On 10 November 2013, while conducting an approach to the Red Lake Airport, at Red Lake, Ontario, Canada, the crew of a Fairchild-Swearingen SA227AC (Metroliner) aircraft declared an emergency. Shortly after, the aircraft struck trees and a powerline before crashing south of the airport. The aircraft was destroyed by the impact and fire. The two crewmembers and three of the passengers sustained fatal injuries. The remaining two passengers escaped with non-life-threatening injuries.
An investigation into the circumstances of this accident is being carried out by the Transportation Safety Board (TSB) of Canada. The TSB investigation can be accessed at www.bst-tsb.gc.ca/eng/, reference A13C0150.
On 5 November 2014 the TSB requested Australian Transport Safety Bureau (ATSB) assistance in gathering information on two recent engine failures involving Australian‑registered Metroliner aircraft, with a view to identifying any commonality with the Red Lake accident. In accordance with paragraph 5.23 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation, the ATSB appointed an accredited representative to the TSB investigation. To facilitate this support, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003. The information gathered by the ATSB was provided to the TSB on 11 November 2014.
The TSB is responsible for, and will administer the release of the final investigation report into this accident. Any enquiries regarding the TSB investigation should, in the first instance, be directed to:
Director Investigations - Air Transportation Safety Board of Canada 200 Promenade du Portage Place du Centre, 4th floor Gatineau Québec, K1A 1K8
On 9 December 2014, diesel locomotive D2 (Drewry locomotive built 1953, weight 27 t, length 7.6 m) travelled from Regatta Point (Strahan) to Dubbil Barril, to collect an empty passenger carriage for transfer back to Regatta Point. This was in preparation for the recommencement of passenger services between Dubbil Barril and Regatta Point on 15 December 2014. The locomotive and empty carriage, with a crew of three (designated as train 71SG), departed Dubbil Barril at about 1136, bound for Regatta Point.
At about 1215, a radio message was received from the train crew advising that the locomotive had derailed all wheels. The trailing empty passenger carriage remained on track. The crew sustained minor injuries (bruising and stiffness).
What was found
West Coast Wilderness Railway (the operator) investigated the occurrence; the findings of which indicated the track condition and geometry was not a contributing factor. Mechanical examination of the locomotive found that the front right hand axle box horn guide had jammed due to a lack of lubrication (Figure 1). The jammed horn guide had restricted axle articulation while the locomotive was negotiating a slight left-hand curve, causing the leading wheel on the right side to climb the rail head and derail to the right.
A blanket speed restriction of 10 km/h existed for diesel locomotives travelling the section between Regatta Point and Dubbil Barril. Although the locomotive did not have a mechanism to display or record speed, individual crew member interviews and the damage sustained by the track infrastructure and rolling stock suggested that speed was not a factor in the derailment.
West Coast Wilderness Railway operates three diesel locomotives of this type – primarily for shunting and the occasional freight service. They are not normally used for passenger services. Although the locomotives receive regular inspections they can spend long periods idle, are often housed in the open and are subject to the harsh environment of Tasmania’s west coast.
A pre-departure inspection (A-exam) was conducted on the locomotive before operation, but the lack of adequate horn guide lubrication was not noted. The investigation found that the A-exam did not specify a requirement to check the axle box horn guide oil reservoir to ensure lubrication was being applied.
Figure 1: Axle box horn guide
Source: West Coast Wilderness Railway
Safety action
As a result of this occurrence, the West Coast Wilderness Railway has advised the ATSB that they are taking the following proactive safety action in order to reduce their safety risk:
Review locomotive AB examination recording sheet; making changes where needed and ensuring maintainers are advised of any changes made.
Review the daily locomotive A-exam to include the need for ensuring the oil reservoir above the axle box horn guide is clear, horn cheeks are showing signs of lubrication and checked for visual signs of binding, and ensure that locomotive crews are advised of the change.
Investigate the possibility of improving the lubrication delivery method.
Revisit and amend the risk register for rolling stock inspections.
Undertake a review of the rolling stock maintenance procedures manual.
ATSB comment
The ATSB noted that the risk exposure for derailment of passenger services is reduced due to the limited use and blanket speed restriction for these types of locomotives on the West Coast Wilderness Railway network. In addition, the ATSB noted that the actions taken by West Coast Wilderness Railway should further reduce the risk of future derailment.
Safety message
This incident highlights to operators and maintainers, the importance of continually monitoring and reassessing risks to the safe operation of rolling stock – particularly with respect to low utilisation operating scenarios.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
________________________
A limited-scope, fact-gathering investigation into this occurrence was conducted in order to produce this short summary report and allow for greater industry awareness of potential safety issues and possible safety actions.
On 12 December 2014, the pilot of a Cessna 310 aircraft registered VH-TBE (TBE) was completing a charter flight from Oenpelli to Jabiru, Northern Territory. On board were the pilot, two adults and three children.
During the short flight, one of the passengers coughed incessantly through the headset which distracted the pilot. Once he had the aircraft stable he reached over and unplugged the headset.
The pilot manoeuvred the aircraft to join a late downwind for runway 27 at Jabiru. He reported that, as he commenced the pre-landing checks and verbalised 'undercarriage down' but made a decision to defer the associated procedure. He elected to keep the aircraft speed slightly higher than normal and as per the company procedures kept a stable power setting and profile and only made adjustments when needed at around 300 ft. He was also mindful of a Cessna 210 aircraft close behind VH-TBE.
He then focussed on the passengers, and made sure that had their seatbelts correctly fastened prior to landing.
The pilot reported that he normally completed the remaining memory-recall PUFF (set Propeller pitch, Undercarriage down, and Flaps Full down) check on final approach, but on this occasion he did not.
As the pilot flared the aircraft for landing he became aware that the undercarriage was not down and the propellers contacted the ground.
This incident highlights the impact a combination of distractions can have on aircraft operations.
Further reading on distractions for flight crew is available at:
On Tuesday 9 December 2014, at about 0003 (EDT), the load on train 2MP9 struck a timber pylon of an over-rail bridge near Great Western, Victoria. The train was transporting a number of Maxitrans skeletal road trailers (in piggyback configuration). During the journey, one of the upper road trailers had shifted laterally by almost 2 m, striking the Paxton Street bridge as the train passed beneath. Authorities closed the bridge, assessed it for safety and cleared it for normal traffic some time later. After being alerted to the load shift and collision while stopped and waiting for a passing train, the rail operator made arrangements to remove the road trailer load. Train 2MP9 subsequently departed Great Western at 1205 and continued its journey to Perth.
What the ATSB found
The ATSB found that, based on recorded data from wayside monitoring systems and the condition of the wagon’s side bearers, it is likely that the wagon carrying the shifted load (PQMY4346V) was hunting. The hunting motion would be expected to increase the lateral forces on the load restraints. Compounding this, SCT’s freight loading procedures did not specifically provide for the effective restraint and securement of commercial road transport vehicles for transportation on rail vehicles. Terminal staff responsible for securing and checking the load were not fully aware of the load securement requirements documented in the Rail Industry Safety and Standards Board (RISSB) Code of Practice for the Loading of Rail Freight.
What's been done as a result
SCT Logistics have issued a safety alert to all SCT managers and supervisors, reminding them of the freight loading Code of Practice requirements and instructing that only qualified and/or experienced staff are to perform the loading task.
SCT also addressed the mandatory replacement of wagon side bearers in accordance with the manufacturer’s service bulletin.
Safety message
A shifted load during rail vehicle transit represents a significant risk to infrastructure, railway employees, passengers, and the general public. In light of this occurrence, all rail freight operators should consider the safety implications of inadequate load restraint within their own operations - taking action where opportunities exist for improvement and compliance with requirements.
The occurrence
On Monday 8 December 2014, a load of Maxitrans skeletal road trailers arrived at the Laverton freight terminal, Melbourne. The trailers arrived via road in a piggyback (stacked) configuration. During the day the trailers were loaded onto a flat container wagon to form part of train 2MP9 travelling to Perth, WA. Train 2MP9 departed Melbourne at about 2050 (EDT).
At some point in the journey, one of the skeletal road trailers moved, leading to the load protruding almost 2 m beyond the edges of the rail wagon (out-of-gauge) (Figure 1). An out-of-gauge load is a load that does not conform to a predefined loading outline.
At about 0003 on 9 December 2014, the out-of-gauge road trailer on the 33rd wagon struck the Paxton Street over-rail bridge. The 33rd wagon was about 956 m behind the lead locomotive and the train crew were unaware of the collision. The train continued about 6.7 km further into Great Western, Victoria where it waited on the main line to cross train 6PM6 travelling from Perth. Great Western is about 288 km North West from Melbourne.
As train 6PM6 travelled through Great Western on the loop line, the driver noticed that ‘something was hanging off’ the train on the main line. The driver stopped the train and reported the condition to train 2MP9’s crew.
Shortly thereafter, train 7768, following 2MP9, discovered the damage to the Paxton Street over-rail bridge. The crew reported the damage to the Australian Rail Track Corporation (ARTC) network control centre. The ARTC control centre subsequently coordinated a response to the incident. The response involved repositioning train 2MP9 on the main line and closing the over-rail bridge to both rail and road traffic. A crane removed the shifted trailer, after which the train continued its journey.
Figure 1: The shifted load
The top road trailer had shifted to the left-hand-side in direction of travel. The movement was enough to strike the bridge infrastructure. Source: SCT Logistics
An examination of the over-rail bridge established that a timber pylon had been struck and destroyed (Figure 2). Accordingly, the bridge was cleared for rail traffic but remained closed to road traffic pending a subsequent structural engineering examination.
There were no injuries resulting from the collision and the road trailers sustained only minor damage.
Figure 2: Paxton Street bridge damage
The shifted road trailer struck and destroyed the wooden pylon as indicated. Note however, the pylon was redundant due to an additional steel support structure installed at an earlier time. Source: SCT Logistics
Context
The location
The out-of-gauge load was detected while train 2MP9 was at Great Western, about 288 track kilometres from Melbourne on the interstate main line between Melbourne and Adelaide. It was evident that the load on train 2MP9 had shifted sideways at some stage prior to striking the Paxton Road Bridge; about 6.7 km before entering the loop.
A lateral force is usually required to initiate a sideways load shift. This could result from in-train forces while travelling, or from passage across a track geometry defect. Information provided by the drivers indicated that track leading up to the Paxton Road Bridge was fine, with no notable instances of rough-ride that could be associated with geometry defects. A section of track between Maroona and Ararat (about 30 km before Great Western) was noted as having track geometry issues, but a temporary speed restriction had been applied in this area, which would have served to reduce undesirable lateral forces.
There was no evidence available to determine at what point the load had shifted during the journey from Melbourne. Similarly, there was no evidence to suggest that a specific track geometry feature or defect may have initiated the load shift.
Trackside condition monitoring equipment
The ARTC have wayside hunting[1] detection equipment installed at Port Germein, South Australia. Motion measurements from passing trains are stored so that the operator can interrogate the data for developing trends. The data can only be accessed by the relevant rolling stock owner/operator and is used to predict maintenance issues with rolling stock.
The ATSB examined the recorded condition monitoring data relevant to wagon PQMY4346V. The data logged 166 journeys between 22 December 2012 and 24 November 2014. In that time, the wagon had registered five medium, three high, and two extreme indications. This would suggest a developing trend that may have required maintenance intervention.
Train information
Train 2MP9 was owned and operated by SCT Logistics, and crewed by Genesee and Wyoming Australia (GWA) under contract to SCT Logistics. The train consisted of three locomotives hauling 51 wagons, totalling a combined length of 1,378 m and a gross mass of 4,181 t.
There was no evidence to suggest the train had been operated inappropriately, and as such, train handling was not considered to have been a factor contributing to the load shift.
Wagon PQMY4346V condition and monitoring
Following the incident, wagon PQMY4346V was sent to the maintainer’s facility in Perth for an inspection, where it was identified as having a number of faults that could have contributed to hunting, including failed side bearers[2]. Should hunting have developed while in transit, the hunting motion could very likely have increased the lateral forces on the load restraints.
Loading of freight on rail vehicles
The Australian Rail Industry Safety and Standards Board (RISSB) Code of Practice for the Loading of Rail Freight (CoP) specifies the requirements for loading, restraint, and securement of freight on rail vehicles, and is the standard adopted by SCT Logistics. Appendix F.1 of the CoP provides specific guidance for the lashing and securing of commercial road transport vehicles, and states:
F.1.4 Lashing & Securement
(a) Trailers should be secured using transport chain fitted with load-binders or turnbuckles—
(i) Trailers should be chained diagonally at the front and rear to provide lateral and longitudinal restraint, using two chains at each end. Each chain is fixed to the trailer and to the flat car at the opposite side.
(ii) Additional chains should be used along the sides of the trailer for further longitudinal restraint. These chains should be fixed to the trailer and the flat car in opposing directions so that they provide restraint in both directions.
(b) For trailers up to 24 tonnes gross mass—
(i) The lashings should be 10mm chain with a minimum tensile strength of 10 tonnes.
(ii) They should be attached as follows—
a. Two (2) each end in diagonal configuration to provide lateral and longitudinal restraint.
b. Two (2) chains each side sloping away from each other to provide longitudinal restraint in both directions.
Figure 3: Lashing and securing typical arrangement
Source: RISSB Code of Practice Loading of Rail Freight, Appendix F
The RISSB CoP did not specifically provide for the double stacking of road vehicles. While SCT Logistics did not have any additional documented procedures addressing the securing and restraining of double stacking of road vehicles, it would be expected that the general principles of the CoP should still be applied.
Loading on Wagon PQMY4346V
The wagon upon which the load had shifted was located at the 33rd position in the train consist. Two other similar loads were located to either side of this wagon (Figure 4).
Figure 4: Trailer loading on train 2MP9
The shifted trailer (indicated) compared with similar loads on adjacent wagons. Source: SCT Logistics
The Maxitrans skeletal trailers arrived at the train loading depot already unitised in the piggyback configuration. These units were lifted and placed on top of the flat rail wagons. Wooden pallets were stacked under the fifth wheel position to support the lower trailer. The lower trailer was secured to the rail wagon (Figure 5 and Figure 6)
Figure 5: Securing of trailers on wagon PQMY4346V
Figure 5 illustrates the load and securing configuration for the double stacked road vehicles on the rail wagon. The red lines represent securing of the trailers to the wagon at the time of the incident. Source: ATSB
Figure 6: Securing of trailers
Figure 6 shows the securing chain unitising the two trailers together. Note the steel beam on which the trailer support stands sit. A similar beam was used as a wheel guide for the rear wheels. Source: SCT Logistics
The trailers were secured at the road wheels via their axles. Since the securing chains did not bridge the suspension elements, the vehicle suspension was unlikely to compromise the integrity of the securement system.
Wagon PQMY4346V was fitted with constant contact side bearers[3] manufactured by the A. Stucki Company. SCT maintenance procedures do not require replacement during inspections, unless worn. However, a Stucki service bulletin, circa 2011, states research showing the Stucki side bearer blocks have a useful life of 600,000 miles (about 1 million kilometres) or six years of service. Each Stucki side bearer is stamped with a date of manufacture, although the date of manufacture could not be identified on the failed side bearer from PQMY4346V. Based on maintenance records, it was likely that the side bearers from this wagon had not been replaced in at least seven years.
Wayside monitoring equipment at Port Germein, South Australia, identified a series of motion indications from wagon PQMY4346V. In particular, during the period from 5 November 2014 until the incident, there were five indications recorded – two medium, one high, and two extreme. Of note however, the ownership of wagon PQMY4346V had been recorded against another transport operator on the ARTC system. While this may have contributed to SCT not identifying the motion indications from the wagon, it was noted that SCT, as the operator of the wagon, could still have accessed this data against the wagon identification.
Based on the condition of the side bearers (post-incident examination) and the recorded trackside condition data, it is likely that wagon PQMY4346V was hunting during the journey from Melbourne on 8 December 2014. A hunting wagon would almost certainly have increased the lateral forces on the load restraints.
Loading of rail freight
The RISSB Code of Practice for the Loading of Rail Freight requires items transported via rail to be appropriately secured. The securement system’s function is to restrain the load (prevent relative movement between the load and the vehicle), retain the load on the vehicle during normal transit, and minimise the risk of separation from the vehicle in adverse conditions such as collisions or derailments.
Restraint systems should be selected and applied to prevent the load from moving relative to the vehicle, in the longitudinal (length-wise), lateral (sideways) and vertical planes. Surface grip (friction), the vehicle structure, specific attachments, or combinations of these can be employed as forms of restraint. While frictional forces between the load and the vehicle deck or floor can provide some resistance to horizontal movement, friction alone is generally insufficient to restrain a load under dynamic forces and needs to be supplemented by other means.
Retention devices generally retain the loading on the vehicle by preventing vertical movement and providing longitudinal and lateral restraint. The retention function may be incorporated into the restraint system.
Freight movement on 2MP9
In this occurrence, the methods used to secure the lower trailer to the wagon (Figure 5) had provided limited restraint against longitudinal, lateral, and vertical forces. Most significantly, the upper trailer had only been restrained on the vertical axis, relying on the downward clamping (frictional) forces provided by the two forward hold-down chains to restrain the load against lateral or longitudinal movement.
Neither trailer had been secured sufficiently to prevent movement relative to the rail vehicle, as required by the RISSB CoP. This allowed the upper trailer stands and/or support beams to move laterally and subsequently collapse downward (Figure 7). When the upper trailer collapsed, the restraint chains became ineffective at restraining lateral movement, allowing the trailer to move further out-of-gauge.
Figure 7: Collapsed trailer
Shows the collapsed upper trailer and support beam. Note the securing point of the two forward hold-down chains on a lateral beam of the lower trailer. In this configuration, the potential existed for the chains to move laterally along the beam, contributing further to the lack of lateral restraint. Source: SCT Logistics
Freight acceptance
There was no documented guidance specific to securing and restraining double stacked road vehicles for transportation on rail wagons. Given the stacked trailer securing arrangements evident on train 2MP9, it was likely that the loading handlers accepted the load of road trailers without adequate inspection of the securement system that had been employed. It was also evident from the inadequate load restraint configuration that the loading handlers were not aware of the general principles contained in the RISSB CoP regarding securing road vehicles onto rail wagons.
From the evidence available, the following findings are made with respect to the collision between loading on train 2MP9 and an over-rail road bridge near Great Western, Victoria, on 9 December 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
Based on the condition of the side bearers and recorded data, it is likely that wagon PQMY4346V was hunting. The hunting motion increased the lateral forces on the load restraints.
SCT Logistics’ maintenance processes and systems did not detect the wagon’s side bearer faults or ensure that life-limited components were replaced in a timely manner.
SCT’s freight loading procedures did not specifically provide for the restraint and securement of double-stacked commercial road transport vehicles for transportation on rail vehicles.
The loading handlers did not apply the general principles of the RISSB Code of Practice for the Loading of Rail Freight when lashing and securing commercial road transport vehicles to rail vehicles.
Safety actions
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action taken by SCT Logistics
On 15 December 2014, SCT Logistics issued a safety alert to State Managers, Operations Managers, and Rail Manager/Supervisors, instructing that:
Road vehicles are (to be) secured as described in the Australian Code of Practice – Loading of Rail Freight (Appendix F – Road Vehicles).
A copy of the Code of Practice MUST be available to all staff who are required to secure loading.
Loading should only be undertaken by trained and / or experienced staff.
On 2 November 2015, SCT also reviewed their procedures to ensure the mandatory replacement of Stucki side bearers after one million kilometres or six years of service.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Australian Rail Track Corporation information
Rail Industry Safety and Standards Board Australia (RISSB) Code of Practice Loading of Rail Freight
Recorded data such as locomotive data logs
SCT Logistics information
Staff statements.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to SCT Logistics (SCT), Genesee & Wyoming Australia Pty Ltd (GWA), the Office of the National Rail Safety Regulator (ONRSR) and the Australian Rail Track Corporation (ARTC).
Submissions were received from SCT, GWA, ONRSR and ARTC. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 28 November 2014, a Cessna 210 aircraft, registered VHTWD (TWD), was being operated on a charter flight from Broome, Western Australia. On board were the pilot and four passengers.
At about 1135 Western Standard Time, the aircraft landed at Fitzroy Crossing to refuel before continuing to Balgo Hill Western Australia, where three of the passengers disembarked (Figure 1).
At 1202, the aircraft departed Balgo Hill for the Ringer Soak aeroplane landing area (ALA) Western Australia, where the remaining passenger was due to disembark. About 25 NM from Ringer Soak, while cruising at 5,500 ft, the pilot noticed a low oil pressure indication. He reported that all other engine instruments were within normal parameters. As Ringer Soak was only a few minutes away, he elected to continue and assess the situation after landing.
Figure 1: TWD flight route
Source: Google earth
Shortly after, the pilot detected a burning smell in the cockpit, followed by a loud bang from the engine. The engine started to vibrate and make an abnormal sound, and a small amount of white smoke emanated from the front section. The pilot immediately commenced the memory items from the emergency checklist, but there was no response from the engine. After shutting down the engine, he pitched the aircraft up slightly to both gain some altitude and to allow the speed to decrease. After configuring the aircraft for the best glide speed of about 80 kt, and with one stage of flap selected, he searched for a suitable landing area amongst the predominantly thick scrub and trees in the surrounding area. He eventually located an area that was more open, and during this time he also completed the emergency checklist to cover any items he may have missed during his initial actions.
Due to the intermittent communication at low altitudes in remote locations, the pilot then broadcast MAYDAY[1] on the Brisbane Centre frequency, and then switched on the emergency locator transmitter. Brisbane Centre gave assistance to the pilot and initiated a search and rescue phase. The pilot then briefed his passenger on the emergency procedures, and prepared for a forced-landing. Due to the rough terrain, he elected to keep the landing gear retracted and unlatched both doors and briefly turned on the master switch to fully extend the flaps.
He prepared the aircraft for touchdown with the tail in a lower than normal position. The aircraft impacted the ground firmly and slid forward at least 20 m before it came to rest. The passenger immediately exited using the right door, and after checking all switches were off, the pilot exited the left door.
The passenger reported he had a minor head injury while the pilot was uninjured. The aircraft was substantially damaged (Figure 2).
Post-accident activities
After retrieving the first aid kit, emergency rations and the Global Positioning System from the aircraft, the pilot set up a temporary shelter under the aircraft wing, while they awaited rescue. He communicated via very high frequency (VHF) radio with three separate aircraft deployed at different times by Air Traffic Control to overhead the accident. This enabled messages to be relayed to and from Brisbane Centre and the pilot. He conserved the aircraft battery by only turning on the power to communicate briefly which each aircraft and at one hourly intervals. At about 1500, a helicopter arrived to retrieve the pilot and passenger and ferry them to Halls Creek.
Figure 2: VH-TWD after emergency equipment had been retrieved
Source: Pilot
Weather
The weather enroute was fine with scattered cloud at about 7,000 ft. It was the wet season in northern Australia, and was typically hot and humid, with a temperature in excess of 38°C.
The aircraft
In July 2013, TWD was fitted with a factory rebuilt Continental IO-550 engine. Since installation of the engine, the aircraft had completed 1,059.5 hours. During this time, the operator had observed an unusually high oil consumption.
On 19 November 2014, the aircraft used 7 quarts[2] of oil during a 4.7 hour flight. This resulted in the aircraft being taken out of service for maintenance. Engineers found that cylinders number 3, 4 and 5 had glazed walls; these were honed and replaced. The piston rings were also removed and replaced. After a test flight, the aircraft was returned to service. The accident flight was the aircraft’s first commercial flight since being returned to service.
The operator conducted a further trend analysis of the aircraft’s oil consumption. They found that TWD had flown 168.3 hours, and used 152 quarts of oil which was about twice the typical consumption rate of about 0.43 quarts per hour.
Pilot experience and comments
The pilot had accrued about 3,270 hours total flight time with about 967 hours on Cessna 210 aircraft.
On the day of the flight, he had conducted the aircraft pre-flight inspection and submitted a flight plan as normal. The pilot checked the oil quantity as part of the pre-flight inspection at Broome and noted it was 8.6 quarts. The normal oil quantity range for this aircraft was 8-10 quarts. Due to the high weight of the payload, and as per normal procedure, the aircraft had to depart with less than full fuel and refuel at planned stops throughout the flight.
Due to the late arrival of one of the passengers, the flight was delayed for about one and a half hours. The pilot felt some concern about trying to regain some of this lost time in order to provide a timely service. He also reported that the passenger for Ringer Soak was quite anxious to get to his destination.
Engine examination
The insurance assessor advised the ATSB that the engine has been relocated to Perth for further examination. At the time of publication of this report, the reason for the engine failure had not been determined.
Operator comments
The operator conducted an internal investigation into the accident, and provided their report to the ATSB, where they raised concerns about the reliability of the factory overhauled IO-550 engines that had been installed in two of their C210 aircraft.
Major points from the company report are listed below.
Although the pilot checked the fuel at every stop on the flight, he did not manually check the oil quantity. Due the late arrival of a passenger at Broome, the pilot had departed 1.5 hours behind schedule. It is likely this influenced the pilot’s decision not to spend time manually checking the oil quantity at each stop.
In hindsight, TWD may have been unsuitable for the long flights to/from the more remote ports. Even though the aircraft was considered serviceable it may have been more appropriate for TWD to remain on short flights to further analyse the oil usage rates.
CASA Comment
The ATSB raised the issue of IO-550 engine failures with the Civil Aviation Safety Authority (CASA).
CASA completed a review of their database, and although there had been several failures of this engine type, there have been a number of different causal factors. After examining the information, they determined that there was no increasing trend of failures in this engine type.
Engine manufacturer
The ATSB contacted the engine manufacturer and will continue to liaise with them in regard the IO-550 engine.
ATSB comment
In the past 12 months, the ATSB has investigated three accidents involving engine failures of factory re-built IO-550 engine. At this stage, it has not been possible to determine any links between the accidents.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking several safety actions, some of which are listed below:
Flight restriction for other aircraft installed with a IO-550 engine
The company have placed a flight restriction on their other Cessna 210 aircraft fitted with an IO-550 engine. Until more trend data is available, they have restricted this aircraft to shorter, close to base flights.
Assistance from operations section
To promote better support from different sections of the company, the operations section will now assist flight crew when dealing with issues such as late passengers, loading and cargo problems and also to help determine a go-no-go time for delayed flights.
Maintenance controller
The maintenance controller is to more closely consider aircraft that have unusual, but acceptable usage of oil or other similar types of issues. These aircraft are to be flagged to the operations and safety section for closer trend monitoring, and also only utilised on shorter flights.
Chief pilot
The chief pilot will conduct flight crew refresher training on issues such as flight log and maintenance release entries, SARTIME and procedural requirements.
Chief engineer
The chief engineer will arrange for additional instruction to be available for engineers working on the IO-550 engine, and provide a go-to expert to contact for further information.
Company Procedures
The company noted that their operations manual detailing the correct operating procedures for the IO-550 engine contained some ambiguous instructions. The manual will be amended to better clarify the intent of its content.
Safety message
As was displayed in this instance, it is a timely reminder for pilots to be well rehearsed in both emergency procedures and to be pro-active in the post-accident survival phase, especially when operating in a remote area.
Section 5 – Emergency Procedures of the Visual Flight Rules (VFRG) guide gives an overview of planning for and dealing with emergency situations in aviation.
While no one ever plans to get into trouble, the possibility of an emergency situation should always be considered by all pilots before take-off. When faced with an engine failure in a remote area, there are extra survival considerations both prior to and immediately the aircraft has ‘landed’, as usually there will be an inevitable wait for assistance to arrive.
The Rescue Coordination Centre of the Australian Maritime Safety Authority (AMSA) produced a short booklet which highlights some of the considerations for preparedness for operations in remote areas.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1717 on 26 November 2014, the crew of a Virgin Australia Airlines Pty Ltd Airbus A330 aircraft, registered VH-XFJ, taxied to gate 20A at Perth Airport, Western Australia after holding short for about an hour due to severe thunderstorm activity in the area. When the aircraft stopped, the Ramp Supervisor connected the headset to communicate with the flight crew. At about the same time, other ground crew reported observing lightning strike the aircraft’s tail. As a result, an electrical discharge passed through the headset rendering the ramp supervisor unconscious. Another ground crew member who was assisting the arrival of VH-XFJ was also affected by electrical discharge from the lightning strike. That person remained conscious. Both ground crew were hospitalised for observation. There was no apparent damage to the aircraft.
What the ATSB found
The ATSB found that, while the airport’s lightning detection system was working within its rated specifications, it did not show ground strikes leading up to, or at the time of the injuries sustained by the ground crew. This highlights the importance of local observations when making risk assessments about resuming ramp duties. The ATSB also found that on the day of the incident, perceived operational pressure, weather advice, and a decrease in local storm activity influenced the Ramp Supervisor’s decision to resume ramp activities.
What's been done as a result
Subsequent to this occurrence, Perth Airport Pty Ltd has installed a thunderstorm warning system that provides audible and visual alerts to airport staff when it is unsafe to be on the ramp.
In addition, the ground-handling organisation made changes to its severe weather procedures, which include ceasing using aircraft-connected headsets when lightning activity is within 10 NM (19 km) of an airport.
Finally, Virgin Australia Airlines Pty Ltd advised that they provided all Airport Movement Coordinators with additional training in weather and flight planning. This included automated thunderstorm alerting system-specific training. In addition, the airline has aligned their manuals with other stakeholders’ extreme weather policy and procedures and commenced using wireless headsets at some airports.
Safety message
This occurrence reaffirms that perceived or actual operational requirements should not be allowed to compromise safety. When assessing if work can resume on the airfield in the face of potentially‑hazardous weather conditions, local observations of those conditions should be an integral part of the decision-making process. The final decision to resume duties should remain with the responsible person at that location.
Lightning at Perth Airport (not the day of the incident)
Source: Will Mallinson
The occurrence
On 26 November 2014, the flight crew of an Airbus A330 aircraft, registered VH-XFJ (XFJ) and operated by Virgin Airlines Australia Pty Ltd (Virgin), was conducting a scheduled passenger flight from Sydney, New South Wales, to Perth Airport, Western Australia. The general weather forecast for arrival at Perth included scattered thunderstorms. As a result, the aircraft was vectored a number of times by air traffic control to avoid the storm cells in the area.
At about 1435 Western Standard Time,[1] due to an electrical storm at Perth Airport, all work on the ramp stopped. At about 1515, no further lightning activity was observed on the weather radar, so the ground crew resumed their duties. However, shortly after, cloud-to-cloud lightning was observed and lightning struck the ramp behind an aircraft. All work activities immediately ceased again. The Ramp Supervisor (RS) reported continually monitoring the local conditions from that time to determine when it would be safe for staff to resume work on the ramp.
The captain reported that, on approach into Perth, the aircraft descended through cloud and that they became visual between 4,000–5,000 ft above ground level with small storm cells and lightning activity observed to the north of the airport. The captain recalled landing on runway 06 shortly after 1615 and, during the landing roll, seeing lightning strike the ground about 500 m to the right of the aircraft. The flight crew were advised by air traffic control to hold on the taxiway as the ramp was closed and their designated bay (20A) was occupied.
At about 1630, the Airport Movement Coordinator advised the RS they had been contacted by Virgin’s operations controller located in Brisbane, who queried why duties on the ramp had not recommenced, as other airlines had already resumed their Perth operations. The RS called the Operations Controller and was questioned directly as to why they had not returned to the ramp. During this conversation, the RS was told of advice from Virgin’s Meteorological Officer that there had not been any lightning activity in the area for the past 30 minutes. In response, the RS relayed that lightning was still visible overhead, and was told to discuss this with Virgin’s Meteorological Officer. After being unsuccessfully transferred to the Meteorological Officer’s phone, the RS hung up and reviewed the Bureau of Meteorology weather radar images.
After assessing the weather radar images, the RS determined that there could shortly be about a 45-minute break in the storm cell activity in the area. The Airport Movement Coordinator received a number of additional calls from the Operations Controller about the resumption of ramp duties, which were relayed to the RS. Following a discussion with other senior ground crew, and observing a reduction in the local storm activity, the RS decided to resume work on the ramp. The RS gave priority to clearing the backlog of aircraft waiting to be unloaded, then directed ground crew to move the aircraft already at bay 20A to nearby ‘stand-off’ bay 915 (Figure 1).
At about 1717, the crew of XFJ taxied to bay 20A. After they came to a stop, the RS chocked the nose wheels and connected a headset to the intercom jack at the aircraft’s nose landing gear (Figure 2).
As the ground crew were parking the other aircraft on bay 915, lightning was observed to strike the tail region of XFJ. Simultaneously, engineers located at bay 20A reported observing a lightning flash to the rear-left of XFJ. As the RS depressed the ‘push-to-talk’ button and established contact with the flight crew, the RS received an electrical shock consistent with a high voltage electrical discharge.
The RS staggered from the aircraft before collapsing unconscious on the ground. A second ground crew member assigned to XFJ was also subjected to the electrical discharge and sustained a burn injury. That ground crew member did not lose consciousness.
Both ground crew were transported to hospital for observation. The second injured ground crew member was released the next day and the RS remained in hospital for a number of days before being released.
Inspection of the aircraft by Virgin did not find any evidence of the lightning strike entry or exit points, nor were any defects found that could account for the injuries sustained by the ground crew.
Figure 1: Terminal three at Perth Airport indicating parking bays 20A (in red) and 915 (in green) and the witness locations
Source: Airservices Australia, modified by the ATSB
Figure 2: Perth Airport ramp closed-circuit television images showing the RS at the nose landing gear of XFJ
The aircraft, an Airbus A330-243, serial number 1561, was manufactured in France in 2014 and placed on the Australian register on 11 June that year. The aircraft was maintained in accordance with Civil Aviation Safety Authority requirements through the Virgin Australia Airlines Pty Ltd (Virgin) approved system of maintenance. The aircraft’s logbook did not contain any defects at the time of the occurrence that would have effected its airworthiness or account for the injuries sustained by the ground crew.
Aircraft lightning protection
Regulatory requirements
The United States Federal Aviation Administration (FAA) had developed an electrical system harmonisation working group to standardise regulations between the Federal Aviation Administration regulations (FAR) and the European Joint Aviation Authority regulations (JAR). This included electrical bonding[2] and protection against lightning and static electricity. As a result, FAR 25 and JAR 25 closely mirrored each other.
FAR/JAR 25 provided airworthiness standards for transport category aircraft. Regulations FAR/JAR 25.581 specifically addressed lightning protection. They stated that:
…an aircraft must be protected against catastrophic effects from lightning through the bonding of metallic components to the airframe, or designing the components so that a lightning strike will not endanger the aircraft. For non-metallic components, the regulations requires they are designed to minimise the effect of a strike, or incorporate an acceptable means of diverting the resulting electrical current so as not to endanger the aircraft.
Regulations FAR 25.899 and JAR ACJ 25X899 related to electrical bonding and protection against static electricity. These regulations highlighted that bonding design must minimise the accumulation of electrostatic charge that would cause:
human injury from electrical shock
ignition of flammable vapours
or
interference with installed electrical and electronic equipment.
They also reinforced that metallic components needed to be properly bonded to the airframe. Where other acceptable means of dissipating the resulting electrical current were used, they could not endanger the aircraft, personnel, or the operation of installed electronic and electrical equipment.
Aircraft design
Airbus advised that the A330 design was protected against the effects of lightning in accordance with FAR/JAR 25. That compliance was assessed during the aircraft design stage through analysis and testing that ranged from specific equipment installed on the aircraft, to full-scale aircraft testing.
The aircraft was designed to behave as a Faraday cage[3] in the event of a lightning strike. The aircraft’s structure and systems were protected through electrical bonding to minimize structural damage and electrostatic charge build-up, and to ensure that critical systems would remain available.
Aircraft bonding
Airbus also advised that any electrical charge from a lightning strike would most probably dissipate through the landing gear to the ground. Airbus Maintenance Briefing Note 12/5/2014 provided a number of illustrations and flow charts that referenced mandatory earthing for transit, base or hangar aircraft maintenance during storm conditions (Figure 3).
Figure 3: Airbus Maintenance Briefing Note 12/5/2014 extract showing the bonding requirements for transit, base or hangar maintenance during storm conditions
Source: Airbus
Aircraft Maintenance
Safe practices
Whether an aircraft is electrically earthed[4] or not, the risk of injury to ground crew working around the aircraft when it is struck by lightning is high and increases significantly if direct contact is made with the aircraft.
To minimise the likelihood of injury from lightning, the aircraft maintenance manual provided the following warning:
WARNING: DO NOT TOUCH CONNECTIONS TO THE AIRCRAFT, DO NOT USE HEADSETS, LIGHTNING STRIKE AND HIGH DISCHARGE CURRENTS ARE VERY DANGEROUS FOR PERSONNEL AND CAN CAUSE DAMAGE TO EQUIPMENT.
The aircraft maintenance manual defined a ‘WARNING’ as:
CALLS ATTENTION TO USE OF MATERIAL, PROCESSES, METHODS, PROCEDURES OR LIMITS WHICH MUST BE FOLLOWED PRECISELY TO AVOID INJURY OR DEATH TO PERSONS.
Lightning strike inspection procedure
The aircraft maintenance manual after lightning strike inspection detailed the maintenance actions after a lightning strike to the aircraft. The procedure defined lightning strike probability on the aircraft in terms of three probability zones (Figure 4).
Figure 4: Airbus lightning strike inspection areas
Source: Airbus, modified by the ATSB
The inspection procedure consisted of three phases:
phase 1, which entailed a visual inspection
phase 2, consisting of a system test
phase 3, which resulted in the replacement/repair of damaged equipment or components.
If the phase 1 inspection did not identify any defects, the subsequent phase inspections were not required. Review of the aircraft’s maintenance documentation revealed that no defects were identified during the phase 1 inspection after the lightning strike.
Meteorological information
Lightning
Lightning is an atmospheric discharge of electricity, which typically occurs during thunderstorms, but can occur during volcanic eruptions or dust storms. While the formation of lightning is still under debate, ice in clouds is believed to play a key role in lightning formation and the forcible separation of positive and negative charges within a cloud. Lightning can occur within clouds (cloud-to-cloud) or between the earth and a cloud (cloud-to-ground or ground-to-cloud).
As the thundercloud moves over the earth an equal but opposite electrical charge is induced on the ground. The negatively ionised air channels within the cloud (called leaders) are drawn toward positive ions in quick jumps. As these ‘stepped’ leaders approach within 15 to 50 m of the ground, the electrical potential increases until the remaining gap is bridged. A neutralising current flows along the ionised path, and is visible as a flash (bolt) in the return stroke.
Lightning often strikes outside heavy rain and can occur up to 16 km from the storm cloud. The typical ground bolt length is 1.6 km long.
Weather forecasting
The Bureau of Meteorology (BoM) produced a number of forecasts and reports for Perth Airport throughout the day. These included aerodrome warnings, aerodrome weather, aerodrome forecasts (TAF)[5] and trend forecasts (TTF)[6].
Aerodrome warning
Aerodrome warnings were issued when meteorological conditions that could adversely affect airport facilities, services, or aircraft on the ground were anticipated.
At 0839, an aerodrome warning (valid from 0840 to 2040) was issued for Perth Airport. It stated that thunderstorms were observed within the terminal area to the north and east that were expected to persist throughout the day and into the evening.
A second warning (valid from 1340 to 1700) was issued at 1340. This warning confirmed the presence of hail in the region with the possibility of hail at the airport in the afternoon until at least 1700.
Aerodrome weather briefing
An aerodrome weather briefing issued at 1331 confirmed the presence of thunderstorms to the north of Perth Airport and stated they were expected to continue until 1700 the following day. This included an at least 50 per cent probability of thunderstorms at the terminal until 1700 that day, and a 30 per cent probability of thunderstorms until 1700 the next day.
Amended TAF
At 1518, an amended TAF for Perth Airport (valid from 1500 to 2000 the following day) was issued. That forecast predicted rain showers and periods of thunderstorms and hail around the time of the occurrence.
TTFs
TTF (SPECI) reports were issued for Perth Airport at 1630, 1700, 1721 and 1730. These reports documented the presence of thunderstorm activity in the area.
Weather radar
The BoM provided copies of weather radar images for Perth Airport at the time of the incident. The weather radar images show only precipitation, not cloud formations, thunderstorms or lightning strikes. The images provided confirm the presence of rain in the vicinity of the airport at the time of the occurrence (Figure 5).
Figure 5: BoM weather radar screen captures of the weather at Perth Airport from 1700 to 1720 (0900 to 0920 UTC) on 26 November 2014 showing consistent light-to-moderate rain
Source: BoM, modified by the ATSB
Adverse weather monitoring
Automated Thunderstorm Alerting System
The BoM developed the Automated Thunderstorm Alerting System (ATSAS) to provide real-time information about thunderstorms and lightning activity at major airports. The system used radar data combined with localised single station lightning sensors at supported airports, including at Perth, to record cloud-to-cloud and cloud-to-ground lightning strikes within 10 NM (19 km) of the airport. The system had a reported accuracy of 90 per cent for lightning detection, with information updates occurring every minute. Data gathered was presented as a graphic for registered users, showing the airport in plan view, thunderstorm cell location and its forecast movement for up to 30 minutes.
Global Positioning and Tracking System
An alternate commercial lightning detection system was in operation in Australia at the time of the occurrence. The Global Positioning and Tracking System comprised of a network of sensors that used a different method of tracking lightning strikes. Data from that system was available to the BoM.
Global Positioning and Tracking System data was available for the period of the occurrence. The data showed multiple lightning strikes on the airport at 1342 and 1524.
Alerting system data
Neither the Global Positioning and Tracking System nor ATSAS data identified cloud-to-ground lightning strikes at or within a 5 NM (9 km) radius of the airport at the time of the occurrence. The data did show an increase in cloud-to-cloud lightning activity at that time.
Virgin adverse weather monitoring
Virgin reported that their Brisbane-based contracted Meteorological Officer monitored the storm activity in the vicinity of the Perth Airport that day. The Meteorological Officer stated that the data indicated that the last lightning strike within 5 NM (9 km) of the airport occurred about 16 minutes prior to the aircraft being parked at bay 20A. At the time of the occurrence, lightning activity was indicated approximately 21 NM (39 km) south-south-west of the airport. The Meteorological Officer reported that a significant increase in the number of cloud-to-cloud lightning strikes could signify an imminent cloud-to-ground strike.
Severe weather procedures
Virgin
Virgin’s Airport Airside Operations (AAO) manual discussed severe weather operations procedures. In accordance with the manual, either the Ramp Duty Manager (RDM)[7] or the Airport Duty Manager (ADM) were responsible for declaring a thunderstorm watch and activating the various stages of the phased response procedures. Activation was to be undertaken in conjunction with local observations and assessment.
The thunderstorm watch phased response procedures included the:
Alert Phase:
Once a storm front was within 10 NM (19 km) of the airport and continuing to approach, the RDM/ADM was to notify the likelihood of an operational shutdown to all ramp staff and key personnel. This included the on-duty Airport Manager, duty Operations Controller, Airport Movement Coordinator, flight crew and cabin supervisors, contractors and service providers, and so on.
Preparations for shutdown included suspending non-essential open area activities, alerting staff using headsets, advising fuelling operations to monitor the approaching storm and avoiding use of highly-conductive equipment.
Stop/Shutdown Phase:
When the storm was within 5 NM (9 km), the RDM/ADM was to declare the Stop/Shutdown Phase and ensure the information was relayed to all relevant personnel.
On announcement of the Stop/Shutdown Phase, personnel were to stop all ramp activities, including fuelling. Communication with the aircraft via headset was to be discontinued and personnel were to seek shelter inside buildings. All passenger boarding was to cease and arriving aircraft be held off their gate.
All Clear/Downgrade/Cancellation Phase:
When the storm had passed 5 NM (9 km) from the airport, there was a downgrade to the Alert Phase. When the storm reached 10 NM (19 km) from the airport, the Alert Phase could be cancelled.
The AAO manual contained the following note in respect of the procedure for ATSAS airports:
The AAO acknowledged the risk of lightning injury and advised that many lightning injuries occurred after the perceived threat had passed. The manual also stated that ‘lightning generally diminishes with time after the last sound of thunder, but may persist for more than 30 minutes.’
The manual’s thunderstorm and lightning safety subsection listed activities that should not be undertaken during lightning events. These included the use of a headset that was connected to an aircraft and not staying in open areas or under the aircraft.
Ground handling
Virgin used a third party for aircraft ground-handling operations at Perth Airport. The ground handling organisation was one of the largest independent providers of ground support services in Australia, with operations at 16 major airports.
The ground-handling organisation’s Quality Manual contained procedures for adverse weather operations, including thunderstorms. While the procedures identified BoM and Virgin’s meteorological services as major sources of weather information, the procedure noted that:
Airport managers and Ramp Supervisors should use this information carefully, also taking into account local visual observations.
The stipulated response to adverse weather conditions was divided into the following five phases:
Awareness
Storm watch
Alert
Airside operations shutdown
Downgrade/cancellation.
These phases aligned closely with Virgin’s procedures in regard to storm proximity to the airport and the cessation/resumption of ramp activities.
Airport procedures
The Perth Airport Pty Ltd operating protocols placed the onus on the airlines and their contractors to ensure that their staff were competent in airfield and ramp occupational health and safety practices. Consequently, the airport’s policy and procedures did not incorporate any specific adverse weather practices or procedures. Perth Airport did not have an airfield thunderstorm/lightning warning system for alerting personnel on the apron.
Organisational and Management information
Workload/operational pressure
At the first sign of lightning near the ramp (at about 1515), the RS ceased work activities and withdrew the ground-handling staff. At about 1630, the Aircraft Movement Coordinator and Operations Controller questioned why the RS had not recommenced work on the ramp as the meteorological information provided showed no lightning activity since about 1600. At that time, work had ceased for over an hour and there were partially-unloaded aircraft that had landed just prior to the lightning activity.
The Operations Controller re-enforced that the aircraft needed to be unloaded and dispatched, as they were required on the ‘east coast’ that night. As a result, the RS reviewed the radar data on the BoM website before directing the ground handlers to resume ramp duties
The RS stated that had he not felt pressured by the Operations Controller and Aircraft Movement Coordinator, he would most likely not have resumed work on the ramp at that time.
Additional information
Decision making
Studies have found that decision quality decreased when time pressures are imposed (Kerstholt 1991). The decision maker will tend to narrow their focus with selective processing of the available information. Research into the effect of time pressure on aviation maintenance errors found that decision making accounted for about 9 per cent of errors studied (Suzuki and others 2008). That percentage increased to about 27 per cent when time pressures were applied.
The RS advised of feeling under pressure to return ground-handling staff to ramp duties quickly to facilitate the relocation of aircraft to the east coast that day.
Lightning injuries
On average, there are about 10 fatal lightning strikes and about 100 strikes that result in injury in Australia each year. Injuries from lightning can occur through the following discharge methods:
direct strike, in which the person is the point of the lightning strike
contact strike, where the person is in contact with an object that is struck
side flash, where lightning strikes an object and jumps/splashes to a nearby person
upward leader strike, in which the positive current moves upward without contacting the downward stroke
ground flash/current, where the lightning strikes the ground some distance from the person. The lightning then spreads across and energises the ground.
Canadian research statistics have shown that the most common lightning injuries are the result of indirect strikes, with ground flash/current accounting for 40 to 50 per cent of injuries, and side flash accounting for 20 to 30 per cent of injuries. Only 3–5 per cent of injuries were attributed to direct strikes (Figure 6).
Figure 6: Pie chart of Canadian lightning strike types and annual injury percentages
Source: Environment Canada
It is a common misconception that lightning strike victims remain electrically charged and that contact with that person can result in injury. This is incorrect, as the electrical discharge passes through the strike victim to earth. Consequently, shock injuries do not occur as a result of touching someone who has been struck by lightning.
Other occurrences
Perth Airport Pty Ltd advised that they had no record of any previous injuries due to aircraft lightning strikes occurring at Perth Airport.
The ground-handling organisation advised that their records showed four incidents of possible lightning strike electrical discharge injuries across their operations. These included:
2008 Gold Coast Airport, Queensland. During the aircraft’s arrival, the ground crew felt a minor shock through the headset.
2013 Perth Airport. During dispatch, the ground crew felt a minor shock through the headset.
2014 Darwin Airport, Northern Territory. During waste water servicing, the ground crew was knocked to the ground but was able to continue their duties.
2014 Perth Airport (this incident).
A search of the ATSB occurrence database identified 19 lightning strikes to aircraft that were parked or taxiing at aerodromes in Australia from 1974 to 2014. Of these incidents, only this occurrence resulted in serious injury to personnel.
After VH-XFJ (XFJ) arrived at gate 20A at Perth Airport, lightning was observed striking the tail region and rear-left of the tail of the aircraft. The two ground crew who were receiving the aircraft sustained injuries consistent with electrical discharge from the lightning strike.
The aircraft was manufactured to the required lightning protection design standards. Inspection of the aircraft by Virgin Australia Airlines Pty Ltd (Virgin) maintenance staff did not identify the lightning strike point of entry, nor was evidence of an electrical bonding deficiency found. Further, the aircraft did not contain any defects that could account for the injuries sustained. As a result, the aircraft design or its systems were not considered contributory to the occurrence. Therefore, this analysis will focus on factors relating to the:
lightning strike
effectiveness of the monitoring of the lightning activity
effectiveness of the adverse weather procedures employed by the parties involved
effect of perceived or actual operational pressure on decision making.
Lightning strike
Location of the strike
The lack of an identifiable lightning strike entry or exit point on XFJ could be attributed to the integrity of the aircraft’s electrical bonding and that ground discharge occurred through the headset and ramp supervisor (RS). However, a lightning strike to the ground adjacent to the aircraft, rather than to the aircraft itself, would also account for the absence of lightning damage to the aircraft.
The ground staff on bay 915 reported seeing lightning strike the tail of XFJ. The presence of lightning was further supported by the flash at the rear-left of the tail of the aircraft as reported by the engineers on bay 20A.
The ATSB considered which of a lightning strike to the tail or to the nearby ground was more likely. In this regard, a lightning ground strike would result in radial discharge from the point of strike as shown in Figure 7.
Figure 7: Ground lightning strike showing radial discharge from a central strike point (indicated by a white arrow)
Source: Mr Al Gamaty, courtesy of Reddit
Had a ground strike occurred at the near-rear of the aircraft, and discharged outward toward the location of the RS and second ground crew member at the nose wheel, it would have also radiated approximately the same distance behind and to the sides of the aircraft. Given the lack of reported lightning injuries/effects to other ground crew working in those areas, a ground strike is considered less likely than a tail strike.
Ground crew injuries
The injuries sustained by the two ground crew were consistent with high voltage electrical discharge. A lightning strike to the ground close to the aircraft could have resulted in a ground current passing through both ground crew. However, in the case of the RS, the injuries appear more likely a result of lightning striking the tail of the aircraft and discharging through the headset and RS to earth. This is termed a ‘contact’ strike. Due to their close proximity to the aircraft, the second ground crew member most likely received a less severe, ‘side flash’ strike.
Lightning activity monitoring and the decision to resume tarmac operations
Lightning activity monitoring
Virgin’s Brisbane-based Meteorological Officer had access to Bureau of Meteorology weather data and was monitoring the weather at Perth Airport. Specific to lightning activity, they had access to the Automated Thunderstorm Alerting System (ATSAS) and the Global Positioning and Tracking System data. Neither system showed ground strikes at the airport prior to or during the occurrence. The absence of lightning activity in that data, which was briefed to the Operations Controller by the Virgin Meteorological Officer, was a significant factor influencing the controller to discuss the resumption of work on the ramp with the RS.
The ATSAS and Global Positioning and Tracking system provided a high level of accuracy in the detection of cloud-to-ground lightning strikes (reported as up to 90 per cent accuracy). However, the absence of detection by either system in this occurrence supports the need to source collaborative local data when determining whether it is safe to return to work activities.
The decision to resume tarmac operations
The RS attempted to clarify the lightning risk after the Operations Controller called to advise that no lightning activity was recorded in the area for the last 30 minutes, and that other operators had resumed tarmac operations. This entailed the RS attempting to telephone the Brisbane-based Meteorological Officer to discuss the disparity in the controller’s advice as compared to the lighting still being observed overhead. The RS was unable to contact the Meteorological Officer.
Consistent with the reported perception by the RS of pressure from the Operations Controller and Airport Movement Coordinator to resume work earlier than they would have liked, the RS used the Bureau of Meteorology website’s weather radar information to assess the local conditions and estimate the storm’s movement. The weather radar displayed areas of precipitation, but did not directly show cloud formation, thunderstorm or lightning strike activity. Therefore, the weather radar alone did not provide sufficient information to predict lightning strikes. Additionally, the use and interpretation of weather radar information without formal training increased the likelihood that the RS was not aware of this limitation.
In the event, the RS’s decision to resume tarmac activities was informed by their interpretation of the radar data accessed on the Bureau of Meteorology website. This interpretation was reinforced by the report from the Operations Controller of no lightning activity in the area in the preceding 30 minutes, and by the supervisor’s perception of a reduction in local storm activity.
A review of weather radar images for the period leading up to the incident indicated ongoing rain in the vicinity of the airport (Figure 5). The data did not show a clear break in the storm.
Severe weather procedures
Virgin
In respect of the resumption of duties at ATSAS-equipped airports such as Perth, Virgin’s Airport Airside Operations manual severe weather operations procedure stated:
The decision to resume normal duties shall take into account any cells observed outside the 5 nm [9 km] radius which are expected to impact on the airport in the immediate future. Where a second cell is anticipated to impact on the 5 nm [9 km] area, the decision to resume ramp activities rests with the RDM [Ramp Supervisor] and the DES [Duty Engineering Supervisor].
Despite those requirements, it appears that Virgin’s Operations Controller did not consider seeking an understanding of the local weather conditions from either the RS or the Duty Engineering Supervisor. A discussion with the RS of the need to resume ramp duties would have, if able to have been carried out, provided an ideal opportunity for the Operations Controller to gain that understanding. There was the potential for it to have also had an effect on the pressure felt by the RS to resume those operations.
Ground-handling organisation
The ground-handling organisation’s procedures in the case of thunderstorm and lightning activity closely followed those of Virgin with regard to alert stages and the cessation and resumption of duties. The procedures supported the use of weather information as part of the assessment process and stated that local visual observations should be taken into account when assessing the resumption of duties, but cautioned that airport managers and ramp supervisors should use weather information carefully. However, no formal guidance or training on which weather information was suitable given the situation, or how to interpret that information, was provided.
Summary
Virgin’s and the ground-handling organisation’s procedures provided for local observations to be taken into account when considering the resumption of ramp duties. However, the reliance by the Operations Controller on the Meteorological Officer’s advice that lightning activity had ceased affected the application of those procedures in this case. The conversation between the controller and the RS, and then the Airport Movement Coordinator and the RS, resulted in perceived pressure by the RS to resume ramp duties. Given the report of lightning still being observed overhead, the decision by the RS to resume those operations increased the risk of a lightning strike and injury to ground personnel.
Findings
From the evidence available, the following findings are made with respect to the lightning strike involving Airbus A330, registered VH-XFJ, at Perth Airport, Western Australia on 26 November 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
In combination, perceived operational pressure by the Ramp Supervisor, and their assessment that there would be a 45-minute break in thunderstorm activity, influenced the decision to resume work on the ramp during local thunderstorm activity.
Consistent with the observed lightning strike to the tail of the aircraft, connection of the headset to the aircraft during local thunderstorm activity resulted in a ‘contact’ strike to the ramp supervisor.
Other factors that increased risk
The Automated Thunderstorm Alerting System and Global Positioning and Tracking System data did not show cloud-to-ground lightning activity within 10 NM (19 km) of the airport prior to work resuming on the tarmac or at the time of the injuries. Despite the observed local conditions, the lack of recorded ground strikes prior to the incident may have created a false impression of a low lightning risk environment.
The Virgin Australia Airlines Pty Ltd Meteorological Officer report of no lightning activity in the area in the previous 30 minutes was communicated to the Ramp Supervisor by the Operations Controller. That and the subsequent communication by the Airport Movement Coordinator was perceived by the Ramp Supervisor as pressure to resume ramp duties.
Other finding
The Ramp Supervisor’s assessment that there would be a 45-minute break in thunderstorm activity was reinforced by the report by the Operations Controller of no lightning activity in the area in the preceding 30 minutes, and the supervisor’s perception of a reduction in local storm activity.
Safety issues and actions
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
Proactive safety action taken by Virgin Australia Airlines Pty Ltd
As a result of this occurrence, Virgin Australia Airlines Pty Ltd:
Enhanced its flight planning and weather training for all ground operations Airport Movement Coordinators, incorporating a specific Automated Thunderstorm Alert System training package.
Is considering the implementation of a ‘Severe Weather’ text message alert system to airports on their network that were not covered by the Automated Thunderstorm Alerting System. These alerts would be sent in advance of severe wind, lightning, and so on and would direct the recipient to the Bureau of Meteorology for more information.
Commenced a trial of smartphone weather alert applications with key operational personnel across the domestic network.
Commenced using wireless headsets at some airports.
Aligned their manuals with other stakeholders’ extreme weather policy and procedures.
Proactive safety action taken by Aerocare
As a result of this occurrence, Aerocare (the ground-handling organisation) made a number of changes to its adverse weather procedures. These included:
increased emphasis that Ramp Supervisors have the authority to determine the cessation and recommencement of work activities
increased emphasis on the risk of electrical discharge as a result of connecting a headset to an aircraft during storm activity and increasing the minimum distance from such storm activity at which headset connection takes place from 10 km to 18 km
clarification of a number of terms/distances
increasing the lightning risk distance from an airport from 10 km to 18 km
the inclusion of first aid and emergency response information in case of a lightning strike
greater guidance on the available weather-monitoring tools
standardisation of the adverse weather phases as follows:
- Awareness – forecast adverse weather
- Watch – 30 NM (56 km) and approaching
- Alert – 10 NM (19 km) and approaching
- Airside operational shutdown – 5 NM (9 km) and approaching
- Downgrade - greater than 5 NM (9 km) and receding
- Cancellation – no thunderstorm activity is forecast or observed locally.
Proactive safety action taken by Perth Airport Pty Ltd
As a result of this occurrence, in December 2014 Perth Airport Pty Ltd produced Safety Bulletin issue 05. The bulletin highlighted the importance of taking appropriate action during severe weather to airside operators and personnel.
Additionally, in September 2015 a thunderstorm warning system that featured audio and visual warnings to staff on the airport was installed. Perth Airport Pty Ltd advised that, since installation, the warning system had been used successfully on a number of occasions.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
ramp supervisor
ground crew
ground-handling organisation
Bureau of Meteorology
Virgin Australia Airlines Pty Ltd
Airbus
Perth Airport Pty Ltd.
References
Suzuki T, Von Thaden TL, Geibel WD. 2008, Influence of time pressure on aircraft maintenance errors. Champaign Illinois.
Kerstholt J H. 1991, Time pressure effects on decision making in a dynamic task environment, TNO, Soesterberg.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Virgin Australia Airlines Pty Ltd, Airbus, Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile, the Bureau of Meteorology, Perth Airport Pty Ltd, the ground-handling organisation, the Ramp Supervisor and the second ground crew member working on VH-XFJ and the Civil Aviation Safety Authority.
Submissions were received from Bureau of Meteorology, the Civil Aviation Safety Authority and Virgin Australia Airlines Pty Ltd. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 1159 on 24 November 2014, freight service 4190 passed Signal 66.8 while it was displaying a stop aspect and without an authority[1]. Signal 66.8 is located in the section between Wyee and Warnervale on the NSW central coast. The SPAD represented a breach of the Network Rules and Procedures involving the use of Absolute Signal Blocking (ASB) that had been granted as part of worksite protection arrangements for a workgroup conducting electrical maintenance tasks at Warnervale. The Protection Officer for the workgroup was granted ASB shortly after there was a change in the Network Control Officers (NCO) at Morisset, from where the signals protecting the section were controlled. Although assurances were given to the PO that the section was clear, two trains were still travelling between the protecting signals and the worksite at the time ASB was implemented. The first train passed the worksite shortly afterwards without incident. The second, travelling some eight minutes behind, came to a stand approximately 1,300 metres before the worksite after the driver reacted to a signal returning to stop in front of the train. The signal had returned to stop because of electrical testing being conducted as part of the maintenance tasks. Its return to stop also (fortuitously) prevented the train from entering the worksite and potentially injuring the workgroup members.
There were no reported injuries or infrastructure damage as a result of the incident.
What the ATSB found
The ATSB found that when the NCOs changed over at Morisset, there was a breakdown in the handover process. This breakdown resulted in ASB being granted to the PO at Warnervale without the exact location of trains being established, signals V8 and V6 being set back to stop and blocking facilities applied in accordance with Network Rule NWT 308. At the time of this incident Sydney Trains was trialling a modified ASB methodology to address previously identified safety issues, however this trial had not been extended to Morisset. If it had been, the progress in granting ASB would have been documented and would have assisted the NCOs during the handover process.
What's been done as a result
Sydney Trains advised that it has expanded its trial of the ‘Coded Authorisation Process for Absolute Signal Blocking’ to include signal box locations on the Main North Line between Gosford and Broadmeadow. It further advised that, upon completion of the trial, the Network Rule and Procedure for Absolute Signal Blocking will be rewritten to improve its readability and application.
Safety message
This incident illustrates the criticality of minimising interruptions and distractions that may affect the process for the granting or authorisation of work on track authorities, particularly Absolute Signal Blocking. Similarly, it reinforces the importance of information and situational awareness exchange between personnel during the handover process for the control of dynamic rail network operations.
At 1128 on 24 November 2014, two officers from NSW Police entered the signal box at Morisset unannounced seeking information regarding an incident which occurred on a train at Morisset two nights previously. They engaged with a Duty Manager (DM) who had just arrived to sign on for duty at 1130.
As this was occurring, the Protection Officer (PO) for a workgroup conducting electrical maintenance tasks telephoned the Station Manager (SM) at Morisset, who was also in the signal box working in the role of Network Control Officer (NCO) (Signaller). The PO requested Absolute Signal Blocking (ASB) for protection of a worksite on the Up Main North line at Warnervale (Figure 1). [2] During the discussion, the PO also mentioned he would require ASB for a number of other proposed worksites in the section between Warnervale and Wyee up till 1500. The PO nominated absolute signals V8 and V6, between Morisset and Vales Point, as the protecting signals for the ASB requests. The SM acknowledged the request for ASB telling the PO he would ‘get his offsider to cut in’. [3]
The SM commenced the process to grant ASB. Significantly, as this was happening (at about 1136), up freight service 4122 passed through Morisset, heading towards the proposed worksite at Warnervale.
At 1139, as part of the ASB process, the SM advised the NCO at Wyong and the Train Controller at Sydney North Control of the intention to switch the interlocking at Vales Point from automatic to local control. This was required in order to place blocking facilities on signals V8 and V6 as requested by the PO. Completing both calls, at 1141, the SM advised the Train Controller of the ASB request and provided all the assurances needed for the Train Controller to compile the ASB checklist. The Train Controller also acknowledged the likelihood of other ASBs being granted during the day and sought an assurance from the SM that they would be managed as required. This was despite its being a circumvention of the ASB process which does not provide for blanket authorisation for multiple ASBs.
In the meantime, the Police requested to view CCTV coverage of the station and surrounds for the purposes of the incident they were investigating. While viewing some CCTV footage in the signal box area, two persons of interest related to the incident were observed to be on station premises as well as an open staff car park gate. Concerned about the presence of these persons on the station premises and the open gate, the DM exited the signal box at 1144 to ascertain the location of the persons and close the gate. After searching various passenger areas around No.2 platform and closing the gate, he re-entered the signal box at 1147. As this was occurring, a second freight service, 4190, arrived at Morisset at 1146. As Signals V8 and V6 had not been set back to stop with blocking facilities applied at the time for ASB, 4190 continued on towards the worksite at Warnervale.
At 1147, the SM informed the NCO at Wyong of the passing of trains 4122 and 4190. Ending the call at 1148, he indicated that he would be handing over to the DM as he was ‘going home’.
At 1149, the DM, having assumed the role of NCO, telephoned the PO to advise that ASB had been granted since 1143. This was less than a minute after the SM had concluded the call with the NCO at Wyong and less than two minutes after the DM had re-entered the signal box and concluded with the Police. He gave the PO an assurance that signals V8 and V6 were at stop with blocking facilities applied and that the section was clear as a freight train should have just passed their worksite. The PO responded that no freight train had passed. Surprised, instead of immediately cancelling or fulfilling ASB, the DM instructed the PO to call back once it had passed.
Figure 1: Incident location
Source: NSW Trains annotated by OTSI
At 1151, the PO telephoned the DM to report that a freight train ‘with leading engine 44202’ had passed clear of the worksite. This engine was later identified as the leading engine on the first freight train, 4122. Although not fulfilled or cancelled, at 1152, after all assurances were given and received, ASB was again granted to the PO. Immediately, the workgroup commenced their maintenance tasks. The maintenance tasks involved the change-out and testing of an electronic control module associated with permissive Signal 66.8 located in the signal hut beside the level crossing at Warnervale. The change out of the module took less than a minute and testing commenced at 1153. The testing caused the aspect of Signal 66.8 to alternate between stop and proceed a number of times.
At 1155, as testing was continuing, a ‘Signal Passed at Danger’ (SPAD) alarm for Signal 66.8 activated in both Morisset and Wyong Signal Boxes. The alarm at Wyong was also accompanied by a report from the driver of 4190 advising that he had passed Signal 66.8 by approximately 500 metres after it had returned to stop in front of the train.
After receiving advice about the SPAD from the NCO at Wyong, the DM contacted the PO querying whether any of the workgroup’s actions had caused Signal 66.8 to return to stop in front of 4190. The PO responded that the workgroup had been testing the signal when the SPAD had occurred but queried how there was a freight train past the protecting signals (of the ASB). As the conversation continued, it became apparent that the DM had been confused about freight train 4190. Although it should have been visible on the local panel at the time in the vicinity of Wyee, 4190 had gone unnoticed in the approximately 14 kilometre long section between the last protecting signal (V6) and the worksite when the PO was first informed ASB was granted at 1151.
There were no injuries to any persons and no infrastructure damage.
Resulting safety actions
At 1201, the SM, who was still present in the signal box, resumed the role of NCO. He informed the PO that, because of the incident, ASB was cancelled pending notification and investigation by incident response officers.
Both the DM and the PO underwent post-incident drug and breath testing, subsequently returning negative results. Despite being directly involved parties, the SM, the Train Controller and the crew of 4190 were not assessed or breath tested post incident.
Sydney Trains acknowledged that the crew of freight service 4190 had not contributed to the incident, so were permitted to continue once cancellation of the ASB was completed. The incident caused minimal delay to 4190 and following services.
In response to the incident, instructions were issued that qualified staff from Sydney Trains would monitor the issue of any work on track authorities in the signal boxes operated by NSW Trains staff on the Main North line.
In February 2015, in response to this incident, Sydney Trains expanded a western network region trial of modified ASB procedures to include the signal boxes on the Main North line. The modified procedures, in essence, are designed to formalise the critical ASB details. Both the NCO (Signaller) and the PO are required to include the following on a standardised ‘job aid’:
the exact worksite location
the details of the last train to pass through the section and its current location
an assurance that there are no trains between the protecting signals and the worksite
an assurance that signals are set to stop with blocking facilities applied.
All the infrastructure relevant to the incident is located on the Main North line between Sydney and Newcastle. The SPAD occurred at Signal 66.8 (107.722 km[4]) between Wyee and Warnervale. The worksite was located at the level crossing at Warnervale (105.915 km). Signals V8 and V6, which were being used as protecting signals for the worksite, are located at 119.309 km and 121.359 km respectively. All signals are located in the area monitored or controlled from Morisset Signal Box (123.400 km).
Morisset Signal Box
Morisset signal box is one of two on the Main North line where NSW Trains staff provide network control officer functions on behalf of Sydney Trains under a services contract. The NSW Trains staff operate under Sydney Trains accreditation using Sydney Trains’ Network Rules and Procedures.
The station consists of two platforms with the main office complex and ticket booking office located on No.2 Platform. A combined signal box and meals area is included in the main office complex. There are two access doors into the signal box, one directly from the platform and the other via the Station Manager’s office (Figure 2). However, there were no instructions on either door for persons requiring access.
Figure 2: Platform 2 Morisset
The signal box controls the operation of the interlocking and absolute (controlled) signals at Morisset and Vales Point. The interlocking at Morisset is lever controlled with a track diagram that provides the signaller with information regarding the location of trains and the status of track circuits, absolute signals and points. A separate electrical switch panel is used to operate the interlocking at Vales Point when in local control. Panel indicator lights and switch positions provide the signaller with an indication of the location of trains and the status of track circuits, absolute signals and points in the interlocking.
The signal box is also provisioned with the following (Figure 3):
A Train Location System (TLS) located in the signal box and ticket booking office that provides a graphical representation of the entire Sydney Trains electrified network.
A non-vital Train Visibility System (TVS) to monitor the permissive signalled “dark territory” between Dora Creek and Wyong [5],[6]
Track diagrams to provide an indication of the location of trains and the status of track circuits, absolute signals and points in Morisset’s area of control.
Figure 3: Morisset Signal Box
The TLS shows the run numbers of all services and their locations, except for freight services between Broadmeadow and Wyong, which are not visible. The blocks occupied by freight trains appear as a red lines on the diagram, but a run number is not displayed. All services are, however, visible on the TVS which displays services as occupied lines / blocks. While Morisset station is manned continually, the signal box is not. Being a localised signal box, it is cut in or cut out by the Signaller for worksite protection arrangements, when terminating rail traffic at Morisset or when rail traffic is required to enter or exit Vales Point power station. When cut out, all absolute (controlled) signalling in the Morisset area of control operates in automatic mode.
Train movements through the Morisset area of control are also monitored by the Train Controller at the Rail Management Centre (Sydney) who marks all train movements on a train graph based on the times reported by the signal boxes along the line. The Train Controller also has a TLS to provide oversight of their area of control and the network.
In accordance with current security requirements, all persons entering the station, other than members of the public entering or using public areas, are required to undergo a local safety induction. The induction is a mandatory briefing for all station visitors to make them aware of key safety related issues and requirements. This was not done for the NSW Police officers and their presence in the signal box was not managed during the time safety critical information was being exchanged.
Applicable Network Rules and Procedure
Network Rule NWT 300 - Planning Work in the Rail Corridor
NWT 300 prescribes the rules for planning work in the rail corridor and assessing the work for safety. Before any workgroup enters the rail corridor, the PO must plan and document the worksite in accordance with NWT 300. The rule prescribes that work planned in the corridor must be assessed for safety and it’s potential to intrude on the Danger Zone. Work cannot be carried out unless a safe place can be easily reached and safety measures are in place.
A worksite must have a PO whose primary duty is to keep the worksite and workers safe. POs must be satisfied that other work will not interfere with their primary duty. The PO is responsible for the following:
conducting the safety assessment of the worksite
briefing the workers of the protection arrangements
ensuring the works are conducted in a safe manner
keeping records of the protection arrangements
communicating with Network Control about the protection.
When conducting the safety assessment, the PO must consider, amongst other factors, the method of protecting the worksite, the resources required for its protection and the communication requirements. The PO must also ensure that the planning of the worksite is documented and all workers are adequately briefed on the safety requirements.
Network Rule NWT 308 – Absolute Signal Blocking
ASB is a method of worksite protection used to exclude rail traffic from a worksite. It is intended for use where any required tools can be easily removed from the tracks by a single person. ASB can also be used to allow vehicles to cross the track at network access level crossings.
When requesting ASB, the PO must tell the signaller the location of the worksite and the intended start and finish times. All points of entry must be protected and the PO must arrange for:
at least two consecutive controlled absolute signals at STOP with blocking facilities applied, or
manual points control mechanisms to be used to set controlled absolute signals at STOP, or
at least one controlled absolute signal at STOP with blocking facilities applied, and
points secured to prevent access to the tracks, or
there must be an easily reached safe place available and a lookout provided.
A signaller may grant the ASB method only for signals in their respective area of control. Before setting controlled signals at Stop, the Signaller must tell the Train Controller about the request to exclude rail traffic. The Signaller must ensure that:
the protecting controlled absolute signals are at STOP, and
blocking facilities have been applied, and
there is no approaching rail traffic between the protecting signals and the proposed worksite, and
that any rail traffic that has passed complete beyond the worksite will not return.
The PO must confirm these actions with the Signaller as well as the agreed start and finish times.
At the end of the working the PO must tell the Signaller that the work is completed, the workers and equipment are clear of the danger zone, all manual points control mechanisms have been returned to normal and any points that were secured are available for use. After being assured the track is clear by the PO, the signaller may remove the blocking facilities that were applied.
Although there is a requirement that a permanent record of the ASB details be made by the Signaller and the PO, no forms or checklists accompany the rule.
Network Procedure NPR 703 – Using Absolute Signal Blocking
Network Procedures describe how particular actions are to be done to apply the Network Rules. NPR 703 prescribes the requirements when using ASB in accordance with NWT 308.
As with NWT 308, NPR 703 requires the Signaller to ensure that all absolute signals allowing entry to the worksite are at stop with blocking facilities applied, there is no rail traffic approaching the worksite and all rail traffic that has passed complete beyond the proposed work location will not return.
Interim arrangements for Absolute Signal Blocking
In 2013, the ATSB investigated three incidents involving the use of ASB as part of Sydney Trains worksite protection arrangements in a combined report RO-2013-018.[7] Immediately following these incidents, Sydney Trains issued a memorandum, ‘Application of Absolute Signal Blocking’ on 22 July 2013 amending the procedures for the granting of ASB. The amended procedures required the Train Controller to compile a checklist when informed of the ASB request and the PO to deploy lookouts as an additional defence. They were still current at the time of this incident.
Although a Train Controller checklist was compiled at the ASB request, it was only a single checklist but intended for multiple worksites. Further, the PO did not deploy any lookouts. As such, both these situations contravened the memorandum requirements.
While not deployed, the effectiveness of any lookouts in this incident would have been diminished by the following:
the occurrence of the SPAD some 1,300 metres in advance of the worksite
the workgroup conducting its tasks outside the danger zone in a signalling hut
the available sighting distance at the worksite (See Figure 4)
the presence of active (automatic) type protection equipment at the level crossing.
Figure 4: Worksite at Warnervale
Source: OTSI
In a subsequent internal investigation, Sydney Trains found that not all staff had been aware of the memorandum requirements. Consequently, a safety alert (SD-2014-23) was issued on 28 November 2014 highlighting the requirements of the memorandum.
Taking into account the recommendations from the ATSB investigation and the findings from various internal investigations, Sydney Trains commenced a trial of a modified ASB process called ‘Trial of Coded Process for Absolute Signal Blocking’. The key elements of this trial, which override the requirements of the memorandum, include the following:
Introduction of job aids (forms) for both the PO and the NCO to ensure consistency when requesting and granting ASB.
Mandating the use of only five main reference points when identifying the proposed worksite location. All of the identifiers are those that will be present on the NCO’s track diagram.
A reinforcement and read back requirement to ensure that there are no trains between the protecting signals and the worksite while ASB is being established.
A requirement for the NCO to nominate the last train to enter the portion of line where the ASB is being established and its current location, i.e. that it is beyond the worksite.
The trial was introduced during 2014 in the signal boxes located between Blacktown and Springwood. It had not been introduced at Morisset at the time of the incident.
Concurrently, the ASB rule is also undergoing a complete re-write to improve its readability and application.
Train running time for section
The freight trains were travelling approximately eight minutes apart at the time of the incident. Evidence indicated that both freight trains had been operating at or near to scheduled speeds throughout the 22 kilometre section between Morisset and Wyong and not been delayed prior to the incident.
Workgroup and tasks
The workgroup, consisting of a PO and two electrical maintainers, signed on for duty at 0700 to conduct electrical maintenance tasks at various signal huts between Wyong and Wyee. The tasks involved the change-out of electronic modules within the signalling system that had been subject to a product recall by the manufacturer.
At 1000, the PO compiled a worksite protection plan for the worksite at Warnervale in accordance with Network Rule NWT 300 Planning Work in the Rail Corridor. He assessed that trains could be excluded and the proposed works could be conducted safely using Absolute Signal Blocking, in accordance with Network Rule NWT 308 Absolute Signal Blocking and Network Procedure NPR 703 Using Absolute Signal Blocking. [8] NWT 308 and NPR 703 principally require that the protecting absolute signal(s) at the beginning of the section to be placed back at stop with blocking facilities applied. Verbal assurances were given to the PO that there were no trains in the section approaching the proposed worksite. In his assessment, the PO nominated that signals V8 and V6 could be used as the protecting signals for the ASB as they provided two signal protection and did not require the use of a lookout.
Employee Information
The Station Manager was an employee of NSW Trains and a qualified Network Control Officer. He had 29 years rail experience.
The Duty Manager was an employee of NSW Trains and a qualified Network Control Officer. He had 13 years rail experience.
The Protection Officer was an employee of Sydney Trains and had been a qualified and authorised PO Level 2 for approximately six months.
Weather conditions
Bureau of Meteorology records indicated that the maximum temperature on 24 November 2014 was 26.9°C and no rain had fallen throughout the previous week. Weather conditions were reported as fine and dry at the time and did not contribute to the incident.
Fatigue
An examination of the rosters for the DM, SM and PO did not identify any evidence of the likelihood that fatigue was a contributing factor in the incident.
Train-in-section checks had not been performed properly when ASB was granted, resulting in trains going undetected while still in the section. This has been a common contributing factor in a number of recent investigations into worksite protection incidents where ASB has been employed.
In this particular incident, the main contributing factor was a breakdown in the handover process between the SM and the DM during the granting of ASB as two trains were approaching the worksite. There were no actions or omissions by the PO which contributed to the incident.
Breakdown in the NCO handover process
The breakdown in the handover between the SM and the DM was the result of an interruption mid process and a distraction caused by the presence of the NSW Police officers.
The interruption mid process occurred when the SM handed over to the DM. The change in NCOs, which was intended to occur at the commencement of the DM’s shift, was arranged by the SM to increase the DM’s experience with the ASB process. Instead, the DM became distracted by the presence of the two NSW Police officers who had entered the signal box. Instead of separating them from the ASB process and conducting the required induction, the DM catered to their information requests while the SM commenced actioning the ASB request.
The SM was still actioning the ASB request when the DM left the signal box. Coincidentally, at 1147, just before the DM returned to the signal box, freight service 4190 passed through Morisset under a full clear proceed signal.
At 1148, after conferring with the NCO at Wyong about the approach of trains 4122 and 4190, the SM handed the ASB request over to the DM. The handover took about a minute to complete and was given in verbal form only. No written details were given about the status of the signals being used for ASB, the application of blocking facilities or the location of trains in the section. The DM recalled the mention of only one freight train, 4190, during the handover.
At 1149, the DM, now in the role of NCO, called the PO to inform him ASB had been granted since 1143; a time shortly after the SM had informed the Sydney North Train Controller of the ASB request. In addition, he mentioned to the PO that a train, which he believed to be 4190, should have just passed his location. The PO challenged the passing of a train but, instead of verifying its exact location, the DM instructed him to call back once a train had passed. The PO called back at 1151, shortly after a train, later identified as earlier train 4122, had passed the worksite.
The call at 1149 highlighted the extent of the breakdown in the handover as follows:
The communications between the SM and the DM who did not come to clear and concise understanding about the stage of where the granting of ASB was at.
The lack of knowledge of where or how many trains were in the section. The PO’s challenge about a train not passing the worksite went unrecognised as to the probability of a train still within the section. On the basis of this obvious error, ASB should have been fulfilled or cancelled immediately until the location of all trains was properly established. Instead, the time ASB was granted was simply varied by the DM and accepted by the PO to coincide with the eventual passing of a train.
The ability of 4190 to continue through Morisset at 1147 under a full clear (green) proceed aspect. This indicated that the next two signals, V8 and V6, which were to be used as the protecting signals for ASB, had not been placed back to stop with blocking facilities applied when ASB was granted at 1143 or before the PO was advised at 1149. Signal 76.6, located at the Sydney end of No.1 platform at Morisset, is the preceding signal to V8 and was observed in CCTV footage to be displaying a full clear (green) proceed aspect at the passing of 4190. The full clear aspect indicated that the next signal, V8, was also displaying either a restricted or full clear proceed aspect and that V6, the following signal to V8, was displaying either a proceed or stop aspect as well. As no SPAD was recorded at either signal, it indicated that the signals had not been set back to stop for ASB, no blocking facilities had been applied and 4190 had continued under proceed indications. Signal logs indicated that blocking facilities were likely to have been applied after 4190 had passed V6, if at all. Critically, the ability of 4190 to continue towards Warnervale under proceed signal aspects and SPAD at Signal 66.8 during testing of the signal controls indicated that no required train in section checks were made before, during or after the handover.
The minimal length in time of the handover which was concluded within a minute after the SM had finished the call with the NCO at Wyong and less than two minutes after the DM had re-entered the signal box.
In summary, despite the requirements of Network Rule NWT 308, there was a breakdown in the NCO handover process used at Morisset which resulted in:
ASB being granted to the PO at Warnervale without the exact location of trains being properly established
Signals V8 and V6 not being set back to stop and blocking facilities not applied.
Other safety matters
Train Identification
Voice recording evidence indicated that there was confusion between the DM and the PO about the passing freight train when ASB had first been granted. Without details of train numbers from the DM, the PO instead described the passing train by the number of the leading locomotive. However, without having any train consist details or engine numbers, and in the absence of freight trains being numbered on the TVS, the DM assumed that the PO was referring to the second train, 4190, and continued with granting ASB. Once granted ASB, the workgroup then had unrestricted track access to the Up North Main line despite 4190 still approaching. Fortunately, the testing of the signalling system caused Signal 66.8 to return to stop in front of 4190 and prevented it from reaching the worksite.
Summary
The SM and the DM did not conduct the handover at an optimal time. It was undertaken while granting ASB was still in progress. As a result, the setting of signals V8 and V6 back at stop, the application of blocking facilities and the determination of precise locations for trains approaching the proposed worksite were overlooked.
A more considered option for the handover would have been at the time either when the PO first called requesting ASB or after ASB had been granted.
The presence of NSW Police officers in the signal box at the time and the activity to meet their needs served as a distraction during the process.
Findings
From the evidence available, the following findings are made with respect to the incident involving the granting of Absolute Signal Blocking culminating in the passing of Signal 66.8 by freight service 4190 at stop without authority. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
There was a breakdown in the NCO handover process used at Morisset which resulted in ASB being granted to the Protection Officer at Warnervale without the exact location of trains being properly established, signals V8 and V6 being set back to stop and blocking facilities applied in accordance with Network Rule NWT 308. [Safety issue]
Other findings that increased risk
Additional interim arrangements for Absolute Signal Blocking were not implemented at the time of the incident as the requirements listed in the memorandum of July 2013 had not been promulgated to all staff.
Other findings
The documented process, as recommended in RO-2013-018 and currently being trialled in the modified ASB process, was not implemented at Morisset at the time but could have assisted during the NCO handover in determining where the granting of ASB had progressed.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report. Where relevant, safety issues and actions will be updated on the ATSB website as information comes to hand. The initial public version of these safety issues and actions are in PDF on the ATSB website.
Deficient handover process
There was a breakdown in the NCO handover process used at Morisset which resulted in ASB being granted to the Protection Officer at Warnervale without the exact location of trains being properly established, signals V8 and V6 being set back to stop and blocking facilities applied in accordance with Network Rule NWT 308.
The sources of information during the investigation included:
NSW Trains
Sydney Rail Services Pty Ltd
Sydney Trains
The Bureau of Meteorology
The Duty Manager, Morisset
The Station Manager, Morisset
Transport for New South Wales
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to:
NSW Trains
Office of the National Rail Safety Regulator
Sydney Rail Services Pty Ltd
Sydney Trains
The Duty Manager, Morisset
The Station Manager, Morisset
The Sydney Trains Protection Officer
The train crew of 4190
Transport for New South Wales
Submissions were received from all parties with the exception of the train crew of 4190. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 November 2014, at about 0600 Eastern Standard Time, a Robinson R44 helicopter, registered VH-YYS, departed from Mareeba, Queensland on a private flight with a pilot and one passenger on board. The helicopter engine had recently been overhauled, and the pilot had expressed concern about the quantity of oil the engine was using following the overhaul. He had been advised to conduct a longer flight to ‘bed in’ the engine.
The helicopter tracked via the coast to Cooktown where the pilot landed and refuelled. The helicopter had used about 1 L of oil during the 1.5 hour flight. From there the helicopter continued to Coen with two intermediate landings. In Coen, the pilot refuelled the helicopter and added 1 L of oil to bring the total oil quantity back up to 8 L. The helicopter then tracked to Archer River and departed there at about 1400, tracking towards the coast.
When about 30 NM from Archer River and at about 1,300 ft, the pilot observed the engine revolutions per minute (rpm) decreasing rapidly. He immediately entered an autorotation and advised the passenger to brace for impact. The pilot sighted a clearing ahead landed.
The pilot and passenger quickly exited and observed smoke billowing from the rear of the helicopter, where heat from the helicopter’s exhaust ignited a grass fire. Within seconds the helicopter was engulfed by fire and destroyed. The pilot and passenger were uninjured.
A full strip down of the engine was not conducted following the accident. The magnetos were badly fire damaged and it was not possible to determine their serviceability at the time of the accident or the cause of the reduced engine rpm.
In this incident, the pilot was concerned about the serviceability of the helicopter. The cause of the power loss was unable to be determined. The incident highlights the importance of pilot decision making in determining whether to conduct or continue a flight when abnormal indications such as excessive oil consumption occur.
On 16 November 2014, a Robinson R44 helicopter, registered VH-YDK (YDK), was approaching Jandakot Airport on a charter flight from Rottnest Island, Western Australia, with a pilot and three passengers on board. At about 1348 Western Standard Time, the pilot of YDK reported downwind for runway 24 on the Jandakot Tower frequency.
At about the same time, the pilot of a Bell 412 helicopter, registered VH-EWA (EWA), prepared to conduct a rescue flight to Bunbury, Western Australia, with a crewman and paramedic on board. As YDK turned onto final, at about 400 ft above ground level (AGL), the pilot of YDK sighted EWA outside its hangar and elected to continue the approach.
At about 1350, the pilot of EWA requested to taxi to the compass swing bay on the Ground frequency. As the pilot commenced taxiing, the crewman sighted YDK at about 150 ft AGL and on an approach towards EWA. He directed the pilot of EWA to go forward.
At about 1350, the pilot of YDK broadcast on the Tower frequency: ‘YDK just out your left hand window’. The pilot of EWA was monitoring the Ground frequency and did not hear that call. YDK then descended and passed behind EWA towards a landing on the middle of the grassed area.
The pilot of EWA continued to taxi towards the compass swing bay, and when approaching the bay, first sighted YDK which was then passing behind EWA and about 30 m away.
The environment and procedures in the helicopter precinct at Jandakot require that pilots make the mandatory radio calls, maintain a good lookout and taxi, depart and approach the area by the most predictable routes to assist others in sighting them.
A limited-scope, fact-gathering investigation into this occurrence was conducted in order to produce this short summary report and allow for greater industry awareness of potential safety issues and possible safety actions.
What happened
On 6 November 2014, the liquefied natural gas (LNG) tanker Northwest Stormpetrel completed loading cargo and left its berth in Dampier, Western Australia. The ship was then anchored in the harbour to allow the use of excess time in the schedule for its voyage to Japan for in-water lifeboat drills and other maintenance tasks.
The lifeboat drills and some maintenance tasks were carried out on 7 November. One of the tasks planned for the following day (before the ship sailed from Dampier) was to check the LNG forcing vaporiser’s1 steam trap to resolve recurrent drainage issues with the system (Figures 1 and 2).
Figure 1: LNG forcing vaporiser
Source: Shell (photograph annotated by ATSB)
Figure 2: Steam trap and associated valves
Source: Australian Maritime Safety Authority (annotated by ATSB)
At 07452 on 8 November, Northwest Stormpetrel’s engineers discussed the planned task. The cryogenic engineer (cargo engineer) routinely carried out vaporiser-related maintenance and was familiar with its systems and the task.
At 0800, the cargo engineer and the integrated rating (IR) assigned to assist him met on the ship’s main deck. They discussed the task, reviewed its risk assessment and completed a toolbox talk.3 The cargo engineer then went to the cargo machinery room (CMR) on the starboard side of the main deck (where the vaporiser was located) to isolate the system before work on it could start. Meanwhile, the IR went to the engine room to fabricate a new gasket for the steam trap.
In the CMR, the cargo engineer isolated and locked out the forcing vaporiser’s steam supply, outlet, drain and bypass valves. After checking that the system was depressurised, he went to get a permit to work for the task.
The cargo engineer completed the permit to work with the chief engineer, who signed the permit to authorise the work. The cargo engineer then returned to the CMR and started dismantling the steam trap located below the vaporiser (Figure 2).
At about 0900, the IR came to the CMR with the new gasket for the dismantled and cleaned steam trap. The cargo engineer discussed the remaining work with him before re-assembling the trap. The system then needed to be de-isolated and returned to its normal operational condition.
Shortly before 1000, the cargo engineer walked around the vaporiser to check if everything was in order for de-isolating the system. Satisfied with the checks, he removed all the valve lock outs.
The cargo engineer then began carefully opening and closing steam valves, regularly checking if everything was normal. The IR stood by and kept watch for abnormal signs. After the vaporiser’s steam supply valve had been fully opened, the regulator was set to its normal working pressure.4
At about 1000, the cargo engineer decided to fully open the steam trap’s inlet valve that he had earlier cracked open. He had turned the hand wheel of the valve5 about one turn when the valve’s bonnet came away from the valve body. A jet of steam (about 50 mm wide) erupted from the top of the valve’s open body, scalding the cargo engineer’s hands, forehead and neck before he could move clear. After getting clear of the steam, he took off his gloves, safety glasses and hardhat. The IR helped him out of the CMR and, once outside, his boots and overalls were removed. They then hurried to the nearest safety shower and began cooling the cargo engineer’s burns.
At about 1002, the IR called Northwest Stormpetrel’s navigation bridge and reported the incident. The ship’s master initiated an emergency response and a shipboard medical team was tasked to attend the injured cargo engineer. The master then notified authorities ashore of the incident. At 1005, he asked for a medical evacuation to be arranged and then requested medical advice.
At about 1010, the cargo engineer was moved to the ship’s hospital where first aid continued. Over the next hour, he was treated as per medical advice obtained while awaiting evacuation.
At 1122, a helicopter with a paramedic on board landed on the ship. At 1142, the helicopter left with the cargo engineer on board. He was taken to the local hospital, where a doctor assessed his injuries as superficial and admitted him to a treatment ward.
Later that afternoon, representatives from the Australian Maritime Safety Authority (AMSA) and Northwest Stormpetrel’s managers, Shell International Shipping and Trading Company (Shell), boarded the ship to conduct their respective investigations.
The investigations found that the bonnet locking clip on the steam valve was missing (Figures 3 and 4) and this had allowed the bonnet to unscrew and come away from the valve body. The missing clip was not found, nor could it be established when or how it had been lost.
On 9 November, after a replacement cargo engineer had joined Northwest Stormpetrel and Shell’s safety investigation was completed, the ship sailed from Dampier.
Figure 3: Valve with locking clip missing
Source: AMSA (annotated by ATSB)
Figure 4: Similar valve with locking clip
Source: AMSA (annotated by ATSB)
ATSB comment
The steam valve’s bonnet had several threads and unscrewing it to the point of release would have required turning it several times. However, it was reported that the bonnet came away after the valve’s hand wheel was turned only one turn (to open). Therefore, it is likely that when the cargo engineer began to fully open the valve, the bonnet was already partially unscrewed and being held by very little thread. The nearly unscrewed bonnet and its missing locking clip may have been more readily apparent visually and by touch/feel, had the valve’s location been less confined, the lighting been better and greater vigilance been exercised.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Australian Maritime Safety Authority (AMSA)
As the ship’s flag State Administration, AMSA conducted a regulatory investigation and issued Northwest Stormpetrel’s master with an Improvement Notice that required the following action:
Improvement Notice
Conduct a detailed analysis and review of procedures and precautions whilst working with pressurised systems.
Specifically address isolation and de-isolation procedures to ensure adequate protection from injury.
Shell International Shipping and Trading Company (Shell)
Shell’s safety investigation identified a number of safety actions to avoid this type of incident.
Procedures and work practices
The safety actions covered shipboard procedures and practices dealing with risk awareness, risk assessment and work planning, permits to work, defective equipment and safety reporting.
Focus areas identified for better risk awareness included joining ship briefings, familiarisation, work site assessments, personal protective equipment and audits. The development of effective risk assessments, their review and using them for work planning and toolbox talks were also identified. An increased focus on permits to work, particularly for invasive and pressurised systems, and the completion and verification of permits were other identified focus areas. Checking for defective equipment and better reporting through training were also noted.
Safety message
Work on pressurised shipboard systems can potentially have a high risk of serious injury. Familiarity with repetitive tasks on these systems can sometimes reduce the perception of that risk. Therefore, it is important that the associated risk controls, such as risk assessments and permits to work, are periodically reviewed and carefully completed to effectively identify and mitigate all risks – including the presence of defective system components .
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported by industry. Marine work practices is one of those safety concerns.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
[1] When there is insufficient natural boil-off from LNG in the cargo tanks, the forcing vaporiser utilises steam to generate LNG vapour for consumption in the ship’s boilers.
[2] All times referred to in this report are local time, Coordinated Universal Time (UTC) + 8 hours.
[3] A toolbox talk is a safety focussed discussion undertaken by a work team before starting work to cover key elements of the task and the risks involved.
[4] A steam pressure setting of 0.2 MPa that equates to a steam temperature of approximately 120°C.
[5] A screw lift globe valve with a threaded bonnet that is secured with a locking clip.
Occurrence summary
Investigation number
316-MO-2014-013
Occurrence date
08/11/2014
Location
Dampier anchorage
State
Western Australia
Report release date
30/03/2015
Report status
Final
Investigation level
Short
Investigation type
Occurrence Investigation
Investigation status
Completed
Mode of transport
Marine
Marine occurrence category
Injury
Occurrence class
Serious Incident
Highest injury level
Serious
Ship details
Name
Northwest Stormpetrel
IMO number
9045132
Ship type
Anchored
Flag
Australian
Manager
(Manager) Shell International Shipping and Trading Company, UK
