On the 26 June 2018, QantasLink was operating a De Havilland Aircraft of Canada DHC-8-400 aircraft, registered VH-LQD, on a scheduled passenger service from Mackay to Brisbane, Queensland. As the aircraft approached the top of descent, the right engine shut down uncommanded. The crew were unable to feather the propeller and it continued to rotate at low speed, in a coarse pitch condition. The crew actioned the ‘Non-Normal’ checklist and continued to Brisbane Airport where the aircraft landed safely.
What the ATSB found
The ATSB found that a bearing within the engine’s intercompressor case fractured, leading to an automated in-flight engine shutdown. Despite detailed technical examination, the reason the propeller did not feather could not be established. However, the operator identified that the one engine inoperative performance reduction between a counter‑weight coarsened propeller and a fully feathered propeller was only 0.5–0.9 per cent.
The ATSB also found that aircraft maintainers missed an opportunity to ground the aircraft when, on the day before the flight, metal debris was detected on the turbomachinery chip detector. It was identified that the procedures in the aircraft maintenance manual were confusing and ambiguous. This probably led to a misunderstanding by the personnel within the approved maintenance organisation and the continuing airworthiness maintenance organisation, which allowed the aircraft to be released to service.
The ATSB also found that the approved maintenance organisation personnel were not recording all the work performed during regular inspections. This meant that the maintenance information system was incomplete and an opportunity to identify the developing bearing degradation was missed.
What's been done as a result
As a result of this occurrence, QantasLink released a technical advisory bulletin to pilots advising of the incident and warning that the propeller may not always feather as practiced in the simulator.
They have also introduced a system to monitor metallic debris found on chip detectors. This will assist trend identification and ensure analysis results can be accessed quickly in the event of a reoccurrence of debris. Additionally, the organisation contracted to assist with engine monitoring now has a function, which allows monitoring and alerting of fault messages within recorded engine and flight data.
In addition, QantasLink have issued an airworthiness standing order to all certifiers within the approved maintenance organisation to introduce a single certification statement standard for all maintenance. They have also introduced a documentation check to be completed by supervisors after maintenance is completed. A recurrent course is also under development for all certifiers to ensure they remain current with all aircraft maintenance documentation recording requirements.
The engine manufacturer Pratt & Whitney Canada advised they have standardised the wording relating to debris analysis guidance in the next revision of the aircraft maintenance manual. The ATSB acknowledges the improvement this will make, but considers that there is still ambiguity and the potential for the confusion in the procedure.
As such, the ATSB has issued a recommendation to Pratt and Whitney Canada to improve the clarity of procedures within the chip detector debris analysis section of the aircraft maintenance manual.
When performing safety‑critical tasks like aircraft maintenance, it is very important that procedures are clear and unambiguous in order to avoid misinterpretation and error such as those that occurred in this incident.
The occurrence also illustrates that the high reliability of modern aircraft maintenance depends on accurate record keeping of all performed tasks to both communicate what has been done and assist in trend identification.
On the 26 June 2018, a QantasLink De Havilland Aircraft of Canada (formerly Bombardier Inc.) DHC-8-402, registered VH-LQD (LQD), was operating a regular passenger service within Queensland from Brisbane to Mackay, and returning to Brisbane. The flight crew consisted of two captains, one in the right seat who was training to get an approval to operate the aircraft from the right seat, and a training captain who was pilot in command.
When the flight crew arrived at LQD to begin their pre-flight preparations, they identified a number of maintenance requirements for the right engine related to ongoing inspections. These requirements were for advice-only to the flight crew. After completing their pre‑flight preparations, they flew from Brisbane to Mackay with no issues.
The return flight to Brisbane had four crewmembers and 74 passengers on board. For this flight, the training captain was the pilot monitoring (PM) and the trainee captain, acting as first officer, was the pilot flying (PF).
At approximately 1749 Eastern Standard Time, as the aircraft approached the top of descent at FL 250, the aircraft yawed and there was a warning chime. The flight crew identified that the full authority digital engine control (FADEC) had shut down the right engine without warning. Due to their concern about the resultant windmilling propeller, the crew actioned the engine shutdown procedure from memory rather than by using the quick reference handbook. As this did not result in the propeller feathering, they selected the alternative feathering system. They observed the ‘feather pump running’ advisory light was illuminated, indicating that the alternative feather pump was working. The crew reported the propeller continued to turn at approximately 270 RPM and that the remainder of the checklist items were actioned.
The crew assessed the available landing options and decided that despite being slightly closer to the Sunshine Coast Airport, they would continue to Brisbane as they were prepared and had briefed for that approach. As expected, the aircraft could not maintain speed at FL 250 with one engine inoperative, so they slowed towards 190 kt. The PM contacted air traffic control (ATC) to advise them of the situation and requested a descent to FL 200, which was approved. They then made a PAN PAN call and advised ATC that emergency services would be required on landing.
The PM contacted the cabin crew to advise them of the situation and requested that they prepare the cabin and passengers. A public announcement was then made to the passengers.
The propeller was still rotating at approximately 270–300 RPM, but as the aircraft descended and the airspeed increased, the propeller rotations increased to approximately 660 RPM. To reduce the RPM, the flight crew slowed the aircraft. During the descent, the batteries in the PF’s noise cancelling headset failed. It was reported that, as the batteries were being changed, the PF could hear what appeared to be grinding from the rotating propeller. Consequently, the PM contacted the company’s engineering section to ensure all appropriate actions had been completed.
About 45 km from the airport, the training captain took over flying the aircraft. As they descended through 5,000 ft, the aircraft exited cloud and the crew sighted the airport. They requested radar vectors for the Runway 19 instrument landing system, to ensure they were set up to conduct a stabilised approach. They then advised ATC that they expected to conduct a normal landing but as the propeller had not feathered, they could not guarantee missed approach performance and so would not conduct a missed approach.
At 1845, the aircraft landed and was stopped on the second high speed turnoff. This allowed the aviation rescue firefighting (ARFF) service to inspect the engine for excessive residual heat or oil leaks. Following advice from the ARFF that there were no observed engine issues, the aircraft was cleared to taxi to the bay.
The flying pilot observed that the only handling difference from an engine failure practiced in the simulator was that when the operating engine was selected to flight idle during the landing, the aircraft yawed significantly more than expected. He commented that it required almost full right rudder to maintain the aircraft on the centreline.
- Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
- Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
- Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
- Windmilling: a rotating propeller being driven by the airflow rather than by engine power, and results in increased drag at normal propeller blade angles.
- Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
- PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
Engine and propeller examination
The aircraft was equipped with two Pratt & Whitney Canada PW150A engines, each driving a Dowty Propellers’ six-blade R408 propeller system. The affected engine, serial no. PCE-FA0815, was sent to a Pratt & Whitney Canada engine facility in Canada for inspection. Their examination identified that the uncommanded engine shutdown was the result of a No. 30 bearing fracture. Due to the extent of damage, it was not possible to establish the bearing fracture mechanism.
The No. 30 bearing is part of the tower shaft for the accessory gearbox that runs the main engine oil pump and fuel metering unit, among other systems.
Source: Pratt & Whitney Canada report received from the operator
The propeller pitch control unit, propeller overspeed governor, and auxiliary feather pump were sent to the relevant manufacturer for inspection. The auxiliary feather pump was not test run prior to being disassembled and inspected however, nothing was found during the inspections that contributed to the propeller not feathering.
The operator advised that while the propeller did not feather, and the reason for this could not be identified, the propeller did go to a safe coarse condition due to the counterweights in the propeller system, as it would if there was no oil in the propeller system. The manufacturer’s analysis showed that with one engine inoperative, the difference between a counter-weight coarsened propeller and a fully feathered propeller was a 0.5–0.9 per cent decrease in aircraft performance.
Airworthiness and maintenance
The operator had a Civil Aviation Safety Authority-approved Civil Aviation Safety Regulation (CASR) Part 42 continuing airworthiness maintenance organisation (CAMO). The CAMO maintained the aircraft maintenance program, which included:
- maintenance planning
- the reliability program
- recording of data in the maintenance information system.
The operator also had a CASR Part 145 approved maintenance organisation (AMO) to perform the required maintenance on the aircraft.
The CAMO planned the maintenance actions and issued work orders to the AMO. The work orders contained task cards that directed the AMO to conduct specific tasks. Personnel from the AMO were required to:
- complete the task
- record what work was completed
- sign the task as complete
- attach the task card to the work order.
The overarching work order was then signed as being complete and a summary recorded. Those records were then returned to the CAMO to assess the completed work and record the information in the maintenance information system. Information in the system was available to both CAMO and AMO personnel.
Engine monitoring systems
During the 12 months prior to the incident, the operator had been introducing a new engine monitoring system across their DHC-8 fleet—the flight-data acquisition, storage and transmission (FAST) system. This system provided automated transmission of flight and engine health data to an organisation contracted to provide technical support. An automated email was sent to selected people within the CAMO if a fault was generated within the critical (as specified by the engine manufacturer) health data.
At the time of the incident, the procedures for what data was emailed and how to use the data had not been implemented. Since this occurrence, the installation of the FAST system has been completed across the fleet. Procedures on how to deal with notifications generated by the FAST system have also been introduced.
The FAST system had been installed on LQD. The system was producing data, and emails relating to faults were being sent to selected people within the CAMO.
While the FAST system was being installed across the fleet, the operator conducted regular engine trend-monitoring inspections as per the approved maintenance program. This included a work order to conduct routine interrogation of the engine central diagnostic system (CDS) by personnel within the AMO every 50 hours. Each work order contained a task card instructing the AMO to check, investigate and clear CDS faults and to record the relevant faults. Relevant faults codes included those which occurred during normal operations:
- resulting in the subsequent reset of a system in accordance with the De Havilland Supplemental Procedure Ground Reset Guide (SPGRG)
- or maintenance activities and required a subsequent maintenance action to clear.
Maintenance actions prior to the uncommanded engine shutdown
On the 13, 18 April, and 27 May, personnel within the CAMO received automated emails from the contracted organisation notifying them of ‘Fault code 938 – Turbomachinery chip detector’ generated by the FAST system, for the right engine on LQD. No actions were taken in response to these emails, and as the procedures were not yet in place, no action was required.
On the 13 April, earlier on the day the CAMO received the first email relating to the fault, personnel working within the AMO signed a work order as complete, recorded that there were no defects and ticked the ‘Fault code(s)’ ‘No’ box on the task card. The fault, recorded in the email received by the CAMO, was most likely generated after this check was completed. This fault was probably cleared on the 18 April, when a separate powerplant message was cleared, and the fault generated again on a flight later the same day resulting in the second email being forwarded to the CAMO. An inspection on 20 April was also completed with no faults recorded and the ‘Fault code(s)’ ‘No’ box ticked.
During an inspection on 26 April, ‘Fault code 938 – Turbomachinery chip detector’ was detected on the CDS. On further inspection, ‘minor fuzz’ was detected on the turbomachinery chip detector. The AMO categorised the debris as ‘permitted’, which was described in the aircraft maintenance manual as a ‘small quantity of hair like filaments (fuzz) or powder provided there has been no prior history of debris (allowable or non-allowable) within the last 400 hours’.
After consulting the aircraft maintenance manual, the engine was returned to service. The debris was not analysed, and there was no requirement to do so. The fault was recorded in the technical log, and the fault code ‘No’ box was ticked on the task card and work order (Figure 2).
The task card on the left references the task in the technical log and shows that the fault code ‘No’ box is ticked although a fault code was present.
The task card on the right is the task on the 30 May 2018, where the fault code 938 had been received and cleared in the CDS and no information about the maintenance task had been recorded on the task card. These tasks were completed by different engineers.
Source: Operator annotated by ATSB with identifying information redacted.
The AMO conducted nine more inspections of the CDS with no defects recorded and the fault code ‘No’ box ticked on each occasion. Different personnel within the AMO completed these inspections.
After the incident, the operator interrogated the CDS to investigate why the FAST system had recorded 938 fault codes, but no such fault codes were recorded during most of the 50 hourly routine tasks. The interrogation found that during the maintenance task on the 30 May, the ‘Fault code 938 – Turbomachinery chip detector’ had been cleared in the CDS. This indicated that when the maintainer interrogated the CDS, they identified fault code 938, and had cleared it.
The AMO could not provide evidence that further actions had been taken in relation to CDS ‘Fault code 938 – Turbomachinery chip detector’ although they stated that it was highly likely that the appropriate maintenance actions had taken place when the faults were cleared.
This omission in the recording of maintenance had not been detected by the AMO, as there was no requirement to ensure that the work completed was recorded in the paperwork correctly. It was also not detected within the CAMO, as personnel working within the technical records area have no way of knowing what unscheduled maintenance was completed unless it was written on a task card.
A review of tasks cards found a number on which the maintainer had listed the fault codes that had been detected and the work completed to clear those codes, but the fault code ’No’ box was ticked (see Figure 2). This was not detected during the assessment of the paperwork by the technical records area, as there was no requirement to check this specific area of the form. The AMO could not explain why the same error was made by different maintainers over a number of inspections.
There is a regulatory requirement that an operator ensure that all stages of maintenance are complete and recorded, with details of the maintenance conducted, before an aircraft is released to service. There is also a regulatory requirement that licenced aircraft maintenance engineers’ record all maintenance conducted within the continuing airworthiness records system before an aircraft is released to service.
Oil sampling trial
On 18 May, an oil sample was taken from the occurrence engine as part of a trial being conducted by the engine manufacturer. There were no requirements on the operator to collect the sample and no procedures on how quickly the sample was to be sent for analysis to the engine manufacturer’s facility. The sample was sent to the manufacturer’s facility on 25 June. The results, which indicated that the bearing and gear material were above the set threshold, were not received by the operator until 12 September.
Maintenance actions immediately prior to the uncommanded engine shutdown
Overnight on 25 June, the FAST system recorded three fault codes - ‘Fault code 938 – Turbomachinery chip detector’, ‘Fault code 915 - Main Oil Filter’ and ‘Fault Code 932 - Scavenge Oil Filter’. Due to the system’s set-up, personnel from the CAMO received an automated email from the contracted organisation notifying them of ‘Fault code 938 – Turbomachinery chip detector’. On receipt of this email, they raised an urgent technical service request (UTSR) which was sent to the AMO.
During scheduled maintenance on the evening of 25 June, personnel from the AMO also noted that the CDS had recorded ‘Fault code 938 – Turbomachinery chip detector’, ‘Fault code 915 - Main Oil Filter’ and ‘Fault Code 932 - Scavenge Oil Filter’. As a result, they conducted an inspection of the engine.
Personnel from the AMO found debris on the turbomachinery chip detector and the main oil filter and classified this as ‘Non-Permitted Category 3’ debris (dark irregular magnetic chips or small clusters of magnetic flakes or all other debris not defined elsewhere, Figure 3). This required that a sample of the debris be sent to a laboratory for analysis.
They then, in consultation with personnel from the CAMO, used a flow chart to determine whether to return the engine to service. This flow chart indicated that if the turbomachinery had a history of contamination within the previous 400 hours, they must ‘wait for the results of the previous lab report prior to continuing operation’. The personnel from the AMO and CAMO together decided not to include the previous permitted ‘minor fuzz’ found on the chip detector on the 26 April, which was within the previous 400 flight-hours, due to an assessment that it did not constitute an occurrence of debris. There was no record in the maintenance information system that ‘Fault Code 938 – Turbomachinery chip detector’ had been received and cleared on previous occasions, as this had not been recorded on the task cards.
The personnel from the AMO and CAMO discussed the steps in the flow chart procedure and assessed that with no history of debris, the engine could be returned to service with a 20 flight‑hour limitation. The debris was sent for laboratory analysis. The report with the results of the debris analysis, which showed the sample contained bearing material, was received by maintenance personnel while the aircraft was in cruise, 35 minutes before the engine shutdown.
The personnel from the AMO and CAMO did not consult with the engine manufacturer during this process as it was not a requirement when following the Aircraft Maintenance Manual.
The aircraft maintenance manual PSM 1-84-2, covered the classification and required actions to be taken when debris was detected on the turbo machinery chip detector. As part of their investigation into the incident, the operator reviewed the relevant sections of the manual and found a number of ambiguities in terminology and required actions.
In the section to classify the debris found in the turbomachinery and reduction gearbox oil system (subtask 79-22-00-750-009 table 601, Figure 3), the debris classification table used the terms ‘permitted’ and ‘non-permitted’ to classify the debris. However, in the definitions, the terms were changed to ‘allowable’ or ‘non-allowable’. The next section interchangeably used the terms ‘debris’ and ‘contamination’, ‘bearing material’ and ‘material’.
The table shows the debris type and definition.
Source: Aircraft manufacturer
In the classification system, category 3 debris was smaller than category 1 debris. Unlike category 2 debris, the category 3 debris definition did not consider if there was a history of debris within the previous 400 hours.
The aircraft maintenance manual directed the user to a flow chart that set out the steps to be taken when debris was detected on the turbomachinery chip detector and/or the main oil filter. Step 16 in the flow chart (Figure 4) asked if the turbomachinery had ‘a history of contamination within 400 hours?’. This step changed the term from ‘debris’ to ‘contamination’ and it also did not include the words ‘allowable’ or ‘non-allowable’.
Source: Aircraft manufacturer
If the answer to step 16 was ‘yes’ then the flow chart directed the user to step 29 (Figure 5). This asked if a laboratory report was available for the previous event of contamination and if the answer was ‘no’, directed the user to go to step 30. Step 30 stated ‘wait for the results of the previous lab report prior to continuing operation’.
Source: Aircraft manufacturer
The operator found that the personnel from the ‘AMO and CAMO were then faced with a situation whereby the guidance required them to wait for the results of a debris analysis that had not taken place’. This step also directed the user to Note 6 (Figure 6) which directed the user to obtain an analysis of the ‘last’ sample. The operator noted that the use of the word ‘last’ here was open to interpretation, as this could be interpreted as ‘last’ being the previous debris or ‘last’ being the latest debris. It also did not specify that the debris could be ‘allowable’ or ‘non-allowable’, as specified in other sections of the manual.
Source: Aircraft manufacturer
To assess the clarity of the procedure, the operator conducted an informal survey of other maintenance staff using this documentation. They found that the maintenance staff came to different conclusions as to the action to be taken.
Engine manufacturer’s comments
The engine manufacturer considered that the in-flight shutdown of the turbomachinery was a preventable occurrence. They classified the debris identified on 25 June as ‘Non-permitted Category 2’ (Any quantity of hair like filament (fuzz) or powder if the module has a history of generating debris (allowable or non-allowable) within the previous 400 hours). They advised that the ‘minor fuzz’ detected on the 26 April should have been classified as ‘previous history’ for the purpose of considering the debris identified on 25 June. This would have required the aircraft to be grounded until the results from the analysis of the debris was received.
The engine manufacturer also advised that worldwide, this was the third fracture of the No. 30 bearing since May 2013, when the entire fleet had incorporated service bulletin SB35216. There have been over 10 million hours flown worldwide since the service bulletin was incorporated. In all three events, it was impossible to detect what had led to the bearing fracture, but two of the three events had resulted in uncommanded inflight engine shutdowns.
During cruise flight, a bearing fracture within the intercompressor case resulted in an automated shutdown of the right engine. Due to the extent of the damage, and consistent with previous similar occurrences, it was not possible to establish the bearing fracture mechanism.
After the uncommanded engine shutdown, the propeller did not feather as expected, instead going into a design coarse position. This decreased the aircraft’s one engine inoperative performance by up to 0.9 per cent from that expected had the propeller feathered. Detailed technical inspection was unable to identify the reason why the propeller did not feather.
This analysis will discuss the indications of the deterioration of the bearing and the maintenance actions in the months and days preceding the uncommanded engine shutdown. It also examines the maintenance procedure used to determine whether the aircraft should be grounded pending the analysis of the debris found on the turbomachinery chip detector.
During a number of regular inspections leading up to the detection of what maintenance personnel considered to be category 3 chip detector debris, different maintainers from the operator’s approved maintenance organisation (AMO) had identified ‘Fault Code 938 – Turbomachinery Chip Detector’. For reasons that could not be determined, and contrary to the required procedure, these faults were cleared without recording the fault and maintenance actions in the task card. The associated fault code ‘No’ box was also ticked on each occasion.
There was no process, nor was there a requirement within the AMO, to ensure that the completed maintenance related to fault codes were correctly recorded in the maintenance documentation. Additionally, there was no way or means for personnel within the continuing air maintenance organisation (CAMO) to detect when unscheduled maintenance was completed but not documented. They also did not have a procedure to ensure that when there were faults recorded on the task card, that the fault code ‘Yes’ box was ticked.
As a result, the opportunity to identify the developing debris trend associated with the gearbox bearing deterioration was missed.
On the evening of 25 June, ‘Fault Code 938 – Turbomachinery Chip Detector’ fault was detected and debris found on the turbomachinery chip detector and the main oil filter. The debris was classified as ‘Non-permitted Category 3’ debris. In consultation, personnel from the CAMO and the AMO decided that the previous instance of debris (26 April) did not constitute a history of debris.
Based on that assessment, they used the information provided in the aircraft maintenance manual to release the engine to service with a 20 flight-hour limitation while a sample of the debris was sent for analysis.
The engine manufacturer’s intent was that the prior ‘fuzz’ should have been considered a history of debris. This would have required the debris detected on the 25 June to be analysed and the results reviewed, before the aircraft was released to service. Had that occurred, the uncommanded engine shutdown would probably have been avoided.
The aircraft maintenance manual procedures for assessing chip detector debris were written in a way that could cause confusion and error. For example, in describing the classification of the debris, the ‘Non‑permitted Category 3’ description did not mention a previous history of debris. This allowed the user to read the classification description in isolation and, as in this case, disregard the previous instance of ‘permitted’ debris. This was not the manufacturer’s intended interpretation.
Additionally, some of the required maintenance steps relied on the results of debris analysis but it was not always clear what debris was being referred to—current or previous. Terminology was also interchanged without explanation.
These aspects of the assessment flowchart most likely influenced the maintenance personnel’s decision to discount the previous history and release the engine to service with a 20 flight-hour limitation, while they waited for the results of the debris detected on the 25 June to be analysed.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the uncommanded engine shutdown involving a De Havilland DHC-8, registered VH-LQD, near Brisbane, Queensland, on 26 June 2018.
- During cruise, a bearing in the intercompressor case fractured, leading to an automated in‑flight engine shutdown.
- Following detection of category 3 debris on the chip detector and the oil filter, the maintenance personnel discussed a previous detection of debris but incorrectly concluded that it did not need to be considered. This resulted in the aircraft being released to service, and the uncommanded engine shutdown, within the 20 flight-hour limitation.
- The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing. [Safety issue]
Other safety factors
- Multiple maintenance personnel did not record 'Fault code 938 - turbomachinery chip detector' as required when conducting 50 hourly inspections.
- There were no processes within the aircraft maintenance organisation or QantasLink to ensure that maintenance tasks associated with fault codes were correctly documented.
- After the uncommanded engine shutdown, the propeller did not feather. Instead, it moved to a safe coarse position, which resulted in a decrease in the aircraft’s one engine inoperative performance of 0.5‑0.9 per cent compared to a feathered propeller.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand.
Safety Issue number: AO-2018-049-SI-01
Safety issue description: The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing.
The ATSB makes a formal safety recommendation, either during or at the end of an investigation, based on the level of risk associated with a safety issue and the extent of corrective action already undertaken. Rather than being prescriptive about the form of corrective action to be taken, the recommendation focuses on the safety issue of concern. It is a matter for the responsible organisation to assess the costs and benefits of any particular method of addressing a safety issue.
Safety recommendation: The Australian Transport Safety Bureau recommends that Pratt & Whitney Canada takes safety action to improve the clarity of procedures within the chip detector debris analysis section of the aircraft maintenance manual.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Safety action by QantasLink
QantasLink now proactively requires all debris detected during inspections of engines and turbomachinery chip-detectors to be sent for analysis. The results of this analysis is stored and can be referenced, should further faults be detected, without having to wait for analysis.
QantasLink’s AMO introduced a ‘supervisor documentation quality check’ and issued a maintenance standing order. Shift supervisors are now required to conduct final checks of all aircraft maintenance and check packages for correct completion, certification and coordination in accordance with the:
- AMO Internal Procedures Manual
- Continuing Airworthiness Maintenance Organisation’s Approved Maintenance Program
- certification practices and procedures and the Civil Aviation Safety Regulations.
Following these checks, all necessary maintenance records and data are to be sent to the CAMO technical records department.
While the CAMO ‘Documents & Procedures’ course is delivered to new AMO employees, a recurrent course has not previously been available. A recurrent ‘Docs & Procs’ online course is now under development. This course is intended to ensure all certifiers remain current with all aircraft maintenance documentation recording requirements.
Implementation of the FAST system has now been completed on all QantasLink Dash-8 aircraft. This system allows monitoring of faults, including accessing the date and time the faults were triggered via the contracted organisation’s systems portal. For selected fault codes, as recommended by Pratt & Whitney Canada (P&WC), an automated alert email is also provided to selected staff by the contracted organisation. A ‘work instruction’ detailing the process to react to FAST system generated alerts, has been published (AWI-TS10). This ‘work instruction’ is based around P&WC Service Information Letter PWC150-045 along with other P&WC data.
Sources and submissions
Sources of information
The sources of information during the investigation included:
- interviews with the flight crew
- De Havilland Aircraft of Canada
- Pratt & Whitney Canada
- the Transportation Safety Board of Canada.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, QantasLink, Pratt & Whitney Canada, De Havilland Aircraft of Canada, the Transportation Safety Board of Canada, Transport Canada and the Civil Aviation Safety Authority.
Submissions were received from the flight crew, QantasLink, De Havilland Aircraft of Canada, Pratt & Whitney Canada and Transport Canada. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly. Australian Transport Safety Bureau
The ATSB is an independent Commonwealth Government statutory agency. The ATSB is governed by a Commission and is entirely separate from transport regulators, policy makers and service providers. The ATSB’s function is to improve safety and public confidence in the aviation, marine and rail modes of transport through excellence in: independent investigation of transport accidents and other safety occurrences; safety data recording, analysis and research; fostering safety awareness, knowledge and action.
The ATSB is responsible for investigating accidents and other transport safety matters involving civil aviation, marine and rail operations in Australia that fall within the ATSB’s jurisdiction, as well as participating in overseas investigations involving Australian registered aircraft and ships. A primary concern is the safety of commercial transport, with particular regard to operations involving the travelling public.
The ATSB performs its functions in accordance with the provisions of the Transport Safety Investigation Act 2003 and Regulations and, where applicable, relevant international agreements.
Purpose of safety investigations
The object of a safety investigation is to identify and reduce safety-related risk. ATSB investigations determine and communicate the factors related to the transport safety matter being investigated.
It is not a function of the ATSB to apportion blame or determine liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner.
Developing safety action
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues in the transport environment. The ATSB prefers to encourage the relevant organisation(s) to initiate proactive safety action that addresses safety issues. Nevertheless, the ATSB may use its power to make a formal safety recommendation either during or at the end of an investigation, depending on the level of risk associated with a safety issue and the extent of corrective action undertaken by the relevant organisation.
When safety recommendations are issued, they focus on clearly describing the safety issue of concern, rather than providing instructions or opinions on a preferred method of corrective action. As with equivalent overseas organisations, the ATSB has no power to enforce the implementation of its recommendations. It is a matter for the body to which an ATSB recommendation is directed to assess the costs and benefits of any particular means of addressing a safety issue.
When the ATSB issues a safety recommendation to a person, organisation or agency, they must provide a written response within 90 days. That response must indicate whether they accept the recommendation, any reasons for not accepting part or all of the recommendation, and details of any proposed safety action to give effect to the recommendation.
The ATSB can also issue safety advisory notices suggesting that an organisation or an industry sector consider a safety issue and take action where it believes it appropriate. There is no requirement for a formal response to an advisory notice, although the ATSB will publish any response it receives.
Terminology used in this report
Occurrence: accident or incident.
Safety factor: an event or condition that increases safety risk. In other words, it is something that, if it occurred in the future, would increase the likelihood of an occurrence, and/or the severity of the adverse consequences associated with an occurrence. Safety factors include the occurrence events (e.g. engine failure, signal passed at danger, grounding), individual actions (e.g. errors and violations), local conditions, current risk controls and organisational influences.
Contributing factor: a factor that, had it not occurred or existed at the time of an occurrence, then either:
(a) the occurrence would probably not have occurred; or
(b) the adverse consequences associated with the occurrence would probably not have occurred or have been as serious, or
(c) another contributing factor would probably not have occurred or existed.
Other factors that increased risk: a safety factor identified during an occurrence investigation, which did not meet the definition of contributing factor but was still considered to be important to communicate in an investigation report in the interest of improved transport safety.
Other findings: any finding, other than that associated with safety factors, considered important to include in an investigation report. Such findings may resolve ambiguity or controversy, describe possible scenarios or safety factors when firm safety factor findings were not able to be made, or note events or conditions which ‘saved the day’ or played an important role in reducing the risk associated with an occurrence.
The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing.
|Status:||Open – Safety action pending|
|Date:||26 June 2018||Investigation status:||Completed|
|Time:||1749 EST||Investigation level:||Defined - click for an explanation of investigation levels|
|Location:||near Brisbane Airport||Investigation phase:||Final report: Dissemination|
|State:||Queensland||Occurrence type:||Engine failure or malfunction|
|Release date:||16 September 2020||Occurrence category:||Incident|
|Report status:||Final||Highest injury level:||None|
|Aircraft manufacturer||De Havilland Canada|
|Operator||Sunstate Airlines (Qld), operating as QantasLink|
|Type of operation||Air Transport High Capacity|
|Damage to aircraft||Minor|
|Departure point||Mackay, Queensland|