On 24 July 2013, the pilot of a Cessna 404 aircraft, registered VH-HVR, was preparing for a charter flight from Darwin to the Pigeon Hole aeroplane landing area (ALA), Northern Territory.
The pilot used the operator’s electronic flight planning system to generate the flight plan, which also provided coordinates for the ALA and stated that the runway direction was 18/36. The coordinates for the ALA had been previously entered into the GPS, which was to be used throughout the flight for navigation assistance.
When at 5 NM, on final approach to Pigeon Hole, the pilot noticed that the runway surface appeared overgrown with vegetation. The pilot configured the aircraft for landing. At about 300 ft above ground level, the pilot noted that there were no runway strip markers or windsock. The pilot then realised that the airstrip was closed, but due to the aircraft’s altitude, elected to continue the landing. During the landing, the aircraft struck vegetation, but the pilot did not believe the aircraft had collided with anything.
After landing, the pilot assessed the situation and elected to take off. During the take-off, the pilot confirmed that the engines were operating normally and after becoming airborne, observed the correct ALA about 2 km south-west of the Pigeon Hole Township.
The aircraft landed there without further incident. Minor damage had been sustained to the leading edge of the right wing and propeller.
This incident highlights the importance of reviewing all available information appropriate to the intended operation, including the condition and suitability of the selected landing area/s, and ensuring that operational documents are current. It also demonstrates the benefits of overflying an airstrip to assist with determining the suitability of the landing area and the need to be go-around prepared and go-around minded.
On 10 August 2013, an Airbus A320-232, registered VH-VGR (VGR) and operated by Jetstar Airways Pty Ltd was holding short of gate D2 at Melbourne Airport, Victoria. At the same time, a Boeing B737-800, registered VH-YID (YID) and operated by Virgin Australia Airlines Pty Ltd. (Virgin) was approved by air traffic control for a pushback from bay E1 once VGR was on the gate at bay D2. The dispatcher for YID assessed VGR was on the gate and commenced the pushback. During the pushback, the left wingtip of YID collided with the tail cone of VGR, damaging both aircraft. There were no injuries.
What the ATSB found
The ATSB found that the dispatcher for YID could not visually confirm the position of VGR relative to gate D2 and assessed that because the aircraft hadn’t moved, it was on the gate. The pushback ground staff followed the normal practice for a pushback from bay E1. However, this practice did not allow for visual monitoring of the left side of the aircraft, such as by using a wing walker. This meant it was not possible for the dispatcher to identify the collision risk in time to prevent the collision.
What's been done as a result
Virgin advised that following this occurrence, they issued a local instruction to ground staff, mandating the use of wing walkers from certain bays at Melbourne Airport, including bay E1.
Safety message
This occurrence highlights the importance of ensuring that adequate clearance exists prior to commencing pushback. This includes using sufficient personnel to ensure visibility of each side of the aircraft at all times.
The occurrence
On 10 August 2013, Airbus A320, registered VH-VGR (VGR) and operated by Jetstar Airways Pty Ltd (Jetstar), was flown from Sydney, New South Wales to Melbourne, Victoria. Upon arrival, the crew of VGR were cleared by the air traffic control surface movement controller (ground controller) to taxi to gate D2.
At 0930 Eastern Standard Time[1], VGR entered the apron en route to gate D2, when a Boeing B737-800, registered VH-YID (YID), requested pushback approval from gate E1 (Figure 1). YID was being operated by Virgin Australia Airlines Pty Ltd. on a flight to Maroochydore, Queensland. The controller advised the crew of YID that a Jetstar A320 was entering the apron behind them for bay D2 and that when that traffic was ‘on the gate’[2], pushback from bay E1 was approved.
The flight crew of YID reported that they saw VGR (the Jetstar A320) pass behind them from the reflection in the terminal window in front of their parked aircraft. The captain of YID relayed the pushback approval to the dispatcher, including that it could only commence once the A320 was on the gate. The dispatcher was standing to the right of the aircraft’s nose.
At 0931:34, as VGR approached the gate on bay D2, the automatic nose-in guidance system (NIGS) displayed a message ‘STOP-WAIT’. In response the flight crew stopped the aircraft short of the gate. The dispatcher on YID reported looking under the aircraft and observing that VGR was stopped. The dispatcher reported then waiting for about 15–20 seconds to confirm the aircraft remained stationary. As it did, the dispatcher was satisfied that VGR was on the gate and the pushback of YID could commence. Pushback began at 0931:46.
At 0931:58, the crew of VGR transmitted to the controller that they were holding short of the bay because of the NIGS. However, that message was over‑transmitted by another aircraft. Forty seconds later, the crew re‑transmitted the same message. The message was acknowledged by the controller, who requested to be advised when the aircraft was at the gate.
Neither the crew of VGR nor the controller mentioned the gate number during the transmissions. The crew of YID later reported they did not hear these transmissions.
At 0933:03, the left wingtip of YID contacted the tail cone of VGR immediately aft of the operating auxiliary power unit. The tail cone of VGR immediately aft of the auxiliary power unit separated from the aircraft and fell to the ground. The left wingtip of YID was damaged during the collision.
Following the collision, YID was towed back to gate E1 and VGR was marshalled to gate D2.
There were no injuries as a result of the collision.
Figure 1: Position of A320 VGR (in green), holding short of gate D2, and B737 YID (in grey) during pushback from Bay E1 at the time of the collision. The position of the dispatcher and tug for YID are also shown
During the pushback from Bay E1, the dispatcher of YID communicated with the aircraft captain via a headset that was plugged into the nose of the aircraft on the first officer’s (FO) (right) side. The dispatcher communicated with the tug driver by hand signal.
When the ground controller issued the conditional approval for a pushback to the crew of YID, it was acknowledged by the FO. The captain heard the transmission and relayed it to the dispatcher. In turn, once the dispatcher was satisfied of VGR’s location at Bay D2, they communicated the commencement of the pushback to the tug driver using hand signals.
The surface movement control radio frequency was used for communication between the ground controller and aircraft. This frequency was not normally used for direct communication between aircraft. During this period, the crew of YID were also monitoring other communication channels, including the cabin interphone, the company radio frequency and the dispatcher.
When VGR had to hold short of the gate at bay D2, the flight crew notified the ground controller. While not required to do so, this displayed good judgement and communication in an effort to ensure a common understanding of their situation.
Aerodrome information
Control of aircraft during airport ground operations
While flight crew need a clearance from the ground controller to be allowed to move their aircraft on the apron, responsibility for separation between a moving aircraft and any obstacles rests with the flight crew and supporting company staff (see Appendix A).
There are taxi lines marked for aircraft to follow when entering or departing from any bay/gate. Guidance lines also show pushback limits and where to disconnect from a tug after a pushback.
Clearance lines indicate the limit of an area on the apron where an aircraft may park and, once located ‘on the gate’, be assured of adequate clearance. An aircraft holding short of a designated gate may not be wholly beyond the clearance line and may therefore present a collision risk.
Nose-in guidance system
A nose-in guidance system (NIGS) is an automatic system for accurately guiding aircraft to the gate. The NIGS at bay D2 had a function that identified the shape of an approaching aircraft. Using this feature, the NIGS only provided guidance to the specific aircraft type that was programmed into the NIGS at that time.
If the NIGS did not identify an approaching aircraft as the correct type, it would not provide guidance. Instead, it would display a message ‘STOP-WAIT’ when the aircraft was about 20 m short of the gate.
Recorded information
Recorded flight data was obtained from both aircraft. The cockpit voice recording was available from VGR; however, the recorded audio from YID had been overwritten.
Audio recordings of the surface movement control radio frequency and data from the surface movement radar were also obtained.
Wreckage and impact information
The left wingtip of YID was damaged during the collision (Figure 2).
Figure 2: Damage to the left wingtip of YID
Source: ATSB
The tail cone of VGR aft of the auxiliary power unit (APU) and the APU exhaust duct separated from the aircraft (Figure 3). The bulkhead aft of the APU was buckled and there was also minor localised damage to the external skin.
Figure 3: Damage to the tail cone of VGR aft of the APU, looking from left to right of the aircraft
Source: ATSB
No other damage was identified on either aircraft.
Pushback procedures
Dispatcher
Under Virgin Australia Airlines Pty Ltd. (Virgin) operating procedures, the dispatcher was responsible for the guidance of the aircraft and for the avoidance of obstructions when the aircraft was under tow. They were responsible from the time that voice communications were first established with the cockpit, until the flight crew indicated the aircraft was clear to start taxiing under its own power.
The standard operating procedures stated:
The aircraft dispatcher is to stand in a position that gives clear visibility of aircraft wingtips or wing walkers and potential obstructions at all times.
From the dispatcher’s position to the front-right of YID on the day of the occurrence, it was not possible to see the left side of the aircraft during the pushback (Figure 4). During the ATSB’s observation of operations at Bay E1 the following day, it was similarly noted that the dispatcher’s position meant that the dispatcher could not see the left side of the aircraft (Figure 5).
Figure 4: Screenshot of YID during pushback,5 seconds before thecollisionwith VGR and showing the position of the tug and the dispatcher
Source: Melbourne Airport, modified by the ATSB
Figure 5: Pushback of the same Virgin flight from bay E1 on the next day
Source: ATSB
Once YID was pushed back from bay E1 on the day of the occurrence, it was turned slightly ‘tail left’ from the pushback driver’s point of view. The geometry of the aircraft and the tug meant the pushback driver was positioned well to the right of the aircraft’s nose. The dispatcher reported they could not safely change from one side of the aircraft to the other while the aircraft was moving. However, the dispatcher could walk on the side that gave a bigger field of view during any expected turn. In this occurrence, the dispatcher could have walked on the left side of the aircraft during the pushback.
The dispatcher reported that it was normal practice to walk on the side of the aircraft where the headset sockets were located, which for the 737 was the right side. The dispatcher reported they had never walked on the other side of the aircraft during a pushback before. It was also reported as being normal for the 737 to be pushed back from bay E1 without using a wing walker. This meant that normally only one wingtip could be monitored visually during pushback.
Before starting a pushback, dispatchers normally visually assessed the area for potential obstacles behind the aircraft. In this occurrence, the dispatcher did this by looking under and around the engines.
Pushback driver
The pushback driver reported that their attention was focussed on controlling the aircraft and the tug. As such, they were not concentrating on any collision potential during the pushback.
Wing walkers
The dispatcher was required to use a wing walker if they did not have clear visibility of the aircraft wingtips.
If a wing walker was used, the wing walker was responsible for monitoring the wingtip and tail clearances on that side of the aircraft.
Safety analysis
Introduction
The collision between the two aircraft occurred when the B737, VH-YID (YID) was being pushed back from gate E1. At that time the A320, VH-VGR (VGR) was holding short of gate D2 due to a STOP-WAIT indication from the guidance system. The following analysis will examine the factors leading to the collision.
Pushback approval and commencement
The ground controller issued a pushback approval to YID that required VGR to be on gate D2 before commencement. While this was accurately conveyed to the dispatcher by the captain of YID, from the dispatcher’s position at the front-right of YID, there were insufficient visual cues for the dispatcher to accurately determine that VGR had stopped at gate D2. While VGR was actually holding short of the gate, the dispatcher formed the opinion that the aircraft was on the gate based on the observation that it had been stationary for a period of time. This was consistent with their experience and as a result, they did not move to a position from where they could accurately assess VGR’s location.
After observing that VGR was stationary for a period of time, the dispatcher signalled the pushback driver to commence YID’s pushback. From the dispatcher’s walking position, it was not possible to see the clearance lines for bay D2 marked on the apron. It was also not possible for the dispatcher to see VGR’s fuselage or its position in relation to the gate. From the dispatcher’s perspective, YID obscured most of VGR. The operator’s standard operating procedures required the dispatcher to have ‘clear visibility of the aircraft wingtips or wing walkers and potential obstructions at all times’.
As was reported to be normal practice, a wing walker was not used in this case for a pushback from bay E1. In the absence of a wing walker, the dispatcher was not able to ensure the aircraft would not collide with potential obstructions during the pushback as there was no visibility of the left side of YID. Following this occurrence, Virgin Australia Airlines Pty Ltd. provided a local instruction to Melbourne Airport ground staff that stipulated the gates that required the presence of a wing walker prior to push back. Gate E1 was included in that list of gates.
Communication
The flight crew of YID did not recall hearing the transmissions between VGR and the ground controller. There were a number of factors that may have affected the crew being alerted by the communication:
the surface movement control radio frequency was very congested in the time leading up to the occurrence, being in use for about 96 per cent of the time
during the 2 minutes and 20 seconds between issuing pushback approval and the collision, the ground controller participated in sequences of transmissions between seven different aircraft and one ground tug
VGR’s transmissions were abbreviated and fast, likely as a result of the frequency congestion discussed above
VGR’s crew did not mention the gate number in their holding short transmission, nor were they required to as it was included in the ground controller’s initial contact with the crew
the pilots’ expectation that in the radio environment, messages would be directly addressed between the controller and a specific aircraft, and not broadcast generally. Pilots will therefore pay more attention to transmissions directed to their aircraft.
Given these factors, it is not reasonable to expect that the transmission from VGR could have alerted the crew of YID to the collision risk. In addition, in the lead up to the collision, the crew of VGR were communicating with their company to resolve the issue with the nose‑in guidance system at the gate. This limited their ability to identify and therefore react to the collision risk.
Findings
From the evidence available, the following findings are made with respect to the collision during pushback between Boeing B737-8FE, registered VH-YID, and Airbus A320‑232, registered VH‑VGR, at Melbourne Airport, Victoria on 10 August 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The dispatcher of the B737 could not visually confirm the position of the A320 relative to its assigned gate and incorrectly assessed that, as the aircraft was stationary, it was at the gate.
The pushback of the B737 was commenced with insufficient clearance from the A320, which was not identified prior to the collision as the dispatcher's position to the right-front of the B737 prevented observation of its left wing.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew of YID and VGR
the dispatch ground staff for YID
recorded data from both aircraft
recorded data from Melbourne Airport
Virgin Australia Airlines Pty Ltd. (Virgin)
Airservices Australia.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Airservices Australia, flight crew and ground staff from Virgin, flight crew from Jetstar Airways Pty Ltd and the Civil Aviation Safety Authority.
Submissions were received from the captain of VGR, the dispatcher of YID and Virgin. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 11 July 2013, a Sikorsky S-76C helicopter, registered VH-EXU, departed the heliport at Longford, Victoria on the first of a series of passenger ferry flights to a number of offshore platforms that were located throughout the Bass Strait oil and gas fields.
On departure from the Snapper platform for a return to Longford, the right engine failed. The helicopter descended rapidly toward the surface of the water.
The crew controlled the helicopter and secured the failed engine. In addition, in response to a right engine fire warning, the crew discharged fire extinguisher agent into the right engine compartment. A positive rate of climb was established and the helicopter was flown away before being escorted back to Longford by other company helicopters for a single-engine landing.
What the ATSB found
The engine failure was attributed to the fracture of a second-stage, high-pressure turbine blade. The liberated blade impacted and damaged adjacent blades with the resulting loss of power and associated increased vibration.
The engine and failed blade structure were inspected by the engine manufacturer. The manufacturer concluded that the failure was due to a combination of metal fatigue, blade creep and oxidation deposits. While a definitive cause for the blade fracture has yet to be determined, blade material, dimensional and quality assurance checks have ruled out any deficiencies.
In the absence of published data from the helicopter manufacturer, the operator had established helideck flight departure and approach profiles consistent with the performance capabilities of the helicopter. In this case, the lift-off from the helideck followed the operator’s standard departure profile. Given this profile, the helicopter descended to within 30 ft (9 m) of the sea surface during the recovery to stabilised flight.
What's been done as a result
In the absence of a conclusive cause of the blade fracture and remedial information, the operator imposed a service life limitation on their helicopters’ engine turbine assemblies that were fitted with the same blades. In addition, the engine manufacturer issued notifications to operators and introduced specific inspection requirements relevant to potentially affected turbine assemblies.
At the time of writing, the engine manufacturer was continuing its investigation into the cause of the blade fracture.
Safety message
This occurrence highlights how a situation can quickly change from normal operations to one where the flight crew have to deal with an in-flight emergency. In this respect, effective crew interaction, thorough pre-briefing and anticipation of what can go wrong has been shown to increase the likelihood of a successful outcome. Recovery from the engine failure and potential ditching, and return of the helicopter to Longford, reaffirms the benefits of those preparatory actions.
The occurrence
Background
At 0730 Eastern Standard Time[1] on 11 July 2013, a Sikorsky S-76C helicopter, registered VH‑EXU (EXU), departed the operator’s heliport at Longford, Victoria on the first of a series of passenger ferry flights to a number of offshore platforms that were located throughout the Bass Strait oil and gas fields. This involved dropping off and picking up passengers at each stage. The flight duration between platforms was relatively short, ranging between 3 and 11 minutes.
At around 0835 the flight crew landed on Snapper platform for the final passenger drop-off/pick-up before returning to the Longford heliport. On board the helicopter for the flight to Longford were 10 passengers and two flight crew. The captain was the pilot monitoring and the copilot the pilot flying.[2]
After the passengers and their baggage were loaded, the flight crew completed their pre‑take‑off checks and commenced lift-off at around 0843. With all cockpit indications normal, the helicopter was established in a low hover above the helideck for final systems checks prior to departure. The copilot commenced a vertical climb from the hover and, after achieving the required rate of vertical climb and height above the helideck, reached the take-off ‘committed point’[3]. At this point, the copilot selected a nose-down attitude and commenced flying away in a standard, descending profile.
The engine failure and recovery
The crew recalled that immediately after setting the nose-down attitude, there was a loud bang accompanied by significant airframe vibration. The helicopter yawed about 5° to the right and descended toward the sea surface. Numerous lights illuminated on the master warning panel and an aural warning alerted the crew of a significant problem.
Coincident with the loud bang, the captain noted an immediate split in torque between the two engines and a decay in the main rotor speed. The captain identified that the right engine had failed and transmitted a MAYDAY[4] radio call to the operator’s search-and-rescue (SAR) service via the Longford flight following facility.
Following the engine failure, electrical power to the flight and navigation displays on each pilot’s instrument panel was disrupted, momentarily shutting down both primary electronic flight information system screens. Among other information, these screens display the attitude of the helicopter. The loss of attitude information required the copilot to revert to flying the helicopter with reference to the natural horizon.
The captain recalled that during the emergency the helicopter descended to around 30 ft (9 m) above the sea surface. Due to uncertainty of whether sufficient performance could be restored before an emergency ditching, the captain was ready to activate the emergency flotation system until the helicopter regained altitude and safe flight was assured.
The copilot recalled a positive airspeed trend through 45 kt and, at 60 kt, commenced a gradual climb with a recovery of the main rotor speed. Control of the aircraft was maintained and the crew were able to stabilise the main rotor speed at 107 per cent. The crew decided that the best option was to fly direct to the coastline.
After stabilising at 500 ft, the flight crew completed the engine failure checklist and secured the right engine. A follow-up radio call to the Longford flight following facility by the captain updated the operator on the situation. The crew elected to continue the climb to a target altitude of 1,000 ft.
During the climb, and despite the engine already being shut down, the crew were alerted to fire indications in the exhaust region of the right engine. The crew reported that the exhaust temperature increased rapidly until it was ‘off the scale’. In response, the crew carried out the engine fire checklist. This included activating the engine’s fire handle, which discharged fire‑extinguishing agent into the right engine compartment. The exhaust temperature reduced to zero. A third radio call to Longford advised of the engine fire and that it had been extinguished.
As part of their ongoing checks, the flight crew determined that the available fuel quantity in the tank that was feeding the left engine was approaching a low level as the helicopter approached the coastline. In response, the crew activated the cross-feed function to supply fuel from the right tank to the operating left engine. This ensured adequate reserves for the remainder of the flight to Longford. A depiction of the approximate flight track is provided in Figure 1.
Figure 1: Approximate flight track from Snapper platform to the operator’s heliport at Longford
Source: Google earth, modified by the ATSB
Operator’s SAR capability and response
The operator maintained a SAR capability at their Longford heliport that used a dedicated Sikorsky S-76C helicopter from within their fleet. A rostered crew remained prepared and on call during normal operations throughout the day.
Following the crew’s MAYDAY call the SAR helicopter was deployed to intercept EXU along its return track. Another of the operator’s helicopters that was en route to a nearby platform was contacted by the Longford flight following facility to divert and escort EXU for the return flight. The crew of this helicopter conducted a visual assessment of EXU and advised that no external damage was evident.
At 0913 the flight crew of EXU conducted a single-engine approach and landing at the Longford heliport.
Both pilots held an Airline Transport Pilot Licence (Helicopter), an endorsement on the Sikorsky S‑76C (S-76C) helicopter and a valid Class 1 Aviation Medical Certificate. Both were designated by the operator as captains of the S76C helicopter type.
The captain of the helicopter, the more senior of the two pilots that day, was seated in the right seat. The copilot was seated in the left seat and maintained control of VH-EXU (EXU) throughout the emergency and return to the Longford heliport.
The operator maintained a training and checking organisation to manage aircrew flight competency with checks conducted on a 6-monthly basis. These checks included pilot response to a single-engine failure on reaching the take-off committed point. Examination of the pilots’ most recent training records showed that both had passed all of their competency checks.
The operator’s pilots were also required to complete S-76C simulator endorsement training. The copilot commented that the emergency training in the simulator and during their competency checks was invaluable in identifying and managing the engine failure on departure from Snapper platform.
The relevant aeronautical experience of the flight crew is outlined in Table 1 and Table 2.
Table 1: Copilot's aeronautical experience and relevant training
The S-76C is a four-blade, twin-engine, transport category helicopter capable of carrying two flight crew and up to 12 passengers (Figure 2). It is often used for offshore oilfield support due to its long range.
EXU was manufactured in the United States in 1995 and first registered in Australia on 21 July 1995. It had accumulated 13,084 hours total time in service and 73,192 landings at the time of the engine failure. In the event of a ditching, EXU was equipped with:
As EXU was operated in the private category, a flight data recorder was not fitted, nor was it required by regulation. The operator had installed an aftermarket condition monitoring system that recorded vibration data of critical components including the main and tail rotors, rotor drive systems and engines.
Figure 2: Sikorsky S-76C
Source: Helicopter operator
Engine information
EXU was powered by two Safran SA Turbomeca (Turbomeca) Arriel 1S1 turboshaft engines located above and to the rear of the passenger compartment. These engines consist of five modules, with the gas generator (GG) turbine located in Module 3.
Examination of the engine records for the right engine in EXU showed that Module 3 had accumulated 2,275 hours in service and 2,664 cycles since the last overhaul.
Turbomeca service bulletin (SB) 292 72 0151 was issued in June 1992 and specified the incorporation of modification TU-204 across all variants of the Arriel engine. This modification involved corrosion and erosion protection of the second stage, GG high pressure (HP2) turbine blades via application of a low-pressure plasma coating. Modification TU-204 was incorporated in Arriel 1S1 engines at manufacture.
Following reports of several uncommanded in-flight engine shutdowns attributed to HP2 turbine blade failures, the engine manufacturer implemented internal documentation and procedures to remove all TU-204 HP2 turbine blades during overhaul of Module 3. Consequently, SB 292 72 0151 was amended on 18 August 2000, to recommend removal of all TU-204 modified blades.
Subsequently, Turbomeca released SB 292 72 0347, effective from July 2008, which referenced the incorporation of modification TU‑347. This modification incorporated a redesigned HP2 turbine that was in accordance with the latest design standards.
The changes to the GG high pressure HP2 turbine as a result of the incorporation of TU-347 are illustrated in Figure 3 and include:
an increased turbine disc thickness
changes in the design of the blade locking system, fir tree root and blade
changes in the turbine disc materials
the addition of a damper device between the blade base and turbine disc.
Figure 3: TU-347 detail
Source: Turbomeca, modified by the ATSB
The HP2 turbine of the right engine in EXU had TU-347 incorporated when the Module 3 was last overhauled.
Airworthiness directive AD 2009-0236R1 was issued in November 2009 and required repetitive inspections to be carried out on the HP2 turbine in Arriel engines. Incorporation of SB 292 72 0347 terminated the requirements of the airworthiness directive.
Examination of the right (failed) engine
The failed right engine was removed from EXU and shipped to the engine manufacturer’s facility in Sydney, New South Wales where it was partially disassembled under the supervision of the ATSB. Module 3 of the engine and the oil pump assembly were subsequently transported to the engine manufacturer’s facilities in France. Here, the engine and oil pump were inspected under the supervision of the French aviation investigation agency, the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile.
The examination of Module 3 revealed significant damage in the turbine area. This included fracture of the No. 26 blade of the GG high pressure turbine assembly second stage wheel (HP2) with resulting impact damage to, and loss of material from a number of adjacent blades. The GG turbine rear bearing also exhibited signs of significant damage associated with heavy rubbing on the races and flattening of the bearing rollers.
Examination of the failed blade by the engine manufacturer revealed a fracture resulting from a combination of static and dynamic stresses associated with bending loads during operation. The fracture occurred on the aerofoil section about 6 mm above the platform.
Inspection of the fracture surface revealed two distinct regions nominated as area A and area B. Area B included the leading edge and accounted for approximately 83 per cent of the fracture surface. Area A included the trailing edge and covered the remaining 17 per cent of the fracture surface (Figure 4).
The fracture surface was examined using a scanning electron microscope. In addition, metallurgical testing of blade No. 26 was conducted, along with blade No. 27 for comparative purposes.
The blade No. 26 area B fracture surface was typical of overstress and sudden fracture. Several isolated areas of fatigue crack propagation near the trailing edge of the blade (Area A) were noted; however, the origin could not be determined. There was no evidence of blade creep or sign of foreign object damage.
The blade No. 27 fracture surface was consistent with static overstress resulting from the impact of blade No. 26. This phenomenon also explained the damage observed on a number of the other blades. No significant metallurgical discrepancies were identified between the blades that were examined.
The fractured No. 26 blade and adjacent damaged blades are shown in Figure 5.
Figure 5: Blade No. 26 and damage to the adjacent blades
Source: Turbomeca, modified by the ATSB
Examination of the engine oil pump and apparent damage to the GG turbine rear bearing determined that any damage to those items was consistent with secondary damage associated with the blade fracture. The loss of the blade resulted in the unbalance and rapid deterioration in efficiency of the GG assembly, and a loss of engine power.
The internal rub marks on the rotating parts were a result of the unbalanced state combined with the natural modes of vibration encountered during the engine slowdown.
Right (failed) engine maintenance history
Aside from an early morning observation during the pre-take-off checks that the GG speeds were difficult to match for both engines, the crew reported that, up to the point when the right engine failed, there was no pre-indication of a significant abnormality. As was normal, an engine performance trend check was conducted prior to the first departure from Longford and no significant deviations were apparent.
Depending on the modification status of the engine, the manufacturer required the operator to perform a periodic inspection of the GG turbine rear bearing for clogging. The inspection involved measurement of the quantity of lubricating oil exiting from the rear bearing housing. If this quantity was less than the 50 ml specified in the maintenance manual, remedial action was necessary. Maintenance records for the right engine indicated that the oil flow checks were consistently within limits.
The operator’s system of maintenance for its Arriel engines specified that the measurement and recording of engine vibration data was to be conducted at 300- and 750-hour operating intervals. The data was recorded using an externally-mounted, calibrated instrument and sensor that recorded the vibration sample from the engine ‘rear point’, on the Module 3 external casing.
Examination of the rear point vibration recordings for the right engine found that they were below the maximum limits published by the engine manufacturer and were certified acceptable by the operator.
Due to the sampling rate periods of the aftermarket condition monitoring system, the engine operating parameters, including vibration levels, nearest to the time of the engine failure were not logged.
Recording and monitoring engine cycles
To ensure engine serviceability and monitor necessary service life limits of the engine’s rotating components, the engine manufacturer required operators to monitor and record engine operating cycles. The definition of a cycle varied with the rotating component and, in the case of the GG in the Arriel engine, complete[8] and partial[9] operating cycles were recorded.
The operator of EXU used a software program to record and monitor engine cycles. This required pilots to add relevant flight information based on sectors flown and their attendant engine power settings. The software program was designed to calculate the cycle particular to the rotating component and recorded the progressive cycle count. The results of the engine recording/monitoring were documented in the operator’s maintenance records.
An independent assessment of the operator’s methodology and cycle count totals was conducted by the engine manufacturer following the occurrence. The assessment concluded that the process and records were satisfactory.
Weight and balance
The S-76C has a maximum take-off weight of 5,307 kg (11,700 lb). The operator’s load sheets indicated that EXU had 590 kg (1,300 lb) of fuel on board at Longford prior to departure. With the weight of the fuel, the occupants and their equipment, the take-off weight at Longford was calculated to be 5,196 kg (11,455 lb), which was 111 kg (245 lb) below the maximum take-off weight.
The take-off weight of EXU at Snapper platform was estimated to be about 5,026 kg (11,080 lb), including about 286 kg (630 lb) of fuel for the flight back to Longford. The estimated take‑off weight was 281 kg (619 lb) below the maximum take-off weight and within the operator’s allowable weight restrictions given the ambient air temperature and pressure.
Meteorological information
The crew reported the conditions for the departure from Snapper platform as including a westerly wind of 5 kt (10 km/h), no visible cloud or adverse weather and an ambient temperature of 12 °C. The QNH[10] was reported as 1,034 hPa.
Platform/helideck operations
Snapper platform
Snapper platform is located approximately 40 NM (74 km) east of the Longford heliport and is one of a number of offshore oil and gas production platforms within the Bass Strait region.
Snapper platform was constructed with a helideck large enough to cater for two S-76C helicopters (Figure 6). The helideck is about 44 m (145 ft) above the sea surface and is constructed to provide an obstacle free zone when the correct take-off profile is flown.
Figure 6: Snapper platform and helideck, looking east
Source: Helicopter operator, modified by the ATSB
Helicopter performance
The operator’s fleet of S-76C helicopters was the primary means of transport for personnel working offshore, allowing the oilfield workforce to be ferried from Longford to the Bass Strait platforms, or transferred from one platform to another. The operator conducted over 4,000 S-76C flights per year in this role.
The operator conducted its flights in the S-76C in either of two multi‑engine helicopter performance categories:
Category A operations were those where, in the event of an engine failure, the helicopter had adequate performance to safely continue or reject the take-off or landing. In order to meet these criteria, a reduced take-off weight may be required. However, Category A operations could not be conducted from elevated platforms due to performance limitations.
Category B operations did not meet the operator’s Category A criteria. In the event of an engine failure during Category B operations, performance was available to enable the helicopter to safely continue the flight, except when the failure occured early in the take-off or late in the landing. In these cases, a forced landing may be required. The operator’s helicopter flights to the Bass Strait offshore platforms were conducted as Category B operations.
The operator’s Flying Operations Manual described a Category B departure profile employed for all helideck departures in the S-76C. In the course of the departure, a committed point is determined. This point is defined as the height above the helipad from which the helicopter can sustain an engine failure and continue the departure with one engine inoperative. If the take-off is rejected prior to the committed point, the helicopter is landed back on the platform.
The Category B departure profile requires the crew to establish the helicopter in a 5 ft (1.5 m) hover above the helideck before checking the available engine power. The pilot flying then climbs the helicopter vertically to at least 25 ft (7.5 m) above the helideck and confirms a minimum rate of climb of 200 ft/min passing through that height. The pilot flying makes a decision and ‘commits’ to continuing the departure. A rejected take-off will no longer be attempted. The pilot flying rotates the helicopter to a nose-down attitude of 15° and accelerates to the take-off safety speed while climbing to 250 ft above mean sea level. From this height, the helicopter is climbed at the best rate of climb speed.
In all cases, payload is offset against helicopter performance taking into account the ambient conditions and operational requirements.
Figure 7 provides a representation of the operator’s Category B departure from an offshore platform with all engines operating and an estimation of EXU’s profile following the engine failure.
Figure 7: Elevated helideck profile showing a representation of the operator’s Category B departure with all engines operating (in black) and an estimation of the departure profile for the occurrence flight (in red)
Source: ATSB
Operator activity
The operator’s activities were characterised by short-distance flights between offshore platforms and multiple flight sectors. Such operations result in engine cycle counts accumulating faster than operating hour limitations. An increased frequency of cycle-based maintenance results.
Engines are maintained in accordance with the engine manufacturer’s requirements with emphasis on engine operating cycle counting for service life tracking of critical rotating components. Engine rinsing was conducted at the end of the day’s flying, supplemented by periodic chemical cleaning of engine compressors and turbines as per the engine manufacturer’s requirements.
Related occurrences
Australian occurrences
The operator had three occurrences of HP2 blade failure between 1996 and 2001, all involving Arriel 1S1 engines. All were investigated by the ATSB and involved earlier-modification engines (pre TU-347) than those in EXU.
All of the ATSB investigation reports are available from the ATSB website.
On 9 September 1996, an S-76C helicopter experienced an in-flight engine failure of the right engine while taking off from an oil platform. A loud noise was heard before the engine failure. The right engine was shut down and the crew completed an uneventful single-engine return to the operator’s Longford base. There was no associated engine fire. The right engine was removed and sent to the manufacturer for disassembly and examination.
The manufacturer provided the operator with a final report noting the rupture (separation) of one GG turbine blade and subsequent rear bearing damage and GG seizure. The report stated that the separation was suspected to be the result of blade rubbing with the second stage nozzle guide vanes. There was no sign of fatigue as a factor, or abnormal over temperature operation of the engine.
On 7 February 2001, an S-76C helicopter with two crew and 10 passengers on board, was in a hover as the flight crew completed their before take-off checklist. The pilot reported that while trimming the engines, a ‘pop’ was heard. The left engine turbine gas temperature was noted in excess of 1,000 °C. The helicopter was landed uneventfully. The flight crew reported that the only other cockpit indication of a problem was the almost simultaneous illumination of the left engine chip (magnetic particle) detector advisory.
The manufacturer's final report noted a separation of the No. 6 turbine blade of the GG second stage disc. The blade separated above the ‘fir tree’ attachment point but below the blade platform, before puncturing the second stage nozzle guide vane turbine ring.
On 11 July 2001, an S-76C helicopter was in cruise flight with the automatic flight control system engaged, when the flight crew noted a loud noise and the helicopter yawed and rolled to the left and pitched nose-down. The right engine-out and fire‑warning annunciators illuminated and the engine-out aural warning sounded. The right engine GG RPM reduced to zero and extremely high turbine outlet temperature was indicated. The crew activated the right engine fire bottles and closed the fuel firewall shut-off valve before completing a single-engine landing at their base.
Disassembly and preliminary examination of the engine revealed the separation of one GG second stage turbine blade. Blade No. 16 was separated above the blade ‘fir tree’ attachment point but below the blade platform, and punctured the second stage nozzle guide vane turbine ring. The rear bearing of the GG had collapsed and was significantly damaged.
International occurrences
French Direction générale de l’aviation civile
The French Direction générale de l’aviation civile advised of a further three occurrences involving GG turbine blade failures. All occurred in earlier-modification engines (pre TU-347) than those in EXU.
Engine manufacturer
The engine manufacturer advised of four GG turbine blade failures in the second stage high pressure turbine of engines incorporating TU-347-modified turbine assemblies. This modification was incorporated in the engines in EXU.
The failures were attributed to foreign/domestic object damage[11] (two events) and an isolated failure associated with blade creep[12]. The fourth failure was attributed to a combination of blade creep and fatigue. Of the failures associated with blade creep or fatigue, oxidation was also present on the blade surfaces. All of the blade failures were isolated to individual blades with varying impact on engine operation. The blade failures did not result in in-flight engine shutdowns.
The engine manufacturer advised that since inception in July 2008, there were in excess of 2,400 modules in service with modification TU-347 incorporated and that the fleet had accumulated 4.1 million flight hours. Given the low number of failures, the risk of further failures can be considered to be low.
A review of a number of international accident databases was also conducted by the ATSB. This review showed no clear indication of TU-347-related engine issues or failures.
Flight operations to offshore platforms present unique challenges in terms of the physical environment, characteristics of the platform and helicopter performance. In addition, more involved and generally frequent maintenance is carried out on aircraft undertaking such operations. In this respect, no deficiencies in the operator’s maintenance practices were identified that may have contributed to the engine failure.
In this occurrence, the engine failure occurred at the most critical point during the departure from the platform, resulting in a significant loss of engine power and helicopter performance and the helicopter coming to within 30 ft (9 m) of the sea surface before flying away. This analysis will examine the nature of the engine failure and a number of operational aspects that increased the likelihood of a successful recovery from the failure.
Engine failure
Service Bulletin 292 72 0347 referenced the incorporation of modification TU‑347 in Arriel 1S1 engines. This modification, which incorporated a redesigned high pressure turbine assembly second stage (HP2) wheel that accorded with the latest design standards, had been incorporated in the engines in VH-EXU (EXU).
In an effort to understand the associated risk, the ATSB’s occurrence database and reports from the French Direction générale de l’aviation civile and the engine manufacturer were reviewed. This review indicated that, apart from an overseas engine failure involving a TU‑347‑modified engine that is still under investigation, the loss of the blade from the HP turbine and ensuing engine failure in EXU was the first involving a TU-347-modified Arriel 1S1 engine. The review also identified four previous occurrences that, while they did not result in engine failure or an in-flight shutdown, they did impact on engine operation. The manufacturer determined that in two of the events, creep/metal fatigue and oxidation deposits were factors.
The engine’s vibration monitoring system did not capture the engine vibration levels immediately preceding and after the blade fracture. This was a consequence of the system’s vibration sampling rate. The availability of vibration data closer to the blade fracture had the potential to better inform the investigation as to the nature of the fracture.
At the time of writing this investigation report, the engine manufacturer’s examination of Module 3 and the oil pump assembly from the right engine of EXU has identified no clear evidence of the cause of the blade fracture. The fatigue cracking to blade No. 26 was not discernible ahead of the blade fracture and assessment of the other blades in the affected engine did not reveal discernible defects.
In the absence of a conclusive cause, the engine manufacturer has continued its investigation into the blade fracture. This includes an examination of the manufacturing processes and a number of environmental and operational factors. Several potential contributing factors related to materials, dimensional and quality checks have been eliminated. The engine manufacturer acknowledged that the TU-347 blades were implicated in this occurrence, with the fracture being linked to the geometry of the aerofoil.
As of the date of this report, the engine manufacturer’s investigation concluded that the fracture occurred due to a combination of metal fatigue, blade material creep characteristics and oxidation origins. However, the definitive cause of the fracture remained unknown. The manufacturer reported that blades within excess of 2,000 operating hours or 2,300 cycles may be more susceptible to failure. The manufacturer is in the process of identifying potentially affected blades. Given the number of TU-347-modified modules in service and the amount of hours flown, the rate of failures is low. The associated safety risk is therefore considered to be low.
Aircraft operator
The operator’s Category B departure profile allowed crews to use their discretion and vary the committed point based on ambient conditions and aircraft payload. In this respect, the aircraft’s payload is adjusted to suit the characteristics of the specific platform.
In the event of an engine failure after passing the committed point, crews aim to convert height to speed while maintaining rotor RPM within limits using the available emergency power from the operative engine.
The operator’s Flying Operations Manual directed pilots to assess whether performance is improving or deteriorating during a one engine inoperative departure. In the case of a deteriorating situation, crews prepare for ditching. Where performance is improving or static, one engine inoperative power limits are observed and airspeed is monitored before being set at the best rate of climb speed with the landing gear retracted.
In combination, the operator’s focus on crew and simulator training in the management of single‑engine emergencies, and the crew’s actions in response to the engine failure in EXU, increased the likelihood of a successful outcome.
Findings
From the evidence available, the following findings are made with respect to the engine failure sustained by Sikorsky S-76C helicopter, registered VH-EXU, near Snapper Platform helicopter landing site, Bass Strait, Victoria on 11 July 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The No. 26 blade separated from the right engine high pressure turbine assembly second stage wheel, impacting adjacent blades and resulting in a significent loss of engine power.
The significant power loss of the right engine considerably reduced the helicopter’s performance during a critical phase of flight.
Other factors that increased risk
While the engine manufacturer identified that the No. 26 blade of the high-pressure turbine assembly second stage wheel fractured due to a combination of fatigue, creep and oxidation, the specific factor leading to the fracture has yet to be determined.
Other findings
In combination, the operator’s focus on crew and simulator training in the management of single engine emergencies, and the crew’s actions in response to the engine failure in VH‑EXU, increased the likelihood of a successful outcome.
Safety issues and actions
The ATSB did not identify any organisational or systemic issues that might adversely affect the future safety of aircraft operations. However, whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action taken by the helicopter operator
The helicopter operator advised that, in response to this occurrence, they reviewed the reliability of the Arriel 1S1 engine second stage, gas generator high-pressure turbine blades in their fleet of Sikorsky S-76C helicopters. In particular, the operator examined those turbine blades that have been modified in accordance with the engine manufacturer’s service bulletin SB 292 72 0347. As a result of that examination, while the manufacturer’s published service life for the turbine blades is 6,000 hours, the helicopter operator has imposed its own life limit of 2,000 hours.
Proactive safety action taken by the engine manufacturer
The engine manufacturer initiated a series of actions in response to the engine failure, including:
issuing Service Letter No. 2888/13/AR1S in July 2013, which advised operators of the occurrence and the manufacturer’s preliminary lines of enquiry
issuing Information Letter Arriel1/002/14 in November 2014, which advised field technicians and maintenance centres to pay close attention to TU-347 blades for damage and report the results (at the time of this report, the manufacturer had received no reports of damaged TU‑347 blades)
issuing Service Bulletin 292 72 0845 on 19 January 2015, which required a one-off visual inspection of the free (power) turbine blades in Arriel 1 series engine variants
amendment of the Arriel 1 series engine Repair Manual, effective mid-2015, to specify a dye penetrant inspection of TU-347 blades whenever an engine was returned for repair.
In addition, the engine manufacturer advised that it was in the process of developing a service bulletin for distribution to operators once any potentially affected TU-347 blades were identified.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew of VH-EXU
the helicopter operator
Safran SA Turbomeca
the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew of VH-EXU, the helicopter operator, Safran SA Turbomeca, the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile and the Civil Aviation Safety Authority.
Submissions were received from the helicopter operator, Safran SA Turbomeca and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 5 August 2013, a Cirrus SR22T aircraft, registered VH-LBQ, was being operated on a private flight from Archerfield to Kingaroy, Queensland.
On approach to Kingaroy, at about 500 above ground level (AGL), the pilot extended the flaps and shortly after, disconnected the autopilot (AP). Upon disconnecting the AP, the pilot reported that the aircraft pitched-up violently due to trim runaway. The AP pitch trim was trimming the aircraft for a nose-up position, even though the AP was disconnected. This required the pilot to use a large amount of forward physical force to maintain stable flight. He attempted to resolve the problem by pressing and holding the autopilot disconnect switch (AP DISC), however, this had no effect. The pilot conducted a go-around.
He then used the manual electric trim (MET) hat switch located on the control yoke, in an attempt to trim the aircraft nose-down. The pilot was able to regain sufficient control of the aircraft and land safely at Kingaroy.
On the basis of the evidence available to the ATSB, it was not possible to determine, with any certainty, the reason for the pitch-up event.
This occurrence highlights the safety benefit to be gained from going around, which allowed the pilot time to troubleshoot and prepare for landing with the pitch trim difficulties. This decision helped ensure the aircraft landed safely.
At about 2121 on 14 July 2013, Pacific National intermodal freight train 6MP5 overran the limit of its authority at Blamey, Western Australia. The train travelled 23 km into the Blamey to Curtin section before the crew realised the overrun had occurred and stopped the train.
The crew did not immediately report the overrun to the Network Control Officer as required. Instead, they provided misleading information about the train’s location and that they were having problems with the on board communication systems. Unaware of the authority overrun, the Network Control Officer issued a Train Authority for train 6MP5 to proceed from Blamey to Parkeston.
The train crew signed off duty at Parkeston and after reflecting on their actions reported the occurrence to the Pacific National Kalgoorlie Depot Manager the following day.
What the ATSB found
The ATSB found that during the safety critical period approaching the limit of authority at Blamey, the train crew had focused their attention on planning for the upcoming refuelling at Parkeston. As a result, they were distracted from the primary task of driving the train and missed vital cues and information that identified the limit of the current train authority.
The investigation also found that there were inconsistencies in the instructions contained in the various Pacific National procedural documents relating to refuelling at Parkeston.
What's been done as a result
Pacific National has amended procedures related to the arrangements for refuelling trains at Parkeston to remove inconsistencies and ensure that ancillary tasks do not have the potential to distract train crews from undertaking safety critical work.
Safety message
Train crews must be cognisant of and apply the operational procedures intended to prevent or control the consequence that may arise from an overrun of authority.
Rail transport operators should ensure that any ancillary tasks undertaken by a train crew do not have the potential to divert attention away from the safe operation of a train.
On 31 July 2013 at about 1500 Eastern Standard Time, an instructor and pilot under review departed Bankstown, New South Wales, in a Bell 206B helicopter, registered VH‑EPQ (EPQ), to conduct a Helicopter Flight Review. The pilot under review flew the helicopter to just south of Bringelly to conduct aerial work.
The crew conducted practice autorotation’s with the plan to go-around at about treetop height. The instructor reported that because they intended to go-around, the flare was conducted higher than if they had planned to land on the ground.
At the commencement of the last autorotation, the instructor noticed that the pilot was heavy on the controls. At the flare point, the instructor attempted to increase the throttle, but he was unable to apply pressure in time. At that stage, the helicopter was too low to be able to apply power and go around, but too high for a normal landing flare.
The helicopter struck the ground heavily and one rotor blade touched the tail cone resulting in substantial damage, the crew were uninjured.
On 7 August 2013, the student pilot of a Robinson R22 helicopter registered VH-EGN (EGN) departed from the parking area near the flying school hangar to conduct a session of solo circuits at Camden Airport, New South Wales.
The student had been checked by his instructor earlier that morning and already conducted some solo circuit practice and returned to the parking area.
At the end of the solo circuits, the student taxied EGN back toward the hangar. Facing east, and hovering about 3ft above the ground, the student commenced a left pedal turn to position the helicopter in a westerly direction for landing. The helicopter commenced turning left. When in a downwind position, the student reported that the helicopter weather-cocked into wind and the rotational speed rapidly increased.
The student unsuccessfully attempted to regain control of the helicopter. He then lowered the collective to put EGN on the ground. The right skid struck the ground first, followed by the tail rotor. The student, who was not injured, exited the helicopter. EGN sustained substantial damage.
The United States Federal Aviation Administration (FAA) Helicopter Flying Handbook states that the nose of a helicopter will attempt to weather cock into the relative wind when a tailwind from 120° to 240° is experienced. If sufficient resisting pedal input is not made by the pilot, the helicopter will start a slow, uncommanded turn to either the left or right, depending on the wind direction. If the yaw rate is allowed to develop and the tail of the helicopter moves into this region, the yaw rate can accelerate rapidly. The FAA further stated that, when approaching the downwind portion of a turn, anticipate the helicopter’s tendency to weathercock by applying pedal pressure opposite to the direction of the turn.
On 31 July 2013, a Bell 206B helicopter, registered VH‑SMI, departed Horn Island, Queensland for an aerial filming flight about 5 NM to the north‑east, at the Tuesday Islets. The purpose of the flight was to film a 20 m vessel travelling back and forth along a channel in between the Islets.
After having completed four passes over the vessel, the pilot positioned the helicopter for the next pass. Maintaining 200 ft, the helicopter approached the vessel from behind and to the left. The vessel was travelling into wind. As the helicopter flew abeam the vessel, the pilot initiated a climb and then commenced a right turn to pass in front. At that time, the pilot was monitoring the view finder to ensure that the helicopter’s skids did not impede the film shot.
After having completed the film shot, when at about 450 ft, the helicopter entered an uncommanded yaw right by about 25-30° and started to experience a loss of tail rotor effectiveness (LTE). The helicopter rotation stopped momentarily, but shortly after, it began to yaw right again. Despite the pilot’s attempt to recover the situation, the helicopter continued to yaw right and descend. When below 100 ft, the pilot determined that he was unable to recover, and he prepared for a forced landing onto the water. The emergency flotation system was activated, and the helicopter landed on the water. The occupants received nil injuries.
As a result of this occurrence, the helicopter operator has advised the ATSB that all company pilots will be required to demonstrate their ability to recover from an LTE event during regular flight checks with the Chief Pilot.
Certain operations, such as low speed aerial filming/photography flights, lend themselves to being more at risk to LTE than others. If a helicopter was placed in conditions conducive to LTE, it is crucial that pilots not only recognise the onset of LTE, but respond immediately and appropriately before the situation develops.
On 29 July 2013, about 64 NM (119 km) from Sydney the captain of Bombardier DHC-8-315 (Dash 8) aircraft, registered VH‑SBG and operated by QantasLink on a scheduled flight from Sydney to Wagga Wagga, New South Wales noticed a blank area in the centre of the flight management system (FMS) screen. About 10 minutes later the screen went completely blank and thick, light-grey smoke was observed coming from the unit.
The flight crew commenced the quick reference handbook Fuselage Fire or Smoke checklist, donning oxygen masks and smoke goggles. The crew found communication difficult while wearing their masks and, as a result, removed the masks for the remainder of the flight. The aircraft was diverted to Canberra, Australian Capital Territory. The flight crew were taken to hospital for observation and later released without needing treatment. No injuries were reported by the cabin crew or passengers. The aircraft sustained no other damage.
What the ATSB found
Examination of the FMS unit found that two capacitors failed, resulting in the smoke and failure of the unit. The unit was manufactured in 1997 and, in 1998, the FMS manufacturer introduced a modification to replace those capacitors in all subsequently manufactured units. However, there was no recall or retrofit program for unmodified FMS units already in service.
The ATSB also found that, at the time of the occurrence, the approved QantasLink training did not provide sufficient familiarity to first officers in the use of oxygen masks and smoke goggles. The more-experienced captain’s familiarity with the equipment was enhanced by completion of additional mask and goggles training sessions.
What's been done as a result
In October 2013, as a result of this occurrence, the FMS manufacturer issued a service bulletin for the optional incorporation of different capacitors to unmodified in-service FMS units.
QantasLink undertook a number of safety actions in response to this occurrence. This included installing modified FMS units to all aircraft in its Dash 8 fleet. QantasLink has also implemented a number of improvements to crew training, including improved oxygen mask and smoke goggle training and identifying alternate stowage for the flight deck fire extinguisher.
Safety message
This occurrence highlights the importance of flight crew familiarising themselves with the operation of the onboard emergency equipment. It also reminds crews that inhalation of fumes can have an adverse effect on an individual’s ability to function. Flight crew need to fully consider the implications of removing their emergency breathing equipment when in an environment where smoke and fumes are, or have been, present.
The occurrence
At about 1130 Eastern Standard Time[1] on 29 July 2013, the crew of Bombardier DHC‑8‑315 (Dash 8) aircraft, registered VH-SBG and operated by QantasLink, departed Sydney on a scheduled flight to Wagga Wagga, New South Wales. On board were two flight crew, two cabin crew and 49 passengers. The captain was the pilot flying,[2] and the first officer (FO) was the pilot monitoring.
About 64 NM (119 km) from Sydney, the captain noticed a 30 mm diameter ‘blank’ area in the centre of the flight management system (FMS) screen. The crew were still within radio contact range with QantasLink ‘maintenance watch’ so technical advice was sought. While the captain was talking to maintenance watch, the blank area disappeared and normal FMS function resumed. On receiving that information, maintenance watch personnel advised the crew that it was safe for the flight to continue to Wagga Wagga.
About 10 minutes later, the crew observed the FMS screen go completely blank, with thick, light‑grey smoke coming from the unit. At that time, the aircraft was out of radio range with maintenance watch so further advice could not be obtained. The captain reported that when the FMS screen went blank, it emitted a solid stream of light‑grey smoke for about 5 minutes. The smoke reduced to puffs of about 30-second intervals, before finally stopping about 3 minutes before landing.
There were no warnings or alerts while the solid stream of smoke was visible. The captain reported that immediately preceding the loss of the FMS screen, the presentation of navigation information was degraded.
At the first sign of smoke, the FO removed the Quick Reference Handbook from its stowage and commenced reading out the checklist action items for the non‑normal/emergency procedure Fuselage Fire or Smoke (appendix A). This resulted in the crew donning their oxygen masks and smoke goggles. The FO also removed the portable fire extinguisher from its stowage at the rear of the centre console and passed it to the captain.
The captain could not see anywhere in the FMS unit into which to discharge the extinguishing agent, so the fire extinguisher was placed on the floor adjacent to the captain’s seat.
Both flight crew reported communication was difficult while using the oxygen masks. This was due to an initial incorrect intercom setting. It was further exacerbated by the need to switch the mask microphone OFF between talking. The FO also reported that the communication difficulties resulted in an increased level of anxiety.
The captain asked the FO to contact Melbourne Centre air traffic control (ATC) to report the situation. The FO, believing the captain wanted to descend from their current cruise altitude of flight level (FL) 200[3], declared a PAN[4] and requested a descent. The flight crew reported that ATC did not initially understand the call, so the FO repeated the broadcast a number of times until ATC acknowledged the PAN. Noting the aircraft was maintaining the cruise level, the FO disconnected the autopilot and initiated a descent.
The captain did not recall discussing the need to descend and did not intend doing so at that time. As a result, when the FO initiated the descent, the captain re-engaged the autopilot, pulled back on the control column and declared having control of the aircraft. Both crew reported the FO disconnected the autopilot a second time in similar circumstances, although data from the flight recorder did not show this. The captain again re-engaged the autopilot and repeated ‘my controls’ so the FO would know the captain had taken control of the aircraft. Due to the ongoing communication issues, the captain instructed the FO to remove their mask to improve communication between the crew. Both crew removed their masks and goggles to discuss the situation.
As the FMS was no longer functioning, the FO asked ATC for the nearest airport and was told Canberra was 30 NM (56 km) away. The crew advised ATC they would divert to Canberra and requested and received radar vectors for approach to Canberra Airport, Australian Capital Territory.
The captain briefed the cabin crew and made a public address to alert the passengers of the intention to divert to Canberra with a landing in about 10 minutes. At that time, the smoke in the flight deck had reduced to about 50 per cent of its original rate. As neither crew felt they were experiencing ill effects from the smoke, they did not refit their masks or goggles.
During the descent, the flight crew returned to the Quick Reference Handbook checklist items but misread a note that resulted in them ceasing the Fuselage Fire or Smoke checklist to allow commencement of the normal landing checks. The smoke had almost cleared from the flight deck by the time the aircraft commenced the approach. After touchdown, the aircraft was turned onto taxiway Golf where it was stopped and a precautionary disembarkation of the passengers and crew carried out.
The flight crew had flown without wearing their masks and smoke goggles for about 10‑15 minutes. As a result, they were taken by ambulance to a local hospital for monitoring, before being released some hours later.
No passengers or cabin crew reported injuries or ill effects from the smoke. There was no other damage to the aircraft.
The captain commenced flying in 2002, held an Air Transport Pilot (Aeroplane) Licence and had a current Class 1 Medical Certificate. Their total aeronautical experience was about 3,525 hours, with about 2,000 hours on the Dash 8 aircraft type.
During the previous 7 days, the captain was on duty for 4 days, on stand-by (without call-out) for 1 day and then had 2 days off duty. The previous duty concluded at about 2255 on 25 July 2013. The captain reported being on duty for 3 hours at the time of the occurrence, having been awake for 6 hours. The captain did not report any fatigue‑related concerns or any illness leading up to the occurrence.
First officer
The first officer (FO) held a Commercial Pilot (Aeroplane) Licence and had a current Class 1 Medical Certificate. They had a total aeronautical experience of about 2,531 flying hours.
During the previous 7 days, the FO had 1 day on duty, 2 days off duty, and then 4 days on duty. The previous duty concluded at 1531 on 28 July 2013. The FO reported being awake for 4 hours and on duty for 2 hours at the time of the occurrence and did not report any fatigue‑related concerns or any illness at that time.
Emergency procedures training
Oxygen masks and goggles
As part of endorsement training, crew were required to conduct a rapid depressurisation simulator session. This session required the rapid donning and ongoing use of oxygen masks and:
included making a single radio transmission to air traffic control
included crew-to-crew communication
did not involve wearing the smoke goggles (as they were not required by the training scenario)
included the initiation of an emergency descent with the engines at the flight idle power setting
included the initiation of an emergency descent at the maximum operating airspeed.
Further rapid depressurisation sessions were conducted as part of command upgrade or other recurrent training. QantasLink also provided annual emergency procedures training. This training was theory‑based and covered the use of the emergency equipment including the oxygen masks, but not wearing, or communicating while wearing the mask. The emergency procedures training did not incorporate wearing the smoke goggles.
Training records indicated that since commencing employment with QantasLink in 2008, the captain had undertaken three rapid depressurisation simulator sessions. The most recent session was in 2011 on the DHC-8-402 aircraft that was fitted with a different type of oxygen mask. The captain had also undergone five emergency procedures training sessions. The captain reported not having previously worn the oxygen mask or smoke goggles during a flight.
The FO reported completing a rapid depressurisation simulator session about 18 months prior to the occurrence. That was the only occasion that the FO had worn the oxygen mask prior to the occurrence flight. Training records indicated that the FO completed three emergency procedures training sessions.
The FO advised that, during the initial simulator session, only one radio transmission was made while wearing the mask and that after the aircraft had descended to the safe altitude, the oxygen mask was able to be removed. The FO had not worn the smoke goggles prior to the occurrence flight.
Portable fire extinguisher
Neither crew member had used the portable fire extinguisher previously. As part of QantasLink’s investigation into the occurrence, a simulation was conducted where flight crew had to remove and then replace the portable fire extinguisher in its stowage. That simulation revealed that while seated, neither crew could refit the fire extinguisher in its stowage and secure it correctly. The aircraft manufacturer’s Fuselage Fire or Smoke checklist, which had been adopted by QantasLink, included a step to extinguish any fire with the portable extinguisher. No specific instruction was provided in the checklist regarding the stowage of an empty or unused extinguisher.
Aircraft information
Flight management system
General
The flight management system (FMS) was a fully integrated navigation management system designed to provide the crew with computer-based flight planning, fuel management and centralised control for the aircraft's navigation sensors. The aircraft incorporated a single FMS unit located on the left side of the centre console, adjacent to the captain’s seat (Figure 1).
Examination of the failed flight management system unit
The FMS unit was sent to the manufacturer for examination. That examination found that there had been a dielectric breakdown[5] of a capacitor, which then acted as a low resistance load. This resulted in self-heating that led to the failure of that capacitor, of an adjacent capacitor and of a diode. Other signs of excessive heating were visible on a number of circuit boards, including the display circuit board and connector ribbons within the unit.
In November 1998, because of previous unit failures, the manufacturer released an engineering change order to replace the capacitors affected in this occurrence with components of a higher rating. That modification applied to newly-built units only, and was not retrospectively applied to existing units. As a result, a number of unmodified units remained in service globally.
The circuit board containing the failed capacitors and diode was in original condition and had not been modified. The capacitors were of a different rating, which did not meet the manufacturer’s post-1998 specifications.
Figure 1: DHC-8-315 instrument panel showing the location of the FMS on the captain’s side of the centre console (detailed view of the FMS at inset)
Source: QantasLink
FMS service history
The failed FMS unit, part number 10172-41-111, serial number 1590, was manufactured in 1997 and was acquired from the manufacturer as an overhauled unit by QantasLink in April 2010.
A review of the unit’s service history revealed that it entered service in November 2010 and was removed 438 hours later due to the screen going blank. In May 2011, the unit was returned to service and removed 2,808 hours later due to a backlight problem on the display panel. The unit was returned to service in March 2013 and was removed 671 hours later due to this occurrence. Following this occurrence, the unit was returned to service in August 2013 but was again removed 141 hours later due to the display being permanently set to full brightness.
Flight crew emergency oxygen system
The aircraft flight deck contained a fixed emergency oxygen system comprising of captain and FO half-face (oronasal) masks. The masks were suspended on quick-release hangers from the ceiling panel above and behind each crew seat. Each mask contained a microphone and a regulator that supplied normal or 100 per cent oxygen, either on demand or as continuous flow.
Communication using the mask microphone required the user to select the intercom switch on the communications panel at the rear of the centre console from BOOM (headset microphone) to MASK (mask microphone). The press-to-talk switches on the control columns were then required to be toggled ON when the individuals were speaking and OFF when finished. This was to prevent distraction for the other crew member from breathing noises associated with a live microphone.
During the first flight of the day, flight crew were required to check the serviceability of the emergency oxygen equipment. This included:
a visual inspection of the condition of the oxygen mask
checking the mask is connected to the oxygen supply
testing for continuous flow of oxygen
confirmation that the ‘100%/Dilute’ selector is in the 100 per cent position
checking the operation of the oxygen mask microphone.
The fitment of the smoke goggles was not routinely carried out as part of that check.
Operational factors
QantasLink DHC-8 Fuselage Fire or Smoke checklist
The aircraft manufacturer’s Quick Reference Handbook (QRH) was used by QantasLink. The QRH contains information derived from the Approved Airplane Flight Manual. It is used by flight crew to confirm that respective procedures have been performed correctly.
The QRH contains checklists for Normal and Non-normal/Emergency situations. The Non‑normal/Emergency checklists contain only those items and procedures that differ from those for normal aircraft operation.
The Fuselage Fire or Smoke checklist was divided into four sections (appendix A):
‘boxed’ action items (the recall/memory action items) and landing considerations
Known Source of Fire or Smoke action items
Unknown Source of Fire or Smoke action items
Source of Fire or Smoke cannot be identified action items.
The boxed action items that were applicable on the occurrence flight are shown in Figure 2.
Figure 2: Dash 8 Quick Reference Handbook extract showing the procedural action items in the case of a fire or smoke in the cockpit from a known source (from the FMS in this case)
Source: QantasLink
The Known Source of Fire or Smoke section of the checklist did not contain action items for removal of electrical power from affected systems, such as the FMS. The aircraft manufacturer advised the ATSB that the checklist relied on the flight crew isolating, as required, affected equipment from the aircraft’s electrical system through the operation of any integrated power switch. Reconfiguration of the aircraft’s electrical system in response to a fire or smoke situation of unknown origin was contained in other sections of the checklist (appendix A).
Flight crew actions
Quick reference handbook
On observing the smoke, the FO removed the QRH from its location at the rear of the centre console, located the Fuselage Fire or Smoke checklist, and commenced reading out the recall/memory action items. After donning their masks and goggles, the recirculation fans were selected to OFF. The FO went to select the emergency lights ON but was told to leave them off by the captain, who did not want to alarm the passengers or be distracted with cabin crew enquiries.
While actioning the checklist, the crew were interrupted multiple times with calls from air traffic control and QantasLink. Each time the crew were interrupted, they recommenced the checklist at the start to ensure all actions were conducted.
The crew briefly returned to the Fuselage Fire or Smoke checklist at about 8,000 ft. The FO read out the note that followed the recall actions. This allowed for the discontinuation of the procedures in response to an unknown source of smoke or fire prior to their completion. This was to facilitate preparations for an immediate landing. However, this was misheard by the captain as being applicable to their situation of a known source of fire or smoke – the FMS.
As a result, the checklist was terminated at that point. This meant that the forward outflow valve was never opened, which would have, if activated, assisted in the removal of the smoke from the flight deck.[6]
At the time the Fuselage Fire or Smoke checklist was inadvertently stopped, the normal approach and landing checklist became the priority, so the Fuselage Fire or Smoke checklist was not returned to, nor completed.
Oxygen masks
Both crew reported communication difficulty while wearing their oxygen masks. This difficulty related to both inter‑crew communication and communication between the FO and air traffic control. As a result of this difficulty, and the FO disengaging the autopilot, the captain directed the removal of oxygen masks. The oxygen masks were not worn for the remainder of the flight.
Neither crew reported suffering ill effects from the smoke and were subsequently medically cleared after landing.
Tests and research
Fume and smoke hazards
There has been extensive research into the effects of fumes and smoke in aircraft. The United States Federal Aviation Administration pilot safety brochure Smoke toxicity[7] highlights that smoke inhalation should be recognised as a very real danger. It also states that ‘smoke gas levels do not need to be lethal to seriously impair a pilot’s performance’.
Analysis of fumes and smoke events in Australian aviation from 2008 to 2012: A joint initiative of Australian aviation safety agencies,[8] found that over 1,000 fumes/smoke events were reported to the ATSB and the Civil Aviation Safety Authority in the period 2008–2012. From the data gathered, it was apparent that the most common source of fumes/smoke was the malfunction or failure of electrical systems and auxiliary power units.
The ATSB research report also identified a significant increase in reported fumes/smoke events from mid-2011, which was independent of the growth in flying activity. The report highlights that fumes relating to electrical failures may have the potential to pose a health risk through eye/skin irritation, difficulty in breathing, incapacitation or illness. This was especially the case if the fumes were associated with particulates (smoke) or fire. However, while the potential for a serious outcome is more likely from an occurrence involving smoke, the research also found that ‘very few led to a serious consequential event (such as a forced landing) or outcome such as fire or crew incapacitation’.
Other occurrences
Australia
QantasLink advised there had been a total of five FMS fire/smoke events within their fleet of Dash 8 aircraft during the period 2004–2013. One other Dash 8 operator in Australia had experienced an FMS smoke event, which occurred in 2011. The remaining Australian Dash 8 operators reported they had not experienced any FMS fire/smoke events within their fleets.
A review of the ATSB occurrence database confirmed that six Dash 8 FMS fire/smoke events were reported between 2007 and 2013 across all Australian Dash 8 operators. In one such event on 24 March 2007, while conducting a scheduled flight from Cairns to Horn Island, Queensland, the flight crew of Dash 8 aircraft, registered VH-SBV, reported the aircraft’s FMS unit ceased operating. About 60 seconds later, smoke was observed emanating from the FMS unit. As a precaution, the flight crew donned their oxygen masks and smoke goggles. After completing the action items in the Fuselage Fire or Smoke checklist, the captain ‘pulled’ (opened) the circuit breaker for the FMS to isolate electrical power. That action, while not in accordance with procedures or the checklist, resulted in the smoke ceasing. The opening of the forward outflow valve, in accordance with the checklist, resulted in the rapid removal of smoke from the flight deck.
Worldwide
The ATSB also reviewed a number of international safety databases. While that review found numerous reported smoke/fire events for the Dash 8 aircraft, it did not identify any additional FMS‑related occurrences.
The failure of the flight management system (FMS) unit and subsequent smoke in the cockpit led to the flight crew diverting the aircraft to Canberra Airport, Australian Capital Territory. This analysis will examine the failure mode of the FMS unit, the actions of the flight crew, operational issues and organisational factors that had the potential to affect the flight.
Flight management system failure
The failure of the FMS unit was due to the dielectric breakdown and overheating of one of the unit’s capacitors. The FMS manufacturer had reviewed the suitability of the capacitors in the early model FMS units and implemented a design modification to upgrade the capacitors in 1998. This was done through an engineering change order, which was implemented about 12 months after the release to service of the FMS unit installed in VH-SBG.
Despite the availability of this modification, the FMS manufacturer did not have a retrospective fitment program for in‑service units. Such a program could be expected to reduce the likelihood of capacitors overheating and therefore in-flight FMS failures and subsequent fire/smoke occurrences. The manufacturer was unable to provide details of the number of unmodified units currently in service, which made evaluation of the risk of further in‑service failures as a result of this failure mode difficult to determine. However, in Australia, QantasLink commenced an upgrade of their FMS units in February 2014 to meet the new design specification under service bulletin SB10172.XX.()‑34‑3578 Installation of Mod 22 in the UNS-1C+ FMS. This upgrade was completed in June 2014.
Operational factors
Flight crew actions
As would be expected in any emergency situation, the appearance of smoke from the FMS created a level of stress for the flight crew. Their immediate response was to review the Quick Reference Handbook and action the Fuselage Fire or Smoke checklist. The first step was to put oxygen masks on, followed by fitting the smoke goggles before continuing the checklist.
During this time, the crew were interrupted numerous times due to the need to respond to air traffic control (ATC) and calls from QantasLink via radio as the first officer (FO) was reading out the checklist. After each interruption, the checklist was recommenced from the start. However, reports from the crew indicated that communication both between them and with ATC while wearing the oxygen masks was difficult. Consequently, the FO had to repeat the PAN call to ATC multiple times before being understood. This added to the crew’s stress and workload in trying to resolve this difficulty.
Research has shown that, under stressful conditions, the performance of tasks can be affected so that the outcomes are not as planned or in conformance with a procedure (Wickens and Hollands, 2000). The effects of stress on human performance have been characterised as:
Attentional narrowing, where an individual’s attention can concentrate on a single aspect of a task at hand to the detriment of other information cues or task requirements.
Perseveration[9], where an individual perseveres with a given action or plan they have used in the past, even if it is failing to provide a successful solution.
Confirmation bias, where a decision maker, once locked into a hypothesis on the reason behind an event, will be less likely to consider information cues that might support an alternative hypotheses.
The combined influence of those characteristics can contribute to a pattern of convergent thinking or ‘cognitive tunnelling’. This will initially narrow the set of cues processed by the individual to those they perceive as being the most important. As the cues have been viewed to support one hypothesis only, the individual will continue to consider that hypothesis only, and process a restricted range of cues consistent with that set.
The FO’s action to reduce altitude appears based on recognising this requirement from the training in simulated rapid depressurisation procedures. The captain did not recall discussing descending the aircraft with the FO at that time and was not aware that the FO had advised ATC they intended doing so. Consequently, the captain was surprised by the FO’s actions and immediately re-engaged the autopilot.
After the FO attempted to descend the aircraft without a direction to do so from the captain (who was the pilot flying) and, recognising that the FO was anxious, the captain ordered the removal of the oxygen masks. As the smoke goggles and oxygen masks were ‘tangled’ together, both crew members’ masks and goggles remained off for the remainder of the flight.
The captain reported that once the oxygen masks were removed, and better communications established as a result, the FO contacted ATC and determined that Canberra was the closest suitable airport. The crew requested radar vectors for Canberra from ATC as the FMS was no longer working. The captain stated that descent from FL 200 normally required about 60 NM (111 km). In this instance, the aircraft’s proximity to Canberra meant that the crew had to prepare for the descent and landing over a remaining distance of 30 NM (56 km). This resulted in a similar number of tasks being carried out in a reduced period of time.
Workload has been defined as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. Workload represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady and Orlady, 1999). A discussion of the effect of workload on the completion of a task requires an understanding of an individual’s strategies for managing tasks.
An individual has a finite set of mental resources they can assign to a set of tasks (for example, performing a take-off). These resources can change given the individual’s experience and training and the level of stress and fatigue being experienced at the time. An individual will seek to perform at an optimum workload by balancing the demands of their tasks. When workload is low, the individual will seek to take on tasks. When workload becomes excessive the individual must, as a result of their finite mental resources, shed tasks.
An individual can shed tasks in an efficient manner by eliminating performance on low priority tasks. Alternately, they can shed tasks in an inefficient fashion by abandoning tasks that should be performed. Tasks make demands on an individual’s resources through the mental and physical requirements of the task, temporal demands and the wish to achieve performance goals (Hart and Staveland, 1988 and Lee and Liu, 2003).
The inherent stress of the event, together with the associated high workload led to the crew making errors in both aircraft management and checklist completion. This included not completing the ‘transition drill’ when passing 10,000 ft on descent, which includes checking, and changing as required, the fuel system, exterior lights, pressurisation and ice protection. These drills were conducted at 8,000 ft prior to conducting the approach checklist.
As part of the initial conduct of the checklist, the FO retrieved the fire extinguisher and handed it to the captain. However, as the FMS was still an intact, sealed unit, there was no way for the extinguisher to be used on the FMS. The captain’s decision to place the unused fire extinguisher on the floor adjacent to the seat may have been influenced by the impracticality of re-securing the fire extinguisher in the normal stowage location. Consequently, the fire extinguisher presented a potential projectile hazard within the flight deck.
The captain stated that passing about FL 120 the FO was requested to continue with the Fuselage Fire or Smoke checklist. The captain reported a number of interruptions at about this time to the extent that the FO was unable to recommence reading out the checklist actions until passing about 8,000 ft. These interruptions included the previously mentioned numerous ATC calls and from QantasLink ground personnel, enquiries from cabin crew and the need to make a public address announcement to the passengers.
When the Fuselage Fire or Smoke checklist was recommenced just prior to 8,000 ft, the captain misheard the cessation note as read out by the FO. This note was designed to highlight the need to prepare for and manage an immediate landing if the source of fire or smoke could not be identified and that to do so, the checklist could be terminated. It is likely that when this note was read out, the proximity to Canberra and the need to conduct the approach and landing checklist reinforced the captain’s decision to terminate the checklist at this point, despite it applying to an unknown source of fire.
In both the crew’s initial action to carry out the Fuselage Fire or Smoke checklist, and its review at 8,000 ft, circumstances prevented the completion of the Known Source of Fire or Smoke section. In both cases, the action to open the ‘forward outflow valve’ was missed. However, the associated note for this action specified its completion ‘if necessary to assist in removal of smoke’. Given the crew reported the smoke had dissipated by the time the approach was commenced into Canberra, even if this step was reached, it is unlikely it would have needed to be actioned.
Emergency equipment training
All QantasLink flight crew underwent a rapid depressurisation scenario simulator session as part of their Dash 8 endorsement training. Additional rapid depressurisation training was undertaken as part of command upgrade for captains. The crew were required to undertake emergency procedures training annually but this was primarily theory based.
QantasLink provided limited training in the use of smoke goggles and no training on using the goggles in combination with the oxygen mask. Both crew confirmed that the only training provided in the use of oxygen masks was during a rapid depressurisation scenario, which was reported not frequently practiced.
Resolution of emergency situations relies on effective decision making by crews given the information available. Emergency procedure training provides the opportunity for crews to familiarise themselves with those procedures for use in times of high stress and workload. In this instance, the lack of prior exposure to wearing smoke goggles in a training environment increased the risk of reduced flight crew performance in response to the occurrence.
Both crew reported being confident in the use of the oxygen mask. However, their infrequent practice using the mask microphone to communicate increased the risk of communication breakdown as experienced during this occurrence.
The communication difficulties experienced by the crew in this occurrence contributed to their decision to remove their oxygen masks. Despite addressing the problem of communication, it also resulted in their re-exposure to potentially harmful smoke/fumes. While the crew reported no adverse effects from this exposure, it did increase the risk of crew impairment/incapacitation.
From the evidence available, the following findings are made with respect to the failure of the flight management system unit and subsequent smoke on the flight deck occurrence involving Bombardier DHC-8-315 aircraft, registered VH-SBG, near Canberra Airport, Australian Capital Territory on 29 July 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The flight management system unit failure and observed smoke were the result of a capacitor, which did not meet current design specifications, overheating.
Despite a design upgrade in 1998 for new flight management system units, unmodified units remained in service that had the original capacitors.
At the time of the occurrence, the approved QantasLink training did not provide first officers with sufficient familiarity on the use of the oxygen mask and smoke goggles. This likely contributed to the crew's communication difficulties, including with air traffic control. [Safety issue]
Other factors that increased risk
Despite removing their oxygen masks to improve communication, by doing so the crew increased the risk of impairment or incapacitation as there was still smoke in the cockpit.
The stress associated with the smoke in the cockpit resulted in a high workload for the crew and adversely affected their performance, leading to errors in aircraft management and checklist completion.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Emergency oxygen mask and smoke goggles training
At the time of the occurrence, the approved QantasLink training did not provide first officers with sufficient familiarity on the use of the oxygen mask and smoke goggles. This likely contributed to the crew's communication difficulties, including with air traffic control.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
QantasLink
QantasLink has undertaken the following additional safety actions:
Amended the Aircrew Emergency Procedures Manual to include post‑precautionary evacuation procedures and post‑incident debriefings to all flight and cabin crew. This includes in crew emergency procedures training.
Completed a program in June 2014 to modify all QantasLink flight management system units to incorporate 22uF/25V capacitors in accordance with service bulletin SB10172.XX.()-34-3578 Installation of Mod 22 in the UNS‑1C+ FMS.
Amended their emergency procedures training to include alternative stowage of fire extinguishers in the flight deck.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew of VH-SBG
QantasLink
Bombardier Inc
flight management system manufacturer
United States National Transportation Safety Board
United Kingdom Air Accidents Investigation Branch
Transportation Safety Board of Canada.
References
Hart, SG & Staveland, LE 1988, ‘Development of NASA-TLX (Task Load Index): Results of empirical and theoretical research’, In PA Hancock & N Meshkati (Eds.), Human Mental Workload. North Holland Press, Amsterdam.
Lee, YH & Liu, BS 2003, ‘Inflight workload assessment: Comparison of subjective and physiological measurements’, Aviation, Space, and Environmental Medicine, vol.74, pp. 1078‑1084.
Orlady, HW & Orlady, LM 1999, Human factors in multi-crew flight operations. Ashgate, Aldershot, p. 203.
Wickens, CD & Hollands, JG 2000, Engineering psychology and human performance. 3rd Edition. Prentice Hall, New Jersey.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the crew of VH‑SBG, QantasLink, the Civil Aviation Safety Authority, Bombardier Inc, the flight management system manufacturer, United States National Transportation Safety Board and the Transportation Safety Board of Canada.
Submissions were received from the captain of VH-SBG, QantasLink and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Appendices
Appendix A – DHC-8-315 Quick reference handbook
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 25 July 2013, Pacific National locomotive 8122 was undertaking shunt operations in the Melbourne Freight Terminal (MFT) and onto areas of the main line controlled by signal DYN150. During one of the shunt movements, the locomotive stopped slightly forward of signal DYN150, in a position where indication on the signal was not visible to the driver. The signalling system should have detected the locomotive still occupied the track section forward of the signal, but in this instance, the system registered the train had cleared the section. The system then allowed points 143 ahead of signal DYN150 to change position for the passage of another train.
Unaware of the change in points 143, the driver continued with shunt operations by moving the locomotive forward. A Signal Passed at Danger (SPAD) alarm was generated and displayed to the Network Control Officer (NCO) who then contacted the MFT shunt planner. Meanwhile, the driver continued forward before stopping just after the lead bogie of locomotive 8122 had run through points 143, which were now set in the incorrect position for the move being undertaken.
Unaware that the points had been run through, the driver then reversed direction for the next shunt movement. This manoeuvre resulted in the lead bogie of the locomotive diverging onto a different track, causing all wheels of the locomotive and one bogie of the first wagon coupled to the locomotive to derail. At no point in time did a conversation occur between the NCO and the locomotive driver, and almost 30 minutes passed before the NCO and the shunt planner became aware of (and confirmed) the derailment at points 143.
What the ATSB found
The ATSB found that the location of the insulated rail joints adjacent signal DYN150 were incorrect. Consequently, the track section past the signal could be detected as unoccupied, even though the locomotive (and drivers cab) was positioned past the signal.
The ATSB also found that procedures specific to shunting in and about the MFT had not been implemented in this instance. It was evident that communication in response to the preceding SPAD alarm had been ineffective – allowing shunt operations to continue and locomotive 8122 to derail. Furthermore, significant time passed before the network control officer and the MFT shunt planner became fully aware of the derailment.
What's been done as a result
The Australian Rail Track Corporation initiated actions to verify (within Victoria) the position of insulated joints relative to the respective signals and develop a prioritised remediation plan for any non-conforming arrangements.
Pacific National and the Australian Rail Track Corporation have taken action to ensure all parties adhere to the documented process for shunting in and about the MFT. In addition, Pacific National has advised their drivers and shunt planners that communication regarding any issues related to the shunting movements must occur directly between the network controller and the locomotive driver.
Safety message
Rail transport operators must ensure that local communication practices are not substituted for, or do not influence required communication protocols in an emergency.
The occurrence
On 25 July 2013, the shunt planner at the Melbourne Freight Terminal (MFT) requested the driver of Pacific National locomotive 8122 and a shunter[1], to marshal[2] wagons within the terminal. To achieve the desired order of wagons, the locomotive required access beyond the terminal limits and onto the main line.
At about 1715[3], at the request of the MFT shunt planner, the Australian Rail Track Corporation Network Control Officer (NCO) set a route onto the main line for locomotive 8122. About five minutes later, locomotive 8122 hauled a rake of six wagons from the MFT onto the main line and in the direction of Sims Street Junction (Figure 1). At about 1721, the locomotive passed signal DYN150 which was displaying a ‘medium speed warning’ aspect[4]. The locomotive continued beyond the signal for about 200 m before the shunter told the driver to stop.
Figure 1: Track layout Sims Street Junction showing path of locomotive 8122
Source: ARTC annotated by ATSB.
About the same time, though still some distance away, train 9794 was approaching from Footscray intending to travel towards North Dynon Junction via points 143. Although the NCO selected the required route for train 9794, the signal interlocking system[5] prevented the route from setting, due to locomotive 8122 occupying a track section that was also part of that route. The signal interlocking system stored the selected route until such time that all the required track sections were clear.
At about 1724, the driver of locomotive 8122 received a further direction from the shunter to propel[6] back toward the MFT. The locomotive pushed the attached wagons until they were in the required position and the shunter again told the driver to stop. This placed the locomotive adjacent to signal DYN150.
The driver recalled that part of the locomotive (including the driver’s cab) was forward of the signal. A rail vehicle placed in this position should register in the signalling system as occupying the track section ahead of the signal. In this instance however, the system registered the track section as clear and the original route set for locomotive 8122 from signal DYN150 completed.
As the route from DYN150 was no longer active, the system then commenced to set the stored route for train 9794 from Footscray. This included the operation of points 143 from the normal position (main line through South Dynon Junction), to the reverse position (‘X’ track through North Dynon Junction).
At about 1729, unaware of the change in the setting at points 143, the driver of locomotive 8122 continued the marshalling movements under the direction of the shunter. As the locomotive moved forward in another hauling move, the track circuitry detected occupancy of the section ahead of signal DYN150. This indicated on the Phoenix control system (Figure 2, Left), which provided the NCO with real time monitoring and control of field equipment. The Phoenix system recorded the track occupancy as an unauthorised movement past signal DYN150 and generated a Signal Passed at Danger (SPAD) alarm for attention by the NCO.
Meanwhile, the locomotive was moving toward points 143, which were now incorrectly set for this movement. At about 1730, the locomotive ran through[7] the points. Shortly after trailing the points, the shunter again told the driver to stop the shunt movement.
At about the same time, the NCO responding to the SPAD alarm phoned the MFT shunt planner. A conversation commenced about what the driver of the shunt movement was doing in passing signal DYN150 without authorisation.
As locomotive 8122 ran through the points, the signalling system lost detection of the point orientation. This, in conjunction with the new track occupancy, caused the cancellation of the route from Footscray. The Phoenix system reflected this change (Figure 2, Right), but it went unnoticed by the NCO.
Figure 2: Screen captures from Phoenix control panel
The left-hand image shows the Phoenix control panel screen immediately after the signalling system detected locomotive 8122 occupying the track section ahead of Signal DYN150. The right-hand image shows the Phoenix control panel screen immediately after the signalling system loses detection of the points 143 orientation. Source: ARTC annotation by ATSB
The locomotive stopped while straddling the points 143, with the lead bogie on the facing side of points 143 and the rear bogie on the trailing side. The shunter again told the driver to change direction and propel back towards the MFT. This manoeuvre caused the lead bogie of the locomotive to diverge onto the ‘X’ track (towards North Dynon Junction), while the locomotive’s rear bogie and wagons continued along the main line towards the MFT. The driver realised what was happening and applied the brake, but could not stop the train before derailing the locomotive and the lead bogie of the first coupled wagon.
At about the same time, the MFT shunt planner interrupted his phone conversation with the NCO and issued an instruction to the driver by UHF radio to stop the train. The MFT shunt planner did not wait for a response from the driver, but confirmed with the NCO that he had told the driver to stop. Neither the shunt planner nor the NCO was aware that the locomotive had derailed.
The NCO, the shunt planner and other representatives of the operator continued with a series of phone conversations about the SPAD and their intention to authorise the locomotive to push back behind signal DYN150. None considered the possibility of a derailment. Almost 30 minutes passed before the NCO and the shunt planner became aware of (and confirmed) that locomotive 8122 and a wagon had derailed at points 143.
The NCO then arranged for protection of the track and an inspection of the damage to the infrastructure. At 1515 on 26 July, the locomotive and the lead wagon were recovered and the track restored for traffic.
The Dynon area was a freight hub in Melbourne, Victoria with freight terminals servicing the Port of Melbourne, Appleton Dock, and Swanson Dock. The track from Footscray approached from the west; entering the Dynon area at Sims Street Junction, where a track branched to North Dynon Junction then on towards South Kensington. The main rail line continued east towards South Dynon Junction and the MFT.
The derailment occurred at points 143, situated at the 4.429 km mark[8] at the eastern end of Sims Street Junction. The distance from the points to signal DYN150 was about 177 metres. The connection between the ‘X track’ to South Kensington and the main line towards the MFT occurs at points 143 (Figure 3).
Figure 3: View of South Dynon Junction track layout including the main line, ‘X’ track and points 143
Source: Google Earth, annotated by ATSB.
Network control
The Australian Rail Track Corporation (ARTC) managed the main line, ‘X track’ and associated signalling infrastructure involved in the derailment. The signalling infrastructure incorporated track circuits for rail vehicle detection and remotely controlling line-side signals and point machines.
The Phoenix control system, located at the Mile End control centre in South Australia, provided the remote control functionality. The system was a non-vital centralised traffic control system[9][10]monitored and operated by the NCO. The system also provided status indications for the signalling equipment supporting the monitoring and management of train movements in real time.
Train and train crew
Train information
The locomotive involved in the occurrence was an 81-class diesel electric with an overall length of about 21.2 m. The shunt movements involved the remarshalling of six (multiple-platform) wagons with a combined overall consist length of about 660 m. There was no evidence that any mechanical defects were affecting the locomotive’s operation.
The locomotive 8122 was fitted with a Hasler data logger; an electro-mechanical strip chart recorder. The logger recorded data such as time, speed, throttle position, vigilance control and brake pipe pressure, on a waxed paper tape.
Locomotive data loggers provide essential evidence in verifying the sequence of events during an investigation. In this case, the tape recovered from locomotive 8122 was damaged and in very poor condition when provided to the ATSB. The damage to the tape was near the data critical to the derailment sequence and prevented the accurate examination and analysis of events. Consequently, the data logger information could not verify the position of locomotive 8122 relative to signal DYN150 before it moved off and ran through points 143.
Train crew
The driver of locomotive 8122 had worked in the rail industry for about 8 years and had been qualified as a driver for 5 years. The driver’s route competency included a number of main line routes and local areas – including the MFT. The driver was familiar with the shunting operations at the MFT.
There was no evidence to suggest impairment of the driver’s performance from fatigue or other factors. Similarly, the driver’s health assessment records met the required National Standard for Health of Rail Safety Workers. Following the derailment, the driver underwent a routine drug and alcohol-screening test, which returned a negative result. There was no evidence to suggest that any medical or physiological factors affected the driver’s performance leading up to or during the derailment.
Freight terminal operations
There were four Pacific National facilities managed at this locality. These included the Melbourne Freight Terminal (MFT), the Melbourne Operations Terminal, the Locomotive Provisioning Centre and the Wagon Maintenance Centre. The facilities all had direct rail connections to the ARTC network.
The MFT contained multiple shunt roads used to load, unload and marshal wagons. The shunt roads within the terminal were not long enough to wholly accommodate the average train length, and as such, longer trains required shunting out of the MFT and onto the main line.
A shunt planner located in the terminal ‘tower’ coordinated shunt movements within the MFT. A shunter was also positioned on the ground (usually towards the rear of the train consist). The shunter operated the yard points and directed the locomotive driver on where to position the train for the coupling of wagons on the required shunt roads. Where a shunt movement was required to exit the terminal and move onto the main line, the shunt planner contacted the NCO to facilitate the clearing of the relevant main line signals.
Communication
The means of communication between the MFT shunt planner and the NCO was by way of landline telephone. The MFT shunt planner also had an Ultra High Frequency (UHF) base radio for communication with the terminal shunters and the locomotive drivers.
The locomotive 8122 was fitted with the AWARE[11] train radio system, providing the driver with direct voice communication to the relevant train control, the MFT shunt planner, and the shunter on the ground. Prior to obtaining access onto the ARTC track, the driver had logged access to the system using the prescribed code. The radio communication system was serviceable at the time of the derailment.
Operational rules
Section 12 of the ARTC Code of Practice for the Victorian Main Line Network (TA20)documents the rules for shunting of freight wagons on the ARTC main line, including the Dynon area. While generally under the instruction of a shunter, a train driver must also comply with the network’s fixed signals. That is, it is not permissible to shunt vehicles past a signal displaying a stop (red) indication, even if the shunter directs the movement.
If there is a requirement for a shunt movement to pass a signal, a route must be authorised by the NCO. A route is defined as ‘a section of track between one signal and the next, along which an authorised movement is to be made’[12].
Railway signalling systems usually facilitate single direction train movements from one signal to the next, so it is not normal practice for trains to change direction or divert from the original authorised route. Short shunting is a term commonly used to describe a diversion from an authorised route. The ARTC rules provide further clarification regarding the term short shunting:
`Short Shunting' is defined as a train movement whereby the train does not complete the full signalled route, in order to take an alternative route at a midway point.
Signalling in track circuited areas is generally designed directionally, so that when the rear of a train clears the fouling point, a cross movement can be performed behind that train, even though the rear of that train may not have cleared the opposing Fixed Signal.
A shunting movement must complete the full signalled movement prior to reversing the direction of the train in order to take an alternative route.
`Short Shunting' is not permitted.
A shunting movement may reverse direction within a set route, provided the integrity of the route is not compromised (i.e.: the route is not altered whilst the train is in between the controlling Signals).
In this instance, the authority of the controlling Signaller must first be obtained.
It is clear from the rule that diverting from the authorised route is short shunting and thus not permitted at any time. However, the rule also provides clarification regarding the permitted reversal of direction within an authorised route. That is, as there is no alteration to the route and only a reversal of direction, the movement is not classified as short shunting and is permitted so long as authority is provided.
In this case, the shunting operation undertaken by locomotive 8122 required a series of movements involving various shunt roads in the MFT and movement out onto the ARTC mainline via signal DYN150. The methodologies employed were accepted and commonly-practiced procedures for shunting at the MFT. At the time when locomotive 8122 needed to pass signal DYN150, the shunt planner requested authority from the NCO for shunt operations to move out past the signal. The NCO provided authority by setting a route between signal DYN150 and signal MGL57 (local line at Footscray).
When signal DYN150 cleared, shunt operations continued within the route set between signals DYN150 and MGL57. In conjunction with the instructions given by the shunter located on the ground in the MFT, the driver of locomotive 8122 followed the signalled route onto the main line. At no stage did the driver communicate directly with the NCO.
As noted previously, shunt movements were permitted to reverse direction so long as the route (between the two signals) could not be altered; that is, while the tracks between the signals remained occupied. If the entire train and locomotive had moved back behind the signal (clear of the track circuits), movements within the route would be considered complete and the driver would again need to abide by the relevant signal indication. Should the shunting operation need further forward movement and occupancy of the track ahead of the signal, authority from the NCO would once again be required.
These actions were all consistent with the ARTC rules. Authority was obtained to shunt within the route set between signals DYN150 and MGL57; including reversal of direction as was common practise at the MFT. There was no intention by the NCO to compromise (or alter) the route set between signal DYN150 and signal MGL57.
Operational procedures
ARTC Standing Train Notices provide notice of temporary or permanent alterations to the ARTC network. In October 2009, the ARTC issued notice (1983/2009), providing instructions related to shunting movements at the MFT. The notice stated:
As part of shunting operations at the Pacific National Melbourne Freight Terminal, a train or locomotive movement may need to shunt onto the ARTC main line outside either end of the terminal within specified limits.
PN must clearly outline the limits and moves required for the planned shunt to the ARTC Melbourne Metro Train Controller.
Before clearing the relevant signal for the shunt movement, the Train Controller must:
* Block relevant motor operated points that the movement is to traverse as required.
The Train Controller must maintain point blocking until the train or loco has completed the shunt and PN has advised that the movement is completely behind a controlled signal.
Point blocking is a facility used to prevent the operation of the points. The procedure defined in the notice provided an additional control measure to ensure the integrity of the authorised route and prevent short shunting. That is, all points that may provide an opportunity to alter the route are prevented from operating.
In this case, the PN shunt planner requested authority from the NCO for shunt operations to move out past signal DYN150. The NCO provided that authority by setting a route between signal DYN150 and signal MGL57 (local line at Footscray), but did not block points 143.
The investigation found that the driver of locomotive 8122 initially passed signal DYN150, which was displaying a proceed indication, with the intention of conducting a number of shunt movements. Shunting included reversing direction and pushing back towards the MFT. Recorded signal data indicated that during the shunt movement, the track section ahead of DYN150 registered being clear of any occupancy. This condition implied that locomotive 8122 had moved back behind DYN150. As the signal interlocking system now registered the route from DYN150 as complete, the system automatically operated points 143 to set the stored route for train 9794 from Footscray.
From the driver’s recollection, the locomotive had pushed back to a point where it was adjacent signal DYN150, but had not returned behind DYN150 at any time during shunting. As such, there was no trigger for the driver to notify the NCO before moving forward. When again requested by the shunter to move forward, the driver continued shunting as though the route from DYN150 was still available for shunt operations.
As the signalling system had previously registered the route from DYN150 had cleared, the subsequent occupation of the tracks beyond the (red) signal resulted in the NCO receiving a SPAD alarm.
From the ATSB’s investigations and examination of recorded signalling data, it was evident that there had been a disparity between the driver’s observations and the indications displayed on the Phoenix signalling system, with respect to the relative position of locomotive 8122 and signal DYN150.
The following analysis examines the possibility that the integrity of the route set from DYN150 (for shunting) was compromised, resulting in the NCO receiving a SPAD alarm, the operation of points 143, and the subsequent derailment of locomotive 8122. The actions taken in response to the SPAD alarm and subsequent derailment are also examined.
Track infrastructure
The signalling system relied on track circuits to detect the location of rail vehicles. In simple terms, a track circuit uses the rails as electrical conductors to allow a power supply to energise a relay. Rail vehicle wheels and axles electrically short-circuit the two rails, which prevents energising of the relay, thereby detecting the presence of the rail vehicle. Insulated rail joints[13] (IRJs) provide electrical isolation between consecutive track circuits while maintaining the structural integrity of the rail for train movements.
To ensure the position of a rail vehicle is detected accurately with respect to the position of fixed line-side signals, it is essential that the IRJs are appropriately located – usually immediately adjacent the signal.
In this case, an examination of the track infrastructure for signal DYN150 found the IRJs were located about 4.8 m ahead of the signal’s physical position (Figure 4). This was non-compliant with the ARTC procedure[14], which specified the following requirement:
Ideally the insulated rail joints shall be located directly in line with signal to which they apply and no more than 2 m past the signal.
ARTC inspection records from January 2009 listed the position of the signal relative to the IRJ as being correct. There was no record of any significant changes to the infrastructure associated with signal DYN150 between the 2009 inspection and the derailment. The ARTC had no record of the reasons or considerations behind the installation of the IRJs 4.8 m past signal DYN150.
Figure 4: Schematic of rail vehicle axle, track circuit and signal displaying stop indication
Source: ATSB.
Track circuits
Track circuits do not detect a transition of occupancy until the lead wheelset of a rail vehicle has traversed the IRJs. If the IRJs are positioned ahead of a signal, the front of a rail vehicle may already be past the signal before its lead wheelset crosses the IRJs. Conversely, a movement in the opposite direction will be detected clear of the track circuit even though the rear of the train still occupies the track ahead of the signal.
Following this incident, an exemplar locomotive was placed adjacent to signal DYN150, in a position where the lead wheels of the front bogie were immediately behind the IRJs (Figure 5) and not detected by the track circuit located ahead of the signal. The position was consistent with the driver’s recollection of locomotive 8122 before it moved towards points 143 and subsequently derailed. In this position, it was evident that a driver in the locomotive cab would not be able to observe the aspect of signal DYN150.
Figure 5: Exemplar locomotive near signal DYN150 and IRJ’s
Source: Pacific National with annotation by ATSB.
While there was insufficient evidence to discount the possibility that locomotive 8122 actually had pushed back behind signal DYN150, it was clear that the infrastructure configuration could permit a scenario whereby a locomotive driver may remain unaware that the expected route from signal DYN150 had not been maintained during shunt movements.
Existing risk controls
Regardless of the stopping point of the locomotive (either adjacent the signal or completely behind), the signalling system detected the track beyond signal DYN150 as clear. This released the route and allowed operation of points 143, which altered the route that had been set between signal DYN150 and signal MGL57 (for the shunting).
The ARTC had recognised the potential for this scenario and issued Standing Train Notice 1983/2009 to provide specific additional protection. That is, even if the route set between signal DYN150 and signal MGL57 became unoccupied, the integrity of the route could not be compromised (or altered) until the NCO had verified that the train or loco had returned completely behind signal DYN150.
All parties have responsibilities under Standing Train Notice 1983/2009, PN to communicate the planned shunt and the ARTC to apply blocking facilities to the relevant points. In this instance however, the driver, shunt planner and Network Control Officer had not implemented these procedures.
There is no clear reason why neither party initiated the requirements of the notice in this case, nor was there any evidence to suggest the lapse was a common occurrence. Both the ARTC and PN have initiated action to reinforce the requirement for relevant personnel to implement the instructions of Standing Train Notice 1983/2009 when shunting at the MFT (refer to Safety issues and actions section below).
Incident response and communication
To mitigate further risk following the development of this occurrence, two key events required an effective and timely response. The first was the SPAD alarm generated by the signalling system indicating a limit of authority overrun, and the second was the actual derailment of locomotive 8122 at points 143.
Signal passed at danger
The ARTC Code of Practice for the Defined Interstate Rail Network, Operations and Safeworking, Issue 2 (ARTC Annotated Version May 2002) documented the required action by the NCO when responding to a SPAD alarm. The code required the NCO to promptly react to emergencies or unusual circumstances and to protect the train that had overrun and any other train that may come into conflict. The code’s intent was for the NCO to promptly stop the train that had overrun its limit of authority and to stop any other movements that were at risk.
In this case, in response to the SPAD alarm, the NCO contacted the MFT shunt planner, rather than the driver of locomotive 8122, and a conversation began regarding the SPAD at DYN150. The driver was unaware of the SPAD alarm and did not recall receiving any instruction from either the NCO or the MFT shunt planner to stop the train.
Analysis of network voice recordings indicated that the shunt planner (during his conversation with the NCO) made a short call to the driver by UHF radio and used the phrase ‘red light’. This phrase was identical to the normal expression used by the shunter when directing a driver to stop, before making further directions to complete a particular shunt movement. The shunt planner’s ‘red light’ phrase did not alert the driver to the significance of the message and there was no follow up by the shunt planner to confirm that the driver had received and understood the communication.
The absence of direct communication between the driver and the NCO meant that the driver remained unaware of the SPAD alarm. The adopted process failed to ensure protection (in this case against derailment) for the train identified by the signalling system as having exceeding its authority.
Derailment of locomotive 8122
Without receiving clear instructions to the contrary and unbeknown to the NCO and MFT shunt planner, the driver of locomotive 8122 continued shunt operations that led to the derailment at points 143.
The ARTC Code of Practice for the Victorian Main Line Network documented the action required by a locomotive driver in response to an emergency scenario (such as a derailment). Drivers were required to advise the NCO by radio that a derailment had occurred and that the safe operation of the line was affected. Contrary to this however, the driver said that his first action in this case was to contact the MFT shunt planner, before relaying the information to other Pacific National representatives. The driver did not directly contact the NCO and there was no recorded evidence verifying discussions between the driver and the shunt planner. Examination of the train control voice logs indicated that almost 30 minutes passed before all parties became aware of (and confirmed) that locomotive 8122 and a wagon had derailed at points 143.
Communication
Typically, a driver would request an authority to enter the main line from a shunting yard or terminal directly from the NCO. This establishes a direct line of communication between the driver and the NCO.
The process for obtaining an authority in and about the MFT differed because of the type and frequency of train movements undertaken. For operational reasons, the shunt planner (rather than the driver) would contact the NCO to request an authority to enter the main line. This process inherently limited direct communication between the locomotive driver and the NCO – including on this occasion, the more urgent communications related to the SPAD alarm.
While communicating through a third party (the MFT shunt planner) may have been suitable for managing routine shunt operations at this location, it was evident that communication in response to the SPAD alarm was ineffective, as shunt operations continued and locomotive 8122 subsequently derailed. Furthermore, significant time passed before the NCO and the MFT shunt planner became fully aware of the derailment.
The investigation found that although communication systems and protocols were in place, the NCO and the train driver did not directly communicate following the SPAD alarm or the subsequent derailment. Had this communication occurred, it was possible that there would have been sufficient time to stop the train before the arrival at the points, or at least alert the driver and prevent the subsequent reverse manoeuvre that produced the derailment. Similarly, had the driver immediately reported the derailment directly to the NCO, actions could have been taken much earlier to ensure the protection of this and other train movements in the vicinity.
From the evidence available, the following findings are made with respect to the derailment of locomotive 8122 at South Dynon Junction, West Melbourne, Victoria, on 25 July 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The driver, shunt planner and Network Control Officer did not implement the procedures documented in ARTC Standing Train Notice 1983/2009.
The placement of the insulated rail joints adjacent to signal DYN150 was not in accordance with the ARTC engineering procedure ESC-07-01. [Safety issue]
The Network Control Officer did not contact the driver of locomotive 8122 following receipt of the SPAD alarm.
The driver of locomotive 8122 was unaware that points 143 were set incorrectly for the passage of the locomotive.
The practice of using a third party (the shunt planner) to facilitate communication between Network Control Officers and train drivers at the Melbourne Freight Terminal prevented an effective response to the emergency. [Safety issue]
Other factors that increased risk
The driver of locomotive 8122 did not immediately report the derailment to the Network Control Officer.
Other findings
The data log tape from locomotive 8122 was damaged and in very poor condition when provided to the ATSB, so could not be used to verify the sequence of events.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Where relevant, safety issues and actions will be updated on the ATSB website as information comes to hand. The initial public version of these safety issues and actions are in PDF on the ATSB website.
The insulated rail joints were incorrectly placed
The placement of the insulated rail joints adjacent to signal DYN150 was not in accordance with the ARTC engineering procedure ESC-07-01.
Communication protocols at the Melbourne Freight Terminal
The practice of using a third party (the shunt planner) to facilitate communication between Network Control Officers and train drivers at the Melbourne Freight Terminal prevented an effective response to the emergency.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
Proactive safety action taken by the Australian Rail Track Corporation
The ARTC has issued a Network Control Centre Notice (Notice number 021, issued 16/9/2015), drawing attention to the requirements of Standing Train Notice 1983/2009 and that all Network Controllers are to adhere to the instructions regarding the blocking of points over which a shunt is to traverse at the MFT.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Pacific National Pty Ltd
The Australian Rail Track Corporation
The driver of locomotive 8122
References
Rail Industry Safety and Standards Board (2010), Glossary of Rail Terminology – Guideline.
Code of Practice for the Defined Interstate Rail Network, Operations and Safeworking, Issue 2 – ARTC Annotated Version May 2002
ARTC Code of Practice for the Victorian Main Line Operations Issue 1, Revision 2, 07 August 2011
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Office of the National Rail Safety Regulator, Pacific National, the Australian Rail Track Corporation, and the driver of locomotive 8122.
Submissions were received from all parties. These were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
