A cabin altitude warning alarm on a Boeing 737 due to air conditioning pack switches being left in the OFF position highlights the importance of effective checklist management, a new ATSB investigation reports says.
As the 737 climbed through 13,500 feet during a July 2018 scheduled airline flight from Sydney to Melbourne, the aircraft’s cabin altitude warning horn sounded, resulting in the pilots donning oxygen masks. On hearing the alert the First Officer, who was the Pilot Flying, identified that both air conditioning pack switches were set to OFF, and immediately switched them to AUTO.
The Captain took over control of the aircraft and after the crew completed the remainder of the cabin altitude warning checklist, and with cabin pressure under control and operations normal, the flight continued to Melbourne.
Flight crews are reminded that effective checklist management is essential for verifying that critical procedural items are undertaken and ensuring safe aircraft operation.
The ATSB’s subsequent investigation of the incident found that normal procedures and checklists, which were designed to ensure that the aircraft is correctly configured for flight, were not completed due to a number of factors, including training, distraction, high workload, low expectancy of error, and supervision lapses.
“Flight crews are reminded that effective checklist management is essential for verifying that critical procedural items are undertaken and ensuring safe aircraft operation,” ATSB Director Transport Safety Dr Stuart Godley said.
The investigation noted that the the First Officer, who was under supervision from the Captain ahead of being checked to the line on the 737, had significant experience on other aircraft types. The First Officer had only recently joined the airline and a lengthy break in flying roles and significant gaps in the training program may not have allowed him sufficient time to consolidate the procedures to an intuitive level that was resilient to error.
As the First Officer was very experienced, the Captain may have relaxed his supervision of the First Officer, thus contributing to him not identifying the error at the time.
“Although a highly experienced pilot, the First Officer was still a trainee on the Boeing 737 and as such, required vigilant supervision of a training captain. This is a crucial defence against error by trainee pilots,” Dr Godley said.
Three people sustained minor injuries when an Xplorer passenger train entered a siding loop at twice the maximum track speed after the train passed a signal set to ‘Stop’.
The two-car Xplorer NP43 passenger service was operating between Werris Creek and Moree, New South Wales, on the afternoon of 10 June 2019. Shortly after departing Gunnedah, the train passed a signal set to ‘Caution’ – which indicated the next signal could be at ‘Stop’.
The driver, however, did not see the signal, and so he proceeded as normal. Later, the driver would report that he knew the location of the signal, but he had never seen it with a ‘Caution’ indication in the previous 12 years, which likely influenced his continuing at track speed.
By the time the driver saw the next signal and realised that it was set to ‘Stop’, there was insufficient distance to stop the train before crossing the points that would transition the train into the Whitehaven Coal Loop.
If safe sighting distance is reduced due to environmental factors, it is important to reduce speed and be prepared to stop.
The driver initiated an emergency brake application, but the train entered the Whitehave Coal Loop siding at approximately 110km/h. The increased lateral forces as a result of the train traversing the points in excess of the maximum track speed of 50km/h, resulted in the three injuries, where a passenger and a member of the crew were struck by flying objects, while another crew member was thrown from their seat, striking their head.
The train stopped approximately 400m into the coal loop.
The late running of the train service and time of the year meant the sun was lower than the driver was expecting or reportedly had previously seen, an investigation into the incident, conducted on behalf of the ATSB by NSW’s Office Transport Safety Investigations, found.
The investigation determined that the driver’s vision of the signals was likely impaired due to the position of the sun. The sun reflecting off the side of some stainless-steel coal wagons parked in the adjacent Gunnedah long loop prior to the signal set to ‘Caution’ possibly further impaired his vision. Under these conditions, the driver did not suitably adjust the speed of the train to allow for safe sighting of the signals.
The safety message from this investigation reminds train drivers of the importance of operating to current conditions, and with consideration to potential future conditions.
If safe sighting distance is reduced due to environmental factors, it is important to reduce speed and be prepared to stop.
Personnel working in and around aircraft have specific duties, and they also have a responsibility to advise the operating crew of any concerns they may have with an aircraft, a new ATSB investigation report highlights.
In preparation for an August 2018 scheduled flight from Perth Airport to Christmas Island, an apron engineer fitted landing gear ground locks (LGGL) to an Airbus A320 before it was towed to its departure bay. The apron engineer then went to supervise the refuelling of another aircraft, with the intention of returning for the refuelling of the A320 and removing the LGGL.
Approximately 40 minutes later, a flight crew member’s pre-flight walk-around identified the presence of the LGGL. The captain acknowledged the flight crew member’s observation but anticipated that normal departure procedures would lead to the removal of the LGGL before flight.
As departure approached, the apron engineer realised he would be unable to return for refuelling and contacted an engineer who was on-board the aircraft to supervise refuelling. The handover between the engineers was not effective at communicating the requirement to remove the LGGL. The on-board engineer supervised the refuelling and returned to the flight deck.
Due to rectification work in the flight deck, the flight crew commenced their pre-flight procedures later than anticipated. The crew did not detect that the LGGL had not been stowed on board the aircraft as required.
While waiting for pushback to commence, the pushback tug driver and dispatcher saw pins and associated flags attached to the landing gear of the aircraft. After being unable to contact the aircraft movements co-ordinator and with just seven minutes before the scheduled take-off, the tug driver removed the LGGL pins but unknowingly left the locking sleeves in place.
Regardless of someone’s specific role working around an aircraft, everyone has a responsibility to notify the operating crew of any concerns they may have with an aircraft and that any concerns are assessed and rectified by any qualified personnel before flight.
The tug driver then entered the cockpit to have the load sheet signed by the flight crew. Neither the tug driver nor the dispatcher advised the flight crew of the presence and removal of the lock pins.
The aircraft subsequently taxied for departure with the LGGL sleeves attached. A sleeve fell unnoticed onto the taxiway and the other fell onto the runway shortly after take-off. The flight crew were advised of the discovery of the discarded locking sleeves while on descent into Christmas Island, where the aircraft landed without incident.
“This investigation demonstrates how a number of relatively small errors or omissions between different work areas can combine to affect flight safety,” ATSB Transport Safety Director Dr Stuart Godley said.
“Regardless of someone’s specific role working around an aircraft everyone has a responsibility to notify the operating crew of any concerns they may have with an aircraft and that any concerns are assessed and rectified by qualified personnel before flight.”
The investigation found that a lack of documentation for the installation and removal of the LGGL following a positional tow and deficiencies in the handover between pre-flight engineers led to the locks remaining on the aircraft during flight preparation.
The ATSB welcomes the operator’s introduction of new procedures requiring an authorised person to sign an Aircraft Readiness Log to certify that the LGGL have been removed prior to flight. These new procedures also require that if the aircraft has been towed after the initial check, the LGGL must be checked again.
“Further, a notice has been issued to flight crews instructing them to use a standardised method for stowing LGGL pins and sleeves and a separate notice reminds ground handlers they should not remove pins themselves,” Dr Godley said.
The ATSB is highlighting the importance of following procedures after a lockout pin was not removed after maintenance, which resulted in an Airbus A320’s left engine thrust reverser not activating when selected on landing.
The Airbus A320 had undergone overnight maintenance in Adelaide before departing for Gold Coast Airport, on the morning of 18 December 2017, operating as a scheduled passenger flight. After a normal descent and touchdown, the captain selected both engine thrust reversers. The left reverser, however, did not activate. The aircraft decelerated using normal braking, and taxied to the gate without further incident.
The ATSB investigation into the incident found that the left engine thrust reverser lockout pin had not been removed after the overnight maintenance, and so the aircraft had returned to service with the thrust reverser deactivated. The lockout pin had not been booked out of the tool store, and its installation was not recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin’s removal were missed.
… the aircraft had returned to service with the thrust reverser deactivated...
“This investigation highlights the importance of considering the environmental conditions in which equipment and tools will potentially be used, as well as the importance of following procedures that, in this instance, should have resulted in detecting the error,” ATSB Director Transport Safety Stuart Macleod said.
“When considering the effectiveness of equipment, tooling and procedures that aim to minimise the consequences of an error, an engineered solution is generally more effective than relying on procedural compliance. Further, within procedural compliance a functional check is generally more effective than a self-check of work.”
In response to this incident, the aircraft’s maintenance organisation is taking a number of safety actions including highlighting the importance of the aircraft maintenance manual precautions to maintenance staff at Adelaide. All thrust reverser lockout pin warning flags are being lengthened to hang past the closed engine cowls, while pins will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.
Separately, Airbus has advised it has introduced an operational test of the thrust reverser system to confirm re‑activation after maintenance as part of the latest revision to the aircraft maintenance manual.
An unmanned aircraft’s collision with terrain highlights the importance of confirming the significance of any unexpected observations during pre-flight checks, an ATSB investigation has detailed.
The 9 January, 2019 accident occurred after the Insitu ScanEagle X200 unmanned aircraft system (UAS) was launched to conduct ‘beyond visual line of sight’ aerial survey work in the Woleebee Creek area of Queensland. The operating crew consisted of two pilots and two ground crew.
Shortly after launch, the X200 pitched up and then entered an aerodynamic stall. It self-recovered, but the pilots then received an alert indicating an airspeed sensor failure. The X200 continued to fly to its first programmed waypoint, oscillating as it passed out of sight. While the flying pilot was executing the emergency procedures checklist, the X200 entered a second aerodynamic stall. Once again, the UAS self-recovered, but then entered a third aerodynamic stall and collided with terrain. The aircraft was destroyed.
During the pre-flight check, the crew had not identified erroneous airspeed indications...
“A post-accident inspection of the wreckage identified a partial blockage to the aircraft’s pitot system,” said ATSB Director Transport Safety Stuart Macleod. “The pitot system provides data to the autopilot which is used to maintain controlled flight.”
The ATSB investigation found that the blockage in the pitot-static system resulted in the autopilot receiving unreliable airspeed data. During the pre-flight check, the crew had not identified erroneous airspeed indications, and the ground control station had not flagged them. This led to the X200 eventually entering an aerodynamic stall at a height that was insufficient for recovery.
“This occurrence highlights the importance of confirming the significance of any unexpected observations during the pre-flight checks, to minimise the risk of the aircraft departing with an unserviceability,” Mr Macleod said. “In addition, providing pilots and ground crew with the reasoning behind specific checks and procedures can enhance their ability to identify anomalies and perform the appropriate corrective actions in a timely manner.”
As a result of this accident, the manufacturer took several safety actions to prevent a recurrence, including providing support to pilots and ground crew in identifying anomalies, both on the ground and in-flight. All the operator’s pilots underwent refresher training with a focus on identification and emergency procedures regarding incorrect indications.
Additionally, updates to the operational software are intended to ensure that any spurious on-ground anomalies will be accompanied by an alarm, to prevent X200s being launched with any unidentified issues in the future.
An Australian Transport Safety Bureau investigation has found that community service flights conducted on behalf of Angel Flight Australia have a fatal accident rate per flight that is seven times higher than for other private flights.
That was a key finding of the first analysis to be undertaken in Australia to determine the relative safety of Angel Flight compared to other private flying operations, after a second fatal accident involving the charity in the past decade.
The analysis was conducted as part of the ATSB’s investigation into the collision with terrain of a SOCATA TB-10 Tobago light aircraft near Mount Gambier Airport, South Australia, on 28 June 2017. The aircraft had departed Mount Gambier in poor weather bound for Adelaide, transporting a young person to a medical treatment appointment on behalf of Angel Flight, accompanied by a family member.
Shortly after take-off the aircraft entered low-level cloud (estimated to be about 200 feet above ground level), and the pilot, who was not qualified to fly in other than visual conditions, probably became spatially disorientated, resulting in a loss of control of the aircraft.
Our analysis of the circumstances of this tragic accident highlights that passengers on Angel Flight community service flights, and indeed their volunteer pilots, are being exposed to much higher levels of risk
About 70 seconds after take-off, the aircraft collided with the ground. Both passengers and the volunteer pilot were fatally injured, and the aircraft was destroyed.
“The ATSB considers that the conduct of community service flights, where volunteer pilots flying private aircraft to transport those less fortunate requiring medical treatment from regional and rural Australia, demonstrates a laudable concern for others,” ATSB Chief Commissioner Greg Hood said.
“However, our analysis of the circumstances of this tragic accident highlights that passengers on Angel Flight community service flights, and indeed their volunteer pilots, are being exposed to much higher levels of risk compared with other types of aviation operations.”
Community service flights operating on behalf of Angel Flight do so as private flights, which the Civil Aviation Safety Authority (CASA) defines as “flying for pleasure, sport or recreation, or personal transport not associated with a business or profession”.
However, the ATSB investigation showed that the rate of safety occurrences, which can be pre-cursors of fatal accidents, was substantially higher for passenger carrying Angel Flight operations than other private operations. This is almost certainly due to pilots operating community service flights on behalf of Angel Flight being exposed to additional operational risk factors.
Source: South Australia Police
These include the potential for pilots to experience perceived or self-imposed pressures to take on what Angel Flight described as ‘missions’ to fly ill, unrelated passengers (rather than family or friends) at pre-determined times and locations to meet scheduled medical appointments, rather than at times chosen by the pilot.
“Angel Flight did not pressure pilots to fly in conditions beyond their capability, but some circumstances can lead a pilot to feel pressure anyway, such as the responsibility to fly unrelated ill passengers to meet medical deadlines. This can lead to degraded decision making under high-pressure situations, like when confronted with poor weather,” Commissioner Hood said.
On the morning of the Mount Gambier accident two regional airliner flights into Mount Gambier were delayed due to the poor weather, Commissioner Hood noted.
The ATSB’s analysis determined pilots flying on behalf of Angel Flight were more likely to make operational errors when compared to other private operations, particularly associated with flight preparation and navigation, airspace, runway events, and communications breakdowns.
“The community could reasonably expect that community service flights would have a level of safety at least commensurate with other private operations, if not higher. However, this investigation has shown that those conducted for Angel Flight are actually less safe than other private operations, let alone charter and scheduled airline flying,” Commissioner Hood said.
Earlier ATSB research has already established that private flying has a fatal accident rate per flight that is eight times higher than commercial charter operations and 27 times higher than low-capacity scheduled airline flying. Further, there have been no fatalities involving a high-capacity airliner in Australia in more than 40 years.
“Given the factors identified for the accident at Mount Gambier and previously with another Angel Flight fatal accident in 2011, supported by the differences identified in the analysis of safety occurrences and consistent with findings from investigations of similar organisations in the United States, the ATSB considers that measures must be undertaken to improve existing risk controls,” Commissioner Hood said.
The ATSB commends Angel Flight for initiating some pro-active action on a number of the investigation’s identified safety issues, including developing an online safety course, planning a pilot mentoring program, and implementing a safety management system. The ATSB will continue to monitor the implementation of these and other controls to ensure pilots receive sufficient support and guidance to deal with the additional risks faced by private pilots when conducting a flight on behalf of Angel Flight.
However, the ATSB has issued a formal safety recommendation to Angel Flight Australia, recommending that it consider paying for commercial flights where they are available to transport its passengers.
“This ATSB investigation showed that commercial passenger flight options are available for nearly two-thirds of the private flights organised by Angel Flight,” Commissioner Hood said.
Angel Flight could purchase tickets on commercial flights for two passengers for a comparable cost to the organisation to what they normally reimburse for the fuel costs of privately-operated flights. Taking into account other passenger needs, 30 to 40 per cent of flights could be done using existing commercial flights.
“As a charity established to transport rural and regional people with limited financial means to medical appointments, the ATSB considers that Angel Flight could and should include the fact that commercial passenger flights have a lower safety risk to passengers than private operations as a factor when they are organising flights.”
Commissioner Hood noted that on the day of the Mount Gambier accident, suitable and cost-comparative airline flights were available.
In response to a separate safety issue raised by the ATSB’s investigation, CASA has taken proactive safety action by ensuring community services flights can now be identified separately to other private operations, which will better enable it to identify risks in the sector into the future.
“The ATSB is supportive of the community service flight sector, however, based upon the analysis conducted, it is essential that the controls for risk are strengthened to prevent further accidents,” Commissioner Hood said.
On the morning of 31 July 2017, a team of four Sydney Trains infrastructure maintainers was conducting a series of regular inspection and measurements at points along the Illawarra Main and Local lines at Tempe in Sydney’s inner west.
Two of the workers were acting as an inspection team, entering the danger zone (the area within three metres horizontally from the nearest rail) and accessing the track.
The other two workers acted as lookouts, using the Lookout Working method, which consists of rules for working in the danger zone using lookouts, and requires all workers and equipment to be completely within a safe place a minimum of 10 seconds before rail traffic passes their location.
Conducting work on or near railway track can be dangerous if safeworking rules and procedures have not been correctly implemented.
At approximately 10.00am, an empty passenger train was travelling on the Illawarra Local line when the driver observed the work group in the danger zone. He applied the brakes and blew the horn, and the workers began to move off the line towards a safe place to the side of the track. A review of the CCTV footage from the train showed that the workers had not yet reached a safe place when the train passed their location, approximately seven seconds after the train first observed them. There were no injuries or damage.
The investigation, conducted on behalf of the ATSB by NSW’s Office of Transport Safety Investigations (OTSI), found issues with the workgroup’s reliance on Lookout Working for worksite protection. Each lookout had been positioned to watch in different directions – one monitoring for Up trains, the other for Down trains. This incident occurred when the Down lookout had turned away to monitor the situation with an approaching Up train (which did not pose an immediate risk to the work group), and then turned back to find that a Down train was also approaching. He was not able to sound the warning to the work group and give them sufficient time to clear the danger zone to a safe location before the train neared their location.
Compared to other worksite protection methods, Lookout Working does not warn, or restrict trains from approaching, or entering a work location. The investigation found that Lookout Working had been implemented in an area deemed not suitable on the Sydney Trains rail network.
Additionally, there was not a clear understanding within the work group of various elements of the Lookout Working system, resulting in reassessments not being made, the Up lookout being posted in an inappropriate area, and a misunderstanding of what constituted a safe place.
The ATSB safety message from this investigation stresses that where practical, rail transport operators must require track workers to continually re-assess the site risks, add and or combine safety measures (like an Automatic Track Warning System, or audible warning devices), or implement a higher form of protection.
A hot air balloon in-flight fire demonstrates the importance of pilots preparing for the possibility of fire, including rehearsing emergency procedures and wearing appropriate protective clothing, a new ATSB investigation highlights.
The 26 December 2018 scenic flight had departed Wandin, Victoria, with a pilot and 15 passengers on board.
Twenty minutes into the flight, while at an altitude of about 800 ft, the pilot heard a small explosion from the front left burner and then observed a small fire had started on the outside of the burner. Despite attempts to extinguish the fire, it re-ignited twice and the pilot’s compartment caught fire.
About eight minutes after the fire first ignited, the pilot identified a suitable landing position. During the decent, the basket struck some treetops and ropes became tangled in the branches. The branches whipped around and into the basket, and one passenger sustained cuts to his hand.
As the basket touched the ground, the passengers on the right-hand side of the basket jumped out, causing the right side of the basket to lift off the ground again. In response, the pilot quickly pulled the red line to evacuate the hot air from the envelope and brought the basket back down to the ground. The remaining passengers then jumped out and ran to safety.
The fire continued to burn as the pilot secured the balloon. When emergency services arrived on site, flames had engulfed the balloon. By the time firefighters extinguished the flames, the fire had destroyed the balloon.
In the event of an in-flight balloon fire, the first priority must be the isolation of the fuel supply at the fuel tank.
The ATSB investigation found that a fuel leak at the front left burner has resulted in the fire. After the fire broke out, the hand-wheel valve on the liquid outlet of the fuel tank and the pilot burners were not shut off, which resulted in the pilot being unable to control the fire.
“Pilots experience a high workload during in-flight emergencies. However, in the event of an in‑flight balloon fire, the first priority must be isolation of the fuel supply at the fuel tank,” said ATSB Executive Director Transport Safety Mr Nat Nagy.
“In addition, it is good practice to rehearse emergency procedures by standing in the basket to run through the checklist steps.”
Mr Nagy noted that further ways to reduce risk to individuals and improve survivability outcomes include wearing appropriate protective clothing, including cotton long‑sleeved shirts and trousers, leather gloves, and enclosed footwear.
“Operators should also consider utilising componentry that provides a visual indication of the system status, for example, 90‑degree valves on liquid outlets.”
Sighting from road vehicles can be severely restricted at passively protected level crossings with an acute angle road-to-track interface, a new investigation highlights.
On 13 July 2016, a Warrnambool-bound passenger train collided with a semi-trailer at the Phalps Road level crossing at Larpent, near Colac, Victoria. The level crossing was passively controlled with stop signs.
When the truck initially stopped at the crossing, the train was more than 300 m away. The truck commenced moving towards the track when the train was between 220 and 260 m from the crossing. Unaware of the train approaching beyond his line of sight, the truck driver entered the level crossing.
The driver heard the train’s horn shortly before the locomotive struck the truck’s semi-trailer. After impact, the train’s locomotive and all passenger cars derailed. The locomotive driver, train conductor, 18 passengers and the truck driver were injured. There were no fatalities.
… sighting from road vehicles can be severely restricted at passively protected crossings with an acute angle road-to-track interface. It is important that available risk controls be deployed in these circumstances and road users take special care…
The investigation, conducted by Victoria's Chief Investigator, Transport Safety, on behalf of the ATSB, found the driver was unable to detect the approaching train on his left due to his restricted view from the level crossing’s acute road-to-rail angle and the composition of the truck’s passenger-side window.
The ATSB safety message from this investigation highlights that sighting from road vehicles can be severely restricted at passively protected crossings with an acute angle road-to-track interface. It is important that available risk controls be deployed in these circumstances and road users take special care.
The ability of a truck driver to see along a railway track to their left can be affected by in-cab obstructions. The Australian Design Standard for passively controlled level crossings accounts for this possibility by requiring a viewing angle of no more 110 degrees for a driver looking to their left from the straight-ahead direction. If this viewing angel is exceeded, passive level crossing controls should not be used.
The investigation found that for a vehicle stopped at the northern side of the Phalps Road level crossing, the viewing angle to achieve the required sighting distance was 116 degrees. The Phalps Road level crossing was subsequently upgraded to active protection controls in August 2016.
Since the accident, V/Line has taken action at 25 passenger line passively controlled level crossings with left-hand viewing angles that exceed the Australian Standard. Nine have been upgraded, one has had restricted access gates installed and 15 have had speed restrictions put in place. A further 24 crossings have also been nominated for upgrade.
The derailment of a loaded coal train between Emerald and Rockhampton in Queensland in January 2018 highlights the need for track managers to develop, maintain and consult network hazard registers to identify locations at risk of buckling due to compressive rail stress, according to a new ATSB investigation.
The day before the derailment, the affected track had been subject to ballast-cleaning operations. The track was then tamped, aligned, and stabilised, with a second and final pass of this work taking place the next morning.
That afternoon, as the nearly 2 km long train EF01 was descending a steep grade, the driver noticed a track buckle forming ahead of the train. After applying emergency braking the train came to a halt 65 seconds after the lead locomotive had passed over the track buckle.
The first wagon to derail travelled for over half a kilometre before the train stopped. Of the 17 wagons that derailed, 13 were extensively damaged and unlikely to be repaired. Just over half a kilometre of track on the down line and 54 m of track on the adjacent up line was damaged, with rails, sleepers and overhead line equipment needing replacement.
This investigation highlight the importance of developing, maintaining and consulting a network hazard register to identify locations at risk of buckling, and producing site-specific risk assessments that consider rail stress when planning track disturbing maintenance work.
The ATSB determined the accumulative effect of the track’s steep grade, with its proximity to a turnout and a high ambient temperature lead to the track to buckle. The ATSB also found the ballast cleaning operational plan did not consider compressive rail stress as a risk at this location.
”This investigation highlights the importance of developing, maintaining and consulting a network hazard register to identify locations at risk of buckling, and producing site-specific risk assessments that consider rail stress when planning track disturbing maintenance work,” said ATSB Director Transport Safety Dr Stuart Godley
“The accident also demonstrates that effective rail stress management is dependent on a knowledge of the rail stress free temperature and the identification of any variations from that stress free temperature.”
As a result of the accident, track manager Aurizon Network has changed its procedures to ensure a temporary speed restriction is applied to all work sites on which ballast undercutting has been performed. The restriction is to remain in place until rail adjustment or stress testing has been completed and it has been determined that the rail stresses are within accepted limits.
In addition, sites with a high risk of compressive rail stress will be identified and added to the site hazard map before conducting ballast cleaning.
