Based on a review of evidence gathered during this investigation, the ATSB concluded that:
There were no mechanical deficiencies with train 2MP9 which contributed to the collision.
The signalling and communication systems operated correctly and as designed.
Train 2MP9 proceeded past No. 1 signal and travelled at a speed not greater than 25 km/h.
The driver of train 2MP9 was unable to stop the train, in accordance with the operational rules, and collided with the rear of train 2MP1.
The following safety analysis focuses on factors that may have influenced the train driver’s awareness and sighting of train 2MP1.
Conspicuity of the rear of train 2MP1
Conspicuity refers to those characteristics of an object or condition that determine the likelihood that it will come to the attention of an observer. Some of the key attributes that contribute to the conspicuity of an object are its brightness, contrast and physical size. In general terms, objects that stand out from their visual background are more easily noticed, and, when all else is equal, larger objects are generally easier to see and hence more conspicuous than smaller objects[15].
The driver and observer of train 2MP9 both remarked that they had not seen the empty flat wagons at the rear end of train 2MP1, or the end-of-train (EoT) marker[16], until their train was about 110 m from the rear end of 2MP1 at which time the driver made an emergency brake application.
Train 2MP1 had been marshalled[17] with a number of empty flat wagons at the rear of the train; the last having an end-of-train (EoT) marker attached. It is common practice, and in most cases desirable[18], for lightly loaded or empty wagons to be marshalled to the rear of a train. In this case, this configuration reduced the conspicuity of the rear of train 2MP1.
It was also noted (post-collision) that the rear end of train 2MP1 was partially obscured by stumpy vegetation and a low fence (Figure 4). As is evident in Figure 4, after passing under the APT Access Bridge the train driver and observer could see parts of the track ahead as it swept gradually to the right. However, the vegetation (part of which is outside the ARTC rail corridor) and fence obscured parts of the track. It was likely that with intermittent opportunities to observe the track ahead, the empty flat wagons at the end of train 2MP1 were not sufficiently conspicuous against the visual background as to be perceived by the crew of 2MP9. Thus, the driver did not recognise the need to slow the train (below 25 km/h) as there was no apparent obstruction in his visual field.
Expectancy
Another factor, which can influence performance, is expectancy. An individual’s expectations of events can significantly influence their interpretation of information in the environment. Research has established that individuals often fail to notice unexpected events, even ones that are important. Even when objects are designed for visual distinctiveness, they will be missed if they do not fit within an individual’s expectations. Overcoming the powerfulness of expectancy is challenging, particularly because people will generally assume that, by looking in the right direction, unexpected objects and events will grab their attention.[19]
Interview evidence indicated that upon observing No. 1 signal displaying a Calling on/Low speed indication, the driver and observer believed that the train ahead of them was most likely moving out of the section. At interview after the collision, the driver and observer stated they could not understand why the NCO had attempted to path their train (2MP9) close in behind 2MP1, as there was very little room for 2MP9. The driver also commented that while the NCO was not procedurally obliged to advise them regarding the position of train 2MP1, had the NCO briefed the driver, he would have approached the site more cautiously, probably at a crawl speed. It was evident that the train crew were not expecting a train so close ahead.
Network control officers’ actions
Two of the primary tasks for a network control officer (NCO) are safe and efficient pathing of trains.
As trains 2MP1, 2MP9 and the Indian Pacific (1PA8) approached Mile End they came under the jurisdiction of the Adelaide metro network controller. The NCO examined the geographic positioning of the three trains, considered the pathing opportunities, and decided that train 2MP1 should be held at Mile End to allow the Indian Pacific (1PA8) to be pathed into the Adelaide Parklands Terminal (APT). The NCO expected these two movements to complete before train 2MP9 was to move through Mile End. He pre-selected/stored the routes accordingly. While the signalling system allows routes to be pre-selected/stored, for safety reasons, the interlocking enforces a substantial timeout period if pre-selected/stored routes are cancelled. Therefore, once the NCO had pre-selected/stored routes for 1PA8, 2MP1 and 2MP9, his decisions were somewhat locked in place.
The Indian Pacific (1PA8) did not arrive at the APT as early as the NCO had anticipated. This delay resulted in the NCO electing to hold 2MP1 on the main line within the limits of the Mile End crossing loop, with 2MP9 approaching on the main line behind.
The NCO was busy communicating with the driver of 2MP1 and was intently focussed on the timely dispatch of 2MP1 as soon as 1PA8 was within the APT limits. This was probably for two reasons; firstly to keep train 2MP1 moving and facilitate the efficient pathing of 2MP9 through the Mile End crossing loop. The second reason was to limit the time that train 2MP9 would block the Leader Street and Victoria Street level crossings during the busy morning peak. To move 2MP9 off the level crossings and onto the main line of the Mile End crossing loop, the NCO recognised the need to get 2MP1 moving and out from the crossing loop.
It was evident from network control voice recordings that all communications had been with the driver of train 2MP1 – the NCO’s perceived priority. The NCO was providing information regarding the progress of train 1PA8 to expedite the efficient pathing of all three movements, and subsequently clear train 2MP9 off the level crossings. However, there was no similar information communicated to the crew of 2MP9 until moments after the collision.
For signalled movements there was no requirement for the NCO to advise either driver of the status of the track ahead. A correctly functioning signalling system will provide protection for a ‘Proceed authority’ (PR), but it cannot do so absolutely for a ‘Proceed restricted authority’ (PRA). While a PA can only be provided if the track ahead is clear, a PRA by the nature of the operational rules allows for joint track occupation, which results in a reduction of defences against train conflicts.
While the signalling system and rules provide protection for train movements, the sweeping curve, stumpy vegetation and low fence, combined with the reduced physical conspicuity of train 2MP1 inhibited the driver of train 2MP9 from perceiving the train ahead. In the absence of any additional information alerting 2MP9’s driver as to the proximity of train 2MP1, the driver assumed the track ahead was clear, and was unable to stop in accordance with the half-distance sighting rule, to avoid the collision.
It was also evident that when pre-selecting routes for 1PA8, 2MP1 and 2MP9, the NCO had not expected a delay to 2MP1 departing the main line in Mile End. The intent was for the Indian Pacific (1PA8) to clear into the APT, for 2MP1 to continue on from Mile End and for 2MP9 to pass largely unimpeded onto the main line at Mile End.
Without presuming the contribution of other factors, an alternative and potentially safer option for the NCO may have been to path train 2MP9 onto the loop track at Mile End. This option would have removed the occupancy conflict that occurred due to the delayed departure of train 2MP1.
It is likely that adoption of defensive pathing solutions and the timely communication of information to train crew are both strategies that could reduce safety risk to rail operations.
National Train Communications System
The ARTC National Train Communications System (NTCS) was (in part) designed to emulate an open channel (‘party-line’) communication system so that train drivers and track workers could maintain awareness of activities close to their area of operation. However, due to the high volumes of radio traffic and the potential for this to cause train driver distraction, this function was not enabled for the Adelaide metro area. Consequently, due to the configuration of the NTCS system, the driver of 2MP9 did not hear any dialogue between the driver of 2MP1 and the NCO regarding the pathing of train 2MP1 and 1PA8. The driver of 2MP9 was therefore not fully aware of activities close to his area of operation – in particular the position of train 2MP1 on the Mile End main line.
From the evidence available, the following findings are made with respect to the collision between freight trains 2MP9 and 2MP1 at Mile End, South Australia on 31 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The train was travelling too fast for the prevailing conditions and the driver of train 2MP9 did not see the rear of train 2MP1 in sufficient time to stop and avoid the collision.
The driver of 2MP9 was unaware, and did not expect that train 2MP1 was stationary on the track ahead.
Vegetation and a low fence adjacent the Mile End crossing loop partially obscured the view that the crew of train 2MP9 had of the empty flat wagons at the rear of train 2MP1. [Safety issue]
The practice of pathing a following train onto a line occupied by a preceding train, when an alternate route was available and not obstructed, presented an elevated level of risk. [Safety issue]
Other factors that increased risk
The practice of pathing a following train onto the same line occupied by a preceding train, without pre-warning the driver regarding the train ahead, presented an elevated level of risk. [Safety issue]
The design of the NTCS in screening Adelaide metro broadcast communications prevented the driver of 2MP9 from gaining an appreciation of activities close to his area of operation, in particular the position of train 2MP1 along the Mile End main line. [Safety issue]
Other findings
The signalling and communications systems were operating correctly and as designed.
Operational rules for a ‘Calling on/Low speed’ signal allow for the dispatch of a train into a route that is occupied by another train at stop.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Safety issue description: Vegetation and a low fence adjacent the Mile End crossing loop partially obscured the view that the crew of train 2MP9 had of the empty flat wagons at the rear of train 2MP1.
Safety issue description: The practice of pathing a following train onto a line occupied by a preceding train, when an alternate route was available and not obstructed, presented an elevated level of risk.
Safety issue description: The practice of pathing a following train onto the same line occupied by a preceding train, without pre-warning the driver regarding the train ahead, presented an elevated level of risk.
National Train Communications System (NTCS) – Broadcast communications
Safety issue description: The design of the NTCS in screening Adelaide metro broadcast communications prevented the driver of 2MP9 from gaining an appreciation of activities close to his area of operation, in particular the position of train 2MP1 along the Mile End main line.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
The Australian Rail Track Corporation
SCT Logistics
References
ARA Glossary for the National Codes of Practice and Dictionary of Railway Terminology
Bureau of Meteorology - Weather Observations for Adelaide, South Australia (31 March 2015)
RISSB Glossary of Railway Terminology – Guideline
Code of Practice for the Defined Interstate Rail Network – Volume 2 – Glossary
Code of Practice for the Defined Interstate Rail Network – Volume 3 – Operations and Safeworking Part 1: Rules
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to:
SCT Logistics
The Australian Rail Track Corporation
The Office of the National Rail Safety Regulator
The crew of train 2MP9 and the Network Control Officer involved in the occurrence.
Submissions were received from SCT Logistics, the Australian Rail Track Corporation, the Office of the National Rail Safety Regulator and the driver of train 2MP9. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 March 2015, an Aeronavics SkyJib 8 remotely piloted aircraft (RPA) (Figure 1) was being used to assist with media coverage of the International Cricket Council World Cup Final, at the Melbourne Cricket Ground (MCG), Melbourne, Victoria. The RPA was being operated from the top of the south-western scoreboard of the MCG. The operating team consisted of:
a flight controller, who piloted the RPA
a ground station controller, who performed a range of functions including monitoring the position of the RPA and providing a back-up control for the flight controller
a camera gimbal controller, who controlled the camera mounted beneath the RPA.
Figure 1: RPA prepared for flight with camera mounted beneath
Source: RPA operator
The accident flight followed four earlier uneventful flights that day. The crew completed all pre-flight checks[1] and made broadcasts on appropriate air traffic frequencies, then launched the RPA at about 1430 Eastern Daylight-saving Time. On this particular flight, the operator intended to capture footage of the MCG and surrounds as the competing teams entered the MCG and during the pre-match ceremonies. The RPA’s take-off and departure were normal. The RPA was flown slowly southward toward Hisense Arena (Figure 2), climbing to a height of about 300 ft above ground level. The route was similar to that flown during earlier flights, without incident. All three control systems (flight control, ground station control and camera gimbal control) appeared to be functioning normally during the departure and transit to Hisense Arena.
About 2 minutes into the flight and soon after the competing teams entered the MCG, with the RPA over the northern roof of Hisense Arena, the camera gimbal operator lost control of the gimbal. The gimbal operator reported the loss of control to the other team members. Several seconds later, the ground station controller also lost communication with the RPA. At that point, with the RPA moving slowly southward over Hisense Arena, the flight controller made a decision to discontinue the flight and return the RPA to the top of the scoreboard. The flight controller made appropriate control inputs but found that the RPA was unresponsive, and it continued to move slowly southward.
Having lost normal control of the RPA, the flight controller commenced alternate RPA recovery procedures. The flight controller switched from GPS to attitude mode,[2] but was still unable to control the RPA. The flight controller then activated the ‘return to home’ function, but this was also ineffective. The flight controller then reverted to manual control,[3] in an attempt to recover control of the RPA, but the RPA remained unresponsive. Throughout this time, the ground station controller continued attempts to re-establish communication with the RPA, also without success.
About 20 seconds after the initial control problems, the RPA commenced travelling at medium speed in a westerly direction, and began slowly descending. The flight controller continued attempts to re-establish control by switching between control modes and again activating the ‘return to home’ function, but all attempts were unsuccessful. When the RPA reached a point south of Rod Laver Arena, it appeared to cease lateral movement and stabilise just above treetop level. Continued attempts by the flight controller to regain control were unsuccessful, and the RPA descended beneath the treetops, out of sight of the controlling crew.
The RPA collided with terrain on the median strip on Batman Avenue to the south of Rod Laver Arena, a little over 3 minutes after the flight had commenced. The operating crew had maintained line of sight with the RPA until it descended beneath the treetops. Initial control difficulties were experienced when the RPA was just over 200 m from the position of the operating crew. The collision with terrain was about 450 m from their position (Figure 2).
There were no injuries to people on the ground, and no damage to other property, but the RPA and associated equipment were substantially damaged during the collision.
Figure 2: Approximate flight path of the RPA, from the take-off location on top of the south-western scoreboard at the MCG, to where control was lost over Hisense Arena and the collision location on Batman Avenue
Source: Google Earth with additions by the ATSB
Operator’s approval and risk assessment
The operator had approval from the Civil Aviation Safety Authority to operate the RPA near people and over populous areas while taking aerial photography during the event. The approval included a number of conditions related to such things as RPA control capabilities, the operating area and the operating environment. The operator had also conducted a risk assessment relevant to the flight during which the accident occurred. This assessment included consideration of a range of environmental factors, and outlined a number of risk mitigation measures. Among other things, the risk assessment included consideration of:
weather conditions that may affect control of the RPA
light conditions that may affect the ability of the operating crew to maintain visual contact with the RPA
the intended flight path with respect to the location of people and property
the location of structures, other obstacles and other air traffic that may affect the flight
the adequacy of emergency procedures and possible equipment failure modes
the operating environment in terms of noise and possible distractions (operating crew and members of the public).
Operator’s investigation
The operator investigated the accident, with a particular focus of establishing the reasons for which control of the RPA was lost. The investigation included consideration of a number of system-related and environmental factors, and the behaviour of the RPA following the loss of control.
The operator’s report concluded that radio frequency interference was the most likely cause of the accident. The volume of radio frequency traffic at the time of the accident was probably substantial, and perhaps sufficient to override RPA control signals. Numerous fixed telecommunications facilities and mobile broadcast vehicles in the vicinity of the MCG were probably transmitting at the time of the accident. Over 93,000 people attended the event, many of whom were probably using personal mobile communication devices at about the time of the accident. Furthermore, the use of portable communication devices by event management personnel (such as security and emergency services personnel) may also have contributed to the volume of radio frequency traffic.
The operator considered that the behaviour of the RPA was consistent with signal interference or confusion, rather than signal loss. In the event that the signal was lost, the RPA would have entered a fail-safe mode. In fail-safe mode, if the RPA had a valid GPS signal it would have returned to the starting point and landed. Without a valid GPS signal, the RPA would have held position, then descend slowly in that position, until touch down. Additionally, the operator found no evidence that there was any fault with the RPA control systems or any hardware issues, which may have resulted in the loss of control.
The operator’s investigation report commented that very similar operations had been conducted without incident prior to the accident flight. On this particular flight, the scale of the event, and probably the amount of associated radio frequency traffic, were more substantial. The operator’s report also acknowledged that further testing and analysis was required before the primary cause of the accident could be confirmed beyond doubt.
Safety action
As a result of this occurrence, the RPA operator has advised the ATSB that they are planning further tests to better understand the nature of the loss of control of the RPA. A better understanding of the nature of the problem may allow identification of engineering measures to reduce the risk associated with the possibility of radio frequency interference.
The operator also intends to review procedures and update risk assessments considering the circumstances surrounding this accident.
Safety message
On this occasion, the available evidence suggests that a high volume of radio frequency traffic compromised RPA control and communication functions. This accident highlights the need for careful consideration of ‘what might be different this time’ during risk assessments, including the identification of appropriate risk mitigation strategies. Although the operator had conducted a risk assessment for the accident flight, the possible effects of a substantial increase in the volume of radio frequency traffic had not been specifically considered.
In a broader sense, this accident highlights the ongoing importance of appropriate RPA operational controls and procedures. These are particularly important where operations are intended in the vicinity of populated areas or other air traffic. The careful application of operational controls and procedures, underpinned by robust risk assessment, will become increasingly important as relevant technologies develop further and new RPA applications continue to emerge.
Important information for RPA operators, including information about relevant regulations, operational approval requirements and RPA associations, is available on the CASA website.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 14 March 2015 Malaysia Airlines Airbus A330, registered 9M-MTA, began its approach to Melbourne (Tullamarine) after a flight from Kuala Lumpur. In the final stages of the approach, at approximately 50 feet, the captain reported feeling the aircraft sink and manually increased the thrust to the engines in an attempt to slow the rate of descent. Despite this action, the aircraft experienced a hard landing of a magnitude requiring replacement of the aircraft’s main landing gear. There were no reported injuries as a result of the occurrence.
What the ATSB found
The ATSB found that as a result of the pilot flying’s control inputs after disengaging the autopilot (approximately 700 feet above the ground), the final approach had become unstable, descending below the desired vertical profile. The continuation of the approach and an inappropriate attempt to recover the situation led to a high rate of descent at touch down.
What has been done as a result
Soon after the event, the operator circulated a memorandum to their A330 flight crew highlighting the incident and advising of the relevant procedures intended to minimise the chances of a similar occurrence. The flight crew involved also undertook additional training and assessment before returning to flight duties.
Safety message
A stable approach significantly reduces the risk of a hard landing.
If an approach does become unstable, a rushed attempt to recover the approach may produce an undesirable aircraft response. There is also a risk of breaking down the shared understanding between the pilots, which in turn limits the opportunity of the other flight crew to detect or react to inappropriate actions.
When landing, pilots should maintain a safety philosophy of “if in doubt, go around”.
The occurrence
On 14 March 2015, at about 0750 EST[1] an Airbus A330-343 (A330) aircraft registered 9M-MTA and operated by Malaysia Airlines Berhad, began its final approach to runway 34 at Melbourne Airport. The flight was a regular passenger service from Kuala Lumpur, Malaysia to Melbourne, Australia. Bureau of Meteorology weather data was consistent with the flight crew’s reports of fine flying conditions. The flight crew consisted of a captain, who was the pilot flying (PF[2]) and a first officer, who was pilot monitoring (PM).
The approach to runway 34 at Melbourne airport was not equipped with an Instrument Landing System (ILS), so a non-precision approach was performed. Runway 34 had a precision approach path indicator (PAPI) system consisting of four lights that provided visual guidance for the pilots to determine if the aircraft was maintaining the correct glide path. Figure 1 shows what a crew flying using the PAPI system would expect to see depending on their relative height to the correct approach path. A crew maintaining the nominal 3° path should see two white lights and two red lights.
Figure 1: Precision approach path indicator (PAPI) system
Source: Flight Safety Australia
Melbourne airport is equipped with a precision approach path indicator (PAPI) system. The system provides a method for pilots to maintain the 3° glide path by referencing the colour of the four lights. The crew of an aircraft on the 3° glide path would see two white lights and two red lights
Unstable approach developed
Flight data showed that the PF disengaged the autopilot at approximately 700 feet above ground level (AGL) and from that point until touchdown there was an increase in the frequency and magnitude of sidestick pitch control inputs by the PF (Figure 4).
In response to these inputs the aircraft’s autothrottle system varied the engine thrust to maintain a target speed, as per system design, and the aircraft pitch angles fluctuated between approximately -0.5° nose down and +5.0° nose up. The net result of the varying thrust settings and pitch angles was a fluctuating rate of descent between approximately 380 and 960 feet per minute.
Large sidestick inputs, specifically nose-down, also have the potential to inhibit the vertical speed reduction function, which is an automated function that provides some protection against touchdown at very high vertical speeds.
The Operator’s Flight Crew Training manual included the following information about the disconnecting of the Autopilot:
----
AP Disconnect
During the final approach with the AP engaged, the aircraft will be stabilised. Therefore, when disconnecting the AP for a manual landing, the pilot should avoid the temptation to make large inputs on the sidestick.
The pilot should disconnect the autopilot early enough to resume manual control of the aircraft and to evaluate the drift before flare. During crosswind conditions, the pilot should avoid any tendency to drift downwind.
Some common errors include:
• Descending below the final path, and/or
• reducing the drift too early.
----
As the aircraft passed 300 feet above ground level (AGL) a rate of descent of 960 feet per minute was recorded. This neared the operator’s maximum stabilised approach limit of 1000 feet per minute when below 500 feet AGL. As well as a high rate of descent, actual exceedances of the operator’s stabilisation criteria included:
large changes to pitch inputted by the pilot flying, including negative pitch values,
fluctuations in the rate of descent over a large range that were abnormal for the phase of flight,
incorrect glide path. From approximately 250 feet AGL, the aircraft was trending low and continuing below the glide path. At this point the pilots would have been able to observe 3 red lights and one white light on the PAPI. This trend was allowed to continue until the aircraft was well below the desired glide path to the extent that the PAPI would have indicated 4 red lights from approximately 125 feet AGL (Figure 2). From this point the PF made numerous pitch commands which were mostly nose down. These included a full range nose down deflection at 24 feet AGL.
Figure 2: Aircraft path relative to the PAPI indications the pilots would have observed during the approach
Source: ATSB
Figure 2 displays in green the ideal glide path during an approach and the PAPI thresholds in red (low) and white (high). The yellow is the actual path of the aircraft derived from the flight data. Just below 150 feet 4 red light would have been indicated to the crew.
Unstable approach was continued
The company procedures and manufacturer’s recommendations dictated that if an approach becomes unstable below 500 feet AGL, a go-around must be initiated by the pilot flying (PF) and/or the pilot monitoring (PM) must alert the PF of the unstable approach and encourage a go-around (Figure 3).
Included in the operator’s flight crew training manual and the manufacturer’s operating philosophy of the aircraft were a set of ‘golden rules’ to be followed by flight crew at all times whilst operating the aircraft. Rule number 4 was as follows:
----
If the aircraft does not follow the desired vertical or lateral flight path, or the selected targets, and if the flight crew does not have sufficient time to analyse and solve the situation, the flight crew must immediately take appropriate or required actions, as follows:
The PF should change the level of automation:
From managed guidance to selected guidance, or
From selected guidance to manual flying.
The PNF should perform the following actions in sequence:
Communicate with the PF
Challenge the actions of the PF, when necessary
Take-over, when necessary.
----
During flight crew interviews there was no indication that the pilot not flying (PNF-now referred to as the PM) communicated with the PF about the unstable approach conditions, considered taking over from the PF, and/or encouraged the PF to conduct a go-around.
Figure 3: Extract from the operator’s Operations Manuals current at the time of the occurrence.
Source: Malaysia Airlines
Attempted recovery from unstable approach
At 60 feet AGL the captain moved the thrust levers forward momentarily into the TOGA (Take-off/Go Around) detent. The captain stated that this was done in response to a feeling that the aircraft was sinking below the path, and the intention was to reduce this sink by applying more thrust to the engines. The placement of the thrust lever into TOGA placed the aircraft automation into the go-around autopilot modes and changed the display on the primary flight display flight mode annunciator (FMA). The captain subsequently reduced the thrust levers.
The PM, on seeing the modes on the FMA change assumed that a go-around was being conducted and awaited further announcement from the captain. The PM reported noticing the thrust levers reducing and that the aircraft was not flaring and applied nose up input to the sidestick at the same time as the PF.
At the time of the occurrence there was no procedure on the A330 for the use of manual thrust for this purpose. Prior to 2009, a procedure existed in the Airbus A330 documentation that allowed a specific use of manual thrust in difficult environmental conditions. Airbus advised that after an analysis of in-service events the procedure was removed from all operational documents. A flight crew operations manual (FCOM) Bulletin was published at the time which explained the removal of the procedure
Manipulation of the thrust levers in this manner had the effect of:
disengaging the autothrottle thereby inhibiting some of the available auto flight system protections including the target speed function (which automatically maintained the desired speed and adjusted for fluctuation in the wind), and the vertical speed reduction function
causing a pitch up tendency – as underslung engines increase thrust, they typically apply an upward pitching moment to the aircraft. This usually requires a large nose down input by the pilot flying to prevent the aircraft from pitching up. At this stage in the approach applying large nose down inputs differed from the gradual nose up input normally required to complete the flare.
breaking down of the shared mental model between the pilot flying and pilot monitoring in that the pilot monitoring believed the advancement of the thrust levers was the initiation of a go-around.
Shortly after this action, the aircraft touched down at a vertical speed of approximately 700 feet per minute and a vertical acceleration of 2.61 G was recorded. The aircraft also touched down at approximately 170m (560 feet) from the landing threshold, short of the normal touchdown zone of between 304m (1000 feet) and 609m (2000 feet).
The manufacturer of the aircraft produced a complete load analysis of the event based on recorded flight data provided by the operator. The conclusion of this analysis was that several components in the left and right gear had “exceeded their design load limits and may have been detrimentally overloaded”.
The manufacturer’s analysis assessed the affected components to be unserviceable and requiring replacement before the next flight. Several supplementary inspections were also required.
There were no injuries reported as a result of the hard landing.
Figure 4: Graphical representation of the flight data from the incident approach
A stable approach is a crucial element of final approach. Identifying an unstable approach and taking the appropriate corrective action is key to maintaining safety at touch down. This analysis examines the stability of the aircraft and the decision making in the final stages of the approach.
Stability of the final approach
Information published by the Flight Safety Foundation (Flight Safety Digest, August 2004, Stabilized Approach and Flare Keys to Avoiding Hard Landings) indicated that in 2004, hard landings were the highest number of recorded accidents in the preceding 10 years. The study found that a stable approach and flare were key to avoiding hard landings.
Analysis of the flight data relating to the stability of the final approach showed from 300 feet the approach was unstable due to large control inputs, erratic rates of descent and deviation below the glide path. Throughout the final approach, the PF’s sidestick inputs determined the aircraft’s vertical profile and, in the absence of any external factors, were therefore contributing to the unstable approach.
Monitoring and Communication
Researchers (Klein 1999, Kahneman, 2011) have stated that, in time-constrained environments, individuals can make decisions using intuitive reasoning where the steps are often unconscious and based on pattern recognition. For intuitive decision-making, an experienced individual will identify a problem situation as similar to a situation they have dealt with before and will extract a plan of action from memory. If time permits, they will confirm their expectations prior to initiating action. If time does not permit, actions will be initiated with uncertainty that may result in a poor decision.
In this investigation, the PM was late to recognise that the approach was unstable and as such did not encourage the PF to conduct a go-around, as per the operator’s standard operating procedures.
During the last 50 feet of the approach (4 seconds before touch down) the PF inappropriately used the thrust levers in an attempt to arrest the high rate of descent. Despite the absence of the standard phraseology of ‘go-around’ by the PF, the PM mistook this advancement of the thrust levers as the initiation of a go-around. The PM, expecting that the PF had initiated a go-around and realising that the aircraft was still descending with a nose-down attitude, placed their hand on the sidestick and applied a nose up input. A dual input was therefore recorded as the aircraft touched down.
Probably due to time constraints, neither crew member communicated their intentions. Neither the initial thrust advancement nor the subsequent thrust reversal by the PF were communicated to the PM. As a result, the PM was unclear about the action taken by the PF.
Continuation of the approach
Large and erratic pitch inputs by the PF, as well as large fluctuations in the rate of descent and visual reference of the PAPI lights provided opportunities for the crew to recognise an unstable approach. Despite this, there was no evidence of actions or support language to suggest that the unstable approach was identified. The operator’s procedures whereby an unstable approach should result in a go-around, were not followed.
The manual thrust technique used by the captain to arrest the sink and recover the approach was used on other aircraft types previously flown by the captain. There was no current approved procedure on the A330 for this technique. However, analysis of the flight data determined that this action alone did not contribute to or increase the severity of the hard landing.
The captain and first officer advised at interview that, in retrospect, they should have conducted a go-around in accordance with the operator’s training procedures. The Flight Safety Foundation publication noted earlier indicated that runway contact from a late go-around is preferable to attempting to recover an unstable approach.
Elements of an unstable approach are not unusual during flight operations. However, the actions taken by flight crew in response are key to maintaining flight safety. The training records of the crew were reviewed to establish the possibility that a training or performance issue led to the PF’s actions. Apart from the PF’s misunderstanding of the use of the thrust levers to reduce the rate of descent, there was no indication of a systemic issue with either crew member.
Findings
From the evidence available, the following findings are made about the hard landing involving an Airbus A330-343, registered 9M-MTA that occurred at Melbourne Airport, Victoria on 15 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The final approach became unstable at around 300 feet above the ground due to the control inputs from the captain.
Inadequate monitoring and communication by the crew led to a lack of recognition of the undesirable flight state and the continuation of an unstable approach.
Continuation of the unstable approach led to a high rate of descent at touchdown and resulted in a hard landing in excess of the aircraft design loads and short of the normal touchdown area.
Other safety factors
The captain used an unapproved manual thrust procedure in an attempt to recover the approach.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Flight recorder data.
Airbus
Malaysia Airlines Safety
Flight Safety Foundation
References
Klein, G. (1999). Sources of power: How people make decisions. Cambridge, MA: MIT Press.
Kahneman, D. (2011). Thinking, fast and slow. New York: Farrar, Straus and Giroux.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority (CASA), Malaysian Airlines Berhad, the Malaysian Ministry of Transport and Airbus.
Submissions were received from Airbus and CASA. The submission were reviewed and where considered appropriate, the text of the draft report will be amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
