History of the flight

Approximately eight minutes into a regular passenger transport flight from Melbourne to Sydney, while the Boeing 767 aircraft was climbing through flight level 160, the crew and passengers heard a loud bang and felt severe vibration throughout the airframe. Engine indication and crew alerting system (EICAS) messages on the flight deck indicated the left (number-one) engine had no N1 turbine rotation and an elevated exhaust gas temperature. After discontinuing the climb and advising air traffic services (ATS), the flight crew actioned the 'engine fire, severe damage and separation' checklist and advised the cabin crew and passengers of the engine failure and the intention to return to Melbourne. Several aircraft crewmembers that were passengers aboard the flight advised the flight crew (via the cabin services manager) that the left engine had lost a fan blade and that it had perforated the engine cowling. The flight crew made a PAN radio call to ATS and requested emergency services be placed on local stand-by. After configuring the aircraft for a single-engine approach and landing, some adjustment of the airspeed was required to minimise the level of vibration from the failed engine. The aircraft landed safely on Melbourne airport runway 27, eighteen minutes after the engine had failed and twenty-six minutes after departure.

After exiting the runway, the aircraft was stopped and airport rescue and fire-fighting services carried out a safety inspection before allowing the aircraft to taxi to the terminal buildings using thrust from its remaining serviceable engine. Following passenger disembarkation, the flight crew conducted an operational debriefing with the cabin crew.

Injuries to persons

Damage to the aircraft

Damage to the aircraft was limited to the left engine assembly and nacelle. While multiple punctures of the engine nose cowling indicated the liberation of debris from the confines of the intake area, none of this debris had struck the wing, fuselage or tailplane of the aircraft.

Failure of the Pratt & Whitney JT9D-7R4 engine (serial number P-716610) fitted to the aircraft was attributed directly to the fracture and release of the outer half of a single low-pressure compressor (fan) blade (part number 5001341-22, serial number ND9278).

Liberation of the blade segment caused appreciable damage to the remaining fan blades and extensive damage to the intake linings. Ancillary damage to the engine included distortion of the fan casing, loss of the fan speed (N1) sensor and the overload failure of several nose-cowl bolts. Although the primary impact of the released blade with the fan casing had resulted in the segment being contained, the subsequent forward movement of the blade allowed it to impact the nose-cowling with sufficient energy to puncture the cowl wall and escape the engine intake. The initial impact with the cowl occurred at the two-o'clock position (looking forward), with the blade segment passing through the cowl with a tangential trajectory, exiting at around the three-o'clock position. From the impact point and angle, it was evident that the blade segment had been ejected downward and beneath the aircraft. Other debris liberated through the nose cowl or fairings included the N1 sensor and one of the nose cowl lip bolts. Both components were located adjacent to the initial blade impact point and thus were likely to have been subject to a very large reactive force as the blade segment struck the fan case. Figures one to four illustrate the trajectory followed by the released blade segment and the fan case components that perforated the engine cowling.

Aircraft information

Engine information

The subject engine (serial number P-716610) had been installed on VH-EAQ since October 2001 and had operated for 319 hours and through 200 cycles while fitted to the aircraft. Pratt & Whitney first purchased the engine for leasing in 1998 and, since that time, it had been installed on several different aircraft from different airlines. At the time of failure, the engine had operated for a total of 26,138 hours and through approximately 8,900 cycles.

The failed fan blade (part number 5001341-22, serial number ND9278) was fitted to the engine in August 1998. Before this, the blade had been held as a stock component since its repair and refurbishment in 1991. Work done on the blade at that time included two elevated-temperature straightening operations, where the blade was heated to 650 degrees Celsius and the aerofoil shape re-formed. The manufacturer's records indicated a subsequent blade service life of 7,187 hours and 2,083 cycles. The total time and cycles accumulated by the blade since manufacture was unknown.

Blade inspection

Various non-destructive inspections had been carried out on the blade since overhaul, including eddy current inspections after the thermal straightening operations and periodic visual inspections of the blade while in operational service. Prior to installation on VH-EAQ, the engine underwent a foreign object damage inspection (conducted every 200 cycles) and an eddy current inspection of the leading edge (conducted by the operator every 350 hours). No further inspections had been performed or were required at the time of failure. The requirements and frequency of these on-wing inspections were specified in the aircraft manufacturer's maintenance manual (B767-72-31-02/601) and in Pratt & Whitney service bulletin SB 72-255. At the time of the failure, these documents contained no requirement to carry out a periodic eddy current inspection of the blade trailing edges while the engine was in-service. SB 72-255 stated that 'Eddy current inspection may be used as an option at the operator's discretion'.

After the 1991 refurbishment work, the manufacturer's records indicated that the failed blade was inspected to the engine manual requirements using a single-pass eddy current technique. The eddy current procedure was specified as having the capability to detect crack-like defects as shallow as 0.25mm (0.010") along the blade edges. No defects were detected as a result of this procedure and the blade was subsequently accepted for service.

Cabin aspects

The cabin services manager (CSM) reported the initial engine failure event as "like hitting a brick wall; obviously not turbulence". The CSM described a noisy, high level vibration throughout the cabin, causing some unsteadiness to the crew standing in the cabin service areas. After the vibration had abated, the crew commenced securing the cabin and awaited instruction from the flight deck. Several aircraft crewmembers travelling as passengers reported damage to the left engine nacelle to members of the cabin crew. The CSM passed those observations on to the flight crew. The CSM reported no adverse passenger reactions during the event or during the subsequent return to Melbourne.

Flight recorder

The aircraft was fitted with an L3 Communications (LORAL) model FA2100 solid-state flight data recorder (SSFDR). An excerpt of the data from the recorder containing information from the previous flight and the incident flight was obtained by the ATSB. That data was analysed by the ATSB and used to prepare a summary of events and actions during the incident flight.

The FDR information indicated that the left engine failed at 00:19:59UTC (11:19:59 Eastern Summer Time) and was characterised by a sudden increase in the engine broadband vibration and a decrease in the engine pressure ratio (EPR). At that time, the aircraft was climbing through an altitude of 16,134 feet and maintaining 311 knots airspeed. Both left and right engines were operating at an N1 speed of approximately 94 percent. Vibration levels peaked around two seconds following the initial event and the engine exhaust gas temperature (EGT) peaked at 633 degrees C, six seconds after.

Within the next fourteen seconds, the flight crew had retarded the left engine thrust lever, disengaged the auto-throttle and move the left engine fuel cut-off lever to the OFF position. The left engine fire switch was pulled at 00:21:47, however neither fire bottle was discharged. All actions taken were as documented in the 'Engine fire, severe damage or separation' section of the B767-238 quick reference handbook.

Comparison of the engine broadband vibration levels found no specific differences between the incident flight (before the failure) and the previous flight. Examination of the graphically presented information showed that at approximately twenty seconds before the major vibration transient associated with the fan blade release, a smaller transient occurred in the base vibration levels (figure 5). Short-term escalations in engine vibration levels are anomalous and often indicative of transient events such as compressor aerofoil stalls and surges or foreign object ingestion.

Tests and research

The ATSB examined the released blade segment, assisted by authorised representatives from Pratt & Whitney.

Liberation of the fan blade segment occurred as a direct result of fatigue cracking developing within the trailing edge of the blade aerofoil section. A single transverse high-cycle fatigue crack had developed from a 0.6mm deep pre-existing defect at the blade trailing edge, approximately 290 millimetres above the root face. Multiple surface arrest marks indicated to the growth of the cracking over multiple flight cycles. Final tensile overload of the remaining cross-section released the outer blade section after the fatigue crack had grown to a length of approximately 85 millimetres.

The characteristics of the defect at the fatigue origin identified it as a crack-like feature formed under localised tensile loads. Heat tinting of the defect surfaces indicated the exposure of the region to the elevated temperatures associated with the blade overhaul. The implication from this was that the defect was either present before the overhaul or was produced by the overhaul operations. The defect location was within an area of repair blending at the blade trailing edge. While the blending had reduced the chord-wise width of the blade to one millimetre below the specified minimum limit, it was not considered to have significantly contributed to the development of fatigue cracking from the trailing edge defect. Non-destructive testing procedures carried out following the blade re-work had failed to detect the trailing edge defect before the blade was re-introduced into service within engine P-716610.

A copy of Technical Analysis report number 9/02 detailing the examination of the failed blade is available from the bureau on request.

1. A small crack-like defect remained within the trailing edge of a first-stage low-pressure compressor (fan) blade after the component had undergone overhaul operations in 1991.
2. Post-overhaul non-destructive inspection procedures conducted on the blade edges failed to detect the defect and the blade was placed in storage until 1998, when it was installed into engine P-716610.
3. Because of its small size, the trailing edge defect was not detectable by the in-service visual inspections required by the manufacturer and carried out by the various engine operators (SB 72-255).
4. An optional eddy-current inspection of the blade by the last operator was capable of detecting the defect, but was not performed (nor required to be performed) along the blade trailing edge.
5. Fatigue cracking initiated and propagated from the trailing edge defect in response to vibratory and centrifugal operating loads.
6. Fracture of the fan blade occurred after growth of the fatigue cracking to critical size.
7. The left engine of the aircraft failed after the fracture and liberation of the blade segment during climb to cruising altitude.

Engine failure

Failure of the left engine from VH-EAQ occurred as a result of the fracture and liberation of approximately two-thirds of the length of a single first-stage low-pressure compressor (fan) blade. The loss of the blade section produced a significant imbalance in the fan rotor, which manifested as severe vibration of the airframe and produced heavy tip rub on the remaining blades against the fan case lining. The flight crew's subsequent observations of a high exhaust gas temperature indicated the development of anomalous combustion conditions within the engine because of the airflow interruptions produced by the fan failure.

Blade loss

Rotor kinematic laws predict that the partial loss of a fan blade will result in the fragment striking the fan case, before folding flat and moving forward from the plane of rotation with a helical motion. This motion will continue until the fragment either perforates the intake cowling forward of the fan case, exits the front of the intake cowling, or is drawn back into and re-ingested by the fan rotor. In this case, damage to the intake (nose) cowling indicated the loss of the blade section soon after liberation, with comparatively little other damage to the remaining blades. Measurements of the damage to the intake cowling indicated the blade exited the cowling with a forward and downward trajectory, sufficient to take it away from the aircraft without impacting any other part of the structure.

The radial forces transferred to the fan case by the initial impact of the blade segment were sufficient to break away several of the nose cowl bolts, one of which punctured the inboard fan case cowl. The fan speed (N1) sensor was also lost in a similar manner. Neither of these components had damaged the aircraft after exiting the engine nacelle.

Blade failure

Laboratory examination of the blade fracture surface confirmed the presence of a pre-existing trailing edge defect, from which high-cycle fatigue cracking initiated and propagated. The examination identified the defect was either produced by, or was present before the last major blade refurbishment operation incorporating an elevated temperature straightening operation. The size and nature of the defect was such that it should have been detectable by non-destructive means following the blade refurbishment operations. The engine manufacturer stated that the eddy-current method specified for this inspection had the capability to detect defects well below the size of the actual defect present. In this regard therefore, error by the inspecting technician was the most likely factor contributing to the failure to detect the defect.

Pratt & Whitney service bulletin SB 72-255 was the core document that specified the requirements for the periodic in-service inspection of the engine low-pressure compressor blades. The objective of that service bulletin was to provide opportunities for the early discovery and repair of foreign object damage, thereby reducing the potential for foreign object damage induced blade failures. The bulletin required the visual inspection of the fan blade assemblies and the blend repair of all leading edge damage found, with eddy current inspection included as an option at the operator's discretion. In this case however, visual inspection alone would have likely proved unsuccessful in detecting the defect at the origin of fatigue cracking, due to the small defect size and the absence of any associated foreign object damage.

In the current engine operator's case, an eddy current technique was used to complement the visual inspection, however this was a limited survey and did not extend to the examination of the blade trailing edges. It was not known whether any of the previous engine operators had used an eddy current inspection as part of their compliance with SB 72-255.

Continuing airworthiness

The US Federal Aviation Administration has published a draft advisory circular that provides a mechanism for the assessment of the continued airworthiness of powerplants and auxiliary power units on transport category aircraft (AC39-XX). The advisory circular describes the Continued Airworthiness Assessment Methodologies (CAAM) and uses them to identify unsafe conditions, before prescribing corrective actions in accordance with the Federal Aviation Regulations (FAR) part 39.

The CAAM recognise uncontained engine blade failures as an 'historically unsafe condition' and as such, require that an appropriate response be determined and carried out. In this case, the unsafe condition may be more specifically defined as the presence of undetected defects within the blade trailing edges, from which uncontained failure may result. Following from this, aircraft exposed to this unsafe condition are defined as those aircraft fitted with engines carrying defective fan blades. In the context of this occurrence, the assessment of the level of exposure (ie. number of aircraft) can only be determined by the inspection of each blade currently in service, to determine the presence or otherwise of the defect/s. Minimisation of the risk is achieved by the subsequent removal of all blades found to contain defects.

This action is proposed by the engine manufacturer and is detailed within section 4 of this report (Safety Action).

During the early stages of a regular passenger transport flight between Melbourne and Sydney, Boeing 767 aircraft, registration VH-EAQ, sustained the failure of the left engine, necessitating a return to Melbourne airport. The turn-back and subsequent single-engine landing was uneventful.

Failure of the left engine resulted from the liberation of the outer-most half of a single first-stage compressor (fan) blade. The fan casing had contained the initial blade impact, however subsequent forward movement of the segment allowed it to strike and penetrate the engine intake (nose) cowling. Other small components had also penetrated the inboard fan case cowl. Inspections found no evidence that any of the released debris had damaged the aircraft structure outside of the engine nacelle.

Laboratory examination of the section of failed blade remaining within the fan rotor found that the fracture had occurred from high-cycle fatigue cracking that initiated from a pre-existing defect at the blade trailing edge. This crack-like defect showed evidence of having formed during or before the blade was last overhauled in 1991 and had remained undetected during post-overhaul non-destructive testing inspections. The manufacturer fitted the blade to the subject engine in 1998 and it remained in service until the failure, accumulating 7,187 hours and 2,083 cycles since overhaul.

The engine manufacturer attributed the failure to detect the original fan blade defect to procedural deficiencies and operator error during inspection. In response to previous blade failures, the manufacturer amended the engine manuals to incorporate a number of improvements aimed at increasing the probability of defect detection. The failed blade in this occurrence had been inspected before the engine manual changes. The engine manufacturer has also issued an all-operator communication recommending that any blades last inspected before the engine manual changes should be re-inspected to the latest requirements.

(Damage confined to number one engine and cowling. Loss of single fan blade produced multiple punctures of nose cowling and smaller preforations in fan case cowling. Extensive impact damage to remaining fan blades and cowl linings.)

On 11 November 2005 a further investigation under section 19DF of the Air Navigation Act 1920 was commenced into aspects of this accident. This investigation has been completed and a supplementary report 200507077 has been released and is available on the website.

It was likely that the controller was distracted by thoughts of the pending meeting. He may also have been fatigued to some degree as he had been occupied with either operational or administrative tasks since commencing work and had not had an adequate rest period.

It is possible that the controller did not appreciate the error, because the read back by the pilot phonologically matched the information stored in the controller's short-term memory. The controller had issued a clearance of FL330 to the crew and this was the same flight level that was read back.

The aviation system relied on the instruction and readback cycle used by pilots and controllers to prevent misunderstanding. The nature of interacting with TAAATS can make the controller response to the clearance read back an automatic process that provides no clue to input errors. While the read back process used two parties, a pilot and a controller, to challenge and check each other, the data input to TAAATS was reliant on controller self-checking. The occurrence highlighted the limitations inherent in using individuals to check their own work. Controllers need to be aware of the potential for error when checking TAAATS data inputs against clearance read backs.

The situational awareness of the crew of TJY, and their query regarding the assigned flight level, ensured that the situation was clarified and safety was maintained.

A Boeing 737 (B737) registered VH-TAW (TAW) was inbound to Ayers Rock from Sydney at flight level (FL) 320. A B737 registered VH-TJY (TJY) departed Ayers Rock for Sydney with a planned level of FL350. The Alice Springs sector controller calculated the estimated time of passing for the aircraft as 1328 Central Standard Time (CST). The controller entered FL310 into The Australian Advanced Air Traffic Control System (TAAATS) for TJY but unintentionally instructed the crew to "Climb to amended FL330". At 1321 CST, after the crew of TAW had reported on the sector frequency, the controller requested them to "Report sighting and passing TJY on climb to FL310". The crew of TAW responded that they would advise. The crew of TJY heard the controller's transmission and queried their assigned level of FL330. The controller advised that crew that they had been assigned FL310. The crew of TJY, having passed FL320, elected to continue the climb and at 1322 CST they reported maintaining FL330. The application of standard separation required the aircraft to be established 1,000 ft vertically apart ten minutes prior to the estimated time of passing. There was an infringement of separation standards.

Reduced vertical separation minimum (RVSM) procedures had been introduced across the Australian airspace on 1 November 2001. Those procedures reduced the previous 2,000 ft vertical separation standard for aircraft operating above FL290 to 1,000 ft for approved aircraft operating between FL290 and FL410. Both aircraft were RVSM approved and the controller had undergone RVSM training prior to the change in procedure.

The controller had seven years experience in air traffic control and was rated on the Alice Springs sector in June 2000. During the 12 months prior to the incident the controller had spent the majority of his time working on that sector. The controller was included on the team leader roster in September 2001.

The Ayers Rock sector position was located in the Melbourne Air Traffic Control centre. Team leaders worked a daily shift from 0830 to 1630 Eastern Summer Time (ESuT). The incident shift was the seventh day of the controller's shift period. After arriving at work the controller, as the team leader, was advised that a rostered controller was unavailable. He unsuccessfully sought approval to call in a replacement controller. The controller then self-briefed and from 0900 to 1030 ESuT operated one of the Group's control positions. The controller had a break during which he endeavoured to resolve the controller shortfall by roster adjustments before returning to another operating position at 1100 ESuT. The controller had scheduled a 1330 ESuT meeting for a project he was working on and organised his periods at the console to ensure that he was able to attend that meeting. He took a second break at 1230 ESuT before taking over the Alice Springs sector position at 1300 ESuT. He reported that he had lunch during one of the breaks when he left the operations room for about 10 minutes.

The controller reported that there was a medium level of air traffic. The Alice Springs sector was combined with the low-level Todd sector. That required the controller to operate on three radio frequencies. There were also several aircraft on frequency with similar callsigns, including aircraft registered: VH-TJY, VH-TJJ, VH-TAW and VH-TJD. Each of those aircraft required separation action or clearance adjustment. It was during that time that the controller made a communication error in that a crew was addressed by an incorrect callsign. That error was undetected but did not affect safety.

The crew of TJY had planned to operate at FL350 and the controller was aware that there was insufficient time to establish the required passing standard. He intended to maintain TJY at FL310 until it had passed TAW. The crew of TJY reported departure from Ayers Rock to the controller at 1311 and shortly after, were cleared to enter controlled airspace "On track to Oodnadatta, and planned route, on climb to amended FL330". The crew read back that clearance. The controller used the cleared flight level field in the aircraft's label on the air situation display to change the level to FL310. Analysis of the recorded system and audio data confirmed that the controller had entered, and accepted, FL310 in TAAATS and had transmitted FL330 to the crew.

Boeing 777-212ER, 9V-SRE

1. FACTUAL INFORMATION

1.1 Introduction

During a flight from Brisbane to Singapore, the crew of the Boeing 777-212ER aircraft noticed the onset of abnormal vibration levels and several 'thumps' from the right engine. While continuing to monitor the engine, the vibration and thumps recurred and the engine was subsequently shut down after the oil and exhaust gas temperatures rapidly increased. Following a diversion to Darwin, the crew conducted an uneventful single engine landing.

On initial inspection, maintenance personnel found a single fractured first-stage variable stator vane (VSV) control lever (figure 1). Later internal boroscopic inspection of the engine found significant levels of mechanical damage within the intermediate and high-pressure compressor stages.

The fractured lever and a selection of other levers from the first-stage VSV assembly were removed from the engine for examination by the ATSB.

Fig. 1 External view of the stage-one variable stator vane actuator ring and the single fractured lever (arrowed).

1.2 Visual examination and fractography (failed lever)

Initial inspection in the ATSB laboratory found the VSV lever had fractured transversely through the end of the arm section (figure 2), at a location coincident with the riveted connection to the actuator pin. The fracture path followed a uniform arc, extending from one side of the arm to the opposite and intersecting the pin connection at the centre (figure 3).

Fig. 2 Underside of the VSV lever removed from the engine.

Fig. 3 Underside of the VSV lever showing the curved fracture path and the wear mark produced by in-service movement after failure.

A prominent track mark had developed on the underside of the arm where the relative movement between the separated arm and the pin flange had produced appreciable wear. The effects of wear extended to the fracture surfaces themselves, which were heavily eroded and all fracture surface detail obliterated (figures 4 & 5). Apart from the fracture, the arm had sustained little other mechanical damage and showed no evidence of deformation or distortion associated with the failure.

Fig. 4 Arm section fracture surface showing degree of wear and loss of detail.

Fig. 5 Pin section fracture - adjoins the surface shown in figure 4.

On close inspection, the fracture path appeared to intersect the bore of the rivet hole, with slight upward 'dishing' of the arm section beneath the rivet head (figure 6). A clearance or gap was not evident between the pin shaft and the bore of the arm hole through which the pin shaft was riveted.

Fig. 6 Gap between the pin flange and the control arm produced by upward 'dishing' of the arm beneath the rivet head.

The examination did not show any evidence of binding or excessive friction between the actuator pin and the mating bushing, nor did any other component show significant indications of miss-installation or anomalous operation.

1. A number of IPC stage-2 blades were found to be damaged during a borescope inspection on 8 April 2001 but remained in service on the engine.
2. Fatigue cracking of the VSV-1 lever led to its failure resulting in the closing of the number 28 Variable Stator Vane.
3. The closure of the number 28 Variable Stator Vane created a disrupted airflow, which acted on the passing blades.

Fuel quantity calibration and indication

Although the aircraft fuel gauges differed between left and right tanks for a given scale marking, this was compensated for by having a calibration correction card fitted to the aircraft. It is not uncommon to have such discrepancies between multiple gauges in the same aircraft and should not have been a factor in this accident.

As a back up measure the aircraft also carried a dipstick, which was usually locally manufactured by the maintenance organisation. It could be used by the pilot to verify the actual fuel quantity on board before or between flights. The dipstick found at the crash site, although not calibrated specifically for the accident aircraft, should have given a reliable enough reading to alert the pilot to the 80L discrepancy in the fuel quantity on board; if it had been used. Passengers did not see the pilot verify the fuel quantities at Rawlinna, either visually or by using the dipstick. It could not be determined if the pilot verified the actual fuel quantity on board, visually or by dipstick prior to departing Kalgoorlie but, considering the incorrect trip log annotation of 160L in each tank, it is unlikely that he did.

The fuel that rescuers observed leaking onto the front seat occupant and which had pooled under the aircraft, probably came from the disrupted fuel lines around the fuel tank selector in the first instance and later augmented by the right door pillar supply line from the right tank that was severed during the rescue. As the residual fuel in the left tank was not able to feed to the fuel selector supply lines, the fuel remaining in the left tank only approximated to the unusable amount, as published in the POH, for that tank.

The selected position of the yellow segment of the auxiliary fuel pump switch as observed at the accident site, was consistent with emergency checklist action following an inflight engine power loss or vapour purge.

The fuel selector was found selected to the right tank. The fuel pump switch and fuel selector position observations were considered in conjunction with the pilot's trip log notes showing that the flight immediately prior to the power loss was conducted on the left tank. If the pilot had conducted the emergency checklist actions, as seems likely based on the auxiliary fuel pump switch selection, then he had selected the fuel selector to the opposite tank. The evidence was consistent with a power loss while operating from the left fuel tank and a probable attempted engine re-start after changing fuel tank selection to the right tank.

In flight engine restart

The radio call made by the pilot gave the aircraft height of about 800ft above ground level (AGL) at the time the engine lost power. This would have provided gliding time of approximately one minute in the flaps up configuration recommended by the POH; and used by the pilot. This short interval after the engine power loss may have been insufficient for the pilot to successfully complete an in-flight engine re-start drill.

Fuel tank exhaustion - fuel supply starvation

The aircraft fuel usage annotations recorded in the trip fuel log by the pilot showed that he had started his fuel calculations with 80L more fuel than was on-board. The annotations also showed that the left tank had been used for taxi and take off on both flight sectors that day. Take-offs were the periods of highest fuel demand by the engine and in accordance with the POH, should have been conducted from the fullest tank. The trip fuel log showed that, on departure from Rawlinna, the right tank contained the most fuel and, therefore, should have been used for that take off.

Whether prolonged taxi or extended use of climb power using the left tank took place could not be verified and the possibility of additional fuel usage from the left tank during these periods could not be ruled out.

The pilot's fuel usage annotations showed that he calculated the aircraft had used approximately 69L from the left tank and 70L from the right tank in total for both sectors that day, up to the last hand written entry for the fuel tank selection change at 1345. Using the operator's average fuel consumption figure for this aircraft, a further 28L needed to be used from the left tank by the time that the engine lost power; approximately 1413. If the tank selections were correctly carried out as annotated by the pilot, the total fuel burn from the left tank would have been around 97L, which should have left approximately 23L remaining in that tank. The tank was observed, at the accident site, to contain approximately half a litre of (unusable) fuel. It could not be positively determined why only unusable fuel remained in the left fuel tank.

The previous accident in 1995 demonstrated, that on at least one other occasion, this aircraft's left fuel tank contents could be exhausted after one hour and 40 minutes of operation from a `tabs level' fuel quantity. Flight time of the Kalgoorlie accident flight, while operating on fuel supplied only from the left tank, was estimated to have totalled approximately one hour and 37 minutes. It was therefore possible that the contents of the left tank may have also been exhausted on the Kalgoorlie, Rawlinna, Kalgoorlie flight in this period of time.

Operations with low-fuel quantity

The trip fuel log revealed that the pilot would have expected to have 40L more fuel remaining in each tank at the time the engine lost power. Consequently, he may not have considered a low fuel state as a possible cause for the engine power loss.

Flying in turbulence with a low fuel state can also lead to uncovering of the fuel outlets in the fuel tanks. If the pilot had correctly carried out the tank changes noted in the trip log, the left tank should have had approximately 23L of fuel remaining when the engine lost power; which equated to about an eighth of a tank. If such a quantity was present in the reported turbulent conditions, then the possibility of unporting the fuel outlets could not be ruled out.

Summary

The low fuel-state of the left tank alone, or in combination with the forecast turbulence, probably caused the engine to lose power.

In the absence of evidence of a mechanical failure leading to engine loss of power, the most likely cause of the engine loss of power was associated with fuel supply starvation or exhaustion.

The presence of a vehicle on the road appeared to have caused the pilot to initiate a sudden pull back on the flight controls that led to a loss of control and subsequent impact with the ground.

As a result of the occurrence, the B767 operator immediately replaced the aerodrome charts in the applicable aircraft with charts printed in a larger format. In addition, a briefing note was issued to crews in order to highlight the problem and to minimise the likelihood of a recurrence.

The on-board recorders showed that the highest cabin altitude captured was 8553 feet with a subsequent continuous decrease in cabin altitude recorded prior to the loss of the system data. The cabin altitude did not reach the required height for supplementary oxygen which was consistent with the reported lack of oxygen flow through the passenger drop masks after they had deployed.

The operation of the pressure relief valve indicated that an over-pressurisation condition had been experienced in the cabin. This was most likely due to the manual closing of the outflow valves by the flight crew while the aircraft was continuing to be pressurised by the controlling CPC. The resultant rate of change of cabin pressure may have contributed to the reported injury sustained by a passenger.

The concern at the lack of oxygen flow through the masks led to some cabin crew moving from their seated position to obtain portable oxygen, or to assist passengers during the emergency descent.

Extensive research has shown that the effect of oxygen deprivation can be insidious and, as such, cabin crew may not be the best judges of their own oxygen intake. Although the cabin altitude may not have been high enough to require supplemental oxygen, that information was not available to the cabin crew at the time. As the cabin crew were unable to accurately judge the aircraft's altitude, remaining seated until advised by the flight crew that a safe altitude had been reached, in accordance with procedures, may have been a safer practice than moving through the cabin to assist passengers and accessing bottled oxygen.

Although the flight crew conducted an appropriate emergency descent, most cabin crew commented that the floor angle in the cabin during the descent seemed less steep than their emergency decompression training had led them to expect. Previous decompression events have shown that cabin floor angles less steep than expected may have led to cabin crew judgement that it was safe to move about the cabin during an emergency descent.

The reason for the loss of the IDUs could not be determined or reproduced during the subsequent testing of system components. The IOP#1 fault found on one of the EIUs, could have led to the blanking of the PIC's primary flight display, but it should not have resulted in the failure of the remaining IDUs. The subsequent IDU blanking incident in January 2003 has resulted in further investigation by the CAAS, the NTSB, the aircraft and EIU manufacturers.