Safety summary

What happened

On Tuesday 9 December 2014, at about 0003 (EDT), the load on train 2MP9 struck a timber pylon of an over-rail bridge near Great Western, Victoria. The train was transporting a number of Maxitrans skeletal road trailers (in piggyback configuration). During the journey, one of the upper road trailers had shifted laterally by almost 2 m, striking the Paxton Street bridge as the train passed beneath. Authorities closed the bridge, assessed it for safety and cleared it for normal traffic some time later. After being alerted to the load shift and collision while stopped and waiting for a passing train, the rail operator made arrangements to remove the road trailer load. Train 2MP9 subsequently departed Great Western at 1205 and continued its journey to Perth.

What the ATSB found

The ATSB found that, based on recorded data from wayside monitoring systems and the condition of the wagon’s side bearers, it is likely that the wagon carrying the shifted load (PQMY4346V) was hunting. The hunting motion would be expected to increase the lateral forces on the load restraints. Compounding this, SCT’s freight loading procedures did not specifically provide for the effective restraint and securement of commercial road transport vehicles for transportation on rail vehicles. Terminal staff responsible for securing and checking the load were not fully aware of the load securement requirements documented in the Rail Industry Safety and Standards Board (RISSB) Code of Practice for the Loading of Rail Freight.

What's been done as a result

SCT Logistics have issued a safety alert to all SCT managers and supervisors, reminding them of the freight loading Code of Practice requirements and instructing that only qualified and/or experienced staff are to perform the loading task.

SCT also addressed the mandatory replacement of wagon side bearers in accordance with the manufacturer’s service bulletin.

Safety message

A shifted load during rail vehicle transit represents a significant risk to infrastructure, railway employees, passengers, and the general public. In light of this occurrence, all rail freight operators should consider the safety implications of inadequate load restraint within their own operations - taking action where opportunities exist for improvement and compliance with requirements.

Safety actions

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action taken by SCT Logistics

On 15 December 2014, SCT Logistics issued a safety alert to State Managers, Operations Managers, and Rail Manager/Supervisors, instructing that:

• Road vehicles are (to be) secured as described in the Australian Code of Practice – Loading of Rail Freight (Appendix F – Road Vehicles).
• A copy of the Code of Practice MUST be available to all staff who are required to secure loading.
• Loading should only be undertaken by trained and / or experienced staff.

On 2 November 2015, SCT also reviewed their procedures to ensure the mandatory replacement of Stucki side bearers after one million kilometres or six years of service.

Context

The location

The out-of-gauge load was detected while train 2MP9 was at Great Western, about 288 track kilometres from Melbourne on the interstate main line between Melbourne and Adelaide. It was evident that the load on train 2MP9 had shifted sideways at some stage prior to striking the Paxton Road Bridge; about 6.7 km before entering the loop.

A lateral force is usually required to initiate a sideways load shift. This could result from in-train forces while travelling, or from passage across a track geometry defect. Information provided by the drivers indicated that track leading up to the Paxton Road Bridge was fine, with no notable instances of rough-ride that could be associated with geometry defects. A section of track between Maroona and Ararat (about 30 km before Great Western) was noted as having track geometry issues, but a temporary speed restriction had been applied in this area, which would have served to reduce undesirable lateral forces.

There was no evidence available to determine at what point the load had shifted during the journey from Melbourne. Similarly, there was no evidence to suggest that a specific track geometry feature or defect may have initiated the load shift.

Trackside condition monitoring equipment

The ARTC have wayside hunting^[1] detection equipment installed at Port Germein, South Australia. Motion measurements from passing trains are stored so that the operator can interrogate the data for developing trends. The data can only be accessed by the relevant rolling stock owner/operator and is used to predict maintenance issues with rolling stock.

The ATSB examined the recorded condition monitoring data relevant to wagon PQMY4346V. The data logged 166 journeys between 22 December 2012 and 24 November 2014. In that time, the wagon had registered five medium, three high, and two extreme indications. This would suggest a developing trend that may have required maintenance intervention.

Train information

Train 2MP9 was owned and operated by SCT Logistics, and crewed by Genesee and Wyoming Australia (GWA) under contract to SCT Logistics. The train consisted of three locomotives hauling 51 wagons, totalling a combined length of 1,378 m and a gross mass of 4,181 t.

There was no evidence to suggest the train had been operated inappropriately, and as such, train handling was not considered to have been a factor contributing to the load shift.

Wagon PQMY4346V condition and monitoring

Following the incident, wagon PQMY4346V was sent to the maintainer’s facility in Perth for an inspection, where it was identified as having a number of faults that could have contributed to hunting, including failed side bearers^[2]. Should hunting have developed while in transit, the hunting motion could very likely have increased the lateral forces on the load restraints.

Loading of freight on rail vehicles

The Australian Rail Industry Safety and Standards Board (RISSB) Code of Practice for the Loading of Rail Freight (CoP) specifies the requirements for loading, restraint, and securement of freight on rail vehicles, and is the standard adopted by SCT Logistics. Appendix F.1 of the CoP provides specific guidance for the lashing and securing of commercial road transport vehicles, and states:

F.1.4 Lashing & Securement

(a) Trailers should be secured using transport chain fitted with load-binders or turnbuckles—

(i) Trailers should be chained diagonally at the front and rear to provide lateral and longitudinal restraint, using two chains at each end. Each chain is fixed to the trailer and to the flat car at the opposite side.

(ii) Additional chains should be used along the sides of the trailer for further longitudinal restraint. These chains should be fixed to the trailer and the flat car in opposing directions so that they provide restraint in both directions.

(b) For trailers up to 24 tonnes gross mass—

(i) The lashings should be 10mm chain with a minimum tensile strength of 10 tonnes.

(ii) They should be attached as follows—

a. Two (2) each end in diagonal configuration to provide lateral and longitudinal restraint.

b. Two (2) chains each side sloping away from each other to provide longitudinal restraint in both directions.

Figure 3: Lashing and securing typical arrangement

Source: RISSB Code of Practice Loading of Rail Freight, Appendix F

The RISSB CoP did not specifically provide for the double stacking of road vehicles. While SCT Logistics did not have any additional documented procedures addressing the securing and restraining of double stacking of road vehicles, it would be expected that the general principles of the CoP should still be applied.

Loading on Wagon PQMY4346V

The wagon upon which the load had shifted was located at the 33rd position in the train consist. Two other similar loads were located to either side of this wagon (Figure 4).

Figure 4: Trailer loading on train 2MP9

The shifted trailer (indicated) compared with similar loads on adjacent wagons. Source: SCT Logistics

The Maxitrans skeletal trailers arrived at the train loading depot already unitised in the piggyback configuration. These units were lifted and placed on top of the flat rail wagons. Wooden pallets were stacked under the fifth wheel position to support the lower trailer. The lower trailer was secured to the rail wagon (Figure 5 and Figure 6)

Figure 5: Securing of trailers on wagon PQMY4346V

Figure 5 illustrates the load and securing configuration for the double stacked road vehicles on the rail wagon. The red lines represent securing of the trailers to the wagon at the time of the incident. Source: ATSB

Figure 6: Securing of trailers

Figure 6 shows the securing chain unitising the two trailers together. Note the steel beam on which the trailer support stands sit. A similar beam was used as a wheel guide for the rear wheels. Source: SCT Logistics

The trailers were secured at the road wheels via their axles. Since the securing chains did not bridge the suspension elements, the vehicle suspension was unlikely to compromise the integrity of the securement system.

__________

1. Uncontrolled and undesirable cyclic lateral and yaw displacements of the wheelsets of a vehicle, generally worsening with increased speed.
2. Brackets or assemblies on both sides of the longitudinal centre of a bogie that limit roll of the underframe on the bogie bolster.

Safety analysis

Wagon maintenance and monitoring

Wagon PQMY4346V was fitted with constant contact side bearers^[3] manufactured by the A. Stucki Company. SCT maintenance procedures do not require replacement during inspections, unless worn. However, a Stucki service bulletin, circa 2011, states research showing the Stucki side bearer blocks have a useful life of 600,000 miles (about 1 million kilometres) or six years of service. Each Stucki side bearer is stamped with a date of manufacture, although the date of manufacture could not be identified on the failed side bearer from PQMY4346V. Based on maintenance records, it was likely that the side bearers from this wagon had not been replaced in at least seven years.

Wayside monitoring equipment at Port Germein, South Australia, identified a series of motion indications from wagon PQMY4346V. In particular, during the period from 5 November 2014 until the incident, there were five indications recorded – two medium, one high, and two extreme. Of note however, the ownership of wagon PQMY4346V had been recorded against another transport operator on the ARTC system. While this may have contributed to SCT not identifying the motion indications from the wagon, it was noted that SCT, as the operator of the wagon, could still have accessed this data against the wagon identification.

Based on the condition of the side bearers (post-incident examination) and the recorded trackside condition data, it is likely that wagon PQMY4346V was hunting during the journey from Melbourne on 8 December 2014. A hunting wagon would almost certainly have increased the lateral forces on the load restraints.

Loading of rail freight

The RISSB Code of Practice for the Loading of Rail Freight requires items transported via rail to be appropriately secured. The securement system’s function is to restrain the load (prevent relative movement between the load and the vehicle), retain the load on the vehicle during normal transit, and minimise the risk of separation from the vehicle in adverse conditions such as collisions or derailments.

Restraint systems should be selected and applied to prevent the load from moving relative to the vehicle, in the longitudinal (length-wise), lateral (sideways) and vertical planes. Surface grip (friction), the vehicle structure, specific attachments, or combinations of these can be employed as forms of restraint. While frictional forces between the load and the vehicle deck or floor can provide some resistance to horizontal movement, friction alone is generally insufficient to restrain a load under dynamic forces and needs to be supplemented by other means.

Retention devices generally retain the loading on the vehicle by preventing vertical movement and providing longitudinal and lateral restraint. The retention function may be incorporated into the restraint system.

Freight movement on 2MP9

In this occurrence, the methods used to secure the lower trailer to the wagon (Figure 5) had provided limited restraint against longitudinal, lateral, and vertical forces. Most significantly, the upper trailer had only been restrained on the vertical axis, relying on the downward clamping (frictional) forces provided by the two forward hold-down chains to restrain the load against lateral or longitudinal movement.

Neither trailer had been secured sufficiently to prevent movement relative to the rail vehicle, as required by the RISSB CoP. This allowed the upper trailer stands and/or support beams to move laterally and subsequently collapse downward (Figure 7). When the upper trailer collapsed, the restraint chains became ineffective at restraining lateral movement, allowing the trailer to move further out-of-gauge.

Figure 7: Collapsed trailer

Shows the collapsed upper trailer and support beam. Note the securing point of the two forward hold-down chains on a lateral beam of the lower trailer. In this configuration, the potential existed for the chains to move laterally along the beam, contributing further to the lack of lateral restraint. Source: SCT Logistics

Freight acceptance

There was no documented guidance specific to securing and restraining double stacked road vehicles for transportation on rail wagons. Given the stacked trailer securing arrangements evident on train 2MP9, it was likely that the loading handlers accepted the load of road trailers without adequate inspection of the securement system that had been employed. It was also evident from the inadequate load restraint configuration that the loading handlers were not aware of the general principles contained in the RISSB CoP regarding securing road vehicles onto rail wagons.

__________

3. A constant contact type side bearing that utilises some form of a resilient element to maintain a compression force and proportional shear restraint between the bogie and wagon body, the purpose is to control bogie hunting.

The occurrence

On Monday 8 December 2014, a load of Maxitrans skeletal road trailers arrived at the Laverton freight terminal, Melbourne. The trailers arrived via road in a piggyback (stacked) configuration. During the day the trailers were loaded onto a flat container wagon to form part of train 2MP9 travelling to Perth, WA. Train 2MP9 departed Melbourne at about 2050 (EDT).

At some point in the journey, one of the skeletal road trailers moved, leading to the load protruding almost 2 m beyond the edges of the rail wagon (out-of-gauge) (Figure 1). An out-of-gauge load is a load that does not conform to a predefined loading outline.

At about 0003 on 9 December 2014, the out-of-gauge road trailer on the 33rd wagon struck the Paxton Street over-rail bridge. The 33rd wagon was about 956 m behind the lead locomotive and the train crew were unaware of the collision. The train continued about 6.7 km further into Great Western, Victoria where it waited on the main line to cross train 6PM6 travelling from Perth. Great Western is about 288 km North West from Melbourne.

As train 6PM6 travelled through Great Western on the loop line, the driver noticed that ‘something was hanging off’ the train on the main line. The driver stopped the train and reported the condition to train 2MP9’s crew.

Shortly thereafter, train 7768, following 2MP9, discovered the damage to the Paxton Street over-rail bridge. The crew reported the damage to the Australian Rail Track Corporation (ARTC) network control centre. The ARTC control centre subsequently coordinated a response to the incident. The response involved repositioning train 2MP9 on the main line and closing the over-rail bridge to both rail and road traffic. A crane removed the shifted trailer, after which the train continued its journey.

Figure 1: The shifted load

The top road trailer had shifted to the left-hand-side in direction of travel. The movement was enough to strike the bridge infrastructure. Source: SCT Logistics

An examination of the over-rail bridge established that a timber pylon had been struck and destroyed (Figure 2). Accordingly, the bridge was cleared for rail traffic but remained closed to road traffic pending a subsequent structural engineering examination.

There were no injuries resulting from the collision and the road trailers sustained only minor damage.

Figure 2: Paxton Street bridge damage

The shifted road trailer struck and destroyed the wooden pylon as indicated. Note however, the pylon was redundant due to an additional steel support structure installed at an earlier time.  Source: SCT Logistics

 

Findings

From the evidence available, the following findings are made with respect to the collision between loading on train 2MP9 and an over-rail road bridge near Great Western, Victoria, on 9 December 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Based on the condition of the side bearers and recorded data, it is likely that wagon PQMY4346V was hunting. The hunting motion increased the lateral forces on the load restraints.
• SCT Logistics’ maintenance processes and systems did not detect the wagon’s side bearer faults or ensure that life-limited components were replaced in a timely manner.
• SCT’s freight loading procedures did not specifically provide for the restraint and securement of double-stacked commercial road transport vehicles for transportation on rail vehicles.
• The loading handlers did not apply the general principles of the RISSB Code of Practice for the Loading of Rail Freight when lashing and securing commercial road transport vehicles to rail vehicles.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Australian Rail Track Corporation information
• Rail Industry Safety and Standards Board Australia (RISSB) Code of Practice Loading of Rail Freight
• Recorded data such as locomotive data logs
• SCT Logistics information
• Staff statements.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to SCT Logistics (SCT), Genesee & Wyoming Australia Pty Ltd (GWA), the Office of the National Rail Safety Regulator (ONRSR) and the Australian Rail Track Corporation (ARTC).

Submissions were received from SCT, GWA, ONRSR and ARTC. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 28 November 2014, a Cessna 210 aircraft, registered VHTWD (TWD), was being operated on a charter flight from Broome, Western Australia. On board were the pilot and four passengers.

At about 1135 Western Standard Time, the aircraft landed at Fitzroy Crossing to refuel before continuing to Balgo Hill Western Australia, where three of the passengers disembarked (Figure 1).

At 1202, the aircraft departed Balgo Hill for the Ringer Soak aeroplane landing area (ALA) Western Australia, where the remaining passenger was due to disembark. About 25 NM from Ringer Soak, while cruising at 5,500 ft, the pilot noticed a low oil pressure indication. He reported that all other engine instruments were within normal parameters. As Ringer Soak was only a few minutes away, he elected to continue and assess the situation after landing.

Figure 1: TWD flight route

Source: Google earth

Shortly after, the pilot detected a burning smell in the cockpit, followed by a loud bang from the engine. The engine started to vibrate and make an abnormal sound, and a small amount of white smoke emanated from the front section. The pilot immediately commenced the memory items from the emergency checklist, but there was no response from the engine. After shutting down the engine, he pitched the aircraft up slightly to both gain some altitude and to allow the speed to decrease. After configuring the aircraft for the best glide speed of about 80 kt, and with one stage of flap selected, he searched for a suitable landing area amongst the predominantly thick scrub and trees in the surrounding area. He eventually located an area that was more open, and during this time he also completed the emergency checklist to cover any items he may have missed during his initial actions.

Due to the intermittent communication at low altitudes in remote locations, the pilot then broadcast MAYDAY^[1] on the Brisbane Centre frequency, and then switched on the emergency locator transmitter. Brisbane Centre gave assistance to the pilot and initiated a search and rescue phase. The pilot then briefed his passenger on the emergency procedures, and prepared for a forced-landing. Due to the rough terrain, he elected to keep the landing gear retracted and unlatched both doors and briefly turned on the master switch to fully extend the flaps.

He prepared the aircraft for touchdown with the tail in a lower than normal position. The aircraft impacted the ground firmly and slid forward at least 20 m before it came to rest. The passenger immediately exited using the right door, and after checking all switches were off, the pilot exited the left door.

The passenger reported he had a minor head injury while the pilot was uninjured. The aircraft was substantially damaged (Figure 2).

Post-accident activities

After retrieving the first aid kit, emergency rations and the Global Positioning System from the aircraft, the pilot set up a temporary shelter under the aircraft wing, while they awaited rescue. He communicated via very high frequency (VHF) radio with three separate aircraft deployed at different times by Air Traffic Control to overhead the accident. This enabled messages to be relayed to and from Brisbane Centre and the pilot. He conserved the aircraft battery by only turning on the power to communicate briefly which each aircraft and at one hourly intervals. At about 1500, a helicopter arrived to retrieve the pilot and passenger and ferry them to Halls Creek.

Figure 2: VH-TWD after emergency equipment had been retrieved

Source: Pilot

Weather

The weather enroute was fine with scattered cloud at about 7,000 ft. It was the wet season in northern Australia, and was typically hot and humid, with a temperature in excess of 38°C.

The aircraft

In July 2013, TWD was fitted with a factory rebuilt Continental IO-550 engine. Since installation of the engine, the aircraft had completed 1,059.5 hours. During this time, the operator had observed an unusually high oil consumption.

On 19 November 2014, the aircraft used 7 quarts^[2] of oil during a 4.7 hour flight. This resulted in the aircraft being taken out of service for maintenance. Engineers found that cylinders number 3, 4 and 5 had glazed walls; these were honed and replaced. The piston rings were also removed and replaced. After a test flight, the aircraft was returned to service. The accident flight was the aircraft’s first commercial flight since being returned to service.

The operator conducted a further trend analysis of the aircraft’s oil consumption. They found that TWD had flown 168.3 hours, and used 152 quarts of oil which was about twice the typical consumption rate of about 0.43 quarts per hour.

Pilot experience and comments

The pilot had accrued about 3,270 hours total flight time with about 967 hours on Cessna 210 aircraft.

On the day of the flight, he had conducted the aircraft pre-flight inspection and submitted a flight plan as normal. The pilot checked the oil quantity as part of the pre-flight inspection at Broome and noted it was 8.6 quarts. The normal oil quantity range for this aircraft was 8-10 quarts. Due to the high weight of the payload, and as per normal procedure, the aircraft had to depart with less than full fuel and refuel at planned stops throughout the flight.

Due to the late arrival of one of the passengers, the flight was delayed for about one and a half hours. The pilot felt some concern about trying to regain some of this lost time in order to provide a timely service. He also reported that the passenger for Ringer Soak was quite anxious to get to his destination.

Engine examination

The insurance assessor advised the ATSB that the engine has been relocated to Perth for further examination. At the time of publication of this report, the reason for the engine failure had not been determined.

Operator comments

The operator conducted an internal investigation into the accident, and provided their report to the ATSB, where they raised concerns about the reliability of the factory overhauled IO-550 engines that had been installed in two of their C210 aircraft.

Major points from the company report are listed below.

• Although the pilot checked the fuel at every stop on the flight, he did not manually check the oil quantity. Due the late arrival of a passenger at Broome, the pilot had departed 1.5 hours behind schedule. It is likely this influenced the pilot’s decision not to spend time manually checking the oil quantity at each stop.
• In hindsight, TWD may have been unsuitable for the long flights to/from the more remote ports. Even though the aircraft was considered serviceable it may have been more appropriate for TWD to remain on short flights to further analyse the oil usage rates.

CASA Comment

The ATSB raised the issue of IO-550 engine failures with the Civil Aviation Safety Authority (CASA).

CASA completed a review of their database, and although there had been several failures of this engine type, there have been a number of different causal factors. After examining the information, they determined that there was no increasing trend of failures in this engine type.

Engine manufacturer

The ATSB contacted the engine manufacturer and will continue to liaise with them in regard the IO-550 engine.

ATSB comment

In the past 12 months, the ATSB has investigated three accidents involving engine failures of factory re-built IO-550 engine. At this stage, it has not been possible to determine any links between the accidents.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking several safety actions, some of which are listed below:

Flight restriction for other aircraft installed with a IO-550 engine

The company have placed a flight restriction on their other Cessna 210 aircraft fitted with an IO-550 engine. Until more trend data is available, they have restricted this aircraft to shorter, close to base flights.

Assistance from operations section

To promote better support from different sections of the company, the operations section will now assist flight crew when dealing with issues such as late passengers, loading and cargo problems and also to help determine a go-no-go time for delayed flights.

Maintenance controller

The maintenance controller is to more closely consider aircraft that have unusual, but acceptable usage of oil or other similar types of issues. These aircraft are to be flagged to the operations and safety section for closer trend monitoring, and also only utilised on shorter flights.

Chief pilot

The chief pilot will conduct flight crew refresher training on issues such as flight log and maintenance release entries, SARTIME and procedural requirements.

Chief engineer

The chief engineer will arrange for additional instruction to be available for engineers working on the IO-550 engine, and provide a go-to expert to contact for further information.

Company Procedures

The company noted that their operations manual detailing the correct operating procedures for the IO-550 engine contained some ambiguous instructions. The manual will be amended to better clarify the intent of its content.

Safety message

As was displayed in this instance, it is a timely reminder for pilots to be well rehearsed in both emergency procedures and to be pro-active in the post-accident survival phase, especially when operating in a remote area.

Section 5 – Emergency Procedures of the Visual Flight Rules (VFRG) guide gives an overview of planning for and dealing with emergency situations in aviation.

While no one ever plans to get into trouble, the possibility of an emergency situation should always be considered by all pilots before take-off. When faced with an engine failure in a remote area, there are extra survival considerations both prior to and immediately the aircraft has ‘landed’, as usually there will be an inevitable wait for assistance to arrive.

The Rescue Coordination Centre of the Australian Maritime Safety Authority (AMSA) produced a short booklet which highlights some of the considerations for preparedness for operations in remote areas.

Aviation Short Investigations Bulletin - Issue 41

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Mayday is an internationally recognised radio call for urgent assistance
2. 10 quarts is equivalent to 9.46 L

What happened

At about 1717 on 26 November 2014, the crew of a Virgin Australia Airlines Pty Ltd Airbus A330 aircraft, registered VH-XFJ, taxied to gate 20A at Perth Airport, Western Australia after holding short for about an hour due to severe thunderstorm activity in the area. When the aircraft stopped, the Ramp Supervisor connected the headset to communicate with the flight crew. At about the same time, other ground crew reported observing lightning strike the aircraft’s tail. As a result, an electrical discharge passed through the headset rendering the ramp supervisor unconscious. Another ground crew member who was assisting the arrival of VH-XFJ was also affected by electrical discharge from the lightning strike. That person remained conscious. Both ground crew were hospitalised for observation. There was no apparent damage to the aircraft.

What the ATSB found

The ATSB found that, while the airport’s lightning detection system was working within its rated specifications, it did not show ground strikes leading up to, or at the time of the injuries sustained by the ground crew. This highlights the importance of local observations when making risk assessments about resuming ramp duties. The ATSB also found that on the day of the incident, perceived operational pressure, weather advice, and a decrease in local storm activity influenced the Ramp Supervisor’s decision to resume ramp activities.

What's been done as a result

Subsequent to this occurrence, Perth Airport Pty Ltd has installed a thunderstorm warning system that provides audible and visual alerts to airport staff when it is unsafe to be on the ramp.

In addition, the ground-handling organisation made changes to its severe weather procedures, which include ceasing using aircraft-connected headsets when lightning activity is within 10 NM (19 km) of an airport.

Finally, Virgin Australia Airlines Pty Ltd advised that they provided all Airport Movement Coordinators with additional training in weather and flight planning. This included automated thunderstorm alerting system-specific training. In addition, the airline has aligned their manuals with other stakeholders’ extreme weather policy and procedures and commenced using wireless headsets at some airports.

Safety message

This occurrence reaffirms that perceived or actual operational requirements should not be allowed to compromise safety. When assessing if work can resume on the airfield in the face of potentially‑hazardous weather conditions, local observations of those conditions should be an integral part of the decision-making process. The final decision to resume duties should remain with the responsible person at that location.

Lightning at Perth Airport (not the day of the incident)

Source: Will Mallinson

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• ramp supervisor
• ground crew
• ground-handling organisation
• Bureau of Meteorology
• Virgin Australia Airlines Pty Ltd
• Airbus
• Perth Airport Pty Ltd.

References

Suzuki T, Von Thaden TL, Geibel WD. 2008, Influence of time pressure on aircraft maintenance errors. Champaign Illinois.

Kerstholt J H. 1991, Time pressure effects on decision making in a dynamic task environment, TNO, Soesterberg.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Virgin Australia Airlines Pty Ltd, Airbus, Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile, the Bureau of Meteorology, Perth Airport Pty Ltd, the ground-handling organisation, the Ramp Supervisor and the second ground crew member working on VH-XFJ and the Civil Aviation Safety Authority.

Submissions were received from Bureau of Meteorology, the Civil Aviation Safety Authority and Virgin Australia Airlines Pty Ltd. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Safety analysis

Introduction

After VH-XFJ (XFJ) arrived at gate 20A at Perth Airport, lightning was observed striking the tail region and rear-left of the tail of the aircraft. The two ground crew who were receiving the aircraft sustained injuries consistent with electrical discharge from the lightning strike.

The aircraft was manufactured to the required lightning protection design standards. Inspection of the aircraft by Virgin Australia Airlines Pty Ltd (Virgin) maintenance staff did not identify the lightning strike point of entry, nor was evidence of an electrical bonding deficiency found. Further, the aircraft did not contain any defects that could account for the injuries sustained. As a result, the aircraft design or its systems were not considered contributory to the occurrence. Therefore, this analysis will focus on factors relating to the:

• lightning strike
• effectiveness of the monitoring of the lightning activity
• effectiveness of the adverse weather procedures employed by the parties involved
• effect of perceived or actual operational pressure on decision making.

Lightning strike

Location of the strike

The lack of an identifiable lightning strike entry or exit point on XFJ could be attributed to the integrity of the aircraft’s electrical bonding and that ground discharge occurred through the headset and ramp supervisor (RS). However, a lightning strike to the ground adjacent to the aircraft, rather than to the aircraft itself, would also account for the absence of lightning damage to the aircraft.

The ground staff on bay 915 reported seeing lightning strike the tail of XFJ. The presence of lightning was further supported by the flash at the rear-left of the tail of the aircraft as reported by the engineers on bay 20A.

The ATSB considered which of a lightning strike to the tail or to the nearby ground was more likely. In this regard, a lightning ground strike would result in radial discharge from the point of strike as shown in Figure 7.

Figure 7: Ground lightning strike showing radial discharge from a central strike point (indicated by a white arrow)

Source: Mr Al Gamaty, courtesy of Reddit

Had a ground strike occurred at the near-rear of the aircraft, and discharged outward toward the location of the RS and second ground crew member at the nose wheel, it would have also radiated approximately the same distance behind and to the sides of the aircraft. Given the lack of reported lightning injuries/effects to other ground crew working in those areas, a ground strike is considered less likely than a tail strike.

Ground crew injuries

The injuries sustained by the two ground crew were consistent with high voltage electrical discharge. A lightning strike to the ground close to the aircraft could have resulted in a ground current passing through both ground crew. However, in the case of the RS, the injuries appear more likely a result of lightning striking the tail of the aircraft and discharging through the headset and RS to earth. This is termed a ‘contact’ strike. Due to their close proximity to the aircraft, the second ground crew member most likely received a less severe, ‘side flash’ strike.

Lightning activity monitoring and the decision to resume tarmac operations

Lightning activity monitoring

Virgin’s Brisbane-based Meteorological Officer had access to Bureau of Meteorology weather data and was monitoring the weather at Perth Airport. Specific to lightning activity, they had access to the Automated Thunderstorm Alerting System (ATSAS) and the Global Positioning and Tracking System data. Neither system showed ground strikes at the airport prior to or during the occurrence. The absence of lightning activity in that data, which was briefed to the Operations Controller by the Virgin Meteorological Officer, was a significant factor influencing the controller to discuss the resumption of work on the ramp with the RS.

The ATSAS and Global Positioning and Tracking system provided a high level of accuracy in the detection of cloud-to-ground lightning strikes (reported as up to 90 per cent accuracy). However, the absence of detection by either system in this occurrence supports the need to source collaborative local data when determining whether it is safe to return to work activities.

The decision to resume tarmac operations

The RS attempted to clarify the lightning risk after the Operations Controller called to advise that no lightning activity was recorded in the area for the last 30 minutes, and that other operators had resumed tarmac operations. This entailed the RS attempting to telephone the Brisbane-based Meteorological Officer to discuss the disparity in the controller’s advice as compared to the lighting still being observed overhead. The RS was unable to contact the Meteorological Officer.

Consistent with the reported perception by the RS of pressure from the Operations Controller and Airport Movement Coordinator to resume work earlier than they would have liked, the RS used the Bureau of Meteorology website’s weather radar information to assess the local conditions and estimate the storm’s movement. The weather radar displayed areas of precipitation, but did not directly show cloud formation, thunderstorm or lightning strike activity. Therefore, the weather radar alone did not provide sufficient information to predict lightning strikes. Additionally, the use and interpretation of weather radar information without formal training increased the likelihood that the RS was not aware of this limitation.

In the event, the RS’s decision to resume tarmac activities was informed by their interpretation of the radar data accessed on the Bureau of Meteorology website. This interpretation was reinforced by the report from the Operations Controller of no lightning activity in the area in the preceding 30 minutes, and by the supervisor’s perception of a reduction in local storm activity.

A review of weather radar images for the period leading up to the incident indicated ongoing rain in the vicinity of the airport (Figure 5). The data did not show a clear break in the storm.

Severe weather procedures

Virgin

In respect of the resumption of duties at ATSAS-equipped airports such as Perth, Virgin’s Airport Airside Operations manual severe weather operations procedure stated:

The decision to resume normal duties shall take into account any cells observed outside the 5 nm [9 km] radius which are expected to impact on the airport in the immediate future. Where a second cell is anticipated to impact on the 5 nm [9 km] area, the decision to resume ramp activities rests with the RDM [Ramp Supervisor] and the DES [Duty Engineering Supervisor].

Despite those requirements, it appears that Virgin’s Operations Controller did not consider seeking an understanding of the local weather conditions from either the RS or the Duty Engineering Supervisor. A discussion with the RS of the need to resume ramp duties would have, if able to have been carried out, provided an ideal opportunity for the Operations Controller to gain that understanding. There was the potential for it to have also had an effect on the pressure felt by the RS to resume those operations.

Ground-handling organisation

The ground-handling organisation’s procedures in the case of thunderstorm and lightning activity closely followed those of Virgin with regard to alert stages and the cessation and resumption of duties. The procedures supported the use of weather information as part of the assessment process and stated that local visual observations should be taken into account when assessing the resumption of duties, but cautioned that airport managers and ramp supervisors should use weather information carefully. However, no formal guidance or training on which weather information was suitable given the situation, or how to interpret that information, was provided.

Summary

Virgin’s and the ground-handling organisation’s procedures provided for local observations to be taken into account when considering the resumption of ramp duties. However, the reliance by the Operations Controller on the Meteorological Officer’s advice that lightning activity had ceased affected the application of those procedures in this case. The conversation between the controller and the RS, and then the Airport Movement Coordinator and the RS, resulted in perceived pressure by the RS to resume ramp duties. Given the report of lightning still being observed overhead, the decision by the RS to resume those operations increased the risk of a lightning strike and injury to ground personnel.

Safety issues and actions

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Proactive safety action taken by Virgin Australia Airlines Pty Ltd

As a result of this occurrence, Virgin Australia Airlines Pty Ltd:

• Enhanced its flight planning and weather training for all ground operations Airport Movement Coordinators, incorporating a specific Automated Thunderstorm Alert System training package.
• Is considering the implementation of a ‘Severe Weather’ text message alert system to airports on their network that were not covered by the Automated Thunderstorm Alerting System. These alerts would be sent in advance of severe wind, lightning, and so on and would direct the recipient to the Bureau of Meteorology for more information.
• Commenced a trial of smartphone weather alert applications with key operational personnel across the domestic network.
• Commenced using wireless headsets at some airports.
• Aligned their manuals with other stakeholders’ extreme weather policy and procedures.

Proactive safety action taken by Aerocare

As a result of this occurrence, Aerocare (the ground-handling organisation) made a number of changes to its adverse weather procedures. These included:

• increased emphasis that Ramp Supervisors have the authority to determine the cessation and recommencement of work activities
• increased emphasis on the risk of electrical discharge as a result of connecting a headset to an aircraft during storm activity and increasing the minimum distance from such storm activity at which headset connection takes place from 10 km to 18 km
• clarification of a number of terms/distances
• increasing the lightning risk distance from an airport from 10 km to 18 km
• the inclusion of first aid and emergency response information in case of a lightning strike
• greater guidance on the available weather-monitoring tools
• standardisation of the adverse weather phases as follows:

- Awareness – forecast adverse weather

- Watch – 30 NM (56 km) and approaching

- Alert – 10 NM (19 km) and approaching

- Airside operational shutdown – 5 NM (9 km) and approaching

- Downgrade - greater than 5 NM (9 km) and receding

- Cancellation – no thunderstorm activity is forecast or observed locally.

Proactive safety action taken by Perth Airport Pty Ltd

As a result of this occurrence, in December 2014 Perth Airport Pty Ltd produced Safety Bulletin issue 05. The bulletin highlighted the importance of taking appropriate action during severe weather to airside operators and personnel.

Additionally, in September 2015 a thunderstorm warning system that featured audio and visual warnings to staff on the airport was installed. Perth Airport Pty Ltd advised that, since installation, the warning system had been used successfully on a number of occasions.

Findings

From the evidence available, the following findings are made with respect to the lightning strike involving Airbus A330, registered VH-XFJ, at Perth Airport, Western Australia on 26 November 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• In combination, perceived operational pressure by the Ramp Supervisor, and their assessment that there would be a 45-minute break in thunderstorm activity, influenced the decision to resume work on the ramp during local thunderstorm activity.
• Consistent with the observed lightning strike to the tail of the aircraft, connection of the headset to the aircraft during local thunderstorm activity resulted in a ‘contact’ strike to the ramp supervisor.

Other factors that increased risk

• The Automated Thunderstorm Alerting System and Global Positioning and Tracking System data did not show cloud-to-ground lightning activity within 10 NM (19 km) of the airport prior to work resuming on the tarmac or at the time of the injuries. Despite the observed local conditions, the lack of recorded ground strikes prior to the incident may have created a false impression of a low lightning risk environment.
• The Virgin Australia Airlines Pty Ltd Meteorological Officer report of no lightning activity in the area in the previous 30 minutes was communicated to the Ramp Supervisor by the Operations Controller. That and the subsequent communication by the Airport Movement Coordinator was perceived by the Ramp Supervisor as pressure to resume ramp duties.

Other finding

• The Ramp Supervisor’s assessment that there would be a 45-minute break in thunderstorm activity was reinforced by the report by the Operations Controller of no lightning activity in the area in the preceding 30 minutes, and the supervisor’s perception of a reduction in local storm activity.

The occurrence

On 26 November 2014, the flight crew of an Airbus A330 aircraft, registered VH-XFJ (XFJ) and operated by Virgin Airlines Australia Pty Ltd (Virgin), was conducting a scheduled passenger flight from Sydney, New South Wales, to Perth Airport, Western Australia. The general weather forecast for arrival at Perth included scattered thunderstorms. As a result, the aircraft was vectored a number of times by air traffic control to avoid the storm cells in the area.

At about 1435 Western Standard Time,^[1] due to an electrical storm at Perth Airport, all work on the ramp stopped. At about 1515, no further lightning activity was observed on the weather radar, so the ground crew resumed their duties. However, shortly after, cloud-to-cloud lightning was observed and lightning struck the ramp behind an aircraft. All work activities immediately ceased again. The Ramp Supervisor (RS) reported continually monitoring the local conditions from that time to determine when it would be safe for staff to resume work on the ramp.

The captain reported that, on approach into Perth, the aircraft descended through cloud and that they became visual between 4,000–5,000 ft above ground level with small storm cells and lightning activity observed to the north of the airport. The captain recalled landing on runway 06 shortly after 1615 and, during the landing roll, seeing lightning strike the ground about 500 m to the right of the aircraft. The flight crew were advised by air traffic control to hold on the taxiway as the ramp was closed and their designated bay (20A) was occupied.

At about 1630, the Airport Movement Coordinator advised the RS they had been contacted by Virgin’s operations controller located in Brisbane, who queried why duties on the ramp had not recommenced, as other airlines had already resumed their Perth operations. The RS called the Operations Controller and was questioned directly as to why they had not returned to the ramp. During this conversation, the RS was told of advice from Virgin’s Meteorological Officer that there had not been any lightning activity in the area for the past 30 minutes. In response, the RS relayed that lightning was still visible overhead, and was told to discuss this with Virgin’s Meteorological Officer. After being unsuccessfully transferred to the Meteorological Officer’s phone, the RS hung up and reviewed the Bureau of Meteorology weather radar images.

After assessing the weather radar images, the RS determined that there could shortly be about a 45-minute break in the storm cell activity in the area. The Airport Movement Coordinator received a number of additional calls from the Operations Controller about the resumption of ramp duties, which were relayed to the RS. Following a discussion with other senior ground crew, and observing a reduction in the local storm activity, the RS decided to resume work on the ramp. The RS gave priority to clearing the backlog of aircraft waiting to be unloaded, then directed ground crew to move the aircraft already at bay 20A to nearby ‘stand-off’ bay 915 (Figure 1).

At about 1717, the crew of XFJ taxied to bay 20A. After they came to a stop, the RS chocked the nose wheels and connected a headset to the intercom jack at the aircraft’s nose landing gear (Figure 2).

As the ground crew were parking the other aircraft on bay 915, lightning was observed to strike the tail region of XFJ. Simultaneously, engineers located at bay 20A reported observing a lightning flash to the rear-left of XFJ. As the RS depressed the ‘push-to-talk’ button and established contact with the flight crew, the RS received an electrical shock consistent with a high voltage electrical discharge.

The RS staggered from the aircraft before collapsing unconscious on the ground. A second ground crew member assigned to XFJ was also subjected to the electrical discharge and sustained a burn injury. That ground crew member did not lose consciousness.

Both ground crew were transported to hospital for observation. The second injured ground crew member was released the next day and the RS remained in hospital for a number of days before being released.

Inspection of the aircraft by Virgin did not find any evidence of the lightning strike entry or exit points, nor were any defects found that could account for the injuries sustained by the ground crew.

Figure 1: Terminal three at Perth Airport indicating parking bays 20A (in red) and 915 (in green) and the witness locations

Source: Airservices Australia, modified by the ATSB

Figure 2: Perth Airport ramp closed-circuit television images showing the RS at the nose landing gear of XFJ

Source: Perth Airport Pty Ltd

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.

Context

Aircraft information

General information

The aircraft, an Airbus A330-243, serial number 1561, was manufactured in France in 2014 and placed on the Australian register on 11 June that year. The aircraft was maintained in accordance with Civil Aviation Safety Authority requirements through the Virgin Australia Airlines Pty Ltd (Virgin) approved system of maintenance. The aircraft’s logbook did not contain any defects at the time of the occurrence that would have effected its airworthiness or account for the injuries sustained by the ground crew.

Aircraft lightning protection

Regulatory requirements

The United States Federal Aviation Administration (FAA) had developed an electrical system harmonisation working group to standardise regulations between the Federal Aviation Administration regulations (FAR) and the European Joint Aviation Authority regulations (JAR). This included electrical bonding^[2] and protection against lightning and static electricity. As a result, FAR 25 and JAR 25 closely mirrored each other.

FAR/JAR 25 provided airworthiness standards for transport category aircraft. Regulations FAR/JAR 25.581 specifically addressed lightning protection. They stated that:

…an aircraft must be protected against catastrophic effects from lightning through the bonding of metallic components to the airframe, or designing the components so that a lightning strike will not endanger the aircraft. For non-metallic components, the regulations requires they are designed to minimise the effect of a strike, or incorporate an acceptable means of diverting the resulting electrical current so as not to endanger the aircraft.

Regulations FAR 25.899 and JAR ACJ 25X899 related to electrical bonding and protection against static electricity. These regulations highlighted that bonding design must minimise the accumulation of electrostatic charge that would cause:

• human injury from electrical shock
• ignition of flammable vapours

or

• interference with installed electrical and electronic equipment.

They also reinforced that metallic components needed to be properly bonded to the airframe. Where other acceptable means of dissipating the resulting electrical current were used, they could not endanger the aircraft, personnel, or the operation of installed electronic and electrical equipment.

Aircraft design

Airbus advised that the A330 design was protected against the effects of lightning in accordance with FAR/JAR 25. That compliance was assessed during the aircraft design stage through analysis and testing that ranged from specific equipment installed on the aircraft, to full-scale aircraft testing.

The aircraft was designed to behave as a Faraday cage^[3] in the event of a lightning strike. The aircraft’s structure and systems were protected through electrical bonding to minimize structural damage and electrostatic charge build-up, and to ensure that critical systems would remain available.

Aircraft bonding

Airbus also advised that any electrical charge from a lightning strike would most probably dissipate through the landing gear to the ground. Airbus Maintenance Briefing Note 12/5/2014 provided a number of illustrations and flow charts that referenced mandatory earthing for transit, base or hangar aircraft maintenance during storm conditions (Figure 3).

Figure 3: Airbus Maintenance Briefing Note 12/5/2014 extract showing the bonding requirements for transit, base or hangar maintenance during storm conditions

Source: Airbus

Aircraft Maintenance

Safe practices

Whether an aircraft is electrically earthed^[4] or not, the risk of injury to ground crew working around the aircraft when it is struck by lightning is high and increases significantly if direct contact is made with the aircraft.

To minimise the likelihood of injury from lightning, the aircraft maintenance manual provided the following warning:

WARNING: DO NOT TOUCH CONNECTIONS TO THE AIRCRAFT, DO NOT USE HEADSETS, LIGHTNING STRIKE AND HIGH DISCHARGE CURRENTS ARE VERY DANGEROUS FOR PERSONNEL AND CAN CAUSE DAMAGE TO EQUIPMENT.

The aircraft maintenance manual defined a ‘WARNING’ as:

CALLS ATTENTION TO USE OF MATERIAL, PROCESSES, METHODS, PROCEDURES OR LIMITS WHICH MUST BE FOLLOWED PRECISELY TO AVOID INJURY OR DEATH TO PERSONS.

Lightning strike inspection procedure

The aircraft maintenance manual after lightning strike inspection detailed the maintenance actions after a lightning strike to the aircraft. The procedure defined lightning strike probability on the aircraft in terms of three probability zones (Figure 4).

Figure 4: Airbus lightning strike inspection areas

Source: Airbus, modified by the ATSB

The inspection procedure consisted of three phases:

• phase 1, which entailed a visual inspection
• phase 2, consisting of a system test
• phase 3, which resulted in the replacement/repair of damaged equipment or components.

If the phase 1 inspection did not identify any defects, the subsequent phase inspections were not required. Review of the aircraft’s maintenance documentation revealed that no defects were identified during the phase 1 inspection after the lightning strike.

Meteorological information

Lightning

Lightning is an atmospheric discharge of electricity, which typically occurs during thunderstorms, but can occur during volcanic eruptions or dust storms. While the formation of lightning is still under debate, ice in clouds is believed to play a key role in lightning formation and the forcible separation of positive and negative charges within a cloud. Lightning can occur within clouds (cloud-to-cloud) or between the earth and a cloud (cloud-to-ground or ground-to-cloud).

As the thundercloud moves over the earth an equal but opposite electrical charge is induced on the ground. The negatively ionised air channels within the cloud (called leaders) are drawn toward positive ions in quick jumps. As these ‘stepped’ leaders approach within 15 to 50 m of the ground, the electrical potential increases until the remaining gap is bridged. A neutralising current flows along the ionised path, and is visible as a flash (bolt) in the return stroke.

Lightning often strikes outside heavy rain and can occur up to 16 km from the storm cloud. The typical ground bolt length is 1.6 km long.

Weather forecasting

The Bureau of Meteorology (BoM) produced a number of forecasts and reports for Perth Airport throughout the day. These included aerodrome warnings, aerodrome weather, aerodrome forecasts (TAF)^[5] and trend forecasts (TTF)^[6].

Aerodrome warning

Aerodrome warnings were issued when meteorological conditions that could adversely affect airport facilities, services, or aircraft on the ground were anticipated.

At 0839, an aerodrome warning (valid from 0840 to 2040) was issued for Perth Airport. It stated that thunderstorms were observed within the terminal area to the north and east that were expected to persist throughout the day and into the evening.

A second warning (valid from 1340 to 1700) was issued at 1340. This warning confirmed the presence of hail in the region with the possibility of hail at the airport in the afternoon until at least 1700.

Aerodrome weather briefing

An aerodrome weather briefing issued at 1331 confirmed the presence of thunderstorms to the north of Perth Airport and stated they were expected to continue until 1700 the following day. This included an at least 50 per cent probability of thunderstorms at the terminal until 1700 that day, and a 30 per cent probability of thunderstorms until 1700 the next day.

Amended TAF

At 1518, an amended TAF for Perth Airport (valid from 1500 to 2000 the following day) was issued. That forecast predicted rain showers and periods of thunderstorms and hail around the time of the occurrence.

TTFs

TTF (SPECI) reports were issued for Perth Airport at 1630, 1700, 1721 and 1730. These reports documented the presence of thunderstorm activity in the area.

Weather radar

The BoM provided copies of weather radar images for Perth Airport at the time of the incident. The weather radar images show only precipitation, not cloud formations, thunderstorms or lightning strikes. The images provided confirm the presence of rain in the vicinity of the airport at the time of the occurrence (Figure 5).

Figure 5: BoM weather radar screen captures of the weather at Perth Airport from 1700 to 1720 (0900 to 0920 UTC) on 26 November 2014 showing consistent light-to-moderate rain

Source: BoM, modified by the ATSB

Adverse weather monitoring

Automated Thunderstorm Alerting System

The BoM developed the Automated Thunderstorm Alerting System (ATSAS) to provide real-time information about thunderstorms and lightning activity at major airports. The system used radar data combined with localised single station lightning sensors at supported airports, including at Perth, to record cloud-to-cloud and cloud-to-ground lightning strikes within 10 NM (19 km) of the airport. The system had a reported accuracy of 90 per cent for lightning detection, with information updates occurring every minute. Data gathered was presented as a graphic for registered users, showing the airport in plan view, thunderstorm cell location and its forecast movement for up to 30 minutes.

Global Positioning and Tracking System

An alternate commercial lightning detection system was in operation in Australia at the time of the occurrence. The Global Positioning and Tracking System comprised of a network of sensors that used a different method of tracking lightning strikes. Data from that system was available to the BoM.

Global Positioning and Tracking System data was available for the period of the occurrence. The data showed multiple lightning strikes on the airport at 1342 and 1524.

Alerting system data

Neither the Global Positioning and Tracking System nor ATSAS data identified cloud-to-ground lightning strikes at or within a 5 NM (9 km) radius of the airport at the time of the occurrence. The data did show an increase in cloud-to-cloud lightning activity at that time.

Virgin adverse weather monitoring

Virgin reported that their Brisbane-based contracted Meteorological Officer monitored the storm activity in the vicinity of the Perth Airport that day. The Meteorological Officer stated that the data indicated that the last lightning strike within 5 NM (9 km) of the airport occurred about 16 minutes prior to the aircraft being parked at bay 20A. At the time of the occurrence, lightning activity was indicated approximately 21 NM (39 km) south-south-west of the airport. The Meteorological Officer reported that a significant increase in the number of cloud-to-cloud lightning strikes could signify an imminent cloud-to-ground strike.

Severe weather procedures

Virgin

Virgin’s Airport Airside Operations (AAO) manual discussed severe weather operations procedures. In accordance with the manual, either the Ramp Duty Manager (RDM)^[7] or the Airport Duty Manager (ADM) were responsible for declaring a thunderstorm watch and activating the various stages of the phased response procedures. Activation was to be undertaken in conjunction with local observations and assessment.

The thunderstorm watch phased response procedures included the:

• Alert Phase:
• Once a storm front was within 10 NM (19 km) of the airport and continuing to approach, the RDM/ADM was to notify the likelihood of an operational shutdown to all ramp staff and key personnel. This included the on-duty Airport Manager, duty Operations Controller, Airport Movement Coordinator, flight crew and cabin supervisors, contractors and service providers, and so on.
• Preparations for shutdown included suspending non-essential open area activities, alerting staff using headsets, advising fuelling operations to monitor the approaching storm and avoiding use of highly-conductive equipment.
• Stop/Shutdown Phase:
• When the storm was within 5 NM (9 km), the RDM/ADM was to declare the Stop/Shutdown Phase and ensure the information was relayed to all relevant personnel.
• On announcement of the Stop/Shutdown Phase, personnel were to stop all ramp activities, including fuelling. Communication with the aircraft via headset was to be discontinued and personnel were to seek shelter inside buildings. All passenger boarding was to cease and arriving aircraft be held off their gate.
• All Clear/Downgrade/Cancellation Phase:
• When the storm had passed 5 NM (9 km) from the airport, there was a downgrade to the Alert Phase. When the storm reached 10 NM (19 km) from the airport, the Alert Phase could be cancelled.
• The AAO manual contained the following note in respect of the procedure for ATSAS airports:
• [duty engineering supervisor][duty engineering supervisor]
• The AAO acknowledged the risk of lightning injury and advised that many lightning injuries occurred after the perceived threat had passed. The manual also stated that ‘lightning generally diminishes with time after the last sound of thunder, but may persist for more than 30 minutes.’
• The manual’s thunderstorm and lightning safety subsection listed activities that should not be undertaken during lightning events. These included the use of a headset that was connected to an aircraft and not staying in open areas or under the aircraft.

Ground handling

Virgin used a third party for aircraft ground-handling operations at Perth Airport. The ground handling organisation was one of the largest independent providers of ground support services in Australia, with operations at 16 major airports.

The ground-handling organisation’s Quality Manual contained procedures for adverse weather operations, including thunderstorms. While the procedures identified BoM and Virgin’s meteorological services as major sources of weather information, the procedure noted that:

Airport managers and Ramp Supervisors should use this information carefully, also taking into account local visual observations.

The stipulated response to adverse weather conditions was divided into the following five phases:

• Awareness
• Storm watch
• Alert
• Airside operations shutdown
• Downgrade/cancellation.

These phases aligned closely with Virgin’s procedures in regard to storm proximity to the airport and the cessation/resumption of ramp activities.

Airport procedures

The Perth Airport Pty Ltd operating protocols placed the onus on the airlines and their contractors to ensure that their staff were competent in airfield and ramp occupational health and safety practices. Consequently, the airport’s policy and procedures did not incorporate any specific adverse weather practices or procedures. Perth Airport did not have an airfield thunderstorm/lightning warning system for alerting personnel on the apron.

Organisational and Management information

Workload/operational pressure

At the first sign of lightning near the ramp (at about 1515), the RS ceased work activities and withdrew the ground-handling staff. At about 1630, the Aircraft Movement Coordinator and Operations Controller questioned why the RS had not recommenced work on the ramp as the meteorological information provided showed no lightning activity since about 1600. At that time, work had ceased for over an hour and there were partially-unloaded aircraft that had landed just prior to the lightning activity.

The Operations Controller re-enforced that the aircraft needed to be unloaded and dispatched, as they were required on the ‘east coast’ that night. As a result, the RS reviewed the radar data on the BoM website before directing the ground handlers to resume ramp duties

The RS stated that had he not felt pressured by the Operations Controller and Aircraft Movement Coordinator, he would most likely not have resumed work on the ramp at that time.

Additional information

Decision making

Studies have found that decision quality decreased when time pressures are imposed (Kerstholt 1991). The decision maker will tend to narrow their focus with selective processing of the available information. Research into the effect of time pressure on aviation maintenance errors found that decision making accounted for about 9 per cent of errors studied (Suzuki and others 2008). That percentage increased to about 27 per cent when time pressures were applied.

The RS advised of feeling under pressure to return ground-handling staff to ramp duties quickly to facilitate the relocation of aircraft to the east coast that day.

Lightning injuries

On average, there are about 10 fatal lightning strikes and about 100 strikes that result in injury in Australia each year. Injuries from lightning can occur through the following discharge methods:

• direct strike, in which the person is the point of the lightning strike
• contact strike, where the person is in contact with an object that is struck
• side flash, where lightning strikes an object and jumps/splashes to a nearby person
• upward leader strike, in which the positive current moves upward without contacting the downward stroke
• ground flash/current, where the lightning strikes the ground some distance from the person. The lightning then spreads across and energises the ground.

Canadian research statistics have shown that the most common lightning injuries are the result of indirect strikes, with ground flash/current accounting for 40 to 50 per cent of injuries, and side flash accounting for 20 to 30 per cent of injuries. Only 3–5 per cent of injuries were attributed to direct strikes (Figure 6).

Figure 6: Pie chart of Canadian lightning strike types and annual injury percentages

Source: Environment Canada

It is a common misconception that lightning strike victims remain electrically charged and that contact with that person can result in injury. This is incorrect, as the electrical discharge passes through the strike victim to earth. Consequently, shock injuries do not occur as a result of touching someone who has been struck by lightning.

Other occurrences

Perth Airport Pty Ltd advised that they had no record of any previous injuries due to aircraft lightning strikes occurring at Perth Airport.

The ground-handling organisation advised that their records showed four incidents of possible lightning strike electrical discharge injuries across their operations. These included:

• 2008 Gold Coast Airport, Queensland. During the aircraft’s arrival, the ground crew felt a minor shock through the headset.
• 2013 Perth Airport. During dispatch, the ground crew felt a minor shock through the headset.
• 2014 Darwin Airport, Northern Territory. During waste water servicing, the ground crew was knocked to the ground but was able to continue their duties.
• 2014 Perth Airport (this incident).
• A search of the ATSB occurrence database identified 19 lightning strikes to aircraft that were parked or taxiing at aerodromes in Australia from 1974 to 2014. Of these incidents, only this occurrence resulted in serious injury to personnel.

______

2. Electrical bonding: the establishment of a current path between electrically conductive parts in order to assure electrical continuity.
3. Faraday cage: a shield that protects its inner contents from static electricity fields.
4. Electrically earthed: the establishment of electrical continuity between the aircraft and the earth’s surface (ground).
5. Aerodrome Forecast (TAF): a statement of meteorological conditions expected for a specific period of time in the airspace within a radius of 5 NM (9 km) of the aerodrome reference point.
6. Trend Forecast (TTF): an aerodrome weather report (either routine (METAR) and issued at fixed times (hourly or half hourly), or special (SPECI) and issued whenever weather conditions fluctuate about or are below specified criteria. A statement of trend is appended to these reports.
7. RDM: the Virgin designation for the Ramp Supervisor (RS).

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At 1159 on 24 November 2014, freight service 4190 passed Signal 66.8 while it was displaying a stop aspect and without an authority^[1]. Signal 66.8 is located in the section between Wyee and Warnervale on the NSW central coast. The SPAD represented a breach of the Network Rules and Procedures involving the use of Absolute Signal Blocking (ASB) that had been granted as part of worksite protection arrangements for a workgroup conducting electrical maintenance tasks at Warnervale. The Protection Officer for the workgroup was granted ASB shortly after there was a change in the Network Control Officers (NCO) at Morisset, from where the signals protecting the section were controlled. Although assurances were given to the PO that the section was clear, two trains were still travelling between the protecting signals and the worksite at the time ASB was implemented. The first train passed the worksite shortly afterwards without incident. The second, travelling some eight minutes behind, came to a stand approximately 1,300 metres before the worksite after the driver reacted to a signal returning to stop in front of the train. The signal had returned to stop because of electrical testing being conducted as part of the maintenance tasks. Its return to stop also (fortuitously) prevented the train from entering the worksite and potentially injuring the workgroup members.

There were no reported injuries or infrastructure damage as a result of the incident.

What the ATSB found

The ATSB found that when the NCOs changed over at Morisset, there was a breakdown in the handover process. This breakdown resulted in ASB being granted to the PO at Warnervale without the exact location of trains being established, signals V8 and V6 being set back to stop and blocking facilities applied in accordance with Network Rule NWT 308. At the time of this incident Sydney Trains was trialling a modified ASB methodology to address previously identified safety issues, however this trial had not been extended to Morisset. If it had been, the progress in granting ASB would have been documented and would have assisted the NCOs during the handover process.

What's been done as a result

Sydney Trains advised that it has expanded its trial of the ‘Coded Authorisation Process for Absolute Signal Blocking’ to include signal box locations on the Main North Line between Gosford and Broadmeadow. It further advised that, upon completion of the trial, the Network Rule and Procedure for Absolute Signal Blocking will be rewritten to improve its readability and application.

Safety message

This incident illustrates the criticality of minimising interruptions and distractions that may affect the process for the granting or authorisation of work on track authorities, particularly Absolute Signal Blocking. Similarly, it reinforces the importance of information and situational awareness exchange between personnel during the handover process for the control of dynamic rail network operations.

__________

1. Signal passed at stop without authority is also referred to as ‘Signal Passed at Danger’ or ‘SPAD’.

Context

Relevant infrastructure

All the infrastructure relevant to the incident is located on the Main North line between Sydney and Newcastle. The SPAD occurred at Signal 66.8 (107.722 km^[4]) between Wyee and Warnervale. The worksite was located at the level crossing at Warnervale (105.915 km). Signals V8 and V6, which were being used as protecting signals for the worksite, are located at 119.309 km and 121.359 km respectively. All signals are located in the area monitored or controlled from Morisset Signal Box (123.400 km).

Morisset Signal Box

Morisset signal box is one of two on the Main North line where NSW Trains staff provide network control officer functions on behalf of Sydney Trains under a services contract. The NSW Trains staff operate under Sydney Trains accreditation using Sydney Trains’ Network Rules and Procedures.

The station consists of two platforms with the main office complex and ticket booking office located on No.2 Platform. A combined signal box and meals area is included in the main office complex. There are two access doors into the signal box, one directly from the platform and the other via the Station Manager’s office (Figure 2). However, there were no instructions on either door for persons requiring access.

Figure 2: Platform 2 Morisset

The signal box controls the operation of the interlocking and absolute (controlled) signals at Morisset and Vales Point. The interlocking at Morisset is lever controlled with a track diagram that provides the signaller with information regarding the location of trains and the status of track circuits, absolute signals and points. A separate electrical switch panel is used to operate the interlocking at Vales Point when in local control. Panel indicator lights and switch positions provide the signaller with an indication of the location of trains and the status of track circuits, absolute signals and points in the interlocking.

The signal box is also provisioned with the following (Figure 3):

• A Train Location System (TLS) located in the signal box and ticket booking office that provides a graphical representation of the entire Sydney Trains electrified network.
• A non-vital Train Visibility System (TVS) to monitor the permissive signalled “dark territory” between Dora Creek and Wyong ^[5],^[6]
• Track diagrams to provide an indication of the location of trains and the status of track circuits, absolute signals and points in Morisset’s area of control.

Figure 3: Morisset Signal Box

The TLS shows the run numbers of all services and their locations, except for freight services between Broadmeadow and Wyong, which are not visible. The blocks occupied by freight trains appear as a red lines on the diagram, but a run number is not displayed. All services are, however, visible on the TVS which displays services as occupied lines / blocks. While Morisset station is manned continually, the signal box is not. Being a localised signal box, it is cut in or cut out by the Signaller for worksite protection arrangements, when terminating rail traffic at Morisset or when rail traffic is required to enter or exit Vales Point power station. When cut out, all absolute (controlled) signalling in the Morisset area of control operates in automatic mode.

Train movements through the Morisset area of control are also monitored by the Train Controller at the Rail Management Centre (Sydney) who marks all train movements on a train graph based on the times reported by the signal boxes along the line. The Train Controller also has a TLS to provide oversight of their area of control and the network.

In accordance with current security requirements, all persons entering the station, other than members of the public entering or using public areas, are required to undergo a local safety induction. The induction is a mandatory briefing for all station visitors to make them aware of key safety related issues and requirements. This was not done for the NSW Police officers and their presence in the signal box was not managed during the time safety critical information was being exchanged.

Applicable Network Rules and Procedure

Network Rule NWT 300 - Planning Work in the Rail Corridor

NWT 300 prescribes the rules for planning work in the rail corridor and assessing the work for safety. Before any workgroup enters the rail corridor, the PO must plan and document the worksite in accordance with NWT 300. The rule prescribes that work planned in the corridor must be assessed for safety and it’s potential to intrude on the Danger Zone. Work cannot be carried out unless a safe place can be easily reached and safety measures are in place.

A worksite must have a PO whose primary duty is to keep the worksite and workers safe. POs must be satisfied that other work will not interfere with their primary duty. The PO is responsible for the following:

• conducting the safety assessment of the worksite
• briefing the workers of the protection arrangements
• ensuring the works are conducted in a safe manner
• keeping records of the protection arrangements
• communicating with Network Control about the protection.

When conducting the safety assessment, the PO must consider, amongst other factors, the method of protecting the worksite, the resources required for its protection and the communication requirements. The PO must also ensure that the planning of the worksite is documented and all workers are adequately briefed on the safety requirements.

Network Rule NWT 308 – Absolute Signal Blocking

ASB is a method of worksite protection used to exclude rail traffic from a worksite. It is intended for use where any required tools can be easily removed from the tracks by a single person. ASB can also be used to allow vehicles to cross the track at network access level crossings.

When requesting ASB, the PO must tell the signaller the location of the worksite and the intended start and finish times. All points of entry must be protected and the PO must arrange for:

• at least two consecutive controlled absolute signals at STOP with blocking facilities applied, or
• manual points control mechanisms to be used to set controlled absolute signals at STOP, or
• at least one controlled absolute signal at STOP with blocking facilities applied, and
• points secured to prevent access to the tracks, or
• there must be an easily reached safe place available and a lookout provided.

A signaller may grant the ASB method only for signals in their respective area of control. Before setting controlled signals at Stop, the Signaller must tell the Train Controller about the request to exclude rail traffic. The Signaller must ensure that:

• the protecting controlled absolute signals are at STOP, and
• blocking facilities have been applied, and
• there is no approaching rail traffic between the protecting signals and the proposed worksite, and
• that any rail traffic that has passed complete beyond the worksite will not return.

The PO must confirm these actions with the Signaller as well as the agreed start and finish times.

At the end of the working the PO must tell the Signaller that the work is completed, the workers and equipment are clear of the danger zone, all manual points control mechanisms have been returned to normal and any points that were secured are available for use. After being assured the track is clear by the PO, the signaller may remove the blocking facilities that were applied.

Although there is a requirement that a permanent record of the ASB details be made by the Signaller and the PO, no forms or checklists accompany the rule.

Network Procedure NPR 703 – Using Absolute Signal Blocking

Network Procedures describe how particular actions are to be done to apply the Network Rules. NPR 703 prescribes the requirements when using ASB in accordance with NWT 308.

As with NWT 308, NPR 703 requires the Signaller to ensure that all absolute signals allowing entry to the worksite are at stop with blocking facilities applied, there is no rail traffic approaching the worksite and all rail traffic that has passed complete beyond the proposed work location will not return.

Interim arrangements for Absolute Signal Blocking

In 2013, the ATSB investigated three incidents involving the use of ASB as part of Sydney Trains worksite protection arrangements in a combined report RO-2013-018.^[7] Immediately following these incidents, Sydney Trains issued a memorandum, ‘Application of Absolute Signal Blocking’ on 22 July 2013 amending the procedures for the granting of ASB. The amended procedures required the Train Controller to compile a checklist when informed of the ASB request and the PO to deploy lookouts as an additional defence. They were still current at the time of this incident.

Although a Train Controller checklist was compiled at the ASB request, it was only a single checklist but intended for multiple worksites. Further, the PO did not deploy any lookouts. As such, both these situations contravened the memorandum requirements.

While not deployed, the effectiveness of any lookouts in this incident would have been diminished by the following:

• the occurrence of the SPAD some 1,300 metres in advance of the worksite
• the workgroup conducting its tasks outside the danger zone in a signalling hut
• the available sighting distance at the worksite (See Figure 4)
• the presence of active (automatic) type protection equipment at the level crossing.

Figure 4: Worksite at Warnervale

Source: OTSI

In a subsequent internal investigation, Sydney Trains found that not all staff had been aware of the memorandum requirements. Consequently, a safety alert (SD-2014-23) was issued on 28 November 2014 highlighting the requirements of the memorandum.

Taking into account the recommendations from the ATSB investigation and the findings from various internal investigations, Sydney Trains commenced a trial of a modified ASB process called ‘Trial of Coded Process for Absolute Signal Blocking’. The key elements of this trial, which override the requirements of the memorandum, include the following:

• Introduction of job aids (forms) for both the PO and the NCO to ensure consistency when requesting and granting ASB.
• Mandating the use of only five main reference points when identifying the proposed worksite location. All of the identifiers are those that will be present on the NCO’s track diagram.
• A reinforcement and read back requirement to ensure that there are no trains between the protecting signals and the worksite while ASB is being established.
• A requirement for the NCO to nominate the last train to enter the portion of line where the ASB is being established and its current location, i.e. that it is beyond the worksite.

The trial was introduced during 2014 in the signal boxes located between Blacktown and Springwood. It had not been introduced at Morisset at the time of the incident.

Concurrently, the ASB rule is also undergoing a complete re-write to improve its readability and application.

Train running time for section

The freight trains were travelling approximately eight minutes apart at the time of the incident. Evidence indicated that both freight trains had been operating at or near to scheduled speeds throughout the 22 kilometre section between Morisset and Wyong and not been delayed prior to the incident.

Workgroup and tasks

The workgroup, consisting of a PO and two electrical maintainers, signed on for duty at 0700 to conduct electrical maintenance tasks at various signal huts between Wyong and Wyee. The tasks involved the change-out of electronic modules within the signalling system that had been subject to a product recall by the manufacturer.

At 1000, the PO compiled a worksite protection plan for the worksite at Warnervale in accordance with Network Rule NWT 300 Planning Work in the Rail Corridor. He assessed that trains could be excluded and the proposed works could be conducted safely using Absolute Signal Blocking, in accordance with Network Rule NWT 308 Absolute Signal Blocking and Network Procedure NPR 703 Using Absolute Signal Blocking. ^[8] NWT 308 and NPR 703 principally require that the protecting absolute signal(s) at the beginning of the section to be placed back at stop with blocking facilities applied. Verbal assurances were given to the PO that there were no trains in the section approaching the proposed worksite. In his assessment, the PO nominated that signals V8 and V6 could be used as the protecting signals for the ASB as they provided two signal protection and did not require the use of a lookout.

Employee Information

The Station Manager was an employee of NSW Trains and a qualified Network Control Officer. He had 29 years rail experience.

The Duty Manager was an employee of NSW Trains and a qualified Network Control Officer. He had 13 years rail experience.

The Protection Officer was an employee of Sydney Trains and had been a qualified and authorised PO Level 2 for approximately six months.

Weather conditions

Bureau of Meteorology records indicated that the maximum temperature on 24 November 2014 was 26.9°C and no rain had fallen throughout the previous week. Weather conditions were reported as fine and dry at the time and did not contribute to the incident.

Fatigue

An examination of the rosters for the DM, SM and PO did not identify any evidence of the likelihood that fatigue was a contributing factor in the incident.

__________

4. Distance in kilometres from Sydney Central Station.
5. Signalling equipment and circuits are considered non-vital where failure to function correctly would not cause an unsafe outcome of the signalling system. Non-vital equipment and circuits do not affect the safe operation of the signalling system.
6. The ‘dark territory’ is a section of track where train movements are controlled by permissive (automatic) signals only. The signaller has no control over any of this signalling equipment or its functions. The dark territory is displayed on the TVS display as a straight line graphical representation of the section. Line segments on the screen change from green, when the route is clear, to red as trains occupy the track circuits while progressing through the section.
7. RO-2013-018: Safeworking breaches involving Absolute Signal Blocking Blackheath NSW, 13 June 2013, Newcastle NSW, 13 July 2013 and Wollstonecraft NSW, 17 July 2013 available on the ATSB website at www.atsb.gov.au
8. Full details of each Network Rule and Procedure can be found at http://railsafe.sydneytrains.nsw.gov.au/work-on-track

Safety analysis

Introduction

Train-in-section checks had not been performed properly when ASB was granted, resulting in trains going undetected while still in the section. This has been a common contributing factor in a number of recent investigations into worksite protection incidents where ASB has been employed.

In this particular incident, the main contributing factor was a breakdown in the handover process between the SM and the DM during the granting of ASB as two trains were approaching the worksite. There were no actions or omissions by the PO which contributed to the incident.

Breakdown in the NCO handover process

The breakdown in the handover between the SM and the DM was the result of an interruption mid process and a distraction caused by the presence of the NSW Police officers.

The interruption mid process occurred when the SM handed over to the DM. The change in NCOs, which was intended to occur at the commencement of the DM’s shift, was arranged by the SM to increase the DM’s experience with the ASB process. Instead, the DM became distracted by the presence of the two NSW Police officers who had entered the signal box. Instead of separating them from the ASB process and conducting the required induction, the DM catered to their information requests while the SM commenced actioning the ASB request.

The SM was still actioning the ASB request when the DM left the signal box. Coincidentally, at 1147, just before the DM returned to the signal box, freight service 4190 passed through Morisset under a full clear proceed signal.

At 1148, after conferring with the NCO at Wyong about the approach of trains 4122 and 4190, the SM handed the ASB request over to the DM. The handover took about a minute to complete and was given in verbal form only. No written details were given about the status of the signals being used for ASB, the application of blocking facilities or the location of trains in the section. The DM recalled the mention of only one freight train, 4190, during the handover.

At 1149, the DM, now in the role of NCO, called the PO to inform him ASB had been granted since 1143; a time shortly after the SM had informed the Sydney North Train Controller of the ASB request. In addition, he mentioned to the PO that a train, which he believed to be 4190, should have just passed his location. The PO challenged the passing of a train but, instead of verifying its exact location, the DM instructed him to call back once a train had passed. The PO called back at 1151, shortly after a train, later identified as earlier train 4122, had passed the worksite.

The call at 1149 highlighted the extent of the breakdown in the handover as follows:

• The communications between the SM and the DM who did not come to clear and concise understanding about the stage of where the granting of ASB was at.
• The lack of knowledge of where or how many trains were in the section. The PO’s challenge about a train not passing the worksite went unrecognised as to the probability of a train still within the section. On the basis of this obvious error, ASB should have been fulfilled or cancelled immediately until the location of all trains was properly established. Instead, the time ASB was granted was simply varied by the DM and accepted by the PO to coincide with the eventual passing of a train.
• The ability of 4190 to continue through Morisset at 1147 under a full clear (green) proceed aspect. This indicated that the next two signals, V8 and V6, which were to be used as the protecting signals for ASB, had not been placed back to stop with blocking facilities applied when ASB was granted at 1143 or before the PO was advised at 1149. Signal 76.6, located at the Sydney end of No.1 platform at Morisset, is the preceding signal to V8 and was observed in CCTV footage to be displaying a full clear (green) proceed aspect at the passing of 4190. The full clear aspect indicated that the next signal, V8, was also displaying either a restricted or full clear proceed aspect and that V6, the following signal to V8, was displaying either a proceed or stop aspect as well. As no SPAD was recorded at either signal, it indicated that the signals had not been set back to stop for ASB, no blocking facilities had been applied and 4190 had continued under proceed indications. Signal logs indicated that blocking facilities were likely to have been applied after 4190 had passed V6, if at all. Critically, the ability of 4190 to continue towards Warnervale under proceed signal aspects and SPAD at Signal 66.8 during testing of the signal controls indicated that no required train in section checks were made before, during or after the handover.
• The minimal length in time of the handover which was concluded within a minute after the SM had finished the call with the NCO at Wyong and less than two minutes after the DM had re-entered the signal box.

In summary, despite the requirements of Network Rule NWT 308, there was a breakdown in the NCO handover process used at Morisset which resulted in:

• ASB being granted to the PO at Warnervale without the exact location of trains being properly established
• Signals V8 and V6 not being set back to stop and blocking facilities not applied.

Other safety matters

Train Identification

Voice recording evidence indicated that there was confusion between the DM and the PO about the passing freight train when ASB had first been granted. Without details of train numbers from the DM, the PO instead described the passing train by the number of the leading locomotive. However, without having any train consist details or engine numbers, and in the absence of freight trains being numbered on the TVS, the DM assumed that the PO was referring to the second train, 4190, and continued with granting ASB. Once granted ASB, the workgroup then had unrestricted track access to the Up North Main line despite 4190 still approaching. Fortunately, the testing of the signalling system caused Signal 66.8 to return to stop in front of 4190 and prevented it from reaching the worksite.

Summary

The SM and the DM did not conduct the handover at an optimal time. It was undertaken while granting ASB was still in progress. As a result, the setting of signals V8 and V6 back at stop, the application of blocking facilities and the determination of precise locations for trains approaching the proposed worksite were overlooked.

A more considered option for the handover would have been at the time either when the PO first called requesting ASB or after ASB had been granted.

The presence of NSW Police officers in the signal box at the time and the activity to meet their needs served as a distraction during the process.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report. Where relevant, safety issues and actions will be updated on the ATSB website as information comes to hand. The initial public version of these safety issues and actions are in PDF on the ATSB website.

Deficient handover process

There was a breakdown in the NCO handover process used at Morisset which resulted in ASB being granted to the Protection Officer at Warnervale without the exact location of trains being properly established, signals V8 and V6 being set back to stop and blocking facilities applied in accordance with Network Rule NWT 308.

ATSB Safety issue No: RO-2014-021-SI-01

Sources and submissions

Sources of information

The sources of information during the investigation included:

• NSW Trains
• Sydney Rail Services Pty Ltd
• Sydney Trains
• The Bureau of Meteorology
• The Duty Manager, Morisset
• The Station Manager, Morisset
• Transport for New South Wales

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to:

• NSW Trains
• Office of the National Rail Safety Regulator
• Sydney Rail Services Pty Ltd
• Sydney Trains
• The Duty Manager, Morisset
• The Station Manager, Morisset
• The Sydney Trains Protection Officer
• The train crew of 4190
• Transport for New South Wales

Submissions were received from all parties with the exception of the train crew of 4190. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

The occurrence

At 1128 on 24 November 2014, two officers from NSW Police entered the signal box at Morisset unannounced seeking information regarding an incident which occurred on a train at Morisset two nights previously. They engaged with a Duty Manager (DM) who had just arrived to sign on for duty at 1130.

As this was occurring, the Protection Officer (PO) for a workgroup conducting electrical maintenance tasks telephoned the Station Manager (SM) at Morisset, who was also in the signal box working in the role of Network Control Officer (NCO) (Signaller). The PO requested Absolute Signal Blocking (ASB) for protection of a worksite on the Up Main North line at Warnervale (Figure 1). ^[2] During the discussion, the PO also mentioned he would require ASB for a number of other proposed worksites in the section between Warnervale and Wyee up till 1500. The PO nominated absolute signals V8 and V6, between Morisset and Vales Point, as the protecting signals for the ASB requests. The SM acknowledged the request for ASB telling the PO he would ‘get his offsider to cut in’. ^[3]

The SM commenced the process to grant ASB. Significantly, as this was happening (at about 1136), up freight service 4122 passed through Morisset, heading towards the proposed worksite at Warnervale.

At 1139, as part of the ASB process, the SM advised the NCO at Wyong and the Train Controller at Sydney North Control of the intention to switch the interlocking at Vales Point from automatic to local control. This was required in order to place blocking facilities on signals V8 and V6 as requested by the PO. Completing both calls, at 1141, the SM advised the Train Controller of the ASB request and provided all the assurances needed for the Train Controller to compile the ASB checklist. The Train Controller also acknowledged the likelihood of other ASBs being granted during the day and sought an assurance from the SM that they would be managed as required. This was despite its being a circumvention of the ASB process which does not provide for blanket authorisation for multiple ASBs.

In the meantime, the Police requested to view CCTV coverage of the station and surrounds for the purposes of the incident they were investigating. While viewing some CCTV footage in the signal box area, two persons of interest related to the incident were observed to be on station premises as well as an open staff car park gate. Concerned about the presence of these persons on the station premises and the open gate, the DM exited the signal box at 1144 to ascertain the location of the persons and close the gate. After searching various passenger areas around No.2 platform and closing the gate, he re-entered the signal box at 1147. As this was occurring, a second freight service, 4190, arrived at Morisset at 1146. As Signals V8 and V6 had not been set back to stop with blocking facilities applied at the time for ASB, 4190 continued on towards the worksite at Warnervale.

At 1147, the SM informed the NCO at Wyong of the passing of trains 4122 and 4190. Ending the call at 1148, he indicated that he would be handing over to the DM as he was ‘going home’.

At 1149, the DM, having assumed the role of NCO, telephoned the PO to advise that ASB had been granted since 1143. This was less than a minute after the SM had concluded the call with the NCO at Wyong and less than two minutes after the DM had re-entered the signal box and concluded with the Police. He gave the PO an assurance that signals V8 and V6 were at stop with blocking facilities applied and that the section was clear as a freight train should have just passed their worksite. The PO responded that no freight train had passed. Surprised, instead of immediately cancelling or fulfilling ASB, the DM instructed the PO to call back once it had passed.

Figure 1: Incident location

Source: NSW Trains annotated by OTSI

At 1151, the PO telephoned the DM to report that a freight train ‘with leading engine 44202’ had passed clear of the worksite. This engine was later identified as the leading engine on the first freight train, 4122. Although not fulfilled or cancelled, at 1152, after all assurances were given and received, ASB was again granted to the PO. Immediately, the workgroup commenced their maintenance tasks. The maintenance tasks involved the change-out and testing of an electronic control module associated with permissive Signal 66.8 located in the signal hut beside the level crossing at Warnervale. The change out of the module took less than a minute and testing commenced at 1153. The testing caused the aspect of Signal 66.8 to alternate between stop and proceed a number of times.

At 1155, as testing was continuing, a ‘Signal Passed at Danger’ (SPAD) alarm for Signal 66.8 activated in both Morisset and Wyong Signal Boxes. The alarm at Wyong was also accompanied by a report from the driver of 4190 advising that he had passed Signal 66.8 by approximately 500 metres after it had returned to stop in front of the train.

After receiving advice about the SPAD from the NCO at Wyong, the DM contacted the PO querying whether any of the workgroup’s actions had caused Signal 66.8 to return to stop in front of 4190. The PO responded that the workgroup had been testing the signal when the SPAD had occurred but queried how there was a freight train past the protecting signals (of the ASB). As the conversation continued, it became apparent that the DM had been confused about freight train 4190. Although it should have been visible on the local panel at the time in the vicinity of Wyee, 4190 had gone unnoticed in the approximately 14 kilometre long section between the last protecting signal (V6) and the worksite when the PO was first informed ASB was granted at 1151.

There were no injuries to any persons and no infrastructure damage.

Resulting safety actions

At 1201, the SM, who was still present in the signal box, resumed the role of NCO. He informed the PO that, because of the incident, ASB was cancelled pending notification and investigation by incident response officers.

Both the DM and the PO underwent post-incident drug and breath testing, subsequently returning negative results. Despite being directly involved parties, the SM, the Train Controller and the crew of 4190 were not assessed or breath tested post incident.

Sydney Trains acknowledged that the crew of freight service 4190 had not contributed to the incident, so were permitted to continue once cancellation of the ASB was completed. The incident caused minimal delay to 4190 and following services.

In response to the incident, instructions were issued that qualified staff from Sydney Trains would monitor the issue of any work on track authorities in the signal boxes operated by NSW Trains staff on the Main North line.

In February 2015, in response to this incident, Sydney Trains expanded a western network region trial of modified ASB procedures to include the signal boxes on the Main North line. The modified procedures, in essence, are designed to formalise the critical ASB details. Both the NCO (Signaller) and the PO are required to include the following on a standardised ‘job aid’:

• the exact worksite location
• the details of the last train to pass through the section and its current location
• an assurance that there are no trains between the protecting signals and the worksite
• an assurance that signals are set to stop with blocking facilities applied.

__________

2. In accordance with Network Rule NWT 308 Absolute Signal Blocking and Network Procedure NPR 703 Using Absolute Signal Blocking.
3. This was reference to the switching of all signal and point control at Morisset area of control from automatic control to local control managed by the NCO at Morisset.

Findings

From the evidence available, the following findings are made with respect to the incident involving the granting of Absolute Signal Blocking culminating in the passing of Signal 66.8 by freight service 4190 at stop without authority. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• There was a breakdown in the NCO handover process used at Morisset which resulted in ASB being granted to the Protection Officer at Warnervale without the exact location of trains being properly established, signals V8 and V6 being set back to stop and blocking facilities applied in accordance with Network Rule NWT 308. [Safety issue]

Other findings that increased risk

• Additional interim arrangements for Absolute Signal Blocking were not implemented at the time of the incident as the requirements listed in the memorandum of July 2013 had not been promulgated to all staff.

Other findings

• The documented process, as recommended in RO-2013-018 and currently being trialled in the modified ASB process, was not implemented at Morisset at the time but could have assisted during the NCO handover in determining where the granting of ASB had progressed.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 22 November 2014, at about 0600 Eastern Standard Time, a Robinson R44 helicopter, registered VH-YYS, departed from Mareeba, Queensland on a private flight with a pilot and one passenger on board. The helicopter engine had recently been overhauled, and the pilot had expressed concern about the quantity of oil the engine was using following the overhaul. He had been advised to conduct a longer flight to ‘bed in’ the engine.

The helicopter tracked via the coast to Cooktown where the pilot landed and refuelled. The helicopter had used about 1 L of oil during the 1.5 hour flight. From there the helicopter continued to Coen with two intermediate landings. In Coen, the pilot refuelled the helicopter and added 1 L of oil to bring the total oil quantity back up to 8 L. The helicopter then tracked to Archer River and departed there at about 1400, tracking towards the coast. 

When about 30 NM from Archer River and at about 1,300 ft, the pilot observed the engine revolutions per minute (rpm) decreasing rapidly. He immediately entered an autorotation and advised the passenger to brace for impact. The pilot sighted a clearing ahead landed.

The pilot and passenger quickly exited and observed smoke billowing from the rear of the helicopter, where heat from the helicopter’s exhaust ignited a grass fire. Within seconds the helicopter was engulfed by fire and destroyed. The pilot and passenger were uninjured.

A full strip down of the engine was not conducted following the accident. The magnetos were badly fire damaged and it was not possible to determine their serviceability at the time of the accident or the cause of the reduced engine rpm.

In this incident, the pilot was concerned about the serviceability of the helicopter. The cause of the power loss was unable to be determined. The incident highlights the importance of pilot decision making in determining whether to conduct or continue a flight when abnormal indications such as excessive oil consumption occur. 

Aviation Short Investigations Bulletin - Issue 39

On 16 November 2014, a Robinson R44 helicopter, registered VH-YDK (YDK), was approaching Jandakot Airport on a charter flight from Rottnest Island, Western Australia, with a pilot and three passengers on board. At about 1348 Western Standard Time, the pilot of YDK reported downwind for runway 24 on the Jandakot Tower frequency.

At about the same time, the pilot of a Bell 412 helicopter, registered VH-EWA (EWA), prepared to conduct a rescue flight to Bunbury, Western Australia, with a crewman and paramedic on board. As YDK turned onto final, at about 400 ft above ground level (AGL), the pilot of YDK sighted EWA outside its hangar and elected to continue the approach.

At about 1350, the pilot of EWA requested to taxi to the compass swing bay on the Ground frequency. As the pilot commenced taxiing, the crewman sighted YDK at about 150 ft AGL and on an approach towards EWA. He directed the pilot of EWA to go forward.

At about 1350, the pilot of YDK broadcast on the Tower frequency: ‘YDK just out your left hand window’. The pilot of EWA was monitoring the Ground frequency and did not hear that call. YDK then descended and passed behind EWA towards a landing on the middle of the grassed area.

The pilot of EWA continued to taxi towards the compass swing bay, and when approaching the bay, first sighted YDK which was then passing behind EWA and about 30 m away.

The environment and procedures in the helicopter precinct at Jandakot require that pilots make the mandatory radio calls, maintain a good lookout and taxi, depart and approach the area by the most predictable routes to assist others in sighting them.

Aviation Short Investigations Bulletin - Issue 39

The occurrence

A limited-scope, fact-gathering investigation into this occurrence was conducted in order to produce this short summary report and allow for greater industry awareness of potential safety issues and possible safety actions.

What happened

On 6 November 2014, the liquefied natural gas (LNG) tanker Northwest Stormpetrel completed loading cargo and left its berth in Dampier, Western Australia. The ship was then anchored in the harbour to allow the use of excess time in the schedule for its voyage to Japan for in-water lifeboat drills and other maintenance tasks.

The lifeboat drills and some maintenance tasks were carried out on 7 November. One of the tasks planned for the following day (before the ship sailed from Dampier) was to check the LNG forcing vaporiser’s¹ steam trap to resolve recurrent drainage issues with the system (Figures 1 and 2).

Figure 1: LNG forcing vaporiser

Source: Shell (photograph annotated by ATSB)

Figure 2: Steam trap and associated valves

Source: Australian Maritime Safety Authority (annotated by ATSB)

At 0745² on 8 November, Northwest Stormpetrel’s engineers discussed the planned task. The cryogenic engineer (cargo engineer) routinely carried out vaporiser-related maintenance and was familiar with its systems and the task.

At 0800, the cargo engineer and the integrated rating (IR) assigned to assist him met on the ship’s main deck. They discussed the task, reviewed its risk assessment and completed a toolbox talk.³ The cargo engineer then went to the cargo machinery room (CMR) on the starboard side of the main deck (where the vaporiser was located) to isolate the system before work on it could start. Meanwhile, the IR went to the engine room to fabricate a new gasket for the steam trap.

In the CMR, the cargo engineer isolated and locked out the forcing vaporiser’s steam supply, outlet, drain and bypass valves. After checking that the system was depressurised, he went to get a permit to work for the task.

The cargo engineer completed the permit to work with the chief engineer, who signed the permit to authorise the work. The cargo engineer then returned to the CMR and started dismantling the steam trap located below the vaporiser (Figure 2).

At about 0900, the IR came to the CMR with the new gasket for the dismantled and cleaned steam trap. The cargo engineer discussed the remaining work with him before re-assembling the trap. The system then needed to be de-isolated and returned to its normal operational condition.

Shortly before 1000, the cargo engineer walked around the vaporiser to check if everything was in order for de-isolating the system. Satisfied with the checks, he removed all the valve lock outs.

The cargo engineer then began carefully opening and closing steam valves, regularly checking if everything was normal. The IR stood by and kept watch for abnormal signs. After the vaporiser’s steam supply valve had been fully opened, the regulator was set to its normal working pressure.⁴

At about 1000, the cargo engineer decided to fully open the steam trap’s inlet valve that he had earlier cracked open. He had turned the hand wheel of the valve⁵ about one turn when the valve’s bonnet came away from the valve body. A jet of steam (about 50 mm wide) erupted from the top of the valve’s open body, scalding the cargo engineer’s hands, forehead and neck before he could move clear. After getting clear of the steam, he took off his gloves, safety glasses and hardhat. The IR helped him out of the CMR and, once outside, his boots and overalls were removed. They then hurried to the nearest safety shower and began cooling the cargo engineer’s burns.

At about 1002, the IR called Northwest Stormpetrel’s navigation bridge and reported the incident. The ship’s master initiated an emergency response and a shipboard medical team was tasked to attend the injured cargo engineer. The master then notified authorities ashore of the incident. At 1005, he asked for a medical evacuation to be arranged and then requested medical advice.

At about 1010, the cargo engineer was moved to the ship’s hospital where first aid continued. Over the next hour, he was treated as per medical advice obtained while awaiting evacuation.

At 1122, a helicopter with a paramedic on board landed on the ship. At 1142, the helicopter left with the cargo engineer on board. He was taken to the local hospital, where a doctor assessed his injuries as superficial and admitted him to a treatment ward.

Later that afternoon, representatives from the Australian Maritime Safety Authority (AMSA) and Northwest Stormpetrel’s managers, Shell International Shipping and Trading Company (Shell), boarded the ship to conduct their respective investigations.

The investigations found that the bonnet locking clip on the steam valve was missing (Figures 3 and 4) and this had allowed the bonnet to unscrew and come away from the valve body. The missing clip was not found, nor could it be established when or how it had been lost.

On 9 November, after a replacement cargo engineer had joined Northwest Stormpetrel and Shell’s safety investigation was completed, the ship sailed from Dampier.

Figure 3: Valve with locking clip missing

Source: AMSA (annotated by ATSB)

Figure 4: Similar valve with locking clip

Source: AMSA (annotated by ATSB)

ATSB comment

The steam valve’s bonnet had several threads and unscrewing it to the point of release would have required turning it several times. However, it was reported that the bonnet came away after the valve’s hand wheel was turned only one turn (to open). Therefore, it is likely that when the cargo engineer began to fully open the valve, the bonnet was already partially unscrewed and being held by very little thread. The nearly unscrewed bonnet and its missing locking clip may have been more readily apparent visually and by touch/feel, had the valve’s location been less confined, the lighting been better and greater vigilance been exercised.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Australian Maritime Safety Authority (AMSA)

As the ship’s flag State Administration, AMSA conducted a regulatory investigation and issued Northwest Stormpetrel’s master with an Improvement Notice that required the following action:

Improvement Notice

• Conduct a detailed analysis and review of procedures and precautions whilst working with pressurised systems.
• Specifically address isolation and de-isolation procedures to ensure adequate protection from injury.

Shell International Shipping and Trading Company (Shell)

Shell’s safety investigation identified a number of safety actions to avoid this type of incident.

Procedures and work practices

The safety actions covered shipboard procedures and practices dealing with risk awareness, risk assessment and work planning, permits to work, defective equipment and safety reporting.

Focus areas identified for better risk awareness included joining ship briefings, familiarisation, work site assessments, personal protective equipment and audits. The development of effective risk assessments, their review and using them for work planning and toolbox talks were also identified. An increased focus on permits to work, particularly for invasive and pressurised systems, and the completion and verification of permits were other identified focus areas. Checking for defective equipment and better reporting through training were also noted.

Safety message

Work on pressurised shipboard systems can potentially have a high risk of serious injury. Familiarity with repetitive tasks on these systems can sometimes reduce the perception of that risk. Therefore, it is important that the associated risk controls, such as risk assessments and permits to work, are periodically reviewed and carefully completed to effectively identify and mitigate all risks – including the presence of defective system components .

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported by industry. Marine work practices is one of those safety concerns.

Preliminary report released 19 January 2015

The information contained in this Preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the ongoing investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this Preliminary report. As such, no analysis or findings are included in this report.

The occurrence

At 2026[1] on 8 November 2014, train 735, a scheduled intermodal freight service conducted by TasRail as a driver only operation[2], departed from Burnie, bound for Rogerville (south of Brighton) in Tasmania. At 0300 on 9 November, there was a scheduled change of drivers at Conara Junction, with the new driver to take the train through to Rogerville.

Conara Junction is approximately 140 km from Rogerville by rail. Most of the journey is over rolling tablelands with gentle grades. The last 40 km of the journey includes the 13 km descent through Colebrook, with most of the descent having a posted track speed of 35 km/h due to the steep grades and tight radius curves.

Figure 1: Location map – Tasmania

Source: NatMap Railways of Australia

The passage of the train from Conara Junction to Rhyndaston Tunnel at the top of the grade, was uneventful. At 0512, the driver of train 735 called Train Control to report that the train was clear of the Rhyndaston tunnel and commenced descending the grade under dynamic braking[3].

At 0516 the train crossed the level crossing at Mud Walls Rd at 30 km/h. The train’s data logger showed that shortly thereafter, the speed had dropped to 20 km/h and the driver disengaged the dynamic brake. As the train gathered speed, the driver then reapplied the dynamic brake, followed by the train [air] brake. The train continued to gather speed, reaching 64 km/h as it approached the curve located at the 65 km post. As the train negotiated the curve, the driver placed the train brake into emergency. At the exit of the curve both locomotives left the track and rolled onto their sides into the cess drain (Figure 2). All but the last seven of the train’s wagons derailed and most lost their cargo/freight containers.

Figure 2: Locomotive TR10 at the derailment site

 

Source: ATSB

Events post-derailment

The TR class locomotives include a feature that automatically notifies train control if the driver makes an emergency brake application. Having received an alert that TR10’s emergency brake had been applied, the train controller attempted to call the driver of 735. The driver attempted to respond to the train controller’s call but was unable to locate the radio microphone in the overturned locomotive cab. The driver subsequently located a mobile phone and contacted the train controller to report the emergency. The driver was coherent but had sustained minor injuries.

The driver located the dangerous goods details for the train and exited the locomotive cab through an emergency exit[4]. The train controller commenced notifying emergency services and TasRail first responders, while the driver checked the train to ascertain the damage and the state of the various dangerous goods being carried as freight.

After it became evident that some dangerous goods liquids had been spilt, the Tasmania Fire Service was notified and dispatched to manage the spill.

Context

Location

The derailment occurred approximately 1 km north of Colebrook – about 40 km north of Hobart, near the 65 km post on the South Line in Tasmania. The South Line through this area runs in a north-south direction, forming a main arterial link between Launceston and Hobart.

Train and train crew information

Train 735 was a regular intermodal freight service that operated between Burnie and Brighton. The train consist comprised two locomotives at the head of the train (TR10 leading and TR07 trailing) followed by 16 loaded container wagons. The train had an overall length of 274.4 m and a gross mass of 1041 t.

Locomotives TR10 and TR07 were each equipped with data loggers and forward facing video cameras. The data logger and camera systems are used for recording train information such as date/time, speed, brake pipe pressure, throttle position, distance travelled and external imagery. Data from the recorders and video imagery were used by the ATSB in examining the sequence of events leading up to the derailment.

The driver at the time of the derailment had about 5 years train driving experience. The driver held the required qualifications to operate the train and had been assessed as competent to drive the route. Examination of the driver’s health assessment records confirmed that they met the required National Standard for Health of Rail Safety Workers.

Following the derailment the driver was tested for drugs and alcohol and returned zero readings.

Figure 3: Derailed Wagons on the right hand side of the track and wagons behind stacked on the track.

 

Source: ATSB

Examination of rolling stock

Examination of the derailed wagons and locomotives indicated that none of the derailed rolling stock had travelled far in a derailed state. The locomotive and the first six wagons had been cast to the right of the track and the next three wagons were stacked up on and about the track. Some containers from the train had separated from their wagons and were cast to the right of the track. The last seven wagons of the consist had not derailed and had retained their loads.

Initial on-site inspection of the rolling stock found no obvious defects or mechanical deficiencies that could have been considered contributory to the derailment.

Track Information

The Tasmanian South Line substantially comprised a bidirectional single track with crossing loops strategically located throughout its length.

The track through the derailment site was narrow gauge (1,067 mm) and consisted of 47 kg/m rail, fixed to concrete sleepers with resilient fastenings[5]. The track had been re-layed with new concrete sleepers about 1 year earlier.

The track leading into the derailment site was a set of reverse curves with a short tangent between the curves. The second curve was a left hand compound curve with a tight radius of 190 m, tightening further into a curve of 110 m radius. The grade of the track leading into the derailment site was downgrade about 2.4% (1 in 41) in the direction of travel. The posted track speed through this area was 35 km/h.

Examination of track post-derailment

Examination of the track identified a number of marks on the head of the right hand rail, consistent with wheels moving abruptly across, and running along the rail head. Clusters of sleepers had been damaged and pushed into bunches (Figure 4) adjacent to where the locomotives came to rest.

In the middle of the derailment site was a short transom-top bridge. The western side wing walls of both bridge abutments had impact damage, and apart from damage to the ends of a few bridge transoms, the track over the bridge appeared to be undisturbed.

Undamaged sections of track were measured for gauge, cant and curve radius. There was no evidence of track spread, and gauge widening was considered unlikely to have been a factor in the derailment. There was no evidence of any broken or fractured rail. The track structure surrounding the derailment site appeared to be well maintained and in good condition.

Figure 4: Sleepers pushed into bunches adjacent to locomotive TR10

 

Source: ATSB

Summary of initial investigation outcomes

The preliminary evidence available suggests that train 735 entered a 35 km/h speed rated curve, located at the 65 km post, at a speed of about 64 km/h. The train was unable to safely negotiate the curve at this speed. The leading wagons lost their containers to the right, one of which impacted the bridge abutments, before the locomotives and leading wagons overturned, rolling over the right hand rail. The remainder of the train was brought to an abrupt stop; causing further wagons to derail and some containers to be cast to the left of the track.

Ongoing investigation activities

The ATSB investigation is continuing and areas of focus will include:

• The methods adopted for handling trains through the Colebrook area
• Train braking performance
• Factors affecting driver actions and performance
• Effectiveness of driver training and accreditation processes
• The track alignment and inspection requirements.

Contact with the wharf by Big Glory

A limited-scope, fact-gathering investigation into this occurrence was conducted in order to produce this short summary report and allow for greater industry awareness of potential safety issues and possible safety actions.

What happened

At 0706[1] on 20 November 2014, two port pilots boarded Big Glory (cover) off Cape Flattery (Figure 1), where the ship was to berth for loading silica sand.[2] The pilot assigned to the pilotage task was very experienced and had performed about 70 pilotages into the port, including about 15 on Big Glory. As he was returning after 6 months leave, procedures required that he undergo a check pilotage.

Figure 1: Cape Flattery

Source: ATSB

Figure 2: Big Glory’s planned and actual positions

Source: Maritime Safety Queensland with ATSB annotations

Once on the ship’s navigation bridge, the pilot exchanged information with the master and discussed the pilotage plan (Figure 2). The pilot advised that the current in the area was flowing northeast[3]  at 0.2 knots[4] and high tide was at 0755. The wind at the time was from the southeast at 15 knots. The master confirmed that all the ship’s equipment, including the main engine, was in order. The officer of the watch and the seaman steering the ship were the other members of the bridge team.

At 0715, the pilot took over the conduct of Big Glory with the check pilot observing. He manoeuvred the ship onto the line of the approach leads using visual cues and the ship’s radar while progressively reducing its speed.

By 0740, the ship was positioned along the line of the approach leads about five ship lengths (about 1 km) from the wharf (Figure 2). Its speed was about 3.4 knots and decreasing with the main engine stopped. The pilot established radio contact with the loading supervisor on the wharf and asked him to report as the ship’s bow passed each breasting dolphin (BD) there. [5]

At 0744½, the ship’s speed had decreased to about 2.6 knots and the main engine was run dead slow ahead. Two work boats also arrived near the ship to assist, mainly to assist running mooring ropes when berthing. The port has no tugs and the workboats have limited tug ability.[6]

By 0746½, Big Glory’s speed had increased to about 3.5 knots. The main engine was stopped and then run dead slow astern. The pilot felt that the ship’s speed was not decreasing as expected and he was concerned the ship would overshoot the planned anchor let go position. Hence, main engine power was progressively increased, including about 30 seconds at full astern.

At 0749, the main engine was stopped and the ship was no longer moving ahead. At about this time, the wharf supervisor reported to the pilot that the bow was in line with BD1 (Figure 2). The pilot asked the master to have the crew standby to let go the port anchor.

At this stage, the pilot observed Big Glory being ‘rapidly set on to the wharf’ and considered aborting the berthing. He decided against aborting because he was certain that the ship’s ‘stern would make substantial contact with the wharf’.

A few seconds after 0749, the main engine was run ahead in an attempt to gain headway and manoeuvre Big Glory to the planned anchor let go position some 150 m ahead. The engine was run ahead at up to half power until shortly before 0751, when it was stopped. The ship’s bow was now about 60 m from the wharf and about 100 m away from the planned anchor let go position.

At 0751, the pilot asked for the port anchor to be let go and held on to with two shackles[7] on deck. The main engine was ordered astern and power progressively increased to full astern before it was stopped shortly after 0752. The ship’s headway reduced as it moved towards the wharf.

At about 0754, Big Glory made contact with the dolphin (Figures 2 and 4). The ship’s hull, at the aft end of number one cargo hold, was damaged about 1.5 m above the ballast water line. The shell plating was set-in in two locations about 1 m apart (Figure 3). Part of a steel bracket on the dolphin penetrated the plating leaving a hole about 180 mm x 60 mm. The bracket was partially torn off and the deck plating on the dolphin was dislodged (Figure 4).

Figure 3: Damage to the ship’s hull Source: Maritime Safety Queensland

Figure 4: Damage to the dolphin Source: Maritime Safety Queensland

Shortly afterwards, the wharf supervisor asked the pilot to move the ship clear of the wharf to allow an inspection of the damage to the dolphin. At 0756, the pilot began manoeuvring the ship off the wharf using the workboat forward to push on the starboard bow while heaving the anchor.

At 0810, Big Glory was clear of the wharf. The pilot handed over conduct of the ship to the check pilot and the ship was moved to a safe location within port limits.

At 1306, after some minor repairs to the dolphin were complete, the check pilot started manoeuvring the ship back to the berth. By 1420, the ship was all fast alongside the wharf.

On 25 November, temporary repairs to Big Glory’s hull to allow it to sail on the next voyage were completed. Subsequently, the ship loaded its cargo.

Maritime Safety Queensland investigation

Maritime Safety Queensland (MSQ), the regulatory agency responsible for pilotage at Cape Flattery, conducted an internal investigation into the incident that concluded that the pilot’s loss of situational awareness and error of judgment were the main contributing factors to the incident.

ATSB comment

As Big Glory approached the planned anchor let go position, astern propulsion was used for 90 seconds because the pilot felt that the ship’s speed was not decreasing. However, its speed was decreasing, and the ship stopped 150 m short of the anchor let go position. Ahead propulsion was then used for 90 seconds before the port anchor was let go in a position much closer to the wharf than planned (60 m instead of 150-160 m). The particular combination of the ships’ main engine and rudder movements in the prevailing wind and current resulted in a lateral movement (to starboard) towards the wharf. The use of two shackles of anchor cable as planned suggests that adjusting anchor/cable use to recover from the uncontrolled situation was not considered. Subsequently, the ship’s hull contacted the mooring dolphin with sufficient force to damage its shell plating and the dolphin. The pilot’s perception of the ship’s movement during the critical stages of the approach to the wharf is indicative of his situational awareness at the time.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Maritime Safety Queensland

As a result of its investigation, MSQ’s safety action included the following recommendations:

Pilotage procedures

• A review of the Cape Flattery pilotage plan to include an ‘abort’ position and a more accurate track to the ‘anchor position’.
• Portable pilotage unit (PPU) usage to be made compulsory for all Cape Flattery berthings.
• A requirement for pilots returning from leave exceeding 4 months to complete at least three mentored trips (inward) before undergoing a check pilotage.

Safety message

Bridge resource management (BRM) is critical to safely managing risks in a pilotage. Key elements of BRM include proper planning, execution and monitoring using all available resources. The use of electronic aids to navigation to support traditional methods of pilotage and navigation can significantly enhance the position monitoring ability and situational awareness of the bridge team and, thus, reduce the risk of an incident.

The ATSB SafetyWatch initiative highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. Maritime pilotage is one of the safety concerns, with further information available from the ATSB’s website.

What happened

On 18 November 2014, at about 1728 Central Standard Time (CST), a Robinson R22 helicopter, registered VH-HPH (HPH), departed from La Belle Downs Station, Northern Territory, for a local flight to check the progress of a bush fire, with the pilot and one passenger on board.

About two minutes into the flight, on climb and at about 300 ft above ground level, the pilot felt a vibration through the tail rotor pedals. The pilot decided to return to La Belle Downs station, turned the helicopter to the right and started a descent. The pilot was unable to stop the turn and the helicopter continued to descend and turn to the right. The helicopter started to spin in a tight circle and completed between five and six rotations before landing hard, bouncing once and then coming to a stop. The pilot performed the shutdown procedure and the pilot and passenger exited the helicopter. The pilot and passenger were uninjured. The helicopter was substantially damaged, including damage to the tail boom and both skids.

Pilot comment

After landing, the pilot observed that the tail rotor pitch link^[1] had failed (Figure 1).

Prior to the first flight of the day, the pilot reported carrying out a daily inspection without finding any defects. The pilot had then flown HPH for approximately 2 hours, prior to the accident flight.

Figure 1: Failed tail rotor pitch link

 

Source: Aircraft operator, annotated by the ATSB

Operator investigation

An examination of the tail rotor pitch links was conducted on behalf of the helicopter operator by a consultant in engineered-system failure analysis and the following was found (Figure 2):

• Alternating stress in the failed pitch link resulted in the initiation and propagation of a fatigue crack.
• The alternating stress in the pitch link resulted from failure of the spherical bearing to provide a low friction connection between the end of the tail rotor blade and the pitch link.
• The failed pitch link spherical bearing attached to the tail rotor had extensive wear. Axial wear of the spherical bearing was measured to be about 0.108 inch (2.743 mm).
• The intact pitch link spherical bearing attached to the tail rotor also showed signs of extensive wear. Axial wear of the spherical bearing was measured to be about 0.041 inch (1.041 mm).
• The factors that influence the rate of wear in the spherical bearing that attaches the tail rotor blade to the pitch link would not be expected to vary from helicopter to helicopter.
• No physical explanation was found as to why the specified inspection procedures (R22 Maintenance Manual, Chapter 2 Inspection, section 2.410) failed to detect bearing wear. Possible explanations beyond what could be ascertained by the examination were that the helicopter was operated in an exceptionally abrasive environment or the Teflon bearing lining was affected by some cleaning action.

Figure 2: HPH tail rotor pitch links

 

Source: Aircraft operator, annotated by the ATSB

HPH maintenance documentation

About 443 hours prior to the accident, at a 50 hourly inspection, the tail rotor pitch links (part number B345-3) were found to be unserviceable. Two new pitch links, with the same part number, were installed. The pitch link had failed about 2 hours prior to the next scheduled 100 hourly inspection. The maintenance release indicated that all the required daily inspections had been carried out and that there were no outstanding maintenance issues.

Manufacturer comment

The helicopter manufacturer was only aware of one other similar failure that occurred about 10 years ago. The manufacturer believed that the failure was as a result of the axial wear (about five times more than permitted) allowed binding to occur, with resultant fatigue failure to the pitch link.

Pilot operating handbook

Robinson Model R22 Pilot’s Handbook, Section 4 Normal Procedures Daily or Prefight checks, dated 20 April 2007 page 4-3, included an item to check the tail rotor pitch links for “No looseness”.

Robinson maintenance manual

The Robinson Maintenance Manual Model R22 contains inspection requirements to be conducted at the 100-hour or annual inspection. Section 2.410 Inspection procedures and checklist item 12. Rotor Hub Hinge Bolts, dated October 2014, required the condition of the pitch links and rod ends to be inspected. This inspection was to be in accordance with section 2.120 Push-Pull Tubes, Rod Ends, and Spherical Bearings (dated October 2014), with reference to Figure 2-1 (reproduced below in Figure 3). The inspection needed to meet the following conditions:

• the maximum allowed axial play of 0.020 inch (0.508 mm). The axial play of HPH’s failed pitch link was about 0.108 inch (2.743 mm) and the intact pitch link was about 0.041 inch (1.041 mm)
• the maximum radial play of 0.010 inch (0.254 mm) for the rod end spherical bearings
• with no looseness between the bearing outer race and the rod end housing.

The maintenance manual also contained a caution that the Teflon-lined bearings must not be lubricated or cleaned with solvent.

Figure 3: Robinson maintenance manual spherical bearing limits

 

Source: Robinson

ATSB comment

CASA SDR database search

The operator reported to the ATSB that the R22 helicopter tail rotor pitch links had been failing regularly in mustering operations. CASA provided information from their Service Difficulty Report (SDR) database from 1983 to 2014. The database showed three previously reported defects with the same part number tail rotor pitch link as HPH where the pitch link had failed (Table 1). Two of the failures had occurred in flight.

Table 1: CASA SDR database - Tail rotor pitch link failures

month/year of SDR	Failure	Time since new (hours)	Part number pitch link	Operation
09/2009	Tail rotor pitch link failed in flight.	434	B345-3	Mustering
11/2009	Tail rotor pitch link failed in flight. Spherical bearing attached to the tail rotor blade was found worn to limits.	562	B345-3	Mustering
04/2014	During the scheduled 100 hourly inspection the tail rotor pitch link fractured near the spherical bearing attached to the tail rotor blade.	289	B345-3	Unknown

CASA reported two important points in relation to the CASA SDR system:

in the case of the Robinson R22, there is no legislation requiring the manufacturer to be notified of the tail rotor pitch link failures in Australia that have been reported to CASA. While there is no requirement to provide this information, CASA usually provides data dumps of defect reports on an annual basis to North American NAAs [National Airworthiness Authorities including the US Federal Aviation Administration and Transport Canada].

CASA encourages the industry to pass the defect information to the approval holder [manufacturer] and, as part of any follow up action CASA is likely to send the information to the approval holder [manufacturer], foreign or domestic.

Safety message

Continuing airworthiness relies on inspections identifying damage so that parts can be repaired or replaced prior to failure. Therefore, scheduled maintenance inspections and the pilot’s daily inspection are a central element of the continuing airworthiness of the aircraft.

Regulators and aircraft manufacturers depend on accurate data to ensure the ongoing continued airworthiness of the aircraft. It is important that defects are reported to CASA through the Service Difficulty Reports (SDR) system, and to the manufacturer, so issues can be identified and rectified.

Aviation Short Investigations Bulletin - Issue 42

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. There are two tail rotor pitch links, one for each tail rotor blade. The pitch link connects the blade to the tail rotor pitch control assembly. The tail rotor pitch control assembly is connected via push pull controls to the pedals in the cockpit, which the pilot moves for directional control.