The current ARTC definition of restricted speed requires considerable judgement on the part of train drivers.
Double stacked container wagons are at particular risk of wind induced roll-over. This is a direct relationship of exposed side area, and was therefore probably exacerbated by out of gauge/high loads on some wagons with a large surface area exposed to the gust front.
Train drivers receive no formal training with respect to understanding severe weather events, the associated derailment risk and mitigation strategies.
The available Cross Crew Qualification and Mixed Fleet Flying guidance did not address how flight crew might form an expectation, or conduct a ‘reasonableness' check, of the speed/weight relationship for their aircraft during takeoff.
In recent years there have been developments in guidance materials for system development processes and research into new approaches for system safety assessments. However, there has been limited research that has systematically evaluated how design engineers and safety analysts conduct their evaluations of systems, and how the design of their tasks, tools, training and guidance material can be improved so that the likelihood of design errors is minimised.
Although passengers are routinely advised after takeoff to wear their seat belts when seated, this advice typically does not reinforce how the seat belts should be worn.
When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturer’s system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit.
There was a limitation in the algorithm used by the A330/A340 flight control primary computers (FCPCs) for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple spikes in AOA from only one of the three ADIRUs could result in a nose-down elevator command.
The implementation of Patrick Terminal’s safety management system resulted in an environment where Patrick Terminal management and stevedores were disconnected in relation to the management of some of the day-to-day workplace safety risks. As a result, there was little ownership of the safe work instructions by the stevedores, and some of the more experienced stevedores were probably no longer aware of the risks posed to them when they undertook unsafe ‘workarounds’ in the workplace and these were not identified by Patrick management.
Single event effects (SEE) have the potential to adversely affect avionics systems that have not been specifically designed to be resilient to this hazard. There were no specific certification requirements for SEE, and until recently there was no formal guidance material available for addressing SEE during the design process.
Patrick Terminals’ safe work instructions for lashing/unlashing did not specifically cover the recognised safe practices of not working under containers or between moving containers and fixed objects. Consequently, there was a discontinuity between the level of awareness regarding these dangers and the training new employees received during their induction period.
There has been very little research conducted into the factors influencing passengers’ use of seat belts when the seat-belt sign is not illuminated, and the effectiveness of different techniques to increase the use of seat belts.
Although passengers are routinely reminded to keep their seat belts fastened during flight whenever they are seated, a significant number of passengers have not followed this advice. At the time of the first in-flight upset, more than 60 of the 303 passengers were seated without their seat belts fastened.
For the data-spike failure mode, the built-in test equipment of the LTN 101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid.
One of the aircraft’s three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft.
The recognised safe practices of not working under or near a container being loaded is not well reflected in national and international guidance published to assist container terminal operators develop their own safety policies and guidelines.
Patrick Terminals’ risk assessment process for lashing and unlashing operations had not anticipated a fatal accident resulting from being struck by items falling from a portainer or cargo, or from being struck by a moving container. As a result, while the appropriate risk control for this occurrence had been covered during employee training, this was not reinforced in safe work instructions, an important risk control measure.
The LTN-101 air data inertial reference unit (ADIRU) model had a demonstrated susceptibility to single event effects (SEE). The consideration of SEE during the design process was consistent with industry practice at the time the unit was developed, and the overall fault rates of the ADIRU were within the relevant design objectives.
Patrick Terminals’ hazard identification process had not identified the dangers of working near or under containers being loaded.
