Risk and change management limitations contributed to near collision between passenger trains south of Brisbane

Risk and change management limitations associated with the rollout of new trains in South East Queensland contributed to a near collision in Brisbane in 2019, an Australian Transport Safety Bureau investigation report notes.

On 25 March 2019, passenger train DW17 left Park Road Station when the departure signal was displaying a stop indication.

The New Generation Rollingstock (NGR) train with a driver, guard, and 41 passengers on board, exceeded its authority by 305 m and travelled through a merging conflict point. The merger point was being approached by a second train, which stopped short when that train’s crew detected the problem.

This was the first of six ‘start against signal’ SPADs involving NGR trains on Queensland Rail (QR)’s Citytrain network between March 2019 and April 2021.

A systemic investigation by the ATSB found limitations in QR’s change and risk management processes, specifically in relation to dispatch procedures involving platform staff and NGR train guards, increased the risk of such SPADs taking place.

“Prior to the rollout of NGR trains, there were five stations – three CBD and two suburban stations – where platform staff were required to provide an ‘allright’ signal to a train guard before the train could proceed,” ATSB Director Transport Safety Dr Michael Walker explained.

“Although platform staff at these locations were trained not to look at the departure signal prior to giving the ‘allright’ signal, as this was not their role, in practice platform staff were checking for the departure signal to be at proceed before giving this signal to train guards, creating the expectancy that the ‘allright’ signal was a reliable indication the departure signal was at proceed.”

The positioning of the guard at the rear of the NGR fleet is unique to the Citytrain network. This meant when the NGRs began operating in late 2017, platform staff were required at other suburban stations to assist passengers accessing the middle carriages, which are designated for disabled access.

In January 2019, QR amended its dispatch procedures to require platform staff at all suburban stations to issue the ‘allright’ signal for all NGR train departures, rather than just those with passengers who required assistance.

“Because the platform staff at these suburban stations followed procedure, and did not follow the informal practice of checking the status of the departure signal, train guards were now much more likely to receive an ‘allright’ signal while the departure signal was at stop,” Dr Walker explained.

“Multiple QR risk management and change management processes did not effectively consider the risk of this taking place.”

The final risk control in place to avoid SPADs under QR’s ‘stopped at red’ procedure was for the driver to check the departure signal after receiving the ‘rightaway’ signal (two bells) from the train guard.

The train guard was to provide rightaway to the driver after checking that the platform departure signal was at proceed – either by observing the aspect in the departure signal, or a signal aspect indicator (SAI) located on the platform if the departure signal was not visible by the guard.

“In this near collision occurrence, when the driver received the rightaway signal from the guard, they had a very high level of expectancy that this meant the departure signal was at proceed, and subsequently the train promptly departed the station platform and passed the signal while it displayed a stop indication,” Dr Walker said.

“Similarly, the guard incorrectly provided the rightaway signal to the driver based on a very high level of expectancy that the ‘allright’ signal, provided by platform staff, also meant the signal was at proceed.”

The ATSB noted that the same basic sequence then happened in another five start against signal SPADs at suburban station platforms involving NGR trains. The departure signal was at stop, the station staff correctly gave the allright signal to the guard when platform duties were complete, the guard incorrectly provided the rightaway signal to the driver while the departure signal was still at stop, and the driver then departed the platform without effectively checking and confirming the departure signal.

Dr Walker said operators should apply a formal change management process to assess the potential risk of a procedural change before determining that the change is minor in nature.

“Operators also should ensure they understand the undocumented or informal risk controls that are in place in their operation, and how exactly operational personnel are applying current procedures, prior to introducing changes,” he said.

“A commonly-overlooked aspect of risk management is the need to consistently monitor and review the health of risk controls, either existing or newly-introduced, through a variety of activities and to continuously look for opportunities to improve the operator’s risk position.”

Signal aspect indicators (SAIs) were installed on station platforms when a guard could not see the departure signal from their normal location. The rollout of the NGR trains meant a number of SAIs had to be installed or moved at platforms around the network, to account for the relocation of the train guard from the middle of the train on traditional type suburban passenger trains to the rear of the the train with the introduction of NGR services.

“QR’s process for installing the SAIs did not provide sufficient detail to ensure consistent and conspicuous placement of them at station platforms,” Dr Walker said. “This increased the risk that an SAI would not be correctly perceived by a train guard.”

The ATSB notes the rate of ‘start against signal’ SPADs has decreased in recent times, as guards become more familiar with the location of SAIs, and the new processes at suburban station platforms.

“The ATSB will continue to examine change management issues in current and future investigations,” Dr Walker concluded.

Finally, although not a contributing factor, the investigation found that a late-notice roster change meant the guard was probably experiencing a level of fatigue known to adversely influence performance.

As a result, QR issued an important safety notice to rail traffic crew and rostering personnel regarding unplanned shifts and required that rostering personnel complete a checklist when arranging unplanned shifts with less than 12 hours prior notice.

Read the final report: Signal DP29 passed at danger involving suburban passenger train DW17 and near collision with another suburban passenger train, Park Road Station, Queensland, on 25 March 2019

ATSB investigation highlights potential to further reduce Ballina airspace safety risk

The pilot of a Jabiru recreational aircraft was unaware of the presence of an Airbus A320 before the flight paths of both aircraft inadvertently intersected while flying in non-controlled airspace near Ballina Airport, an Australian Transport Safety Bureau investigation details.

The Jetstar Airways A320, with 2 flight crew, 5 cabin crew and 163 passengers on board, was conducting an approach to land at Ballina while the Jabiru, with a pilot and passenger on board, was tracking to the south-west of Ballina en route to Evans Head when their vertical separation reduced to approximately 600 ft (183 m) as their flight paths intersected, with no observed lateral separation. Both aircraft landed at their destinations without further incident.

The ATSB’s investigation into the 28 November 2020 incident details that the A320 flight crew were unaware of the impending conflict until alerted to the presence of the Jabiru by their aircraft’s traffic collision avoidance system (TCAS).

However, the Jabiru pilot had not set their aircraft's transponder to broadcast altitude data (mode 3C), so the A320’s TCAS was unable to provide its flight crew the necessary information to positively avoid the potential collision.

“The pilot of the Jabiru had not selected their transponder to broadcast altitude information, and did not recall hearing radio broadcasts from the A320 until passing above it,” said ATSB Chief Commissioner Angus Mitchell.

“The A320 flight crew, meanwhile, did not recall hearing the Jabiru’s most recent radio broadcast when it was near Lismore; remained unaware of the Jabiru until receiving the TCAS alert; in the brief time available to them did not attempt to make radio contact with the Jabiru; and only sighted it moments before their flight paths converged.

“Consequently, as the pilots of neither aircraft had been able to manage separation from the other aircraft, the vertical separation between them was influenced by chance alone.”

Airspace surrounding Ballina is non-controlled, that is, aircraft are required to maintain separation through see-and-avoid principles – visually sighting other traffic and monitoring radio transmissions – rather than having separation services provided by air traffic control.

“The airspace surrounding Ballina Airport accommodates a complex mix of aircraft types and operations, and there is a number of other non-controlled airports in close proximity,” said Mr Mitchell.

“The ATSB determined that while the available evidence did not support a conclusion that the present system of aircraft self-separation in Ballina airspace is unsafe, there is the opportunity to potentially further reduce safety risk.”

Measures to further reduce risk might include the increased use of controlled airspace, the increased use of ADS-B aircraft surveillance data, both by air traffic services and in-aircraft, and the identification of any increasing risk through the improved monitoring of the quantity and complexity of aircraft movements in Ballina airspace.

“The ATSB supports systemic enhancements to the overall air traffic system that provide a net overall benefit to safety,” Mr Mitchell said.

The investigation notes that a Civil Aviation Safety Authority 2015 review of the airspace surrounding Ballina determined that a higher airspace classification, such as introducing controlled airspace in the vicinity of and an air traffic control service at Ballina was not appropriate.

However, the ATSB found that that review and periodic risk assessments of the airspace did not consider the risks associated with aircraft transiting through the airspace without taking off or landing at Ballina, as occurred in the investigation occurrence.

CASA has advised the ATSB that its most recent review of Ballina airspace is expected to take into account data for transiting aircraft that had either filed a flight plan or been detected by secondary surveillance radar. In addition, CASA has advised it has also developed an airspace risk modelling system that will have an enhanced capability to consider transiting aircraft. 

Separately, the investigation notes that at the time of the occurrence pilots of aircraft operating within 10 nm of Ballina were required to make positional calls on the common traffic advisory frequency (CTAF). In this occurrence, the two aircraft’s flight paths intersected approximately 12 nm to the south-west of Ballina. However, in January 2021 CASA expanded the Ballina CTAF broadcast area to 15 nm.

In addition, in August 2021 Airservices Australia introduced a surveillance flight information service (SFIS), where an air traffic controller based in the Brisbane Air Traffic Services Centre provides traffic information (but not traffic separation) to aircraft operating within the Ballina 15 nm CTAF broadcast area.

The SFIS replaced a certified air/ground radio service (CA/GRS), which was in operation at the time or the occurrence. The CA/GRS was located at Ballina Airport and provided traffic information (but not traffic separation) to aircraft within the then 10 nm CTAF broadcast area.

Read the final report: Separation occurrence involving Airbus A320-232, VH-VGP and Jabiru J230D, 24-7456 near Ballina Byron Gateway Airport, New South Wales, 28 November 2020

Ore train runaway and derailment highlights the importance of change management, risk assessment processes

Change management and risk assessment processes, and unclear communication of a safety-critical action to train drivers, contributed to the runaway and derailment of a fully-loaded 42,500 tonne, 2.86 km iron ore train in Western Australia’s Pilbara region, an Australian Transport Safety Bureau investigation has concluded.

The final report from the ATSB’s systemic investigation into the 5 November 2018 accident describes the circumstances leading up to the train’s runaway, which culminated in its intentional derailment, resulting in 2 remote locomotives, 245 ore cars and 2 km of track infrastructure being destroyed.

When the train, which was being operated by a single driver on BHP’s Newman to Port Hedland railway, was about 211 km from its destination, an inter-car connector separated, severing trainline communications between the lead locomotive and the ore cars toward the end of the train. This initiated an automated emergency brake application, stopping the train as it approached Garden South, which was on a falling (downhill) grade.

The loss of trainline communications started an in-built 60-minute shut-down feature on the braking system of the affected ore cars, which were now holding the train. 

After reporting the emergency stop and taking a number of procedural steps to protect and secure the train, the driver exited the cab without completing the step of placing the automatic brake handle into the pneumatic emergency position. The driver then commenced the process of applying manual handbrakes to each of the train’s ore cars. 

Sixty minutes after the train stopped, and before the driver was able to secure enough of the ore cars’ handbrakes, the affected car control devices shut down, and the brakes were released on the majority of the ore cars in the train.

The train then began to roll away without the driver on board. 

In the ensuing runaway, the train travelled more than 90 km over approximately 40 minutes, before BHP’s Hedland control intentionally derailed it at a crossover to an adjacent track at Turner South, about 120 km from Port Hedland.

“A train runaway can cause injury or loss of life, and while there were no injuries as a result of this accident, it did carry a significant financial and economic cost,” ATSB Chief Commissioner Angus Mitchell said.

“A certain set of specific circumstances meant not completing a single safety-critical action – placing the automatic brake handle in the pneumatic emergency position – had a significant consequence.

“This safety-critical action relied extensively on the driver’s memory, and the investigation found there were limited processes in place to facilitate or cross-check a driver completing key safety-critical actions.”

The investigation found that BHP did not clearly communicate the importance and reasons for this action to its drivers, reducing the potential for the drivers to correctly recall this action.

The same error had been made on a number of previous occasions by other drivers responding to a similar type of event.

Mr Mitchell said the ATSB considered more broadly why prevention of the runaway was dependent on a single safety-critical action.

“The ATSB’s investigation found that, while integrating a new electronically controlled pneumatic braking (ECPB) system with a number of already complex systems into its iron ore trains, BHP managed this integration at an individual system level, rather than through the application of a structured engineering approach,” Mr Mitchell explained.

Subsequently the operator did not identify and manage significant characteristics of how these systems interacted in response to certain fault conditions.

“As a result, BHP’s trains configured for ECPB operation were potentially vulnerable to a runaway event should a unique combination of events and conditions occur,” Mr Mitchell said.

In addition, the investigation identified that, while BHP’s risk assessment for its rail network identified numerous causes and critical controls for incidents such as runaways, it was broad in scope and had limited focus on the causes and critical controls for a train runaway event.

“Although the operator had identified the need for the safety-critical action in its procedures in April 2017, this risk assessment did not include the procedure for responding to brake pipe emergencies and penalties as a critical control, and it did not test the effectiveness of this procedural control,” Mr Mitchell said.

Following the accident, BHP reviewed the risk management framework associated with rail-mounted equipment interaction, updated the risk assessment, and added additional controls related to potential train runaway events.

It also made changes to its controls by revising the operating instruction for brake pipe emergencies. These included a form for drivers to complete confirming they had cross-checked the actions undertaken in response to a system generated emergency brake application with train control prior to leaving the locomotive cab, and amending the instruction to clearly advise the importance of placing the automatic brake handle in the emergency position.

Given that the train stopped at 0340 and the driver was conducting a series of 7 consecutive night shifts, the ATSB also examined BHP’s processes for managing train driver fatigue.

The ATSB found that the BHP roster patterns for fly-in fly-out train drivers were conducive to result in cumulative sleep restriction and levels of fatigue likely to adversely influence performance on a significant proportion of occasions, and BHP had limited processes in place to ensure that drivers actually obtained sufficient sleep when working these roster patterns. However, based on the available evidence, the ATSB did not conclude that fatigue contributed to the runaway event.

The report notes BHP has commissioned external fatigue experts to undertake a range of evaluation and development activities, and has formed a working group to optimise train driver rosters.

“This investigation highlights that rail transport operators considering changes involving the integration of complex systems should utilise a systems engineering approach to identify hazards and then manage risk to ensure that the railway’s operations remain safe,” Mr Mitchell concluded.

Read the final report: Runaway and derailment of loaded ore train M02712, near the 211 km mark south of Port Hedland, Western Australia, on 5 November 2018

Take-off without airspeed information highlights how individually straightforward factors can combine to nullify multiple critical safety barriers

The Australian Transport Safety Bureau has released the final report from its systemic investigation into a serious incident where a Malaysia Airlines Airbus A330 with 14 crew and 215 passengers on board took off from Brisbane Airport with no airspeed information.

Shortly after the aircraft arrived in Brisbane from Kuala Lumpur on 18 July 2018, a support engineer placed covers on the aircraft’s three pitot probes (airspeed sensors) to prevent them from being blocked by mud wasps, a known hazard at Brisbane Airport.

However, during the turnaround and before the aircraft departed for the return flight to Kuala Lumpur the covers were not removed. This was despite there being requirements for multiple walk-around checks by the aircraft captain, engineer and dispatch coordinator, all intended to identify unsafe conditions such as the fitment of pitot probe covers.

Consequently, the aircraft’s primary instrument displays showed red speed flags in place of airspeed indications from early in the take‑off, and the flight crew did not respond in time for the take-off to be safely aborted.

Once airborne the flight crew climbed the aircraft to 11,000 ft where they performed troubleshooting and other procedures, including shutting down the aircraft’s air data systems. This activated a system installed on some Airbus aircraft called the back up speed scale (BUSS), which displayed a safe flight envelope for flight crew to maintain.

Using the BUSS and airspeed management procedures, and assisted by air traffic control, the flight crew brought the aircraft safely back to Brisbane.

“At first glance, it may seem puzzling why multiple checks failed to detect the fitment of the pitot probe covers, or how the flight crew could complete take-off without any valid airspeed being displayed,” said ATSB Chief Commissioner Angus Mitchell.

“This led to the ATSB undertaking one of its most substantive and complex investigations in recent years.”

Mr Mitchell said the ATSB identified safety factors across a wide range of subjects including flight deck and ground operations, aircraft warning systems, air traffic control, aerodrome charts, and risk and change management.

“The investigation illustrates how a range of individually straightforward factors can combine to nullify multiple critical safety barriers,” he said.

On the night, several individuals from different organisations had separate, key roles in detecting aircraft damage or other unsafe conditions such as the fitment of pitot probe covers. However, these checks were omitted entirely or only partially completed, for a variety of reasons including inadequate communication and reduced diligence.

“Had all the relevant pre-flight inspections been completed, and conducted thoroughly, it is very likely that the pitot probe covers would have been seen and removed,” Mr Mitchell noted.

“It’s important to treat every safety-related task or inspection as though it could be the last barrier to protect against an accident.”

Malaysia Airlines had recently reintroduced flights to Brisbane, and although the wasp risk was identified, the use of pitot probe covers was not required or controlled. Shortly after the occurrence, the ATSB issued a safety advisory notice (SAN) to operators who fly to Brisbane Airport to consider the use of pitot probe covers and, where they are used, ensure there are rigorous processes for confirming they are removed before flight.

The ATSB also uncovered a range of deeper issues, including coordination among the involved organisations, that allowed front-line problems to emerge.

“Inconsistent approaches between multiple interacting organisations can have safety implications that are hard to predict,” Mr Mitchell observed.

For flight crew, the occurrence also highlights the importance of vigilance, communications, and decision-making in adverse circumstances.

The ATSB found that surprise, uncertainty, time pressure, and ineffective communication between the two pilots during the take-off probably led to stress and high cognitive workload. This reduced their capacity to interpret the situation and make a decision early enough to safely reject the take-off.

In response, the ATSB has issued a safety advisory notice (SAN) advising manufacturers and operators of all large transport aircraft to consider what types of unreliable airspeed events can occur, how the information is presented to pilots, and what responses are the safest in different phases of the take-off and in a range of potential situations.

All of the relevant organisations have contributed to the large number of safety actions taken in response to the incident and the ATSB’s investigation. For example, Malaysia Airlines now requires the placement of a placard on the flight deck as a visual alert that pitot probe covers are in place, and has introduced improvements to its change and risk management processes.

Airbus, meanwhile, has implemented additional flight crew training standards about unreliable airspeed on take-off, added guidance to the flight crew techniques manual on the importance of airspeed monitoring on take-off, and has commenced a review of airspeed indications in A330 and other aircraft types.

The ground handling and engineering companies involved in the incident have also made system and process improvements, and the airport information provided to pilots has been amended.

“The cooperation of all involved organisations has been very encouraging, especially the amount of safety action they have undertaken,” said Mr Mitchell.

“Many safety gaps have been addressed as a result of this extensive investigation.”

Read the final report: Airspeed indication failure on take-off involving Airbus A330, 9M-MTK Brisbane Airport, Queensland, 18 July 2018

Flight crew did not notice declining airspeed before stick shaker activation

The flight crew of a Saab 340 did not detect the aircraft’s reducing airspeed before its stall warning stick shakers activated, an Australian Transport Safety Bureau investigation details.  

On the afternoon of 6 July 2021, the twin-turboprop Saab 340B, operated by Regional Express, departed Perth for a scheduled passenger flight to Albany, Western Australia, with two flight crew, one cabin crew, and 16 passengers on board. 

During climb, the flight crew were alerted to a fault in the wing de-ice system. After levelling off at 7,000 ft, the crew actioned the relevant abnormal checklist, but were unable to clear the fault. They began a descent from 7,000 ft to 5,000 ft to exit icing conditions, and decided to return to Perth.  

As the aircraft was levelling off at 5,000 ft, air traffic control instructed the flight crew to make a right turn. About 20 seconds into the turn, the aircraft’s stick shakers activated, providing a warning of a potential aerodynamic stall in the form of vibrations and an aural clacker sound. 

“The ATSB’s investigation into this incident found the pilot flying became task saturated due to high workload and did not notice the aircraft’s reducing airspeed, which was also missed by the pilot monitoring due to a focus on other tasks until the stick shaker activated,” said ATSB Director Transport Safety Stuart Macleod. 

Responding to the warning, the first officer, who was pilot flying*, initiated the stall recovery procedure before the captain took control to complete the recovery, and the aircraft returned to Perth without further incident. 

ATSB analysis of the aircraft’s recorded data showed the flight crew had reduced the aircraft’s engine power from 60% torque when flying level at 7,000 ft, to about 15% torque during the descent. However, engine power remained at 15% torque when levelling off and turning at 5,000 ft. 

“In order to maintain level flight at that engine power, the autopilot gradually increased the aircraft’s pitch, which led to a gradual reduction in airspeed,” Mr Macleod said. 

“This airspeed reduction went un-noticed by the flight crew until the increasing pitch reached the level required for one of the Angle of Attack sensors to trigger the stick shaker activation.” 

Mr Macleod noted the crew experienced a high workload in the lead up to the stick shaker activation, including multiple communications with ATC, which issued a series of vectors and requested flight information. 

“During periods of high workload, where there is an increased chance of making errors, flight crews should prioritise monitoring critical flight parameters,” Mr Macleod said. 

“Effective communication can help flight crews recognise a situation when their workload is becoming overwhelming, and consequently better manage the situation – for instance, giving themselves more time to complete the required tasks by discontinuing an approach, or deferring ATC requests appropriately.” 

Following the incident, the operator amended flight crew training simulator sessions and related training material to include flight at minimum manoeuvring speeds – minimum airspeeds that provide a margin above a stall during aircraft manoevring. 

The ATSB also found the alert from the aircraft’s de-ice system, which led the flight crew to return to Perth, was probably due to the right wing inboard de-ice boot delaminating shortly before encountering icing conditions. 

*’Pilot flying’ (PF) and ‘pilot monitoring’ (PM) are procedurally-assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path. 

Read the final report: Stick shaker activation involving Saab 340B, VH-ZLJ, 30.7 km south-west of Perth Airport, Western Australia, on 6 July 2021

A320 main landing gear torque link apex pin fatigue failure

The main landing gear of an Airbus A320 could not be fully retracted due to the fatigue failure of a pin in the aircraft’s left main landing gear, an ATSB investigation report details.  

The Jetstar Airways-operated A320 was departing Sydney to operate a scheduled passenger service to the Gold Coast on the morning of 1 August 2019.   

After take-off and on selecting retraction of the undercarriage, the flight crew received multiple warnings of the undercarriage not retracting completely. The flight crew informed air traffic control of the issue and requested vectors to an area where they could troubleshoot the problem where they then cycled the undercarriage to the extended and then retracted positions, however, the issue remained. 

Meanwhile, the crew of another aircraft taxiing at Sydney Airport identified an object on the ground which they reported to the air traffic control (ATC) Ground controller.  

The debris was collected by an airport ground car and determined to be an aircraft part that was subsequently identified as an A320 main landing gear component. 

The ATC Departures controller notified the A320’s flight crew that an aircraft part had been found on the runway, subsequently informing them ‘they believe it might be a part of the landing gear’. Separately, Jetstar engineering communicated to the flight crew that the part had not yet been positively identified and advised them to follow their standard operating procedures.  

When all appropriate checks were completed, the flight crew elected to return to land at Sydney, requesting the airport’s emergency services be put on a local standby.  

While the landing was uneventful, further damage to the left main landing gear occurred including the loss of brakes and the severing of electrical sensors. 

The flight crew had made the decision to return and land after seeking and assessing information relating to the landing gear malfunction, the ATSB’s investigation notes. 

However, at that time the operator’s engineering personnel were gathering and analysing additional information about the failed component.  

“Despite the failed part and aircraft being positively identified by elements within Jetstar, a message was unable to be conveyed to the flight crew before they returned for landing,” said ATSB Director Transport Safety Stuart Macleod. 

“As such, the flight crew was unaware of the true nature of the undercarriage defect and the associated risks, and that additional information would have better informed crew decision making.” 

Without the apex pin in place, the main landing gear axle could rotate out of alignment. This both prevented the landing gear from retracting, and caused damage to other landing gear components and systems during the taxi, take-off and landing, including disabling the left side main landing gear’s brakes. 

While the disconnected torque link reduced the directional stability and braking performance, the degradation was manageable and the aircraft landed safely. 

“Investigations determined that the fatigue failure of the apex pin was the result of a crack that initiated during the quench step of the heat treatment process at manufacture,” Mr Macleod noted.  

The failed apex pin shank was sent to A320 aircraft main landing gear manufacturer Safran Landing Systems, which concluded the cracks were initiated during the manufacturing process and were not caused by environmental effects in service. 

Following the incident Airbus issued an alert to A320 operators requiring the recall or inspection of 1,988 apex pins – as a result 19 pins were removed from service due to cracking. 

Safran had previously revised its manufacturing processes for the apex pin. 

Also in response to the incident, Jetstar clarified its non-normal operational communication guidance for ground crews in the Airport Operations Manual. This included dedicated phraseology for gaining priority on airband frequencies to relay high priority messages. 

“This investigation highlights the importance of ensuring that operational processes permit coordinated, accurate and timely flow of information between ground personnel and flight crew to assist airborne decision making,” said Mr Macleod. 

Read the final report: Landing gear malfunction involving Airbus A320, VH-VFN, Sydney Airport, New South Wales, on 1 August 2019

Improperly-secured insulation blanket in a 737 freighter’s main pressurisation outflow valve resulted in the cabin depressurisation. 

An improperly-secured insulation blanket became lodged in a 737 freighter’s main pressurisation outflow valve resulting in the aircraft cabin depressurising during descent, an Australian Transport Safety Bureau investigation report outlines.

On 6 July 2021, the Boeing 737-376SF operated by Express Freighters Australia – a subsidiary of Qantas – was operating a freight flight from Perth to Melbourne with a flight crew of two on board.

While descending through 8,000 ft, the flight crew received pressurisation system cautions and the cabin depressurised.

“In response, the flight crew performed the first four steps of the relevant non-normal checklist,” ATSB Director Transport Safety Stuart Macleod said.

“As they descended through 4,000 ft, and with the cabin already depressurised, they elected to suspend that troubleshooting process and landed the aircraft at Melbourne without incident.”

An engineering inspection determined that an insulation blanket from the aft cargo bay had been partially ejected from the aircraft’s main outflow valve, preventing it from closing.

“The engineering inspections revealed multiple aft cargo bay insulation blankets were either missing, installed incorrectly, or unsecured,” Mr Macleod said.

“A heavy maintenance check about 15 months prior to this occurrence necessitated the disturbance and partial or complete removal of the insulation blankets in the aft cargo bay, and it is probable that after this check, the blankets were installed incorrectly, and an inadequate area inspection was carried out.”

As a result of the incident, the operator conducted an inspection of all aft cargo compartment pressurisation components and insulation blankets in their 737 fleet, and discovered multiple unerviceabilities, which were all rectified.

Following these inspections, Express Freighters Australia implemented a 4,000 hour or 36 month insulation blanket visual inspection task for the 737-300, and a 4,000 hour or 18 month visual inspection take for the 737-400.

“Aircraft periodic inspection tasks often require equipment or covering removal to access inspection areas,” Mr Macleod explained.

“Maintenance crews are reminded of the importance of ensuring that any items removed for access are thoroughly inspected for serviceability and securely reinstalled. Items must be refitted in accordance with the maintenance manual to prevent unsecured items inhibiting flight critical systems.”

Read the final report: Uncontrolled pressurisation change involving Boeing 737, VH-XMO, near Melbourne Airport, Victoria, 6 July 2021

Correctly fitted, secured and maintained flight helmets can save lives 

The Australian Transport Safety Bureau (ATSB) has issued a Safety Advisory Notice that strongly encourages all pilots conducting low-level operations to wear a properly fitted and maintained flight helmet to improve their survivability in the event of an accident. 

The advisory comes as the ATSB releases the final report from its investigation into a wirestrike and collision with terrain accident involving a Robinson R44 helicopter conducting low-level aerial spraying at a property south-east of Hay, NSW in July 2020. 

Before commencing spraying at Steam Plains Station, the helicopter pilot received a pre-flight briefing from their chief pilot (who was performing the role of loader that day). The briefing involved a review of hazards on the property including an unmarked 19.1 kV single wire earth return powerline that crossed the perimeter fence line once in the spraying target area. The powerline was also highlighted on the pilot’s map during initial planning with the station manager two days earlier.  

When spraying operations commenced, the pilot flew to the property boundary to spray a track adjacent to the fence line from about 2.5 to 5 m above the ground.  

On the fifth spray run of the day, and when about 370 m before the position of the identified powerline, recovered data from the helicopter showed that the pilot turned the spray off and manoeuvred the helicopter over a stand of trees 12 to 15 m high. The helicopter then descended, most likely to recommence spraying, when the top of its left skid struck the powerline. 

The helicopter then entered uncontrolled flight and collided with the ground about 120 m beyond the wire. The pilot was fatally injured, and the helicopter was substantially damaged. 

Post-accident imagery taken by an ATSB remotely piloted aircraft of the helicopter’s flight path found the wire would have been extremely difficult to detect.  

“Powerlines, particularly unmarked wires, are normally impossible to see due to the size of the wire, camouflage with the background and limitations of the eye,” ATSB Chief Commissioner Angus Mitchell said. 

“Without an aerial hazard check, the pilot was reliant on remembering the location of the wire from earlier briefings and seeing the wire during the flight.” 

A review of GPS data found that while the pilot overflew a small section of the spraying area earlier that morning, there had been no aerial inspection to identify potential hazards and to confirm the location of the powerline on the accident flight.  

“Even with a map of known powerlines, no matter how many hours of aerial application experience you have, and whether the target area is new to you or you flew it yesterday, a pre-application aerial survey from a safe height should be a non-negotiable piece of your personal commitment to safety.” 

The ATSB notes that pilots are increasingly able access to the latest powerline mapping data via applications on their mobile devices. For operations in Queensland, New South Wales and South Australia, pilots can access the location and height of powerlines via the Look Up and Live app, which is available for iOS and Android devices.  

In other states and territories, pilots and operators can check with their local energy provider for available powerline information. 

The ATSB also encourages landowners who engage pilots to conduct aerial application operations to mark powerlines that may pose a hazard to aircraft. 

“As more up-to-date mapping and powerlines data is made available, and more wires carry visible markers, pilots have improved access to tools for planning and strike prevention,” Mr Mitchell noted.  

“However, only by conducting an aerial inspection at a safe height can the pilot be assured of the location of hazards.”  

During its investigation, the ATSB also found the pilot was not adequately restrained by the seat belt’s shoulder sash, resulting in their head impacting the left side of the helicopter during the initial impact. The pilot either slipped out of, or was not wearing, the shoulder sash portion of their 3-point harness, further increasing the risk of injuries.   

“The use of a 4- or 5-point pilot restraint harness, which provides lateral stability to the upper torso in both directions, would have the reduced the risk of strike injuries, particularly to the head as well as reducing the risk of deceleration injuries,” said Mr Mitchell.  

“Although the pilot was wearing a flight helmet, it came off after the initial impact and did not attenuate the impact forces to a survivable level.” 

Either the impact forces exceeded the helmet design specifications, or the helmet was not fitted, worn or maintained correctly, the investigation notes. 

The ATSB has released a Safety Advisory Notice to strongly encourage all pilots conducting low-level flight operations to wear a correctly fitted, secured, and maintained flight helmet to improve their survivability in the event of an accident.  

“A correctly fitted and secured flight helmet can significantly reduce injuries and save lives in the event of a serious incident or accident but to be fully effective it must be adjusted to fit the head and the chin strap must be fastened securely,” Mr Mitchell said.  

“In addition, helmets must be serviced regularly, routinely inspected for damage, and replaced immediately if it has sustained a major impact.” 

Lastly, the investigation also found that the pilot had also been diagnosed with a high risk of severe obstructive sleep apnoea (OSA) in the months before the accident, but it was not reported to a Civil Aviation Safety Authority designated aviation medical examiner and was not being effectively managed in the two weeks before the accident.   

It could not be determined whether the pilot was experiencing any impairments associated with the condition. 

Read the report: Wirestrike and collision with terrain involving Robinson R44, VH-HNF, 69 km south-east of Hay Airport (Steam Plains), New South Wales, on 31 July 2020

To find the latest information on powerline locations in Queensland, New South Wales and South Australia use the Look Up and Live(Opens in a new tab/window) app or your contact the local electricity provider.   
 
For more information on the management of obstructive sleep apnoea read the Civil Aviation Safety Authority’s Obstructive sleep apnoea and aviation safety fact sheet(Opens in a new tab/window).

Pilot’s high workload, including data entry difficulties, likely affected their situational awareness resulting in descent below assigned minimum altitude.

A pilot’s high workload, including data entry difficulties, while conducting an approach to land at Adelaide Airport in instrument meteorological conditions likely affected their situational awareness resulting in their aircraft descending below the assigned minimum altitude.

An Australian Transport Safety Bureau investigation into the incident details that on the morning of 12 August 2021, the twin-engine Aero Commander 500-S was conducting a private flight from Port Lincoln to Adelaide with a pilot and passenger on board.

After descending to 3,800 ft during the approach, the pilot was cleared by air traffic control to track direct to the GPS waypoint GULLY, the initial waypoint for the area navigation (RNAV) instrument approach into Adelaide.

However, the pilot reported having difficulties entering the RNAV approach into the aircraft’s touchscreen multi-function display due to turbulence.

“Several factors including the environmental conditions, data entry difficulties, and the timing of the clearance for the GULLY waypoint, likely led to the pilot experiencing a high workload,” ATSB Director Transport Safety Dr Stuart Godley explained.

By the time the pilot correctly input the approach into the system, the aircraft had just overflown the GULLY waypoint. This meant when the pilot then selected the ‘Direct-To’ option on the display, the autopilot commanded a sharp turn to the right, to commence an orbit to attempt to overfly the waypoint to recapture it.

The controller then began giving the pilot instructions, intending to vector the aircraft back to the waypoint, but a short time later, communications were lost.

“The ATSB found that during the approach the pilot had inadvertedly selected the incorrect radio frequency,” Dr Godley said.

For about 4 minutes before contact was re-established, the aircraft continued on its assigned heading, but began descending below its assigned altitude.

“During this time, the approach controller attempted to contact the pilot and issued three terrain safety alerts. The lowest altitude the aircraft descended to was 2,480 ft, close to the highest point within 5 NM of the aircraft’s track, which was 1,913 ft.”

Once communications were re-established, the approach controller issued the pilot a terrain safety alert and instructed the pilot to climb immediately to 5,000 ft.

The aircraft then tracked to Adelaide Airport and landed without further incident.

Dr Godley said the event highlights the heightened workload pilots experience during the approach and landing phases of flight.

“Pilots must continuously monitor aircraft and approach parameters, and the external environment, to ensure they maintain a stable approach profile and make appropriate decisions for a safe landing,” Dr Godley said.

“Distractions and unanticipated events can further increase a pilot’s workload leading to undetected errors and a loss of situational awareness.

“During high workload phases of flight, pilots should remain focused on monitoring the aircraft instruments and avoid fixating on a problem.”

Read the final report: Flight below minimum altitude involving Aero Commander 500 S, VH-LTP, near Adelaide Airport, South Australia, on 12 August 2021

Powerline survey aircraft stalled at a height too low for recovery

A Cessna 172 aircraft conducting powerline inspections near Canberra stalled and entered a spin at a height too low for recovery before it collided with the ground, an Australian Transport Safety Bureau investigation details.

In the early afternoon of 13 April 2021, the Cessna R172K departed Canberra Airport to conduct powerline surveying to the north of Sutton township, NSW. On board was a crew of two comprising a pilot and an observer.

About three hours into the flight, while manoeuvring to inspect a powerline adjacent to Tallagandra Lane, nearby witnesses observed the aircraft flying low above the trees before it commenced a left turn that continued into a steep descent before colliding with the ground.

The pilot and the observer were fatally injured in the accident, and the aircraft was destroyed.

During the accident flight, according to recorded data and witness accounts, the Cessna transitioned from a level, right turn to the north-north-east into a tighter, possibly climbing, left turn.

From the ATSB’s analysis of the turns conducted by the pilot earlier in the flight, it was estimated that the final turn was likely conducted at a comparatively high angle of bank and closer to the stall speed of the aircraft.

As the manoeuvre continued, the aircraft likely exceeded the critical angle of attack for the wing, causing the wing to aerodynamically stall.

“This investigation reinforces to pilots the importance of managing airspeed and bank angle to minimise the risk of stalling,” ATSB Director Transport Safety Stuart Macleod said.

“This is particularly important when operating in close proximity to the ground, such as conducting low-level air work, as well as during take-off and landing, as recovery may not be possible.”

Mr MacLeod noted the Pilot’s Operating Handbooks for most light aircraft, including the accident Cessna R172K’s, provides stall speed guidelines to avoid a wings level stall.

However, pilots should be cognisant of the raised stall speed when operating turns.

“In a bank the vertical lift component is reduced, and so pilots must pull back on the control yoke to maintain altitude,” noted Mr Macleod.

“This increases the angle of attack of the wing, and if the angle of attack reaches a critical angle, loss of lift and increased drag occurs, and the wing will aerodynamically stall.”

Following the accident, the operator amended the training and checking section of its Operations Manual to incorporate Threat and Error Management and Situational Awareness training modules for powerline low-level survey operations. The amendments enhanced existing topics in the operator’s crew resource management training and stipulated learning outcomes and assessment criteria specific to Threat and Error Management and Situational Awareness.

“The operator also provided detail of intended additions to its low-level procedures to implement an airspeed ‘manoeuvre margin’ that will take into account the increased stall speed associated with steep turns,” Mr Macleod said.

Further, the operator plans to modify its aircraft to include an angle of attack indicator and a g-meter with recording and data download capability.

“These will not only supplement the aircraft’s stall warning device by providing additional warning of an impending stall, but will allow for a record of the maximum and minimum in-flight readings to be downloaded post flight for review,” Mr Macleod said.

Read the report: Loss of control and collision with terrain involving Cessna R172K, VH-DLA, near Sutton, New South Wales, on 13 April 2021