The non-operation of rail level crossing protection following track maintenance highlights the need for formal processes for inhibiting, reinstating and testing rail level crossing protection before rail services resume, an ATSB reports says.
On the night of 21-22 September 2018, active protection at eight railway level crossings between the Warncoort Loop and Camperdown in regional Victoria was removed to facilitate overnight track maintenance. Active protection was due to be reinstated and the operation of crossing protection equipment tested at each level crossing before the track returned to service the next day.
The next morning, the driver of the Melbourne-to-Warrnambool service noticed the flashing lights for the Hart Street level crossing in Colac were not operating, the investigation report, conducted on behalf of the ATSB by Victoria’s Chief Investigator, Transport Safety, noted.
The driver made an emergency brake application but was unable to stop the train from entering the crossing. Fortunately, there was no road traffic at the time.
A subsequent inspection of the Hart Street crossing found that its active level crossing protection equipment was still inhibited from the previous night’s maintenance work.
Those involved in the activity had only partially restored the crossing protection and the track was returned to service with the Hart Street level crossing protection not operational.
When removing or isolating safety equipment it is important to have formal procedures that require the recording of the isolation, reinstatement and testing to ensure the work is complete
The investigation found that V/Line did not have formal detailed processes for inhibiting, and then reinstating rail level crossing protection equipment.
“When isolating safety equipment, it is important to have formal procedures that require the recording of the equipment’s isolation, reinstatement and testing, in order to validate that restoration work is completed before rail services resume,” the investigation report’s safety message stresses.
Without the benefit of any prescribed procedure there was no process for those doing the work to record and check their actions and ensure correct and complete reinstatement of the level crossing protection.
V/Line has since developed new procedures for inhibiting and reinstating rail level crossing protection, and has reviewed resourcing for similar complex maintenance work.
The combination of a wiring error and deterioration of insulation resistance in an uncouple solenoid connector lead to the uncoupling of a suburban passenger train travelling from Flinders Street to Lillydale Station, a new ATSB investigation report says.
Shortly after leaving Croydon Station, the two 3-car train set uncoupled at its mid-point while on a left hand curve, about 800 m from the station. About halfway through the curve the driver noticed the train had uncoupled with the trailing 3-car set detaching from the train. The train, with 150 passengers on board, was travelling at about 78 km/h when it uncoupled with the trailing car set travelling under emergency braking for nearly 200 m before coming to a stop. There were no injuries to passengers or crew.
The investigation, conducted on behalf of the ATSB by Victoria’s Chief Inspector, Transport Safety, found an undetected wiring error from a modification to the wiring of the low-note whistle of the lead car of the train combined with a deterioration of insulation resistance in the uncouple solenoid resulted in a error circuit forming to energise and trigger the uncoupling.
The ATSB safety message from this investigation highlights the importance of ensuring a verification program is incorporated into quality assurance systems to mitigate the risk of errors during installation and modification of electrical systems.
This investigation highlights the importance of ensuring a verification program is incorporated into quality assurance systems to mitigate the risk of errors during installation and modification of electrical systems
A function test alone would not have revealed the wiring error; an assurance program involving a secondary and independent check of the wiring modification may have been the only means of detecting the error, the investigation notes.
Following the incident Metro Trains Melbourne inspected found 11 car-sets with low-notes whistles wired incorrectly and rectified the error.
The ATSB welcomes the updates to the Metro Trains Melbourne’s low-note whistling documentation to prevent further wiring errors and the addition of an independent check of any future wiring work in the form of a supervisor check.
A cabin altitude warning alarm on a Boeing 737 due to air conditioning pack switches being left in the OFF position highlights the importance of effective checklist management, a new ATSB investigation reports says.
As the 737 climbed through 13,500 feet during a July 2018 scheduled airline flight from Sydney to Melbourne, the aircraft’s cabin altitude warning horn sounded, resulting in the pilots donning oxygen masks. On hearing the alert the First Officer, who was the Pilot Flying, identified that both air conditioning pack switches were set to OFF, and immediately switched them to AUTO.
The Captain took over control of the aircraft and after the crew completed the remainder of the cabin altitude warning checklist, and with cabin pressure under control and operations normal, the flight continued to Melbourne.
Flight crews are reminded that effective checklist management is essential for verifying that critical procedural items are undertaken and ensuring safe aircraft operation.
The ATSB’s subsequent investigation of the incident found that normal procedures and checklists, which were designed to ensure that the aircraft is correctly configured for flight, were not completed due to a number of factors, including training, distraction, high workload, low expectancy of error, and supervision lapses.
“Flight crews are reminded that effective checklist management is essential for verifying that critical procedural items are undertaken and ensuring safe aircraft operation,” ATSB Director Transport Safety Dr Stuart Godley said.
The investigation noted that the the First Officer, who was under supervision from the Captain ahead of being checked to the line on the 737, had significant experience on other aircraft types. The First Officer had only recently joined the airline and a lengthy break in flying roles and significant gaps in the training program may not have allowed him sufficient time to consolidate the procedures to an intuitive level that was resilient to error.
As the First Officer was very experienced, the Captain may have relaxed his supervision of the First Officer, thus contributing to him not identifying the error at the time.
“Although a highly experienced pilot, the First Officer was still a trainee on the Boeing 737 and as such, required vigilant supervision of a training captain. This is a crucial defence against error by trainee pilots,” Dr Godley said.
Three people sustained minor injuries when an Xplorer passenger train entered a siding loop at twice the maximum track speed after the train passed a signal set to ‘Stop’.
The two-car Xplorer NP43 passenger service was operating between Werris Creek and Moree, New South Wales, on the afternoon of 10 June 2019. Shortly after departing Gunnedah, the train passed a signal set to ‘Caution’ – which indicated the next signal could be at ‘Stop’.
The driver, however, did not see the signal, and so he proceeded as normal. Later, the driver would report that he knew the location of the signal, but he had never seen it with a ‘Caution’ indication in the previous 12 years, which likely influenced his continuing at track speed.
By the time the driver saw the next signal and realised that it was set to ‘Stop’, there was insufficient distance to stop the train before crossing the points that would transition the train into the Whitehaven Coal Loop.
If safe sighting distance is reduced due to environmental factors, it is important to reduce speed and be prepared to stop.
The driver initiated an emergency brake application, but the train entered the Whitehave Coal Loop siding at approximately 110km/h. The increased lateral forces as a result of the train traversing the points in excess of the maximum track speed of 50km/h, resulted in the three injuries, where a passenger and a member of the crew were struck by flying objects, while another crew member was thrown from their seat, striking their head.
The train stopped approximately 400m into the coal loop.
The late running of the train service and time of the year meant the sun was lower than the driver was expecting or reportedly had previously seen, an investigation into the incident, conducted on behalf of the ATSB by NSW’s Office Transport Safety Investigations, found.
The investigation determined that the driver’s vision of the signals was likely impaired due to the position of the sun. The sun reflecting off the side of some stainless-steel coal wagons parked in the adjacent Gunnedah long loop prior to the signal set to ‘Caution’ possibly further impaired his vision. Under these conditions, the driver did not suitably adjust the speed of the train to allow for safe sighting of the signals.
The safety message from this investigation reminds train drivers of the importance of operating to current conditions, and with consideration to potential future conditions.
If safe sighting distance is reduced due to environmental factors, it is important to reduce speed and be prepared to stop.
Personnel working in and around aircraft have specific duties, and they also have a responsibility to advise the operating crew of any concerns they may have with an aircraft, a new ATSB investigation report highlights.
In preparation for an August 2018 scheduled flight from Perth Airport to Christmas Island, an apron engineer fitted landing gear ground locks (LGGL) to an Airbus A320 before it was towed to its departure bay. The apron engineer then went to supervise the refuelling of another aircraft, with the intention of returning for the refuelling of the A320 and removing the LGGL.
Approximately 40 minutes later, a flight crew member’s pre-flight walk-around identified the presence of the LGGL. The captain acknowledged the flight crew member’s observation but anticipated that normal departure procedures would lead to the removal of the LGGL before flight.
As departure approached, the apron engineer realised he would be unable to return for refuelling and contacted an engineer who was on-board the aircraft to supervise refuelling. The handover between the engineers was not effective at communicating the requirement to remove the LGGL. The on-board engineer supervised the refuelling and returned to the flight deck.
Due to rectification work in the flight deck, the flight crew commenced their pre-flight procedures later than anticipated. The crew did not detect that the LGGL had not been stowed on board the aircraft as required.
While waiting for pushback to commence, the pushback tug driver and dispatcher saw pins and associated flags attached to the landing gear of the aircraft. After being unable to contact the aircraft movements co-ordinator and with just seven minutes before the scheduled take-off, the tug driver removed the LGGL pins but unknowingly left the locking sleeves in place.
Regardless of someone’s specific role working around an aircraft, everyone has a responsibility to notify the operating crew of any concerns they may have with an aircraft and that any concerns are assessed and rectified by any qualified personnel before flight.
The tug driver then entered the cockpit to have the load sheet signed by the flight crew. Neither the tug driver nor the dispatcher advised the flight crew of the presence and removal of the lock pins.
The aircraft subsequently taxied for departure with the LGGL sleeves attached. A sleeve fell unnoticed onto the taxiway and the other fell onto the runway shortly after take-off. The flight crew were advised of the discovery of the discarded locking sleeves while on descent into Christmas Island, where the aircraft landed without incident.
“This investigation demonstrates how a number of relatively small errors or omissions between different work areas can combine to affect flight safety,” ATSB Transport Safety Director Dr Stuart Godley said.
“Regardless of someone’s specific role working around an aircraft everyone has a responsibility to notify the operating crew of any concerns they may have with an aircraft and that any concerns are assessed and rectified by qualified personnel before flight.”
The investigation found that a lack of documentation for the installation and removal of the LGGL following a positional tow and deficiencies in the handover between pre-flight engineers led to the locks remaining on the aircraft during flight preparation.
The ATSB welcomes the operator’s introduction of new procedures requiring an authorised person to sign an Aircraft Readiness Log to certify that the LGGL have been removed prior to flight. These new procedures also require that if the aircraft has been towed after the initial check, the LGGL must be checked again.
“Further, a notice has been issued to flight crews instructing them to use a standardised method for stowing LGGL pins and sleeves and a separate notice reminds ground handlers they should not remove pins themselves,” Dr Godley said.
The ATSB is highlighting the importance of following procedures after a lockout pin was not removed after maintenance, which resulted in an Airbus A320’s left engine thrust reverser not activating when selected on landing.
The Airbus A320 had undergone overnight maintenance in Adelaide before departing for Gold Coast Airport, on the morning of 18 December 2017, operating as a scheduled passenger flight. After a normal descent and touchdown, the captain selected both engine thrust reversers. The left reverser, however, did not activate. The aircraft decelerated using normal braking, and taxied to the gate without further incident.
The ATSB investigation into the incident found that the left engine thrust reverser lockout pin had not been removed after the overnight maintenance, and so the aircraft had returned to service with the thrust reverser deactivated. The lockout pin had not been booked out of the tool store, and its installation was not recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin’s removal were missed.
… the aircraft had returned to service with the thrust reverser deactivated...
“This investigation highlights the importance of considering the environmental conditions in which equipment and tools will potentially be used, as well as the importance of following procedures that, in this instance, should have resulted in detecting the error,” ATSB Director Transport Safety Stuart Macleod said.
“When considering the effectiveness of equipment, tooling and procedures that aim to minimise the consequences of an error, an engineered solution is generally more effective than relying on procedural compliance. Further, within procedural compliance a functional check is generally more effective than a self-check of work.”
In response to this incident, the aircraft’s maintenance organisation is taking a number of safety actions including highlighting the importance of the aircraft maintenance manual precautions to maintenance staff at Adelaide. All thrust reverser lockout pin warning flags are being lengthened to hang past the closed engine cowls, while pins will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.
Separately, Airbus has advised it has introduced an operational test of the thrust reverser system to confirm re‑activation after maintenance as part of the latest revision to the aircraft maintenance manual.
An unmanned aircraft’s collision with terrain highlights the importance of confirming the significance of any unexpected observations during pre-flight checks, an ATSB investigation has detailed.
The 9 January, 2019 accident occurred after the Insitu ScanEagle X200 unmanned aircraft system (UAS) was launched to conduct ‘beyond visual line of sight’ aerial survey work in the Woleebee Creek area of Queensland. The operating crew consisted of two pilots and two ground crew.
Shortly after launch, the X200 pitched up and then entered an aerodynamic stall. It self-recovered, but the pilots then received an alert indicating an airspeed sensor failure. The X200 continued to fly to its first programmed waypoint, oscillating as it passed out of sight. While the flying pilot was executing the emergency procedures checklist, the X200 entered a second aerodynamic stall. Once again, the UAS self-recovered, but then entered a third aerodynamic stall and collided with terrain. The aircraft was destroyed.
During the pre-flight check, the crew had not identified erroneous airspeed indications...
“A post-accident inspection of the wreckage identified a partial blockage to the aircraft’s pitot system,” said ATSB Director Transport Safety Stuart Macleod. “The pitot system provides data to the autopilot which is used to maintain controlled flight.”
The ATSB investigation found that the blockage in the pitot-static system resulted in the autopilot receiving unreliable airspeed data. During the pre-flight check, the crew had not identified erroneous airspeed indications, and the ground control station had not flagged them. This led to the X200 eventually entering an aerodynamic stall at a height that was insufficient for recovery.
“This occurrence highlights the importance of confirming the significance of any unexpected observations during the pre-flight checks, to minimise the risk of the aircraft departing with an unserviceability,” Mr Macleod said. “In addition, providing pilots and ground crew with the reasoning behind specific checks and procedures can enhance their ability to identify anomalies and perform the appropriate corrective actions in a timely manner.”
As a result of this accident, the manufacturer took several safety actions to prevent a recurrence, including providing support to pilots and ground crew in identifying anomalies, both on the ground and in-flight. All the operator’s pilots underwent refresher training with a focus on identification and emergency procedures regarding incorrect indications.
Additionally, updates to the operational software are intended to ensure that any spurious on-ground anomalies will be accompanied by an alarm, to prevent X200s being launched with any unidentified issues in the future.
An Australian Transport Safety Bureau investigation has found that community service flights conducted on behalf of Angel Flight Australia have a fatal accident rate per flight that is seven times higher than for other private flights.
That was a key finding of the first analysis to be undertaken in Australia to determine the relative safety of Angel Flight compared to other private flying operations, after a second fatal accident involving the charity in the past decade.
The analysis was conducted as part of the ATSB’s investigation into the collision with terrain of a SOCATA TB-10 Tobago light aircraft near Mount Gambier Airport, South Australia, on 28 June 2017. The aircraft had departed Mount Gambier in poor weather bound for Adelaide, transporting a young person to a medical treatment appointment on behalf of Angel Flight, accompanied by a family member.
Shortly after take-off the aircraft entered low-level cloud (estimated to be about 200 feet above ground level), and the pilot, who was not qualified to fly in other than visual conditions, probably became spatially disorientated, resulting in a loss of control of the aircraft.
Our analysis of the circumstances of this tragic accident highlights that passengers on Angel Flight community service flights, and indeed their volunteer pilots, are being exposed to much higher levels of risk
About 70 seconds after take-off, the aircraft collided with the ground. Both passengers and the volunteer pilot were fatally injured, and the aircraft was destroyed.
“The ATSB considers that the conduct of community service flights, where volunteer pilots flying private aircraft to transport those less fortunate requiring medical treatment from regional and rural Australia, demonstrates a laudable concern for others,” ATSB Chief Commissioner Greg Hood said.
“However, our analysis of the circumstances of this tragic accident highlights that passengers on Angel Flight community service flights, and indeed their volunteer pilots, are being exposed to much higher levels of risk compared with other types of aviation operations.”
Community service flights operating on behalf of Angel Flight do so as private flights, which the Civil Aviation Safety Authority (CASA) defines as “flying for pleasure, sport or recreation, or personal transport not associated with a business or profession”.
However, the ATSB investigation showed that the rate of safety occurrences, which can be pre-cursors of fatal accidents, was substantially higher for passenger carrying Angel Flight operations than other private operations. This is almost certainly due to pilots operating community service flights on behalf of Angel Flight being exposed to additional operational risk factors.
Source: South Australia Police
These include the potential for pilots to experience perceived or self-imposed pressures to take on what Angel Flight described as ‘missions’ to fly ill, unrelated passengers (rather than family or friends) at pre-determined times and locations to meet scheduled medical appointments, rather than at times chosen by the pilot.
“Angel Flight did not pressure pilots to fly in conditions beyond their capability, but some circumstances can lead a pilot to feel pressure anyway, such as the responsibility to fly unrelated ill passengers to meet medical deadlines. This can lead to degraded decision making under high-pressure situations, like when confronted with poor weather,” Commissioner Hood said.
On the morning of the Mount Gambier accident two regional airliner flights into Mount Gambier were delayed due to the poor weather, Commissioner Hood noted.
The ATSB’s analysis determined pilots flying on behalf of Angel Flight were more likely to make operational errors when compared to other private operations, particularly associated with flight preparation and navigation, airspace, runway events, and communications breakdowns.
“The community could reasonably expect that community service flights would have a level of safety at least commensurate with other private operations, if not higher. However, this investigation has shown that those conducted for Angel Flight are actually less safe than other private operations, let alone charter and scheduled airline flying,” Commissioner Hood said.
Earlier ATSB research has already established that private flying has a fatal accident rate per flight that is eight times higher than commercial charter operations and 27 times higher than low-capacity scheduled airline flying. Further, there have been no fatalities involving a high-capacity airliner in Australia in more than 40 years.
“Given the factors identified for the accident at Mount Gambier and previously with another Angel Flight fatal accident in 2011, supported by the differences identified in the analysis of safety occurrences and consistent with findings from investigations of similar organisations in the United States, the ATSB considers that measures must be undertaken to improve existing risk controls,” Commissioner Hood said.
The ATSB commends Angel Flight for initiating some pro-active action on a number of the investigation’s identified safety issues, including developing an online safety course, planning a pilot mentoring program, and implementing a safety management system. The ATSB will continue to monitor the implementation of these and other controls to ensure pilots receive sufficient support and guidance to deal with the additional risks faced by private pilots when conducting a flight on behalf of Angel Flight.
However, the ATSB has issued a formal safety recommendation to Angel Flight Australia, recommending that it consider paying for commercial flights where they are available to transport its passengers.
“This ATSB investigation showed that commercial passenger flight options are available for nearly two-thirds of the private flights organised by Angel Flight,” Commissioner Hood said.
Angel Flight could purchase tickets on commercial flights for two passengers for a comparable cost to the organisation to what they normally reimburse for the fuel costs of privately-operated flights. Taking into account other passenger needs, 30 to 40 per cent of flights could be done using existing commercial flights.
“As a charity established to transport rural and regional people with limited financial means to medical appointments, the ATSB considers that Angel Flight could and should include the fact that commercial passenger flights have a lower safety risk to passengers than private operations as a factor when they are organising flights.”
Commissioner Hood noted that on the day of the Mount Gambier accident, suitable and cost-comparative airline flights were available.
In response to a separate safety issue raised by the ATSB’s investigation, CASA has taken proactive safety action by ensuring community services flights can now be identified separately to other private operations, which will better enable it to identify risks in the sector into the future.
“The ATSB is supportive of the community service flight sector, however, based upon the analysis conducted, it is essential that the controls for risk are strengthened to prevent further accidents,” Commissioner Hood said.
On the morning of 31 July 2017, a team of four Sydney Trains infrastructure maintainers was conducting a series of regular inspection and measurements at points along the Illawarra Main and Local lines at Tempe in Sydney’s inner west.
Two of the workers were acting as an inspection team, entering the danger zone (the area within three metres horizontally from the nearest rail) and accessing the track.
The other two workers acted as lookouts, using the Lookout Working method, which consists of rules for working in the danger zone using lookouts, and requires all workers and equipment to be completely within a safe place a minimum of 10 seconds before rail traffic passes their location.
Conducting work on or near railway track can be dangerous if safeworking rules and procedures have not been correctly implemented.
At approximately 10.00am, an empty passenger train was travelling on the Illawarra Local line when the driver observed the work group in the danger zone. He applied the brakes and blew the horn, and the workers began to move off the line towards a safe place to the side of the track. A review of the CCTV footage from the train showed that the workers had not yet reached a safe place when the train passed their location, approximately seven seconds after the train first observed them. There were no injuries or damage.
The investigation, conducted on behalf of the ATSB by NSW’s Office of Transport Safety Investigations (OTSI), found issues with the workgroup’s reliance on Lookout Working for worksite protection. Each lookout had been positioned to watch in different directions – one monitoring for Up trains, the other for Down trains. This incident occurred when the Down lookout had turned away to monitor the situation with an approaching Up train (which did not pose an immediate risk to the work group), and then turned back to find that a Down train was also approaching. He was not able to sound the warning to the work group and give them sufficient time to clear the danger zone to a safe location before the train neared their location.
Compared to other worksite protection methods, Lookout Working does not warn, or restrict trains from approaching, or entering a work location. The investigation found that Lookout Working had been implemented in an area deemed not suitable on the Sydney Trains rail network.
Additionally, there was not a clear understanding within the work group of various elements of the Lookout Working system, resulting in reassessments not being made, the Up lookout being posted in an inappropriate area, and a misunderstanding of what constituted a safe place.
The ATSB safety message from this investigation stresses that where practical, rail transport operators must require track workers to continually re-assess the site risks, add and or combine safety measures (like an Automatic Track Warning System, or audible warning devices), or implement a higher form of protection.
A hot air balloon in-flight fire demonstrates the importance of pilots preparing for the possibility of fire, including rehearsing emergency procedures and wearing appropriate protective clothing, a new ATSB investigation highlights.
The 26 December 2018 scenic flight had departed Wandin, Victoria, with a pilot and 15 passengers on board.
Twenty minutes into the flight, while at an altitude of about 800 ft, the pilot heard a small explosion from the front left burner and then observed a small fire had started on the outside of the burner. Despite attempts to extinguish the fire, it re-ignited twice and the pilot’s compartment caught fire.
About eight minutes after the fire first ignited, the pilot identified a suitable landing position. During the decent, the basket struck some treetops and ropes became tangled in the branches. The branches whipped around and into the basket, and one passenger sustained cuts to his hand.
As the basket touched the ground, the passengers on the right-hand side of the basket jumped out, causing the right side of the basket to lift off the ground again. In response, the pilot quickly pulled the red line to evacuate the hot air from the envelope and brought the basket back down to the ground. The remaining passengers then jumped out and ran to safety.
The fire continued to burn as the pilot secured the balloon. When emergency services arrived on site, flames had engulfed the balloon. By the time firefighters extinguished the flames, the fire had destroyed the balloon.
In the event of an in-flight balloon fire, the first priority must be the isolation of the fuel supply at the fuel tank.
The ATSB investigation found that a fuel leak at the front left burner has resulted in the fire. After the fire broke out, the hand-wheel valve on the liquid outlet of the fuel tank and the pilot burners were not shut off, which resulted in the pilot being unable to control the fire.
“Pilots experience a high workload during in-flight emergencies. However, in the event of an in‑flight balloon fire, the first priority must be isolation of the fuel supply at the fuel tank,” said ATSB Executive Director Transport Safety Mr Nat Nagy.
“In addition, it is good practice to rehearse emergency procedures by standing in the basket to run through the checklist steps.”
Mr Nagy noted that further ways to reduce risk to individuals and improve survivability outcomes include wearing appropriate protective clothing, including cotton long‑sleeved shirts and trousers, leather gloves, and enclosed footwear.
“Operators should also consider utilising componentry that provides a visual indication of the system status, for example, 90‑degree valves on liquid outlets.”
