Warning devices

Safety summary

What happened

On the morning of 18 December 2017, a Jetstar Airways Airbus A320 aircraft, registered VH‑VQG was on final approach for Gold Coast Airport, Queensland. The aircraft was operating as a scheduled passenger flight, from Adelaide, South Australia.

After a normal descent and touchdown, the captain selected both engine thrust reversers. The left engine thrust reverser did not activate. The aircraft decelerated using normal braking and taxied to the gate without further incident. There was no damage to the aircraft, or injuries as a result of the incident, and the captain reported the thrust reverser issue for investigation.

What the ATSB found

During overnight maintenance in Adelaide, the left engine thrust reverser lockout pin had been installed. However, the pin was not removed after the maintenance, resulting in the aircraft returning to service with the thrust reverser deactivated.

The lockout pin was located at the top of the engine and its 1 m red warning flag was difficult to see in the prevailing low‑light conditions. This probably led to the engineer not seeing the flag and removing the pin.

Further, the lockout pin was not booked out of the tool store nor was its installation recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin's removal were missed.

What's been done as a result

The aircraft’s maintenance organisation, Qantas, advised that it is taking safety action that includes the following:

• Highlighting the importance of the aircraft maintenance manual precautions to maintenance staff at Adelaide.
• Lengthening all thrust reverser lockout pin warning flags to hang past the closed engine cowls. The pin will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.

The aircraft manufacturer, Airbus, advised that the August 2019 revision of the aircraft maintenance manual introduced an operational test of the thrust reverser system to confirm its re‑activation after maintenance tasks.

Safety message

This investigation highlights the importance of considering the environmental conditions in which equipment and tools will potentially be used, as well as the importance of following procedures that in this instance should have resulted in detecting the error.

When considering the effectiveness of equipment, tooling and procedures that aim to minimise the likelihood and/or consequences of an error, an engineered solution is generally more effective than relying on procedural compliance. Further, a functional check is generally more effective within procedural compliance than a self-check of work. See the ATSB research report, An overview of human factors in aviation maintenance (AR-2008-055), available from the ATSB website.

The occurrence

What happened

On the morning of 18 December 2017, a Jetstar Airways (Jetstar) Airbus A320 aircraft, registered VH‑VQG (VQG) was on final approach to Gold Coast Airport, Queensland. The aircraft was operating as a scheduled passenger flight, from Adelaide, South Australia, with two flight crew, four cabin crew, and 140 passengers.

At about 0845 Eastern Standard Time,^[1] air traffic control cleared VQG to land. After a normal descent and touchdown, the captain (pilot flying) selected both engine thrust reversers.^[2] The right engine thrust reverser activated but the left engine reverser did not, and the flight crew received a ‘reverse fault’ alert. They continued with the landing and the aircraft decelerated to a taxi speed using normal braking. The captain moved the thrust reverser controls to the stowed position, the aircraft was taxied to the gate without further incident and the passengers disembarked.

While taxiing, the captain cycled the thrust reverser levers and the alert extinguished. Nevertheless, the captain reported the thrust reverser issue for investigation by engineering personnel.

The subsequent engineering inspection found the left engine thrust reverser lockout pin installed, effectively deactivating the reverser. The lockout pin was removed, the thrust reverser confirmed to be operating normally and the aircraft returned to service.

There was no damage to the aircraft, or injuries as a result of the incident.

Overnight maintenance

Maintenance on the aircraft’s left engine was carried out in Adelaide during the night before the incident flight. Two A320 licensed maintenance engineers had carried out that maintenance.

One of the engineers (engineer 1) began his scheduled night shift at about 1900 on 17 December, and he described the weather that evening as hot and humid. He initially thought he was the only engineer on that shift to carry out maintenance certification on four A320 aircraft, and stated that he felt ‘stressed’ and under pressure. The other engineer (engineer 2) had been called in to work overtime that evening. He started his shift at 1830, carrying out other tasks before being assigned to assist engineer 1 with VQG later that evening.

At about 2300, after completing their other tasks, the engineers commenced maintenance on VQG. This maintenance was unscheduled and involved investigating an engine bleed air issue. Jetstar had not provided paperwork for this task. Engineer 2 began collecting the consumables required for the task. Engineer 1 went to the tarmac tool store to get a lockout pin, required to be installed on the engine to prevent inadvertent activation of the thrust reverser.

After locating the lockout pin with some difficulty, engineer 1 hurried back to the aircraft without booking out the pin on the store’s computer system. He opened the left engine cowling and, using a stand to access the top of the engine, installed the pin. Procedures required the pin’s installation to be entered in the aircraft’s technical log. The log was located in the line office, and the engineer decided to record it in the log later.

A couple of hours later, the engineers completed investigating the bleed air issue. By this time, it had started raining. Engineer 1 made a visual inspection around the engine in preparation to close the cowling. The available lighting had reduced as half the tarmac lights automatically turn off at midnight. Engineer 1 missed seeing the lockout pin and its 1 m long red warning flag, and closed the cowling (Figure 1). The flag was shorter than those on the pins in the hangar tool store at Adelaide, which had been lengthened to 4 m after a previous incident to make them more obvious. Additionally, the stand that engineer 1 had used to install the pin, and which may have reminded him about it, had been removed for another task.

The aircraft maintenance manual thrust reverser de-activation procedure also required the use of specific warning labels in the cockpit, stating that ‘thrust reverser HCU [hydraulic control unit] is de-activated’. This procedure was not used during this maintenance task.

Figure 1: Photograph of a thrust reverser lockout pin and warning flag (non-reflective)

Source: Operator, annotated by the ATSB

Shortly after 0230 on 18 December, the engineers completed the maintenance on VQG, and went to the line office to complete the paperwork. The engineers recorded different parts of the completed maintenance, but neither entered the installation of the lockout pin in the technical log.

At the release to service of VQG, a tooling inventory check was conducted. As the pin was not booked out on the store’s computer, it did not show up during the check.

The aircraft was released to service with the lockout pin installed.

Similar occurrences

AO-2018-064^[3]

In September 2018, the engine thrust reversers on a Jetstar A320 aircraft did not activate when landing at Sydney Airport, New South Wales. The ATSB investigation into that occurrence found that the thrust reverser lockout pins on both engines were not removed after maintenance at the Brisbane Airport, Queensland facility before the flight.

In that case, the aircraft maintenance lockout pins (fitted with warning flags) were substituted with in-service pins without flags. Further, the functional check of the thrust reversers following reactivation as per the operator’s task card for that planned maintenance was not carried out. The investigation also found that operational pressure to expedite the maintenance probably influenced the deviation from procedures.

January 2017

In January 2017, the right engine thrust reverser on a Jetstar A320 aircraft did not activate when landing at Melbourne Airport, Victoria. The operator’s investigation found that the thrust reverser lockout pin was not removed after maintenance at Adelaide before the flight.

In that case, the aircraft maintenance lockout pin also had a 1 m red warning flag and was not booked out on the store’s computer system.

Safety analysis

The left engine thrust reverser did not activate when VH‑VQG landed at the Gold Coast Airport because its lockout pin was installed. Engineers had installed the pin during maintenance in Adelaide before the flight, but missed removing it due to a number of reasons.

The maintenance in Adelaide was carried out in the night under artificial lighting on the tarmac. The lighting significantly reduced at midnight when the tarmac lights automatically dimmed (half extinguished). In addition, it was raining when engineer 1 carried out a visual inspection before closing the engine cowling. These conditions made it difficult to see the lockout pin’s red warning flag.

The red colour of the flag was also harder to see in the artificial lighting,^[4] and the flag was not fitted with reflective material. The lockout pin was located at the top of the engine, where its 1 m flag was not as conspicuous as other longer flags, which would have hung below the engine to the tarmac. Further, the stand used to install the pin, which might have served as a reminder, had been removed. The combination of these factors probably led to the pin not being removed.

Procedures aimed at ensuring the lockout pin’s removal were not followed. These procedures included booking items out on the tool store’s computer system. As the pin was not booked out, its return to the store could not be checked. Further, the pin’s installation was not recorded in the technical log, which meant its removal went unnoticed and unrecorded.

Finally, the required cockpit warnings associated with thrust reverser deactivation were not used, thereby removing an opportunity to identify that the pin had not been removed before the aircraft was returned to service.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The lockout pin on the left engine thrust reverser was not removed after maintenance, resulting in the aircraft returning to service with the thrust reverser deactivated.
• The location of the thrust reverser lockout pin at the top of the engine meant that its 1 m red warning flag was difficult to see in the prevailing low‑light conditions. This probably led to the engineer not seeing the flag and removing the pin.
• The lockout pin was not booked out of the tool store nor was its installation recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin's removal were missed. Additionally, the required cockpit warnings associated with thrust reverser deactivation were not used, removing an opportunity to identify that the thrust reverser was disabled.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas

The aircraft maintenance organisation, Qantas, has advised the ATSB that it is taking the following safety actions:

• Highlighting the importance of the aircraft maintenance manual precautions, and the limitations of human performance on the stages of maintenance, to maintenance staff at Adelaide.
• Lengthening all thrust reverser lockout pin flags to hang past the closed cowls. The pin will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.
• Focused audits on work practices for tooling and documenting maintenance activities.
• Reiterating the responsibilities of engineers to those involved in this incident.

Airbus

The aircraft manufacturer, Airbus, advised that the August 2019 revision of the aircraft maintenance manual introduced an operational test of the thrust reverser system to confirm its re‑activation after maintenance tasks.

 

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. The purpose of the engine thrust reversers is to decelerate the aircraft on the ground, either routinely or during an emergency.
3. Available at www.atsb.gov.au
4. An effect known as the Purkinje shift, red will appear darker relative to other colours as light levels decrease.

During the take-off run on runway 34 the first officer, who was flying the aircraft, called "failure" at approximately 120 knots. This was below V1, and the captain rejected the take-off. The Master Caution Air Conditioning lights were illuminated. The auxiliary power unit bleed air was supplying the left pack which was running in high mode. The pack tripped off as a result of high temperatures.

Autobrake was used in the rejected take-off selection and operated until down to a slow speed in the deceleration. The outboard left main wheel tyre deflated due to overheating. Both left main gear wheels and the left outboard brake unit were subsequently changed. Take-off should not be rejected from high speed for a Master Caution. However, when the first officer responded by calling "failure" the captain was obliged to reject the take-off.

Significant Factors

1. Master Caution Air Conditioning lights illuminated during the take-off roll.

2. The first officer incorrectly called "failure" for the caution light illumination.

3. The captain was obliged to reject the take off on the basis of the first officers call.

Take-off from runway 16 was rejected at 145 knots due to an Engine Indication and Crew Alerting System (EICAS) message relating to a spoiler/flaps configuration warning. The warning was subsequently determined to be false.

As this was the third rejected take-off by this aircraft since 8 March, number 10 Slat Position Switch, Spoiler Handle and the Proximity Switch Electronic Unit (PSEU) were changed as a precaution. The defect has not recurred. The reason for the EICAS message was not determined.

Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.

On 24 December 2011 an Agusta Westland AW139 helicopter departed Bankstown Airport to retrieve a seriously injured patient in the Budderoo National Park, about 16 km west-south-west of Wollongong Airport, New South Wales. During the retrieval, the patient and one of the paramedics hit rocks at the base of the waterfall. The paramedic died from the impact. The ATSB investigation (AO-2011-166) identified four safety issues, including the following:

The helicopter’s lighting set-up did not allow independent control of the searchlights by the pilot using the switches on the flight controls, as required by the operations manual and Civil Aviation Order [CAO] 29.11, and increased the risk of loss of hover reference and distraction in the case of a single light failure or switch miss-selection by a pilot.

The relevant section of the CAO 29.11 sub section 6.3 stated:

A helicopter shall not engage in winching and/or rappelling operations over the land at night unless it is equipped…

(b) as specified in Appendix V of section 20.18 with the addition of…

(ii)    2 white lights operable by the pilot and trainable in azimuth and elevation without removing his/her hands from the flying controls…

Note:   A single white light having 2 separately energized filaments may be approved as meeting this requirement provided that the selection of the alternative light can be accomplished by the pilot without removing his/her hands from the flying controls.

In order to ascertain the extent of the lighting-related safety issue, on 1 May 2013 a safety issues investigation was commenced under the TSI Act. This included the development of a questionnaire that was sent to 10 helicopter operators who were capable of night winching operations. Those operators represented about two thirds of the night winch-capable operators throughout Australia with a combined total of 89 winch-capable helicopters of various types.

The answers to the survey from the 10 operators indicated that about 50 per cent fully complied with CAO 29.11. Of those who did not comply, most believed that they did comply due to their interpretation of the CAO. In all non-compliance situations the pilot had to move their hand from the collective in order to switch between light controls. From that point on the selected light could be controlled from the collective. All respondents believed that the lighting on their helicopters was adequate.

The Civil Aviation Safety Authority (CASA) was made aware of these findings. CASA advised that it realised it could be difficult to comply with the existing CAO 29.11 requirement and that it was proposing to modify the requirements of the CAO. This modification would require the helicopter to only be fitted with one light that could be operated by a pilot without removing their hands form the flying controls.[1]

The likelihood of a lighting failure leading to a substantial loss of hover reference during night winching operations, which are increasingly employing night vision devices, is very low. The ATSB also recognises that CAO 29.11 is being changed to make it easier to comply, and that forcing operators to comply with the existing requirement may introduce additional risks given the design difficulties involved.

Based on the feedback provided by night winch-capable helicopter operators and CASA, the ATSB assessed that the lighting issue did not appear to form a significant safety issue for ongoing helicopter night winching operations. On that basis, the ATSB has decided to discontinue its investigation.

The slat asymmetry warning message illuminated as the crew were configuring the aircraft to land. The approach was discontinued, and the aircraft was then cleared to 1500 ft to carry out the appropriate safety checks. A decision was taken to divert to Brisbane, where engineering assistance was available. The flight landed at Brisbane without further incident. The aircraft was able to depart for the intended destination a short time later after ground checks determined the original slat asymmetry warning to be spurious.

On final approach into Melbourne at 2,000 feet an Engine Information and Crew Alerting System (EICAS) message alerted the crew to an asymmetrical leading edge slat problem. The crew selected flaps to 20 degrees and initiated a go-around. After completing all checklist actions, another approach was commenced with the flaps set at 20 degrees. The aircraft subsequently made an uneventful landing.

The asymmetric slat fault indication is a known 767 problem. Boeing is currently working on a solution to this recurring system anomaly.

The crew reported that they received a cockpit warning during climb passing through FL 310. In accordance with company procedures the flight was returned for an uneventful landing at the departure runway.

Post flight examination found the number 3 Air Data reference Unit had failed. The unit was replaced and all systems tested normal. The aircraft then returned to service without further incident.

When the aircraft encountered icing conditions at 3000 feet on climb the following annunciator lights illuminated:

• #2 INTAKE LOW PRESSURE
• #2 AIR FAULT
• #4 AIR FAULT
• #2 AIR VALVE
• #4 AIR VALVE

The aircraft returned to Melbourne for a normal landing. Maintenance replaced the #2 engine intake low pressure switch and carried out satisfactory ground runs. During later testing the intake low pressure switch was found to be serviceable.

Further checks were carried out on the performance of the number 2 and 4 engines during the overnight service, but the fault was unable to be reproduced. The flight data recorder was not examined to ascertain the flight and engine parameters at the time of the incident.

Maintenance noted that low duct temperatures will give an AIR LOW TEMP warning which will cause the AIR FAULT and AIR VALVE lights to come on. Maintenance advised that it was necessary to maintain 90% N2 to obtain satisfactory airframe anti-ice performance thereby maintaining adequate intake duct temperatures.

Maintenance asked that if the fault reappeared the pilots should supply the N2 figures. The fault has not reappeared.

Significant Factors

The following factors were considered relevant to the development of the incident.

1.The aircraft was flown in icing conditions with thrust settings below those required to maintain adequate anti-ice performance.

2.The reason why this occurred was not established.

1. FACTUAL INFORMATION

1.1 The incident

The Airbus A300-B4 aircraft departed Sydney on a scheduled service to Brisbane. At about 700 ft after take-off the left engine fire warning activated. The crew carried out the appropriate procedures and shut down the left engine. With the engine shut down the fire warning indications ceased, therefore the fire bottle was not discharged. The aircraft was vectored for a priority landing back onto the departure runway and, after ground inspections confirmed the absence of fire, the aircraft was taxied to the terminal for a normal disembarkation.

Inspection of the engine disclosed a rupture of the 14th stage lower bleed air duct. Secondary thermal damage had occurred to the reverser cowl and minor mechanical damage was evident to the reverser mechanism.

1.2. Duct cracking

The engine manufacturer, General Electric (GE), advised that cracking can occur in the lower bleed air duct due to differences in thermal gradients. This occurs because the duct is made from a nickel alloy Inconel 625, and the support link assemblies are made of 321 stainless steel. Thermal stresses occur when the bleed air valve is closed resulting in the lower duct being cooler than the engine case. Installation stresses can also result in cracking.

1.3. Duct examination

The duct is a 90 mm pipe spanning approximately one-third of the circumference of the engine core. Three mounting lugs are welded to the outside surface of the pipe. The duct had ruptured around the toe of the weld at the lap joint of an end lug. Cracking was also present along the toe weld of the other end lug.

The fracture surfaces were subjected to both low power and scanning electron beam microscopy which revealed that the failure was typical of that due to fatigue. The fatigue had multiple initiations along both the outside and inside surfaces of the duct; however, the majority of the fracture had propagated from the outside surface. The fatigue fracture consisted of very fine evenly spaced fatigue striations typical of a constant amplitude load from the stresses associated with thermal cycles.

The fatigue extended around the end of the weld lap joint and approximately 30 mm each side of the lap joint before rapid tearing commenced. The fatigue fracture was stained indicating that hot air had been escaping for some time.

1.4 Propagation rate

The fatigue striation spacing was measured on a small area of fatigue fracture at various distances across the duct section from an origin on the outside surface to the boundary line between two areas of fatigue. From these measurements it was estimated that approximately 2,000 fatigue striations were present on this small area of fatigue fracture. Assuming that a thermal cycle is equivalent to an engine cycle, it would appear that this small area of fatigue had been propagating for 2,000 engine cycles. However, the entire fatigue fracture consisted of many fatigue cracks initiating at different stages during the life of the duct. This indicates that the fatigue cracking had been propagating for in excess of 2,000 engine cycles.

1.5 Recent inspections

The last maintenance inspection was during a Check "A" inspection carried out at 199 hours and 180 cycles prior to failure of the duct.  The last shop visit was 922 hours and 816 cycles prior to failure. The fatigue cracks were present, but not detected, when these inspections were carried out.

1.6 Operator's inspection requirements

The operator's inspection requirement was detailed on Task Card AB3-723300-0801-TN-L and R.  This task card is called up at each Check "A" inspection which at the time of the incident was on a rotating 320/480 hour schedule. The task was originally created on 29 October 1987. The task card in use during the last inspection of the duct was issued with an amendment dated 6 September 1990 which required:

"Visual inspection of high-pressure compressor emphasising......14th stage bleed air manifold for cracks".

This visual inspection was carried out at the last inspection but failed to detect the cracking.

1.7 Manufacturer’s requirement

GE issued Service Bulletin CF6-50-75-064 (SB 064) on 3 August 1990 to institute a recurring inspection aimed at detecting cracks in the 14th stage bleed air ducts.

On Page 4 of SB 064, at item 2.B was a requirement that a Spot Fluorescent Penetrant Inspection (SFPI) technique be used to detect cracks, with a requirement that the SFPI be carried out every 500 flight hours or 150 engine cycles whichever occurs last.

The operator's maintenance system is detailed in the Maintenance Instruction Manual (MIM). This manual sets out the procedures to be used to ensure compliance with the statutory requirements pertaining to engineering and maintenance activities.

Revisions to the MIM are accomplished by entering the necessary details onto a Manual Revision Authority form. The form is then processed in accordance with flow charts contained in the MIM. Some procedures are also contained within instructions raised within specific sections.

The preparation of the Manual Revision Authority form, the routeing through actioning sections, and the subsequent approval and incorporation of an amendment is accomplished by individuals actioning computer-based commands.

1.8 Operator's action

The operator received information, known generically as service literature, regarding introduction of the SFPI technique from both GE and Airbus Industrie (AI), the aircraft manufacturer.

Within the operator's maintenance organisation there are two sections which are required to process changes to maintenance requirements for engines. These are the Power Plant Engineering (PPE) section and the Maintenance Development (MD) section. There were at least four occasions when either or both sections assessed or reviewed the requirements of the SB.

These were:

(a) at initial issue of SB 064,

(b) on receipt of GE Commercial Engine Service Memorandum 76 (CESM 76)

(c) on receipt of an amendment to Airbus Industrie Maintenance Planning Document (MPD) dated October 1991.

(d) on receipt of an MPD amendment dated October 1992

1.9 Initial assessment of SB 064

GE issued SB 064 on 30 August 1990. Contrary to MIM requirements there were no entries made into the computer system that would have allowed the investigation to accurately track the initial routeing of SB 064.

The SB should have been received by PPE and passed to MD for assessment. The PPE engineer involved was no longer employed by the operator at the time of this investigation and was unable to be interviewed regarding his memory of his handling of the SB.

Available records do show that on 28 August 1990 an engineer in MD raised a Manual Revision Authority, numbered AB3100190, requesting the following change to the Maintenance Instruction Manual (MIM):

"Revise tasks AB3-723300-0801-TN-L & R to add visual inspections of the 8th and 14th stage bleed air manifolds". (BASI note - the terms manifold and duct are interchangeable).

The Purpose/Justification part of the Authority stated:

"New General Electric requirement as per SB 75-064".

This request for an MIM change was presented to, and authorised by, the Engineering Manager who did not identify that the assessing engineer in MD had made an incorrect assessment of the inspection process called up in the SB. As a result of the Engineering Manager's authorisation, the task card was amended on 6 September 1990.

MD also raised a Engineering Instruction (EI) numbered EI AB3-075-0102R00. The purpose of the EI is to notify other action sections of any change that may require their attention. This EI was not actioned because the assessing engineer, having raised the Manual Revision Authority, annotated on the EI that the SB was actioned by stating that the EI was "Terminated.... Covered By Maintenance A Checks".  There was no evidence of any communication taking place between PPE and MD prior to the decision to terminate the EI. However, anecdotal evidence suggests that there was often verbal communication between the sections regarding the processing of service literature.

The MIM did not require that a comparison between the SB inspection requirements and those contained in the Maintenance Check A been carried out prior to terminating the EI.

The MIM requires that PPE issue an Action Advice to notify MD that the intent of the SB is to be included in the applicable aircraft checks. An Action Advice covering the initial assessment of SB 064 could not be located.

1.10 General Electric Service Memorandum

On 10 September 1990 GE issued Revision 6 to Commercial Engine Service Memorandum (CESM) No. 76 which contained a consolidated listing of all scheduled inspection and servicing intervals for engines. This was received by PPE on 18 October 1990. PPE raised Action Advice number 9043002 on 1 November 1990 to notify MD of receipt of the CESM. MD assessed and cleared this Action Advice stating it was "Covered by AB3 MPD Revision".

While the statement is correct in that the task cards had been revised, the incorrect assessment and subsequent incorrect procedure were not identified by the person in MD responsible for carrying out the assessment of CESM No. 76.

1.11 AI MPD amendment dated October 1991

Airbus Industrie first introduced the requirement to comply with GE SB 064 via an amendment to the MPD issued in October 1991. The revised MPD was received by MD and assessed. The assessing/action engineer, while noting that GE SB 064 had been incorporated into the MIM via the task cards, did not identify that the original assessment had resulted in an incorrect procedure being called up.

1.12 AI MPD amendment dated October 1992

AI introduced a revision to the inspection intervals for GE SB 064 via a revision to the MPD issued on 30 October 1992.  Again, the MD assessing/action engineer while amending the inspection period did not identify that an incorrect procedure had been called up.

1.13 Operator’s review

When the MIM listing of an incorrect maintenance procedure became apparent the operator immediately established a review of the MIM amendment system. That review examined the procedures in use and checked that all mandatory inspections were correctly specified in the MIM.

The review found that:

(a) action Advice procedures were not being used consistently across all engineering groups;

(b) applicable service literature requirements had not been inserted into the system of maintenance;

(c) there was possible reliance on verbal communication in the service literature decision process;

(d) there was limited review of the service literature assessment by supervisors;

(e) there was a lack of discipline in checking that action data includes all necessary requirements;

(f) there was a breakdown of communication between and within PPE and MD sections;

(g) the review of the acquitted Action Advices appeared to be on an ad hoc basis; and

(h) there was no documented receipt, assessment and maintenance system revision procedure for introducing MPD amendments;

The review recommended that:

(a) members of engineering groups receive training in service literature handling.

(b) in regard to Action Advices:

(1) Ensure that the addressing reflects the current organisational structure.

(2) Ensure actions required to be taken by the addressee are detailed.

(3) Any response must be in a form that provides an audit trail.

(c) The decision process must not use verbal communication that may by-pass the computer-based recording procedure.

(d) A system of cross checking be introduced to ensure that service literature has been correctly interpreted and subsequent action is accurately presented.

(e) A formal procedure should be introduced to control receipt, assessment and revision certification for MPD amendments.

(f) Introduce a standalone listing of outstanding maintenance related Action Advices.

(g) Carry out a follow-up audit to establish that the recommendations are effective.

2. ANALYSIS

The system employed to receive, assess and incorporate service literature that requires an amendment to the MIM was basically sound. However, the system relied on each person correctly accomplishing a task, but did not specifically require the approving authority to check that the assessment was correct.

The operator’s review of handling of service literature found areas of non-conformance other than those which led to the development of the incident.

3. CONCLUSIONS

3.1 Findings

3.1.1 The manufacturer's requirement for an SFPI inspection of the duct was not included in the operator’s maintenance system.

3.1.2 Personnel who were required to action the documentation received from manufacturers did not follow established procedures.

3.1.3 There were inadequate safeguards in the system of maintenance to detect that established procedures had not been followed.

3.2 Significant factors

3.2.1 Visual inspections of the high-pressure duct did not disclose any evidence of cracking.

3.2.2 An SFPI inspection was not carried out because it was not called up on the relevant check sheet.

3.2.3 The check sheet had not been amended to include an SFPI inspection because of errors in transcribing the manufacturers requirement.

3.2.4 The errors in transcribing were not detected.

3.2.5 The high-pressure duct cracked and ejected hot air into the cowl area which activated the fire warning system.

4. SAFETY ACTION

4.1 The operator has instituted revised procedures that require the approving authority to check that the assessment details are correct.

4.2 The operator carried out a total review of the MPD to ensure that mandatory requirements were correctly assessed and that amendments to the MIM were correct.

4.3 The operator introduced a formal certification system that assures an audit trail of all service literature actions.

4.4 After the amendments to the system had been implemented the operator carried out an audit to ensure that the revised procedures were effective and were being complied with. This audit identified the need for a formal procedure covering the handling of Action Advices. This procedure is to be prepared and introduced on a priority basis.

On 2 February 2009, an Agusta Westland AW139 helicopter, registered VH-ESH, departed under the instrument flight rules from Mackay Aerodrome for Townsville Aerodrome, Queensland. The purpose of the flight was to return the helicopter to Townsville following the passage of a tropical cyclone.

Shortly after departure from Mackay, the crew were presented with an increasing number of alert messages indicating the failure of various helicopter systems. While the crew were focussed on assessing these messages, the autopilot altitude hold function disengaged, leading to a descent that was not detected by either the flight crew or air traffic services (ATS).

The helicopter descended undetected for over 6 minutes while flying towards an area of rising terrain, losing about 3,300 ft of altitude, before ATS observed the descent and alerted the crew.

The investigation determined that the helicopter sustained two independent technical problems; one associated with water and particulate ingress and a second related to the probable susceptibility of the air data system to in-flight turbulence. These failures resulted in multiple erroneous alert messages and uncommanded disengagement of the altitude hold function. The investigation also identified a number of safety factors relating to workload and task management by the crew and monitoring of the aircraft by ATS. That included the lack of an altitude deviation alert within the Australian Defence Air Traffic System (ADATS).

Following the occurrence, the helicopter manufacturer and operator, and the Civil Aviation Safety Authority (CASA) implemented a number of safety actions relating to the identified technical and operational safety issues. In addition, the manufacturer and operator of the helicopter, and CASA undertook proactive safety action in a number of cases for which no safety issues were identified.

A replacement common ATS system for ADATS and the civilian Australian Advanced Air Traffic System (TAAATS) has been announced by the Government that could be expected to include common alert functions, such as the existing cleared level adherence monitoring alert in TAAATS.