There were limited opportunities for Angel Flight to be made aware of any safety related information involving flights conducted on its behalf.
Angel Flight had insufficient controls in place, and provided inadequate guidance to pilots to address the additional operational risks associated with community service flights.
Angel Flight did not consider the safety benefits of commercial passenger flights when suitable flights were available.
Lookout Working (LOW) was implemented in an area deemed unsuitable for LOW on the Sydney Trains Worksite Protection Hazardous Locations Register (WPHLR). This is likely due to the WPHLR not being clearly stated as a reference with specific requirements that must be adhered to.
Warning lights were utilised at Tempe to overcome sighting hazards and justify the use of Lookout Working (LOW). Warning lights rely on lookouts maintaining continuous observation and their use were not specifically referenced in the LOW Network Rules.
A variety of techniques to indicate and record rail stress at specific locations are available, however, Aurizon had not used any of these techniques in some locations with elevated risk of rail stress, such as tangent track on steep grades. As a result, Aurizon could not readily determine the presence or absence of compressive rail stress at these locations.
When planning track disturbing work, Aurizon’s normal practice was to use its Hazard Location Register as a record of past occurrences at a specific location. Aurizon did not use the Hazard Location Register as a resource to consider the situational characteristics of a location that may increase risk, such as continuous welded rail, track gradient and proximity to fixed points such as turnouts or level crossings.
The hydrographic use of point feature objects to represent physical features of relatively significant spatial extent on an Electronic Navigational Chart can increase the risk of the hazard posed by such features being misinterpreted by mariners and potentially reduce the effectiveness of the ECDIS safety checking functions.
ECDIS on board most Australian Border Force cutters, including ABFC Roebuck Bay, operated with a non-type-approved naval software version that was not updated to the latest applicable standards of the International Hydrographic Organization. The ECDIS therefore did not comply with the minimum requirements of an ECDIS being used to meet the chart carriage requirements of the regulations. As a result, the enhanced safety features of the new presentation library, which would have potentially alerted the officers to the danger posed by the reef, were not available.
Most Australian Border Force cutters, including ABFC Roebuck Bay, were installed with ECDIS operating on non-type-approved naval software. Subsequently, DNV GL, acting on behalf of the Australian Maritime Safety Authority, incorrectly certified these vessels as using type-approved ECDIS to meet the chart carriage requirements of the regulations. This removed an opportunity to put in place controls to ensure ongoing safety compliance.
Although the online VisionMaster FT ECDIS type-specific familiarisation training included the relevant content, the training as undertaken by Australian Border Force deck officers was not effective in preparing ABFC Roebuck Bay's officers for the operational use of the ECDIS.
Queensland Rail’s track monitoring and inspection processes were not effective in identifying significant deterioration in the condition of level crossing ID 2309 and its approach roads to ensure the safe operating limits of the level crossing throughout its lifecycle.
The GATX 840P1 axle was susceptible to fatigue cracking due to relatively minor damage that was not reliably detected prior to failure.
Anomalies in the magnetic particle inspection procedures likely led to the crack not being detected.
As a legacy of there being no inspection specific to an in-flight pitch disconnect, there is potential for other ATR aircraft to have sustained an in-flight pitch disconnect in the past and be operating with undetected horizontal stabiliser damage.
The aircraft manufacturer, ATR, did not provide a maintenance inspection to specifically assess the effect of an in-flight pitch disconnect on the structural integrity of the horizontal stabilisers. As a result, if an in-flight pitch disconnect occurred, the aircraft may not be inspected at a level commensurate with the criticality of the event.
Although the design standard for the aircraft (JAR-25) required the control system to be of sufficient strength to withstand dual control inputs, it did not require consideration of the effect that dual control inputs may have on control of the aircraft. Similarly, the current design standard (CS-25) does not address this issue.
Response from EASA
In September 2018, EASA advised the ATSB that:
