ATSB

Boeing 717-200, VH-VQE

Safety Action

Airline operator

As a result of this occurrence, the operator has issued a Flight Operations Memo advising all B717 pilots that: " Effective immediately, discontinue the use of the secondary flight plan during operations".

Aircraft manufacturer

As a result of this occurrence, the aircraft manufacturer has:

Released a Flight Operations Bulletin, B-717-02-001 on 7 March 2002, describing the conditions that may result in a dual FMS failure and suggested flight crew response.
Scheduled a system software upgrade (VIA-907) addressing this issue which is due for release in 2003.

Analysis

The double failure of the FMS was consistent with that experienced as a result of primary and secondary flight data conflict. Having the upgraded software fitted to the aircraft allowed the re-instatement of the flight management system following successful completion of its BITE procedure. As the FMS was capable of functioning normally without the use of a secondary flight plan, the dual reset under those conditions was not considered critical.

Summary

As the Boeing 717-200 (B717) aircraft was levelling off in cruise flight at flight level 250, the crew noticed a 'MAP FAIL' message on the co-pilot's navigation display. This was followed by the same message on the pilot in command's (PIC) display along with a flight management system (FMS) double failure indication. After a short pause to allow the versatile integrated avionics (VIA) units to stabilise, the PIC selected 'STBY NAV' and reverted to the aircraft's very high frequency omni-directional radio (VOR) system for navigation.

The co-pilot then noticed that his FMS had become available once again; however, the flight plan information had been lost and required reloading. The PIC's FMS also became available and was re-instated. The flight then continued to Melbourne with no further anomalies.

A subsequent maintenance check of the aircraft revealed that both VIA units had indicated software faults. The aircraft had recently undergone a system software upgrade. The upgrade had been installed to prevent software faults that had resulted in previous FMS failures on this aircraft type. The aircraft's avionics system manufacturer was informed of the failure.

FMS reset

The software manufacturer advised that the loss of the FMS function (known as a reset) occurred under certain conditions when a secondary flight plan had been entered into the FMS. The normal procedure was to copy the primary flight plan to the secondary so it could be utilised for late changes once en route. However, if altitude adjustments during the flight were made using the altitude setting function on the autopilot glare shield controller, with the system selected to the EDIT mode, the primary flight plan data of the FMS would be updated automatically, but the secondary flight plan data would not. This would have created a conflict between the primary and secondary flight plans resulting in an FMS reset.

FMS software upgrade

The aircraft was fitted with the latest FMS software upgrade (VIA-905), which had addressed previously encountered problems associated with the system, and provided a number of improvements to the aircraft's operation. Although a dual reset resulting from the use of a secondary flight plan was experienced, the upgrade did allow the FMS to be reinstated after a built-in test equipment (BITE) test had been conducted.

Occurrence summary

Investigation number	200105820
Occurrence date	08/12/2001
Location	30 km N Launceston, Aero.
State	Tasmania
Report release date	08/11/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	717
Registration	VH-VQE
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Launceston, TAS
Destination	Melbourne, VIC
Damage	Nil

Boeing 767-300ER, C-FXCA

Safety Action

RECOMMENDATIONS

As a result of the investigation the Australian Transport Safety Bureau issues the following recommendations:

Recommendation R20020051

The Australian Transport Safety Bureau recommends that the US Federal Aviation Administration review the adequacy of requirements covering protection of the engine fire detector loom wires in engine compartments.

Recommendation R20020052

The Australian Transport Safety Bureau recommends that the Joint Aviation Authority review the adequacy of requirements covering protection of the engine fire detector loom wires in engine compartments.

Recommendation R20020053

The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority review the adequacy of requirements covering protection of the engine fire detector loom wires in Boeing 767 engine compartments.

Significant Factors

Fracture of the high pressure duct allowed high-pressure, high-temperature air to impinge on the engine fire detector loop wires adjacent to the fracture, damaging their insulation and disrupting the wire loom.
The continued fire warning led the crew to discharge the second fire bottle.
The engine fire detection loop wires were not protected against damage by the high- pressure, high-temperature air that escaped from the fractured duct.

Summary

The Boeing 767-300ER aircraft had departed Sydney for Honolulu on a scheduled passenger service. While on climb through flight level 105, the left engine fire warning light illuminated. The crew carried out the fire drill, shutting down the engine and discharging the engines' fire bottle number 1. Fire bottle number 2 was discharged shortly after due to the reactivation of the left engine fire warning. The fire warning lights continued to fluctuate on and off.

Air traffic control was advised of the emergency and issued a clearance for the aircraft to return to Sydney. After landing at Sydney, rescue and fire fighting services followed the aircraft to the parking area but were not required.

An examination by the operator revealed that a high-pressure duct (Wye-Air Cooling Part No 1456M55G03) had fractured transversely through the shorter of two stub-sections. High-pressure, high-temperature air that had escaped from the cracked duct, impinged on wiring to the engine fire detection loop. The insulation of the wires was damaged, and the wires disrupted. The duct that ruptured was part of the engine's stage 11 cooling system. Air is ducted from stage 11 of the high-pressure compressor to cool the stage 2 high pressure turbine nozzles.

Examination of the duct by the Australian Transport Safety Bureau determined that the duct rupture was a result of fatigue cracking consistent with high-cycle, vibratory loads. The crack initiated at the base of a reinforcing strap brazed to the duct neck. There was evidence of a misalignment of approximately 2 degrees in the connection of the fractured stub section to the adjoining section. There was no evidence of material or manufacturing defects.

The ruptured duct was replaceable with either of two later part numbers introduced by the engine manufacturer's Service Bulletins (SB) 72-757 and 72-761. A further option was introduced by SB 75-0156, dated February 2001, that replaced the duct with individual pipes. None of the service bulletins had been actioned by the aircraft operator, nor were they required to be actioned.

The engine was fitted with a "Kidde" fire warning loop that relies on changes of resistance of the internal thermistor material. When subjected to heat, the resistance of the material decreases to a pre-set point which then activates the cockpit warning system. Once the source of heat is removed, the resistance of the material returns to the original value and the fire warning ceases.

The Boeing 767-300ER engine fire extinguishing system has two fire bottles located in the fuselage which are both available to either engine. The engine fire drill required that if an engine fire warning light remained illuminated after activation of the number 1 fire bottle, the crew wait for 30 seconds before they discharge the second fire bottle. As the light remained on, the second fire bottle was discharged. That action meant that the entire fire extinguishing system for both engines was exhausted.

The operator advised that the engine fire detection loop was inspected after the incident and found to be fully serviceable. Temporary repairs were effected to the damaged wiring and the wires were subsequently replaced. Photographs of the damaged and disrupted wires, and the corresponding wire loom on another aircraft, are available on the ATSB website, www.atsb.gov.au, or from the Bureau on request. The continued fluctuation of the fire warning was due to damage and disruption of the wires to the engine fire detection loop, rather than a signal from the loop itself.

Individual wires to the engine fire warning loop were in a loom and the loom was positioned between the duct, pipes and the compressor outer case. Compliance with SB 75-0156, that removed the duct altogether, would still not remove the pipes that carry the high-pressure, high- temperature air through the area.

Occurrence summary

Investigation number	200105701
Occurrence date	04/12/2001
Location	46 km ESE Sydney, Aero.
State	New South Wales
Report release date	18/07/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	767
Registration	C-FXCA
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Sydney, NSW
Destination	Honolulu, USA
Damage	Minor

Piper PA-31-350, VH-FIA

Safety Action

Local Safety Action

The operator has introduced three Company Standing Orders detailing new procedures for traffic separation procedures between company aircraft, radio procedures to reduce frequency congestion, and procedures to be followed after a propeller strike.

Summary

The Piper Chieftain was being flown as a single-pilot operation to conduct a scheduled passenger flight from Adelaide to Kingscote. The Chieftain was one of six aircraft being used by the operator on the route at the time. The other aircraft were involved in passenger charter operation. The six aircraft departed Adelaide at about the same time for Kingscote and the Chieftain was the first to approach the airfield.

The pilot reported that he decided, based on the Kingscote Automatic Weather Service reports and the weather forecast for the area, to descend to the sector's Lowest Safe Altitude. He intended to descend clear of cloud and approach the airfield to land on Runway 19 via a 5 NM straight-in visual approach. He had also planned to conduct a Sector A Global Positioning System (GPS) instrument arrival should the aircraft not break clear of cloud in sufficient time for a normal visual approach. Due to the weather conditions, the pilot decided to make the Sector A GPS arrival. The pilot reported that during the descent and approach, the pilots of the other aircraft were querying him about the cloud base and weather so that they could plan their arrivals.

The pilot reported that, during the GPS arrival, he had configured the aircraft in accordance with the operator's requirements and aircraft checklist, including lowering the landing gear. The aircraft broke clear of cloud at about 1,000 ft and 2 NM from the airfield. The pilot decided that the aircraft would require excessive manoeuvring to land directly from the approach and chose, instead, to conduct a left circling approach to Runway 19. He reported that he raised the landing gear to reduce the chance of large power changes that may have alarmed the passengers. He then flew the circling approach but did not lower the landing gear.

While the pilot was answering queries from other pilots about the weather conditions on the MBZ frequency, he was also listening to radio traffic on the ATC frequency. He also reported that there was light rain falling and running along the windscreen, reducing visibility and increasing his workload.

The pilot reported that late in the landing flare, he heard the landing gear warning horn and the scraping of the aircraft on the runway. He initiated a go around and advised the following aircraft of the event, however he did not receive a reply because the aircraft's VHF antennas had been damaged during the scrape on the runway. He then lowered the landing gear and landed without further incident on Runway 24 to help ensure separation from the following aircraft. The Chieftain sustained damage to both propellers, the VHF radio aerials on the underside of the aircraft fuselage and the inboard sections of the flaps.

The pilot was in a high workload situation, manoeuvring the aircraft in order to set it up for landing, and was probably distracted by the radio broadcasts and weather conditions at the time, which resulted in him forgetting to lower the landing gear before landing.

Occurrence summary

Investigation number	200105698
Occurrence date	03/12/2001
Location	Kingscote Aero.
State	South Australia
Report release date	25/02/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Aviation occurrence category	Ground strike
Occurrence class	Accident
Highest injury level	None

Aircraft details

Manufacturer	Piper Aircraft Corp
Model	PA-31
Registration	VH-FIA
Serial number	31-7752032
Sector	Piston
Operation type	Air Transport Low Capacity
Departure point	Adelaide, SA
Destination	Kingscote, SA
Damage	Substantial

Boeing 737, VH-VGC

Summary

Prior to take-off, the crews of a Boeing 767 (767) and a Boeing 737 (737) received clearances to depart Sydney via a runway 34 right MARUB 3 standard instrument departure on climb to 5,000 ft initially. They were subsequently cleared to climb to flight level (FL) 280. That procedure required the aircraft to turn right after take-off and to track to MARUB, located 15 NM east of the airport. The aircraft were then required to turn right and track southeasterly until leaving 10,000 ft, before turning further right to track to Wollongong and then to continue their planned route to Melbourne. As the aircraft taxied for departure, the air traffic controller advised the crews of an approaching line of thunderstorms that could affect their aircraft en route, to the southwest of the airport.

The 767 departed at 1314 Eastern Summer Time and the 737 departed at 1324. Both crews subsequently diverted their respective aircraft east of the cleared track due to thunderstorms on the planned track and entered restricted area 495 (R495) at 1330 and 1338 respectively. The area was active with Royal Australian Air Force (RAAF) F/A-18 Hornets and a Learjet operating with Royal Australian Navy (RAN) ships. The 767 and the 737 entered R495 without a clearance and were in the same part of the area as a number of Hornets. The investigation did not establish the actual proximity of aircraft and if any information regarding the 767 and 737 was issued to the crews of the military aircraft.

A Bureau of Meteorology (BoM) assessment of the meteorological situation reported that the weather across New South Wales (NSW) was dominated by a low-pressure centre located on the south coast of NSW. A trough extended from the low through to the southwest of inland Queensland, and the middle and upper atmospheres were dominated by strong westerly to north-westerly winds. During the day, the low and the trough moved slowly northeast. The atmosphere on and east of the trough was very unstable and by 1200 thunderstorms and heavy showers began to form near the trough. Due to the atmospheric conditions those thunderstorms quickly formed into squall lines and they moved towards the coast at speeds of about 40 knots.

At about 1200, the Sydney meteorological radar showed that a line of showers had moved eastward and was just to the west of a line from Bathurst to Goulburn. The 1230 radar scan identified the presence of thunderstorms in that line of showers, which was about 50 NM from Sydney airport (Figure 1), and moving in an easterly direction (Figure 2 to 4).

Figure 1: Sydney Radar 1233

Figure 2: Sydney Radar 1243

Figure 3: Sydney Radar 1253

Figure 4: Sydney Radar 1303

The BoM reported that individual storm cells in that line had tops of 25,000 to 30,000 ft. Part of the squall line passed over the Sydney radar at 1320 and continued to develop, assisted by the inflow of moist surface air (Figure 5 and 6).

Figure 5: Sydney Radar 1313

Figure 6: Sydney Radar 1323

By 1340, the line of thunderstorms was close to Sydney airport (Figure 7 and 8).

Figure 7: Sydney Radar 1333

Figure 8: Sydney Radar 1343

By 1420 the squall line had cleared Sydney airport.

The BoM Sydney terminal area forecast (TAF) for the 24-hour period commencing at 0500, issued at 0350, included a 30% probability of thunderstorms for that afternoon (the same intermittent weather was included on an amended TAF issued at 0930). The 1300 Trend Type Forecast issued at 1304 amended that forecast to include intermittent periods of thunderstorm activity commencing from 1345.

At 1230, BoM issued an Airport Warning for Sydney advising of expected wind gusts in excess of 41 kts in the following hour. At 1334, BoM issued a lightning alert to airport ground staff warning that lightning had been observed within 10 km of Sydney airport.

At about 1230, the Sydney Traffic Manager (TM) became aware of the approaching thunderstorms. At 1300, the TM called the RAN Fleet Operations Officer to coordinate the early release of the restricted area to facilitate possible aircraft diversions into that area. On previous occasions when aircraft had needed additional airspace to avoid weather the area had been able to be released to Sydney Air Traffic Control at relatively short notice. The area was planned to be active for the afternoon but the Fleet Operations Officer approved the release of the eastern portion of the area from 1430. The TM accepted the partial release of the area from 1430 and warned the operations officer that emergency diversions might still occur before that time. The TM also had controllers notify pilots of departing aircraft of the approaching thunderstorms.

When it was apparent that the aircraft were likely to enter the active restricted area at about 1330, the crews of both aircraft were instructed to activate their aircraft transponders to code 7700 and to broadcast intentions on the Very High Frequency (VHF) emergency frequency 121.5 Mhz. The crews complied with those instructions.

The occurrence highlights the need for collaborative decision making between forecasters, controllers and pilots during periods of thunderstorm activity. It has similarities with a weather-related occurrence in Brisbane during January 2001 that was investigated by the Australian Transport Safety Bureau. That investigation found a number of factors, including factors related to controller and pilot decision making, and the need for increased communication during periods of convective weather. The ATSB made a number of recommendations following that investigation.

For more information see Occurrence report BO/200100213.

Occurrence summary

Investigation number	200105697
Occurrence date	03/12/2001
Location	93 km S Sydney, VOR
State	New South Wales
Report release date	18/06/2003
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	737
Registration	VH-VGC
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Sydney, NSW
Destination	Melbourne, VIC
Damage	Nil

Aircraft details

Manufacturer	The Boeing Company
Model	767
Registration	VH-OGF
Serial number	24853
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Sydney, NSW
Destination	Melbourne, VIC
Damage	Nil

Fairchild SA227-AC, VH-CUZ

Summary

While in cruise flight, the crew of the SA 227 aircraft noticed the left engine oil pressure fluctuating. A visual inspection of the engine in-flight revealed nothing unusual. A short time later, the left engine oil warning light illuminated and, in accordance with company standard operating procedures, a precautionary engine shut down was carried out. The crew then diverted the aircraft to the nearest available airport and conducted a single engine approach and landing. A post flight inspection of the aircraft revealed no measurable oil remaining in the left engine.

An inspection of the aircraft, immediately following landing, found that the engine oil had leaked from a loose right-angle oil line fitting that was situated on the left engine's Beta Manifold. A subsequent maintenance investigation by the operator discovered that the fitting had become loose after it had been forcibly contacted by the left starter generator's "micarta" electrical connector block. That contact had occurred following the rotation of the generator on its mounts due to a loose attaching clamp and several missing locating pins.

An inspection of the generator's attaching "v-band" clamp revealed evidence of deterioration of the thread and nut that tightened the clamp. Three of the four locating pins that positioned the generator on the mount were also noted to have been missing, with the remaining pin partially depressed into the surface of the mount. The generator had been removed, and re-installed, during contractor maintenance approximately two weeks prior to the incident.

The starter generator and mounts were replaced with serviceable items and the engine was ground run with no problems noted. The aircraft was returned to service.

Following the incident the contract maintenance personnel were briefed on the occurrence and the ramifications of incorrect component installation.

Occurrence summary

Investigation number	200105660
Occurrence date	29/11/2001
Location	130 km E Osborne Mine, (ALA)
State	Queensland
Report release date	05/03/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	Fairchild Industries Inc
Model	SA227
Registration	VH-CUZ
Serial number	AC-610B
Sector	Turboprop
Operation type	Air Transport Low Capacity
Departure point	Townsville, QLD
Destination	Osborne ALA, QLD
Damage	Nil

Boeing 767-238, VH-EAQ

Safety Action

Local safety action

In response to other JT9D blade failures from trailing edge cracks, the engine manufacturer implemented improvements to the eddy-current techniques used to inspect the blades after overhaul. The improvements included the addition of a new eddy-current inspection requirement after fan blade patch repairs, changes to the probe scanning methods and the use of a chart-recorder device to produce a 'hard-copy' of the test results for post-inspection review. The blade fracture on engine P-716610 occurred on a component that was repaired and inspected before the technique improvements and relevant engine manual changes were made.

The engine manufacturer is revising the relevant engine manuals to include the use of an enhanced 3-pass eddy current inspection procedure in lieu of the single pass procedure. This procedure provides a greater degree of confidence for the detection of small defects. The issue of these engine manual revisions is planned for early 2003.

An all-operator communication (AOW) was issued by the engine manufacturer on 19 July 2002, providing for a temporary revision of the engine manuals to incorporate the 3-pass eddy current inspection procedure, prior to the full revision of the engine manuals as mentioned above. The AOW also recommended the re-inspection of all fan blade leading and trailing edges at next overhaul, using the 3-pass eddy current procedure.

After the engine failure, the aircraft operator implemented a once-off fleet-wide inspection of the fan blade trailing edges using an eddy-current technique. No other similar defects were found. The operator has also implemented an engineering instruction requiring that all new or lease engines introduced into the fleet will automatically be flagged as requiring a blade trailing edge eddy-current inspection.

Factual Information

History of the flight

Approximately eight minutes into a regular passenger transport flight from Melbourne to Sydney, while the Boeing 767 aircraft was climbing through flight level 160, the crew and passengers heard a loud bang and felt severe vibration throughout the airframe. Engine indication and crew alerting system (EICAS) messages on the flight deck indicated the left (number-one) engine had no N1 turbine rotation and an elevated exhaust gas temperature. After discontinuing the climb and advising air traffic services (ATS), the flight crew actioned the 'engine fire, severe damage and separation' checklist and advised the cabin crew and passengers of the engine failure and the intention to return to Melbourne. Several aircraft crewmembers that were passengers aboard the flight advised the flight crew (via the cabin services manager) that the left engine had lost a fan blade and that it had perforated the engine cowling. The flight crew made a PAN radio call to ATS and requested emergency services be placed on local stand-by. After configuring the aircraft for a single-engine approach and landing, some adjustment of the airspeed was required to minimise the level of vibration from the failed engine. The aircraft landed safely on Melbourne airport runway 27, eighteen minutes after the engine had failed and twenty-six minutes after departure.

After exiting the runway, the aircraft was stopped and airport rescue and fire-fighting services carried out a safety inspection before allowing the aircraft to taxi to the terminal buildings using thrust from its remaining serviceable engine. Following passenger disembarkation, the flight crew conducted an operational debriefing with the cabin crew.

Injuries to persons

Injuries	Crew	Passengers	Others	Total
Fatal
Serious
Minor
None	10	194	Nil	204

Damage to the aircraft

Damage to the aircraft was limited to the left engine assembly and nacelle. While multiple punctures of the engine nose cowling indicated the liberation of debris from the confines of the intake area, none of this debris had struck the wing, fuselage or tailplane of the aircraft.

Failure of the Pratt & Whitney JT9D-7R4 engine (serial number P-716610) fitted to the aircraft was attributed directly to the fracture and release of the outer half of a single low-pressure compressor (fan) blade (part number 5001341-22, serial number ND9278).

Liberation of the blade segment caused appreciable damage to the remaining fan blades and extensive damage to the intake linings. Ancillary damage to the engine included distortion of the fan casing, loss of the fan speed (N1) sensor and the overload failure of several nose-cowl bolts. Although the primary impact of the released blade with the fan casing had resulted in the segment being contained, the subsequent forward movement of the blade allowed it to impact the nose-cowling with sufficient energy to puncture the cowl wall and escape the engine intake. The initial impact with the cowl occurred at the two-o'clock position (looking forward), with the blade segment passing through the cowl with a tangential trajectory, exiting at around the three-o'clock position. From the impact point and angle, it was evident that the blade segment had been ejected downward and beneath the aircraft. Other debris liberated through the nose cowl or fairings included the N1 sensor and one of the nose cowl lip bolts. Both components were located adjacent to the initial blade impact point and thus were likely to have been subject to a very large reactive force as the blade segment struck the fan case. Figures one to four illustrate the trajectory followed by the released blade segment and the fan case components that perforated the engine cowling.

Aircraft information

Manufacturer	Boeing Co.
Model	767-238
Serial number	23896
Registration	VH-EAQ
Year of manufacture	1987
Certificate of airworthiness	Issue date: 27 August 1987
Certificate of registration	Issue date: 27 August 1987

Engine information

The subject engine (serial number P-716610) had been installed on VH-EAQ since October 2001 and had operated for 319 hours and through 200 cycles while fitted to the aircraft. Pratt & Whitney first purchased the engine for leasing in 1998 and, since that time, it had been installed on several different aircraft from different airlines. At the time of failure, the engine had operated for a total of 26,138 hours and through approximately 8,900 cycles.

The failed fan blade (part number 5001341-22, serial number ND9278) was fitted to the engine in August 1998. Before this, the blade had been held as a stock component since its repair and refurbishment in 1991. Work done on the blade at that time included two elevated-temperature straightening operations, where the blade was heated to 650 degrees Celsius and the aerofoil shape re-formed. The manufacturer's records indicated a subsequent blade service life of 7,187 hours and 2,083 cycles. The total time and cycles accumulated by the blade since manufacture was unknown.

Blade inspection

Various non-destructive inspections had been carried out on the blade since overhaul, including eddy current inspections after the thermal straightening operations and periodic visual inspections of the blade while in operational service. Prior to installation on VH-EAQ, the engine underwent a foreign object damage inspection (conducted every 200 cycles) and an eddy current inspection of the leading edge (conducted by the operator every 350 hours). No further inspections had been performed or were required at the time of failure. The requirements and frequency of these on-wing inspections were specified in the aircraft manufacturer's maintenance manual (B767-72-31-02/601) and in Pratt & Whitney service bulletin SB 72-255. At the time of the failure, these documents contained no requirement to carry out a periodic eddy current inspection of the blade trailing edges while the engine was in-service. SB 72-255 stated that 'Eddy current inspection may be used as an option at the operator's discretion'.

After the 1991 refurbishment work, the manufacturer's records indicated that the failed blade was inspected to the engine manual requirements using a single-pass eddy current technique. The eddy current procedure was specified as having the capability to detect crack-like defects as shallow as 0.25mm (0.010") along the blade edges. No defects were detected as a result of this procedure and the blade was subsequently accepted for service.

Cabin aspects

The cabin services manager (CSM) reported the initial engine failure event as "like hitting a brick wall; obviously not turbulence". The CSM described a noisy, high level vibration throughout the cabin, causing some unsteadiness to the crew standing in the cabin service areas. After the vibration had abated, the crew commenced securing the cabin and awaited instruction from the flight deck. Several aircraft crewmembers travelling as passengers reported damage to the left engine nacelle to members of the cabin crew. The CSM passed those observations on to the flight crew. The CSM reported no adverse passenger reactions during the event or during the subsequent return to Melbourne.

Flight recorder

The aircraft was fitted with an L3 Communications (LORAL) model FA2100 solid-state flight data recorder (SSFDR). An excerpt of the data from the recorder containing information from the previous flight and the incident flight was obtained by the ATSB. That data was analysed by the ATSB and used to prepare a summary of events and actions during the incident flight.

The FDR information indicated that the left engine failed at 00:19:59UTC (11:19:59 Eastern Summer Time) and was characterised by a sudden increase in the engine broadband vibration and a decrease in the engine pressure ratio (EPR). At that time, the aircraft was climbing through an altitude of 16,134 feet and maintaining 311 knots airspeed. Both left and right engines were operating at an N1 speed of approximately 94 percent. Vibration levels peaked around two seconds following the initial event and the engine exhaust gas temperature (EGT) peaked at 633 degrees C, six seconds after.

Within the next fourteen seconds, the flight crew had retarded the left engine thrust lever, disengaged the auto-throttle and move the left engine fuel cut-off lever to the OFF position. The left engine fire switch was pulled at 00:21:47, however neither fire bottle was discharged. All actions taken were as documented in the 'Engine fire, severe damage or separation' section of the B767-238 quick reference handbook.

Comparison of the engine broadband vibration levels found no specific differences between the incident flight (before the failure) and the previous flight. Examination of the graphically presented information showed that at approximately twenty seconds before the major vibration transient associated with the fan blade release, a smaller transient occurred in the base vibration levels (figure 5). Short-term escalations in engine vibration levels are anomalous and often indicative of transient events such as compressor aerofoil stalls and surges or foreign object ingestion.

Tests and research

The ATSB examined the released blade segment, assisted by authorised representatives from Pratt & Whitney.

Liberation of the fan blade segment occurred as a direct result of fatigue cracking developing within the trailing edge of the blade aerofoil section. A single transverse high-cycle fatigue crack had developed from a 0.6mm deep pre-existing defect at the blade trailing edge, approximately 290 millimetres above the root face. Multiple surface arrest marks indicated to the growth of the cracking over multiple flight cycles. Final tensile overload of the remaining cross-section released the outer blade section after the fatigue crack had grown to a length of approximately 85 millimetres.

The characteristics of the defect at the fatigue origin identified it as a crack-like feature formed under localised tensile loads. Heat tinting of the defect surfaces indicated the exposure of the region to the elevated temperatures associated with the blade overhaul. The implication from this was that the defect was either present before the overhaul or was produced by the overhaul operations. The defect location was within an area of repair blending at the blade trailing edge. While the blending had reduced the chord-wise width of the blade to one millimetre below the specified minimum limit, it was not considered to have significantly contributed to the development of fatigue cracking from the trailing edge defect. Non-destructive testing procedures carried out following the blade re-work had failed to detect the trailing edge defect before the blade was re-introduced into service within engine P-716610.

A copy of Technical Analysis report number 9/02 detailing the examination of the failed blade is available from the bureau on request.

Significant Factors

A small crack-like defect remained within the trailing edge of a first-stage low-pressure compressor (fan) blade after the component had undergone overhaul operations in 1991.
Post-overhaul non-destructive inspection procedures conducted on the blade edges failed to detect the defect and the blade was placed in storage until 1998, when it was installed into engine P-716610.
Because of its small size, the trailing edge defect was not detectable by the in-service visual inspections required by the manufacturer and carried out by the various engine operators (SB 72-255).
An optional eddy-current inspection of the blade by the last operator was capable of detecting the defect, but was not performed (nor required to be performed) along the blade trailing edge.
Fatigue cracking initiated and propagated from the trailing edge defect in response to vibratory and centrifugal operating loads.
Fracture of the fan blade occurred after growth of the fatigue cracking to critical size.
The left engine of the aircraft failed after the fracture and liberation of the blade segment during climb to cruising altitude.

Analysis

Engine failure

Failure of the left engine from VH-EAQ occurred as a result of the fracture and liberation of approximately two-thirds of the length of a single first-stage low-pressure compressor (fan) blade. The loss of the blade section produced a significant imbalance in the fan rotor, which manifested as severe vibration of the airframe and produced heavy tip rub on the remaining blades against the fan case lining. The flight crew's subsequent observations of a high exhaust gas temperature indicated the development of anomalous combustion conditions within the engine because of the airflow interruptions produced by the fan failure.

Blade loss

Rotor kinematic laws predict that the partial loss of a fan blade will result in the fragment striking the fan case, before folding flat and moving forward from the plane of rotation with a helical motion. This motion will continue until the fragment either perforates the intake cowling forward of the fan case, exits the front of the intake cowling, or is drawn back into and re-ingested by the fan rotor. In this case, damage to the intake (nose) cowling indicated the loss of the blade section soon after liberation, with comparatively little other damage to the remaining blades. Measurements of the damage to the intake cowling indicated the blade exited the cowling with a forward and downward trajectory, sufficient to take it away from the aircraft without impacting any other part of the structure.

The radial forces transferred to the fan case by the initial impact of the blade segment were sufficient to break away several of the nose cowl bolts, one of which punctured the inboard fan case cowl. The fan speed (N1) sensor was also lost in a similar manner. Neither of these components had damaged the aircraft after exiting the engine nacelle.

Blade failure

Laboratory examination of the blade fracture surface confirmed the presence of a pre-existing trailing edge defect, from which high-cycle fatigue cracking initiated and propagated. The examination identified the defect was either produced by, or was present before the last major blade refurbishment operation incorporating an elevated temperature straightening operation. The size and nature of the defect was such that it should have been detectable by non-destructive means following the blade refurbishment operations. The engine manufacturer stated that the eddy-current method specified for this inspection had the capability to detect defects well below the size of the actual defect present. In this regard therefore, error by the inspecting technician was the most likely factor contributing to the failure to detect the defect.

Pratt & Whitney service bulletin SB 72-255 was the core document that specified the requirements for the periodic in-service inspection of the engine low-pressure compressor blades. The objective of that service bulletin was to provide opportunities for the early discovery and repair of foreign object damage, thereby reducing the potential for foreign object damage induced blade failures. The bulletin required the visual inspection of the fan blade assemblies and the blend repair of all leading edge damage found, with eddy current inspection included as an option at the operator's discretion. In this case however, visual inspection alone would have likely proved unsuccessful in detecting the defect at the origin of fatigue cracking, due to the small defect size and the absence of any associated foreign object damage.

In the current engine operator's case, an eddy current technique was used to complement the visual inspection, however this was a limited survey and did not extend to the examination of the blade trailing edges. It was not known whether any of the previous engine operators had used an eddy current inspection as part of their compliance with SB 72-255.

Continuing airworthiness

The US Federal Aviation Administration has published a draft advisory circular that provides a mechanism for the assessment of the continued airworthiness of powerplants and auxiliary power units on transport category aircraft (AC39-XX). The advisory circular describes the Continued Airworthiness Assessment Methodologies (CAAM) and uses them to identify unsafe conditions, before prescribing corrective actions in accordance with the Federal Aviation Regulations (FAR) part 39.

The CAAM recognise uncontained engine blade failures as an 'historically unsafe condition' and as such, require that an appropriate response be determined and carried out. In this case, the unsafe condition may be more specifically defined as the presence of undetected defects within the blade trailing edges, from which uncontained failure may result. Following from this, aircraft exposed to this unsafe condition are defined as those aircraft fitted with engines carrying defective fan blades. In the context of this occurrence, the assessment of the level of exposure (ie. number of aircraft) can only be determined by the inspection of each blade currently in service, to determine the presence or otherwise of the defect/s. Minimisation of the risk is achieved by the subsequent removal of all blades found to contain defects.

This action is proposed by the engine manufacturer and is detailed within section 4 of this report (Safety Action).

Summary

During the early stages of a regular passenger transport flight between Melbourne and Sydney, Boeing 767 aircraft, registration VH-EAQ, sustained the failure of the left engine, necessitating a return to Melbourne airport. The turn-back and subsequent single-engine landing was uneventful.

Failure of the left engine resulted from the liberation of the outer-most half of a single first-stage compressor (fan) blade. The fan casing had contained the initial blade impact, however subsequent forward movement of the segment allowed it to strike and penetrate the engine intake (nose) cowling. Other small components had also penetrated the inboard fan case cowl. Inspections found no evidence that any of the released debris had damaged the aircraft structure outside of the engine nacelle.

Laboratory examination of the section of failed blade remaining within the fan rotor found that the fracture had occurred from high-cycle fatigue cracking that initiated from a pre-existing defect at the blade trailing edge. This crack-like defect showed evidence of having formed during or before the blade was last overhauled in 1991 and had remained undetected during post-overhaul non-destructive testing inspections. The manufacturer fitted the blade to the subject engine in 1998 and it remained in service until the failure, accumulating 7,187 hours and 2,083 cycles since overhaul.

The engine manufacturer attributed the failure to detect the original fan blade defect to procedural deficiencies and operator error during inspection. In response to previous blade failures, the manufacturer amended the engine manuals to incorporate a number of improvements aimed at increasing the probability of defect detection. The failed blade in this occurrence had been inspected before the engine manual changes. The engine manufacturer has also issued an all-operator communication recommending that any blades last inspected before the engine manual changes should be re-inspected to the latest requirements.

(Damage confined to number one engine and cowling. Loss of single fan blade produced multiple punctures of nose cowling and smaller preforations in fan case cowling. Extensive impact damage to remaining fan blades and cowl linings.)

Occurrence summary

Investigation number	200105627
Occurrence date	27/11/2001
Location	56 km NE Melbourne, Aero.
State	Victoria
Report release date	02/10/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	767
Registration	VH-EAQ
Serial number	23896
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Melbourne, VIC
Destination	Sydney, NSW
Damage	Minor

Beech Aircraft Corp C90, VH-LQH

Factual Information

FACTUAL INFORMATION

In common with most transport accidents, this occurrence involved a number of different contributing factors. Although some of these factors were associated with actions of individuals or organisations, it is essential to note that the key objective of an ATSB safety investigation is to identify safety deficiencies or weaknesses in the safety system and to learn how to minimise the risk of future accidents. It is not the purpose or intention of the investigation to apportion blame, or to provide a means of determining liability.

Sequence of events

At about 0836 Eastern Standard Time on 27 November 2001, a Beech Aircraft Corporation King Air C90 aircraft, registered VH-LQH, took off from runway 29 at Toowoomba aerodrome, Queensland for an Instrument Flight Rules charter flight to Goondiwindi, Queensland. On board were the pilot and three passengers.

Just prior to, or at about the time the aircraft became airborne, the left engine failed. A subsequent examination of the left engine found that it probably lost thrust-producing power almost immediately. Following the engine failure, the take-off manoeuvre continued and the aircraft became airborne prior to crashing.

The aircraft was equipped with an automatic propeller feathering system, but the propeller was not feathered at impact. The reason the propeller was not feathered could not be determined. The landing gear was not retracted during the short flight. The right engine was developing significant power at impact.

The aircraft remained airborne for about 20 seconds. The aircraft's flight path was typical of an asymmetric, low speed flight situation, and it is unlikely that the aircraft's speed was ever significantly above the minimum control speed (V_mca) of 90 kts. The aircraft manufacturer's specified procedures for responding to an engine failure in LQH stated that the take off should be rejected below the 'take-off speed', specified as 100 kts. After control of the aircraft was lost, and as the aircraft was rolling through about 90 degrees left bank, it struck powerlines about 10 m above ground level and about 560 m beyond the end of the runway. It then continued to roll left and impacted the ground inverted in a steep nose-low attitude. An intense fuel-fed fire erupted upon initial impact with the ground. The aircraft was destroyed and all four occupants sustained fatal injuries. The accident was not considered to be survivable due to the impact forces and post-impact fire.

Maintenance-related issues

The central event in this accident was the failure of the left engine, which was the 'critical' engine on the aircraft in terms of aircraft performance considerations. Examination of the left engine showed internal damage that was consistent with the fracture and release of one or more compressor turbine blades into the engine gas path, resulting in a significant reduction in power from the engine. There were no indications that the engine failure was due to manufacturing defects, metal fatigue, foreign object damage during the flight, or the quality or quantity of fuel on board the aircraft. Examination of the compressor turbine blades indicated that they had been exposed to higher than normal operating temperatures in the period leading up to the accident.

The engine failure occurred at 3,556.0 hours since the last overhaul, which was within the 3,600 hours time between overhaul (TBO) specified in the engine manufacturer's service bulletins. However, the aircraft's engines were operating on a life extension to 5,000 hours TBO in accordance with the provisions of the Australian Civil Aviation Safety Authority (CASA) Airworthiness Directive AD/ENG/5 Amendment 7. A requirement of the AD was that, if the engines were operating to a 5,000 hour TBO, they had to be subject to an engine condition trend monitoring (ECTM) program. The pattern of ECTM data from the left engine indicated that a potentially safety-critical problem existed in that engine for several weeks prior to the accident. For a variety of reasons, that evidence was not detected and analysed, nor was appropriate remedial action initiated. Without timely intervention to address the developing engine problem, it was increasingly probable that the aircraft would have an in-flight emergency involving the left engine.

The pattern of evidence suggested that a problem with the efficiency of the cold section of the engine probably led to temperature-related damage to the compressor turbine blades, which probably resulted in the failure of one of those blades. However, some other explanations for the failure, such as a previous hot start leading to or exacerbating the temperature-related damage, could not be discounted.

Apart from issues associated with the left engine, there was no indication of any fault in any aircraft system that may have contributed to the accident. The ECTM data for the right engine suggested that a potential problem had also been developing in the cold section of that engine for a period of time.

The last maintenance of the left engine most probably occurred on 7 June 2001. Based on the requirements of AD/ENG/5, a compressor performance recovery wash was required to be conducted in response to trend monitoring parameter deviations, or at intervals not to exceed 3 months or 220 hours, whichever came first. Had the performance recovery wash been conducted on the left engine at the appropriate time, it may have been effective in removing the source of deterioration in cold section efficiency.

Prior to March 2001, maintenance on the operator's aircraft was conducted by an external maintenance organisation. From March 2001, maintenance was conducted by a newly formed internal maintenance organisation. The ratio of the operator's available maintenance personnel resources relative to the maintenance resources reasonably required, resulted in the operator's chief engineer experiencing a significant workload. In August 2001, the maintenance controller left the operator and the chief engineer took over the maintenance controller responsibilities. His workload increased significantly when he took on these additional responsibilities.

In addition to the level of maintenance resources, the investigation noted that the defences within the operator's maintenance organisation were deficient in a number of other areas. The chief engineer had minimal preparation for his role as maintenance controller. He had also not completed ECTM training, and therefore the operator arranged to send the data to the engine manufacturer's field representative for analysis. However, the ECTM data were not being recorded or submitted for analysis as frequently as required by the engine manufacturer's requirements or AD/ENG/5. In addition, there were deficiencies in the operator's maintenance scheduling processes.

CASA was aware that the chief engineer had not completed ECTM training and that the operator had an arrangement to send ECTM data to the engine manufacturer's field representative for analysis. However, CASA surveillance had not detected any problems with the operator's ECTM program prior to the accident. Following the accident, CASA inspectors conducted a review of the engine condition monitoring programs of operators in their region. The review found that a number of the operators were not complying with relevant requirements.

The introduction of AD/ENG/5 allowed life extensions to be approved for PT6A engines in Australia under less restrictive circumstances compared with those required by the engine manufacturer. By allowing a wider range of operators to extend TBOs, there was an onus on CASA to take measures to assure itself, during its surveillance activities, that operators were complying with the AD and conducting ECTM appropriately. However, CASA's surveillance system was not sufficiently rigorous to ensure that the mitigators it had introduced within AD/ENG/5 for allowing TBO extensions were effective.

The investigation also noted that the CASA system for approving maintenance organisations and maintenance controllers did not appropriately consider the maintenance organisation's resource requirements.

Flight operations issues

The investigation determined that the pilot was appropriately licensed to conduct the flight, and that it was unlikely that any medical or physiological factor's adversely affected the pilot's performance. There was also no evidence that incorrect aircraft loading or meteorological conditions were factors in the accident.

Several factors would have contributed to the aircraft's speed not being sufficient for the pilot to maintain control of the aircraft during the accident flight. These factors included the significant loss of power from the left engine just prior to, or at about the time, the aircraft became airborne, and the substantial aerodynamic drag resulting from the landing gear remaining extended and the left propeller not being feathered. In addition, the aircraft's speed when it became airborne was probably close to V_mca and not sufficient to allow the aircraft to accelerate to the best one-engine inoperative rate-of-climb speed (V_yse) of 107 kts with an engine failure.

With an engine failure or malfunction near V_mca, the safest course of action would be to reject the takeoff due to the likelihood of the aircraft not being able to accelerate to V_yse. Although in some cases this will mean that the aircraft will overrun the runway and perhaps sustain substantial damage, the consequences associated with such an accident will generally be less serious than a loss of control after becoming airborne.

In this case, the engine failure occurred during a critical phase of flight, in a situation that was among the most difficult for a pilot to respond to in a manner that would ensure a safe outcome. In addition to the timing of the engine failure, a number of factors could have influenced the pilot's decision to continue with the takeoff, including the nature of the operator's procedures, the length of the runway, and the visual appearance of the runway and buildings beyond the runway at the time of the engine failure.

The operator specified a rotation speed of 90 kts, which was less than the 96 kts rotation speed specified by the aircraft manufacturer for King Air C90 aircraft. The operator's specified rotation speed had the effect of degrading the one-engine inoperative performance capability of the aircraft during takeoff. In addition, the operator's procedures did not provide appropriate guidance for pilots regarding decision speeds or decision points to use for an engine failure during takeoff.

While aircraft manufacturers have provided guidance material in operating manuals regarding engine failures leading to power loss in multi-engine aircraft, CASA had not published formal guidance material. The level of training available for emergencies in this category of aircraft during critical phases of flight and at high aircraft weights was less than desirable.

Toowoomba aerodrome was licensed and met the relevant CASA standards. However, runway 29 did not meet the ICAO standard in relation to the runway end safety area (RESA).

Safety action

Since the accident, CASA has made changes to the requirements of AD/ENG/5 and the processes for assessing the suitability of maintenance controllers.

As a result of this investigation, the ATSB issued six recommendations to CASA relating to the following areas:

reviewing operator compliance with the requirements of mandatory turbine engine condition monitoring programs.
surveillance processes for confirming operator compliance with mandatory engine condition monitoring programs.
processes for identifying priority areas for consideration during airworthiness surveillance and approval activities.
processes to assess whether a maintenance organisation has adequate resources to conduct its required activities.
the provision of formal advisory material to operators and pilots about managing engine failures and other emergencies during takeoff.
the assessment of synthetic training devices for the purpose of training pilots in making decisions regarding emergencies during critical stages of flight.

As a result of this accident, the ATSB has issued a recommendation to the aerodrome operator for it to liaise with CASA to evaluate an engineering solution to enhance aircraft deceleration in the runway end safety area of runway 11/29 at Toowoomba aerodrome.

A number of issues identified during the investigation related to the aircraft operator, and would normally have resulted in safety recommendations to that organisation. However, subsequent to the accident the operator ceased operations.

Summary

On 11 November 2005 a further investigation under section 19DF of the Air Navigation Act 1920 was commenced into aspects of this accident. This investigation has been completed and a supplementary report 200507077 has been released and is available on the website.

Occurrence summary

Investigation number	200105618
Occurrence date	27/11/2001
Location	Toowoomba, (ALA)
State	Queensland
Report release date	25/06/2004
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Aviation occurrence category	Collision with terrain
Occurrence class	Accident
Highest injury level	Fatal

Aircraft details

Manufacturer	Beech Aircraft Corp
Model	90
Registration	VH-LQH
Serial number	LJ-644
Sector	Turboprop
Operation type	Charter
Departure point	Toowoomba,QLD
Destination	Goondiwindi, QLD
Damage	Destroyed

Boeing 737-476, VH-TJY

Safety Action

The investigation found a safety deficiency relating to the limitations of self-checking of data inputs by controllers. Any outcome from the investigation of the safety deficiency will be published on the Australian Transport Safety Bureau website www.atsb.gov.au.

Analysis

It was likely that the controller was distracted by thoughts of the pending meeting. He may also have been fatigued to some degree as he had been occupied with either operational or administrative tasks since commencing work and had not had an adequate rest period.

It is possible that the controller did not appreciate the error, because the read back by the pilot phonologically matched the information stored in the controller's short-term memory. The controller had issued a clearance of FL330 to the crew and this was the same flight level that was read back.

The aviation system relied on the instruction and readback cycle used by pilots and controllers to prevent misunderstanding. The nature of interacting with TAAATS can make the controller response to the clearance read back an automatic process that provides no clue to input errors. While the read back process used two parties, a pilot and a controller, to challenge and check each other, the data input to TAAATS was reliant on controller self-checking. The occurrence highlighted the limitations inherent in using individuals to check their own work. Controllers need to be aware of the potential for error when checking TAAATS data inputs against clearance read backs.

The situational awareness of the crew of TJY, and their query regarding the assigned flight level, ensured that the situation was clarified and safety was maintained.

Summary

A Boeing 737 (B737) registered VH-TAW (TAW) was inbound to Ayers Rock from Sydney at flight level (FL) 320. A B737 registered VH-TJY (TJY) departed Ayers Rock for Sydney with a planned level of FL350. The Alice Springs sector controller calculated the estimated time of passing for the aircraft as 1328 Central Standard Time (CST). The controller entered FL310 into The Australian Advanced Air Traffic Control System (TAAATS) for TJY but unintentionally instructed the crew to "Climb to amended FL330". At 1321 CST, after the crew of TAW had reported on the sector frequency, the controller requested them to "Report sighting and passing TJY on climb to FL310". The crew of TAW responded that they would advise. The crew of TJY heard the controller's transmission and queried their assigned level of FL330. The controller advised that crew that they had been assigned FL310. The crew of TJY, having passed FL320, elected to continue the climb and at 1322 CST they reported maintaining FL330. The application of standard separation required the aircraft to be established 1,000 ft vertically apart ten minutes prior to the estimated time of passing. There was an infringement of separation standards.

Reduced vertical separation minimum (RVSM) procedures had been introduced across the Australian airspace on 1 November 2001. Those procedures reduced the previous 2,000 ft vertical separation standard for aircraft operating above FL290 to 1,000 ft for approved aircraft operating between FL290 and FL410. Both aircraft were RVSM approved and the controller had undergone RVSM training prior to the change in procedure.

The controller had seven years experience in air traffic control and was rated on the Alice Springs sector in June 2000. During the 12 months prior to the incident the controller had spent the majority of his time working on that sector. The controller was included on the team leader roster in September 2001.

The Ayers Rock sector position was located in the Melbourne Air Traffic Control centre. Team leaders worked a daily shift from 0830 to 1630 Eastern Summer Time (ESuT). The incident shift was the seventh day of the controller's shift period. After arriving at work the controller, as the team leader, was advised that a rostered controller was unavailable. He unsuccessfully sought approval to call in a replacement controller. The controller then self-briefed and from 0900 to 1030 ESuT operated one of the Group's control positions. The controller had a break during which he endeavoured to resolve the controller shortfall by roster adjustments before returning to another operating position at 1100 ESuT. The controller had scheduled a 1330 ESuT meeting for a project he was working on and organised his periods at the console to ensure that he was able to attend that meeting. He took a second break at 1230 ESuT before taking over the Alice Springs sector position at 1300 ESuT. He reported that he had lunch during one of the breaks when he left the operations room for about 10 minutes.

The controller reported that there was a medium level of air traffic. The Alice Springs sector was combined with the low-level Todd sector. That required the controller to operate on three radio frequencies. There were also several aircraft on frequency with similar callsigns, including aircraft registered: VH-TJY, VH-TJJ, VH-TAW and VH-TJD. Each of those aircraft required separation action or clearance adjustment. It was during that time that the controller made a communication error in that a crew was addressed by an incorrect callsign. That error was undetected but did not affect safety.

The crew of TJY had planned to operate at FL350 and the controller was aware that there was insufficient time to establish the required passing standard. He intended to maintain TJY at FL310 until it had passed TAW. The crew of TJY reported departure from Ayers Rock to the controller at 1311 and shortly after, were cleared to enter controlled airspace "On track to Oodnadatta, and planned route, on climb to amended FL330". The crew read back that clearance. The controller used the cleared flight level field in the aircraft's label on the air situation display to change the level to FL310. Analysis of the recorded system and audio data confirmed that the controller had entered, and accepted, FL310 in TAAATS and had transmitted FL330 to the crew.

Occurrence summary

Investigation number	200105559
Occurrence date	21/11/2001
Location	278 km ESE Alice Springs, (VOR)
Report release date	07/08/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Aviation occurrence category	Loss of separation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	737
Registration	VH-TJY
Serial number	28151
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Ayers Rock, NT
Destination	Sydney, NSW
Damage	Nil

Aircraft details

Manufacturer	The Boeing Company
Model	737
Registration	VH-TAW
Serial number	23488
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Sydney, NSW
Destination	Ayers Rock, NT
Damage	Nil

Abnormal engine indications, Boeing 777, 9V-SRE, Tindal, Northern Territory, on 18 November 2001

Safety Action

Local safety action

As a result of this incident the operator has proceeded to replace all VSV levers of the same manufacture as the failed item.

The engine manufacturer has amended the 'IPC tip bend acceptance criteria' text in the aircraft maintenance manual and issued a revision to service bulletin RB211-72-D516, extending the range of the inspection to include all VSV-1 and VSV-2 levers. The engine manufacturer has also designed a strengthened VSV lever that has been certified for use under service bulletin RB211-72-E042.

RECOMMENDATIONS

As a result of this occurrence the Australian Transport Safety Bureau issues the following safety recommendations:

1. Recommendation R20030002

The Australian Transport Safety Bureau recommends that Rolls-Royce plc revise service bulletin RB211-72-D516 to highlight the potential for cracking failure between the lever and connecting pin of the Variable Stator Vane lever assemblies, and ensure that inspections contained within this service bulletin adequately address this mode of failure.

2. Recommendation R20030003

The Australian Transport Safety Bureau recommends that the United Kingdom Civil Aviation Authority review Rolls Royce plc, Trent 800 engine inspection procedures for the variable stator vane lever assemblies and service bulletin RB211-72-D516, to ensure that they adequately address and manage the potential for cracking failure of the lever assemblies.

Technical Analysis Report

Boeing 777-212ER, 9V-SRE

1. FACTUAL INFORMATION

1.1 Introduction

During a flight from Brisbane to Singapore, the crew of the Boeing 777-212ER aircraft noticed the onset of abnormal vibration levels and several 'thumps' from the right engine. While continuing to monitor the engine, the vibration and thumps recurred and the engine was subsequently shut down after the oil and exhaust gas temperatures rapidly increased. Following a diversion to Darwin, the crew conducted an uneventful single engine landing.

On initial inspection, maintenance personnel found a single fractured first-stage variable stator vane (VSV) control lever (figure 1). Later internal boroscopic inspection of the engine found significant levels of mechanical damage within the intermediate and high-pressure compressor stages.

The fractured lever and a selection of other levers from the first-stage VSV assembly were removed from the engine for examination by the ATSB.

Fig. 1 External view of the stage-one variable stator vane actuator ring and the single fractured lever (arrowed).

1.2 Visual examination and fractography (failed lever)

Initial inspection in the ATSB laboratory found the VSV lever had fractured transversely through the end of the arm section (figure 2), at a location coincident with the riveted connection to the actuator pin. The fracture path followed a uniform arc, extending from one side of the arm to the opposite and intersecting the pin connection at the centre (figure 3).

Fig. 2 Underside of the VSV lever removed from the engine.

Fig. 3 Underside of the VSV lever showing the curved fracture path and the wear mark produced by in-service movement after failure.

A prominent track mark had developed on the underside of the arm where the relative movement between the separated arm and the pin flange had produced appreciable wear. The effects of wear extended to the fracture surfaces themselves, which were heavily eroded and all fracture surface detail obliterated (figures 4 & 5). Apart from the fracture, the arm had sustained little other mechanical damage and showed no evidence of deformation or distortion associated with the failure.

Fig. 4 Arm section fracture surface showing degree of wear and loss of detail.

Fig. 5 Pin section fracture - adjoins the surface shown in figure 4.

On close inspection, the fracture path appeared to intersect the bore of the rivet hole, with slight upward 'dishing' of the arm section beneath the rivet head (figure 6). A clearance or gap was not evident between the pin shaft and the bore of the arm hole through which the pin shaft was riveted.

Fig. 6 Gap between the pin flange and the control arm produced by upward 'dishing' of the arm beneath the rivet head.

The examination did not show any evidence of binding or excessive friction between the actuator pin and the mating bushing, nor did any other component show significant indications of miss-installation or anomalous operation.

Analysis

The soft body damage identified as bending on the IPC stage-2 blades by the boroscope inspection on 8 April 2001, was consistent with that incurred by the engine ingesting a soft bodied object such as a bird or ice. These defects were determined to be within serviceable limits, and as such would not have failed unless additional abnormal forces were applied to them.

There was no evidence of any system faults or additional internal deterioration of the engine after the increase in TGT was detected on 15 October 2001. It is possible that the increase was the result of the number 28 vane moving to the closed position after the lever failed. The nudging of the number 28 vane towards its normal closed position by the number 29 vane during engine shut down may have been enough to allow the failed lever to assume its normal position, thereby escaping easy detection.

The ATSB's technical analysis report determined that the failure of the lever was probably a product of a progressive fatigue cracking mechanism. The observed fracture features suggested that the crack initiation occurred from the connecting-pin, hole.

The bias in the wear mark to one side of the failed lever combined with the contact points evident on the number 28 and 29 vanes indicated that during engine operation, the number 28 vane had remained in a predominantly closed position.

As found with previous VSV lever failures, the out of sequence position of the vane created turbulence in the airflow. This would have been felt on the IPC stage-2 blades inducing abnormal loads. Two of the bent IPC stage-2 blades were unable to tolerate that excitation and as a result their blade tips failed. The released sections of blade then ricocheted within that stage before being projected through the engine, impacting blades in other stages downstream.

As the sections of blade and accumulated debris passed through the engine, a piece of material impacted the leading edge of a HPC stage-1 blade, chipping and cracking it. The crack then progressed to a point where the blade failed and detached.

Although it was possible for the IPC stage-2 blade tips to fail as a result of bird or ice ingestion during the incident flight, the lack of supporting evidence, and the failure mechanism of the HPC blade did not support such an event.

Significant Factors

A number of IPC stage-2 blades were found to be damaged during a borescope inspection on 8 April 2001 but remained in service on the engine.
Fatigue cracking of the VSV-1 lever led to its failure resulting in the closing of the number 28 Variable Stator Vane.
The closure of the number 28 Variable Stator Vane created a disrupted airflow, which acted on the passing blades.

Summary

After departing Brisbane en-route to Singapore, the crew of the Boeing 777-212ER aircraft heard and felt two thumps through the airframe and noticed a severe vibration indication of the right engine. The vibration subsided before re-occurring moments later with an increase in the engine's exhaust gas temperature also indicated. The crew conducted an in-flight engine shutdown and requested Air Traffic Control clearance to divert to Darwin where an uneventful single-engine landing was carried out.

An inspection conducted by ground engineers at Darwin found a stage-1, variable stator vane (VSV) control lever broken on the right engine. A borescope inspection of the engine interior was then carried out with a number of compressor blades found damaged. The engine was removed from the aircraft and sent to an overhaul facility for disassembly and evaluation.

Engine description

The Rolls-Royce Trent 800 was a triple spool turbofan engine. Its construction consisted of a single-stage low pressure fan connected to a five-stage low pressure turbine. An eight-stage intermediate pressure compressor (IPC) connected to a single stage intermediate pressure turbine and a six-stage high pressure compressor (HPC) connected to a single-stage high pressure turbine (see fig 1).

To maintain maximum efficiency during all power settings, the airflow through the engine needed to be controlled to prevent stalling or surging. This was achieved by a single stage of variable inlet guide vanes installed between the fan and the first stage of the IPC and two stages of variable stator vanes, VSV stage 1 and VSV stage 2 (VSV-1 and VSV-2) installed between IPC stages, one/two and two/three respectively. Each Variable Stator Vane was attached to a lever that transferred the linear input from the controlling actuators and unison rings to a rotational movement of the vane (see fig 2). These levers consisted of an arm and connecting pin (see fig 3).

During engine start, these vanes would have been in their most closed position with internal engine bleed valves open. As the power was increased, the bleed valves would close and the vanes move toward their full open position allowing optimum airflow through the engine.

Post incident engine inspection

Prior to disassembly, the engine's exterior was inspected with the broken VSV-1 lever identified as being in the number 28 position. No evidence was observed of bird impact or other external defects. Rigging and clearance checks of the VSV control system were carried out with no anomalies found. The remaining VSV-1 and VSV-2 levers were then removed and crack tested using a dye penetrant inspection. No evidence of cracking was found on any of those levers.

After separating the engine-to-modular level, the IPC and HPC modules were completely disassembled for a detailed inspection.

IPC inspection

Removal of the IPC casing revealed six stage-2 blades displaying soft body impact damage¹ resulting in bending of the blades. On two of those blades the corners had also detached. Three other blades displayed hard body impact damage² with cuts and nicks (small cuts) on their surfaces. Two blades with minor nicks were found in stage 3, with only one blade in stage 5 showing nick damage. All of the stage-8 blades displayed hard body impact damage on their trailing edges, a few blades also having nicks on their leading edges. There was no evidence of damage to the disc material adjacent to the blade roots on any of the eight stages.

The IPC case lining was examined with only minor damage evident. The number 28 VSV 1 vane, had a wear mark on the leading edge lower corner with a noticeable worn stepped area on its horizontal surface above its base. The adjacent number 29 vane had a contact mark at a point mid span on the vane and one on its base. The remaining VSV-1 and all the VSV-2 vanes were found to be undamaged. Dark deposits were evident around the base of each VSV. These deposits formed a black ringed area around all except for the number 28 vane where the mark was crescent shaped.

When the number 28 and 29 vanes were positioned so that the wear marks on both vanes aligned, the number 29 vane was found to be in its normal full open position while the number 28 vane was noted as sitting beyond its normal closed position. The dark crescent area around the base of the number 28 vane also coincided with the angle of the vane's root. When the number 29 vane was moved to the closed position it was seen to nudge the number 28 vane up towards its normal closed position.

¹ Having been impacted by an object made from a softer material than the blade itself.
² Having been impacted by an object made from the same or harder material than the blade itself.

Failed VSV-1 lever

The Australian Transport Safety Bureau (ATSB) conducted a metallurgical examination of the failed number 28, VSV-1 lever (see fig 3). The examination found that:

'The lever had fractured transversely through the end of the arm section, at a location coincident with the riveted connection to the actuator pin. The fracture path followed a uniform arc, extending from one side of the arm to the opposite and intersecting the pin connection at the centre. A prominent track mark had developed on the underside of the arm where the relative movement between the separated arm and the pin flange had produced appreciable wear. On close inspection, the fracture path appeared to intersect the bore of the rivet hole with a slight upward 'dishing' of the arm section beneath the rivet head'.

The examination also determined that:

'During riveting, the expansion of the rivet shaft could induce tensile stresses within the bore of the rivet hole if the diameter was insufficient to allow for the expansion. Tensile stresses of this nature would be expected to predispose the lever arm to the initiation and propagation of fatigue cracking'.

The examination of a further four VSV-1 levers was conducted, with welding and partial fusion between the lever and connecting pin evident, and varying degrees of cracking also evident on all four levers. For the full technical report refer to attachment A.

A further investigation by the engine manufacturer, identified the presence of a double-sided chamfer to the lever holes on a small number of levers. This removal of material during the lever manufacture may have led to the overheating and partial welding of the lever material during the rivet forming.

HPC inspection

In the HPC, all of the stage-1 blades displayed severe hard body impact damage with one blade found to have failed, detaching above the blade root. Stages 2 to 6 showed hard body impact damage to varying degrees on all the blades.

Close examination of the failed HPC stage-1 blade, found a chipped area in the leading edge, with the fracture surface revealing a number of crack progression marks indicating that the failure was progressive over a number of cycles and not instantaneous. The exact number of cycles required to fail the blade could not be determined (see fig 4).

Engine history

The engine commenced service in December 1998 and had completed a total of 8923 hours and 2373 cycles at the time of this incident. Its service history showed that on 8 April 2001, a routine borescope inspection detected damage to a number of IPC stage 2 blades in the form of bending and curling to their tips. This damage was assessed to be within the manufacturer's allowable limits so the engine remained in service. On 17 October 2001, a substantial shift in the turbine gas temperature (TGT) was detected giving a warning that the engine's efficiency had deteriorated significantly. A borescope inspection was carried out on the engine with only the previously recorded IPC stage-2 bent blade damage found. No other damage was observed on the engine. Checks of the air system, engine bleed air and monitoring systems were carried out, however the reason for the TGT shift could not be determined.

Previous VSV lever failures

Although the manufacturer had not experienced previous failures of VSV-1 levers, failures of VSV-2 levers had been recorded on two separate occasion. On those occasions the connecting pin's had fretted through the body of the lever due to inadequate riveting during the manufacturing process. The result of the levers failing was the closure of their associated variable stator vanes, which created a disruption to the airflow behind them. The vibration subsequently experienced by the blades passing the area resulted in fragments of disc material breaking off and migrating through the engine, damaging blades further downstream. These failures were indicated by a progressive increase in the engine's TGT over periods of 2 to 4 weeks.

The manufacturer issued a service bulletin, RB211-72-D516 to all operators recommending an inspection of, 'the six VSV-1 and VSV-2 levers either side of the actuating mechanism control rod connection, for significant relative movement between the lever and connecting pin'.

Occurrence summary

Investigation number	200105494
Occurrence date	18/11/2001
Location	Tindal
State	Northern Territory
Report release date	18/03/2003
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Aviation occurrence category	Abnormal engine indications
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	777
Registration	9V-SRE
Serial number	226
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Brisbane, Qld
Destination	Singapore
Damage	Nil

Boeing 767-338ER, VH-OGN

Safety Action

As a result of this occurrence, the operator raised an Engineering Instruction (EI), EI-767-032-0102 Rev 0, to immediately inspect all B767 MLG shock strut doors and check the torque values of the door attaching hardware. All of the operator's B767 aircraft were subsequently checked between 23 November 2001 and 8 December 2001. The inspection revealed that a number of MLG shock strut door mounting bolts were found to be below the required Aircraft Maintenance Manual (AMM) torque value and were retorqued to the correct value. As a result of the EI inspection, the operator subsequently issued a revised EI (EI-767-032-0102 Rev 1) requiring that the inspection be conducted on a regular basis; every 3 months.

As a result of reports of loose or fractured MLG shock strut door attach bolts, the aircraft manufacturer developed an engineering change to prevent the MLG shock strut door attach bolts from loosening and indicated that a Service Bulletin to incorporate those changes would be released in the second quarter of 2002.

As there have been two similar events on Australian registered aircraft, The Australian Transport Safety Bureau will continue to monitor actions relating to B767 MLG shock strut door separation occurrences pending the release of the Service Bulletin.

Summary

During the approach, and while below the maximum limit speed of 270 Kts, the flight crew of the Boeing 767 aircraft lowered the landing gear to assist in speed reduction. After a normal landing at Darwin, the crew was informed by a maintenance engineer that the right main landing gear (MLG) strut door had separated from the aircraft. Although an extensive search was conducted by the operator's maintenance staff, the separated door and some attachment fittings were not recovered.

A subsequent examination of the remaining MLG shock strut door attachment fittings revealed that they all showed fractures characteristic of rapid overloading, and were damaged as a result of the door separation but had not contributed to the initial failure sequence.

The aircraft manufacturer issued a Fleet Team Digest (767-FTD-52-01005, revised 21 Nov 2001), referring to Service Bulletin (SB) 767-32A0051, revision 3, dated 27 Mar 1997. The Digest indicated that the manufacturer had received reports of loose or fractured MLG shock strut door attach bolts and that they had "identified details in the MLG door attach joint assembly that can lead to bolt preload loss." The Digest also indicated that operators may wish to inspect the applicable MLG shock strut door attachment joints for looseness. Looseness or premature failure of MLG shock strut door attach bolts could have lead to the loss of the door from the aircraft.

A similar event occurred to an Australian registered B767 aircraft, VH-NOA, on 26 August 2000, during approach to Amsterdam airport in the Netherlands. The Dutch Transport Safety Board is investigating this occurrence.

Occurrence summary

Investigation number	200105518
Occurrence date	20/11/2001
Location	2 km ESE Howard Springs, Locator
State	Northern Territory
Report release date	05/03/2002
Report status	Final
Investigation type	Occurrence Investigation
Investigation status	Completed
Mode of transport	Aviation
Occurrence class	Incident
Highest injury level	None

Aircraft details

Manufacturer	The Boeing Company
Model	767
Registration	VH-OGN
Serial number	25576
Sector	Jet
Operation type	Air Transport High Capacity
Departure point	Cairns, QLD
Destination	Darwin, NT
Damage	Minor

Subscribe to