On 20 March 2015, at about 1140 Eastern Standard Time (EST), a Robinson R22 helicopter, registered VHHUA, departed from Stanbroke Station for a private flight to Devoncourt Station, Queensland. On board were a pilot and one passenger. The main fuel tank was filled to capacity prior to departure, with 68 L of fuel. While en route between the two stations, the pilot was assessing the water available for stock by overflying water holdings.
At about midday, while about 500 ft above ground level, the helicopter approached a gorge. To assess the water quantity in the gorge, the pilot conducted a descent to about 100 ft and slowed the helicopter to a hover. As the pilot shifted his focus outside, the rotor revolutions per minute (RPM) decreased, the low rotor RPM warning horn sounded and the helicopter commenced descending. The pilot immediately lowered the collective[1] and turned the helicopter away from the higher gorge walls in an attempt to increase forward speed and rotor RPM. He was unable to regain sufficient rotor RPM and the helicopter continued to descend.
The right skid landed heavily on uneven ground, followed by the left skid. The main rotor then collided with a rock and the helicopter rolled onto its right side. The pilot and passengers exited the helicopter and were not injured. The helicopter sustained substantial damage (Figure 1).
Figure 1: Damage to VH-HUA
Source: Aircraft operator
Local conditions
The temperature at the time was about 42 °C and the elevation of the area was about 1,000 ft above mean sea level. The pilot reported the wind was southerly at about 10-15 kt, but the gorge was sheltered and the wind in the vicinity of the accident was calm.
Pilot comments
The pilot reported that his attention was momentarily diverted outside checking the water, when he would normally be watching the gauges and monitoring the rotor RPM. He usually operated without a passenger on board, so the extra weight of the passenger had reduced the helicopter’s performance, particularly its ability to maintain a hover out of ground effect.
Power required and power available
A number of factors related to the power required and the power available may have contributed to the decaying main rotor RPM during a hover out of ground effect.[2] These factors include density altitude, take-off weight and the wind component.
Density altitude. Increasing density altitude adversely affects helicopter performance through the combined effects of reducing the power available and increasing the power required. Considering elevation and temperature, and barometric pressure in the area, the density altitude at the accident site would have been around 4,000 ft. High relative humidity would have had the effect of further increasing the density altitude.
Operating weight. Increasing the helicopter weight increases the power required. The greater lifting force demanded of the main rotor, and the requirement to counter the associated increased torque effect[3] with the tail rotor, both contribute to an increased power requirement. The weight of the helicopter at the time of the accident was less than the maximum permitted operating weight, but reduced the ability to hover out of ground effect.
Wind component. A nil wind component increases the power required because of the diminished or delayed influence of translational lift.[4]
The following references discuss factors affecting helicopter performance, and provide some guidance to pilots regarding the associated considerations:
A ‘Good Aviation Practice’ booklet titled Helicopter Performance, produced by the Civil Aviation Authority (CAA) of New Zealand. The booklet is available via the CAA website.
The Federal Aviation Administration (FAA) Helicopter Flying Handbook (chapter 7 deals with helicopter performance). The handbook is available on the FAA website.
Safety message
The Robinson R22 Pilot’s Operating Handbook includes a number of important safety tips and notices. Pilots (particularly those who fly Robinson helicopters) are encouraged to carefully reflect on these safety tips and notices – the tips are intended to improve safety, while the notices have been issued as a result of various accidents and incidents. The R22 Pilot’s Operating Handbook – Section 10 Safety Tips and Notices is available at Robinson Helicopter website.
The Robinson Helicopter Company Safety Notice SN-10: Fatal accidents caused by low rpm rotor stall, advised that a ‘primary cause of fatal accidents in light helicopters is failure to maintain rotor RPM. To avoid this, every pilot must have his reflexes conditioned so he will instantly add throttle and lower collective to maintain RPM in any emergency’.
Three other ATSB investigation reports that identified helicopter performance and low main rotor RPM as possible factors include AO-2013-203, 200600979 and 199900833. These investigation reports are available on the ATSB website.
This incident provides a reminder of the effect of density altitude, weight, and wind on helicopter performance. Pilots are encouraged to carefully and accurately assess these factors to ensure that an adequate performance margin is maintained. When performance is likely to be adversely affected by a combination of these factors, extreme caution is warranted.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 March 2015 Airbus A330, registered 9M-XXM and operated by Malaysian‑based airline AirAsia X, was conducting a regular passenger service from Sydney, New South Wales to Kuala Lumpur, Malaysia. On departure from runway 16R the aircraft was observed by air traffic control to enter the departure flight path of the parallel runway 16L. Following advice from air traffic control, the flight crew identified a problem with the onboard navigation systems. Attempts to troubleshoot and rectify the problem resulted in further degradation of the navigation system, as well as to the aircraft’s flight guidance and flight control systems. The crew elected to discontinue the flight but were unable to return to Sydney as the weather had deteriorated in the Sydney area and the available systems limited the flight to approaches in visual conditions. The aircraft was instead radar vectored to Melbourne, Victoria and the flight completed in visual conditions.
What the ATSB found
The ATSB found that when setting up the aircraft’s flight management and guidance system, the captain inadvertently entered the wrong longitudinal position of the aircraft. This adversely affected the onboard navigation systems however, despite a number of opportunities to identify and correct the error, it was not noticed until after the aircraft became airborne and started tracking in the wrong direction. The ATSB also found that the aircraft was not fitted with an upgraded flight management system that would have prevented the data entry error via either automated initialisation or automatic correction of manual errors.
The flight crew attempted to troubleshoot and rectify the situation while under heavy workload. Combined with limited guidance from the available checklists, this resulted in further errors by the flight crew in the diagnosis and actioning of flight deck switches.
Finally, the ATSB identified that effective monitoring and assistance by air traffic control reduced the risk to the occurrence aircraft and other aircraft in the area.
What's been done as a result
In response to this occurrence the aircraft operator undertook safety action, including:
the development of a training bulletin and package for its flight crews that emphasised the correct operation and alignment of the air data and inertial reference system
sharing the lessons learnt from the operator’s internal investigation with all pilots and reviewing the recovery procedures to be undertaken in the form of a flight safety notice.
Safety message
This occurrence highlights that even experienced flight crew are not immune from data entry errors. However, carrying out procedures and incorporating equipment upgrades recommended by aircraft manufacturers will assist in preventing or detecting such errors.
Additionally, the airborne management of this occurrence illustrates the importance of effective communication when dealing with an abnormal situation under high workload conditions. This is especially the case when there is limited guidance available to resolve the issue.
Photograph of A330-343 9M-XXM
Source: Airliners.net
The occurrence
On 10 March 2015, Airbus A330-343X (A330), registered in Malaysia as 9M-XXM, was scheduled to fly from, Sydney, New South Wales to Kuala Lumpur, Malaysia. The flight was a daily passenger service operated by the Malaysian-based airline Air Asia X.
The aircraft was scheduled to depart at 1155 Eastern Daylight‑saving Time[1] from gate 54 of the Sydney Airport International Terminal. The operating crew consisted of a captain, who was initially pilot monitoring (PM), a first officer (FO) who was initially pilot flying (PF), and eight cabin crew.[2] All crew signed on for duty 60 minutes prior to departure to allow for pre-flight preparation.
During routine operations the PF was responsible for actioning the majority of the cockpit preparation procedures once the preliminary cockpit preparations were completed by both flight crew. While this was underway the PM would typically conduct the pre-flight external inspection of the aircraft. However, on this morning the captain instructed the FO to conduct that inspection and completed the cockpit preparation procedure. The captain stated that this was because the captain’s hearing protection was not available for the external inspection. That reason was not communicated to the FO.
The cockpit preparation procedures included the alignment and initialisation of the aircraft’s air data and inertial reference system (ADIRS) (see the section titled Air navigation system). As well as other functions, the ADIRS provides much of the aircraft’s position, heading and tracking information. For 9M-XXM in particular, the flight crew operating manual procedures for initialisation of the ADIRS required the confirmation of an initial aircraft position in order to carry out these navigational functions. The operating manual also stated that the most appropriate position for this initialisation was the departure gate coordinates.
The captain reported that while carrying out the position initialisation procedure, he manually copied the gate coordinates displayed on a sign outside the cockpit window into the scratchpad of the multipurpose and control display unit (MCDU) (Figure 1). He then submitted these coordinates to the flight management and guidance system (FMGS) using the ALIGN IRS prompt on the MCDU. Flight data and analysis of the occurrence shows a data entry error occurred at this time during the entry of the longitude of the gate coordinates into the MCDU (see the section titled Aircraft heading indications).
Figure 1: At left, Gate 54 showing the coordinates sign and, at right, the MCDU used during the ADIRS initialisation with the ALIGN IRS prompt highlighted in red (Note: the MCDU does not depict the gate 54 coordinates)
Source: Sydney Airports Corporation Limited and Airbus, modified by the ATSB
The captain reported completing much of the cockpit preparation before the FO returned from the external inspection. Once the operator-determined route was entered, this included crosschecking the tracks and distances produced by the FMGS against the paper flight plan produced by flight dispatch. The captain also reported checking the progress page of the MCDU, which indicated GPS PRIMARY for position referencing and updating, and the accuracy of positioning as HIGH. The captain stated that these checks confirmed that the system was set up correctly.
The FO stated that, on return from the external inspection, the majority of the cockpit preparation had been completed. The FO then checked the data entries and switch positions as per the operator’s procedure, including crosschecking the tracks and distances as determined from the FMGS with the paper flight plan. The FO reported also checking the progress page of the MCDU, which indicated GPS PRIMARY for position referencing and updating, and the accuracy of positioning as HIGH. The FO stated that this confirmed their understanding that the system was set up correctly.
During the crosscheck of the cockpit preparation, the FO reported seeing a flag or indication flash up on the captain’s navigation display (ND), but that it was too quick to interpret. The FO did not mention this to the captain as there was no associated electronic centralised aircraft monitoring (ECAM) or STATUS message.
Both flight crew stated that a take-off brief was conducted with reference to the FMGS data and flight deck switch positions, and that the BEFORE START checklist was carried out.
The aircraft pushed back from gate 54 at 1153, 2 minutes ahead of schedule. The crew stated that, at around the time of engine start, both heard a single chime without any associated ECAM or STATUS message. A single chime is an aural alert often associated with an ECAM MASTER CAUTION message to indicate that the aircraft’s systems have detected a fault. Both flight crew stated that they did not look towards the overhead panel or MCDU and, as there was no associated ECAM or STATUS message, they continued with normal procedures.
The flight crew completed the engine start and the AFTER START checklist was actioned. The aircraft was then cleared to taxi to the full length of departure runway 16R. There were several aircraft ahead of 9M-XXM in the departure sequence, requiring the flight crew to hold on a taxiway for several minutes. The flight crew reported that, just prior to being cleared to line-up on the runway, they heard two independent chimes in close proximity. They stated that they checked the STATUS page and ECAM but that there were no other abnormal indications so they continued with the line-up.
The FO commenced take-off from runway 16R with the captain monitoring take-off parameters and thrust settings. Immediately after the aircraft was rotated, the enhanced ground proximity system (EGPWS) activated with the aural alert TERRAIN, TERRAIN. This alert would normally indicate a conflict with the ground or obstacles in the aircraft’s immediate flight path. The next phase of the EGPWS is for automated aural and visual instruction on the flight crew’s NDs to PULL UP. Although both flight crew reported the expectation that this would occur, for reasons believed to be associated with spurious activation, this did not take place.
Flight crew are trained to conduct an EGPWS escape manoeuvre in response to the second phase warning by applying up to full back pressure on the control stick and the auto‑throttle applies high levels of thrust to climb the aircraft away from any conflicting terrain in the shortest distance. The captain stated that, as it was daytime and 9M-XXM was clear of cloud, it was possible to visually confirm that no terrain conflict existed. As such, the captain instructed the FO to disregard the TERRAIN alert and continue with the normal take-off. Both crew stated that, while the alert had startled them, a full response to a spurious EGPWS warning was undesirable in the Sydney area due to an increased likelihood of conflicting with other aircraft.
Flight data of the occurrence flight identified that the autopilot was engaged at an altitude of 410 ft and that the aircraft then commenced a gradual left turn over 14 seconds onto a magnetic heading of 132°, although 170° was being incorrectly displayed on the aircraft’s main heading indicators. The captain reported their departure to air traffic control (ATC), stating they were tracking via the DEENA 5 standard instrument departure (SID), passing 900 ft and climbing to 5,000 ft as per their departure clearance (appendix A). That transmission was acknowledged by ATC and the aircraft was cleared to climb to flight level (FL) 280.[3]
A few seconds later, ATC observed the aircraft turning left, contrary to the SID, and tracking towards the flight path for the active parallel runway, runway 16L. In response, ATC contacted the crew and requested confirmation that they were tracking via the SID and would be maintaining a heading of 155° before turning right. At the same time ATC held another aircraft in the line-up position for departure from runway 16L (Figure 2).
Figure 2: During departure 9M‑XXM initially turned left, instead of right, and crossed the departure flight path of the parallel runway 16L (displayed here in blue). Note the standard instrument departure chart caution against turning left. The DEENA 5 SID is depicted in green
Source: Google earth, modified by the ATSB
ATC audio recordings indicated an initial hesitance in the captain’s reply to ATC, first confirming the heading and then asking ATC to standby as they had lost their primary instruments. During interviews the crew stated that once the EGPWS alert was assessed as spurious, and the decision not to carry out an EGPWS escape manoeuvre made, the crew noticed that all of the expected navigation waypoints and tracking information were not displayed on the ND. Instead, an amber GPS PRIMARY LOST message appeared on the NDs together with an unusual tracking line without an associated waypoint (Figure 3).
Figure 3: Photograph of an exemplar ND and the primary flight display during a simulated recreation of the flight scenario. Note the GPS PRIMARY LOST message (in yellow) at the bottom-left of the photograph and the green tracking line emanating from the white aircraft depiction at the centre of that representation
Source: Air Asia X
Following advice from the captain of the degraded flight display, ATC informed the flight crew that radar showed the aircraft was maintaining an approximate heading of 130°. The controller then instructed the flight crew to turn right onto a heading of 220° with reference to the main heading indicators. Once established on that heading, ATC requested the flight crew to report the heading displayed on the aircraft’s standby compass, to which the flight crew reported 180°. The controller confirmed that 180° matched the aircraft’s radar heading and used this heading offset to provide radar vectoring clear of other traffic in the Sydney area while also limiting the altitude of the aircraft to FL160 due to overflying conflicting traffic. The controller then requested the flight crew’s intentions, to which they replied that they would attempt to restore the aircraft’s systems before continuing on to Kuala Lumpur.
During interviews the flight crew stated that, following identification of the system problem, the captain adopted the role of PF with the autopilot engaged and managed the radio communication to allow the FO to troubleshoot the situation and attempt to restore normal system functionality. The captain advised that, as there were no ECAM or STATUS messages for guidance, the only instruction he gave the FO was to ‘Reset the nav’.
The FO stated that, in the absence of any ECAM or STATUS messages his initial reaction was to reference the UNRELIABLE AIRSPEED INDICATION checklist in the quick reference handbook (QRH). This was in order to provide the captain with attitude and thrust settings in the event that the airspeed indications were affected. This emergency checklist had been part of a recent training/checking exercise the crew had undergone in response to an occurrence involving another A330. In that occurrence, some of the aircraft’s external sensors had blocked with ice, which affected the air data reference (ADR), part of the ADIRS, and subsequently provided erroneous airspeed indications.
The FO recalled then reaching a mindset that there was an issue with the aircraft’s ADR. As part of the ADIRS, information from the ADR provided temperature, aerodynamic, and barometric information from multiple air data sources to much of the aircraft’s primary flight guidance, flight controls and engine controls. The ADR CHECK PROCEDURE is incorporated in the UNRELIABLE SPEED INDICATION checklist that was recently referenced by the FO.
The FO then attempted to program a waypoint and a radio navigation aid. Both were unsuccessful as the FMGS appeared unresponsive to inputs. The FO stated that the absence of an ECAM or STATUS indication hindered their ability to locate a checklist in the QRH that offered a resolution to the situation. As a result, the FO started searching the electronic FCOM on the company‑provided iPad™. ATC continued to provide radar vectoring, climb and stop-climb instructions and request updates of the crew’s intentions.
The FO informed the captain that, in order to attempt to reset the system, it was intended to cycle the three air data and inertial reference unit (ADIRU) rotary switches on the overhead panel from NAV to OFF (Figure 4), and that this would likely cause the autopilot to drop out. The ADIRU rotary switches influence both the ADR and inertial reference parts of the respective ADIRU, and have a greater combined effect on aircraft systems compared with the individual ADR and/or inertial reference push-buttons available on the same overhead panel (Figure 4) (see the section titled Context).
During interview the captain and FO stated that the captain’s response was simply ’Yes’. The FO recalled initially holding their hand in the vicinity of the rotary switches awaiting confirmation from the captain to cycle them to OFF. Both crew recalled that ATC instructions then disrupted the normal process of confirmation before actioning critical flight deck switches. Once the ATC instruction was acknowledged and complied with, the FO turned ADIRU 1 and 3 OFF without clarifying the captain’s confirmation for the action. In response, several flight guidance and navigation systems degraded and the autopilot disengaged. The captain instructed the FO to stop actioning the switches, with ADIRU 2 remaining in the NAV position.
Figure 4: ADIRU rotary switches and individual inertial reference and ADR fault lights and OFF push‑buttons on the A330 flight deck overhead panel
Source: Airbus
Once ADIRUs 1 and 3 were selected OFF, the captain’s primary flight display (PFD) lost all information except accurate airspeed and vertical speed, and the captain’s ND displayed the GPS PRIMARY LOST, HDG and MAP NOT AVAILABLE warning flags (Figure 5). In addition to the information remaining on the captain’s PFD, the FO’s PFD continued to display accurate airspeed, vertical speed and attitude information, but the displayed heading information was incorrect. The FO’s ND also displayed incorrect heading information and there was no usable map, waypoint or tracking information. The autopilot and autothrust systems were also unavailable, and the aircraft had reverted from ‘normal law’ to ‘alternate law’. This affected some of the aircraft’s handling characteristics and flight envelope protections (see the section titled Flight control lawsand Alternate law). The integrated standby instrument system, located on the forward instrument panel, continued to provide aircraft attitude from its own internal accelerometer and gyrometer, and uncorrected airspeed from the standby pitot and standby static probes. The standby compass provided heading information, but this was affected by any slight aircraft acceleration (Figure 5).
Figure 5: Simulator recreation of the captain’s PFD and ND after the ADIRU 1 and 3 switches were selected off. Note the GPS PRIMARY LOST message (in amber) at the base of the photographs and the HDG and MAP NOT AVAIL message (in red) at the centre-upper of the photographs
Source: Air Asia X, modified by ATSB
In consideration of the degraded flight systems, the crew notified ATC that they wished to discontinue the flight and return to Sydney Airport. However, as both NDs and the captain’s PFD were unusable, they advised that they were only capable of conducting a visual approach. In response, ATC advised that since their departure, the weather at Sydney had deteriorated to a cloud base of 1,700 ft with showers in the area and, as such, a visual approach was not possible.
After consideration of the available alternatives, ATC established that en route and arrival conditions for Melbourne Airport, Victoria (approximately 390 NM (722 km) to the south‑west of Sydney) were clear with only a few[4] clouds at 3,000 ft in the vicinity of the airport. The flight crew considered and accepted the option of recovering to Melbourne Airport and ATC coordinated with the en route, arrival, approach and Melbourne tower controllers for the flight crew to receive continuous radar vectors from the aircraft’s current position to touchdown in Melbourne.
The flight crew continued their attempts to restore the flight guidance and navigation systems while in the Sydney area. The FO then carried out the IRS ALIGNMENT IN ATT MODE checklist from the QRH, restoring some ND and PFD functions; however, the heading needed to be periodically updated to allow for inertial drift. As per system design, the aircraft also remained in alternate law, and the autopilot and autothrust systems remained inoperative.
The crew received radar vectors and climb clearances to FL 310 en route to Melbourne. The aircraft was manually-flown by the captain for the transit. The captain reported that increased sensitivity in roll was the most notable handling characteristic of alternate law. However, given the clear daylight conditions and radar coverage, the flight was manageable and the aircraft was radar vectored to short final for runway 16 at Melbourne Airport (Figure 6). During the approach, with the aircraft fully-configured for a Flap 3 landing as per the alternate law checklist, the flight crew noted the aircraft became high on approach with the airspeed too high. As a result, the crew discontinued the approach and conducted a go-around.
Both flight crew stated that, during the initial part of the go‑around, they heard an aural warning similar to a flap overspeed warning. This warning indicated the aircraft’s speed was too high for the selected flap setting. However, on checking their airspeed, both flight crew noted that it was below the maximum permissible 186 kt for the Flap 3 configuration being used. Flight recorder data indicated that the maximum recorded speed was 185 kt for 1 second while in this configuration and the post‑flight report[5] did not record any airspeed exceedances during any phase of the flight.
An EGPWS alert activated at approximately 600 ft during the initial approach at Melbourne, seconds prior to the commencement of the go‑around. An assessment of recorded parameters indicated that, as with the EGPWS alert departing Sydney, this was also a spurious warning associated with the aircraft’s incorrect position information. There was no indication that the flight crew responded to the EGPWS approaching Melbourne.
The crew conducted a visual circuit and landed runway 16 at 1403, 1 hour 54 minutes after becoming airborne in Sydney. The aircraft landed below the maximum landing weight with the use of a single thrust reverser (see the section titled Aircraft information). Fuel jettison was not necessary due to high fuel burn while troubleshooting near Sydney at relatively low altitudes. On exiting the runway, the flight crew informed ATC that emergency services were not necessary and the aircraft taxied to a terminal gate.
Extensive troubleshooting was carried out on the aircraft and its systems by ground engineering services. This included swapping around of the ADIRUs and powering down the entire FMGS to try and replicate the situation encountered by the flight crew. No faults were found.
After 2 hours 58 minutes on the ground, 9M-XXM departed for Kuala Lumpur with the original flight and cabin crew as the operating crew. The flight to Kuala Lumpur was reported as uneventful with a total duty time 14 hours 53 minutes and a total flight time of 10 hours 27 minutes over the two sectors.
Figure 6: Visual depiction of the flight from Sydney to Melbourne, including an inset of the departure from Sydney (right of the two graphics)
Both flight crew reported having 24 hours rest at a hotel in Sydney prior to the occurrence flight, and having received adequate rest and sustenance. Both reported being in good health with no external stresses or distractions.
Captain
The captain held an Air Transport Pilot (Aeroplane) Licence with an Airbus A330 command endorsement. He held a current Class 1 medical with a requirement to wear vision correction. The captain had a total of 22,580 hours flying experience, mostly on Boeing‑type aircraft flying for other operators. He had converted to the A330 as a captain approximately 18 months prior to the occurrence, when commencing employment with Air Asia X.
First officer
The first officer (FO) held a held an Air Transport Pilot (Aeroplane) Licence with an Airbus A330 P2 (copilot) endorsement. He held a current Class 1 medical without restrictions. The FO had a total of 2,200 flying hours, converting as FO to the A330 approximately 2 years prior to the occurrence, when commencing employment with Air Asia X.
Aircraft maintenance information
Maintenance status
On arrival at the aircraft, the captain and FO were met in the aircraft’s cabin by the previous flight crew. They were informed of a Minimum Equipment List (MEL) item that recorded one of the engines’ thrust reversers being inoperative, as well as a minor defect affecting one of the aircraft’s taxi lights. An inoperative thrust reverser and/or taxi light is a permissible fault with only minor impact on A330 operation and deemed not relevant to this occurrence.
Airbus service bulletin
Airbus service bulletin SB 34-3287 Enhanced ADIRU alignment on GPS position became available in 2013 and was recommended by Airbus for incorporation in the A330. This service bulletin is designed to upgrade the air data and inertial reference system (ADIRS) (see the section titled Aircraft navigation system) in various A320, A330, and A340 aircraft such that position initialisation occurs automatically using the aircraft’s global positioning system (GPS)-derived position or, in the event the initialisation is carried out manually, when the pilot-entered initialisation position is crosschecked with the GPS position. If the crosschecked positions are not consistent, the pilot-entered position is rejected. Airbus advised that the objective of this service bulletin was to reduce the time required for ADIRS alignment and to reduce positional data entry errors.
Although recommended by Airbus, this service bulletin SB 34-3287 was not mandatory. At the time of writing, approximately 46 per cent of the 515 aircraft affected by the service bulletin have completed the upgrade. Airbus records suggest that approximately two occurrences are reported per annum that are attributable to position initialisation error in aircraft that have not been upgraded.
For reasons that could not be determined, 9M‑XXM, had not received the ADIRS upgrade detailed in service bulletin SB 34‑3287.
Aircraft systems
Air data and inertial reference system
System overview
The ADIRS provides important information about the outside environment (such as air pressure and temperature), the aircraft’s state relative to the outside air (such as airspeed, altitude and angle of attack), and the aircraft’s state relative to the earth (position, motion and orientation).
To provide redundancy, the ADIRS includes three air data inertial reference units (ADIRU 1, ADIRU 2, and ADIRU 3). Each is of the same design, provides the same information, and operates independently of the other two.
Each ADIRU has two parts, an air data reference (ADR) part and an inertial reference (IR) part, which are integrated into a single unit (Figure 7).
Figure 7: ADIRS architecture
Source: ATSB investigation 200700065, available at ATSB website
Air data reference part
The ADR part of the ADIRU provides information about the aircraft’s movement through the air and atmospheric information. It obtains its inputs from sensors mounted on the aircraft’s fuselage.
Each ADIRU has its own independent sensors. An angle of attack sensor and a total air temperature probe provide data directly to the ADIRU via analogue electrical signals. In addition, a pitot probe and two static ports provide data to the ADIRU via air data modules, which convert air pressure signals to digital signals.
Inertial reference part
The IR part of the ADIRU provides information about the aircraft’s position, orientation, and velocity with respect to the earth. It obtains its data from a set of inertial instruments in each ADIRU, which continually measure acceleration in all three axes (pitch, roll and yaw) as well as rotational movement.
The IR part constantly updates the aircraft’s three-dimensional position and orientation based on the movement it senses from a known starting position and orientation. The process of determining this starting position is known as ‘position initialisation’, and occurs prior to each flight when the aircraft is stationary. Subsequent inertial measurements change the calculated position, orientation and velocity by a very small amount for each measurement cycle. As the IR parameters are dependent on previous values, an error during position initialisation would affect subsequent values. The IR parameters are also highly interdependent, and an error in one parameter would affect other parameters.
Global position inertial reference system
Each ADIRU receives GPS data from one of two multi-mode receivers to augment the inertial reference computations. The two GPS receivers can only influence the flight management and guidance system (FMGS) via the inertial reference system (IRS) in the form of a hybrid global positioning/inertial reference system (GPIRS) position, and could not provide stand-alone positional information directly to the FMGS. In the event of a gross disparity between the position calculated by the GPS receivers and the IR-calculated position, the GPS position would be invalidated and the FMGS would use the IR-only mixed position (Figure 8).
Figure 8: Hybrid GPS architecture. Note that GPS data is received via the IRSs and not directly from the GPS to the FMGS (referred to as FMS in this diagram)
Source: Airbus
ADIRS control panel
The ADIRS control panel provides local fault indications for each part of each ADIRU. If there is a fault with the IR part of an ADIRU, an amber FAULT light illuminates. The relevant part of the ADIRU can be deactivated by pressing the OFF push-button below the fault light. The ADR part of the ADIRU operates in the same manner (Figure 9).
Figure 9: ADIRS control panel containing rotary switches as well as individual IR and ADR FAULT lights and OFF push-buttons.
Source: Airbus
The panel also has an IR mode rotary selector for each ADIRU that allows flight crew to select one of three modes:
OFF, resulting in the ADIRU not being energised and the IR and ADR parts being unavailable
NAV, meaning that the ADIRU supplies full inertial data and air data to other systems (normal mode of operation)
ATT, where the ADIRU supplies full air data but limited inertial data (only attitude and heading information) to other systems.
The ADIRS control panel is located on the flight deck’s overhead panel (Figure 10)
Figure 10: Overhead panel showing the ADIRS control panel (at inset) and relative cockpit position of a number of displays and controls
Source: ATSB investigation 200700065, available at ATSB website
Aircraft heading indications
In aircraft equipped with IRSs, magnetic heading is derived from true heading, which references true north, and then adding or subtracting the magnetic variation (the difference between true and magnetic north for that geographic longitude). The magnetic variation for Sydney at the time of the occurrence was 12.56° east at a longitude of 151° 9.8’ east. The flight data recorder showed that the longitude manually entered by the captain at ADIRS initialisation was 15° 19.79’ east. This equates to a position off the coast of Cape Town, South Africa, about 11,000 km from Sydney Airport. The magnetic variation for this position is 23.57° west. The cumulative difference in magnetic variation between these two points (the actual longitude of the aircraft (Sydney Airport), and that calculated using the incorrectly entered longitude, off South Africa) equates to 36.13°. The difference between the runway direction and the magnetic heading indicated by the aircraft was approximately 38°.
The standby compass gets its reading directly from the earth’s magnetic field and therefore was not affected by the magnetic variation.
Procedural controls
In modern aircraft systems the ability to prevent, detect and/or rectify an error or fault is achieved largely through the use of procedural controls. Procedural controls include, but are not limited to, standard practices and procedures that the crew are trained to undertake throughout the flight to ensure the systems are set-up and running correctly. They are often referred to as standard operating procedures and abnormal procedures, both of which encompass such things as the standardised and coordinated order in which a series of steps are undertaken (scan action flows), and checklists to ensure that the pertinent steps are completed correctly. These scan action flows and checklists are described in the flight crew training manual (FCTM), flight crew operations manual (FCOM) amplified procedures, quick reference handbook (QRH) and flight crew operations manual supplementary procedures (FCOM SUPS). These standardised and ordered actions are supplemental to sound aircraft system knowledge and good piloting practices gained through training and experience.
Initialisation of the air data and inertial reference system
Part of the cockpit preparation procedures involved the alignment of the ADIRS. As detailed previously, this system utilised three independent ADIRUs, as well as GPS and air sensors to complete its multiple functions.
The exact procedure and requirement for ADIRS alignment varied slightly between aircraft subject to the age, manufacture and service bulletin status of the FMGS components. This status was listed in the various operating and training manuals by the Airbus manufacturer serial number for each aircraft. For 9M- XXM, this serial number was 0741.
In the case of 9M-XXM, a full alignment was carried out by first selecting all three ADIRS rotary selectors on the overhead panel to OFF for more than 5 seconds and then selecting these to NAV. The next step involved the position initialisation of the IRS. Using the multipurpose and control display unit (MCDU) position initialisation page, the crew can check/modify the MCDU coordinates before submitting these to the ADIRS.
With regard to the best position for IRS initialisation, the FCOM SUPPS included the following text:
The most appropriate coordinates for IRS position initialisation are the gate coordinates.
When the flight crew enters or modifies the origin airport (FROM) or the CO RTE, the MCDU INIT coordinates are reset to the Aerodrome Reference Point (ARP). The pilot may manually modify these coordinates.
The FCTM also included the following text applicable to 9M-XXM:
MANUAL POSITION INITIALIZATION (AIRCRAFT WITH OR WITHOUT MP S16804)
The coordinates of the departure Airport Reference Point (ARP) are displayed on the MCDU INIT page.
However, the most appropriate coordinates for IRS position initialization are the gate coordinates.
In this case, and in order to avoid entry errors, the flight crew should use the slew keys successively for latitude and longitude, instead of inserting the coordinates on the scratchpad.
The slew keys mentioned in the FCTM were two up and down keys on the MCDU that allow the pilot to incrementally adjust a value displayed on the MCDU screen, without having to retype the entire value. In the case of the ADIRS initialisation, these slew keys enabled the pilot to adjust the latitude and longitude of the initialisation position from the ARP to the gate coordinates without having to retype the entire coordinates. (Figure 11)
Figure 11: Slew key indicators on the MCDU
Source: Airbus
The FCOM also included the following text in specific reference to what will occur in the event of an initialisation error in the Honeywell flight management system 2 (FMS2) as installed in 9M‑XXM:
The Prompt REALIGN IRS is displayed on MCDU INIT Page:
Check and confirm the position initialisation coordinates on MCDU, then valid prompt.
The IRS record the last position it had the last time it was in NAV mode. The IRS are also able to estimate the present latitude during a complete alignment. They use both information to detect significant position initialisation error.
Further procedural controls are included during aircraft taxi and are designed to detect error prior to take-off, when the error can be rectified. The FCOM states:
During taxi, a good way to check the global consistency of FMGS entries (Position and flight plan) is to check the runway and the SID on the ND, in comparison to the aircraft symbol that indicates the current aircraft position. To do so, set the ND in ARC or NAV mode with a range 10 nm.
On the POSITION MONITOR page, check that the IRS are in NAV mode, and check that the distance between each IRS and the FMS position is lower than 5 nm. Select ND in ROSE-NAV or ARC mode, and confirm that then of the airport, the SID and the surrounding NAVAIDS.
GPS primary lost
System design dictated that if the GPS inputs passed both an integrity and accuracy check then the FMGS would enter GPS primary, and the GPS signals would have primacy as the source of position information. If GPS primary was active for more than 10 minutes, and if the GPS integrity or accuracy check then failed because of an anomaly with the satellite array, the GPS signal is invalidated (as described above). The IRS output then reverts to the IR-only mixed position and eventually GPS PRIMARY LOST is displayed on the ND, and cannot be cleared by the crew. (Figure 12)
Figure 12: GPS PRIMARY LOST displayed (in amber) at the bottom-left of an exemplar ND
Source: Air Asia X, modified by the ATSB
Electronic centralised aircraft monitoring
System overview
The electronic centralised aircraft monitoring (ECAM) system is a main component of the Airbus two-crewmember cockpit and takes account of the ‘dark cockpit’ and ‘forward-facing crew’ philosophies. ‘Dark cockpit’ refers to only illuminating the flight deck switches and buttons that require the pilot’s attention and ‘forward facing’ refers to ensuring that essential flight information is readily available in the pilot’s immediate field of view. These philosophies are aimed at supporting crew actions by only displaying the minimum required information and reducing nuisance alerts.
The purpose of the ECAM is to:
display aircraft system information
monitor aircraft systems
indicate required flight crew actions in most normal, abnormal and emergency situations
diagnose and respond to system faults.
As the ECAM is available in most failure situations, it is a significant step in the direction towards a paperless cockpit and the reduction of items that must be conducted from memory by the crew.
The ECAM provides information on two display units located in the centre of the instrument panel (Figure 13).
The upper unit, or engine/warning display (E/WD), presents information such as engine primary indications, fuel quantity information and slats/flap positions. The bottom part of the E/WD presents warning or caution messages when a system fault occurs and memo messages when there are no faults.
Figure 13. Engine/warning display (E/WD) showing exemplar engine parameters, fuel quantity and flap/slat positions (top of the display), take-off and landing memo messages, independent/primary warning/caution messages and required actions (bottom-left) and normal memo and secondary failure messages (bottom right)
Source ATSB investigation 200700065, available at ATSB website
The lower unit, or system display, presents more detailed information for different systems. In some cases, the ECAM automatically provides the relevant system’s information following a system fault. The flight crew can also select different system pages. In addition, the system display presents a ‘status page’, which provides an operational summary of the aircraft’s status, including a list of inoperative systems, cancelled cautions, approach procedures and relevant limitations.
Presentation of ECAM warning and caution messages
The ECAM presents a short message indicating the nature of a warning or caution in red or amber, depending on the failure level. Any required crew actions are displayed in blue text on separate lines below the relevant message.
There are seven lines available at the bottom of the E/WD to display warning and caution messages. The messages are displayed in a priority order, with the most important (Level three) messages displayed at the top. In decreasing priority, Level two messages are displayed below the Level three messages but above Level one messages. When there were multiple messages at the same level, the most recent message has the highest priority.
If the flight crew complete a displayed action, the ECAM automatically removes the action line below the relevant message. The flight crew can also clear a message by pressing the ‘clear’ push-button. If the conditions that led to the presentation of a warning or caution message are no longer present, the ECAM automatically removes the message. If the conditions for the message return, the message is again displayed.
Flight control laws
System overview
The A330’s electrical flight control system (EFCS) is a fly-by-wire system. That is, there is no direct mechanical linkage between most of the flight crew’s controls and the flight control surfaces. Flight control computers send movement commands via electrical signals to hydraulic actuators that are connected to the control surfaces. The computers sense the response of the control surfaces to these commands and adjust the commands as required.
The EFCS computes the control orders according to a ‘control law’, with different functionality provided depending on the law being used. There are three levels of control law, each providing for different functionality as follows:
Normal law. The EFCS detects when the aircraft is approaching the limits of certain flight parameters, and commands control surface movements to prevent the aircraft from exceeding these limits (that is, it prevents the aircraft from exceeding a predefined safe flight envelope). Automatic flight-envelope protections include high angle of attack protection, load factor limitation, pitch attitude protection, roll attitude protection and high speed protection.
Alternate law. The EFCS switches to alternate law if there are certain types or combinations of failures within the flight control system or related systems. Some types of protection, such as high angle of attack protection, are not provided under this law, and others are provided using alternate logic.
Direct law. The EFCS switches to direct law in situations where there are more failures of relevant, redundant systems in addition to those that led to the reversion to alternate law. No flight-envelope protections are provided, and control surface deflection is proportional to sidestick and rudder pedal movement by the flight crew.
Enhanced ground proximity warning system
In respect of the enhance ground proximity warning system activations during take-off from Sydney and again during approach in Melbourne, part of the system involved the comparison of the aircraft’s calculated position with a stored database of known terrain features and obstacles in the vicinity of major airports. System design took into account when the aircraft was likely to be on departure or arrival to these airports. It then modified the alerting functions such that there was a lower sensitivity to obstacles in the prescribed departure and/or arrival flight path when the aircraft was is the correct position, thus reducing nuisance warnings when no conflict with terrain or obstacles existed.
Master warning during the go‑around at Melbourne
During the initial part of the go‑around in Melbourne, both flight crew heard an aural alert associated with a master warning similar to a flap overspeed warning. On checking the aircraft’s airspeed, both flight crew noted that the airspeed was below the maximum permissible 186 kt for the then Flap 3 configuration. Flight data indicated the maximum recorded speed was 185 kt for 1 second whilst in this configuration and the post flight report did not record any airspeed exceedances during any phase of flight.
A further review of flight data indicated that during the go‑around the landing gear was selected up prior to the engine thrust levers reaching the take‑off/go‑around position. The flight crew reported that, in response, the captain reduced power below the take-off/go‑around position to correct a suspected flap overspeed. As the aircraft was below 750 ft above ground level, this would likely have momentarily activated the L/G GEAR NOT DOWN master warning. The flap overspeed and L/G NOT DOWN master warnings have the same aural alert.
On 11 January 2007, at about 0718 Eastern Daylight-saving Time, an Airbus A320 aircraft, registered ZK-OJB, departed runway 34L at Sydney Airport, New South Wales for Auckland, New Zealand and was assigned a radar heading by ATC. The controller noticed that the aircraft turned onto an incorrect heading and informed the flight crew. The crew checked the aircraft’s compasses and identified a heading error of about 40°and a GPS PRIMARY LOST message on the aircraft’s multi-purpose control and display unit and navigational display (ND). The crew advised ATC that they had navigational difficulties and elected to return to Sydney for landing.
When the aircraft returned to the departure gate, the flight crew noticed that the inertial reference system (IRS) was aligned to the incorrect longitude. The operator’s investigation into the incident found that the IRS had been aligned by maintenance staff prior to the crew boarding the aircraft. The incorrect alignment of the IRS was not noticed during a number of subsequent checks prior to departure.
As a result of this occurrence, the operator proposed developing a training program for all company pilots that was designed to improve discussion and guidance in relation to threat and error management issues.
ATSB occurrence report 201104899
On 13 July 2011, a Philippine Airlines Airbus A340, registered RP-C3431, departed Sydney and did not track as cleared by ATC. The flight crew reported navigation problems after crosschecking the standby and main heading indications and the aircraft returned to Sydney for a visual approach and landing.
The occurrence was reported to the ATSB and Airbus.
The crew reported to Airbus that during the take-off roll, they noticed the absence of the runway symbol on the ND and the annunciation of GPS PRIMARY LOST and NAV FM/IR POS DISAGREE on that display. Airbus included this occurrence in the number of global occurrences, detailed in the following section, relating to data entry errors during initialisation of the air data and inertial reference system.
Global occurrences and action
At the time of writing, approximately 46 per cent of the 515 aircraft affected by service bulletin SB 34-3287 Enhanced ADIRU alignment on GPS position have been updated via that bulletin such that data entry is not required for ADIRS initialisation. Despite these updates, 13 occurrences have been reported to Airbus worldwide since January 2010 that are attributable to data entry error during ADIRS initialisation on aircraft that did not have the service bulletin completed. In each occurrence, the flight crew elected to return to the departure point, or a nearby airport via a visual approach.
Safety analysis
Introduction
During pre‑flight initialisation of the aircraft’s navigation systems, the longitude of the aircraft was entered incorrectly. This data entry error was not detected prior to take‑off and resulted in disruption to various navigation and flight guidance systems. While troubleshooting was conducted by the flight crew once the aircraft was airborne, a lack of information from systems and checklists led to an incorrect diagnosis and actioning of flight deck switches. This in turn resulted in further degradation of the aircraft systems.
The following analysis will examine the aircraft systems, procedural controls, and human factors that contributed to the occurrence.
Available upgrade to aircraft navigation systems
Airbus service bulletin SB 34-3287 Enhanced ADIRU [air data inertial reference unit] alignment on GPS position was released in 2013. Embodiment of this service bulletin into affected aircraft removed the need for data entry during the initialisation of the air data and inertial reference system (ADIRS). Furthermore, in the event that flight crew did elect to enter the aircraft’s position manually, any errors resulting from that action would be automatically corrected. As such, the enhancement provided by the service bulletin removed the possibility of the ADIRS being initialised to the wrong coordinates through a data entry error.
While compliance with the service bulletin was recommended by Airbus, it was not mandatory and the occurrence aircraft had not received this upgrade. Consequently, this important defence against data entry error was not available at the time of the occurrence.
Development of the occurrence
Data entry error
Recorded aircraft flight data indicated that the ‘0’ digit of the departure gate longitude was omitted during manual entry of the aircraft’s position into the MCDU at the gate. This led to a longitude of 01519.8 east (15°19.79’ east) being entered instead of the correct value of 15109.8 east (151° 9.8’ east). That error resulted in the aircraft’s navigation systems being directed to a position near Cape Town, South Africa instead of Sydney Airport, Australia. An error in excess of 11,000 km. The magnitude of this error adversely affected the aircraft’s navigation functions, global positioning system (GPS) receivers and some electronic centralised aircraft monitoring (ECAM) alerts.
Airbus recommended that the aircraft’s position should be entered into the MCDU via that equipment’s slew keys. That method of data entry inherently limited the possibility of large errors, as the incremental nature of the slew keys required significant time to effect large changes in latitude and longitude. By contrast, the entry of latitude and longitude using the multipurpose and control display unit (MCDU) scratchpad involved the input of a sequence of 16 characters consisting of 12 numerical characters, two letters and two separate decimal points. This number of characters generally increases the likelihood for error when copying such a sequence from the gate sign to the scratchpad. On this occasion the use of the scratchpad directly facilitated the large positional error.
Kirwan (1994) examined data relating to error in tasks. The results showed a 3 per cent error rate for recall performance when recalling a six-digit sequence. While this is only partially relevant to this occurrence, the same error rate was present for entering seven-digit numbers into a key phone. Of interest, when conducting a routine operation where care is required, the error probability was 1 per cent. These error probability rates are fairly low; however, this kind of event is reasonably rare, as most data entry errors are detected in the cross-check or self-check after entry.
System error detection
Manual entry of the aircraft’s position during ADIRS initialisation routinely results in the message prompt to ALIGN IRS. As this process is carried out on virtually every flight, it becomes an automatic action for flight crew. Automatic actions are not monitored closely and as such, any errors or incorrect actions will often be missed until it's too late to change them, or an unforeseen consequence has occurred (Reason, 1990).
In addition to the ALIGN IRS prompt, the magnitude of the positional change on this occasion would normally result in the prompt to also REALIGN IRS. The captain reported that some of the A330 fleet required ALIGN IRS to be selected twice, and that he could not remember if he carried out the alignment twice on the occurrence flight. That understanding was incorrect as, in the absence of a system fault, the prompt to ALIGN IRS only occurs once.
Examination of the aircraft’s navigation system following this occurrence did not identify any system fault that would have affected normal operation. It was therefore likely that, following entry of the incorrect aircraft position, ALIGN IRS was displayed, followed by the prompt to also REALIGN IRS. Differentiation between these two prompts would be made more difficult as they were displayed in a similar colour and in close proximity.
In summary, the aircraft’s navigation system probably displayed messages that would have enabled identification of the data entry error. However, due to a combination of the captain’s understanding that the same alignment‑related message may be displayed twice, and the similarity between the messages, the error remained undetected.
Data entry crosscheck
The cockpit preparation procedure called for the pilot monitoring to check the airfield data and all flight management system (FMS) entered data. The first officer (FO) stated that on his return from the pre-flight external inspection of the aircraft, the majority of the cockpit preparation had been completed. The FO then checked the data entries and switch positions as per standard operating procedures. The FO’s check of the FMS entries was a routine action carried out at the beginning of every flight, and the FO reported that it was rare for errors to be present and/or detected.
Expectancy can influence how and where people look for information (Wickens and McCarley, 2008). Expectancy can be influenced by habit, salience, event rate and relevance, among other factors.
In addition, various studies have shown a significant number of errors made by individuals are detected only when it is too late for effective intervention and recovery. Sarter and Alexander (2000) found that slips (consistent with the data entry error) were more likely to be detected based on routine or 'suspicious' checks, wherein crew suspected a problem and went looking for it, or observed the outcome of the slip.
Thomas, Petrilli and Dawson (2004) found that 'less than half the errors committed by crews were actually detected'. Another study in 2004 by Thomas noted that the majority of errors occurred during pre-flight, take-off and descent-approach-landing.
The combination of expectancy associated with a high frequency routine check with low suspicion of error, and a low chance of error detection during pre-flight, reduced the effectiveness of the FMGS check as a control in detecting the initialisation error. That probably led to the FO not noticing the incorrect initialisation coordinates during the crosscheck of the flight management and guidance system (FMGS) entries after completing the aircraft exterior inspection.
Heading indication crosscheck
The cockpit preparation procedure included the crosschecking of the primary heading indications on the navigation displays (NDs), primary flight displays (PFDs) and digital distance and radio magnetic indicator (DDRMI) against the standby compass indication. This check was designed to detect errors such as a heading disparity between the direct‑reading standby compass and the primary heading indicators.
As the NDs, PFDs and DDRMI all receive their heading information from a respective ADIRU, on this occasion they would have displayed an equally incorrect heading as they were all influenced by the positional initialisation error. By contrast, the standby compass did not receive heading information from an ADIRU and would therefore have been reading correctly, subject to any magnetic interference. However, the standby indications are much smaller and set further away from the pilots than the indications on the ND, PFD and DDRMI and therefore less prominent. Apart from crosschecking the primary heading indicators, and in rare emergency procedures, the standby compass is rarely referenced by the flight crew.
The crew reported that the crosscheck was performed by one pilot reading out a heading and then both silently checking each heading indication against this value before saying ’Check’. This check did not include verbalising the displayed value.
In order to increase pilots’ awareness of aircraft modes and system states, aircraft manufacturers have recommended that pilots call out mode changes as they occur. While this is generally targeted at calling mode changes in-flight, the same benefit may be gained during ground checks. That is, by verbalising the indication or mode, greater attention is given by the flight crew. As a result, they are more likely to become aware of an error or discrepancy as their attention is directed toward comparing the indications.
Recorded data indicated that the ND modes selected during the pre‑flight would not have displayed the heading on both of the pilot’s NDs. As such it would not have been possible to conduct the full heading indication crosscheck during the pre‑flight, as detailed in the flight crew operations manual (FCOM).
In summary, it is likely that the disparity between the standby compass and the primary heading indications was not identified due to a combination of the:
method of crosschecking the heading indications by use of the word ‘Check’ instead of verbalising the actual indication
reduced prominence of the standby compass compared to the primary heading indications
instrument panel check not being fully carried out during pre-flight in accordance with the FCOM, as the incorrect mode was selected on the NDs.
Flight plan comparison
Following alignment of the ADIRS, the next step in the cockpit preparation was to check the FMGS‑entered flight plan. Both pilots stated that this included checking the total track nautical miles and predicted fuel usage calculated by the FMGS against the values contained on the paper flight plan provided by their flight dispatch. Given the magnitude of the positional error, the ATSB considered whether this comparison provided an opportunity to detect the data entry error.
The check of the FMGS-entered flight plan was designed to ensure the correct flight plan and standard instrument departure (SID) were loaded prior to take‑off. As such, the total track miles and fuel predictions were based the departure runway and active flight plan loaded into the flight management computer (FMC), and not influenced by the aircraft position calculated by the FMC. The total track miles and fuel predictions would therefore not differ from the paper flight plan provided by flight dispatch. As such, the comparison of total track miles in the FMC to the paper flight plan during pre-flight did not provide an opportunity to detect the initialisation error prior to take-off. Once airborne however, the total track miles and fuel predictions would have been erroneous as they incorporated the aircraft’s FMGS calculated position.
GPS accuracy check
Both flight crew stated that seeing GPS PRIMARY and accuracy HIGH on the MCDU progress page during the pre‑flight was, to them, an indication that the ADIRS was initialised and functioning correctly. Given that once airborne the crew noticed GPS PRIMARY LOST displayed on the ND, the ATSB considered whether the sequence of GPS-related messages may have provided an opportunity to detect the positional error before take‑off.
The GPS PRIMARY message is typically displayed when the GPS is capable of passing the integrity and accuracy checks by receiving an adequate number of satellites in the correct positions relative to the aircraft and horizon. When this message is active, the two GPSs interface with the respective inertial reference system (IRS) and output a combined position to the FMC. If GPS PRIMARY is active for more than 10 minutes, and the GPS integrity or accuracy check then fail because of an anomaly with the satellite array, the GPS signal is invalidated. The IRS output then reverts to a mixed IRS only position (IRMIX) and eventually GPS PRIMARY LOST is displayed on the ND. There can be a delay of a few minutes between the invalidation of the GPS signal and display of GPS PRIMARY LOST.
During the occurrence the GPS PRIMARY and accuracy HIGH displays were observed prior to pushback and provided a false confirmation that the FMGS was set up correctly. It is probable that at this time the ADIRS initialisation was either incomplete or had not had enough time to invalidate the GPS signal. Eventually the aircraft used the erroneous position from the initialisation error to compare the satellite array, and invalidated the GPS signal. That would have removed the display of GPS PRIMARY and accuracy HIGH on the MCDU progress page. However, this did not occur until the aircraft was taxiing for departure, a time when the crew would not normally be observing that page. As a result, there was limited potential to identify the error.
The aircraft‑generated post‑flight report indicated that faults associated with failure of GPS integrity checks occurred 14 and 9 minutes prior to take‑off. These failures were the result of the positional error and occurred while the aircraft was being taxied for take-off. Both of these faults are designed to have an associated single chime master caution aural alert, and the respective GPS NAV (1, 2) FAULT should appear on the engine/warning display. There were no associated ECAM messages indicating faults to either GPS.
The crew reported hearing two individual chimes during the taxi but, as there was no associated ECAM message, they continued with normal procedures and prepared for take-off. It is likely that a message associated with failure of the GPS integrity check did appear on the engine warning display but the crew did not recall seeing one.
Activation of the GPS NAV (1,2) FAULT alert would normally indicate a loss of GPS PRIMARY and result in the display of GPS PRIMARY LOST on the ND. However, due to complexity of the system there is variation in the time required to display this message. It was therefore not possible to determine if this message was displayed on the ND prior to take‑off and remained unnoticed by the crew. Alternatively, GPS PRIMARY LOST may not have been displayed until the aircraft was airborne.
A review of the message display logic identified that the ECAM warning FMS/GPS POSITION DISAGREE also normally activates when an erroneous position is entered during IRS alignment. However, there was no evidence from the flight crew, flight data or post‑flight report that this occurred. Advice from Airbus was that, similar to the above discussion regarding display of the GPS PRIMARY LOST message, there may not have been sufficient time for the message to be displayed.
Data integrity checks
The last step in the cockpit preparation procedure before conducting the take-off briefing was the ADIRS check. This check ensured that the distance between each IRS and each FMS position was less than 5 NM (9 km).
As each IRS was initialised to the same positional error, it was probable that the distances between each IRS and each FMS position were within the allowable limit. Likewise, prior to the conduct of this check there may have been sufficient time for the FMS to enter IRMIX mode and invalidate the hybrid global positioning/inertial reference system (GPIRS) position. In that case the FMS and IRS positions would not appear to differ and the error would remain unnoticed.
An FCOM requirement to review the ND during cockpit preparation and taxi provided two opportunities to identify that the ADIRS was not correctly initialised. Specifically, with the ND in NAV or ARC mode, the FMS-calculated position would be displayed but the airport, SID waypoints and surrounding navaids would not as they were significantly outside of the range of the FMS-calculated position. Although contrary to the FCOM, in the event that the ND was left in PLAN mode, the ND would display the loaded airport and SID waypoints but not the FMS‑calculated position. In this case the ND may look similar to a correctly-initialised NAV mode without the aircraft or runway symbols (Figure 13).
Recorded data indicated the captain had PLAN mode selected on his ND until after pushback and just prior to engine start. This precluded the ADIRS IRS align check being carried out in accordance with the FCOM. The FO had NAV or ARC mode selected on his ND for most of the pre-flight and then PLAN mode prior to pushback until engine start.
Based on the selected ND modes it is likely that the data integrity checks detailed in the pre‑flight and taxi procedures were either omitted or conducted with the ND selected to an inappropriate mode and/or range that concealed the aircraft’s positional error.
The recorded data also indicated that the FO selected plan mode and every available ND range during the line-up/take-off roll. This may indicate that the FO was attempting to interpret an unusual display on the ND associated with the positional error.
Figure 13: ND controls and an example of a PLAN mode display (right picture). Note that the track (in yellow) and waypoints (in green) are displayed but there is no aircraft or runway symbol
Source: Airbus, modified by the ATSB
Runway position update
In the event that GPS PRIMARY is not active at the time that take-off/go‑around thrust is applied, the aircraft normally updates its position using the stored coordinates of the runway threshold or runway intersection. As the aircraft‑generated post-flight report identified that GPS PRIMARY was not active when take-off thrust was applied, the ATSB considered why the positional update did not occur on this occasion.
Airbus explained that, despite GPS PRIMARY not being active, the aircraft was unable to update the calculated position to the runway threshold coordinates as the difference between the runway threshold coordinates and the erroneous position was too large. The required positional correction was beyond the normal capabilities of the FMGS to update between the application of take‑off/go‑around thrust and the take-off.
Airborne flight management
Due to the large data entry error remaining uncorrected, the navigation system did not initialise relative to the aircraft’s actual position prior to take‑off. This likely affected the enhanced ground proximity warning system’s (EGPWS) ability to allow for the fact the aircraft was on departure, and resulted in spurious EGPWS activation shortly after take-off from Sydney Airport.
The captain reported being initially startled by the alert and, having visually confirmed that they were clear of terrain, became concerned that the FO would conduct an EGPWS escape manoeuvre. Such a manoeuvre involves separating the aircraft from terrain in the shortest possible distance by the use of as much as full control stick back pressure and all available engine power. The captain believed such an abrupt manoeuvre would increase the risk of a traffic conflict in the busy airspace and therefore instructed the FO to disregard the alert.
The FO engaged the autopilot at an altitude of approximately 400 ft which, in accordance with the SID was around the time the aircraft was required to conduct a right turn from the runway heading of 155° and track towards waypoint DUNES (an approximate heading of 170°). However, as the positional error resulted in the application of the wrong magnetic variation, an incorrect heading was displayed on the ND, PFD and DDRMI. Flight data indicated the aircraft’s indicated heading was 193° throughout the take-off roll, compared to the actual runway heading of 155°. In following the incorrect heading indications towards waypoint DUNES, the crew inadvertently turned left onto 170° and entered the departure flight path of the active parallel runway 16L.
During studies of distraction and interruptions during normal flight operations, distraction has been noted as a factor that can increase the opportunity for error (Loukopoulos, Dismukes & Barshi, 2001). It has also been shown to detract from effective monitoring (Loukopoulos, Dismukes & Barshi, 2003). In some cases this will be as a result of the requirement for a pilot’s attention to be on multiple tasks (Dismukes, Loukopoulos & Jobe, 2001). As such, distraction will often move the focus of attention from the intended task. In this context, it is likely that the spurious EGPWS alert distracted the crew from noticing that the aircraft was turning left and contrary to the SID, once the autopilot was engaged.
Both flight crew stated that in the early stages of flight, the cognitive workload was very high. This was supported when considering the activation of the EGPWS and subsequent determination that this was a spurious warning, combined with attempts to rationalise a number of alerting mechanisms such as air traffic control (ATC) informing the crew they were on the wrong heading, GPS PRIMARY LOST displaying on the ND, and the loss of most tracking and heading information at a critical stage of flight. The crew also stated they were concerned by the amount of traffic in the Sydney area and the potential for traffic conflict given their navigation difficulties.
Shortly after the FO engaged the autopilot, the captain took over the flying and ATC communication duties. The captain stated that due to a lack of any ECAM guidance, the only instruction he could give the FO was to reset the NAV.
The FO’s initial reaction was to refer to the UNRELIABLE AIRSPEED INDICATION checklist despite no guidance to do so from ECAM and no indication of a problem with the air data computers or airspeed sensors. The FO advised that in the weeks prior to the occurrence flight he had undergone a checking and training exercise which simulated conditions of frozen pitot airspeed probes. He stated that this, combined with recent media coverage of a fatal accident involving an A330 that experienced problems with the pitot system, put him in the mindset that they may be experiencing a fault in the air data reference (ADR).
The UNRELABLE AIRSPEED CHECKLIST provided target thrust settings and aircraft attitudes to assist the crew in flying the aircraft within the operating limitations in the event that the airspeed indicators became unreliable. It also contained guidance on identifying an affected ADR, which may have also contributed to the FO’s belief that there was an issue with the aircraft’s ADRs. Although flight data indicates that there was no sign of an ADR fault, this may have led the FO to turn ADR 1 and 3 OFF, inadvertently further degrading the flight systems.
There was limited information available to the crew to identify the risk associated with selecting an ADR to OFF. The flight crew training manual listed the identified risks associated with that action (appendix B) however, there was no guidance for fault diagnosis or rectification of the condition experienced by the crew of 9M-XXM. Additionally, the flight crew training manual is not routinely referenced in-flight, unlike the quick reference handbook or ECAM guidance.
Reliance on electronic centralised aircraft monitoring
The FCTM describes the ECAM as a main component of Airbus aircraft that provides information in response to most failure situations. The captain attributed the lack of ECAM guidance before take‑off as an indicator that the aircraft systems were operating correctly, despite two aural chimes associated with master cautions. The captain further stated that they had never experienced a chime with no associated ECAM message and that their response was to continue normal procedures. This behaviour is consistent with a reliance on ECAM to identify and resolve abnormal system situations.
The crew reported that the lack of ECAM guidance once airborne was a hindrance to resolving the situation. In the absence of ECAM or engine/warning display messages the FO searched the quick reference handbook and FCOM in an attempt to diagnose the problem. The FO carried out part of an UNRELIABLE AIRSPEED CHECKLIST and part of an ADR FAULT procedure before incorrectly using the ADIRS rotary switches in an attempt to rectify the situation.
The operating philosophy and views of the flight crew indicate a high expectancy that ECAM guidance would be available to resolve most abnormal situations, including that being experienced out of Sydney. In those rare situations where this guidance is not available, it could reasonably be expected that the risk of misidentification and/or inappropriate attempts to resolve the situation would increase.
Air traffic control support
A review of the ATC response to this occurrence identified that the controllers carried out several tasks that reduced the risk to both the occurrence aircraft and other aircraft in the area. They were the first to notice and alert the crew to the tracking problem, and provided assistance to identify that the aircraft’s main heading indicators were erroneous. Additionally, ATC quickly resolved a possible conflict with another aircraft lined-up and ready to depart on the parallel runway.
Subsequently, coordination with several ATC units and the availability of continuous radar coverage provided the crew with a safe diversion alternate and vectoring from Sydney all the way to final approach in Melbourne. The captain reported that ATC had prevented the situation becoming a ‘dire emergency’ and that in many ways they had ‘saved the day’.
Findings
From the evidence available, the following findings are made with respect to data entry and navigational issues involving Airbus A330-343, registered 9M-XXM that occurred at Sydney Airport, New South Wales on 10 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
When manually entering the coordinates of the aircraft’s position using a data entry technique that was not recommended by the aircraft manufacturer, the longitude was incorrectly entered as 01519.8 east (15° 19.8’ east) instead of 15109.8 east (151° 9.8’ east). This resulted in a positional error in excess of 11,000 km, which adversely affected the aircraft’s navigation systems and some alerting systems.
The aircraft was not fitted with an upgraded flight management system that would have negated the positional data entry error via either automated initialisation of the air data and inertial reference system, or the automatic correction of manual errors.
The aircraft’s navigation system probably detected the data entry error and displayed an associated message. However, due to the combination of that message being similar to one displayed during routine alignment of the inertial reference system, and the captain’s understanding that the same alignment-related message may be displayed twice, the error was not identified.
The first officer did not notice the error in the initialisation coordinates when crosschecking the flight management and guidance system entries after completing the pre-flight external inspection of the aircraft.
It is likely that data integrity checks detailed in the pre-flight and taxi checklists were either omitted or conducted with the navigation display selected to an inappropriate mode and/or range that concealed the aircraft’s positional error.
The instrument panels cockpit check was not carried out in accordance with the flight crew operations manual and resulted in the crew not detecting the offset error in the displayed heading.
Due to the large data entry error remaining undetected, the navigation system did not initialise relative to the aircraft’s actual position prior to take-off. This resulted in an offset error in the displayed heading and a spurious enhanced ground proximity warning system alert shortly after take‑off and again on arrival in Melbourne.
Activation of the enhanced ground proximity warning system probably distracted the crew and prevented them noticing the turn towards the active parallel runway.
Other factors that increased risk
The crew were presented with an abnormal situation that did not have associated electronic centralised aircraft monitoring or checklist guidance, and was not covered in any training or supplemental information. This increased the risk of misidentification of the situation and further degradation of the aircraft’s systems through incorrect cockpit switch selections.
Other findings
Effective monitoring and assistance provided by air traffic control reduced the risk to both the occurrence aircraft and other aircraft in the area.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Air Asia X
the flight crew of 9M-XXM
Airbus
simulator recreations
on board recorded data
Airservices Australia.
References
Airbus Flight Operations Support & Services. Getting to Grips with RNP AR. Customer Services Directorate, Airbus SAS Feb 2009.
Kirwan, B 1994,A guide to human reliability assessment Taylor and Francis, London.
Wickens, C.D and McCarley, J.S 2008, Applied Attention Theory Boca Raton CRC Press Chicago.
Sarter, N B. and Alexander, H M. 2000, Error Types and Related Error Detection Mechanisms in theAviation Domain: An Analysis of Aviation Safety Reporting System Incident Reports, The International Journal of AviationPsychology,10:2, pp. 189–206.
Thomas J.W, Petrilli R.M and Dawson D. 2004, an Exploratory Study of Error Detection Processes During Normal Line Operations, Centre for Applied Behavioural Science, University of South Australia, pp. 1–5.
Thomas, M. J. W. 2004, Predictors of Threat and Error Management: Identification of core non‑technical skills and implications for training systems design. International Journal of Aviation Psychology, 14(2), pp. 207–231.
Loukopoulos, LD, Dismukes, RK & Barshi, I. Cockpit interruptions and distractions: A line observation study. In Proceedings of the 11th International Symposium on Aviation Psychology, Columbus, OH, 14–17 March 2001.
Dismukes, RK, Loukopoulos, LD & Kobe, KK. The challenges of managing concurrent and deferred tasks.In Proceedings of the 11th International Symposium on Aviation Psychology, Columbus, OH, 14–17 March 2001.
Loukopoulos, LD, Dismukes, RK & Barshi, I. Concurrent task demands in the cockpit: challenges and vulnerabilities in routine flight operations. In Proceedings of the 12th International Symposium on Aviation Psychology, Columbus, OH, 14–17 April 2003.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, Air Asia X, Airbus, the Bureau d’Enquêtes et d’Analyses, Airservices Australia and the Civil Aviation Safety Authority.
Submissions were received from Airbus and Air Asia X. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Standard instrument departure
DEENA 5 standard instrument departure depicting the right turn requirement and caution regarding the parallel runway.
Source: Jeppesen Airways Manuals
Appendix B – Flight crew training manual extract
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 20 March 2015, the pilot of a Piper PA 25-235/A9 Pawnee aircraft, registered VH-NLP, departed a private airstrip near Derrinallum to conduct insect baiting operations on a property near Darlington, Victoria. Shortly after commencing that task, the aircraft collided with terrain and was destroyed by impact forces and a post-impact fire. The pilot, who was the sole occupant, was fatally injured.
What the ATSB found
The ATSB found that while positioning the aircraft for a baiting run, the pilot inadvertently descended below the normal application height over an adjacent paddock. While recovering from this loss of height and avoiding terrain, the aircraft probably stalled and entered an incipient spin at a height from which recovery was not possible before colliding with terrain.
There was no evidence of any pre-existing mechanical defect with the aircraft or engine that could have contributed to the accident. However, the aircraft was being operated outside the flight envelope as it exceeded the design maximum take-off weight. In addition, the conditions were conducive for the formation of carburettor icing.
Safety message
Operators and pilots are reminded of the hazards associated with agricultural low-level flying and the increased risk of collision with terrain. The ATSB highlights the importance to pilots and operators of ensuring that their aircraft’s weight and balance is within specified limits, and understanding the effects of operating outside the flight envelope on the aircraft’s flying characteristics. This accident is also a reminder of the importance of monitoring environmental conditions and the associated risk of carburettor icing.
Photograph of VH-NLP
Source: The operator
The occurrence
On 20 March 2015, a Piper Aircraft Corporation PA-25-235/A9 Pawnee aircraft, registered VH‑NLP (NLP), was being prepared for an agricultural flight from a private airfield near Derrinallum, Victoria. A witness reported observing an estimated total of about 100–120 l of fuel on board, and load of about 450 kg of insect bait. The witness observed that the pilot appeared to be well rested and enthusiastic about the task.
The planned flight was an insect baiting operation, consisting of spreading a poison-infused wheat product. This was to be carried out on a farming property near Darlington, Victoria, over three adjoining paddocks in an east-west direction. The plan was for the pilot to conduct the bait application in a left racetrack pattern,[1] at about treetop level.
At about 0850 Eastern Daylight-saving Time,[2] NLP departed for the 10-minute flight to Darlington. The operator considered the wind to be calm at the time NLP departed Derrinallum. A witness at the accident site indicated that the conditions were calm at about 0900–0915, when they heard the aircraft. They noticed that the wind did come up later in the morning. Bureau of Meteorology weather observations were available for Mortlake, about 15 km to the west of the farming property. At about the time of the bait application operation, the Mortlake recorded weather indicated that the wind was from the west at 7 kt, the temperature was 12.3 °C and that the dewpoint[3] temperature was 10 °C.
Several witnesses observed and heard the aircraft operating in the area of the three paddocks between about 0900 and 0915. One witness, who was travelling along a nearby highway to the south-east of the three paddocks, observed NLP at treetop height, heading west. They then observed it rolling left and right before suddenly descending. Black smoke was seen by witnesses coming from a paddock in the area where NLP had been operating. The aircraft impacted terrain, out of sight of the witnesses, at about 0915.
The pilot, who was the sole occupant, was fatally injured and the aircraft was destroyed by impact forces and a post-impact fire. The accident was not considered survivable.
Operational aspects
Pilot information
The pilot was appropriately qualified for the flight, holding a Commercial Pilot (Aeroplane) Licence, a Class 2 Agricultural Rating (Aeroplane), and a Class 1 Aviation Medical Certificate. The pilot completed their agricultural rating on 9 April 2014, which included their 2-yearly flight review. The pilot had a total aeronautical experience of about 281 hours, about 17 hours of agricultural flying and about 15 hours in NLP.
After obtaining an agricultural rating in Victoria, the pilot was employed for about 4 months by an operator in Queensland. Although the pilot performed a number of training and general flights with that operator, there were no recorded agricultural flights during that period. The pilot returned to Victoria in August 2014, and performed various duties. These included agricultural operations and aerial work through until November 2014.
The pilot’s most recent aerial agricultural operations occurred about 5 months prior to the accident in October 2014. That involved three baiting flights and two flights spraying liquid chemical. The pilot then completed three general flights in January 2015. Of these, the last entry in the pilot’s logbook was for a flight on 26 January 2015. The pilot’s logbook did not include a ferry flight undertaken in NLP on the day prior to the accident.
An aerial agriculture instructor who had flown with the pilot stated that, although the pilot was conscientious and deemed safe for flying agricultural operations, there were particular situations where the pilot’s lower level of experience became evident. These situations, which were reported to sometimes be observed in other ‘junior’ agricultural pilots, included difficulty managing the aeroplane’s attitude during turns and anticipation of a pending aerodynamic stall.[4]
Aircraft information
Piper Aircraft Corporation PA-25-235 Pawnee NLP was manufactured as a single-seat aircraft in the United States in 1965, and certified in the normal category. It was converted to an ‘A9’ variant in Australia in 1983 under a Civil Aviation Safety Authority Supplemental Type Certificate, and certified the normal and agricultural categories. This conversion included the installation of a second seat, replacement of the fabric-covered wings with metal wings and a larger chemical hopper.
The last periodic inspection was carried out on 5 August 2014 at 8,762.8 flying hours.
The Supplemental Type Certificate for the PA25-235/A9 detailed a maximum take-off weight of 1,315 kg. Based on the reported fuel and insect bait on board for the flight, the ATSB estimated that the aircraft departed at about 102 kg over the approved maximum take-off weight at take-off. Similarly, based on a planning fuel use of 60 l/hr and a ‘best guess’ metered bait application rate of 15 kg/hectare, it was estimated that the aircraft was about 39 kg over its maximum take-off weight after the first bait application run. Exceeding operational limitations can affect an aircraft’s handling and performance, reducing the normal operational safety margins. Depending on the magnitude of the exceedance, it can also impose significant structural loads in excess of the aircraft’s design loads. In turn, this can reduce the aircraft’s effective service life and potentially cause structural failure.
Preparation for the operation
Several days prior to the accident, the operator contacted the property owner to discuss the planned baiting job. The operator reported also taking the opportunity to carry out an airborne survey of the paddocks that were to be baited by the pilot. The operator recalled meeting with the pilot for a briefing on the afternoon before the planned flight. The briefing was reported to include a discussion of the boundaries of the paddocks that were to be baited, the powerlines and on the pre‑programming of the aircraft’s global positioning system equipment.
On-site examination
Accident site
The wreckage was located in the eastern-most paddock of the three to be baited. Examination of the accident site indicated that NLP impacted terrain nose-down, in an almost vertical orientation. The aircraft came to rest about 7 m from the initial impact point. The forward fuselage and cockpit sustained significant damage as a result of the initial impact, and a post‑impact fire consumed the the internals of the aircraft’s global positioning system equipment, the majority of the fuselage and the inboard wing sections (Figure 1). Damage to the leading edge of each wing also indicated a vertical impact. ATSB analysis based on estimates of the aircraft’s speed, the almost vertical impact angle and the energy absorbed by the aircraft indicated that the impact forces imparted to the pilot would normally be expected to result in fatal injuries.
Examination of the propeller, along with evidence from the impact crater, indicated that the propeller was rotating under a level of power at the time of impact. Flight control continuity was confirmed. Due to the level of damage, the flap position could not be determined.
No pre‑existing anomalies were identified at the accident site that would have precluded normal operation of the aircraft.
Figure 1: Aircraft wreckage (looking east), showing the lower surface of the aeroplane. Note the significant damage to the forward fuselage and cockpit area and the extent of the fire damage to the fuselage and inboard wing sections
Source: ATSB
Insect bait was found in a straight and regular swathe along the southern fence line of the paddock, consistent with a bait application run (Figure 2). This swathe ran for the entire length of the planned baiting area and was about 36 m wide. Additionally, a bait swathe of varying width and density from the middle of the adjacent paddock was observed outside and to the top‑right of the baiting area. This continued in an arc to the initial impact point. This swathe initially decreased from about 16 m down to 7 m wide, then increased to 30 m wide before tapering off towards the accident site.
Figure 2: Area to be baited (outlined by the yellow dashed line), with dispensed bait shaded in yellow and higher-concentration bait shown as bright yellow
Source: Google earth, modified by the ATSB
Survivability and post-mortem results
The forensic pathologist who conducted the pilot’s post-mortem examination concluded that the pilot succumbed to the effects of fire and impact-related injuries. No abnormalities were identified that could have led to pilot incapacitation. Toxicology results did not identify any substances that could have impaired the pilot’s performance.
From witness information and examination of the accident site, it is evident that during the turn onto the second bait application run, the pilot lost control of the aircraft and was unable to recover before impacting the ground. The observed wing rock and descent was consistent with an aerodynamic stall and wing drop.
Examination of the aircraft and engine did not identify any anomalies that would have precluded normal operation, or that would have required the pilot to jettison the hopper load to the east of the intended bait application area. The wind at the time was not considered significant to the baiting operation.
This analysis will consider the factors with the potential to have contributed to the loss of control, including the potential influence of the aeroplane weight and loss of engine power due to carburettor icing.
Interpretation of the flight path
Set-up for and initiation of the second bait application run
Following the first bait application run, the pilot repositioned the aircraft for the next swathe along the paddocks, which was intended from east to west. The location and orientation of the bait application outside the intended area was consistent with its commencement prior to the beginning of the planned baiting run, as the pilot was finalising the repositioning turn. The spread width of the bait (see the following discussion) was consistent with the aircraft being at a lower height than for the previous run. The ‘track’ of the bait appeared to indicate that the pilot may have been attempting to avoid the tree line at the north‑eastern corner of the area to be baited. The increased bait concentration in the vicinity of those trees was consistent with the pilot jettisoning the load, as opposed to a normal application, which is at a metered rate.
Examination of the second bait application run
The spread width of the bait throughout the initial application run was about 36 m. Consistent with the aircraft owner’s standard bait application height of between treetop height and 100 ft (30 m), a witness observed VH- NLP (NLP) conducting runs at treetop height, or about 50 ft (15 m) above ground level. This reported height, and the known spread width on the first run, was used as a basis for determining the approximate height of NLP between the grain release in the adjacent paddock through to the accident site.
The spread width decreased from 16 m to 7 m, before increasing again to a width of 30 m. This indicates that NLP was below the previous application height, and continued to descend before climbing until about 70 m from the accident site. From this position the aircraft descended and impacted the ground. This is consistent with an attempt by the pilot to regain height after descending in the latter stages of the repositioning turn.
Reason for the height loss and jettison of the load
In an effort to understand the reason for the commencement of the bait application before entering the intended baiting paddock, the ATSB considered whether the pilot may have been momentarily confused by the apparent similarity of the respective tree lines immediately east of the area to be baited, or concerned with the powerlines on and near the south-eastern boundary of the area. The tree lines were each outside the area and the pilot had correctly ceased the first application run before passing over and east of the south-eastern tree line. In addition, the first application run passed close to the powerlines, and the pilot could be expected to have been aware of their location. On this basis, the ATSB concluded that it was unlikely the pilot misinterpreted the relevance of the location of the north‑eastern tree line, or would have been overly concerned with the location of the powerlines, when setting up for the application run.
In respect of the jettison of the bait, the ATSB considered whether the pilot may have unintentionally descended lower than planned or mishandled the repositioning turn. The pilot had relatively low total aeronautical experience and low and interrupted experience in agricultural operations. In addition, an aerial agricultural instructor advised that, similar to the instructor’s experience with other less-experienced agricultural pilots, the pilot at times had difficulty maintaining attitude in turns and anticipating an impending aerodynamic stall. The instructor reported that this was a particular risk when low-experience pilots were not current in agricultural‑type operations. It is not possible to quantify the effect of the pilot’s more recent, non‑agricultural flights in January 2015 on their handling of the aircraft in the baiting operation.
Another reason for the pilot to jettison the load was a loss of engine power. In this regard, although there were no engine anomalies identified that would have precluded normal operation, the ambient conditions were conducive to serious icing at any power setting. Carburettor icing can lead to a loss of engine power (see the subsequent discussion). However, the time between the accident and examination of the wreckage allowed sufficient time for any ice, if present, to have melted.
Aerodynamic stall and loss of control
Flying at low-level gives very little or no margin to recover from unexpected events, such as aerodynamic stalls or other losses of control. Height loss from a stall in general aviation aeroplanes, assuming correct recovery technique and expectancy of the pending stall, is generally 100–350 ft (30–107 m). Therefore, stall prevention (including maintaining airspeed) is essential at low heights.
One of the limitations of stall training and practice is that stalls are generally expected by students and follow a routine pattern. For unexpected or non-routine situations, a pilot will be focussed on the task at hand or perhaps a developing situation and potentially miss the available cues. In this accident, this could have included the pilot focussing on the unintended loss of height during the repositioning turn. Pilot knowledge and skill in recognising a developing stall situation, and responding effectively, is an essential element of flight safety in any operation.
NLP travelled a relatively short 70 m across the ground after the apparent attempt to regain height until impacting the ground. The physical evidence at the site indicated that the aircraft was inverted in an almost vertical, nose-down attitude at impact. The short distance between the initial point of impact with the ground and location of the main wreckage indicated low speed at that time.
Loss of control as a result of an aerodynamic stall could not be definitively proven. However, the low-level flight and manoeuvring by the pilot leading up to the loss of control increased the risk that they might miss any cues of an impending stall. The orientation of, and damage to the aircraft at impact, and low speed at that time indicated that the most probable scenario was an aerodynamic stall and subsequent right wing drop, consistent with an incipient spin. The height of the aircraft at that time was insufficient for the pilot to regain control before impacting the ground.
Weight and balance
Although the aircraft was being operated above its maximum take-off weight by about 102 kg at take‑off, and by about 39 kg at the time the pilot jettisoned the load, there was no evidence of an in-flight structural failure. There was insufficient evidence to determine what, if any, effect the overweight operation of the aircraft had on the flight characteristics or the development of the accident. Despite the overweight operation not being found to be contributory, operators and pilots are reminded that operations within the approved weight and balance envelop provide for known handling and performance characteristics.
Carburettor icing
The recorded temperature at about the time of the accident was 12.3 °C, with a dewpoint[5] of 10 °C. Given these temperatures, the probability of carburettor icing was calculated to be in the serious icing range at any power setting (see the Carburettor icing-probability chart that is available from the Civil Aviation Safety Authority website.
Increased humidity increases the likelihood of carburettor icing. If ice continues to accumulate in the carburettor, the flow of air to the engine reduces. If the process is allowed to continue, it will result in a power reduction, and eventually the engine will stop. Examination of the wreckage indicated that the engine was still operating, however, the level of power being produced was not able to be determined.
A carburettor heat control was available in NLP. If selected, warm air was directed from a heat muff[6] installed on the exhaust system to the carburettor inlet, melting any ice in the carburettor. Due to the level of damage, the ATSB could not determine the position of the carburettor heat control at the time of the accident.
As previously discussed, given the time between the accident and examination of the wreckage, there was insufficient evidence to conclude that carburettor icing occurred or affected normal engine operation.
From the evidence available, the following findings are made with respect to the collision with terrain involving Piper Aircraft Corporation PA-25/A9 Pawnee, registered VH-NLP, which occurred 10 km west of Darlington, Victoria, on 20 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While positioning the aeroplane for a baiting run, and for reasons that could not be determined, the pilot inadvertently descended below the normal application height over an adjacent paddock before climbing and then losing control.
The aircraft probably stalled and entered an incipient spin at a height from which the pilot was unable to regain control before colliding with terrain.
Other factors that increased risk
The pilot took off with the aircraft about 102 kg over its approved maximum take-off weight, which can affect the aircraft’s handling characteristics.
Other findings
The weather at the time of the accident was conducive to carburettor icing, but the time between the accident and examination of the wreckage meant that any ice, if present, had melted.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
operator of VH-NLP
maintainer of VH-NLP
pilot’s aerial agriculture flying instructor
Bureau of Meteorology
Civil Aviation Safety Authority
Supplemental Type Certificate holder.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot’s aerial agriculture flying instructor, the operator of VH-NLP, the Bureau of Meteorology and the Civil Aviation Safety Authority.
Submissions were received from the operator and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 8 March 2015, the pilot of an Aero Commander 500 aircraft, registered VH-WZV, prepared to conduct a charter flight from Badu Island to Horn Island, Queensland, with five passengers. The aircraft had been refuelled earlier that day at Horn Island, where the pilot conducted fuel drains with no contaminants found. He had operated the aircraft for about 2 hours prior to landing at Badu Island with no abnormal performance or indications.
At about 1330 Eastern Standard Time (EST), the pilot started the engines and conducted the standard checks with all indications normal, obtained the relevant clearances from air traffic control, and taxied for a departure from runway 30. As the pilot lined the aircraft up on the runway centreline at the threshold, he performed a pre-take-off safety self-brief and conducted the pre-take-off checks. He then applied full power, released the brakes and commenced the take-off run. All engine indications were normal during the taxi and commencement of the take-off run.
When the airspeed had increased to about 80 kt, the pilot commenced rotation and the nose and main landing gear lifted off the runway. Just as the main landing gear lifted off, the pilot detected a significant loss of power from the left engine. The aircraft yawed to the left, which the pilot counteracted with right rudder. He heard the left engine noise decrease noticeably and the aircraft dropped back onto the runway. The pilot immediately rejected the take-off; reduced the power to idle, and used rudder and brakes to maintain the runway centreline.
The pilot initially assessed that there was sufficient runway remaining to stop on but, due to the wet runway surface, the aircraft did not decelerate as quickly as expected and he anticipated that the aircraft would overrun the runway. As there was a steep slope and trees beyond the end of the runway, he steered the aircraft to the right towards more open and level ground. The aircraft departed the runway to the right, collided with a fence and a bush resulting in substantial damage (Figure 1). The pilot and passengers were not injured.
Figure 1: Damage to VH-WZV
Source: Aircraft engineer
Engineering inspection
An engineering inspection was carried out following the incident. The engineer reported that both engines started and ran without problems and that he ran both engines to full power for sufficient time to establish that there were no obvious defects with the engines and that both engines produced full power. The magneto drop checks were within limits and fuel flows were normal. Both engines appeared to be in their normal configuration with the appropriate quantities of oil and no defects were noted.
The engineer also reported that there was adequate fuel on board the aircraft, and no contaminants were present in the fuel. The engineer verified that the propeller operation and feather checks were functional.
Pilot comments
The pilot reported that the fuel for both engines was selected to ON. At no time had either been selected to OFF, as it was not normal procedure to switch the fuel off when shutting the aircraft down.
Operator report
A report prepared by the aircraft operator, and provided to the ATSB, included the following:
Due to the prevailing conditions of a wet runway and the extremely powerful brakes fitted to the aircraft type, the wheels locked up and the aircraft skidded off the end of the runway. The operator stated that it was easy to aquaplane or lock the brakes in wet or emergency situations.
The aircraft was loaded within the weight and balance limitations and was 67 kg below the take-off weight for the available runway length, based on the approved performance charts.
Passengers on the flight commented on a problem with the left engine at the time of the incident.
Further engineering assessment of the engine and ancillaries will include fuel on board, fuel pumps (engine driven and electric), fuel control unit, magneto ignition systems, engine air intake system and other systems likely to contribute to a loss of engine power.
Safety message
In this incident the pilot had identified the safest run-off area in the event of an engine failure. Having completed a thorough pre-take-off safety briefing, following partial engine failure, the pilot was able to steer the aircraft to a relatively clear area that he had identified. This may have reduced the amount of damage the aircraft sustained, and the potential for injuries to the pilot and passengers.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 28 February 2015, at about 1232 Eastern Standard Time (EST), an Enstrom 280 helicopter, registered VH-YHD (YHD), departed from Caloundra Airport, for a flight to Redcliffe Airport, Queensland, with the pilot, who was the only person on board.
After about half an hour, the pilot commenced a descent from 1,500 ft above ground level (AGL). The pilot then broadcast on the Redcliffe common traffic advisory frequency (CTAF) that YHD would join the Redcliffe circuit in about 6 minutes and navigated along the coastline toward Redcliffe.
At about 1,000 ft AGL, the pilot heard a bang and the engine stopped. This caused the helicopter to yaw to the left violently. The pilot then attempted to restart the engine but was unsuccessful. At about 800 ft AGL, the helicopter entered autorotation[1] and the pilot prepared to land on the beach. The pilot observed people swimming in the sea and manoeuvred the helicopter to an area where there were no people. The pilot arrested the descent and the skids contacted the sand. The helicopter continued to move forward along the sand, and then a few seconds later the helicopter blades impacted the sand, and the helicopter rolled over. The pilot received minor injuries and the helicopter was destroyed (Figure 1).
Figure 1: Accident site showing the damage to VH-YHD
Source: Queensland police
Witness
A witness to the accident reported that the helicopter was first sighted at about 100 m above the ground, descending and approaching from the north. The only noise was from the rotor blades, with no engine sound. The witness reported that the wind was quite strong coming from the east. A stronger easterly gust came when the helicopter was close to the ground. The helicopter landed and continued to move forward, but then flipped upside down and the rotor blades contacted the sand. The helicopter came to rest about 150 m from where the witness was located. A passer-by assisted the pilot to exit the helicopter.
Pilot comment
The pilot provided the following comments:
This was the first flight after the completion of the periodic (100 hourly or 12-month) maintenance inspection.
The helicopter operated normally during the engine run-up checks and the flight, up to the engine failure.
The pilot commented not to delay in lowering the collective[2] and setting the airspeed as everything happened very quickly after the engine failed and the pilot instinctively conducted an autorotation.
The landing was smooth with no bump.
The weather was fine with a slight breeze from the north-east and the wind speed at Caloundra was about 10 kt.
Rather than fly direct to Redcliff airport the pilot had selected to fly along the shoreline. If YHD had flown direct to Redcliff then the engine may have failed over Deception Bay and YHD may have landed in the water.
The pilot stated that the number of flight hours experience on the helicopter type was about 60, with about eight flight hours on the type in the 90 days prior.
Helicopter maintenance
The helicopter engine was overhauled and installed in YHD in April 2006. At the time of the accident, the engine had completed about 146 hours since overhaul. The periodic (100 hourly or 12-month) maintenance inspection included overhaul of the engine magneto.
Maintenance organisation investigation
The maintenance organisation inspected the engine externally and removed the number three cylinder. They determined that the damage found to the number three cylinder and piston (Figure 2) was consistent with detonation. Extreme heat from uncontrolled burning of the combustion gases resulted in melting of the cylinder between the spark plug hole and the exhaust valve seat. This melting damaged the piston to an extent that the combustion gases would blow past the piston rings. The maintenance organisation did not remove the other cylinders.
The maintenance organisation also removed the engine magneto and fuel control unit. Both units were examined at a component overhaul facility. The examination of the magneto found no defects. The examination of the fuel control unit found that it was functioning normally and was set to a lean position, although this position could not be validated due to disruption during the accident.
Figure 2: Damage to number three cylinder and piston
When planning a particular flight it is important for pilots to consider options and risk. In this accident, the pilot opted to follow the coastline, allowing for the option to land on the beach. The pilot in the pre-flight planning identified the hazard (flying over water) and although the likelihood of an engine failure was low, the consequences were high and made the decision to follow the coastline to mitigate the risk. If the pilot had selected the option to fly the most direct path then the engine would have failed over the water.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 February 2015, a Drifter and a Thruster ultralight aircraft, recreational registration 25-0452 and 10-0339 respectively, both collided with terrain approximately 7km south of Donnington Airpark, near Townsville, QLD.
Recreational Aviation Australia (RA-Aus) is the organisation responsible for investigating this accident. As part of its investigation, RA-Aus requested technical assistance from the Australian Transport Safety Bureau (ATSB) in the examination of physical components from the involved aircraft. To protect the information supplied by RA-Aus to the ATSB and the ATSB's investigative work to assist RA-Aus, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.
Results of a visual examination of the physical components were provided to RA-Aus on 8 April 2015.
At about 0513 on 12 March 2015, the driver of a Sydney Trains A-set passenger train operated the train in the wrong running direction from Mt Druitt station. Instead of travelling towards St Marys on the Down Suburban line, he drove 761 m in the opposite direction towards Blacktown. The driver only braked after a network control officer (NCO)[1] contacted him and told him to stop. At the time, only the driver and guard were on board.
At the same time, a Pacific National freight train was about four kilometres away and travelling towards the passenger train on the same line. The NCO also called the driver of the freight train and told him to stop. There were no injuries or damage as a result of this incident.
What the ATSB found
The ATSB found that a number of factors contributed to the driver losing awareness of the way the train was facing. It was likely the driver was:
confused about the direction due to changing ends seven times
distracted from the main task of driving as he had spent over 3 hours at Mt Druitt station performing other tasks before he started driving
at risk of making an error due to his high workload
feeling under pressure to move the train
impaired by fatigue due to being awake for over 21 hours and in the low range of the circadian sleep cycle.
Sydney Trains fatigue management processes were ineffective in identifying the fatigue impairment experienced by the driver.
The guard did not take any action to stop the train although the guard was aware that the train was running in the wrong direction.
What's been done as a result
Sydney Trains conducted an internal safety investigation and is implementing several safety actions in response to that internal report.
Safety message
Rail operators should ensure that adequate strategies exist to safeguard against fatigue impairment of train crew. It should also be noted that train crew have a responsibility to decline a shift if they feel that their performance may be affected by fatigue.
On Wednesday 11 March 2015, at about 1840,[2] a storm blew a house roof off and into the rail corridor. The roof landed on the tracks at Mt Druitt, which affected the overhead electrical supply. Consequently, the track between Blacktown and Penrith was partially closed and Sydney Trains passenger train, 165-S, was held at Mt Druitt station. Passengers disembarked and continued their journey by other means.
Sydney Trains’ Train Crew Assignment Centre (TCAC) decided that the existing train crew would need to be relieved if the train was going to be held at Mt Druitt station for an extended time. TCAC called a driver and guard who were on a stand-by roster and offered them the extra shift. Both accepted and made their way to Central station. The guard signed on at 2000 and the driver at 2100.
Before going to Mt Druitt, the driver and guard completed a passenger service from Central to Hornsby. After this trip they were directed to Mt Druitt station to relieve the train crew on 165-S.
They travelled separately to Mt Druitt station. The guard arrived at 0128 and the driver at 0154. Both went to the country end of platform 3 where the previous train crew were waiting to be relieved. The driver received handover information about problems with the train from the previous driver. He was advised that:
the overhead electrical supply was off
the internal cab lights were not working
the external lights were flashing on and off
the pantographs were down and the pantograph pump was not responding
the Metronet train radio was not working
the faults had been reported to mechanical control.
The previous driver left the station and, at 0205, the driver unsuccessfully attempted to log into the train’s control system and turn on the internal cab lights. The guard was also unsuccessful in attempting to log in to the system.
As the train radio was not working, the guard and driver exchanged mobile phone numbers to enable communication between them. A network control officer (NCO) reported after the incident that he was unable to establish effective communication with the driver until he obtained the driver’s mobile number around 0500. Meanwhile, much of the communication from the signal box throughout the night was via the guard’s mobile phone or via the Mt Druitt station staff, who would walk down to the platform and speak to the driver.
At 0216, the driver walked to the train’s cab at the city end in an attempt to log into the train’s control system. He was again unable to do so. He phoned the guard and requested that they change ends. He returned to the country end at 0218, passing the guard on the platform who went to the city end of the train.
At 0257, overhead power was restored to all running lines. At 0311, a member of Mt Druitt station staff walked down onto the platform and told the driver that the signal box was trying to contact him. The driver phoned the NCO, who informed the driver that power was restored and that he should get ready to depart.
The driver again attempted to log into the train’s computer system, but was unable to do so. The driver phoned mechanical control about logging in and they gave him further instructions to try to rectify the fault. The driver’s login attempts were again unsuccessful. He was then advised to go to the cab at the city end and try to log in there.
At 0332, the driver walked from the country end to the city end and found the guard on the phone to mechanical control discussing the train’s computer system. They both tried to log in. Their attempts were unsuccessful. The driver made his way back to the country end of the train to try a similar process, but was again unsuccessful.
At 0349, the driver left the country end of the train and walked along the platform while speaking to mechanical control on his phone. Halfway along the platform he turned back and returned to the cab at the country end of the train.
A few minutes later, the driver walked from the country end towards the city end. Mechanical control sent a train technician to assist the driver. He arrived at 0352 and met the driver on the platform. Both the train technician and the driver then walked along the platform to the city end of the train where they attempted to get the train working. The train technician requested the driver assist him with the procedure. Once again, the attempt was unsuccessful.
At 0403, the driver and train technician changed from the city to the country end of the train. Both the driver and train technician worked on restarting the train. After a few attempts, they were successful in raising the pantographs. Other issues, such as the train radio, needed attention by the train technician. The train technician left the train at 0436 to get his laptop from the work van. The technician returned to the country end and was successful in restarting the train’s computer. This restored the destination indication panel on the train, but did not fix the train radio problem.
The driver left the train again to go up to the concourse level to the toilet. The driver was on the phone the entire time until returning to the train. At 0452, the guard received a call from the Rail Management Centre discussing problems with the train and asking to inform the driver to move the train soon. The guard spoke to the driver about this message. At 0453, a member of Mt Druitt station staff walked to the country end of the train and passed a message to the driver that the signal box was trying to contact him.
At 0455, an NCO spoke to the driver on his mobile phone and asked the driver if everything was good and if he was ready to go. The driver told the NCO about the problems with the train radio. Just as the driver was asking about his instructions and where he was going, the NCO ended the call to take another call. He then called back at 0458. During this call, he told the driver to operate the train to St Marys, terminate the train, and then return to Macdonaldtown Stabling Yard. The driver stated, ‘OK, I understand’.
The driver called the guard at 0502 and asked to change ends with him. The driver and train technician then walked together towards the city end of the train. At the same time, the guard walked towards the country end. The three met in the middle of the platform and talked for a few seconds. The guard assumed that they were changing ends not to move the train, but to rectify more problems. After a short conversation between the guard and the train technician, the driver and train technician continued to the city end of the train. This was the final change of ends before the driver moved the train.
The driver had changed ends seven times in 3 hours.
The guard was informed that the train could run without a functioning train radio - the NCO said, ‘it’s getting critical, we need him to move’. At 0505, an NCO called the driver and asked if the driver still had a problem. The driver said that they were about to conduct a continuity test after which they would be ready to depart. The NCO said to the driver, ‘(we are) trying to get you motivated, that’s all’.
The occurrence
The train technician, having completed his work, left the driver at the city end of the train at 0507 and departed the station. At 0511, an NCO called the driver and asked when he would be departing. The driver responded that they were departing ‘just now, just now’ but said he would talk with the guard first and probably depart ‘in five seconds’. Meanwhile, the guard called the driver on the train’s intercom system.
The guard informed the driver that he was in the wrong cab if they were heading to St Marys. The driver acknowledged that he heard this information. The driver and guard then discussed the continuity test before exchanging bell signals at 0512. The internal bell signals are used for communication between the driver and the guard. A single bell (all right) was given by the driver at 05:12:46; the guard returned this at 5:12:51.
Immediately after finishing the conversation with the guard, the driver engaged the power handle to 68% to move the train. The time was 0513:05. The train moved away from Mt Druitt station in the up running direction on the Down Suburban line[3] (Figure 1). The train was travelling in the wrong running direction. The driver said he had his head down and was focussed on the controls. The guard was at the door of the train as it moved away from the station. The guard said that the reason the focus was towards the platform was in case late running passengers attempted to get onto the train.
Figure 1: Night time view from Platform 3 (city end)
The white arrow shows the wrong running direction that train 165-S travelled on the Down Suburban line.
Source: Sydney Trains
At 0513:30, after the train had travelled 111 m, the driver adjusted the power handle to 49%, a normal setting for the train to coast. At the same time, NCOs were observing the train movements on their Train Visibility System screen. They observed that the train was heading in the wrong running direction. An NCO made a call to the driver via his mobile phone at 0514:38 and told him to stop the train immediately and not move it any further. The driver said that he would do so and applied the brakes immediately.
At the same time a freight train, CA63, about 4 km away was travelling on the same Down Suburban line towards 165-S. It had just passed through Blacktown station and was approaching Doonside. An NCO contacted the crew of the freight train and told them to stop. This train was stopped before Doonside station.
Before the freight train was stopped, it was travelling in the correct running direction with line-side signals providing the driver with indications along the route. It is likely the driver of the freight train would have reached a signal at stop before reaching the passenger train. This was because the presence of the passenger train would have been detected by the signalling system, setting the signals to stop between it and the freight train.
Meanwhile, the driver of the passenger train had no signals facing him and no mechanism warning him of the freight train ahead. The available defences were the awareness of the driver and guard on the train, and the vigilance of the NCOs watching the Train Visibility System screen in the signal box.
Post-occurrence events
The time was 0514:46 when 165-S came to a stand with the leading car (city end) located at 42.470 km. It had travelled 761 m since leaving the station. During the trip, the train had reached a maximum speed of 33 km/h.
At 0515, the guard made a call to the signal box and enquired whether the driver had authority to head in the wrong running direction. The guard was told that the driver did not have this authority. The NCO again phoned the driver and instructed him to hold the train until an Incident Rail Commander arrived.
At 0521, the Rail Management Centre Shift Manager instructed an Incident Rail Commander to attend. He arrived at 0545 and tested both train crew for the presence of alcohol. Both returned a negative result. The driver was requested to change ends and drive the train back to Mt Druitt station. Authority was given and, at 0614, the train departed, arriving at Mt Druitt station a few minutes later. Both crew were drug tested at 0633. These results were also negative.
The incident occurred at Mt Druitt station on the Down Suburban line. Mt Druitt is located 43 km west of Sydney (Figure 2).
Figure 2: Location of incident at Mt Druitt
This map shows the major railway lines in the Sydney metropolitan area including the western line where the incident occurred.
Source: Geoscience Australia
There were four platforms and four standard gauge lines at Mt Druitt station, the Up and Down Suburban lines and the Up and Down Main lines. Platform 3 is next to the Down Suburban line (Figure 3).
Figure 3: Line information Mt Druitt
The red arrow shows the direction that train 165-S travelled on the Down Suburban line.
Source: OTSI
Train information
Sydney Trains operated the train involved in the incident. The set number of the train was A19. On the day of the incident, it was completing run 165-S. The A-set or Waratah train is an electric multiple unit. It consisted of eight cars with a driving car at each end (Figure 4), two motor cars located next to each driving car, and two trailing cars in the centre of the train. Waratah trains first entered service on the NSW rail network in 2011.
Figure 4: A-set driving car
Source: Sydney Trains
Crew information
The driver and guard were based at Central station, Sydney. Both lived in the inner suburbs of Sydney and had less than 30 minutes travel time to work.
The driver was an experienced driver, starting as a metropolitan train driver in April 2005. He was familiar with the route, fully qualified and medically fit.
The guard was less experienced, having started as a guard in June 2013. The guard was qualified and medically fit.
The driver and guard had not previously worked together.
Environmental conditions
The storm that had caused the network delays the previous evening had long since passed by the time of the incident. Other than some rain showers between 0248 and 0258, there were no adverse weather conditions.
The overnight minimum temperature was 17.5°C as recorded by the Bureau of Meteorology at Horsley Park, approximately 10 km from Mt Druitt station.
It was still dark when the incident occurred at 0513. Sunrise was at 0553.
Network management
NCOs in the Blacktown, Penrith, and St Marys signal boxes control train movements in the area around Mt Druitt. The train controller in the Rail Management Centre at Central also has visibility of train movements throughout the network.
Train maintenance
A private company, Downer Rail, was the contracted entity responsible for A-set train maintenance at the time of the incident. On the morning of the incident, a train technician from Downer Rail attended the site and assisted the driver to restart the train. He left before the driver moved the train.
Safety analysis
Introduction
The driver of passenger train 165-S drove the train in the wrong direction for 761 m. Previously the guard had warned the driver that he was in the wrong cab if he was going to St Marys. The guard did not take any action when the driver started driving in the wrong running direction. An NCO quickly realised the train was heading in the wrong running direction and contacted the driver to stop 165-S.
The driver did not realise the direction that the train was facing before moving the train. This was despite being familiar with the station, the route that he was to operate over, and the guard reminding him that he was at the wrong end of the train. A combination of changing ends a number of times, the length of time at the station, a high workload, and fatigue are the likely reasons he lost awareness of which way he was facing. The driver also felt under pressure to get the train moving after several telephone conversations with NCOs.
This section examines the contributing factors that led to the driver’s action including his work schedule and some preconditions for his unsafe act. It also explores the role of the guard and Sydney Trains fatigue management system.
Factors affecting the actions of the train crew
Time of day
The period between 0200 and 0600 is well established as a period of reduced performance. This is due to the effects of the circadian cycle, which predisposes humans to sleep during the night and be wakeful during the day. When we reverse these activities and work through the night and sleep during the day, we compromise the quality and the quantity of sleep, as well as the quality of the work performed. Thus, time of day creates an additional element of fatigue risk in 24−hour rail operations. The increase in fatigue and the deterioration in performance with time on task have been shown to occur more rapidly overnight.[4]
Another factor that affected the driver’s performance was the night environment. Although there was adequate lighting around the platform and train, the darkness limited visual cues about the direction he was facing. The signal that was closest to the driver was facing the other way. It was designed for trains travelling in the Down direction on the Down Suburban line. The driver said he could not see or did not notice this signal.
Fatigue impairment
In the context of human performance, fatigue is a physical and psychological condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep.[5] The National Transport Commission recognises five main factors contributing to fatigue impaired work performance:
the duration of a duty period (time on task), and the rest breaks within and between shifts
inadequate sleep (or sleep debt), which results from inadequate duration and quality of prior sleeps
circadian effects, which involve working and sleeping against natural body rhythms that normally program people to sleep at night and be awake and work during the day
the type or nature of the task being undertaken (workload)
the work environment.
These factors are compounded by a person’s body clock, environmental conditions, stress, age and personal health and fitness.[6] Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission.[7] Transport accident investigation agencies have identified fatigue impairment as a causal factor in many accidents and incidents.
The driver indicated during an interview that at the start of the shift he felt exhausted, then while he was working on the train ‘adrenaline kicked in’. However, as the shift progressed, he got tired. He said that at the time of the incident he ‘felt drowned - exhausted in the cab'. As an explanation for why this incident happened, he said it was ‘particularly to do with so many hours without sleep’. It should be noted that the driver had a personal responsibility to declare himself unfit for work if he felt that his performance would be affected by fatigue. Research has shown that assessing your own level of fatigue is difficult.[8] There are also a number of reasons why train crew are reluctant to decline an extra shift. Although not indicated by the crew in this incident, common reasons cited by train crew for accepting shifts when fatigued include the loss of income and gaining a reputation as someone who is not reliable.
The scheduling of drivers to work in the early hours of the morning is unavoidable. Knowing the risks associated with early morning shifts is important to optimise the rostering of train crew. The selection of this driver to work this shift increased his risk of error.
Given the driver’s actions and his reported state of fatigue impairment, as well as the established links between fatigue impairment and increased error, Sydney Trains’ management of fatigue risk was investigated.
Driver’s roster
An examination of the driver’s roster, including the incident shift, showed that he had worked 12 of the previous 14 days. In addition, this shift, a stand-by shift, was his tenth consecutive shift. The previous shifts all started in mid-afternoon or in the evening. He worked no morning shifts. This meant he was in a pattern of going to bed around 0100 and sleeping in. He said that if he had not worked this shift he would have gone to bed about midnight. The incident occurred at 0513, a time when he had planned to be sleeping.
The driver said that he started the day about 0800 and spent the day visiting friends. Rostered as a stand-by driver he received a call from train crewing at 2022.
Some of the rostering principles set down by Sydney Trains are:
maximum shift length is set as 9 hours for the driver of a suburban train
workers new to shift work or returning should not be rostered on night work or early morning for their first shift
total hours worked should be no more than 48 hours per week
break of 11 hours between shifts
maximum number of shifts is 12 in a 14 day period
limit night shifts and early morning starts
schedule frequent breaks during a night shift or if the work involves sustained mental or physical activity.
Although the driver considered that he was affected by fatigue when the incident occurred, Sydney Trains use of bio-mathematical modelling did not predict that the driver’s roster would place him at risk. Their assessment of the suitability of the roster for managing fatigue risk was based primarily on the use of a bio-mathematical fatigue modelling program known as the Fatigue Audit Interdyne (FAID).
Bio-mathematical models attempt to predict the effects of different working patterns on subsequent job performance, with regard to the scientific relationships between work hours, sleep, and performance.[9] FAID does not predict fatigue but rather predicts a sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep, producing a work-related fatigue score.[10]
When evaluating rosters, there are a number of documented limitations with over-reliance on bio-mathematical models such as FAID. Because the distribution of fatigue across a given population of employees working the same roster is significant, it is difficult to generalise from the average data generated by a bio-mathematical model. As noted by the NSW Independent Transport Safety Regulator (ITSR):
…fatigue models are appropriate to use as one tool to help evaluate group rosters to help identify how aspects of fatigue exposure are distributed. Model outputs... should never be the sole basis for a safety risk management decision regarding work hours.[11]
FAID, along with other bio-mathematical models, is a useful tool to account for hours of sleep opportunity provided, thereby providing an indication of fatigue exposure across a group of employees. It cannot account for the hours of sleep actually achieved by individuals, nor for the quality of that sleep. These additional factors necessitate the use of multiple layers of controls to manage fatigue-related risk.
Sydney Trains’ management system included policies, procedures, and training to address train crew fatigue impairment. These systems provide guidance for management and employees to ensure there is an awareness of countermeasures in this area. This case should serve as an opportunity to review the rostering of train crew, especially those called in on the stand-by roster.
Time pressure
For most transport operators there is a balance between on-time running and having a safe system. ‘To achieve both safety and on-time running requires the ability to identify hazards that can disrupt services or compromise safety and efficiently manage the risks those hazards create’.[12]
Both train crew received a number of calls from NCOs throughout the shift. The train was expected to be moved once power was restored to the electrical supply. It is likely that NCOs were concerned about delays to the upcoming morning peak. This concern was communicated to both the guard and the driver.
The conversation between the NCO and the driver two minutes before he eventually moved the train was as follows:
Person
Voice recording
NCO
‘Are you right to depart though?’
Driver
‘Yeah, I have just confirmed with the box’.
NCO
‘So how long before you depart?’
Driver
‘Just now, just now’.
NCO
‘So are you on the move?’
Driver
‘Yes - no. I am just going to confirm with the guard … probably 5 seconds’.
NCO
‘Ok thank you’.
The driver said later, 'I felt under pressure to get moving from the box. I moved a few seconds after talking to the (signal) box’.
Communication was hampered by the train radio not working. Initially, this meant information to the driver was relayed via the guard and station staff. Eventually communication was made directly to the driver via his mobile phone. Normally drivers must turn off their mobile phones when driving, but an exception is made when the train radio is not working.
Area control also contacted the guard. The guard was told, correctly, that the train could be moved without a working train radio. The NCO asked that the driver be reminded that a document about this had been released the previous week.[13] The guard was also told that, ‘it’s getting critical that we need him to move’.
Research suggests that a call from a controller to explain a delay increases pressure on the driver to perform.[14] ‘In general, under stress, attention appears to channel or tunnel, reducing focus on peripheral information and tasks and centralising focus on main tasks’.[15] The tunnelling of attention can be a good thing or a bad thing for performance. In this case, the driver said he was completely focussed on the controls in front of him. It is likely that this contributed to him confusing the direction in which he was about to move.
Workload
The driver experienced a period of sustained high workload during his time at Mt Druitt station in the hours leading up to the incident. For over three hours, he made or received a large number of phone calls communicating with network control, train maintenance and the guard. He was on his feet during this time, either standing in the train cab, walking to the other end of the platform or walking up to the concourse.
Research has shown that a high workload can result in slower task performance and errors. ‘Unusual or high workload situations and situations where people are under time pressure can contribute to fatigue related incidents. Rather than causing fatigue in the traditional sense, workload has been described as a factor which can either mask or augment the effects of fatigue. People working under time pressure, or with a high workload, are most likely to make errors at the time of day that this incident occurred.’ [16]
Time at station
The amount of time the driver spent at the station before starting to drive may have affected his performance. The driver had been at Mt Druitt station since 0154 and, for the majority of the time, working and problem-solving to get the train started. For three hours, his focus of attention was directed at fixing problems with the train. The driver’s attention was away from the routine task of driving. When he departed, it was likely his mind was still engaged with the previous task he had spent so much time working on.
The driver said at interview that, after eventually moving the train, ‘when I put my head up, something was weird in my brain. I saw we were not on the right path, with 10 years’ experience as a driver. So everything it was upside down’.
Research suggests that an extended time spent at the station serves to dislocate the driver’s attention from the primary task and safe working. This research found that inattentiveness was deemed to arise primarily from the consequence of disengagement from an active driving state, which gives rise to the process of distraction and reduced situation awareness.[17]
Multiple end changes
Since arriving at Mt Druitt station at 0154, the driver had changed ends seven times. On another occasion, he walked half way along the platform and returned. He had also left the train and walked up to the concourse on two occasions. The timing of driver movements is shown in the table below:
Time
Driver actions
0154
Arrives at Mt Druitt Station and goes to country end of train
0211
Leaves train and goes up to concourse level
0216
Changes from country to city end
0218
Changes from city to country end
0332
Changes from country to city end
0342
Changes from city to country end
0347
Starts to change from country to city end, stops half way and returns
0351
Changes from country to city end
0403
Changes from city to country end
0448
Leaves train and goes up to concourse level
0502
Changes from country to city end
0513
Driver starts driving wrong way from city end of train
It is likely that changing ends on multiple occasions confused the driver. After the train technician arrived, the driver and train technician changed ends twice together (0403 and 0502) and the driver may have thought he would be returning to the country end. He said he thought the train technician would be travelling to St Marys with him. After the train technician left the driver in the cab, the driver should have returned to the country end. Instead the driver prepared to move the train, exchanged bell signals with the guard, received a phone call from the signal box and an intercom call from the guard, then moved the train shortly afterwards.
The role of the guard
The use of a driver and guard is an important measure to mitigate the risk of driver error. ‘Train Crew are responsible for the safety of all passengers on the train, and must be prepared to stop a train immediately if an emergency situation arises. The Train Crew must assist each other to provide for the safety of all passengers’.[18]
A guard provides a level of redundancy in the system. It is essential that guards are not reluctant to take action in an emergency.
The guard was less experienced than the driver. They had not previously worked together. The guard reminded him at least twice that he was in the wrong end of the train if they were going to travel to St Marys. The driver recalled that the guard had told him this. It seems that the driver did not assimilate the significance of the advice, given all that was going on at the time.
The guard took no action when the train started moving in the wrong running direction. This was despite knowing the train was going the wrong way. The guard thought that the driver might have received authority to do this. After the incident, the guard contacted the Rail Management Centre to ask them if they had given authority from the driver to go in the wrong running direction, perhaps being issued a Special Proceed Authority. The guard was told that they had not given any such authority to the driver.
If the guard thought the train was going in the wrong running direction a number of actions could have been taken. These included:
calling the driver and asking him what he was doing
giving a bell signal, of two bells, which tells the driver to stop immediately
operate the emergency brake isolating cock to bring the train to a stand.
Instead, the guard made a decision to watch for passengers on the platform that may have been trying to board the train before it moved off. There were few passengers on the station at the time.
Since the late 1970s, aviation accident investigation agencies have identified ‘authority gradients’ existing between crew contributing to incidents. One significant aviation accident where an authority gradient was a contributing factor was the collision of two Boeing 747s at Tenerife Airport, in 1977. The crash killed 583 people, making it the deadliest accident in aviation history.
‘In a study of 249 airline pilots in the United Kingdom, nearly 40 percent of first officers stated that they failed to communicate safety concerns to their captains on more than one occasion for reasons that included a desire to avoid conflict and in deference to the captain’s experience and authority’.[19]
In 2003, a passenger train derailed at Waterfall, NSW killing 7 persons including the driver. The Special Commission of Inquiry set up to investigate this accident found that an authority gradient existed between the guard and driver. This was one of the factors that discouraged the guard from responding in the emergency. One recommendation discussed improving driver and guard training to encourage teamwork and discourage authority gradients.[20]
Both driver and guard from the Mt Druitt incident had received training about effective communication and teamwork, the guard most recently in 2013.
Track configuration
The track configuration between Westmead and St Marys is different to many other areas in the Sydney metropolitan network. In most multiple track areas, the sequence of tracks will generally be an Up line next to a Down line. The track configuration at Mt Druitt placed both Down lines next to each other, and both Up lines next to each other. This has caused confusion to some drivers and maintenance staff in the past. There is no evidence that this contributed to the driver moving the train in the wrong direction.
From the evidence available, the following findings are made with respect to the wrong running direction of a Sydney Trains passenger service, 165-S, that occurred at Mt Druitt, NSW on 12 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The driver lost awareness of the direction he was to travel due to changing ends seven times in 3 hours while dealing with tasks not usually associated with driving while the train was stationary at Mt Druitt station.
The driver spent over 3 hours at Mt Druitt station performing other tasks before he started driving, his focus of attention directed at fixing problems with the train. When he departed, it was likely his mind was still engaged with the previous task.
The driver experienced a period of sustained high workload during his time at Mt Druitt station in the hours leading up to the incident.
The driver felt that he was under pressure to move the train after receiving multiple telephone calls questioning when he would be moving.
It is likely that the driver of train 165-S was experiencing some level of fatigue impairment when he started driving the train in the wrong running direction.
The time of day when the incident occurred is known to be in the low range of the circadian sleep cycle.
Sydney Trains' fatigue management processes were ineffective in identifying the fatigue impairment experienced by the driver. [Safety issue]
The guard did not take action, either to stop the train or warn the driver, when the driver started driving in the wrong running direction.
Other factors that increased risk
The driver did not assimilate information from the guard, who told him, on two occasions, that he was in the wrong end for the instructed direction of travel.
Other findings
The NCO recognised that train 165-S had started moving in the wrong running direction. The timely action by the NCO in stopping both trains (165-S and CA63) was fortunate.
Safety issues and actions
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Fatigue management
Sydney Trains' fatigue management processes were ineffective in identifying the fatigue impairment experienced by the driver.
The sources of information during the investigation included:
Downer Rail
Sydney Trains
References
Battelle Memorial Institute (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle. Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.
Dawson, D., Noy, Y.I., Harma, M., Akerstedt, T. & Belenky, G. (2011). Modelling fatigue and the use of fatigue models in work settings. Accident Analysis and Prevention, 43, pp 549-564.
Independent Transport Safety Regulator (2010). Transport Safety Alert 34 - Use of bio-mathematical models in managing risks of human fatigue in the workplace.
McInerney, P.A. (2005). Final Report of the Special Commission of Inquiry into the Waterfall Rail Accident Vol. 1.
National Transport Commission (2008). Management of Fatigue in Rail Safety Workers. National Rail Safety Guideline.
National Transportation Safety Board. (2011). Safety Recommendation A-11-39.
Naweed, A. (2013). Psychological factors for driver distraction and inattention in the Australian and New Zealand rail industry. Accident Analysis and Prevention, 60.
RailCorp. (2013). TWP 100 Responsibilities of Train Crew. TOM Notice No. 16.
Staal, M. A. (2004). Stress cognition and human performance – A literature review and conceptual framework. NASA Technical Memorandum. NASA/TM—2004–212824.
Sydney Trains – RailSafe website. (2015).
Van Dongen, H.P.A., Maislin, G., Mulligan, J.M., Dinges, D.F. (2003). The cumulative cost of additional wakefulness: Dose-response effects on neurobehavioral functions and sleep physiology from chronic sleep restriction and total sleep deprivation. Sleep, 26, pp117-126.
Williamson, A., Lombardi, D.A., Folkard, S., Stutts, J., Courtney, T.K. & Connor, J.L. (2011). The link between fatigue and safety. Accident Analysis and Prevention, 43, pp 498-515.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to:
Downer Rail
the Downer Rail train technician
Office of the National Rail Safety Regulator
Pacific National
Sydney Trains
the train crew of 165-S
Submissions were received from Downer Rail, the Office of National Rail Safety Regulator, Pacific National, Sydney Trains, and the train crew of 165-S.
The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 28 February 2015, an instructor and student were conducting a training flight in a Robinson R22, registered VH-CMK, at Archerfield Airport, Queensland. The objective of the flight was to teach the student how to manage jammed anti-torque pedal[1] and jammed collective[2] emergencies. Conditions were fine and clear with a light and variable wind.
The flight commenced with the instructor flying the helicopter in a set direction, demonstrating how to effectively control the helicopter with the pedals jammed in position. The jammed pedal condition was simulated by holding the pedals in a set position with foot pressure, then manipulating the other flight controls and adjusting engine power and airspeed to control the helicopter. Satisfied that the key elements of the demonstration had been effectively addressed and nearing the boundary of the area in which the helicopter had been cleared to operate, the instructor turned the helicopter through about 180 degrees and commenced a similar demonstration travelling in the opposite direction.
During the second demonstration, the helicopter was established in forward flight around 15 ft above the ground at an airspeed of about 40 kt. The instructor simulated a jammed pedal condition, setting the left pedal slightly forward of the neutral position. As the demonstration progressed, the instructor elected to complete the exercise by conducting a simulated jammed pedal run-on[3] landing. The helicopter touched down on a grass surface near the northern boundary of the airport, just outside the runway strips associated with runways 22R/04L and 22L/04R. The grass in the area where the helicopter touched down was slightly longer than the grass on the runway strips, but the instructor was comfortable continuing with the run-on landing, noting that it was not uncommon to operate helicopters on that surface.
The demonstration went as expected up until the point that the helicopter touched down. Still travelling forward at about 10 to 15 kt, the helicopter bounced slightly and yawed to the left. The instructor discontinued the demonstration at that moment, allowing himself full use of the pedals, but he was unable to correct the yaw before the helicopter touched down again. When the helicopter touched down a second time after a very short and shallow bounce, even though the helicopter was level, the forward part of the right skid dug into a surface undulation. The right skid then effectively acted as a pivot, tipping the helicopter to the right. The instructor fully lowered the collective, but the roll continued. The instructor then applied left cyclic[4] but he was unable to stop the helicopter rolling onto its right side.
Aware that a fuel leak had developed, the instructor closed the fuel shut-off valve and turned the master electrical switch off. The instructor and student moved to a safe distance following which the instructor contacted air traffic control (who alerted emergency services). The instructor and student suffered minor injuries and the helicopter was substantially damaged.
Instructor comment
The instructor made the following comments in relation to the accident:
The nature of the surface (outside the runway strips) probably contributed to the accident, given the manner in which the right skid dug into a surface undulation. There was a current NOTAM[5] at the time of the accident stating that grass areas were soft and wet, but the reason the skid dug in rather than skipped forward, seemed to relate more directly to the slightly undulating nature of the surface, rather than how firm the surface was. During future similar exercises involving run-on landings on unprepared surfaces, the instructor intends to inspect the surface for suitability beforehand.
The instructor was mindful of the possibility of dynamic rollover[6] under the circumstances, so consciously avoided applying power and collective as the helicopter tipped.
The instructor had invited the student to place his hands and feet lightly on the controls during the demonstration, to maximise the training benefit of the exercise. The instructor commented that the student may have inadvertently applied some pressure on the pedals during the accident, which could have reduced the effectiveness of the instructor’s attempt to correct the yaw after the initial bounce.
Safety message
This accident highlights the manner in which some hazards may not be immediately obvious. Helicopter training organisations are encouraged to consider the quality of the landing area surface during hazard identification and risk assessment processes associated with training operations, particularly those that involve run-on landings.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 0400 on 28 February 2015, a harbour pilot boarded the container ship Maersk Garonne for its passage into Fremantle’s Inner Harbour. The pilotage generally progressed as intended by the pilot until the ship approached the entrance channel 40 minutes later. At this stage, he became concerned that the assisting harbour tugs would not be at the channel’s entrance before the ship.
At 0442¾, the pilot decided to delay entering the channel by taking Maersk Garonne outside (south of) the channel and entering it later. At 0448, the ship grounded in charted shallow water. The ship did not suffer any damage and was re-floated on the rising tide about 3½ hours later.
What the ATSB found
The ATSB investigation found that bridge resource management was not effectively implemented on board Maersk Garonne. As a result, the ship’s bridge team was not fully engaged in the pilotage and did not effectively monitor the ship’s passage. While the master retained responsibility for safe navigation of the ship, the harbour pilot was the only person actively focused on the pilotage. Consequently, single-person errors that occurred went undetected or inadequately challenged and uncorrected.
The investigation identified that Fremantle Pilots’ publicly available passage planning guidance for the pilotage was inadequate and was not effectively implemented. Further, Fremantle Pilots’ pilotage procedures did not include abort points or contingency plans for identified risks.
The investigation also found that procedures for tugs to be on station at the entrance to the port, or for their co-ordinated movement, were not clearly defined.
What has been done
Fremantle Pilots, the port’s pilotage provider, has reviewed and updated its website, procedures and training with respect to pilotage, passage planning and communications. This includes simulator training for emergencies.
Svitzer Australia, the towage provider, has updated its procedures to include defined on-station times for tugs.
Fremantle Ports, the port authority, has advised that it has clarified the role of the vessel traffic service in assisting ship arrivals and berthing.
The safety actions noted above, together with joint simulator exercises, clarify the roles and responsibilities of all parties with respect to monitoring and management of pilotages. This increases safety margins and reduces the likelihood of a similar incident in the future.
Maersk Garonne’s managers have issued fleet circulars to emphasise and clarify the roles and responsibilities of the master and ship’s crew during navigation with a pilot on board. The managers have also implemented a fleet-wide program that includes education and auditing to ensure compliance with bridge procedures.
Safety message
Comprehensive passage planning that includes risk-assessed contingency planning is vital to safe pilotage and underpins effective bridge resource management. The potentially severe consequences of a pilotage accident means that a low accident rate in the past is not a reliable indicator of safety risk.
The occurrence
During the early hours of 28 February 2015, the 292 m, 4,318 TEU,[1] fully cellular container ship Maersk Garonne (Figure 1) arrived off the Port of Fremantle, Western Australia, after a voyage from Singapore. At 0200,[2] the master arrived on the ship’s navigation bridge (bridge) and at 0300, he took over the conduct (con) of the ship as it approached the Fremantle outer pilot boarding ground. The second mate, who was the officer of the watch (OOW), remained on the bridge to assist the master when required.
Figure 1: Maersk Garonne aground and being assisted by tugs
Source: Tristan Yuswak
Just before 0400, the 4-8 third mate[3] came to the bridge and took over the watch from the second mate. The master directed him to go on deck to escort the pilot to the bridge. By 0403, the harbour pilot and an observer[4] had boarded Maersk Garonne.
At 0400, the weather was fine and clear with the wind from the south-southeast at 9 knots.[5] The forecast was for winds of 15-20 knots from the southeast. Low water was at 0352 (0.51 m) with high water expected at 1849 (0.97 m).
At 0406, the pilot and observer arrived on the bridge. The master and pilot exchanged information and discussed the pilotage at the chart table, over the navigational chart. The pilot was informed that the main engine was at half ahead, the engine had been tested astern, the ship was on hand steering and that all equipment was working as expected. The thrusters were being tested at that time. Maersk Garonne’s draught was 12.2 m forward and 12.4 m aft.
The pilot ordered full ahead and altered the ship’s heading[6] towards the Approach Channel. The master positioned himself behind the engine telegraph in preparation for engine orders and the OOW, the third mate, was at the chart table plotting positions as the transit progressed.
At 0407, the pilot made VHF radio contact with the Port of Fremantle[7] and advised the duty vessel traffic service officer (VTSO) that Maersk Garonne was approaching the Fairway Landfall buoy. The route for the ship into the port via the Deepwater Channel (DWC) was confirmed, and that there was no outbound traffic. The pilot and master then continued discussing the pilotage, including the information provided on Fremantle Pilots’ ‘master/pilot exchange of information’ (MPX) form and the ship’s pilot card. This included the pilot’s intended track from the pilot boarding ground to the berth, where to expect the tugs, tide and weather conditions and berthing arrangements.
By 0410, conversations on the bridge included some social topics. The pilot and observer were engaged in varied discussions when the pilot was not giving helm orders.
Figure 2: Section of navigational chart Aus 112 showing Maersk Garonne’s track
Source: Australian Hydrographic Service (annotated by ATSB)
At 0413, the ship passed the Fairway Landfall buoy (Figure 2) and continued in a south-easterly direction at 14 knots,[8] toward the DWC, about 3 miles[9] off. At 0422, the pilot ordered 10° of starboard rudder and at 0426, a heading of 178°.
At 0430, Maersk Garonne exited the DWC, at a speed of about 16 knots. The pilot then ordered a heading of 170° towards the port entrance channel, about 3½ miles further south. Between helm orders, the bridge conversations continued on marine and social topics, mostly between the pilot and the observer.
At about this time, the chief mate arrived on the bridge to relieve the third mate as OOW for the arrival. They discussed the situation and exchanged watch information.
At 0435, the pilot contacted VTS and reported that the ship was passing Hall Bank (Figure 2). He also confirmed the ship’s berthing arrangements (port side alongside at berth 8). The VTSO replied that Maersk Garonne was all clear to enter the Inner Harbour and that the tugs were ‘getting underway’. Both tugs had been berthed close to each other at the C Shed wharf, about 1½ miles from the entrance channel entrance (one of them, Svitzer Falcon, had departed the wharf by 0433).
At 0435½, the pilot ordered a heading of 165° and 2 minutes later, the main engine was reduced to half ahead.
At 0436, after the third mate had plotted the position on the chart, the chief mate took over the watch. The third mate then left the bridge to stand by at the forward mooring station.
Table 1: Selected ship data leading up to the grounding
Local time
Heading (True)
Speed (Knots)
Main engine status
Rudder (degrees)
Turn rate (⁰/min to Port)
04:35:00
170
16.7
Full ahead
-
-
04:37:32
166
16.3
Half ahead
-
-
04:41:07
166
14.5
Slow ahead
Port 20
0
04:41:36
159
14.2
Slow ahead
Hard to Port
20
04:42:58
123
10.9
Slow ahead
Midships
25
04:44:29
102
9.2
Slow ahead
Stbd 10
14
04:44:59
099
8.9
Slow ahead
Midships
9
04:45:23
098
8.8
Slow ahead
Port 20
7
04:45:35
098
8.7
Slow ahead
Hard to Port
11
04:46:48
082
7.9
Half ahead
Hard to Port
18
04:47:07
079
7.4
Half ahead
Hard to Port
16
04:48:00
071
2.1
Half ahead
Hard to Port
12
04:48:27
070
0.2
Stop
Hard to Port
0
Source: Maersk Garonne’s voyage data recorder
At 0437, the pilot attempted to establish contact with the two tugs assigned to the ship. A response was received immediately from Svitzer Falcon. The pilot advised its master of the intended berthing arrangements and to make fast on the starboard shoulder.[10]
At 0440, the Svitzer Falcon’s master advised the pilot that the other tug, Svitzer Eagle, was letting go his lines. The pilot said he would keep going and then advised Svitzer Falcon to make fast off the starboard quarter. Shortly after, Svitzer Eagle’s master called and the pilot advised him to make fast on the starboard shoulder. The pilot did not know that Svitzer Eagle had not left the wharf.
At 0441, the pilot ordered 20° of port rudder and slow ahead on the main engine to commence the turn to the entrance channel (Figure 3). Thirty seconds later, he ordered hard to port to slow the ship for entry into the channel.
At 0442¾, the pilot advised Svitzer Falcon’s master of his intentions and said that he was '…just going to go south of that first green buoy there…just want to wash a bit more speed off, so I'm just going to keep that one to port, then I'll come in between the two greens’. The ‘first green buoy’ was the starboard hand buoy No. 1 and the other ‘green’ was beacon No. 2 (Figure 3 insert). After communicating this intention of taking the ship south of the entrance channel and entering it later, the pilot advised Svitzer Falcon's master to pass down the ship’s port side.
At 0443, with Maersk Garonne’s speed at 10.9 knots and the ship turning at 25° per minute to port, the pilot ordered midships rudder. The master immediately queried the pilot. The pilot responded that he was ‘…just going to go south of this first green buoy captain, just come in…from that direction’ as he had ‘to kill a little bit of time for the second tug’ because ‘the second tug is running a little bit late.’ The master acknowledged his understanding, and that there was ‘no problem.’ At this time, Svitzer Falcon was to the south of the starboard hand buoy No. 1. Meanwhile, Svitzer Eagle was just leaving the wharf.
At 0444½, as the ship bore down on buoy No. 1, the pilot ordered 10° of starboard rudder. The ship’s speed was now 9.2 knots and its turn rate had reduced to 14° per minute. The ship was on a heading of 102° and its bridge was positioned approximately in the middle of the entrance channel (Figure 3). Svitzer Eagle was now off the wharf and visible to the pilot about 1½ miles distant.
Soon after, the chief mate queried the pilot as the starboard hand buoy No. 1 was on the port bow. The pilot advised him that the ship would pass to starboard of the buoy. The chief mate then alerted him to the shallow water ahead.
At 0445, the pilot, also aware of the shoal ahead, ordered midships rudder and, in quick succession, port 20° and hard to port.
Figure 3: Section of navigational chart Aus 113 showing Maersk Garonne’s track from 0440 at one-minute intervals (inset shows the grounded ship and the tugs at 0448½)
Source: Australian Hydrographic Service (annotated by ATSB)
At 0446¾, as the ship passed buoy No. 1 (abeam of the ship’s bridge), the pilot ordered half ahead on the main engine in an attempt to turn more quickly to port and enter the channel. He also said aloud that the ship ‘could be in a spot of bother here’. The ship was approximately parallel to the entrance channel, still turning to port and its speed was 7.9 knots.
At 0447¼, the master informed the pilot that the echo sounder was showing a depth of 1 m under the keel. The pilot noted the depth and ordered the bow thruster full power to port. Maersk Garonne’s speed was 7.4 knots and over the following 70 seconds the ship slowed and came to a gentle stop as its hull rode up onto the sand and mud bottom to the south of the entrance channel. At 0448¼, the chief mate stated that the ship had no speed, and shortly thereafter, the pilot ordered the main engine to stop. Svitzer Eagle was then about 2 cables[11] from the ship’s bow.
Subsequently, the pilot made a number of unsuccessful attempts to re-float the ship using its main engine, bow and stern thrusters and the tugs. At 0502, he informed the VTSO that the ship had grounded. He requested an additional tug and a relief pilot.
At 0542, the relief pilot boarded the ship. The original pilot remained on board to assist. By this time, the ship’s crew had inspected the cargo holds and sounded the tanks and depths surrounding the ship. The damage assessments did not indicate a breach in the ship’s hull.
Over the following hours, 900 m³ of water ballast was discharged from the forward tanks to reduce the forward draught to assist re-floating. Two additional tugs also arrived to assist.
By 0824, Maersk Garonne was re-floated using its main engine and thrusters with the four tugs assisting. The VTSO then directed that the ship be moved to and anchored in Gage Roads to await hull inspections and investigations.
On the following morning, 1 March, divers conducted an underwater hull inspection. No breaches were found and damage was limited to minor paint scraping.
Main engine trials were completed satisfactorily in the afternoon and the ship was safely berthed in Fremantle that evening.
At 1100 on 3 March, after completing its cargo operations, Maersk Garonne departed Fremantle.
At the time of the incident Maersk Garonne was registered in Denmark and classed with Bureau Veritas. The ship was owned and managed by Maersk.[12] It was on a regular service between ports in Asia and Australia and frequently called at Fremantle.
Maersk Garonne was fitted with navigational equipment required for a ship of its size under SOLAS.[13] The navigation equipment included an electronic chart display and information system (ECDIS) and two radars, which both had automatic radar plotting aid (ARPA) and other target tracking functions. Both radars had data inputs from the ship’s automatic identification system (AIS) transceiver and global positioning system (GPS) receiver unit.
The ship had a multi-national, mostly Filipino, crew of 18. This included four mates with an additional third mate on board to assist in maintaining the rest hour requirements of the STCW Code.[14]
The master had 39 years at sea and held a Romanian master mariner’s certificate of competency. He had sailed as master for 14 years and been with Maersk for the last 7 years. It was his first assignment on Maersk Garonne and he had joined about 2 months before the incident.
The chief mate held a Philippines master mariner’s certificate of competency, first obtained in 2007. He had been at sea for 16 years, all on container ships. He had sailed as chief mate for 7 years and been with Maersk for the previous 5 years. It was his first time on Maersk Garonne and he had joined about 7 weeks before the incident. The chief mate did not keep watches at sea.
The helmsman at the time of the incident was an able seaman with 28 years of seagoing experience, 22 of which had been on container ships. He had been with Maersk for 15 years. His routine duties on many ships had included those as a helmsman. He had joined Maersk Garonne 2 weeks before the grounding.
Port of Fremantle
The Port of Fremantle is Western Australia’s principal national and international sea gateway for container and general cargo trades.[15] Fremantle is a sheltered, all-weather port situated on the west coast about 20 km from the State capital, Perth.
The port operates from two locations: the Inner Harbour is located at the entrance to the Swan River and the Outer Harbour is about 20 km to the south at Kwinana-Cockburn Sound. The port had 2,277 ship visits in the 2013-14 financial year and handled more than 700,000 TEU.[16]
The Fremantle Port Authority operating under the name Fremantle Ports is the port’s strategic manager. Fremantle Ports publishes, and makes available online,[17] a Port Information Guide, which provides relevant port and related information for port users. The information includes details for communications, pilotage, arrival and departure requirements, port navigation, security and safety.
Pilotage in the Port of Fremantle is compulsory for ships over 150 GT,[18] unless the master holds a pilotage exemption certificate, and any ship so directed by the harbour master. Pilotage services are provided by Fremantle Pilots.
Fremantle Pilots
Fremantle Pilots (FP) is a privately owned company[19] that provides contracted pilotage services within the Port of Fremantle and to the ports of Albany and Bunbury as required. Fremantle Pilots provides service to more than 5,100 vessel movements annually. Pilot bookings are managed through the Port of Fremantle via the vessel’s contracted shipping agent.
All pilots undertake continuous professional development including bridge resource management (BRM) and related training, manned model and ship simulator ship-handling training, including contingency planning for emergencies.
The pilot assigned to Maersk Garonne on 28 February held an unrestricted licence as a port pilot issued by Fremantle Ports and a master mariner’s certificate of competency issued by the Australian Maritime Safety Authority (AMSA). He had 15 years of pilotage experience in various Australian ports and had worked for FP since 2004.
Passage plan
Fremantle Pilots provides information on its website[20] for ships’ masters relevant to arrival in Fremantle. This includes a master - pilot exchange of information (MPX) form (Appendix A) and waypoint lists to ‘assist vessel masters with preparing their passage plan’. The company also stated that ‘a detailed plan for the proposed passage is a requirement’ and that passage planning was through the master - pilot exchange. The MPX form was based upon IMO principles to assist:
gathering all information relevant to the contemplated voyage or passage
detailed planning of the whole voyage or passage from berth to berth…
execution of the plan; and monitoring the progress of the vessel in the implementation of the plan.
The information stated that the ‘role of our Pilot is to create a shared mental model of the plan and establish themselves within the bridge team utilising proper bridge resource management (BRM) practices.’ The information also cautioned that ‘waypoints lists are typical arrivals and departures (courses) and any variations will (be) discussed by the Pilot with the Master and bridge team accordingly.’
The inbound track, described by the arrival waypoint list, from the outer boarding ground to the Inner Harbour, is shown in green in Figures 5 and 6.
Portable pilotage unit
Fremantle Pilots issues its pilots with portable pilotage units (PPU). A PPU is an aid to pilotage operations with the intent to improve safety and efficiency of the operation. Its primary use is to provide independent, accurate GPS position, course and speed information. A PPU also provides other information such as charts, passage plan and AIS information. All pilots are trained in the use of the equipment and FP requires a PPU to be used for all pilotages from the outer boarding ground to Gage Roads.
Fremantle Pilots’ Procedures and Guidelines[21] stated that the PPU is to ‘provide additional information to assist the pilot’s assessment and decision making processes, and should be used in conjunction with all means available to the pilot.’ It is, however, ‘…not to be used as the sole means of assessing situational awareness’ and was not ‘to interfere with the comprehensive process required of the Master/Pilot exchange of information.’
Towage
The towage requirements for a ship entering the Port of Fremantle are set by the harbour master and outlined in the Port Information Guide. Towage requirements for ships over 275 m in length are assessed on a case by case basis. The ship’s agent orders the tugs through Fremantle Ports with a minimum of 2 hours’ notice required for the tugs to be on station.
For entry into the Inner Harbour, FP’s procedures require assisting tugs to be on station near the entrance buoys ‘A’ and ‘1’ before the ship’s arrival.
The pilot may make contact with the tugs to confirm they are in position, before arrival at the entrance buoys. The procedures stated that no ship is to enter the Inner Harbour without the assigned tug/s in attendance. The accepted practice was that the tugs be in position and/or made fast before the ship entered the entrance channel. Any tug delays were to be relayed to the pilot, who would determine if an adjustment in speed or course is necessary and/or to abort the approach.
Safe navigation
The Bridge Procedures Guide[22] states that safe navigation of a ship requires that it not be exposed to unnecessary danger and that at all times it can be controlled within acceptable margins. This requires effective command, control, communication and management of the ship.
A key accepted and practised principle of safely navigating a ship is bridge resource management (BRM). Passage planning is central to BRM. Regulation, training, guidelines, and multiple procedures apply to these concepts and enshrine them and their usage in the maritime industry.
Bridge resource management
Bridge resource management (BRM) is defined as the use and coordination of all the skills and resources (people, procedures and equipment) available to the entire bridge team to achieve the established goal of optimum safety and efficiency.[23] All individuals make errors, and BRM aims to minimise the occurrence and outcome of errors through the best possible use of resources.
All ship’s navigators must have training, and demonstrate competence, in BRM techniques.[24]
In areas of increased risk to safe navigation, a pilot is often added to the ship’s navigation team. The pilot’s local knowledge and practised piloting techniques are intended to, and should, reduce risks to an acceptable level.
The ship’s master and the pilot are responsible for taking steps to actively engage and include other members of the ship’s bridge team in the pilotage. Through effective BRM, all personnel involved in the navigation of the ship should have a clear understanding of, and expectations for, the pilotage. However, where marine casualties have occurred with a pilot on board, many have been attributed to flawed master - pilot relationships. In many cases, when the pilot boarded the ship, the master and deck officers ceased to monitor navigation and the position of the ship.
Bridge resource management is a broad topic which covers many inter-related subjects, including but not limited to:
shared mental model
situational awareness
error management
contingency planning
challenge and response
distractions and interruptions.
Safety management systems
The organisations responsible for ensuring Maersk Garonne was safely navigated into the Port of Fremantle included Maersk (the ship’s managers), Fremantle Pilots and Fremantle Ports. Each organisation had a safety management system (SMS), training and processes aimed at achieving that objective.
Each SMS included sections relating to BRM and passage planning and the master - pilot exchange of information (MPX).
Passage planning
Passage planning is necessary to allow the entire bridge team to arrive at a shared understanding of what ‘should’ happen during the passage and thus ensure the ship can be safely navigated between ports from berth to berth. The margins of safety in restricted coastal waters can be critical, limiting the time available to take corrective action when required. Careful passage planning is used to make a pilotage passage safer, for example, by setting limits that make unsafe deviations from the plan readily apparent.
The ship’s master is required to develop a plan for its safe and efficient passage between ports.[25] Detailed plans are needed to ensure appropriate margins of safety are maintained at all times.
The International Maritime Organization (IMO) provides guidelines[26] for voyage planning, which comprises four distinct stages:
appraisal during which all information relevant to the passage is considered
planning when a detailed plan for the voyage is prepared
execution of the plan, including suitable alterations to the passage plan as required by circumstances
monitoring the execution of the plan including ensuring all navigators know and understand it.
Section 2.6 of the Bridge Procedures Guide, states:
Of particular importance is the need to monitor the position of the ship approaching the wheel over position at the end of the track, and checking that the ship is safely on the new track after alteration of course.
Pilotage
A ship is exposed to higher risks in pilotage areas because of the reduced margins of safety due to factors which often include reduced depth and width of fairways, increased traffic, tidal variations and stronger currents. The pilot, as the port’s primary risk mitigation tool for the pilotage area, provides skills and local area knowledge - valuable additions to the bridge team’s resources.
However, a pilot is not a replacement for any of the ship’s bridge team members. The master and the ship’s bridge team are always responsible for its safe navigation, even when navigating with a pilot.[27] It is necessary, therefore, that the ship’s crew works with the pilot by observing good BRM practice in executing the agreed passage plan. This approach helps all to work together to ensure that errors are detected early and corrected before the ship is put into any danger.
Master - pilot exchange
The master - pilot information exchange (MPX) is the first opportunity for the pilot and master to exchange critical information to facilitate a safe and effective pilotage. In effect, it is the meeting in which the pilot and the master agree on a common passage plan. Alterations are made as required to decide how the pilotage will be done jointly. The MPX aims to ensure that the ship’s bridge team and the pilot share the same understanding of, and expectations for, the pilotage. It also helps to establish appropriate working relationships with defined roles and responsibilities.
At 0400 on 28 February 2015, a harbour pilot boarded Maersk Garonne for its passage into Fremantle. The master informed him that the ship’s equipment and machinery were in working order. In turn, the pilot briefed the master and marked his intended course on the diagram in the master - pilot exchange (MPX) form. The ship’s officer of the watch (OOW) and helmsman were also on the bridge.
Over the next 35 minutes, the pilotage generally progressed as intended by the pilot. However, as the ship exited the Deepwater Channel (DWC), the pilot conducted the ship to the east of both the planned track on the ship’s chart and his own intended track on the MPX form. At no stage did the ship’s bridge team members challenge the pilot regarding this deviation from the plan.
Figure 4: Sections of navigational chart Aus 113 showing the progress of Maersk Garonne and the tugs from 0441
Source: Australian Hydrographic Service (annotated by ATSB)
Then, as the ship approached the entrance channel, the pilot became concerned that it would arrive there before the two harbour tugs were in position. After some radio communications with one of the tug masters, the pilot decided to delay the ship’s entry into the channel.
At 0443, the pilot began manoeuvring Maersk Garonne to delay entering the channel (Figure 4). He intended to do so by taking the ship outside, and south of, the channel and then enter between the starboard hand buoy No. 1 and beacon No. 2. However, at 0448, while it was still outside the channel, the ship grounded in an area of charted shallow water.
Execution of the pilotage
Master - pilot exchange
The Fremantle Pilots’ (FP) passage planning for inbound ships, utilised a MPX form based on the IMO’s recommended operational procedures[28] for maritime pilots. This form contained harbour and towage information, transit corridor and channel chartlets and checklist prompts for items of discussion (see Appendix A).
Further, FP’s procedures and guidelines stated:
It should be further noted that the Master/Pilot Information Exchange form does not fulfil the purpose of a passage plan and is used only as a means of effectively exchanging information between the Pilot and the Master to facilitate a safe and effective pilotage operation.
For the arrival of Maersk Garonne, the MPX took place immediately after the pilot arrived on the bridge. This was normal practice, and bridge audio recordings show that the principal information exchange took place before the ship passed the Fairway Landfall buoy. During this discussion, brief mention was made of intended tracks by indicating that the transit would be via the DWC, and that tugs were expected just outside the entrance channel.
However, several items were not discussed, at any stage during this time, or the remainder of the pilotage, including:
ship’s speeds
planned track details, such as true courses, course alterations, wheel over positions, cross-track error limits and main engine/speed requirements/changes
contingency plans and/or abort points
communication with VTS and tugs.
After the MPX was completed, the master did not update the OOW with the information exchanged, including the pilot’s intended track, which was different to that marked on the ship’s chart. Further, no designated roles and responsibilities in support of the pilot were assigned to the ship’s bridge team members. Such duties may have encouraged them to become more actively engaged in the pilotage. Consequently, members of the ship’s bridge team remained unaware of important details of the pilotage passage that were essential to safe navigation.
Passage planning
The passage plan for a pilotage forms the basis on which all bridge team members involved build their understanding of what the pilotage will involve. This model should then be shared between all personnel involved in the navigation of the ship into port.
Fremantle Pilots required a passage plan to be prepared for any, and all, pilotages. Its procedures and guidelines stated:
An essential part of the Pilot's passage plan is the laying down of courses between the point of origin and proposed destination.
Once on board the vessel, the Pilot, in consultation with the Master and his bridge team, will complete the plan making alterations as required.
MaerskGaronne’s master’s passage plan included the pilotage into Fremantle’s Inner Harbour. The ship’s SMS procedures required specific items to be marked on the chart, including:
parallel indexing
methods and frequency of position fixing
clearing lines and bearings
safe speed and necessary speed alterations
changes in machinery status
contingency plans
abort positions.
However, only the safe speed and speed alterations were included in the passage plan, and only the planned track was marked on the chart. This suggests that the ship’s bridge team members expected the pilot to provide much of the missing information.
Planned courses
There were three possible intended tracks for Maersk Garonne's pilotage into the Port of Fremantle on 28 February (shown in different colours in Figure 5):
derived from FP’s published waypoint list (green)
MaerskGaronne’s passage plan marked on the ship’s chart (blue)
pilot’s intended track marked on the MPX form (black).
None of these tracks was followed - the ship actually followed the track shown in red. Further, the three different, possible intended tracks meant that the ship’s bridge team members did not have the same understanding as the pilot of the track he intended to follow.
Awareness and understanding of the plan
At no stage was either OOW briefed on the key details discussed during the MPX. Therefore, the OOWs were unaware that the courses marked on the ship’s chart were not to be followed. Further, the pilot did not inform the ship’s master or bridge team members that he intended to conduct the ship to the east of the marked courses and the hand drawn track on the MPX form.
As a result, the ship’s bridge team members were unable to develop and maintain a shared understanding and mental model of the plan and expectations for the pilotage as it progressed. Their ability to maintain situational awareness was compromised by not knowing what the plan was. Hence, they were not actively engaged in the pilotage and were therefore unable to assist in the detection and management of errors or deviations from the plan.
Further, no opportunities to clarify the plan and then jointly execute and monitor it were taken. For example, the significant deviation from the charted course on departure from the DWC was not communicated or challenged.
Previous tracks
The ATSB investigation analysed recent inbound pilotage tracks of ships similar in size to Maersk Garonne during the 2 months preceding its grounding. The tracks of more than 40 ships greater than 250 m in length are shown below (Figure 6).
All tracks were within the approved Fremantle Ports transit corridor, however, the analysis showed that none of the tracks was consistent with FP’s published waypoint list (green line in Figure 6). The analysis also showed that MaerskGaronne’s track on 28 February was at the eastern extremity of the others. Had the ship followed the published track it would have been 6 cables further to the west. This would then have provided more time and distance for the second tug to be on station, or its position to be verified, and for the pilot to consider aborting the approach.
Figure 5: Comparison of Maersk Garonne's intended and actual tracks on 28 February
Source: Australian Hydrographic service (annotated by ATSB)
Transit speed
Fremantle Ports’ Port Information Guide states that ships transiting channels shall maintain a speed consistent with safe navigation. In addition, the port’s operational parameters stated that ships with draughts greater than 12 m should not exceed 13 knots in the DWC. However, the pilot’s MPX form did not refer to recommended speeds or speed restrictions for the transit.
MaerskGaronne’s master’s passage plan for the pilotage included maximum and minimum speeds. The maximum speed south of the DWC was 12 knots, reducing to less than 8 knots for the entrance channel.
However, Maersk Garonne transited the DWC at about 16 knots. The pilot maintained this speed until south of Hall Bank, when the main engine speed was reduced to half ahead. The ship’s speed reduced slowly until the pilot started the turn towards the entrance channel, at which time it was 14.5 knots. The pilot intended to maintain a higher speed to improve the ship’s manoeuvrability as in his experience the ship did not turn well at slow speed.
Figure 6: Inbound pilotage tracks of ships greater than 250 m in length in the 2 months preceding the grounding
Source: Australian Hydrographic Service (annotated by ATSB)
Neither the pilot nor any of the ship’s bridge team members discussed the ship’s speed at any time. The speed was consistently above the maximums mentioned in the port’s operating parameters and Maersk Garonne’s passage plan. Had the speed been maintained within the port parameters and/or the ship’s passage plan, the ship would have arrived at the pilot’s intended position to turn towards the entrance at least 3 minutes later than it did (0441). While 3 minutes would not have ensured either of the tugs was on station on time, it would have provided more time on board the ship to detect, manage and potentially recover from the errors that occurred.
Contingency planning
Contingency planning is a risk management tool, which adds significant control to better manage emergencies. Anticipation of, and preparation for, an adverse event makes the reaction to it more effective. The reaction may then be one from a known and practised range of options, rather than an unknown, instantaneous reaction in an unexpected and stressful situation. Learning only from real emergencies is not practical and therefore should be enhanced through training, ideally simulation, in a controlled environment, especially for foreseeable risks.
The harbour pilot is the local knowledge expert and is employed to conduct the ship because of this specific knowledge. MaerskGaronne’s pilot had many years of pilotage experience, including more than 10 years in Fremantle, and was also an experienced ship’s master. He was familiar with the ship’s manoeuvring characteristics, having conducted it numerous times in or out of the port.
Maersk Garonne’s maximum draught of 12.2 m and length overall of 292 m were at the upper end of ship size/dimensions permitted in Fremantle. The ship’s manoeuvring information poster was also displayed on the bridge. At interview, the pilot stated that the size and manoeuvrability of the ship at various speeds influenced the decisions he made regarding the ship’s track and turns.
The pilot knew the information about the ship and had a comprehensive knowledge of the pilotage area. He should, therefore, have been keenly aware that the ‘no-go area’ outside the marked channel was unsuitable for a deep draught vessel. Therefore, entering the channel between starboard hand buoy No. 1 and beacon No. 2 should never have been considered a safe option.
At interview, the pilot acknowledged that he was aware that going south of the channel was not an option for the large ship. He also indicated that his plan (that is, going south of the channel) was an ‘ambitious manoeuvre’ to overcome earlier errors but he thought he would still ‘make it’. These statements support the fact that experts also make poor decisions in unexpected situations, particularly when pressed for time. They also highlight the importance of contingency planning.
Fremantle Pilots’ (FP) procedures included guidelines on the identification, assessment and management of hazards and risks. These were recorded using job hazard analysis (JHA) documents. The JHA for Inner Harbour arrival identified risks such as the tugs not standing by and ship’s system faults, and provided risk controls for such events. However, neither the JHA, nor other FP’s procedures, included any formalised contingency plans for the risks identified.
Similarly, ‘no-go areas’ and abort points should have been marked on the ship’s chart. Hence, the ship’s bridge team, especially the master, should have known that navigating outside the channel was not a safe option. However, when the pilot informed him of his intentions, the master did not have an appropriate level of situational awareness and agreed with the pilot without a challenge.
At 0441, the pilot commenced the turn toward the entrance. At 0442¾, he informed the tug master of his intention to go south of the first green buoy (the starboard hand buoy No. 1). Figure 7 shows the final stages of the grounding with an indicative turning circle, based on the ship’s manoeuvring information,[29] shown. This simple analysis shows that options, though limited, remained available to safely manoeuvre or stop the ship before it passed south of the entrance channel.
No contingency plans were recorded or discussed. Therefore, when the tugs were not on station as the pilot expected, he did not have any preplanned or practised manoeuvres to fall back on. He then had to make decisions quickly and under increasing levels of stress. This resulted in manoeuvring the deep draught ship into charted shallow waters outside the marked channel.
Figure 7: Maersk Garonne’s track with the ship’s turning circle overlaid
Source: Australian Hydrographic Service (annotated by ATSB)
Bridge resource management
MaerskGaronne’s safety management system contained a procedure for navigation with a pilot on board. This procedure outlined the strategies and requirements for the master and bridge team members to follow. The subjects mentioned included crewmember responsibilities, communications, master - pilot exchange, manoeuvring, the route to be followed and the passage plan. However, many of these were not followed and BRM was ineffective.
Roles and responsibilities
Safe navigation requires that all bridge team members involved are aware of their roles and responsibilities. Analysis of marine incidents by AMSA has identified that many incidents are attributed to single-person errors.[30] During pilotage, many of the navigational decisions are made by the pilot alone. Therefore, to make it more likely that single-person errors (made by the pilot) are detected early, all bridge team members must have an understanding of individual roles and responsibilities in executing the agreed plan.
The master and the ship’s bridge team are always responsible for its safe navigation, and are therefore expected to participate fully in navigation during pilotage. They must continue to monitor the safe passage of the ship and critically appraise the pilot’s advice. In order to do this, and to ensure safe and efficient navigation, they should fully support the pilot as a valuable resource and addition to the team.
On 28 February, when the pilot took the conduct of Maersk Garonne, in effect, he became the only one actively focused on the pilotage. After the initial exchange of information between the master and pilot, no tasks were assigned to, or updates provided to the bridge team. There was, then, an absence of clearly defined roles and responsibilities for team members.
Shared mental model
Each individual member of a team will develop a mental model of what they think will occur during the task being completed. Each person’s mental model is based upon the information available to them at the time. Ensuring that each member of a bridge team shares the same mental model of the passage plan is central to effective BRM.
Shared mental models serve three critical purposes: they help people to describe, explain and predict events in a common environment. Any team that must adapt quickly to changing tasks might draw on shared or common mental models for those tasks. In order to adapt effectively, team members must be able to predict what their teammates are going to do, and what they are going to need to be able to do it.[31]
At the start of the pilotage, as Maersk Garonne approached the Fairway Landfall buoy, the ship’s bridge team members shared a common mental model of the progress of the pilotage. The intended track through the DWC, marked by the pilot on the MPX form, was consistent with that on the ship’s chart as per its passage plan (Figure 5).
However, as the ship left the DWC, the pilot ordered a heading of 170°. From this point, the pilot’s intended track diverged from the ones marked on the ship’s chart and the MPX form. The ship’s bridge team members did not challenge this deviation and subsequently, no longer had a shared mental model for the pilotage.
Situational awareness
A team’s situational awareness is closely associated with the concept of shared mental model. Situational awareness has been variously defined, including simply as knowing what is going on around you. In relation to a ship’s passage, it includes knowing what has recently happened, what is happening and, based on where the ship is, what is about to happen.
Careful observation and understanding of the situation around you should achieve one of two things: it should reinforce your understanding and confidence in the mental model of the passage, or it should highlight a misunderstanding or an error and trigger actions to clarify or correct the situation.
Situational awareness is dependent on working memory and is, therefore, affected by distraction, interruption and stimulus overload. Collective (team) situational awareness can be enhanced by:
monitoring the progress of the agreed plan
communicating with each other about the situation to share individual awareness and discuss differences
anticipating next conditions
checking one another.
There were many resources available on board Maersk Garonne to assist in establishing and maintaining situational awareness. These included ship’s equipment such as the radars and the AIS receiver, as well as human resources which could be assigned to gather or verify information.
As the ship left the DWC, and navigated to the east of the ship’s passage plan track, the master and OOW progressively lost situational awareness. Their mental models of the pilotage changed and they were unable to anticipate or monitor the ship’s progress against an agreed plan. Despite this, they did not communicate with the pilot or each other to attempt to clarify the plan or the deviation from it.
There was no agreed plan, and, as a consequence, there was no shared mental model of the pilotage. The pilot was the only one who knew what his plan was. Therefore, he was the only one that was in a position to be able to maintain situational awareness.
However, the pilot did not have his personal pilotage unit (PPU), as required by FP procedures, to assist him. Before boarding the ship, he found the PPU was not charged. As there was no spare battery, he left the PPU charging. He did not consider using the ship’s power supply to charge/use the PPU.
In addition to this, while Maersk Garonne was not required to have an electronic chart display and information system (ECDIS), it was fitted with one.[32] However, the ECDIS was not operational. The master had identified this in the pre-arrival notification but Fremantle Ports did not pass this information to the pilot. Nor did the master inform the pilot of this during the MPX.
Consequently, as other position monitoring resources on board were not effectively used, and without the PPU or ECDIS to monitor the passage, the pilot believed that the ship was further to the west than it was. However, this was not the case and his decision-making was hampered. The situation was compounded when the pilot became occupied with contacting the tugs.
Error management
The detection and management of errors is a key safety aspect in the process of avoiding serious incidents. Having accepted the premise that all individuals make errors, error management then seeks to detect and control the mistakes to minimise any negative outcomes.
There are two components to error management:
error reduction – measures designed to limit the occurrence of errors
error containment – measures designed to limit the adverse consequences of those errors that still occur.
The capacity of a system to minimise the outcome of an error, or series of errors, is determined by the system’s margin for error. The bigger the margin for error, the greater the capacity to overcome errors. Time is a key common element in error management. The more time available to detect, assess and respond to an error, the more appropriate the response is likely to be.
On board Maersk Garonne, none of the bridge team members adequately monitored the actions of other members of the team or the ship’s progress. As a consequence, there was no effective detection and management of, or recovery from, errors which occurred, as the bridge team members did not:
clarify and agree upon the planned or intended track
engage all team members in the pilotage
delegate tasks, such as ensuring the locations and movement of tugs
ensure everyone had a common mental model of the intended passage
challenge the deviation from the planned track
have in place or discuss contingency plans
use all bridge equipment to monitor the ship’s progress
critically appraise and verify communications regarding movement of the tugs.
Hence, the margins for error eroded and this led to the ship being navigated outside the channel.
Challenge and response
Effective communication is central to bridge resource management (BRM). It is essential to prevent errors leading to undesirable outcomes. Challenge and response is a BRM technique in which a person’s perception of an error, in the execution of the plan, is confirmed or denied by asking and/or responding to questions. That is, if unsure of exactly what is occurring, a person should ask others to clarify the situation, and a response is required.
While the pilot’s plan was not communicated to the rest of the bridge team, it should have been evident to the OOW that the track marked on the ship’s chart was not being followed (when the ship exited the DWC). That neither OOW raised this important matter with the master or the pilot is indicative of the level of BRM. The OOW only challenged the pilot when the ship was outside the entrance channel and with the starboard hand buoy to port. The ship was now in a ‘no-go area’ with shallow water ahead. However, the challenge was ineffective, as it was too late.
Distractions
Interruptions or distractions during the completion of a task increase the likelihood of error. Distractions can be related to the task or from some external, unrelated source or event. An individual, or team, can also become completely occupied (fixated) with one event or task and therefore distracted from the overall objective.
Minimising possible distractions is important for effective BRM. For example, many ships, and passenger ships in particular, have a ‘red zone’ system during periods of increased risk to navigation, such as pilotages. This method restricts access and internal communication to the bridge to only those involved in navigational tasks. This reduces unnecessary and undesirable sources of distraction.
During this pilotage there were a number of distractions with attempting to establish contact with both tugs, by radio and then visually. The pilot was trying to establish whether or not the second tug would be on station before the ship arrived at the entrance channel. These distractions occupied the pilot’s attention just as the ship was approaching a period of heightened activity and manoeuvring. Throughout this period, he did not check the ship’s position by any means available and relied upon the leading lights as a transit for the wheel over point. However, the ship was much further to the east than he believed.
As the turn commenced, the pilot used the rudder hard to port to slow the ship in preparation for entering the entrance channel. He then became concerned that the tugs would not be on station as he expected so he altered his plan and decided to go south of the channel. He ordered the rudder midships to slow the rate of turn. However, he became concerned that the ship would collide with No. 1 buoy. His attention now turned to avoiding the buoy and he ordered starboard rudder to ensure the ship would pass south of it. This manoeuvre became his focus to the exclusion of other critical navigational risks.
Had the pilot had an accurate understanding and appraisal of the ship’s position and its progress during the turn, he could have manoeuvred to avoid the shallow water before becoming fixated with clearing the buoy.
Change of OOW
The need to change the OOW during a pilotage is a foreseeable risk. The change involves possible disruption to the bridge team and distraction of personnel, including the pilot. There is also the risk of loss of information during the handover, a loss of the shared mental model and loss of situational awareness.
The pilotage from the Fremantle outer pilot boarding ground to the Inner Harbour should have taken about 90 minutes. The ship’s third mate took over the 4-8 watch at 0400, and was to be at the forward mooring station for berthing shortly after 0430. Consequently, two changes of watch occurred in 30 minutes. The chief mate took over at about 0430, when the ship was passing Hall Bank. This was also at about the time the pilot became occupied with contacting the tugs and then turning the ship towards the entrance channel.
The risks associated with handing over the watch during the pilotage had not been considered and the change of OOW added unnecessary distractions.
Observers
There is the potential for additional personnel on the bridge of a ship during pilotage operations to be a distraction.[33] While the presence of observers on the bridge at such times may sometimes be acceptable, it needs to be carefully managed. For example, there is a need for observers for training purposes, of pilots and ship’s crew, and for checking or auditing purposes.
During the pilotage of Maersk Garonne, a navigational student observer was occupying some of the pilot’s time and attention. In such situations, the interaction of observers with the bridge team, and especially the pilot, needs to be controlled to prevent distraction. Bridge recordings show that the pilot and observer were engaged in conversation, interspersed with communications with the ship’s personnel, as late as 0444¾. This was during a period of heightened activity as it was when the chief mate commented that the starboard hand buoy No. 1 was off the port bow and just after the pilot had ordered 10° of starboard rudder to avoid the buoy.
The dynamic between pilot and ship’s bridge team members altered due to the presence of the observer and his interaction with the pilot.[34] Further, while this was not identified as having directly contributed to the incident, the conversation between the observer and the pilot reduced the opportunity for the ship’s crew to interact with the pilot. This factor may have affected the building of a shared mental model and maintaining situational awareness.
External resources in pilotage
Vessel traffic service
Fremantle Ports maintains a 24-hour vessel traffic service (VTS)[35] in accordance with international guidelines. As part of its function, the VTS organises and manages traffic within its VTS area, and provides essential information related to ship movements.
The duty VTS officer (VTSO) is required to maintain a continuous watch, monitoring shipping traffic and provide information to ships, pilots, tugs and other users. The VTSO also provides information about ship movements, berth allocations and other matters related to the safety of navigation and weather within port waters.
At 0435 on 28 February, the VTSO provided tug information, which was taken by the pilot as confirmation that his plan (mental model) was progressing as expected. Therefore, the pilot continued with his plan and started the turn toward the entrance channel. Had the communication between the VTSO and pilot clearly identified that both tugs had not yet departed the wharf, the pilot may have decided to alter his plan or abort the approach to the entrance channel.
Tugs and towage
Tugs are essential resources for safely berthing a ship. Therefore, clear and unambiguous plans, information and communications are required to ensure the most effective use of tugs. In this way, the tugs, their roles and expectations can be integrated into the shared mental model for the pilotage.
At 0435, the VTSO advised the pilot that the tugs were getting underway. However, only one tug had departed the wharf. About 3 minutes later, the pilot contacted the tugs. The master of the tug that was underway answered promptly and informed the pilot that the other tug was on the way. Consequently, he believed that both tugs were en route to the entrance channel buoys. Therefore, he decided to continue the pilotage but altered the positions (forward or aft) for making fast the tugs based upon their expected order of arrival.
At 0440½, the master of the tug that was still alongside the wharf contacted the pilot, just as he was starting the ship’s turn toward the entrance channel. The pilot informed him to make fast on the starboard shoulder. However, neither the fact that the tug was still alongside the wharf nor its expected time at the entrance channel buoys were discussed. It was not until 0444 that the tug departed the wharf. In the meantime, the pilot had started the turn to port and had to alter his plan after not being able to sight the tug.
Entry into the Inner Harbour required tugs to be in attendance. Fremantle Pilots’ (FP) accepted practice was for the tugs to be in position and/or made fast before the ship entered the entrance channel. As tugs being delayed was a foreseeable risk, FP should have had measures in place to ensure clear and unambiguous communications between pilots and tugs. Such measures should necessarily include contingency plans to mitigate risk in the event that tugs are delayed.
Further, Fremantle Ports and its contracted towage provider had not adequately ensured that such risks to the port were mitigated. Procedures for tugs to be on station at the entrance to the port, or for their co-ordinated movement, were not clearly defined.
From the evidence available, the following findings are made with respect to the grounding of the container ship Maersk Garonne at the entrance to the Port of Fremantle, Western Australia, on 28 February 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
At 0448 on 28 February 2015, Maersk Garonne grounded in charted shallow water while it was being manoeuvred outside the shipping channel at the harbour entrance.
The harbour pilot conducting MaerskGaronne had decided to delay the ship’s entry into the entrance channel because it was arriving there earlier than the two harbour tugs assigned to assist it.
MaerskGaronne’s speed until approaching the entrance channel had exceeded both the ship’s passage plan speed and the port’s recommended speed resulting in it arriving there at least 3 minutes earlier than it would have at those slower speeds.
The manoeuvre to delay the ship’s entry into the channel had become the pilot’s primary focus in the period leading up to the grounding.
The pilot was not carrying a portable pilotage unit as required by Fremantle Pilots’ procedures and this affected his ability to accurately monitor the ship’s position and progress.
The ship’s bridge team members did not effectively challenge the pilot’s plan to take the ship outside the channel or take any action to prevent the grounding.
Bridge resource management (BRM) was not effectively implemented on board Maersk Garonne. The ship’s passage plan for the pilotage was inadequate, its bridge team members were not actively engaged in the pilotage and they did not effectively monitorthe ship’s passage. [Safety Issue]
Fremantle Pilots’publicly available information to assist ships' masters with preparing a berth to berth passage plan was inadequate and ineffectively implemented. The information provided consisted essentially of a list of waypoints, which wasroutinely not followed.[Safety issue]
Fremantle Pilots’procedures did not include any contingency plans, including abort points, for risks identifiedfor the pilotage. [Safety issue]
Procedures for harbour tugsto meet inbound ships andfor their co-ordinated movement in the Fremantle pilotage area were not clearly defined. On 28 February,inadequate co-ordination of the tugs and ineffective communication between Maersk Garonne’s pilot and the tug masters resulted in both tugs, the second one in particular,being significantly delayed from when they could reasonably have been expected to be on station.[Safety issue]
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Bridge resource management
Bridge resource management (BRM) was not effectively implemented on board Maersk Garonne. The ship’s passage plan for the pilotage was inadequate, its bridge team members were not actively engaged in the pilotage and they did not effectively monitor the ship’s passage.
Fremantle Pilots’ publicly available information to assist ships' masters with preparing a berth to berth passage plan was inadequate and ineffectively implemented. The information provided consisted essentially of a list of waypoints, which was routinely not followed.
Procedures for harbour tugs to meet inbound ships and for their co-ordinated movement in the Fremantle pilotage area were not clearly defined. On 28 February, inadequate co-ordination of the tugs and ineffective communication between Maersk Garonne’s pilot and the tug masters resulted in both tugs, the second one in particular, being significantly delayed from when they could reasonably have been expected to be on station.
The sources of information during the investigation included:
the master and crewmembers of Maersk Garonne
the marine pilot on board the ship at the time of the grounding
Maersk Line Ship Management
Fremantle Pilots
Fremantle Ports
the Australian Maritime Safety Authority (AMSA).
References
Australian Maritime Safety Authority 2009, Marine Notice 07/2009 Bridge Resource Management (BRM) and Torres Strait Pilotage, AMSA, Canberra. Note that this marine notice has been cancelled and may contain information which is no longer applicable.
Australian Maritime Safety Authority 2012, Marine Order 21 (Safety of navigation and emergency procedures) 2012, AMSA, Canberra.
Australian Maritime Safety Authority 2013, Marine Notice 15/2013 Vessel Traffic Services – Responsibilities of Authorities, AMSA, Canberra.
Di Lieto, A 2015, Bridge Resource Management, Hydeas, Brisbane, Australia.
Greche, RG, Horbery, TJ & Koester, T 2008, Human factors in the maritime domain, CRC Press, London.
International Chamber of Shipping (ICS) 2007, Bridge Procedures Guide, 4th Ed, ICS, London.
International Maritime Organisation (IMO), 1974, The International Convention for the Safety of Life at Sea, 1974, as amended (SOLAS 1974), IMO, London.
International Maritime Organisation (IMO) 1978, International Convention on Standards of Training Certification and Watchkeeping for Seafarers, 1978, as amended (STCW Code), IMO, London.
International Maritime Organisation (IMO) 2004, Resolution A.960(23) Recommendations on training and certification and operational procedures for maritime pilots other than deep-sea pilots, IMO, London.
International Maritime Organisation (IMO) 2004, Resolution A.893(21) Guidelines for voyage planning, IMO, London.
Jonker, C.M., van Riemsdijk, M.B. and Vermuelen, B 2011, ‘Shared Mental Models’, Coordination, Organizations, Institutions, and Norms in Agent Systems VI, Springer, Canada, pp. 132-51.
Reason, J 2008, The Human Contribution, Ashgate, Farnham, England.
Schager, B 2008, Human error in the maritime industry, Marine Profile Sweden.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Australian Maritime Safety Authority (AMSA), the Danish Maritime Accident Investigation Board, Maersk Line Ship Management, Fremantle Ports, Svitzer Australia, Fremantle Pilots, the pilot on board at the time, and Maersk Garonne’s master, chief mate and third mate.
Submissions were received from AMSA, Maersk Line Ship Management, Fremantle Ports, Svitzer Australia, Fremantle Pilots and the pilot on board at the time. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Fremantle Pilots’ Master/Pilot exchange form
Fremantle Pilots’ Master/Pilot exchange of information form, reproduced below, comprises two A4 sized pages and is available from www.fremantlepilots.com.au
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 21/05/2015
The information contained in this Preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the ongoing investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this Preliminary report. As such, no analysis or findings are included in this report.
What happened
During the morning of 28 February 2015, Maersk Garonne was under Fremantle marine pilot guidance on entry to the Port of Fremantle, Western Australia. At 0441 the pilot ordered port helm to bring the ship around to enter the port Inner Harbour entrance channel. During the turning manoeuvre, attempts to delay the ship’s arrival at the entrance beacons led to the ship passing south of the channel. At 0448 the ship grounded to the south of channel beacons number 1 and number 2. The ship was refloated at 0824 and taken to anchor.
What the ATSB has found so far
Based on preliminary information provided to the ATSB, it was apparent that the ship’s bridge crew had not been directly and actively engaged with the pilotage as it progressed, and were broadly unaware of the pilotage plan. Procedures had not been enacted and actions not taken to ensure the full bridge resources available to the pilot and master were utilised.
Investigation direction
The investigation is ongoing and will focus on:
pilotage procedures, planning and practices, information exchange and contingency planning for Fremantle pilotage
the existence, relevance, understanding and implementation of procedures by the pilotage company, port and ship to reduce the risk of grounding
bridge team dynamics, resource management and personnel engagement during pilotage
the implementation and effectiveness of bridge resource management training.
On 27 February 2015, the pilot of a Fletcher FU-24 aircraft, registered VH-KXT (KXT), and the pilot of a Gippsland GA-200 aircraft, registered VH-AGZ (AGZ), were conducting aerial agricultural operations on a property 13 km south-west of Cootamundra, New South Wales.
The pilots were using two runways, one aligned in approximately the 01/19 direction, and the other 06/24. Both of the aircraft were taking off from runway 06, however AGZ was landing on runway 24, and KXT was landing on runway 19. With both aircraft taking a similar amount of time to spread their fertiliser load, they were in an alternating sequence at the landing area.
After completing spreading one area, the pilot of AGZ reloaded and departed to locate the next paddock to be spread. It took about 5 minutes to determine the boundaries and commence spreading. At about 1015 Eastern Daylight-saving Time, as KXT was on final approach for runway 19, the pilot looked for AGZ on approach to runway 24, but did not see the aircraft. At about the same time, AGZ was on approach to land on runway 24 and the pilot looked for KXT approaching or on the runway, but did not sight that aircraft.
As KXT landed, the pilot was momentarily distracted as he observed the loader truck near the fence. AGZ was in the landing roll on runway 24 when the pilot sighted KXT about 10 m from his right wing. KXT was then in the landing roll on runway 19 and the pilot returned his gaze from the loader to the front of the aircraft, just as the propeller collided with the right wingtip and then the tail of AGZ.
Both aircraft sustained substantial damage and the pilots were not injured.
The pilot of KXT commented that this incident highlights the importance of a thorough briefing between pilots prior to commencing operations.
