Correct management of an abnormal situation and effective crew coordination ensured the safe return of a United Airlines Boeing 787 to Sydney on 17 April this year.

An Australian Safety Transport Bureau (ATSB) investigation found that all emergency procedures were carried out efficiently and effectively. The captain involved all relevant crewmembers and the ground-based technical operations maintenance controller (TOMC) in making a decision to return the aircraft to Sydney.

The situation occurred when a faulty oven resulted in smoke and fumes setting off a fire alarm on the San Francisco-bound flight UAL870, comprising 238 passengers, 11 cabin crew and four flight crew.

During departure, cabin crew switched on the aft galley ovens in preparation for meal services. After the two ovens were switched on, there was a short burst of smoke, with one of the ovens displaying a “FAILURE” message.

Several cabin crew detected a strong chemical odour and an electrical smell, as well as a blue haze. Other crew described it as an ozone smell. The oven interactive screen displayed a ‘Critical Error- Broken Fuse’ message.

The crew immediately pulled all relevant circuit breakers, and switched off all electrical sources to the aft galley. The inflight service manager (ISM) advised the captain. The ISM and a relief pilot from the cockpit arrived at the aft galley with fire extinguishers. By this stage, the smoke had dissipated, but the odour persisted. As it could not be confidently ascertained that the ovens were the sole source of the problem, the captain contacted the TOMC by satellite phone.

The discussion with the TOMC involved all flight crew and the ISM. It was agreed that the safest option was to return the aircraft to Sydney. The captain advised ATC by a PAN call. ATC initiated an INCERFA phase. About 110 km east of Port Macquarie, NSW, the crew commenced a return to Sydney. As the aircraft was well in excess of its allowed landing weight, fuel was dumped during the descent.

The aircraft landed without incident in Sydney at 1258 Eastern Standard Time (EST) with emergency services attending.

A post-engineering inspection quarantined the suspect oven, and after an inspection, a fuse was replaced. After appropriate testing, the aircraft was released back to service.

Boeing and the oven manufacturer investigated the cause of the ‘Critical Error’ fault displayed on the oven screen. The manufacturer individually tested all oven components. They reported that all individual components worked correctly, however, an additional measurement of the oven motor current detected that the motor did not run smoothly. The motor temperature was also above normal, most likely from insufficient airflow. This known fault had been rectified with a new oven software release.

Boeing reported that the oven manufacturer was working with United Airlines to update the software in all relevant ovens in their fleet. The exact cause of the odour could not be determined.

Read the final report: Smoke and fumes event involving Boeing 787, N36962, 110 km east of Port Macquarie, New South Wales, on 17 April 2016

An accident where a rail worker was struck by a passenger train near Laverton station in Victoria shows why it’s essential workers follow safeworking rules and procedures when working on or near railway tracks.

A report by the Australian Transport Safety Bureau (ATSB) found that on the morning of 2 October, 2015, a track was accessed by a workgroup without an assessment of risks and without the establishment of appropriate risk controls.

This meant that not all in the group had a clear understanding of train movements that morning, nor was there a defined position of safety known to all the workers.

The ATSB found that the train was given the all clear to proceed prior to the supervisor moving to a position of safety, clear of all tracks. There were several breaches of safeworking procedures that, while not directly contributing to this accident, increased the risks associated with the workgroup’s activities.

On that Friday morning, track workers were assembling track-side in Laverton, Victoria. They planned to undertake dogspike removal works in preparation for re-sleepering of a section of track on the Altona Loop Line.

At around 0910, the supervisor for the works began marking the track to identify those dogspikes to be removed. He was working in a track crossover about 400m on the Melbourne side of Laverton Railway Station. A lookout had been stationed for his protection.

At about 0916, a Metro Trains Melbourne suburban commuter train arrived at Laverton station, bound for Flinders Street Station in central Melbourne. After its scheduled stop, the train departed Laverton and approached the worksite. The lookout observed the train, warned workers of its approach and signalled to the driver that the track was clear.

However, as the train took the crossover, the supervisor was foul of the track, and was struck by the train travelling at about 59 km/h. The supervisor suffered serious injuries.

The supervisor was foul of the track when the train reached his location. It is probable that he expected the train to continue along an adjacent track, and not take the crossover towards his location.

Since the incident, Metro Trains Melbourne has increased the frequency of audits of infrastructure worker compliance with safeworking procedures.

The key safety message is that working in rail corridors carries significant risks that should be mitigated by adhering to established safeworking procedures.

Read the final report: Track worker struck by passenger train, near Laverton station, Victoria, on 2 October 2015

Additional information about safe work on rail.

An incident where the pilot of a Glasair Sportsman GS-2 was temporarily blinded after a large eagle broke through the windscreen, highlights the serious hazards of aviation wildlife strikes.

On 24 December 2015, the pilot of a Glasair Sportsman GS-2 was conducting a private flight from Southport, Queensland, to Moruya, New South Wales (NSW), with a refuel stop at Mudgee, also in NSW. The pilot was the only person on board.

While cruising at 5,500 ft above mean sea level near Bathurst, NSW, the aircraft collided with a large bird, believed to be a wedge-tailed eagle. The bird broke though the windscreen on the left side of the aircraft and struck the pilot. The collision left the pilot with serious facial injuries and they were temporarily unable to see. The pilot was wearing a headset and spectacles, which were both dislodged and damaged during the collision. Following the birdstrike, the aircraft entered a rapid descent, but the pilot recovered sufficiently to regain control. Despite the broken windscreen and their injuries, the pilot was able to divert to Bathurst Airport and land successfully.

During their ordeal, the pilot had been able to locate the microphone of the headset and transmit a MAYDAY call. But damage to the headset meant they were unable to hear any incoming transmissions. Although air traffic control (ATC) received the MAYDAY call, they did not know the callsign or specific location of the aircraft involved, or the intentions of the pilot. About 30 minutes after the MAYDAY call, the Safety Officer at Bathurst airport contacted ATC to advise them that an aircraft with a broken windscreen (the result of a birdstrike) had landed at Bathurst.

ATSB research report (AR-2104-075) titled Australian aviation wildlife strike statistics provides some insights into the nature and characteristics of birdstrikes. The August 2010 edition of the Flight Safety Foundation magazine (AeroSafety World) includes an article titled Bird Strike Mitigation Beyond the Airport(Opens in a new tab/window), which provides some interesting comments regarding bird behaviour and the possible effects of a birdstrike on general aviation aircraft.

This incident highlights the serious hazard to aviation presented by birds, not only near aerodromes. A birdstrike can cause substantial damage which has the potential to significantly adversely affect the performance and handling qualities of an aircraft. When declaring an emergency, pilots are encouraged to relay as much relevant information as reasonably possible (acknowledging that the circumstances surrounding this incident made effective communication very difficult). Positional information and information with respect to the intentions of the pilot may be critical to an effective response by emergency services.

Read the final report: Birdstrike involving Glasair Sportsman GS-2, N666GM, near Bathurst, New South Wales, on 24 December 2015

The ATSB is urging road and rail authorities to consider safer road design at railway crossings, after a tragic collision between a road-train truck and grain train.

On 23 September 2015, an eastbound road-train truck, hauling grain, collided into the side of Pacific National grain train 8834N, (travelling on the main line between Narromine and Peak Hill) at the Tullamore – Narromine Road railway crossing, about 4 km southwest of Narromine, in New South Wales. The railway crossing was controlled by flashing lights, an audible warning device (bell); passive warning signs installed on the road approaches and road surface markings.

The collision and a post-impact fire destroyed the prime mover and one of the two trailers; the truck driver was fatally injured. The crew of the train were physically unhurt. As a result of the impact two wagons, were damaged, one of which derailed. Some of the railway crossing infrastructure (flashing lights) was destroyed and required replacement.

The ATSB found that the driver of the road-train truck was probably travelling too fast for the prevailing conditions, and entered the Tullamore – Narromine Road railway crossing while it was active, and the flashing lights were operating. It was concluded that the truck driver’s attention was probably focussed on negotiating the sweeping right-hand curve that preceded the crossing, at a critical time when he needed to check for the activation of the crossing. It is likely that when the driver perceived that the flashing lights were operating, he was too close to the crossing to stop, and collided with the train.

The ATSB identified a number of areas of potential improvement related to road design (signage and standards associated with railway crossing traffic control) especially with respect to curved approaches, before railway crossings.

Furney Flour Mills, the Narromine Shire Council, and Standards Australia have implemented a range of initiatives to reduce the risk of a similar occurrence in the future, including:

• enhanced employee training and medical assessment initiatives
• provision of additional (road) approach passive warning signs, (W7-4) plus a review of road alignment and railway crossing road approach speeds
• a review of AS 1742.7-2016, with respect to railway crossing approaches, in particular curved approaches, and the location of signage.

Safety message

Although the road rules (NSW - Road Rules 2014) make motorists primarily responsible for avoiding a collision with a train at railway crossings, prudent road design and/or advance warning of a train’s presence at railway crossings should be considered as a strategy to lower the risk of road and rail vehicle collisions.

Road and rail authorities should consider added measures to enhance the situational awareness of motorists approaching railway crossings, especially at locations with restricted sighting due to curved approach roads.

It is imperative that road vehicle drivers always approach railway crossings with extreme care. The level of care and attention required increases as road vehicle gross mass increases.

Read the final report: Collision involving road-train truck and train 8834N, near Narromine, New South Wales, on 23 September 2015

The crew of this Tiger Airways A320 followed emergency procedures effectively to handle a potentially serious situation that affected three cabin crew members.

On 1 March 2016, a Tiger Airways Airbus A320 aircraft departed Brisbane, Queensland, on a scheduled passenger service to Melbourne, Victoria. On board were the captain, the first officer, four cabin crew members, and 63 passengers.

At about 0900 when the aircraft was above Parkes, New South Wales, the cabin crew detected a strong odour in the rear of the cabin, and notified the captain. The cabin crew were unsure what the smell was, but they later described it as being similar to an extinguished cigarette.

At 0933, as the aircraft was about 211 km north of Melbourne, the cabin crew manager advised that three cabin crew members were feeling unwell, and that one had vomited.

The flight crew contacted air traffic control, declared a PAN, and requested direct tracking to Melbourne. The captain advised the passengers that fire vehicles and ambulance would be present for their arrival at Melbourne Airport. 

After landing, the aircraft taxied to the bay, followed by the airport rescue and firefighting service. After shutting the engines down, the captain advised the fire commander that other than sick members of the cabin crew, everything was normal. The fire crew did not find any source of fumes or fire, nor did a subsequent engineering inspection reveal the source.

This incident demonstrates effective crew resource management techniques to deal with an abnormal and evolving situation.

Read the final report: Fumes event involving Airbus A320, VH-VNO, 211 km north of Melbourne Airport, Victoria, on 1 March 2016

On 25 September 2015, a Cessna 550 aircraft (Citation Bravo), registered VH-FGK, taxied at Lismore Airport for a private flight to Baryulgil, New South Wales. The flight crew consisted of a captain and copilot, who were the only occupants of the aircraft.

The flight crew did not detect anything abnormal during the taxi and take-off roll, until the captain attempted to rotate the aircraft to the take-off pitch attitude. When the aircraft had achieved the required rotate speed, the captain applied the normal backpressure on the control column to achieve a standard rate of rotation, and the aircraft did not rotate. The captain then applied full backpressure and reported that the controls felt very heavy. Neither the captain nor the copilot detected any change in the aircraft’s pitch attitude or any indication of pitch-up on the attitude direction indicator.

The captain rejected the take-off, applied full braking and reverse thrust, but the aircraft overran the runway. The nose landing gear detached from the aircraft about 50 m beyond the end of the sealed runway, and the aircraft came to rest in long grass and mud. The aircraft sustained substantial damage, and the captain and copilot were uninjured.

The aircraft did not accelerate normally as the acceleration was retarded by drag associated with rolling friction. This was indicative of partial brake pressure remaining during the take-off run. The partial brake pressure was possibly due to the parking brake being selected on at the holding point with enough pressure to retard aircraft acceleration during the take-off, but not sufficient to prevent the aircraft reaching rotate speed.

Furthermore, the nose-down moment generated by the partial brake pressure probably prevented the aircraft rotating sufficiently to become airborne, despite normal nose-up elevator deflection.

Heat in the brakes due to partial pressure during the take-off run may have reduced their effectiveness when the captain rejected the take-off, contributing to the runway overrun.

The Australian Transport Safety Bureau issued a safety recommendation that Textron Aviation (Cessna) take safety action to address the fact that Citation aircraft do not have an annunciator light to show that the parking brake is engaged and the Cessna 'before take-off' checklist does not include a check to ensure the parking brake is disengaged.

Safety message

For pilots, this incident highlights the importance of attention to the configuration of the aircraft and cockpit settings at all stages of flight, but particularly during take-off. For manufacturers, this incident highlights the importance of systems that bring an irregular or abnormal configuration or cockpit setting to the attention of the crew, especially when that configuration has the potential to adversely affect aircraft performance or control.

Read the final report: Runway excursion involving a Cessna 550, VH-FGK, Lismore Airport, New South Wales, on 25 September 2015

A fatal Cessna 172S aircraft accident highlights the dangers of an aircraft stalling and then spinning while conducting turning manoeuvres, particularly at low heights.

On 29 December 2014, a Cessna 172S aircraft departed Cambridge Airport, Tasmania to photograph yachts participating in the 2014 Sydney Hobart race as they made their way around the southern coast of the Tasman Peninsula. On board the aircraft were the pilot and a photographer.

At about 1815 the aircraft commenced low-level photographic runs on yachts to the east of Cape Raoul. Shortly after completing a run on one yacht at a height of about 50 ft, the aircraft entered a steep turn. The aircraft had almost completed a 180° turn when the upper (right) wing dropped sharply while the aircraft’s nose pitched down to almost vertical. The aircraft impacted the water’s surface in an almost vertical nose down attitude with wings about level. Both aircraft occupants were fatally injured, and the aircraft was seriously damaged.

As a result of the steep turn, the aircraft’s upper wing aerodynamically stalled, resulting in a rapid rotation out of the turn. The aircraft’s steep pitch attitude on impact indicated that, because of the stalled upper wing, the aircraft entered a spin. There was insufficient height for the pilot to recover the aircraft. The final turn was not in accordance with the pilot’s training for low-level flight. Cessna identified that any C172 type aircraft that enters a stall/spin condition will require significant height to recover.

The Civil Aviation Safety Authority had issued the operator with a dispensation that permitted low-level flight down to 150 ft above obstacles. Low-level photographic operations on yachts conducted by the operator had been consistently flown at heights down to 50 ft. Although the aircraft was being operated at a height lower than that authorised by the dispensation, that in itself was not likely to have contributed to the accident.

The ATSB examined the role of the operators’ Safety Management System (SMS). While it was not established that the safety risk management processes and practices directly contributed to the occurrence, there were aspects that the operator could consider working towards to more effectively identify all key operational risks.

The operator advised that it has ceased low-level photography flights.

Safety message

Turning manoeuvres at or close to the aircraft’s critical angle of attack, or stall speed, if poorly handled, can result in a stall that will probably result in the aircraft entering a spin. This is particularly true for aircraft under 5,700 kg. The normally benign stalling characteristics of these aircraft types are exacerbated by the spin entry, which results in a steep pitch down and rotation towards the stalled wing. Recovery from this condition will take a considerable amount of altitude, dependant on the speed of response by the pilot and the use of appropriate control inputs.

Read the final report: Collision with terrain Cessna 172, VH-PFT, Maingon Bay (9 km south of Port Arthur), Tasmania, on 29 December 2014

A collision between an aircraft and aerobridge highlights the difficulties in detecting slow aircraft movement and why flight crew should remain aware of this possibility whenever the engines are running.

On 22 April 2013, the flight crew of a United Airlines Boeing 747-422, flew from Sydney, New South Wales to Melbourne, Victoria. At Melbourne, the crew taxied to gate D5 and stopped, applying the parking brake. Shortly after stopping, the aircraft started to move forward again slowly. The flight crew realised the aircraft was moving and re-applied the brakes. The aircraft’s left wing collided with the aerobridge before the movement had stopped. No one was injured during the occurrence and the aircraft sustained minor damage.

After stopping at the gate, the aircraft parking brake was likely inadvertently released before the nose wheels were chocked and the engines shut down. The flight crew’s attention was inside the cockpit, focused on shutting down the engines. As such they were not actively monitoring aircraft movement, nor was that required at this stage. In addition, the parking guidance system at the gate was set to emergency stop mode by ground personnel when the aircraft first arrived, removing the possibility of an alert for the flight crew that the aircraft had moved. The flight crew became aware of the movement when the captain detected motion through peripheral vision. The very slow acceleration, combined with a lack of visual cues available to the flight crew made it difficult for the crew to detect the movement in time to prevent the collision.

Safety message

This occurrence highlights the importance of flight crew remaining aware of the possibility of aircraft movement whenever the engines are running as aircraft movement, particularly if it is slow, is difficult to detect. Additionally, ground support crew are reminded of the need to leave the parking guidance system in normal mode, unless an emergency stop is required.  

Read the final report: Collision with aerobridge involving Boeing 747-422, N119UA, Melbourne Airport, Victoria, on 22 April 2013

At about 1901 on 22 August 2014, a V/Line train travelling the Werribee line on the Melbourne Metropolitan Rail Network collided with a stationary Metro Trains Melbourne (MTM) passenger train between Maidstone Street level crossing and Kororoit Creek Road. The MTM train had come to an unintended stop due to a loss of air pressure in its braking system.

The V/Line train had stopped at an Automatic signal that was indicating a Stop aspect and after a short while proceeded past the stop signal. Trains can proceed past an Automatic signal at Stop under conditions specified by an operating rule. Shortly after passing the signal, the train collided with the rear of the stationary MTM train at 43 km/h. The MTM train was carrying 51 passengers at the time of the collision. The driver and conductor on the V/Line train, the driver of the MTM train and eight passengers on the MTM train sustained minor injuries in the incident.

The ATSB found that the operating rule permitted the V/Line train to proceed past a signal at Stop into a section that was occupied by the MTM train. The V/Line train was operated past the signal at Stop in a manner contrary to the operating rule and proceeded at a speed that reduced the opportunity to observe the train ahead and stop in time. The rule placed reliance on the train driver to provide separation between trains by line-of-sight observation and was not an effective defence against errors.

The ATSB also found that the marker lights on the MTM train (Comeng type) did not meet the requirements of the Australian Standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS/RISSB 7531.3:2007 for permissive working. This standard was developed by the Rail Industry Safety Standards Board (RISSB) and although MTM had adopted this Standard, it was not implemented on the Comeng trains in their fleet.

Metro Trains Melbourne has amended the existing procedure in Section 3 Rule 1 of The Book of Rules and Operating Procedures 1994 for permitting trains to pass an uncontrolled, unmonitored signal at Stop. The new amendments incorporate a procedure, which requires train drivers to contact and respond to an automated voicemail facility providing their details, the rail vehicle details and details of the signal at Stop.

Metro Trains Melbourne has advised the ATSB that a modification is being developed to increase the intensity of the marker lights of Comeng trains to a level compliant with the Australian Standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS/RISSB 7531.3:2007.

Safety message

The rules pertaining to permissive signalling rely on a train driver to provide separation between trains by line-of-sight observation. In the hierarchy of hazard controls, rule based controls are considered the least effective defence against human error or violations. Train operators should institute additional risk mitigation measures, where safeworking systems allow permissive working.

Read the final report: Collision between V/Line train 8280 and MTM train 6502, Altona, Victoria, on 22 August 2014

On 24 October 2014, the Melbourne to Sydney XPT service ST24 was approaching Culcairn station when there was a severe vibration. The driver stopped at the station and upon inspecting the train found that the axle had broken adjacent to the bearing box on the fourth passenger carriage. There were no injuries to passengers or crew. The passengers continued their journey to Sydney on chartered buses.

The ATSB found that the axle bearing had failed and completely seized, probably due to cage failure.

The probable cage failure caused the rollers to misalign and seize. This seizure of the rollers generated friction and excessive amounts of heat into the bearing journal. The heat applied to the bearing journal caused it to go ‘plastic’ and separate from the axle (commonly referred to as a screwed journal). In this case, much of the evidence was either lost or damaged beyond useful examination. Consequently, there was insufficient evidence available to determine why the bearing cage may have failed.

The ATSB also identified that ARTC train control, despite receiving reports of trackside fires, made contact with NSW Trains operations, rather than directly with the driver. It is unlikely that direct communication with the driver of ST24 would have resulted in a different outcome in this case because, by the time the potential cause of fires was known, ST24 was already on its way to Culcairn. However, in some scenarios, communicating directly with the train driver would likely ensure a more timely response to issues that may affect the safety of the network.

ARTC will ensure that all matters relating, or potentially relating to, the safety of a train operating on the network will be advised in the first instance to the driver of the involved train by the relevant Network Control Officer.

Safety message

Any issues with train services that can compromise the integrity and safety of the network must be communicated directly to the train driver. Communicating through a third party can compromise a timely response.

Read the final report: Axle failure on XPT ST24, Culcairn, New South Wales, on 24 October 2014