Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
The ATSB commenced an investigation into a flight control system event that occurred on 25 May 2017 involving a Boeing Company 737-800, registered VH-YIJ and operated by Virgin Australia International, on a flight from Brisbane, Queensland to Wellington, New Zealand.
The captain was the pilot flying, and he was conducting the night arrival into Wellington. The weather conditions were fine, and the descent (below flight level 250) and approach were briefed to be flown with the autopilot and autothrottle disengaged for practice.
During the approach to runway 34, the flight crew progressively selected flaps 1 then flaps 15. The landing gear was selected down and then flaps 25. The right flap moved to flap 25 but the left flap initially remained at flap 15, before moving very slowly to flap 25, which was not initially detected by the flight crew. Flap 40 was then selected, however, the flaps remained in the 25 and 15+ positions.
While carrying out the landing checklist, the flight crew detected the flap asymmetry. The flight crew attempted to rectify the problem with various flap lever selections, which were unsuccessful. Approaching 1,000 ft, the aircraft did not meet the operator’s stable approach criteria, so the flight crew initiated a missed approach.
During the missed approach, the left flap slowly extended to flap 25, correcting the initial ‘Trailing Edge Flap Asymmetry’ to a ‘Trailing Edge Flap Disagree’ condition. The aircraft, still being manually flown, subsequently climbed above the cleared altitude of 5,000 ft (reaching 5,340 ft) and the flap limit speed was marginally exceeded on two occasions. The flight crew positioned the aircraft into a holding pattern, completed the ‘After Takeoff’ checklist and ‘Trailing Edge Flap Disagree’ non-normal checklist and briefed for a second approach to runway 34 with flaps 25.
Prior to leaving the holding pattern, the captain briefed the cabin supervisor about the situation. However, the format of that briefing was the same as what the cabin supervisor would expect for an emergency. As a result, the cabin supervisor perceived that the cabin needed to be prepared for an emergency landing, which was not the captain’s intention.
A second approach was conducted with the autopilot and autothrottle engaged to 136 ft. The aircraft landed without further incident.
Engineers later performed the required aircraft inspections. They could not reproduce the flap fault, however, replaced the left-hand trailing edge flap position transmitter as a precaution.
The ATSB obtained the operator’s investigation report, and interviewed the flight crew and the cabin supervisor. The ATSB also obtained data from the aircraft’s flight data recorder, aircraft maintenance records and relevant sections of the operator’s operations manual. Based on its review of this information, the ATSB concluded that the operator had conducted a detailed investigation and it was unlikely that further ATSB investigation would identify any systemic safety issues.
The ATSB noted that, although there were flight crew errors made during the approach and the subsequent missed approach, the missed approach was conducted at an appropriate time. In addition, while the cabin crew conducted the cabin preparation drill for a non-normal landing when it was not required, doing so was an example of the operation ‘failing safe’ rather than increasing risk.
The operator has subsequently used this incident as a basis for some recurrent training for its flight crew and cabin crew. Consequently, the ATSB has discontinued this investigation.
On 10 July 2017, at about 1445 Coordinated Universal Time (UTC), an amateur-built Arion Lightning light sport aircraft, registered N273DB, fitted with a Jabiru 3300 engine, was substantially damaged during a forced landing following a partial loss of engine power near New River, Arizona, United States. The pilot, the sole occupant, received minor injuries.
As the accident occurred in the United States, the National Transportation Safety Board (NTSB) was responsible for investigating this occurrence. As part of its investigation, the NTSB notified the Australian Transport Safety Bureau (ATSB) as the state of manufacture of the engine. In accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation, the ATSB appointed an accredited representative to liaise with the NTSB and initiated an investigation under the Australian Transport Safety Investigation Act 2003.
The ATSB has concluded its support of this investigation. On 9 August 2019, the NTSB released the final investigation report into this occurrence and it is available at www.ntsb.gov.
Any enquiries regarding the investigation and report should, in the first instance, be directed to the NTSB.
Occurrence summary
Investigation number
AE-2017-076
Occurrence date
10/07/2017
Location
New River, Arizona (17 miles north of Deer Valley Airport ((KDVT)), US
On March 12, 2017, at about 1015 UTC a pilot and a passenger departed on a private flight from Margate Airport (FAMG) to Light flight Airfield, Cato Ridge, South Africa in a Jabiru UL registered ZU-FIC. The pilot reported that twelve minutes into the flight the aircraft started to lose airspeed. The pilot then set the power to idle and observed the propeller detach from the engine. During the subsequent forced landing in a cane field, the right main wheel broke off. The aircraft then veered to the right and impacted an embankment at which point the nose gear collapsed. The pilot and passenger both sustained minor injuries while the aircraft sustained substantial damage. The South African Civil Aviation Authority (SACAA) commenced an investigation.
As Australia is the State of Design of the aircraft, the ATSB requested to be appointed as an accredited representative to the SACAA investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the SACAA. To facilitate support to the SACAA investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.
The CAA have released the final report into this investigation. Any enquires relating to the investigation should be directed to the SACAA at: http://www.caa.co.za/Pages/Default.aspx
On 20 May 2017, an Airbus A380-842 aircraft, registered VH-OQG, was operating Qantas flight QF 94, from Los Angeles International Airport (LAX), United States, to Melbourne, Victoria. The aircraft departed from runway 24 left (24L) at LAX at about 0542 coordinated universal time (UTC),[1] at the maximum take-off weight of 569 tonnes.
The flight crew comprised the captain, the first officer and two second officers.
The aircraft was cleared by air traffic control (ATC) to climb to flight level (FL) 320.[2] After reaching that level, the captain and a second officer (SO2) left the flight deck for the crew rest area. The first officer then took over as pilot flying (PF) and the other second officer (SO1) was pilot monitoring (PM).[3]
About two hours after departing LAX, the flight crew requested and received ATC clearance to climb to FL 340. The flight crew commenced the climb and increased the thrust on all four engines to 93 per cent ‘N1’[4].
As the aircraft passed FL 325, the crew on the flight deck heard a loud bang and felt a sudden and unusual vibration of the aircraft, which reduced significantly after about 2 seconds. The first officer noticed No. 4 engine’s N1 was much lower than the other three engines – at about 49 per cent (although the flight data showed about 71 per cent N1). The captain, who was in the crew rest area, heard the bang and felt the vibration so he returned to the flight deck.
Flight data showed that as the aircraft passed FL 325, the No. 4 engine intermediate pressure turbine experienced an overspeed and its N2 increased from 92 per cent to the redline limit of 98.5 per cent over the next 2 seconds. An electronic centralised aircraft monitoring (ECAM) ‘ENG 4 N2 OVER LIMIT’[5] message and master warning appeared for 2 seconds.
The SO1 and first officer saw an ECAM message flash up but it disappeared before they could read it.
Shortly after, an advisory message (ADV) appeared on the engine warning display and 6 seconds later the message ‘ENG 4 NORM MODE FAULT’ appeared on the ECAM, along with the associated checklist, a single chime and illumination of the master caution. The ECAM message indicated that there was a problem with the full authority digital engine control (FADEC) of that engine. That fault was triggered by the automatic reversion of the FADEC of engine 4 to alternate mode, caused by the loss of air data or engine sensing parameters.
The flight crew actioned the ECAM first because it had a higher priority than the advisory message[6].
There were only two items on the ECAM checklist. The first required the flight crew to select the switch to set the FADEC to alternate mode for all engines. The second item was to set the autothrust as required (the autothrust was already at an appropriate setting). After completing those two actions, the ECAM message cleared and there were no other ECAMs at that stage.
The first officer received an interphone call from a cabin crewmember in the forward main galley reporting a bang and feeling vibrations. He then received a second interphone call from the cabin crewmember in the main economy galley, reporting that a passenger had seen flames and sparks coming from the right outboard engine.
As the flight crew finished actioning the engine 4 normal mode fault ECAM checklist, the captain arrived on the flight deck, about 60 to 90 seconds after he had heard the bang. The SO1 made the required callout to the first officer when the aircraft was 1,000 ft below FL 340, then swapped out of the captain’s seat. The first officer briefed the captain on the events, and the captain resumed the PF role from the left seat and the first officer became the PM.
The SO1 received multiple calls from cabin crewmembers advising that the aircraft was vibrating in an unusual way, and some had seen sparks and flames. The flight crew found this information very useful because at that stage they had no indication on the flight deck of engine fire.
The flight crew investigated the cause of the ADV message and found that the N1 vibration signal for engine No. 4 indicated 10 units, which was the maximum value.
At about 0724, the aircraft levelled off at FL 340 and the flight crew commenced the abnormal checklist for high engine vibration. According to the flight data, at 0726:17, the flight crew reduced the thrust on engine No. 4 to idle (then generating around 24 per cent N1).
At 0726:44, the engine fire warning ‘ENG 4 FIRE’ ECAM message displayed. The flight crew did not finish the high vibration checklist because the engine fire warning had the highest priority and the flight crew actioned the associated checklist. At 0727:02, the flight crew selected the No. 4 engine master switch off, then pushed the engine No. 4 fire button and discharged one fire retardant agent. The engine fire ECAM cleared.
With the No. 4 engine shut down, the flight crew discussed their options. The aircraft was short of the equal time point between Los Angeles and Honolulu and the weather at both airports was suitable for a diversion, so the crew decided to return to Los Angeles.
The SO1 spoke to the company (Qantas) maintenance watch about the aircraft’s status and to the integrated operations centre about the return to Los Angeles. He also sent a message via the aircraft communications addressing and reporting system (ACARS) advising the company of the engine fire and that they were returning to LAX. The first officer declared a PAN[7] and requested ATC clearance to descend initially to FL 300 and later to FL 290, advising they had shut down an engine and required a diversion to LAX. Air traffic control cleared the aircraft to return to LAX, which was about 2 hours away.
The captain made a public address to the cabin crew and passengers stating that they had an engine issue and had shut down one engine, and were returning to Los Angeles.
There was a light easterly wind at LAX, which would mean a tailwind on runway 25L of about 3 kt. Despite this, the flight crew assessed that it was preferable to land on runway 25L than runway 07 right (07R). This was because of sand dunes and a relatively dark area on the approach to 07R and, more significantly, because autoland[8] is not permitted on runway 07R. They therefore planned for an autoland on runway 25L at a landing weight of about 500 tonnes, and this was programmed into the flight management system. The FO and captain discussed the autobrake setting and elected to set autobrake 2.
When the flight crew received the next weather update, there was an indication of a 5 to 6 kt tailwind on runway 25L. They reworked the landing calculations and found that there was still sufficient margin available on runway 25L as their preferred runway for autoland. They decided, however, to jettison fuel down to a landing weight of 461 tonnes, which gave them a safety margin of 860 m runway length.
At 0944, the fuel jettison was completed over water prior to crossing the coast, about 140 NM from LAX.
The flight crew conducted a normal approach and autoland landing onto runway 25L at about 0956.
During the landing roll, as the aircraft decelerated to 80 kt, the captain deselected autobrake and used the full length of the runway to gradually stop the aircraft. After receiving ATC clearance, the captain taxied the aircraft to the parking bay escorted by airport firefighting services.
The maximum brake temperature recorded was 535 °C, within the normal range. As such, there was no requirement for an emergency disembarkation and the passengers and crew disembarked at the gate.
Communication between cabin crew and flight crew
If the cabin crew have concerns about something that potentially affects the safety of the flight, they should immediately contact the flight deck. According to the flight crew, the cabin crew had provided timely and vitally important information to them, particularly regarding flames and sparks that the flight crew had not known about.
However, due to the number of cabin crewmembers located in different places on the aircraft, several calls were made to the flight deck. The flight crew’s priority at the time was to respond to the fire warning, so they were unable to respond to all of the calls immediately. When the captain tried to contact the flight deck on the interphone after hearing the bang, it was engaged due to the cabin-flight deck communications.
Engine vibrations
The first officer indicated that unlike his experience of Boeing aircraft, where there was a hard limit for engine vibration, they did not get an ECAM generated for the high vibration. According to the captain, flight crew are trained to strictly adhere to ECAM protocols. The high engine vibration procedure was part of the abnormal procedures menu and not presented as an ECAM. Therefore, the FADEC ECAM had higher priority than the high vibration advisory, and the crew did not shut down the engine until the engine fire warning ECAM required this action.
The flight crew operating manual (FCOM) stated that the ECAM vibration advisory is mainly a guideline to monitor the engine parameters and does not call for an immediate engine shutdown. The FCOM also states that high N2 vibrations can occur with or without airframe vibrations and that flight crew should cross-reference other engine parameters in order to determine the required course of action.
Airbus provided the following rationale for the procedure to be followed by flight crew for engine vibrations:
The advisory message blinks when there is an abnormal vibration, that is, when N1 or N2 exceed 5 units.
When the advisory illuminates, flight crew can check the associated ECAM Not Sensed procedure ENG HI VIBRATIONS, which recommends monitoring engine parameters and reducing thrust if possible to maintain vibration level below the advisory threshold.
If vibration is still above the advisory threshold, the decision to shut down the engine is left to the crew – the checklist item states ‘ENG (AFFECTD) MASTER OFF…CONSIDER.’
Autoland and fuel jettison
The A380 is designed so that it can return immediately to the runway from where it departed, and the runway distance will be sufficient to land. The aircraft was certified to autoland at maximum take-off weight. It had taken off from LAX at the maximum take-off weight of 569 tonnes.
Jettisoning fuel enables the flight crew to reduce the aircraft weight to about 440 tonnes. The flight crew elected to jettison fuel to increase the safety margin with the tailwind on the preferred runway.
A prime consideration for an overweight landing is minimisation of the rate of descent on touchdown, where possible to less than 300 ft per minute. Autoland is recommended to reduce the rate of descent on touchdown, and it allows a more consistent approach profile. With one engine shut down, the attitudes, speeds and thrust settings differ from the normal landing phase. The autoland manages those settings and allows the flight crew to monitor the aircraft more effectively.
The overweight landing auto-generates a report that includes touchdown weight and descent rate. After landing in LAX, engineers performed the diagnostic checks and found the touchdown rate of descent was within the limits and the aircraft was wings level at touchdown.
The reduced weight also lessened the risk of hot brakes and wheel fires, and would improve performance in case a go-around was required.
Engineering inspection
Initial engineering inspection of the No. 4 engine following the incident found damage to the low‑pressure turbine blades. There was no visible indication of fire and the event was contained, such that there was no breach of the engine casing. There was minor damage to the right flap and flap fairing from debris exiting the rear of the engine.
Safety analysis
Engine manufacturer investigation
Rolls-Royce, the manufacturer of the aircraft’s Trent 900 engine, conducted an investigation into the engine failure that caused the shutdown.
A teardown of the engine found internally-corroded low-pressure turbine stage 2 (LPT2) blades. The corrosion led to fatigue cracking and subsequent release of blade shroud debris, resulting in significant downstream engine damage.
The corrosion resulted from chemical residue in the hollow blades from cleaning operations at the last service (July 2015). Consequently, Rolls-Royce conducted a thorough audit of cleaning operations and took additional safety action (see Safety action section).
Fire
The fire and overheat detection system was assessed in an attempt to determine the cause of the fire warning. No issues were identified and the fire/overheat detector assemblies were removed and returned to the vendor for further assessment.
The detector manufacturer identified wear in the unit that would have made it more sensitive to vibration and increase the chance of spurious warnings. Rolls-Royce assessed that it was very likely that the wear, coupled with the vibrations associated with this event, contributed to the spurious fire warning.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Internal corrosion of low-pressure turbine stage 2 blades resulted in fatigue failure and separation of blade debris and downstream damage through the engine.
The blade corrosion resulted from chemical residue associated with the cleaning procedure used during the last engine service.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
Rolls-Royce
Rolls-Royce, the engine manufacturer has advised the ATSB that it has taken the following safety actions as a result of this occurrence:
Twelve other engines with blades potentially affected by the cleaning process were identified for removal from service under Rolls-Royce Alert non-modification service bulletin (NMSB) RB.211-72-AJ933. At least five engines had been removed at the time of publication of this report.
Stage 5 low pressure turbine blades that had been exposed to the same processing corrosion issue were also identified. As a result, Rolls Royce drafted an additional, recommended NMSB to address engines with exposed Stage 5 blades installed.
Blade overhaul cleaning operation instructions were revised, with additional detail to incorporate best practice with respect to removal of process solutions and chemical residues. This included modifying the orientation and support of the blades during the cleaning process and pressurised water flushing of aerofoil cavities after cleaning to ensure removal of residual cleaning compounds. The rationalised best practice has been applied at all facilities that conduct cleaning of Trent 900 Stage 2 low pressure turbine blades.
Blade serial numbers are to be marked at the root so they are easily identified in future instead of at the tip where shroud losses more commonly occur.
The engine manufacturer distributed an internal safety alert report to highlight the potential issue that could affect other Rolls-Royce engine types.
European Aviation Safety Agency
The European Aviation Safety Agency released Airworthiness Directive (AD) 2018-0121, effective June 2018, relating to the potential for blade corrosion due to residual cleaning contaminants. The AD mandated replacement of the affected blades in accordance with the Rolls-Royce NMSB RB.211-72-AJ933.
Safety message
This incident highlights the importance of reviewing maintenance processes to ensure best practice is followed.
The incident is also an example of effective crew resource management techniques. The flight crew reported that their actions and response, from the initial engine issue when only two members of the flight crew were in the cockpit to the approach and landing with all four crewmembers on the flight deck, flowed very smoothly. They also felt that their collaborative decision-making was excellent and that the highly experienced second officers provided valuable support to the flying pilots.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 13 May 2017, a Jetstar Airways Boeing 787-8 aircraft, registered VH-VKA, was being operated on a scheduled passenger service from Singapore Changi Airport, Singapore to Melbourne, Victoria. There were two flight crew, nine cabin crew and 231 passengers on board. The captain was designated as the pilot monitoring and the first officer (FO) was the pilot flying.[1]
At about 1325 Coordinated Universal Time (UTC),[2] the aircraft was pushed back from the departure gate at Singapore and the flight crew received taxi instructions for a departure from runway 20 Centre (20C). After a short taxi, the aircraft was lined up for departure at about 1332. The flight crew had set flaps 5 for departure with a calculated rotation speed (VR) [3] of 169 kt at the take-off weight of 191 t. Their planned acceleration altitude was 3,000 ft (the altitude at which the flaps would be retracted from flaps 5 to flaps 1).
The flight crew received air traffic control instructions for a standard instrument departure and the aircraft departed. At about 3,000 ft the FO called for flaps 1 and the captain set the flap lever to the flaps 1 setting. The flight crew then received an engine-indicating and crew-alerting system caution for FLAPS DRIVE, which indicated a fault with the wing flaps. The captain notified air traffic control of the fault, received a clearance to level the aircraft at 6,000 ft and completed the FLAPS DRIVE fault checklist actions. The aircraft entered a holding pattern at 6,000 ft and the captain elected to assume the role of pilot flying after the decision was made to return to Singapore.
While in the holding pattern, the flight crew completed their failure management briefing and briefed the cabin crew manager about the occurrence and their plan. The captain then made a public address to the passengers to inform them of the need to return to Singapore due to a technical issue with the flaps. The FO contacted the company to report their intentions, calculated the reference landing speed (VREF)[4] as 195 kt[5] at about 188 t[6] with flaps 1 selected and briefed the arrival procedure. The captain elected not to jettison excess fuel due to their proximity to other aircraft in the holding pattern, the landing distance required provided a sufficient safety margin, and the fact that the checklist did not require it.
The aircraft landed without incident and was taxied to the gate with emergency service vehicles in attendance. The captain noted on the engine-indicating and crew alerting system that there was a high brake temperature on one of the right landing gear brakes after landing and reported this to the engineering staff after shutdown. Before the flight crew exited the aircraft an engineering staff member entered the flight deck to report that they found damage to the left wing. This was followed by a report from a ground handling staff member that rubber debris was found on runway 20C (Figure 1). The captain annotated the FLAPS DRIVE fault and overweight landing with a ‘positive’[7] touchdown in the aircraft technical log.
Figure 1: Tyre debris on runway 20C
Source: ATSB (debris field locations courtesy Transport Safety Investigation Board, Singapore)
Aircraft flaps
The aircraft is fitted with inboard and outboard trailing edge flaps, and leading edge slats on each wing (Figure 2). The trailing edge flaps are used in conjunction with the leading edge slats to increase lift at lower speeds. The flap positions for the 787-8 are 0, 1, 5, 15, 20, 25 and 30 units. Take-off settings are 5, 15 and 20. Normal landing settings are 25 and 30.
Power to move the flaps is provided by hydraulic or electric motors on a power drive unit (PDU), which turns flap torque tubes, which in turn operate geared rotary actuators (Figure 3). The geared rotary actuators extend or retract the flaps with their drive arms. The aircraft’s flight control electronics cabinets monitor the position of each section of flap for misalignment using four flap skew sensors. The flight control electronics cabinets shut down the flap drive system and send an engine-indicating and crew-alerting system message (FLAPS DRIVE) if a flap asymmetry is detected.
The Boeing 787 flight crew operations manual indicated that the annunciation of FLAPS DRIVE is for a flap drive mechanism failure. Alternate flaps should not be used as asymmetry protection will not be provided. The ground proximity warning system should be set to flap override (to prevent nuisance warnings of incorrect flap configuration during the approach). The manual also stated that the flight management computer fuel predictions should not be used in this condition. If the fault occurred at flaps 5 or less, then the flap lever should be set to flaps 1 to ensure the slats are extended (Figure 2 and 3) and use the VREF for flaps 30 plus 40 kt for landing.
Flight data recorder
The flight data recorder provided the following key events (Table 1).
Table 1: Key events from the flight data recorder
Time
Event
13:35
Aircraft became airborne at about 180 kt
13:36
Flap lever set in flaps 1 detent – flaps not in commanded position – leading edge/trailing edge surfaces in motion (about 3,500 ft pressure altitude)
13:36
Flap asymmetry detected – flap drive system shutdown
13:36
Flaps drive fault message (flap lever remains in flaps 1 position until after landing)
13:38
Ground proximity warning system flap override set
14:16
Touchdown at about 190 kt
Aircraft damage
Inspection of the aircraft found the number 6 wheel tyre tread had delaminated (Figure 4). Damage to the airframe included the left inboard wing panel (above the number 6 wheel) was punctured (Figure 5 left), an area of the trailing edge of the left inboard flap was cracked, and the left inboard flap torque tube was broken (Figure 5 right). A broken torque tube will interrupt the flap drive system for flaps outboard of the break. Consequently, a change in the flap setting will trigger a misalignment between the flap skew sensors.
Figure 4: Number 6 wheel tyre (left picture looking forward and the right looking rearwards)
Aircraft tyres are designed for intermittent operation in which they are accelerated to high speeds in short periods of time. While the acceleration of the tyre is higher on landing, the take-off speed is usually higher compared to landing. The sudden periods of acceleration generate high temperatures and centrifugal forces, and, because the tyre is pneumatic, this leads to compression, tensile and shear forces. Deflection of the tyre tread from contact with the runway surface distorts the tyre from the normal shape and sets up a traction wave in the tread. This leads to higher tensile forces on the outer plies than on the inner plies, which generates shear forces between the layers of ply (Figure 6). Aircraft tyres have a groundspeed rating, which was 235 MPH (about 204 kt) for the occurrence aircraft tyre.
Figure 6: Generic tyre construction
Source: Michelin
Damaged tyre
The damaged tyre was Michelin part number M42202 for the Boeing 787, which was a replacement for the previous M42201. The damaged tyre and the number 5 wheel tyre (mate tyre) were returned to the tyre manufacturer for tyre analysis. The manufacturer’s report noted that 360° of tread was missing and the reinforcing plies were exposed and abraded in areas (Figure 7 left). There was shoulder step-wear and a crack along the serial side[8] shoulder (outboard of main landing gear truck) that had propagated through the tread reinforcing ply. There were no indications of rolling under low pressure.
Figure 7: Number 6 wheel tyre (left) and number 5 wheel tyre (right)
Source: Michelin, modified by the ATSB
The manufacturer’s report concluded that the shoulder step-wear allowed for a raised tread rib, which was subjected to a lateral force strong enough to tear the tread rubber with continued use. The cracking ‘propagated through the tread reinforcing ply and generated the thrown tread as the consequence’ (Figure 7 left). The number 5 wheel tyre was found with cracking on the opposite serial side shoulder (inboard of main landing gear truck), which had started to propagate through the tread reinforcing ply (Figure 7 right). They concluded that chevron cutting around the tread of both tyres indicated that they had been operated on an aggressive runway surface.
When asked to clarify the reference to an ‘aggressive runway surface’, the manufacturer indicated that chevron cutting is linked to grooved runways. The forces required to accelerate the tyre to ground speed during the touchdown phase generate a tearing action, which results in the chevron cutting damage.
Tyre maintenance
The number 6 wheel tyre was received by the operator as a new tyre with a Civil Aviation Safety Authority authorised release certificate, dated 30 November 2016. The wheel assembly was installed on VH-VKA on 9 December 2016 and had accumulated 302 cycles at the time of the failure. The maintenance program inspection interval for the tyres included a general visual inspection on each arrival. The replacement interval for the tyre was ‘on-condition’.[9] The number 5 wheel tyre had accumulated 307 cycles at the time of the incident. Both tyres were below the average life for the operator’s use of these part numbers. The operator reported that this was their first occurrence of a tyre delamination on its 787 fleet.
On arrival at Singapore Changi Airport from the previous flight, the aircraft was subjected to an arrival check and a pre-departure service check. The checks were certified as satisfactory and completed at 1145 UTC. Item 1.2 on the arrival check included:
Inspect (General Visual) the Nose and Main Wheel Tyres IAW DMC-B787-A-32-45-04-00B-311A-A
Note: Ensure tyres have a sufficient life remaining for the intended flight/s, including the return to an Australian Port.
Item 1.1 of the pre-departure service check included an inspection of the nose and main wheels and tyres. However, this check was not required to be performed if the same maintenance person performed the arrival check within the previous 120 minutes and was certifying for both checks. Both checks had the same certifying person’s signature and stamp. The operator reported that the certification for the pre-departure service check was likely an acknowledgement that the tyre check was not required, rather than that it was performed.
The checks took place between 0910 and 1145. Sunset in Singapore on 13 May 2017 was about 1106.
The aircraft maintenance manual task (DMC-B787-A-32-45-04-00B-311A-A) for the general visual inspection of the tyres included the following instructions:
1. C. (1) (a) Examine the tyres for air leaks, abrasions, unusual worn areas, cuts, and flat spots.
1. C. (1) (c) Remove tyres that have the conditions that follow:
- 1) Cuts or weather cracks in the grooves, the tread, shoulders or sidewalls that exceed the limits shown in Figure 2, Tyres General Visual Inspection.
- 2) Blisters, bulges, or other signs of ply separation in the tread, shoulder or the sidewall area.
Michelin’s care and service instructions
Michelin’s aircraft tyre care and service manual, chapter 5, section 8.17 described a ‘thrown tread’ as the ‘partial or complete loss of the tread rubber.’ Potential causes include cuts. The manual stated:
Early signs of separations of internal components may appear as bulges, uneven wear, or localised rubber splits. It is important to remove tyres from service when any evidence of separation is first seen. During high-speed rotation, even small areas of separation can grow into partial or full tread rubber loss.
Chapter 5, section 7.2 indicated ‘removal criteria for normal wear is based on remaining tread rubber as determined by groove depth or exposure of textile/steel ply material’.
Operator’s flight data review
A comprehensive review of flight data was conducted to determine if operational techniques, such as lateral acceleration on take-off and touchdown, may have exposed the tyre to increased side load. No occurrences were noted for any of the operator’s aircraft in the 787 fleet.
Safety analysis
The flap drive fault the flight crew received on departure from Singapore Changi Airport was the result of the delamination of the number 6 wheel tyre tread during take-off. The airport operator found two debris fields on runway 20C, which was used for the take-off and landing. The delamination on take-off likely occurred at the southern end of the runway, when the tyre was at high speed, which provided sufficient energy for the tread to penetrate the left under wing panel and break a flap torque tube. The runway 20C northern debris field was likely the result of further tyre delamination on landing as a result of the touchdown and wheel acceleration.
The tyre manufacturer concluded that the tyre had operated over its life on a grooved runway surface, which generated chevron cutting damage. Before departure the aircraft tyres were certificated as inspected in accordance with the aircraft manufacturer’s general visual inspection requirements. While no faults were recorded for the arrival and pre-departure service checks, it was possible that the tyre shoulder was already subject to undercutting of the tread before departure. The arrival inspection likely occurred during daylight hours, but the aircraft may have been parked with the tyre tread positioned such that the initiation site was not visible to the inspector. However, this was not confirmed by the ATSB. However, the certification for the pre-departure service check was likely an acknowledgement that the tyre check was not required, rather than that it was performed.
When the flight crew moved the flap selector from the flaps setting of 5 to 1, the left inboard and outboard flaps were unable to move, due to the broken torque tube. The right flaps started to move, which generated a flap misalignment signal. The flight control electronics cabinets shut down the flap drive system in response to the misalignment and generated the FLAPS DRIVE fault message. The flight crew then completed the FLAPS DRIVE checklist. While the crew did not know about the tyre damage, the aircraft protective systems and crew actions allowed for a safe return and landing, despite the aircraft being overweight and at a higher-than-normal landing speed.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The number 6 wheel tyre experienced shoulder step-wear, which led to cracking and undercutting of the tyre tread and a subsequent delamination of the number 6 tyre, which occurred in less than the normal average life cycles.
Debris from the delaminated tyre penetrated the left under wing panel and damaged the flap torque tube, resulting in an asymmetric flap condition when the flaps were commanded to retract.
When retracting the wing flaps, the crew received a flap drive fault indication, which resulted in a return to the departure airport and a high-speed overweight landing.
Following the damage to the flap torque tube, the aircraft protective systems operated as designed and the flight crew completed the checklist as published.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they have taken the following safety action:
Quality notice
The operator issued a quality notice to their maintenance line stations and external maintenance organisations on the subject 787 Main Landing Gear Tyre Inspections (Shoulder Wear). The notice explained the incident and highlighted the inspection and tyre replacement requirements for tyre shoulder damage.
Flight standing order
The operator issued a flight standing order to their 787 pilots on the subject of Tyre Wear to highlight the shoulder area of the tyre as requiring extra attention during pre-flight inspections.
Safety message
Following the flaps drive fault message, the flight crew completed the appropriate checklist and landed at the nearest suitable airport without further incident. While the condition of the tyre and the exact fault with the flaps were unknown to the flight crew at the time of their decision-making, this occurrence highlights the importance of following failure management procedures.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 April 2017, a Qantas Airways Boeing 747-438, registered VH-OJU, was operated as scheduled passenger flight QF29 from Melbourne, Victoria, to Hong Kong International Airport, in the Hong Kong Special Administrative Region of the People's Republic of China. On board were 17 crew and 347 passengers.
While descending toward Hong Kong International Airport, air traffic control instructed the flight crew to hold at waypoint BETTY.
When entering the holding pattern, the aircraft’s aerodynamic stall warning stick shaker activated a number of times and the aircraft experienced multiple oscillations of pitch angle and vertical acceleration. During the upset, passengers and cabin crewmembers struck the cabin ceiling and furnishings.
A lavatory smoke alarm later activated, however, the cabin crew determined the smoke alarm to be false and silenced the alarm. The aircraft landed at Hong Kong International Airport without further incident. Four cabin crewmembers and two passengers suffered minor injuries during the incident and the aircraft cabin sustained minor damage.
What the ATSB found
The ATSB found that while planning for the descent, the flight crew overwrote the flight management computer provided hold speed. After receiving a higher than expected hold level, the flight crew did not identify the need to re-evaluate the hold speed. This was likely because they were not aware of a need to do so, nor were they aware that there was a higher hold speed requirement above FL 200. Prior to entering the hold, the speed reduced below both the selected and minimum manoeuvring speeds. The crew did not identify the low speed as their focus was on other operational matters.
The ATSB also found that due to a desire to remain within the holding pattern and a concern regarding the pitch up moment of a large engine power increase, the pilot flying attempted to arrest the rate of descent prior to completing the approach to stall actions. In addition, the pilot monitoring did not identify and call out the incomplete actions. This resulted in further stall warning stick shaker activations and pilot induced oscillations that resulted in minor injuries to cabin crewmembers and passengers.
Additionally, the operator provided limited guidance for hold speed calculation and stall recovery techniques at high altitudes or with engine power above idle. This in turn limited the ability of crew to retain the necessary manual handling skills for the recovery.
What’s been done
In response to the occurrence, the operator updated flight crew training lesson plans and commenced retraining of flight crew in more complex stall recovery events. The operator also amended the Boeing 747-400, 787 and 737 flight crew training manuals and updated flight crew ground school lesson plans to ensure standardisation of training.
Safety message
Balancing competing attention or decision demands can interrupt trained flight crew responses leading to procedures not being completed in full, particularly so if flight crews are not receiving comprehensive and regular training in the application of these skills.
Comprehensive theory and practical training can ensure that flight crews have a complete understanding of aircraft systems and maintain effective manual handling skills. This training should provide flight crew with the knowledge to correctly configure the aircraft’s automatic flight systems and manual handling skills to respond adequately to in-flight upsets.
The occurrence
On 7 April 2017, a Qantas Airways Boeing 747-438, registered VH-OJU, operated as scheduled passenger flight QF29 from Melbourne, Victoria, to Hong Kong International Airport, in the Hong Kong Special Administrative Region of the People's Republic of China. On board were 17 crew and 347 passengers. The captain operated as pilot flying and the first officer as pilot monitoring.[1]
At about 1745 Hong Kong Time (HKT),[2] in daylight, the aircraft descended toward waypoint[3] BETTY (Figure 1) with the autopilot engaged in lateral navigation (LNAV) and vertical navigation (VNAV) modes,[4] and the autothrottle engaged. As the aircraft descended from flight level (FL) 300,[5] the customer service manager (CSM) (following direction from the flight crew) advised the passengers to prepare for landing and fasten seatbelts, however, at this time, the fasten seatbelt sign was not illuminated.
Figure 1: BETTY 2A standard arrival route chart extract
The figure shows the position of the BETTY hold along with the inbound track of VH-OJU. Source: Hong Kong CAD, annotated by ATSB
The flight crew anticipated that air traffic control (ATC) would direct them to hold at waypoint BETTY, at about FL 150 to FL 160, and they used the aircraft flight management computer (FMC) to plan for the hold. The FMC provided a calculated target hold speed (Figure 2) of 223 kt at FL156, which was the FMC-calculated crossing level at waypoint BETTY. The crew verified this calculated speed by comparing it to the flaps-up manoeuvring speed (see Hold speed below) using a heuristic of adding 80 kt to the flaps-30 landing reference speed of 143 kt, resulting in 223 kt.[6] The captain asked the first officer to input 225 kt above FL 150 as the target hold speed.
Figure 2: Example of the FMC route hold page with the target speed and the best speed highlighted
The FMC route hold page, showing the best speed indication (representative and not indicating incident data). Source: Operator, annotated by ATSB
Prior to crossing BETTY, ATC descended the aircraft from FL 300 in steps. This positioned the aircraft above the planned descent profile. As the aircraft approached BETTY at FL 230, ATC instructed the flight crew to descend to FL 220 and hold at BETTY. The flight crew then entered 22,000 ft in the autopilot altitude selection window, which directed the FMC VNAV function to level at FL 220. However, the flight crew did not adjust the target hold speed in alignment with the higher-than-expected hold level. The flight crew later reported that they were not aware of a higher speed requirement for holding above FL 200.
At this time, service in the aircraft’s forward cabin had been completed. The CSM, along with other cabin crewmembers from the forward sections, moved towards the rear of the aircraft to assist with preparing the rear cabin for landing. This led to more cabin crewmembers than normal being in the rear cabin.
While descending towards BETTY, the aircraft’s speed reduced below both the target speed of 225 kt and the minimum manoeuvring speed, which was indicated on the pilot’s flight display (PFD) as the top of an amber band (see Figure 5 in Operational information below).
At this time, the captain was reviewing the Hong Kong approach documentation and the first officer was looking out to the right of the aircraft in an attempt to identify aircraft traffic in the vicinity of the holding pattern. As a result, the captain and first officer did not identify the reducing speed. The second officer later reported observing the speed reducing close to, but not below, the selected speed of 225 kt.
At 1747:42, the flight data showed that the aircraft crossed BETTY at a speed of 222 kt, while descending through FL 227, with engine power at idle. The aircraft then began a right turn to enter the holding pattern. While still turning, the aircraft descended through FL 222 and the pitch angle[7] began to increase as the autopilot prepared to level the aircraft at FL 220. Three seconds later, at 1747:59, the aircraft’s bank angle increased to a maximum of 32 degrees, its speed reduced to 220 kt and the aircraft began experiencing pre-aerodynamic stall buffeting.[8] The flight crew reported the stick shaker also activated, although the recorded flight data does not show a stick shaker activation at this time. The captain also later commented that he did not recall seeing the stall warning indication approaching the indicated speed on the PFD (see Stall warning activation speed below).
After the onset of the buffeting, flight data shows the autopilot was disconnected, most likely by the captain. The captain then pushed forward on the control column to reduce the aircraft’s pitch angle and reduced the aircraft’s bank angle. Due to a desire to remain within the protected airspace of the holding pattern, the captain did not roll to wings level as recommended by the operator’s approach to stall recovery procedure (see Figure 7 in Stall warning recovery procedure below). The captain also did not disconnect the autothrottle as required by the procedure, however, he manually advanced the thrust levers. Due to concerns regarding an excessive increase in pitch resulting from a large power increase,[9] he increased the engine power from about 37 per cent to about 73 per cent N1.[10]
The first officer observed the captain’s actions and was satisfied that the appropriate actions had been undertaken. He did not identify, and therefore did not call out, that the stall recovery procedure had not been completed. As a result of the captain’s actions, the aircraft accelerated slightly, the buffeting stopped and the aircraft continued descending.
Six seconds later, at 1748:05, the aircraft descended through FL 220, the speed increased to the selected 223 kt and the thrust reduced. At the same time, the captain pulled back on the control column to increase the pitch angle to prevent further descent. Four seconds later, the stick shaker activated. In response, the captain again pushed forward on the control column to reduce the aircraft’s pitch angle and increased thrust slightly. The stick shaker deactivated and the aircraft continued descending. As the aircraft descended through FL 218, the captain pulled back on the control column to increase the pitch angle and the stick shaker again activated. In response, the captain again pushed forward on the control column to reduce pitch angle and the stick shaker deactivated. At about this time, the seatbelt sign was selected on.
Over the next nine seconds, the captain disengaged the autothrottle, increased power to greater than 90 per cent N1 and increased the selected speed to 252 kt. The oscillations reduced and the aircraft continued accelerating.
At 1748:31, the aircraft levelled off at FL 214 and the speed was increasing through 238 kt toward the selected speed. At about this time, the first officer alerted the captain that the aircraft had descended below the cleared level. In response, the captain asked the first officer to request a lower level from ATC, who immediately cleared the flight crew to descend to FL 210. The autopilot was then re-engaged in VNAV and LNAV modes with 21,000 ft in the altitude window of the mode control panel. However, as the altitude selector was not activated, 22,000 ft remained as the commanded altitude and the aircraft commenced climbing to FL 220.
As the aircraft climbed, ATC contacted the flight crew to confirm that they were descending to FL 210. The flight crew confirmed that they were descending and activated the 21,000 ft altitude selection. The aircraft then descended to FL 210 and re-joined the BETTY holding pattern. During the event, there was no loss of separation with any aircraft.
During the pilot-induced oscillations, the CSM, who was standing in the left aisle in the vicinity of rows 63 and 64 (Figure 3), struck the cabin ceiling before falling on a seat armrest, sustaining injuries. Five other cabin crewmembers also struck the ceiling, with three sustaining injuries. A passenger located in an L5 lavatory struck the cabin ceiling landing on the lavatory seat, resulting in minor injuries and damage to the lavatory fittings. A passenger in seat 63C who did not have her seatbelt fastened, was also injured.
Figure 3: VH-OJU main deck layout
The figure shows the aircraft main deck layout. The locations of the injured cabin crewmembers, injured passengers and L5 and R5 lavatories are identified. Source: Operator
After the aircraft stabilised, the CSM was alerted to the injured passenger in the L5 lavatory. The CSM provided assistance to this passenger and then conducted the call back procedure.[11] During the call back procedure, cabin crew advised the CSM of further injured passengers and cabin crewmembers.
As the aircraft tracked on the outbound leg of the holding pattern, the lavatory smoke alarm activated and the flight crew received a lavatory smoke alarm warning. The captain asked the first officer to request a priority landing from ATC. ATC immediately cleared the flight directly to Hong Kong International Airport.
The cabin crewmembers established that the smoke alarm originated at the R5 lavatories and that there was no evidence of smoke, fire or fumes. The CSM reported to the flight deck that they believed the smoke alarm to be a false alarm caused by the lavatory damage.
While approaching Hong Kong International Airport, the smoke alarm activated a further six times. The cabin crewmembers determined that these alarms were also false. The aircraft landed without further incident.
Four cabin crewmembers and two passengers received minor injuries during the incident and the aircraft cabin sustained minor damage.
The captain held an Air Transport Pilot Licence (Aeroplane), a multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. The captain had over 24,000 hours of flying experience, of which over 10,000 hours were on the Boeing 747.
First officer
The first officer held an Air Transport Pilot Licence (Aeroplane), a multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. The first officer had over 16,000 hours of flying experience, of which over 5,000 hours were on the Boeing 747.
The investigation assessed whether the captain or first officer were experiencing a level of fatigue known to have an effect on performance. The ATSB found no indicators that increased the risk of either crew experiencing this level of fatigue.
Second officer
The second officer held an Air Transport Pilot Licence (Aeroplane), a multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. The second officer had over 8,000 hours of flying experience, of which over 5,000 hours were on the Boeing 747.
Meteorological information
As the aircraft entered the holding pattern, the aircraft recorded wind direction was 268°M and speed was 41 kt. The flight crew reported visual meteorological conditions with slight haze prevailed at the time of the occurrence.
The flight crew also reported experiencing smooth conditions prior to, and throughout, the event. There was little to no recorded turbulence. The ATSB therefore concluded that turbulence did not contribute to the pre-aerodynamic stall buffeting or stick shaker activations.
Aircraft information
Autopilot holding with LNAV/VNAV active
When holding with LNAV active, the FMC tracks the holding pattern targeting a 25-degree bank angle up to a limit of 30 degrees of bank angle. The FMC computes holding patterns with constant radius turns based on the current wind and commanded speed.
The aircraft tracked 317°M as it crossed BETTY (Figure 4) and began a right turn, through a total of 207°, to track 164°M for the outbound leg of the pattern.
As the aircraft turned, the wind direction moved to a relative position behind the aircraft, increasing the aircraft’s ground speed. The increased ground speed required a greater bank angle to achieve the targeted turn radius and outbound track spacing. The first officer also later commented that when the holding entry required a turn in excess of 180°, the autopilot would initially command a bank greater than 30 degrees.
The aircraft manufacturer commented that the autopilot has the capability to increase bank angle beyond the FMC commanded angle. The manufacturer further commented that it was not unusual that the increasing ground speed led the autopilot to increase bank angle with an overshoot up to 32 degrees to achieve the FMC target turn radius and outbound track spacing.
Figure 4: BETTY holding pattern
The figure shows the BETTY holding pattern along with the recorded wind conditions, the approximate track of VH-OJU as it entered the holding pattern and the locations of the buffet/stick shaker occurrence and first smoke alarm. Source: Hong Kong Civil Aviation Department, annotated by ATSB
Operational information
Hold speed
The FMC calculated target hold speed and target level are based on the aircraft’s gross weight and programmed VNAV descent profile (see Figure 2). Below FL 150, this speed is based upon the flaps 30 landing reference speed with the addition of a speed increment. The speed increment varies with aircraft weight and is designed to provide a manoeuvre margin[12] equivalent to a level turn at 40 degrees angle of bank or 1.3 G of vertical acceleration.
Above FL 200, the FMC calculated hold speed corresponds to the minimum drag speed.[13]
Between FL 150 and FL 200 the FMC target hold speed is calculated using a linear interpolation between the speeds calculated for FL 150 and FL 200.
The FMC also calculates best speed, which is displayed on the hold page (see Figure 2). The operator’s flight crew operations manual (FCOM) contained the following guidance on the best speed function on the hold page of the FMC:
Displays best holding speed for airplane gross weight, altitude, and flap setting.
The displayed best speed may be different to the target hold speed in the hold planning stage as the hold may be planned using an altitude different to the current altitude. If no target speed is selected, the FMC will select the best speed.
The aircraft manufacturer provided the following advice regarding the hold speed for this event:
At 22,000 feet, the optimum holding pattern airspeed would have been approximately 240 knots based upon the event gross weight.
For holding when hold speeds are not available from the FMC, the operator’s flight crew training manual (FCTM) provided the following guidance:
Recommended holding speeds can be approximated by using the following guidance until more accurate speeds are obtained from the quick reference handbook:
- Flaps up manoeuvre speed approximates the minimum fuel burn speed and may be used at low altitudes[14] (approximated by adding 80 kt to the calculated flaps 30 landing reference speed)
- If the FMC calculated hold speed is not available, when holding above FL 200 recommended holding speeds can be approximated by adding 100 kt to the calculated flaps 30 landing reference speed.
Following the above guidance would have provided an approximate hold speed of 243 kt.
The programmed VNAV descent profile crossed BETTY at FL 156. The FMC calculated a target hold speed of 223 kt at FL 156 for holding at BETTY. When ATC instructed the flight crew to hold at FL 220, the captain instructed the first officer to input a target speed of 225 kt at or above FL 150 into the FMC.
While hold speed data was available from the FMC, the flight crew were not aware that a different speed was required above FL 200 and used speed data for FL 156 for holding at FL 220.
Flight crew high altitude hold speed knowledge and training
The flight crew reported that in practice they used the flaps up manoeuvring speed and then added an arbitrary buffer when selecting a hold speed. This is contrary to the FCTM guidance, and there was no other operator or manufacturer guidance recommending this procedure or the size of the buffer to be used. The investigation found that the flight crew were not aware of the function, or use of, the best speed in the hold page of the FMC.
The operator provided training for flight crew on holding patterns and speeds during ground school training prior to the commencement of operations on the aircraft type and during recurrent operational training.
The operator reported that there were no documented training exercises where a holding pattern was conducted at high altitude (above FL 200). Holding patterns were generally conducted at lower levels prior to commencing a landing approach.
Minimum manoeuvre speed
The aircraft’s FMC calculated minimum manoeuvre speed provides 0.3 G of margin above the onset of pre-aerodynamic stall buffet. This is equivalent to a level turn at 40 degrees angle of bank or 1.3 G of vertical acceleration.
The minimum manoeuvre speed is indicated by the top of an amber band on the speed tape of the PFD (Figure 6: Figure 5). When operating at a speed within the amber band, reduced manoeuver capability exists.
Figure 5: Representation of the primary flight display as the aircraft crossed BETTY
This figure shows a representative presentation of the primary flight display as the aircraft crossed BETTY, derived from recorded flight data. The minimum manoeuver speed amber band and selected speed bug are annotated. Source: ATSB
Stall warning activation speed
The speed at which the aircraft’s stall warning system would activate was indicated on the PFD as a red dashed line (see Figure 5 above).
This indication was dynamic and moved in accordance with various factors such as aircraft configuration, gross weight and aircraft manoeuvring. This provided the flight crew with a real-time indication of the stall warning activation speed.
Recorded flight data
Flight data was available from the flight data recorder and the quick access recorder.
Figure 6: Graphical representation of quick access recorder data
The figure shows a graphical representation of recorded flight data from stick shaker incident significant points of the occurrence are annotated. Source: ATSB
The aircraft manufacturer reviewed the flight data and determined that during the stick shaker occurrence, the aircraft did not enter a stall. The manufacturer provided the following analysis:
For the 747-400, at the event flight condition, the estimated maximum vane angle of attack before stall is achieved would be approximately five degrees.[15] During this occurrence, the highest recorded vane angle of attack was approximately -0.5 degrees, resulting in significant margin to the estimated maximum vane angle of attack when stick shaker activated.
The recorded data did not show a stick shaker activation at the time the autopilot disconnected,[16] as described by the flight crew. At this time, the recorded vane angle of attack reached a value about 0.3 degrees below the estimated angle for stick shaker activation. However, as the stick shaker activation parameters are recorded at a rate of one sample per second, it is possible that the stick shaker activated momentarily and was not captured by the flight recorders.
The recorded vertical acceleration at the time of the initial buffet and possible stick shaker activation was 1.29 G. The maximum vertical acceleration value recorded during the occurrence was 1.45 G, the minimum recorded value was 0.09 G.
Stall recovery procedures and training
Stall warning recovery procedure
The aircraft was fitted with a stick shaker device to provide warning to the flight crew that the aircraft was approaching an aerodynamic stall. When activated, the stick shaker vibrated both control columns, providing an aural and tactile warning indication.
The operator procedures included the ‘approach to stall or stall warning’ procedure. In case of a stall warning, the procedural steps to be followed are shown in Figure 7:
Figure 7: Approach to stall or stall recovery procedure
Source: Operator
The recorded data showed that during the recovery after the initial buffet and possible stick shaker activation, the captain did not disconnect the autothrottle. While he reduced the bank angle, he did not level the wings or advance the thrust levers as needed to effect recovery. Nor were these actions completed during the second and third recovery attempts.
The autothrottle was not disconnected and the thrust levers were not advanced as needed to effect recovery until the fourth oscillation. After this increase in thrust, speed increased sufficiently for the captain to arrest the descent and stabilise the aircraft without further stick shaker activations.
During the oscillations, the first officer did not identify or call out the incomplete actions, as required by the procedure.
Approach to stall and stall recovery training
The operator provided approach to stall and stall recovery training to flight crew during type conversion training and their recurrent operational training in accordance with manufacturer recommendations and as approved by the Civil Aviation Safety Authority. Each flight crew member had undergone this training on multiple occasions, exposing them to various stall recovery scenarios.
The stall recovery scenario conducted in the most recent exercise was simulated with the aircraft:
configured with landing gear down and flaps 20
positioned on the downwind leg of a circuit (about 1,500 ft above ground level)
weight of 266,000 kg.
During the exercise, a first officer, as pilot flying, closes the thrust levers while in level flight just before turning onto the base leg of the circuit. The crew should recover at first stall indication, using the correct recovery procedure. The exercise was then repeated with the captain as pilot flying.
The captain last underwent this training on 4 April 2017, three days prior to the incident flight. The first officer had last undergone stall recovery training in October 2014 and the second officer in February 2017.
The scenarios all commenced with the crew reducing the engine power to idle prior to the stick shaker activating, and all recoveries were initiated with engine power at idle.
In their internal investigation report, the operator provided the following analysis of the stall recovery training:
The investigation could not find any trained scenarios that approximated the conditions experienced by QF29; that is; stick shaker activation while manoeuvring at altitude. By limiting stick shaker recovery to non-realistic scenarios, with considerable lead in time giving Flight Crew ample opportunity to prepare for the forthcoming manoeuvring, there is limited exposure to the complexity of the required recovery actions at altitude in real life scenarios…
…Further enhancing stick shaker recovery by including realistic scenarios, during training may provide increased exposure for Flight Crew of the relationship between control column movement and true airspeed, preventing further Flight Crew over-controlling events brought about by startle effect.
Smoke alarm activations
The ATSB could not determine the reason why the smoke alarms in the R5 lavatory activated after the upset. However, the lavatories at R5 and L5 shared a ventilation system and it may have been that dust, from the lavatory fittings detaching in the L5 lavatory, activated the R5 smoke alarm.
During the smoke alarm activations, cabin crewmembers responded appropriately and acted in accordance with procedures. Additional crewmembers in the rear aircraft cabin also supported the response to the smoke alarm.
This research report reviewed 245 stall warnings and stall warning system events reported to the ATSB over a 5-year period (2008–2012). The ATSB identified 33 serious and higher risk incidents in which a stall warning occurred, and in several cases the stall warning speed was higher than normal (due to a higher vertical acceleration (G) factor in a turn, or an incorrect reference speed switch setting). The report contained the following safety message:
Stall warnings occur in normal operations, and are normally low risk events. In Australia, even the most serious events have not resulted in a loss of control, and have been effectively managed by flight crew to prevent a stall from occurring. To avoid higher risk stall warning events, pilots are reminded that they need to be vigilant with their awareness of angle of attack and airspeed.
Identification of necessity to recalculate hold speed
Prior to arriving at BETTY, the VNAV profile in the flight management computer (FMC) calculated holding at between FL 150 and FL 160. When selecting a target speed, the flight crew verified the FMC provided speed by comparing the speed to the flaps up manoeuvre speed calculation. However, the flight crew training manual advised that the flaps up manoeuvring speed guaranteed at least full manoeuvre capability, to stall warning activation at low altitudes. The flight crew were not aware of the requirement to use a different speed calculation verification for altitudes above FL 200.
Had the crew recalculated the hold speed for FL 220 using the flight management computer, it would have provided a target hold speed of 240 kt. In this case, the flight crew likely did not have an adequate understanding of how the FMC calculated the target hold speed. They also did not understand the use of the best speed provided on the hold page in the FMC. Using best speed would have provided the crew with a hold speed for the actual aircraft weight, altitude and configuration at that time. Orasanu (2010) outlines that decision errors in aviation are often a result of a lack of knowledge:
[They] typically are not slips or lapses in carrying out an intention, but errors of intention itself (Norman, 1981). The decision maker acts according to his/her understanding of the situation, and the source of error is in the decision maker’s knowledge base or in the process of reaching a decision.
The selection of an incorrect hold speed resulted in the aircraft entering the hold with a selected speed 15 kt below the required speed. Using the best speed in the FMC hold page or recalculating the hold speed using the FMC for the higher level would have resulted in the use of a speed which provided sufficient margin to prevent a stick shaker activation.
Absence of hold speed re-evaluation procedure
Neither the operator or aircraft manufacturer provided procedures or guidance which stated that a hold speed was required to be re-evaluated for a change in hold level when a speed was selected in the FMC during the planning stage of a descent. Therefore, the flight crew did not have the requisite knowledge to identify the need to re-evaluate the selected speed.
Reason (2008) explains that decision errors, such as not re-evaluating the hold speed, can be as a result of a ‘failure to detect a signal or problem’, and are more likely under conditions including ‘when the person did not expect to find a problem in that location…’. Detecting a problem, or an absence of an action can be particularly difficult when there are no cues to identify an issue. In this case, there was no procedural prompt for the flight crew to re-evaluate the speed for the higher level and select the correct speed. Therefore, the need to re-evaluate the hold speed relied on the crew’s knowledge of the higher speed requirement above FL 200.
This resulted in the remaining protections against a low-speed condition being the minimum manoeuvring and stall warning activation speed indications on the pilot’s flight display. At the time the speed reduced below both the selected speed and the minimum manoeuvring speed, the flight crew’s attention was focussed on other operational matters resulting in the crew not identifying the reduced speed.
In summary, a requirement to re-evaluate the speed for the higher than planned hold level would likely have provided the crew with a prompt to reselect the speed, which in turn would provide an adequate margin above the minimum manoeuvring speed.
Crew recognition of low speed prior to entering the hold
As the aircraft entered the holding pattern, the delay in the autothrottle system detecting and effecting changes in aircraft speed allowed the speed to reduce to 220 kt—below both the selected speed of 225 kt and the minimum manoeuvring speed of 223 kt.
These speeds, along with the stall warning activation speed were displayed on the PFD, but the flight crew did not detect that the speed had reduced as their attention was on other operational tasks. Reason (2008) outlines why focusing one’s attention on one task can be to the detriment of noticing other important tasks:
…attention is a limited resource. Direct it at one thing and it is withdrawn from another. When attention is ‘captured’ by something unrelated to the task at hand, actions often proceed unintentionally along some well-trodden pathway: strong habit intrusions.
Not noticing a visual indication well within one’s visual scan can be a common outcome to a crew’s attention being focused elsewhere, as explained by Wickens and McCarley (2008):
Change blindness…occurs when an observer fails to detect an event (e.g. discreet change) in the environment around him…[and is a] failure to notice that something is different from what it was…How do lapses occur? Very often, [change blindness] is a failure of attention. Data indicate that changes are likely to go unnoticed if they are not attended when they occur…[i.e.] if the observer is looking away…
It can be difficult to detect discreet changes, even with visual indicators of limits (i.e. speed bug on the PFD) in view of the crew, when attention is on other operational matters. In turn, this reduced the likelihood that they could detect an undesirable aircraft condition.
Pre-aerodynamic stall buffet and probable stick shaker activation
As the aircraft turned to enter the holding pattern, the bank angle increased and the aircraft began to transition from descent to level flight. The effects of these manoeuvres combined to increase the vertical acceleration and wing angle of attack. The increasing angle of attack initiated pre-aerodynamic stall buffeting.
At this time, although it was not recorded on the flight data, all flight crewmembers reported a stick shaker activation. The recorded angle of attack also indicated that a stick shaker likely occurred. The manufacturer advised that an activation of less than one second in duration may occur without being captured in the flight recorder data.
Pilot induced oscillations and cabin injuries
At the time of the initial buffeting and probable stick shaker activation, the captain commenced the approach to stall and stall recovery actions required within the operating procedures. However, after this, a number of the other actions required by procedures were not completed, including the following:
due to a desire to remain within the protected airspace of the holding pattern, the wings were not levelled
the autothrottle was not disconnected
due to the captain’s concern regarding the pitch up moment resulting from a large engine power increase, engine power was not manually increased sufficiently to effect recovery
the first officer assessed that the actions had been completed correctly and did not identify or therefore call out the missed actions.
After the captain did not complete the approach to stall recovery procedure, the aircraft entered a series of pilot induced oscillations during which the crew’s premature attempts to arrest the rate of descent without increasing power as needed and before the speed had increased sufficiently, resulted in a further two stick shaker activations. After a fourth oscillation (during which the flight crew did not recall a stick shaker activation and an activation was not recorded), the engine power was increased sufficiently to accelerate the aircraft to enable the flight crew to complete the recovery.
The ATSB considered whether the captain’s performance was affected by a startle response, which is defined by Landman and others (2017) as a ‘physiological reaction to a highly salient stimulus’ (e.g., sudden, intense, or threatening; Rivera, Talone, Boesser, Jentsch, & Yeh, 2014). Rivera and others (2014) add that it disrupts ‘cognitive processing and can negatively influence an individual’s decision making and problem-solving abilities’. They outline that the reaction can result in the following:
Studies have determined that motor response performance following a startling stimulus is disrupted for approximately 0.1 s to 3 s for simple tasks (May & Rice, 1971; Sternbach, 1960; Thackray, 1965)…In more complex motor tasks…startle may impact performance for up to 10 s following a loud intensity signal (Thackray & Touchstone, 1970).’
Rivera and others (2014) also stated that ‘one must also consider the time to cognitively recover after a startling stimulus’. Within this same reference citing Bürki-Cohen (2010), they outline the difference between startle and surprise.
…there are distinctive conceptual, behavioural, and physiological differences between the startle reflex and the surprise emotion.
In contrast to startle, which always occurs as a response to the presence of a sudden, high-intensity stimulus, surprise can be elicited by an unexpected stimulus or by the unexpected absence of a stimulus. Surprise can be described as a combination of physiological, cognitive, and behavioural responses, including increased heart rate, increased blood pressure, an inability to comprehend/analyze, not remembering appropriate operating standards, “freezing”…
In this case, it was not determined as to whether the tactile stimulus of the stick shaker and the aural alert was sufficient to elicit a startle response. However, the reaction of the captain in undertaking the initial approach to stall recovery did not largely appear to be adversely affected, as most actions were completed and the omitted or incomplete actions resulted from deliberate decisions. When then considering the continuation of the recovery steps, he was also able to outline the reasons for his actions, which do not necessarily demonstrate a negative influence on his decision making or problem-solving abilities.
With respect to the first officer, he perceived that the absence of his call-outs required of the pilot monitoring position (including not calling out any omissions during the recovery continuation and completion) were a result of experiencing the startle effect. Given that the approach-to-stall recovery actions overall were completed in about 10 seconds, this is possible. However, there was insufficient evidence to determine whether his was a response to a sudden, high-intensity stimulus. His reaction may appear more consistent with surprise, whereby there was a cognitive mismatch between new information and expectations, especially as he had no expectation of stick shaker activation.
The recorded flight data shows that during the oscillations, the aircraft underwent significant variations in vertical acceleration. The pilot-induced oscillation occurred at a time when the fasten seat belt sign was not illuminated and cabin crewmembers were standing in the rear cabin, completing the cabin preparation for landing. The variations in vertical acceleration resulted in several cabin crewmembers and passengers impacting the cabin ceiling and furnishings, sustaining minor injuries. The impact of occupants to the cabin ceiling and furnishings resulted in damage to these furnishings, in particular an L5 lavatory. This damage resulted in the L5 and R5 lavatory smoke alarm activations.
Limited guidance in high altitude manual handling and stall recovery training
All flight crew undertook simulator training exercises as part of a cyclic training schedule. The most recent exercise undertaken by the crew included an approach to stall recovery scenario exercise, which was simulated at low altitude and with the aircraft configured with flaps and landing gear extended. In this instance, the simulated aircraft response would be markedly different to that of an aircraft operating at higher altitudes (such as FL 200 and above) and with the landing gear and flaps retracted.
In this case, the flight crew had undergone this cyclic training exercise, including the captain who completed the training three days prior to the occurrence. In addition, after the event, they could recall the correct recovery actions indicating that the training was effective in providing the crew with the required knowledge to effect the recovery.
However, this training exercise did not familiarise the crew with the manual handling of the aircraft at higher altitudes. Hasleback (2014) states:
From [a pilot’s initial training onwards], pilots are faced with automation induced skill degradation (Balfe, Wilson, Sharples, & Clarke, 2012), caused by the automation taking over the responsibility for tasks previously performed by the human operators (Parasuraman & Riley, 1997).
There are ways to overcome this. In a study examining the relationship between pilot manual handling performance and recency, Ebbatson (2009) outlined that ‘significant relationships are identified between pilots’ recent flying experience and their manual control strategy’. Hasleback and others (2014) summarised this study to show that ‘recent flight practice including manual flying occurring a few weeks prior to the experiment had more influence on the measured performance than flight hours accumulated over a pilot’s entire career’.
Orlady and Orlady (1999) explain the importance of including manual handling exercises in training:
Using today’s automation more efficiently does not mean that today’s pilots do not need all of the old skills and knowledge… They need all of the old skills plus the new skills required by the automation…Manual skills must be a part of any recurrent or transition training and checking program in addition to the emphasis given to the proper use of the automatics.
In this case, the opportunity for flight crew to practice their high-altitude manual handling skills was limited, which in turn limited the ability of flight crews to retain the necessary manual handling skills for stall recovery at higher altitudes. As a result, the flight crew did not adequately respond to the initial buffet and probable stick shaker activation, leading to the in-flight upset.
Use of seatbelts
Prior to the occurrence, the cabin crewmembers prepared the cabin for arrival at Hong Kong. This included an announcement to fasten seatbelts, however, at this time, the fasten seatbelt sign was not illuminated.
At the time of the in-flight upset, a passenger was located in the L5 lavatory and cabin crewmembers were in the rear cabin preparing for arrival. During the upset, the aircraft cabin was subject to large variations in vertical acceleration. Due to the unexpected nature of the event, neither the cabin crewmembers or the passenger in the L5 lavatory, who did not have a seatbelt available, were seated and secured at the time of the event. As a result, four cabin crewmembers and the passenger in the L5 lavatory sustained minor injuries.
A passenger seated in seat 63C did not have their seatbelt fastened. During the upset, this passenger impacted cabin furnishings and sustained minor injuries. Other seated passengers did have seatbelts fastened and as a result were not injured.
In-flight upsets, while rare, can have the potential to cause injuries. Evidence from this incident along with other incidents demonstrates that while seated, keeping a seatbelt fastened and secure significantly reduces the likelihood of being injured during an upset.
Findings
From the evidence available, the following findings are made with respect to the stick shaker activation event involving Boeing 747, VH-OJU, that occurred 110 km SE of Hong Kong International Airport (BETTY IFR), on 7 April 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
After overwriting the hold speed in the flight monitoring computer, the flight crew did not identify the need to re-evaluate the hold speed for the higher than expected hold level.
Prior to entering the hold, the aircraft’s speed reduced below both the selected and minimum manoeuvring speeds. The crew did not identify that the aircraft was operating below these speeds.
The reduced speed coincided with the turn to enter the holding pattern and the level capture. These factors resulted in pre-aerodynamic stall buffeting and probable stick shaker activation.
The pilot flying attempted to arrest the rate of descent prior to completing the approach to stall actions. The pilot monitoring did not identify and call out the incomplete approach to stall recovery actions. These combined actions led to pilot induced oscillations and further stick shaker activations.
The operator provided flight crew with limited training and guidance in stall prevention and recovery techniques at high altitudes or with engine power above idle. (Safety issue)
The passenger in seat 63C was not wearing a seatbelt at the time of the stick shaker activations.
Other safety factor
The operator provided flight crew with limited training and guidance relating to the need for crew to re-evaluatetheir holding speed for a change in altitude (specifically above flight level 200). (Safety issue)
Safety issues and actions
The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The operator provided flight crew with limited training and guidance in stall prevention and recovery techniques at high altitudes or with engine power above idle.
Re-evaluating hold speeds for a change in altitude
Safety issue description: The operator provided flight crew with limited training and guidance relating to the need for crew to re-evaluate their holding speed for a change in altitude (specifically above flight level 200).
Proactive safety action
The operator reviewed the training and guidance provided to other Boeing aircraft types in its fleet, the 787 and 737, and made the following changes:
Training and guidance
The operator amended recurrent lesson plans for the 787 and 737 fleets to incorporate more complex stall warning recovery events. The operator also updated lesson plans and distributed educational material to all flight crews.
The operator amended the 787 and 737 flight crew training manuals relating to hold speed selection to provide enhanced holding pattern information to flight crew. They also updated ground school lesson plans and information to ensure standardised flight crew training and ensure holding pattern training was adequately addressed during flight crew training.
General details
Pilot details – Captain
Licence details:
Air Transport Pilot (Aeroplane) Licence
Aeronautical experience:
Approximately 24,556 hours
Last flight review:
3 April 2017
Pilot details – First officer
Licence details:
Air Transport Pilot (Aeroplane) Licence
Aeronautical experience:
Approximately 16,400 hours
Last flight review:
12 November 2016
Pilot details – Second officer
Licence details:
Air Transport Pilot (Aeroplane) Licence
Aeronautical experience:
Approximately 8,555 hours
Last flight review:
6 February 2017
Aircraft details
Manufacturer and model:
The Boeing Company 747-438
Year of manufacture:
1999
Registration:
VH-OJU
Operator:
Qantas Airways
Serial number:
25566
Type of operation:
Air transport high capacity - passenger
Persons on board:
Crew – 17
Passengers – 347
Injuries:
Crew – 4 (Minor)
Passengers – 2 (Minor)
Damage:
Minor
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Operator
Boeing (manufacturer)
Aircraft crew
Hong Kong Civil Aviation Department
References
Australian Transport Safety Bureau (ATSB). (2013). Stall warnings in high-capacity aircraft: The Australian context 2008 to 2012. Canberra ATSB.
Ebbatson, M., Harris, D., Huddlestone, J. and Sears, R., 2010, The relationship between manual handling performance and recent flying experience in air transport pilots, Ergonomics, pp.268-277
Hasleback, A., Kirchner, P., Schubert, E. and Bengler, K., 2014, A flight simulator study to evaluate manual flying skills of airline pilots, Proceedings of the Human Factors and Ergonomics Society 58th Annual Meeting, pp.11-15
Landman, A., Groen, E., van Paassen, MM., Bronkhorst, AW. and Mulder, M., 2017, The Influence of Surprise on Upset Recovery Performance in Airline Pilots, The International Journal of Aerospace Psychology, 27:1-2, 2-14
Orlady, HW., and Orlady, LM., 1999, Human Factors in Multi-Crew Flight Operations, Ashgate Publishing Limited, Aldershot, England
Reason, J., 2008, The Human Contribution: Unsafe acts, accidents and heroic recoveries, Ashgate Publishing Limited, Surrey, England
Rivera, J., Talone, AB., Boesser, CT., Jentsch, F. and Yeh, M, 2014, Startle and Surprise on the Flight Deck: Similarities, Differences, and Prevalence, Proceedings of the Human Factors and Ergonomics Society 58th Annual Meeting, pp.1047-1051
Wickens, CD. and McCarley, JS., 2008, Applied Attention Theory, CRC Press, Florida, USA
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, customer service manager, Qantas, the Civil Aviation Safety Authority, and Boeing.
Any submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2017-044
Occurrence date
07/04/2017
Location
110 km south-east of Hong Kong Airport (BETTY IFR)
On 09 April 2017, an ATR 72 aircraft, registered ZK-MCY, experienced unsafe landing gear indications on approach to Nelson, New Zealand (NZ). The aircraft diverted to Palmerston North, NZ, where it made an emergency landing. During the landing roll the right main gear tyre burst and the aircraft was brought to a stop on the runway. An investigation into the circumstances of the accident is being conducted by the Transport Accident Investigation Commission (TAIC) of New Zealand.
The TAIC requested assistance from the Australian Transport Safety Bureau (ATSB) to download the aircraft’s cockpit voice recorder (CVR).
To facilitate this support and to provide the appropriate protections for the CVR information, the ATSB appointed an accredited representative in accordance with paragraph 5.23 of ICAO Annex 13 and commenced an investigation under the Australian Transport Safety Investigation Act 2003.
The New Zealand TAIC is responsible for releasing the final investigation report regarding this accident.
On 21 October 2016, the ATSB was advised that the United States National Transportation Safety Board (NTSB) had commenced an investigation into a collision with terrain involving a Ryan W. Gross Arion Lighting, registered N235SC.
As Australia is the State of Manufacture of the engine, the ATSB requested to be appointed as an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.
On 28 December 2016, the ATSB was advised that the United States National Transportation Safety Board (NTSB) had commenced an investigation into a partial power loss and collision with terrain involving a Mathias Lightning aircraft registered N59JL. The Aircraft was substantially damaged when it impacted terrain while maneuvering in the traffic pattern at Franklin Municipal-John Beverly Rose Airport, Franklin, Virginia. The commercial pilot sustained minor injuries and the passenger sustained a serious injury.
The airplane was operated under the provisions of 14 Code of Federal Regulations Part 91 as a personal, local flight. Visual meteorological conditions prevailed at the time and no flight plan was filed for the flight which was originating at the time of the accident.
As Australia is the State of Manufacture of the engine, on 9 January the ATSB appointed an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB investigation on 9 January. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.
The NTSB determined the probable cause of the accident. Details are available on the NTSB website.
On 5 October 2016, a Qantas-operated Boeing 747-438 aircraft, registered VH-OJT (Figure 1) was undergoing routine maintenance at a contracted repair and overhaul facility in the Hong Kong Special Administrative Region (SAR) in the People’s Republic of China. Inspection of the No. 2[1] engine pylon identified cracking of four outboard strut ribs from within the torque box of the pylon (Figure 2).
Following technical advice from Boeing, the No. 2 engine was removed from its wing installation to allow access to the pylon and removal of the cracked strut ribs. The aircraft was repaired and, after completing the maintenance visit, it was returned to regular passenger service. The cracked ribs were sent to Boeing’s facilities in the United States for specialist metallurgical examination.
Figure 1: Qantas Boeing 747-438 aircraft, registered VH-OJT
Source: Christopher Chai
Pylon inspection requirements
The engines on a Boeing 747 aircraft are mounted to pylons located on the underside of each wing. The pylons transmit thrust from the engine to the airframe and are designed to withstand flight loads from normal operation along with transient dynamic loading in the event of an engine failure. Hydraulic, fuel, electrical and air conditioning lines all pass through the pylon structure.
Boeing’s ongoing maintenance requirements included an inspection of the engine pylon every 48 months. A general visual inspection within the torque box for corrosion damage was required along with a more detailed inspection for cracking of the ribs. The procedures noted that during the inspection, particular attention should be applied to the cutaway where stringers passed through each rib.
Qantas reported to the ATSB that several years prior to this occurrence, it had independently increased the frequency of the zonal inspections from 48 to 24 months due to repeated instances of corrosion and cracking damage within the pylon region. That new inspection interval was formalised by Qantas within its maintenance documentation for its 747 fleet.[2]
Figure 2: Boeing 747 engine pylon showing the location of the cracking (highlighted)
Source: Boeing, annotated by the ATSB
Manufacturer’s examination
Following removal from the aircraft, four cracked outboard strut ribs were sent to Boeing for metallurgical examination and fracture analysis. The examination confirmed that five cracks had developed in the strut ribs, all emanating from the rib cutaway region, ranging in length from 3—19 mm (Figure 3 to Figure 5). Boeing’s report[3] contained the following detail:
Optical examination of the fracture surfaces was conducted and no anomalies were found that might otherwise have contributed to the development of the cracking.
Scanning electron microscopy (SEM) of the fracture surfaces did not find any aberrations or defects on the surfaces of the strut ribs that might have otherwise contributed to the development of the cracking.
SEM analysis of the fracture surfaces confirmed that each strut rib had striations and crack-progression marks consistent with fatigue cracking. No evidence was found of ductile tearing or plastic deformation at the crack origins, which might otherwise suggest that the fatigue cracking had initiated due to excessive vibration or torque loads from a transient engine event.
Metallographic examination of the aluminium alloy microstructure from each rib did not reveal any abnormalities that could have led to the fracture of the strut ribs.
Chemical analysis of each strut rib found the composition met the materials specifications, as listed within the engineering drawings.
Hardness and conductivity measurements from each strut rib confirmed that they were within the correct range, as listed within the engineering drawings.
The ribs were painted and primed in accordance with manufacturing specifications.
Boeing also conducted a structural loads analysis on the pylon, which confirmed that despite the presence of the cracking, the No. 2 engine pylon retained sufficient residual strength for all certified loading conditions.
Figure 3: A strut rib in-situ within the No. 2 pylon with two cracks identified
Source: Boeing, annotated by the ATSB
Figure 4: The strut rib from Figure 3 after removal from the pylon
Source: Boeing, annotated by the ATSB
Figure 5: Close-up of the cracking in the cutaway region shown at Figure 4
Source: Boeing, annotated by the ATSB
Aircraft history
On 24 June 2016, a few months before the detection of the pylon cracks, VH-OJT sustained a failure of the low-pressure turbine from the No. 2 engine during the take-off roll. This resulted in a high-speed seizure of the engine resulting in significant vibration and torque loads on the pylon. Following removal of that engine, the pylon was inspected and no damage to the critical structural members was evident.
Maintenance records noted that when the cracks were discovered in the Hong Kong SAR, the aircraft had accumulated 79,928 hours and 8,313 landings. There were no other identified defects reported from previous inspections on the No. 2 strut support assembly for VH-OJT.
Safety analysis
Cracking of the engine pylon strut ribs
During routine maintenance on 5 October 2016, four strut ribs from the No. 2 engine pylon were found to have developed fatigue cracks. The parts met the manufacturer’s engineering drawing and material specifications. With no obvious defects detected, it is likely that the fatigue cracking developed from exposure to vibratory loading that occurred within the pylon during normal engine operation. A factor that may have contributed to the crack growth was the number of hours and flight cycles that the airframe had accumulated within its service life. The manufacturer’s analysis indicated that despite the crack damage to the ribs, the pylon retained sufficient residual strength for all load cases, which indicates that the aircraft remained safe to operate.
Approximately 6 months prior to the detection of the strut rib cracking, the No. 2 engine sustained a seizure that resulted in the transmission of significant vibratory and torque loads into the pylon structure. Metallurgical analysis of the fracture at the crack origins did not show any evidence of plastic deformation or tearing of the alloy that might otherwise suggest that the seizure was a contributing factor to the cracking.
Pylon inspection
When compared with the 48-month inspection interval recommended by the manufacturer, the 24‑month inspection interval set by Qantas provided greater opportunity for the timely detection of cracking and other defects within the pylon. The reduced inspection interval proved effective in this case, detecting cracks before they reached a level considered by the manufacturer to be a safety risk.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The fatigue cracking in four outboard strut ribs in the No. 2 engine pylon is likely to have developed from exposure to vibratory loading within the pylon during normal engine operation over the aircraft’s service life.
The extent of fatigue cracking in the ribs did not affect the structural integrity of the pylon for all certified load cases, which meant that the aircraft’s safe operation was not affected.
Safety message
The Qantas Boeing 747 maintenance program for the engine pylon area is completed at a higher frequency and in more detail than is required by Boeing. This enhanced inspection regime was effective in detecting cracking of the strut rib assembly, before the cracks reached a level considered to be a safety risk.
This occurrence highlights the importance for vigilance during ongoing routine maintenance activities. It also highlights that, when relevant, operators should consider reviewing prescribed maintenance schedules in order to address issues that may develop as their aircraft age and accumulate time in service.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
