AAIB Bulletin 9/2017

PM told the PF to select TOGA1 thrust. The PM moved the flap lever back to position 1, when instructed by the PF to reselect the flaps, and the slats began to extend. The flight continued without further incident. History of the flight G-EZEW was operating a flight from Bristol Airport to Lisbon Airport, Portugal, with six crew and 144 passengers on board. The co-pilot was the PF and the commander was the PM. The reported weather conditions included surface wind from 230° at 8 kt, more than 10 km visibility, broken cloud at 1,600 ft agl, a temperature of 15°C and a QNH of 1009 hPa. The aircraft began its takeoff from Runway 27 at 1007 hrs with the flap lever in position 1, giving a slat and flap configuration known as config 1+f (leading edge slats extended to 18° and trailing edge flaps extended to 10°). The PF began to rotate the aircraft at 140 kt CAS2 Footnote 1 TOGA: Takeoff/Go Around. Aircraft often take off with a thrust setting below the maximum available (TOGA thrust). If necessary, TOGA thrust can be selected at any time 2 CAS:Copmted Airspee d 4 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZEW EW/C2016/06/03 and it lifted off at 147 kt CAS. The PM called ‘positive climb’ to which the PF responded ‘gear up’. The landing gear was selected up four seconds after lift-off and, three seconds later at approximately 190 ft radio altitude (RA) and 157 kt CAS, the PM moved the flap lever to position 0, causing the slats and flaps to begin to retract. The aircraft pitch attitude began to increase, airspeed began to decrease and, at a height of 370 ft RA, the PF applied a nose-down corrective pitch input which prevented the CAS from decreasing below 153 kt. As the aircraft climbed through 550 ft RA the flaps were fully retracted, the slats were retracting through 7.5° and the CAS was increasing through 160 kt. The PM told the PF what he had done and announced “set toga” 3 , to which the PF responded by moving the thrust levers to the toga detent. After the flaps were selected up, the PF saw the Vls4 indication on the PFD 5 “shoot up” to 180 kt, 30 kt above the current speed (Figure 1). He asked the PM to extend the flaps again and the PM moved the flap lever back to position 1, which caused the slats to begin to extend. The aircraft was at 710 ft RA and 183 kt. The Vls indication reduced below the instantaneous airspeed and, when the aircraft accelerated to S speed 6 , the PF moved the thrust levers to the clb detent to reduce thrust to the climb setting. The PF asked for the slats to be retracted, which the PM did at approximately 850 ft RA and, passing 870 ft RA, the autopilot was engaged and the climb continued. Figure 1 The VLS indication moves up the airspeed scale on the PFD when the flaps are raised 3 TOGA: Takeoff/Go-around (thrust) 4 VLS: the lowest selectable speed 5 Primary flight display 6 S Speed: see Aircraft characteristic speeds below 5 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZEW EW/C2016/06/03 Recorded data The following relevant parameters were recorded: ● When the flap lever was set to position 0, at 190 ft RA and 157 kt CAS, the pitch attitude was 15.1° nose-up and the angle of attack (AOA) was 7.3°. ● During slats and flap retraction, the CAS reached a minimum of 153 kt, at which the pitch attitude reached a maximum value of 17.2° nose-up and AOA reached 9.1° (reaching its maximum recorded value of 9.3° shortly afterwards). When the aircraft reached the clean configuration (slats and flaps fully retracted), the CAS was recorded as 171 kt. ● As the aircraft passed 550 ft RA the AOA was 7.5°, decreasing to a stabilised value of 7.2° to 7.3°. Aircraft technical information Aircraft characteristic speeds Vls is calculated by the Flight Augmentation Computer (FAC) and displayed on the PFD as the top of a vertical amber strip along the airspeed scale. Vls corresponds to: a. 1.13 times the stalling speed during takeoff b. 1.28 times the stalling speed in the clean configuration The manufacturer calculated that the stalling speed of the aircraft in the clean configuration was 156 kt at a gross weight of approximately 63,000 kg. ‘S speed’ is the lowest speed at which flaps should be selected to position 0 and is displayed as a green letter ‘s’ on the airspeed scale of the PFD. Flap system logic When the flap lever is moved to position 0 from config 1+f after takeoff, the flaps and slats begin retracting at the same time if the CAS is above 154 kt. In flight, when the CAS is above 100 kt, moving the flap lever from position 0 to 1 commands config 1 rather than config 1+f, extending the slats but not the flaps. If, after takeoff (and above 100 kt), the flap lever is moved from position 1 to 0 and then back to 1, the slats and flaps begin to retract but, although the slats will extend again, the flaps will continue to retract. Alpha/Speed lock function (slats) The Alpha/Speed lock function inhibits the retraction of slats at high AOA (alpha) or low speeds. If AOA exceeds 8.5° or the airspeed reduces below 148 kt, retraction of slats from position 1 to position 0 is inhibited. It is no longer inhibited when AOA reduces below 7.6° and speed exceeds 154 kt. After the flap lever has been moved to position 0, this protection is not active even if the AOA exceeds 8.5° or the airspeed decreases below 148 kt. 6 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZEW EW/C2016/06/03 Operator’s report on the incident Information from the pilots During their pre-flight briefing, and subsequently during the morning, the pilots had discussed a previous flap mis-selection event that occurred during takeoff from the same airport. The commander stated that he had been thinking about that event while waiting for the instruction to raise the flaps, and wondered later whether these thoughts and the earlier discussions had been a trigger for him selecting the flaps to position 0 before being asked to do so. Operator’s Analysis The operator’s report noted that, when the flap lever reached position 0, the AOA was 7.3° and the CAS was 157 kt. Consequently, the Alpha/Speed lock protection did not activate, and the flaps and slats moved as selected. When the flap lever was selected back to position 1, the slats began to extend again but the flaps did not, in accordance with normal flap system logic. There was no specified procedure for crews to follow in these circumstances but, in this case, the recovery action was effective: reducing the AOA, increasing thrust and extending the slats. The operator’s report stated: ‘The combination of the fact that [the PM] had been thinking about the previous event, perhaps rehearsing how it could have happened, and that he was anticipating the flap 0 call from [the PF], became a trigger and led [the PM] to actually action that sequence in reality by selecting the flap lever to zero.’ Previous event In its report into a similar incident in 2016 7 , the operator referred to the routine procedure of retracting flaps after takeoff, commenting: ‘Tasks which are highly practised, routine and largely physical actions are more vulnerable to action slips than more cognitively demanding tasks. These well‑practised tasks are linked with automatic processing where [we can do the task] ‘without thinking’. Our ability … to automate our processing [allows] us to develop expertise and create the cognitive capacity to process more complex tasks. However, it can also leave us vulnerable to making errors in relatively simple tasks.’ The operator noted that the flap mis-selection was not an isolated event, indicating that flight crew are vulnerable to this type of slip, and consequently undertook a study into other events involving inadvertent flap retraction after takeoff. Footnote 7 See AAIB Bulletin 8/2016; G-EZTZ 7 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZEW EW/C2016/06/03 Study into flap mis-selection after takeoff The Airbus A319 has a further protection known as Alpha Floor8 , which applies maximum thrust regardless of pilot input if the AOA is too great. The operator determined that neither Alpha/ Speed Lock nor Alpha Floor protection had been triggered in any of the events reviewed, noting that this was reassuring. However, it commented that there were other risks associated with the aircraft being in a low energy state near to the ground, including the possibility that crew members would become confused leading to a loss of situational awareness. In addition, the operator was not clear how much performance margin would remain in the event of a loss of thrust in one engine or a requirement to increase the climb angle to avoid an obstacle. The manufacturer studied the events and concluded that, in the circumstances examined where the Alpha Lock function had not been triggered, the aircraft had sufficient performance to maintain a climb and accelerate. None of the operator’s events, or other similar events of which the manufacturer was aware, had triggered the Alpha Floor protection. The manufacturer stated that: a. Had the flap lever been moved to position 0 with the aircraft at higher climb angles or lower speeds, the Alpha/Speed Lock function would have inhibited slat retraction. b. Aircraft climb performance following early flap retraction would exceed that demonstrated in the case of an engine failure after takeoff. c. Should an increased climb rate be required with the aircraft at a very high angle of attack, the Alpha Floor protection would activate to provide TOGA thrust. The manufacturer stated that the takeoff performance calculations used by the operator, when properly computed and applied, combined with the protections above, would allow the aircraft to climb safely should there be a repeat of this type of event even when combined with other adverse factors, such as obstacle or terrain avoidance. Operator safety action Following its review into flap mis-selection after takeoff, the operator took or proposed the following safety action: a. It reviewed its current training and guidance to support crews in handling the aircraft in a low energy state at low altitude. b. Crews would be trained in ‘active monitoring’, focussing on switch selections and lever movements. c. It amended its SOPs for flap and landing gear selection to ensure the correct lever is identified before being moved. d. It would develop training to help crews manage distractions (which had played a role in some events). e. It would raise awareness amongst pilots of the events reviewed through a dedicated flight safety communication. Footnote 8 Alpha-floor protection automatically selects TOGA thrust when the aircraft reaches a very high AOA. 8 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZEW EW/C2016/06/03 Subsequent event On 19 March 2017 one of the operator’s A320 aircraft, G-EZWM, was taking off from Nice Airport when the PM, when asked by the PF to retract the landing gear, responded “gear up” but moved the flap lever to position 0 with the aircraft 105 ft above the runway. The PF noticed a large increase in V LS, which alerted him that the flaps were retracting, and exclaimed “Flaps!” He selected TOGA, and the PM raised the gear, but the flap lever remained at position 0. The flaps and slats retracted fully but, after TOGA was selected, the aircraft accelerated “rapidly” and climbed. In discussion after the event, the crew could not explain definitively why the mis-selection might have happened but noted that the PM had just finished the training introduced by the operator to combat this sort of action slip. They wondered whether the PM, by actively trying not to make a mis-selection, brought about that very outcome. Conclusion The operator realised that the flap mis-selection event to G-EZEW was not an isolated event and carried out a study into similar incidents with assistance from the manufacturer. The operator was concerned about the risk associated with aircraft being in a low energy state near to the ground, including performance risks and the possibility that crew members would become confused leading to a loss of situational awareness. Information from the manufacturer indicated that properly-computed takeoff performance calculations, combined with the aircraft’s Alpha/Speed Lock and Alpha Floor protection functions, would allow the aircraft to climb safely following a flap mis-selection event, even when combined with other, adverse, factors. Aircraft climb performance following early flap retraction would exceed one engine inoperative climb performance. The operator began to focus training effort on avoiding the mis-selection of switches and levers, and amended its SOPs with the same intention. However, a similar event occurred to a pilot shortly after he underwent that training and he wondered subsequently whether, by focussing on not making the action slip, he had brought it about. This hypothesis would be supported by the comment of the pilot of G-EZEW in this report who stated that, while waiting for the instruction to raise the landing gear, he had been thinking about an earlier mis-selection event by another crew at his home base. 9 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A320-214, G-EZWX No & Type of Engines: 2 CFM56-5B4/3 turbofan engines Year of Manufacture: 2014 (Serial no: 6192) Date & Time (UTC): 28 November 2016 at 1303 hrs Location: En route Edinburgh to Hamburg Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 6 Passengers - 172 Injuries: Crew - None Passengers - None Nature of Damage: Static inverter overheated Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 44 years Commander’s Flying Experience: 6,316 hours (of which 4,138 were on type) Last 90 days - 142 hours Last 28 days - 26 hours Information Source: AAIB Field Investigation Synopsis During the en route climb, the flight crew noticed smoke and fumes in the cockpit and donned their oxygen masks. Shortly after, the ECAM avionics smoke caption was displayed and the aircraft diverted to Newcastle Airport. During the descent, the smoke appeared to dissipate after the crew carried out the Quick Reference Handbook (QRH) avionics smoke drill. The aircraft landed without further incident. The source of the smoke and fumes was traced to the cockpit additional electrical supply static inverter, which had overheated. This was the third failure to have occurred on the operator’s fleet of Airbus A320 aircraft since August 2014. The operator was not aware that the aircraft manufacturer had issued a technical publication in March 2016 that identified the cause of the problem, and that the supplier had issued a Vendor Service Bulletin in October 2016 that recommended the replacement of the capacitor involved in the failure mode. A batch of 2,058 units was affected. The failed static inverter on G-EZWX was one of this batch. The investigation also identified an undocumented feature of the interphone emergency call function related to communication re-establishment after a handset reset; awareness of this feature could improve communication management between the cockpit and cabin crew. History of the flight The aircraft was on a scheduled flight from Edinburgh Airport to Hamburg Airport, Germany, with 172 passengers and six crew members on board. At 1303 hrs, 11 minutes into the 10 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 flight, the aircraft was passing FL230 in the climb when the commander and co-pilot became aware of smoke and fumes in the cockpit. Both crew donned their oxygen masks, which coincided with the avionics smoke caption being displayed on the ECAM. The commander took control of the PF duties and radio communications with ATC, whilst the co-pilot carried out the QRH smoke/fumes/avncs smoke drill. At about the same time that smoke and fumes appeared in the cockpit, several cabin crew at the rear of the aircraft also noticed fumes in the cabin. This was shortly followed by the commander making an “attention, crew at all stations”1 PA announcement, alerting the cabin crew to a potential emergency. The commander then declared a MAYDAY to ATC, advising that they had smoke and fumes in the cockpit, and were diverting to Newcastle Airport, which was 47 nm ahead of the aircraft’s track. On a few occasions, the crew had to repeat themselves due to difficulties hearing each other when using the oxygen masks. The commander also had to repeat part of the MAYDAY transmission as the controller did not initially understand him. About a minute after the co-pilot had set the avionics extract and blower to ovrd, the smoke in the cockpit started to dissipate. The co-pilot then selected the interphone emergency call function to ascertain the status of the cabin crew and provide a NITS2 brief to the cabin manager (CM). The CM, who was now seated at the forward attendant station, heard three interphone call ‘chimes’ in the cabin and answered the call by lifting his handset from its cradle, but he could not hear the co-pilot. However, the co-pilot was able to hear the CM speaking, and started to brief him before he realised that he was not being heard. This was coincident with the CM hanging up his handset. During this failed attempt to communicate and about the same time as the aircraft started a descent to Newcastle, the avionics smoke caption extinguished on ECAM. The interphone emergency call initiated by the co-pilot continued to remain active, and about a minute later, the commander and co-pilot heard one of the cabin crew speak on the interphone trying to get their attention; this cabin crew member was seated at the attendant station at the rear of the aircraft. Due to a slight delay in responding, the cabin crew member hung up the handset just as the co-pilot answered. The CM made a PA announcement to the passengers using the handset at the forward attendant station, advising them to remain seated and await further instructions. The commander asked the co-pilot if he had spoken to the cabin crew, and advised him that they were now only about ten minutes from landing. The co-pilot stated that he was still having difficulties in speaking with them, but would try again; the sound of a cockpit switch selection and a single ‘chime’ were recorded on the CVR. The CM, upon hearing the interphone call chime in the cabin, removed his handset from its cradle and pressed and released the emer call button on the keypad before speaking Footnote 1 The operator’s procedures described that on hearing this announcement, cabin crew should immediately interrupt their duty and stow away any catering equipment, before returning to their stations and fastening their harness to await further instructions from the cabin manager or pilots. 2 Nature, Intention, Time and Special Instructions. 11 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 into it. The co-pilot responded and two-way communications was finally established. A NITS brief was provided to the CM, who then briefed the cabin crew before he made a PA announcement to the passengers, advising them that they were making a precautionary landing at Newcastle Airport. Three minutes elapsed between the time that the co-pilot first activated the interphone emergency call function and when two-way communication was established with the cabin crew. The approach and landing at Newcastle were uneventful. The aircraft was met by the RFFS on the taxiway, where the aircraft was stopped and the engines shut down. The RFFS carried out an inspection of the aircraft, during which fumes were still noticeable in the cockpit and the aircraft was electrically powered down as a precaution. The passengers were disembarked using stairs and taken to the terminal by buses. Recorded information A complete record of the incident flight was available from the aircraft’s CVR and FDR; pertinent information has been included in the history of flight. The selections and status of the cabin interphone system is not recorded on the FDR. Aircraft examination The source of the smoke and fumes was traced to the cockpit additional electrical supply static inverter 3, which had overheated. A replacement item was installed and the aircraft subsequently returned to service. Static inverter The cockpit additional electrical supply static inverter converts 28VDC input power to 115VAC/60Hz output power, which is provided to three outlets in the cockpit to enable the charging of electronic devices, such as Electronic Flight Bags. The static inverter is in the avionics bay, installed below the cockpit floor near the co-pilot’s footwell. By design, the cockpit floor is not sealed and so smoke or fumes generated in the avionics bay may enter the cockpit. The static inverter has been standard equipment on Airbus A320 family4 aircraft since the end of 1999, and may also be installed on Airbus A330, A340 and A380 aircraft types. Static inverter failures The operator of G-EZWX experienced its first failure of a cockpit additional electrical supply static inverter on 28 August 2014. This was reported in AAIB Bulletin 12/2014, and involved G-EZWM, an Airbus A320 aircraft, which diverted to London Gatwick due to smoke and fumes in the cockpit. Inspection of the static inverter found that damage centred on a capacitor, C306, which had overheated and failed. This resulted in the release of a ‘strong acrid electrical type’ smell. At this time, the static inverter manufacturer considered that the failure was an isolated occurrence. Footnote 3 Part Number 1-002-0102-1830, serial number AA11136801. 4 This includes the A318, A319, A320 and A321 aircraft types. 12 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 In January 2015, the operator had a second static inverter failure. This unit was fitted to Airbus A320, registration G-EZWK, which diverted to Amsterdam whilst en route from Berlin to Bristol, due to smoke and fumes in the cockpit. On both occasions, the crew had donned their oxygen masks. The aircraft manufacturer had received reports, including those from other operators, of eight other static inverter failures between August 2014 and December 2016. Of the total of 11 failures (including that of G-EZWM, G-EZWK and G-EZWX), eight had occurred between August 2014 and March 2016. The reports submitted to the aircraft manufacturer indicated that the failures had all occurred in flight, with at least seven resulting in diversions. Notification of static inverter failures to operators On 9 March 2016, following the first eight failures, the aircraft manufacturer issued Technical Follow-up (TFU) 24.00.00.114, ‘Premature failure of the Cockpit Additional Supply Static Inverter’`. This noted that ‘some operators of the A320FAM aircraft experienced premature failure of this static inverter which led to smoke/burn smell in the cockpit’ 5 , and that the fault had been isolated to capacitor C306 (the same component identified during the G-EZWM investigation in August 2014). This capacitor had been identified as not having received an individual quality screening prior to fitment, with a batch6 of 2,058 static inverters affected. The vendor had yet to develop a solution and no remedial action was provided in the TFU at that time. On 13 October 2016, VSB 1830-25-37, ‘Equipment – Cockpit Additional Electrical Supply – Static Inverter – Capacitor C306 replacement,’ was published on the vendor’s website, which recommended the static inverter to be removed for modification. On 19 October 2016, TFU 24.00.00.114 was updated by the aircraft manufacturer to reflect that VSB 1830-25-37 was available and noted that operators could modify their affected static inverters free of charge. Technical Follow‑up notices and Operator Information Transmissions TFUs form part of the aircraft manufacturer’s technical documentation that is provided to operators. In July 2014, the aircraft manufacturer rationalised its documentation processes, including TFUs, following recommendations from operators. It communicated these changes to TFUs in Operator Information Transmission (OIT) 999.0017/14 which stated that it would ensure that there is a clear segregation between: ● ‘Instructions,’ which were defined as ‘documents which enable operators to perform an action on their aircraft’ and ● ‘Information,’ defined as ‘documents that help customers to support and improve the operation of their aircraft.’ Footnote 5 ‘A320FAM’ refers to the A320 family of aircraft. 6 Part number 1-002-0102-1830, serial numbers from AA11135265 to AA11137323 (manufactured between 10 September 2012 and 25 November 2014). 13 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 The TFU was defined by the aircraft manufacturer as a type of document providing ‘Information,’ not ‘Instructions.’ The aircraft manufacturer further advised that: ● ‘TFU gives operators follow‑up information, from the time an issue is identified to the time that the solution has proven its efficiency in the field. However, TFU may make recommendations to apply instructions that are included in other relevant publications such as Service Bulletins or AMM/ TSM tasks’7’ and that: ● ‘an OIT ‘is issued to communicate quickly to operators information on in-service events or findings reported to Airbus, that have substantial implications on the Airbus fleet operations, and to provide relevant advices or recommendations in order to address or mitigate them.’ Operator’s TFU and VSB review process TFU’s may be accessed by operators using an online electronic database which can be configured to provide automatic notifications when a new TFU is issued, or track the status of an existing one. The operator of G-EZWX used a maintenance management software system called AMOS 8, which formed part of its airworthiness control. Technical documents, such as Airworthiness Directives, Service Bulletins (SBs) from the aircraft manufacturer, and OITs were imported into AMOS by the operator. This information was then reviewed by its engineering department, who would implement the necessary action. However, TFUs were not imported into AMOS, nor routinely reviewed by the operator. The operator of G-EZWX did not receive notification from the static inverter manufacturer that VSB 1830-25-37 had been issued in October 2016, as it had not registered with this vendor to receive updates. The operator advised that it relied predominantly upon communications from the aircraft manufacturer to identify VSBs that required follow-up action. On 1 December 2016, three days after the incident to G-EZWX, and following discussions with the aircraft manufacturer’s on-site representatives, the operator became aware of TFU 24.00.00.114 and VSB 1830-25-37. Decision to issue TFU by the aircraft manufacturer On 2 December 2016, the operator of G-EZWX asked the aircraft manufacturer why the cause of the static inverter failures was communicated in a TFU, rather than an Alert Footnote 7 AMM (Aircraft Maintenance Manual) and TSM (Trouble Shooting Manual). 8 AMOS is a proprietary software system that is in use at over 140 other operators. 14 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 Operator Transmission (AOT), an OIT or an SB 9 , which it considered more appropriate in relation to the ‘severity of the outcome;’ noting that: ‘failure of the capacitor due to overheating resulting in a smoke smell event should be classified as a safety issue and hence should have been clearly communicated to the operators.’ The aircraft manufacturer advised that its initial analysis, following the first eight failures, had determined that a TFU was the most appropriate means of communicating the information related to the overheating of the Static Inverter capacitor 306, and, from October 2016, related to the availability of the VSB 1830-25-37. The analysis had taken into account aspects such as failure mode, availability of crew procedures and impact on airworthiness and safety. The aircraft manufacturer further advised that it had continued to reassess the situation and had decided in September 2016 that it would issue an OIT to ‘broaden awareness amongst operators. The OIT 999.0096/16 ‘Failure of the Cockpit Additional Electrical Supply System’ was submitted for internal review on 20 October and issued to all operators on 15 December 2016. This OIT highlighted that the reason for the failure of the static inverter had been identified and VSB 1830-25-37 had been published to address this. The AAIB contacted another UK operator that operated a large 10 fleet of the Airbus A320 family of aircraft. It had a similar understanding of TFUs, had similar internal processes to deal with them and TFUs did not form part of its routine technical document review process. This operator had several of its aircraft fitted with static inverters from the affected batch and only became aware of the issue following receipt of OIT 999.0096/16. Cabin interphone system The Airbus A320 is equipped with a Cabin Intercommunication Data System that incorporates the functions of the cabin and cockpit interphone and passenger address systems. The cabin and cockpit interphone system allows telephone communications between all cabin crew attendant stations and the cockpit. Communication at each cabin attendant station is made using a handset. G-EZWX was fitted with one handset at the forward cabin crew attendant station (Figure 1), and two handsets at the rear attendant stations. In the cabin, interphone calls can be made from an attendant station to another attendant station or the cockpit, by making the appropriate selection on the handset’s keypad (Figure 2). The handsets are also used to make passenger announcements in the cabin. Footnote 9 An AOT and an OIT are used when it is necessary to communicate quickly with operators, and provides a means to raise the awareness of operators to information issued which is related to significant in-service events. An SB issued by the aircraft manufacturer provides instructions, and can be used to cross-reference to VSB’s issued by a vendor. 10 More than 100 aircraft. 15 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 On G-EZWX, a call can be made from the cockpit to either the forward attendant station, aft attendant stations, or all attendant stations simultaneously. These options are selected by pressing and releasing the fwd, aft or emer pushbutton switches on the overhead panel in the cockpit. For a pilot to listen to an interphone call in the cockpit, the cab (cabin) reception knob on the pilots’ audio control panel (ACP) must be selected ON. For the cabin crew to hear the pilot speaking over the interphone, the pilot must select the att (attendant) transmission key on the ACP to ON, and then set the int/rad switch on the ACP to the rad position, or depress and hold the sidestick radio transmit selector, whilst speaking into the boom or oxygen mask microphone. The cabin interphone system prioritises calls initiated from the cockpit, which override calls made from the cabin. An interphone call to an attendant station handset is ‘connected’ when the handset is unlatched and removed from its cradle. If the ‘connected’ handset is then placed back onto its cradle, or the reset button on the handset’s keypad is pressed and released, the handset is ‘disconnected’ from the call. This is referred to as a handset that has been ‘reset’. Figure 1 G-EZWX forward attendant position handset in its cradle Figure 2 G-EZWX forward attendant position handset keypad 16 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 Cabin interphone ‑ normal operation for calls between cabin and cockpit Under normal operation, calls from the cabin attendant stations to the cockpit are initiated by pressing and releasing the capt button on the handset keypad. When selected, the att key on all ACP’s are illuminated and a buzzer sounds11 once in the cockpit. In the cabin, the ‘captain’ message is displayed on the corresponding attendant station Attendant Indication Panel (AIP). Calls from the cockpit to the cabin are initiated by selecting either the fwd or aft attendant station call switches on the cockpit overhead panel. When selected, the red lights illuminate on the corresponding forward or aft area call panel, a single hi-low chime sounds in the relevant section of the cabin and a ‘captain calls’ message is displayed on the adjacent AIP. Cabin interphone ‑ emergency operation for calls between cabin and cockpit In an emergency, a call can be made from one attendant station handset to all other attendant stations and the cockpit, enabling simultaneous communications between crew members. This is initiated by pressing and releasing the emer call button on the handset. When selected, the buzzer in the cockpit sounds three times and the emer pushbutton switch and all ACP att keys flash repeatedly. In the cabin, red lights flash at both forward and aft area call panels, three hi-low chimes sound in the cabin and the ‘emergency call’ message is displayed on all AIP’s12. The emergency interphone function is initiated from the cockpit to all cabin attendant stations by pressing and releasing the emer pushbutton on the overhead panel. This results in red lights flashing at both forward and aft area call panels, three hi-low chimes sounding in the cabin and the ‘call emergency’ message displayed on all AIPs. An emergency interphone call from the cockpit is cancelled under the following conditions: ● when all attendant station handsets have been ‘reset’, or ● after two minutes, if the cockpit ACP has not been configured to transmit on the interphone channel by selection of the att key, or ● after approximately five minutes if the emergency call is not connected to an attendant station handset. Cabin interphone ‑ testing A test of the emergency interphone system on G-EZWX found no defect in its operation. However, it was found that when an emergency call from the cockpit was initiated and the forward attendant station handset was then lifted from its cradle, connecting it to the call, and the handset was then ‘reset’ (disconnected) by either placing it back onto its cradle or by pressing the reset button on its keypad: Footnote 11 The buzzer is inhibited during takeoff and landing. 12 Depending upon configuration, the message may only be displayed on the AIP adjacent to the handset where the call was initiated. 17 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 ● It was possible to make a PA announcement to the cabin from the forward handset whilst the emergency interphone call from the cockpit was still in progress. ● It was not possible to make a call to the cockpit by selecting the capt button on the forward handset’s keypad until the emergency interphone call was cancelled. ● It was not possible to call an attendant station handset at the rear of the aircraft from the forward handset unless the handset at the rear had also been reset, or until the emergency interphone call was cancelled. ● Pressing and releasing the emer call button on the forward handset’s keypad resulted in this handset being ‘reconnected’ to the emergency call, enabling the re-establishment of communication with the cockpit. ● Pressing and releasing the fwd pushbutton on the overhead panel in the cockpit, whilst the emergency call function was still active, resulted in a single hi-lo chime in the forward cabin. If the forward handset was then removed from its cradle, it was connected to the call from the cockpit. Cabin interphone – documentation and training Documentation provided by the operator to its cabin and cockpit crews did not include information on how to re-establish communications from a ‘reset’ handset to an emergency interphone call initiated from the cockpit or cabin. The operator’s documentation was based on that provided by the aircraft manufacturer. The AAIB investigation noted that specific use of the emergency interphone call function was not included in cabin crew training. Analysis Static inverter failure There have been a number of failures of static inverter associated with a particular batch of an internal component. Following identification of the first eight failures, the aircraft manufacturer provided information to operators in the form of a TFU. The aircraft manufacturer’s decision to use a TFU as the most appropriate communication method was based on a number of factors, including operational procedures being in place to remove smoke and fumes released into the cockpit. A TFU does not require operator action and is a document that ‘helps customers to support and improve the operation of their aircraft.’ As no follow-up action is required, the operator of G-EZWX, like another UK operator, did not conduct regular reviews of TFUs as part of its airworthiness control processes. This contrasts with important information provided in Airworthiness Directives, Service Bulletins and Operator Information Transmissions which are likely to require operator action and so are subject to regular review. 18 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 On 13 October 2016, just over a month prior to the failure on G-EZWX, the static inverter manufacturer made VSB 1830-25-37 available on its website and, six days later, the aircraft manufacturer updated TFU 24.00.00.114 to incorporate this information. However, the operator was not aware of this VSB and did not review the updated TFU, as the operator relied predominantly on the aircraft manufacturer to communicate such information by means of an OIT or SB to indicate that action might be required. After the incident, the manufacturer’s on-site representatives made the operator aware of both the TFU and VSB. On 15 December 2016 the aircraft manufacturer issued OIT 999.0096/16 ‘Failure of the Cockpit Additional Electrical Supply System’ to all operators. This OIT was issued to “broaden awareness” that the reason for the failure of the static inverter had been identified and VSB 1830-25-37 had been published to address this. One other UK operator, which had a number of its own aircraft affected, only became aware of the issue upon receipt of this OIT. Smoke in the cockpit and the emergency use of oxygen by flight crews are considered to be safety issues by ICAO and, in Annex 13 Attachment C, cite them as possible examples of a Serious Incident. Following the G-EZWX event, the operator queried the aircraft manufacturer’s use of a TFU in this instance as it had concerns that the identified mechanism of the ‘capacitor failure due to overheating resulting in a smoke smell event should be classified as a safety issue and hence should have been clearly communicated to the operators.’ The failure of the static inverter on G-EZWX resulted in an unplanned diversion and the flight crew donning oxygen masks. As a consequence of the smoke and fumes released into the cockpit, this particular mode of failure of the static inverter has resulted in a total of seven aircraft diverting. Cockpit to cabin communications The co-pilot experienced difficulties in communicating with the cabin crew using the emergency interphone system, and it took three minutes from first selecting the emergency interphone function before two-way communication was eventually established. It was most likely that the reason the CM had been unable to hear the co-pilot was because the co-pilot had not set his ACP to transmit on the cabin attendant channel, or he had omitted to select the radio transmit switch on his ACP or sidestick whilst speaking into the oxygen mask microphone. This led to the CM hanging up his handset, which disconnected it from the emergency call. The CM was then able to make a passenger announcement from the forward handset. However, as the emergency interphone call was still active, it would not have been possible for the CM to have initiated an interphone call to either the cockpit or cabin crew at the rear of the aircraft, until the emergency call was cancelled. In the absence of any other action, this would have required the CM to wait for up to two minutes until the emergency call ‘timed out.’ Pressing the emer call button on his handset would have reconnected the CM to the emergency call immediately; however, the CM was not aware that this was required as it was neither documented nor covered in training. Three minutes after having initially tried to establish communications with the cabin crew, 19 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 a button press in the cockpit accompanied by a single call chime was recorded on the CVR. The CM removed his handset from its cradle and pressed and released the emer call button on the keypad before speaking into it. Communications were then established between the CM and co-pilot. The single call chime, followed by communications being established with the CM indicates that the co-pilot had selected the forward attendant call button at this time. This call was prioritised over calls initiated from the cabin and it was therefore not necessary for the CM to have selected the emer call function on his handset to connect the call. It is important that communications between flight crew and cabin crew can easily be established in the event of an emergency and the emergency interphone system is provided to facilitate this. However, testing has shown that the system’s operation is not fully documented and its use is not fully understood. The operator of G-EZWX did not provide training to crew on the operation of the emergency interphone system. The aircraft manufacturer has acknowledged that there is a need for additional information and has launched a review of operational documentation on the operation of the emergency interphone system. This review is due to be completed in July 2017, following which additional information is to be provided to all operators. The operator of G-EZWX has advised that it will update its manuals and training once this information is available. Safety action taken ● By 9 December 2016, the operator of G-EZWX had removed all affected static inverters from its fleet and those that were held as spares. ● The operator’s engineering department is now reviewing all TFUs on a routine basis. Further safety action ● The aircraft manufacturer has advised that, later in 2017, it will release an Inspection Service Bulletin (ISB) to assist operators in identifying and rectifying any of the affected static inverters. ● The aircraft manufacturer has also advised that it will provide additional information to operators on the operation of the emergency interphone system. ● The operator has advised that, following the provision of the additional information of the emergency interphone system from the aircraft manufacturer, it will include this as part of crew training and update the appropriate internal manuals. ● The operator has also advised that it intends to conduct a review of its processes that relate to VSBs. 20 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 Conclusion Static inverter failure The source of the smoke and fumes was traced to the cockpit additional electrical supply static inverter, which had overheated. The manufacturer of the static inverter isolated the fault to a component, capacitor C306, which had not received an individual quality screening prior to fitment. A batch of 2,058 static inverters were affected. The incident on G-EZWX was the eleventh failure reported to the aircraft manufacturer which had resulted in the release of smoke and fumes into the cockpit. Of the eleven failures, at least seven had resulted in diversions. The operator was not aware until after the incident that the manufacturer of the static inverter had published VSB 1830-25-37, nor that the aircraft manufacturer had previously communicated the problem with the static inverters in TFU 24.00.00.114. This was because the operator was not registered to receive notifications of VSB’s from the manufacturer of the inverter and, like another large UK operator, did not routinely review TFUs. Following a decision in September 2016, the aircraft manufacturer subsequently issued OIT 999.0096/16 to all operators on 15 December 2016 to “broaden awareness” that the reason for the failure of the static inverter had been identified and VSB 1830-25-37 had been published to address this. Both the aircraft manufacturer and the operator intend further safety action, in addition to that which has already been taken. Emergency interphone communications Initial communications between the CM and co-pilot using the emergency interphone system failed to be established, as the co-pilot either inadvertently omitted to set up his ACP to transmit on the cabin interphone channel or did not select the transmit button. The CM was unable to hear the co-pilot and hung up his handset, which disconnected it from the emergency call. Communication was subsequently established with the CM about three minutes later when the co-pilot selected the forward interphone call option. The investigation identified that neither information nor training was provided to crew on how to re-establish communications to the cockpit in the event that a cabin handset became disconnected from an emergency interphone call initiated from the cockpit. Whilst an emergency call is in progress, it is not possible to initiate a call to the cockpit from a handset that has been disconnected. However, by selecting the emer call button on the disconnected handset’s keypad, the handset is reconnected to the emergency call, allowing communications with the cockpit and other cabin crew who are also on the call. The CM was not aware of this feature, but had he been, communications may have been established more quickly. The emergency interphone system is infrequently 21 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-EZWX EW/C2016/11/02 used, and therefore it is important that crew have a good understanding of its operation in the event of an emergency. Both the aircraft manufacturer and the operator intend to take safety action to address this issue. 22 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 ACCIDENT Aircraft Type and Registration: DHC-8-402 Dash 8 (Q400), G-PRPC No & Type of Engines: 2 Pratt & Whitney Canada PW150A turboprop engines Year of Manufacture: 2010 (Serial no: 4338) Date & Time (UTC): 14 December 2016 at 0624 hrs Location: On departure from Manchester Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 4 Passengers - 27 Injuries: Crew - None Passengers - None Nature of Damage: Damage to engine access panel, impact damage to vertical stabiliser and VOR/LOC antennas Commander’s Licence: Airline Transport Pilot Licence (Aeroplanes) Commander’s Age: 45 years Commander’s Flying Experience: 7,120 hours (of which 142 were on type) Last 90 days – 142 hours Last 28 days – 63 hours Information Source: AAIB Field Investigation Synopsis Following overnight maintenance work, the outboard engine access panel on the No 1 engine was incorrectly latched shut. This was not identified by the engineer completing the task, by the flight crew during the subsequent pre-departure inspection, or by the ground operations personnel dispatching the aircraft. During takeoff the panel failed at the hinge attachment points and departed the aircraft, striking and damaging the vertical stabiliser, before coming to rest on the runway and its grass verge. A previous incident, where the same engine panel was lost during takeoff, had occurred on the aircraft a month earlier. This report addresses both incidents. Safety action has been taken by the aircraft manufacturer to add labelling and amend the Aircraft Maintenance Manual (AMM), and the operator has revised its maintenance procedures. In addition, two Safety Recommendations have been made relating to flight crew pre-departure inspection procedures and dissemination of safety information to ground crew. History of the flight Following a day of routine flying operations on 13 December, the aircraft night-stopped at Manchester Airport and was parked on a remote stand. The operator’s contracted maintenance organisation completed a routine daily check on the aircraft that evening. This included 23 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 checking the oil content of the No 1 engine, accessed by opening the outboard main access panel on the engine nacelle. The check was concluded by approximately 2115 hrs, with the aircraft scheduled to return to service for a 0610 hrs departure the next morning. The aircraft Technical Log entry for the daily check was signed by the engineer at 0010 hrs. The operating flight crew arrived at the aircraft at 0530 hrs and began their normal pre-flight checks. At 0550 hrs, in accordance with company procedures for the first flight of the day, the commander conducted the pre-departure inspection. As it was still dark, he used a torch to supplement the ambient airport lighting during his inspection. He did not identify any issues with the aircraft and the crew continued with their normal departure routine. The ground crew, who were responsible for pushing the aircraft back off the stand, subsequently arrived and conducted their own walkround check of the aircraft, also identifying nothing of note. The aircraft was dispatched on time and taxied to Runway 23R for takeoff. At approximately 0624 hrs the aircraft commenced its takeoff roll and then continued on an apparently uneventful flight to Hannover, Germany, landing there at 0752 hrs. After the aircraft had parked on the stand and the passengers had disembarked, the ground crew informed the cabin crew that a panel was missing from the No 1 engine. The message was relayed to the flight crew, who inspected the aircraft prior to contacting the operator’s maintenance control department. The operator informed Manchester Airport operations staff at 0836 hrs, who then conducted an inspection of Runway 23R. The panel was recovered from a grass area to the side of the runway, approximately 440 m from the runway threshold. Sections of the panel hold-open strut were also recovered from the runway and adjacent paved areas in the same vicinity (Figure 1). Figure 1 Location of items released from the aircraft during takeoff 24 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Aircraft information The DHC-8-402 Dash 8 (Q400) is a twin-turboprop, medium-range, passenger aircraft. The main engine bay of each engine nacelle has two large forward access doors, one inboard and one outboard. These access doors are made from a carbon/epoxy composite material with integral foam-filled stiffening ribs. Each door is hinged at the top, has a single telescopic hold-open strut and is secured in the closed position by four quick-release lock pin latches (Figure 2). Each latch, when closed, engages a pin into a receiver mounted within the engine nacelle structure. The outboard door on the No 1 engine and the inboard door on the No 2 engine allow access to service the engine oil system. Figure 2 Forward engine bay access panel Aircraft examination On inspection of the recovered panel all four latches were found to be in the closed and latched position. There was no damage to the latch bolts or the receiving fixtures on the nacelle (Figure 3). 25 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Figure 3 Engine access panel and nacelle Inspection of the aircraft vertical stabiliser showed puncture holes in the skin on both sides, with impact marks also present on the leading edge de-icing boot. There was also impact damage to both VOR/LOC antennas. Figure 4 Damage to vertical stabiliser (similar damage occurred on both sides of the vertical stabiliser) 26 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Previous incident on the same aircraft On 9 November 2016 the No 1 engine access panel was found missing from G-PRPC. On the day before, it had arrived at Belfast City Airport at 2145 hrs following a day of routine operations. Engineers from the operator’s subsidiary maintenance company met the aircraft and completed a routine daily check on the aircraft, which included checking the engine oil contents of both engines. After topping up the No 1 engine with oil, the engineer closed the access panel and completed the remaining parts of the aircraft check. The Technical Log for the aircraft was signed at approximately 0030 hrs. Later that morning the flight crew arrived to prepare for the first flight of the day. At 0609 hrs the aircraft commander carried out a pre-departure inspection of the aircraft, which did not identify any issues. The ground crew responsible for departing the aircraft arrived at 0615 hrs and also conducted a walkround inspection. At 0643 hrs, the aircraft departed from Runway 22 for a flight to Glasgow Airport. At 0700 hrs the flight crew from another departing aircraft from the same operator reported a foreign object on the runway. An inspection of the runway was carried out by Airport Operations at the request of Air Traffic Control and an engine access panel was recovered some 300 m from the threshold of Runway 22. G-PRPC landed at Glasgow at 0715 hrs, at which time the ground handling personnel informed the flight crew that the No 1 engine access panel was missing from the aircraft. Further inspection also identified damage to the left wing leading edge de-icing boot and wing skin panel. The recovered access panel showed that all four latches were closed. There was no damage to the nacelle where the latching bolt receiving features were located. Following this incident, on 29 November 2016, the operator issued Notice to Engineers (NTE) 22 requiring that: ‘Following completion of all work either an independent person carries out a walkround inspection to verify all access panels are fitted/secure, or the certifying engineer must return after a notable period of time for a double check of the security of the disturbed panel security. The independent person could be a technician or a pilot, or the notable period of time could be after completion of paper work.’ The NTE did not require the additional walkround inspection to be recorded in the maintenance paperwork or the aircraft Technical Log. 27 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 CCTV footage Airport CCTV footage was recovered showing the commander’s pre-departure inspection, which was done with the aid of a torch. The torch beam could be seen on various parts of the aircraft as the commander went to the nose of the aircraft first, then to the tail, followed by the No 2 engine and the landing gear. The commander then inspected the No 1 engine and the torch light could be seen on the access panel area. The inspection had a total duration of 3 minutes. No CCTV footage was available for the period when the maintenance check was carried out on the No 1 engine. Previous incidents on the global fleet The manufacturer reported that there have been nine other incidents of engine access panel loss in-flight across the worldwide Q400 fleet. In each case there was no damage to the airframe latch bolt receiving fixture, suggesting that the panel latches had been closed incorrectly. 28 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Human factors Engineering The maintenance carried out on the aircraft on the evening of 13 December was conducted by a third party maintenance provider under contract to the operator. Following the incident, the maintenance provider’s staff based at Manchester Airport stated that they were unaware of the existence of NTE 22 at the time the work was carried out, so had not conducted any additional post-maintenance inspection to check the security of the latches and panels. The operator’s safety investigation established that, unlike the operator-owned maintenance subsidiary, there was no procedure in place for contracted maintenance company staff to read and sign NTEs. The routine daily check requirement was laid out in a set of task sheets where each task, once completed, required sign off by an engineer licensed on type. The list of the tasks commenced with checks to internal systems and components, identified as tasks 1 to 14. The first external check was task 15, which required a full external walkround of the aircraft checking for damage, leaks and panel security. Checking the engine oil content of each engine was listed as tasks 26 and 27. These tasks were highlighted as safety critical and had a requirement for an independent check of the oil cap (or repeat inspection after a period of time, in the case of a licenced engineer completing the task). There was no similar instruction regarding the closing of the panel. Whilst the task stated the oil contents check should be in accordance with the Aircraft Maintenance Manual (AMM), a subsequent review with the aircraft manufacturer confirmed that, at the time of this event, the AMM did not contain any instructions on opening or closing the engine access panel. The operator’s expectation was that each item on the daily check task sheet would be signed for. The individual pages would then be certified complete and an entry would be added to the aircraft Technical Log, stating that the daily check had been completed. The signed hard copies of the task sheets and Technical Log pages should then have been posted to the operator’s HQ in accordance with their procedures. The operator’s safety investigation identified that the contracted maintenance company was not certifying the individual tasks or task sheet pages, but was just adding an entry directly into the aircraft Technical Log. The hard copy documents were also not being sent to the operator. Interviews with the engineers involved in both the first and second incidents identified a common technique used to secure the engine access panel. This involved closing the two upper latches first, followed by the two lower ones. Practical assessment of this technique showed that occasionally, as a result of a slight misalignment of the panel, it did not close correctly into the gap in the engine nacelle. Given the height of the panel and shorter distance to the hinge line, it was difficult to apply the necessary force to fully engage the panel at the level of the top latches, when compared to applying a similar force at the bottom of the panel. This could result in the top latches being closed, without the panel being properly located. As a consequence, the locking pin would not be engaged in the receiving fixture on the nacelle side, but the latch would externally look and feel as if it was properly closed. Once the upper latches were closed in this manner, the panel would rest on the 29 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 upper latch pins. Significant force could then be applied to the bottom of the panel while the lower latches were closed, but the pins would not engage in their receiving fixtures. The only external visual confirmation of the incorrect closure of the panel, was a small gap between the access panel and the surrounding nacelle panels (Figure 5). Figure 5 Panel gap resulting from an incorrectly latched panel (viewed from the ground under similar lighting conditions to both incidents) The engineers in both incidents involving G-PRPC were standing on steps to access the engine which meant once the access panel was closed, they were looking downwards at the panel and using a head torch to supplement the ambient lighting on the stand. Figure 6 shows how the perspective of the gap in the panel changes, when viewed under these circumstances. This would have been further exacerbated on the incident aircraft as the surrounding panels were painted purple rather than white, providing much less contrast to the shadow cast by the access panel. 30 © Crown copyright 2017 Figure 6 View of the panel gap following incorrect closure, from the perspective of the engineer conducting the task. The operator subsequently revised NTE 22 post-incident to introduce a procedure where a sticker is placed over the bottom of the panel, when it is closed post-maintenance. This provides visual and tactile confirmation to the engineer that the panel is correctly closed and secured. Flight operations The airline procedures for pre-departure inspection of the aircraft were documented in the Operator’s Operations Manual Part B4 section 2.5.8 ‘External Inspection,’ which stated: ‘The external checks are normally performed walking clockwise around the aircraft starting at the front passenger door. Crews shall not open any panels as part of the external inspection, unless there is a specific reason to believe that a security threat exists, or the Crew is pre-selecting a refuel figure. Particular attention should be made to ensure that all panels, equipment bay doors, engine cowlings are properly closed and secure and all pitot and static ports are not damaged or obstructed.’ AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 31 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 The inboard and outboard engine access panels were also highlighted as a specific check item in the pre-departure inspection checklist. The operator provided information on what initial and recurrent training was provided for flight crew with respect to the pre-departure inspection. Guidance was provided at several points through the training which was delivered whilst walking around the aircraft: ● During an initial ground school hangar visit ● During base training ● During line training ● Assessed on final line check and then bi-yearly line check . Following the first access panel loss in November 2016, the operator’s Flight Operations department issued Notice To Air Crew (NOTAC) 146/16 - ‘Engine Cowling and Hatches Inspection’, to request extra vigilance whilst conducting pre-departure inspections. The aircraft commander from the second incident on G-PRPC confirmed that he had read this document prior to the flight, but commented in interview that as he had previously been a flight engineer it did not contain any information that was new to him. The commander stated that he was aware that a daily maintenance check had been signed for in the aircraft Technical Log and that this involved opening the engine access panels. When asked how he would normally assess that the access panel was secure, he stated that the latches would be flush. He advised that this was taught to him during his recent Q400 type conversion course, and was shown to him during the hangar visit and during his line training. (The commander had joined the operator five months earlier.) Whilst the co-pilot had not been present during the pre-departure inspection prior to the accident flight, he stated that the securing of panels, including engine access panels, had been a classroom discussion on his Q400 type rating course. He had not had the opportunity to see a securely closed panel during the course hangar visit, as they had been open for maintenance at the time. He added that he had been shown the pre-departure inspection procedure by a co-pilot during his line training, who had not specifically highlighted the engine access panels as a check item. Two further NOTACs (63/16 and 64/16) have subsequently been issued by the operator, to provide specific guidance in identifying correct panel and door closure during the pre- departure inspection and to highlight the engineering requirement to use a sticker over the engine access panel to confirm correct closure. 32 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Ground operations Ground operations personnel usually work for a company contracted to provide a service for the airport and facilitate the ‘push back’ procedure for aircraft parked on stands. This consists of using an aircraft tug to reposition the aircraft from the stand to a location where the flight crew can safely start the aircraft engines and taxi away under their own control. Typically a two-man team is used, one to drive the tug and a second who connects a headset to the aircraft intercom, allowing them to communicate with the flight crew and coordinate the process. They are not required to have any technical qualifications and often work on numerous different types of aircraft. Before the aircraft dispatch process commenced, ground operations personnel were required to complete a final walkround check of the aircraft. Guidance for the task was provided in their Ground Operation Manual section 3.4.3.1: ‘Before pushback can commence a final walkround and external visual inspection of the aircraft must take place. This should include an inspection of the condition of the apron including the removal of any FOD1; confirmation that all hold, passenger and service doors, panels and latches are closed and secure; chocks and ground equipment are removed from the aircraft and there are no other obstructions preventing the aircraft pushback onto the taxiway.’ Ground operations staff did not receive copies of the operator’s NOTAC or NTE. The ground handler during the second incident had completed headset training in April 2014. This training included pre-departure checks. The training certificate from this course listed different aircraft types that were covered by the training, but did not include the Q400. The headset training did not specifically refer to the Q400 type, but did include a generic reference to checking that panels and engine cowlings were closed. Aircraft manufacturer’s response Advisory label The aircraft manufacturer has commenced development of a modification to add an advisory label to the access panel which provides pictorial guidance on how to ensure the panel is correctly closed and latched (Figure 7). Footnote 1 Foreign Object Debris. 33 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Figure 7 Advisory label modification AMM Temporary Revision Since this incident the aircraft manufacturer has issued AMM Temporary Revision 71-197, which includes instructions on how to correctly close the engine nacelle access door. Analysis On two separate occasions the outboard engine access panel on the No 1 engine on G-PRPC detached during takeoff. In both cases, the inspections of the panels and aircraft following the event showed that the locking bolts on the panel latches and the bolt receiving features on the nacelle had not failed or been damaged. In addition, the latches on the panels were confirmed to have been fully closed when the panels were recovered. As such, in both events the only explanation for the panels departing the aircraft during takeoff was that the bolts had not engaged in the receivers on the nacelle when the latches were shut. In this event, the aircraft sustained limited damage which did not compromise its ability to 34 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 complete the flight safely. However, there is the potential for more serious damage to occur and the departure of such a large panel from the aircraft could also endanger people on the ground. Engineering The engineers conducting the maintenance daily check prior to both incidents were experienced and well trained staff, who had safely completed the same task many times during the years preceding these incidents. They came from different companies, with separate training organisations and operated at different airports. No significant contributing factors were identified which differentiated these two incidents from any previous occasions that they had completed the same task successfully. The only apparent common links were the technique used to close the panel, the physical positioning of the engineer as this was done and the lighting conditions at the time. The technique of closing the top latches first, when combined with an access panel which may not immediately fit into its correct position without additional adjustment, appears to have created the conditions for a sequence of events which allowed the engineer to close the latches believing that they had correctly engaged the locking bolts, when in reality this was not the case. The fact that the engineers were then looking down on the panel, which was predominantly illuminated by the beam from a head torch, meant that the main indication of the gap at the bottom of the panel was only visually identifiable by the shadow that was cast. As the surrounding panels were painted purple this may not have been obvious, particularly considering that the engineer was not expecting the panel to be open once the latches were closed, was not specifically checking for the presence of a shadow, and may not have appreciated the implication of the presence of a shadow in this position. Aircraft manufacturer’s safety action The manufacturer’s addition of an advisory label on the panel will assist in raising awareness of the implications of a gap/shadow around the panel. At the time of this accident the AMM did not contain a procedure for opening/closing the panel. Evidence from this investigation suggested that using the technique of shutting the top latches first could, in some circumstances, increase the likelihood of the panel being closed incorrectly and not being secured. It would therefore have been beneficial for an approved technique for closing the panel to be included in the AMM. The aircraft manufacturer has since published Temporary Revision 71-197 to the AMM to introduce these instructions. Operator’s safety action The operator has modified the daily check task sheet to introduce a final check of engine access panel security. This includes the requirement introduced by the revised NTE 22 to place a security sticker over the panel edge to confirm that there is no gap present. The sticker acts as an additional visual confirmation for flight crew that the panel has been correctly secured. The operator has also introduced a requirement for subcontract maintenance organisations to receive copies of NTEs. 35 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Flight operations The operator’s Operations Manual provides clear guidance on how a pre-departure inspection should be completed, which highlights the need for the security of the engine access panels to be checked. However, there is a degree of inconsistency in the way in which this is taught practically to flight crew during their type training. The results of this were shown in the CCTV footage of the pilot’s inspection prior to the first incident, which did not follow the Operations Manual process. It was also identified by the co-pilot’s response when questioned about his training experience. If flight crew are not shown the difference between correctly and incorrectly closed panels, misunderstandings such as the belief that closed latches confirm the panel is secure can become accepted custom and practice, and incidents such as this may continue to occur. The improved NOTAC issued by the operator should help to increase awareness amongst their existing flight crew community, but introducing improved and consistent training will provide an opportunity to increase awareness amongst flight crew converting to the Q400. The following Safety Recommendation is therefore made: Safety Recommendation 2017-014 It is recommended that Flybe Ltd introduces defined and consistently delivered flight crew training on pre-departure inspections for the DHC-8-402 (Q400), compliant with the inspection procedure documented in its Operations Manual. This should include a practical element on the aircraft and a demonstration of correctly secured main engine access panels. Ground operations Whilst walkround checks by ground operations crew represent a final opportunity to identify issues such as obviously open access panels, the personnel involved are not technically qualified on type in the same way that engineers and flight crew are. The operator has no control over the quality and content of their training and the service may be provided by multiple companies across all the airports that the operator flies to. As such, their inspection of the aircraft should only be considered a gross check and cannot be relied upon to address issues such as closed but incorrectly secured panels. However, there is potentially some benefit to the operator in increasing general awareness using specifically targeted guidance information relating to safety issues. The following Safety Recommendation is therefore made: Safety Recommendation 2017-015 It is recommended that Flybe Ltd considers introducing a means of disseminating pertinent safety information to ground operations staff in an appropriate format. 36 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-PRPC EW/C2016/12/03 Conclusion Following overnight maintenance work, the outboard engine main access panel on the No 1 engine was not securely closed by the engineer, due to the latch bolts not engaging in the nacelle receiving features when the latches were closed. Contributory factors may have been a slight mismatch in the closure of the panel and the technique used by the engineer of closing the top latches first. The resulting gap around the panel was not identified by the engineer completing the task, possibly as a consequence of the angle at which he was looking down on the closed panel and the lack of contrast of the shadow cast on the dark coloured engine nacelle. The aircraft commander did not identify the incorrect closure of the panel during his subsequent pre-departure inspection, neither did the ground operations crew dispatching the aircraft. During the next takeoff, the panel failed at the hinge attachment points and departed the aircraft striking and damaging the vertical stabiliser, before coming to rest on the runway and its grass verge. The investigation identified a lack of consistency in the way flight crew were instructed on completing pre-departure inspections during their training. A previous accident, where the same engine panel was lost during takeoff, had occurred on the aircraft a month earlier. The circumstances and investigation findings for both accidents were the same. Safety action has been taken by the aircraft manufacturer to add labelling and amend the AMM and the operator has revised its maintenance procedures. In addition, two Safety Recommendations have been made relating to flight crew pre-departure inspection procedures and dissemination of safety information to ground crew, with the intention of preventing recurrence. 37 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 ACCIDENT Aircraft Type and Registration: Reims Cessna F150M, G-BDZC No & Type of Engines: 1 Continental Motors Corp O-200-A piston engine Year of Manufacture: 1976 (Serial no: 1316) Date & Time (UTC): 17 October 2016 at 1021 hrs Location: Bourn Airfield, Cambridgeshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Serious) Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence (A) Commander’s Age: 58 years Commander’s Flying Experience: 363 hours (of which 9 were on type) Last 90 days - 7 hours Last 28 days - 2 hours Information Source: AAIB Field Investigation Synopsis The aircraft was seen to take off with 40° flap set. It did not appear to climb and flew at low level above the runway. Approaching a line of trees beyond the end of the runway, the nose pitched up and the aircraft banked left. The left wing dropped and the aircraft descended in a steep nose-down attitude into the ground. The pilot was fatally injured but the passenger survived. The investigation concluded that the pilot had attempted to take off with the flaps unintentionally set to the fully deployed position. The excess drag in this condition prevented the aircraft from climbing. History of the flight The pilot started flying at Bourn Airfield in April 2016. He was not familiar with the Cessna aircraft which were available at the flying club so during the next few weeks he was checked out by an instructor, flying in both a Cessna 150 (C150) and a Cessna 152 (C152). He completed 4 hours of dual training, a proficiency check, twenty minutes of solo flight and several subsequent flights, including a land away, accompanied by the same instructor. On 17 October the pilot planned to take his father-in-law for a flight from Bourn to Enstone, Oxfordshire, and then return. There were two aircraft available for hire at the club. At the time he booked he had stated a preference for the C150 G-BDZC; the instructor thought this may have been because he had previously experienced the seat slipping back unexpectedly in the C152. The pilot and his passenger arrived at the airfield mid-morning. Another club member was 38 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 already there; he had opened up the club house and was planning to fly the club C152 with an instructor. He carried out a pre-flight inspection and refuelled the C152 before assisting the accident pilot with refuelling G-BDZC; he noted that both tanks were refuelled to just below the filler cap. The pilot’s own pre-flight inspection was partly observed by the other club member, who noticed that the flaps were deployed for the walkround. The pilot, with his passenger on board, started the engine and taxied from behind the C152 across to the run-up area, located on an old taxiway to the east of Runway 18 (Figure 1). He remained there a short while and then taxied towards the threshold of Runway 18, out of view of the occupants of the C152. Figure 1 Aircraft parking and run-up areas at Bourn Airfield The pilot broadcast a radio call to say that he was ‘rolling’ and the occupants of the C152 then saw the aircraft airborne, just above the runway, but not apparently climbing. They realised, as it passed in front of them, that the flaps were fully deployed. The instructor attempted to make a radio call to warn the pilot, but it was too late to be effective and there was no response. They watched G-BDZC continue towards a line of trees beyond the end of the runway and then saw the nose pitch up and the start of a left turn. The left wing then dropped and the aircraft appeared to enter an incipient spin, descending quickly to the ground. 39 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 Several people from the flying club and personnel from an industrial site on the airfield ran across to the aircraft. They were able to assist the passenger from the aircraft, but the pilot was trapped. Attempts were made to turn off the aircraft electrical power but it remained on, and, because of the potential fire risk, it was decided to attempt to get the pilot out. He was unconscious but they released him from the aircraft and pulled him clear. Cardiopulmonary resuscitation (CPR) was administered but they were not able to sustain his breathing. Emergency services arrived at the scene and a paramedic continued to attempt to resuscitate the pilot but without success. Accident site The aircraft had come to rest against some trees located on the southern boundary of the airfield (Figure 2). The accident site was some metres to the left of the extended centreline of the runway. Figure 2 View of airfield showing accident site location relative to the extended centreline of the runway (red line). The ‘old’, disused runway is visible to the right. The aircraft had taken off from the repositioned Runway 18, which had been brought into use during the spring of 2016. This was the result of the landowner leasing the old runway to a company that used it for storing ISO containers. The new runway utilised the old taxiway and had a grass extension to the north, giving a total length of 600 m. The trees on the southern boundary ran in an approximately east-west direction and had a gap in line with the old runway. The aircraft had come to rest in a steep, nose-down attitude against the trees at the western edge of the gap. The trees were up to about 40 ft high and 40 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 it was apparent that, apart from some light branches and foliage having become dislodged, there had not been a severe impact from the aircraft. Marks on the ground close to the base of the trees indicated that the aircraft had struck the ground in a near vertical attitude on its nose and outboard left wing. It had then rocked over onto the outboard region of the right wing before coming to rest with the tail resting lightly in the upper branches of a tree. It was concluded that the impact with the ground was consistent with the aircraft being in a spin to the left, with the velocity vector primarily in the downwards, as opposed to horizontal, direction. The forward fuselage was severely compressed during the impact, such that that the left side of the instrument panel had been pushed rearwards into the cabin. The left wing root had been severely disrupted at the junction with the fuselage, with the rear spar attachment having broken. The left wing had remained attached although there had been some movement relative to the fuselage. The propeller blades displayed evidence of chord-wise scoring, and a propeller ‘chop’ mark was found on the ground at the impact point, indicating that the engine was developing power. It was observed that the flaps were at their maximum deflection of 40°. The inboard end of the right flap was in contact with the right hand side of the rear windscreen and the fuselage skin immediately below, causing distortion. There were no scrape marks or abrasion damage to either; it was therefore concluded that the flaps were in this position prior to impact (Figure 3). Figure 3 As-found flap position, showing damage to rear windscreen and sill structure below 41 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 It was found that there was plenty of fuel aboard the aircraft. When the Fire and Rescue Service attended, fuel was reportedly leaking from the right wing tank fuel filler cap; they had stopped the leak using a clay compound. However, it was subsequently found that much of the fuel in both tanks had seeped away via a broken fuel line in the engine compartment. Although the Alternator/Battery Master switch was found in the off position, the turn and slip gyroscope motor could be heard running for approximately eight hours after the accident. The trim tab was noted to be in line with the elevator and thus in an approximately neutral position. Following an on-site examination the aircraft was recovered to the AAIB’s facility for more detailed inspection. Aircraft information General The C150 is a side-by-side, two-seat training and general use light aircraft. It was in production between the years 1959 to 1977; thereafter it was replaced by the C152. Although it has many similarities with the C152 model, and the two are often considered as a single type, there are some significant differences. Flap selection and indication are different and the C152 has a greater available payload. A study by the General Aviation Safety Council suggests that the accident rate in the UK is higher for the C150 than for the C152 1. Flaps The wing flaps on G-BDZC were electrically operated, with a motor-driven actuator in the right inboard wing driving a screw jack. A nut on the jack in turn drove a pulley; cables transferred the pulley rotation to an identical component in the left wing. Control rods were attached to the pulleys and flaps such that pulley rotation resulted in the flaps extending or retracting. Limit switches on the actuator cut the electric power at the fully extended and retracted positions. A mechanical flap position indication was provided in the left forward door post/windscreen pillar; in addition the flap extension could be seen from within the cockpit. The indicator consisted of a spring-loaded pointer running in a slot in the pillar, with calibration marks from 0° to 40°on the surrounding trim. A cable connected to the pointer ran via a conduit in the left wing root and was attached at its other end to the flap system pulley cable such that flap movement caused the indicator cable, and hence the pointer, to move in proportion. Wing flap selection on G-BDZC was controlled by a switch on the lower centre instrument panel (Figure 4a). To extend the wing flaps the switch must be held against spring pressure in the down position; when released the switch will return to the centre neutral/off position. To retract the flaps the switch had to be selected and held to the up position; the switch would return, under spring pressure, to the neutral position when released. It would take Footnote 1 GASCo study: ‘A Study of Fatal Stall or Spin Accidents to UK Registered Light Aeroplanes 1980 to 2008’ 42 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 approximately 9 seconds to fully extend the flaps in flight and 6 seconds to retract them. The flap switch did not give a visual indication of the selected flap position. The final production models of the C150 were fitted with a re-designed flap selector with detents for the flap positions and a position indicator located beside the switch. The C152 flap selection and indication is similar (Figure 4b), but the maximum flap travel was reduced from 40° to 30°. Figure 4a C150 flap selector switch as fitted to G-BDZC Figure 4b C152 flap selector/indicator switch Flap selector/indicator switch Flap selector switch 43 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 Aircraft examination The examination of the aircraft focused primarily on the flap operating system. It was decided to apply power to the flap system electrical circuit in order to operate the actuator. This involved restoring the electrical wiring between the fuselage and the right wing, as it had been necessary to cut them during the removal of the wings before the aircraft was recovered to the AAIB. As a result of structural distortion that occurred in the impact, it was necessary to remove the flap actuator from the right wing. Prior to applying power, the flap switch was checked for correct operation, with the spring biasing towards the central position being found to be satisfactory. The continuity or open circuit conditions for the switch positions were checked against the appropriate circuit diagram and were found to be correct. Finally, an electrical power supply was connected to the flap switch and it was found that the actuator responded to the flap switch selection and could be moved to its up/down limits, where it was stopped by the limit switches. It could also be halted at any intermediate position. Elsewhere in the flap system it was noted that the flap position indicator cable had broken close to its attachment to the cable linking the two pulleys. The latter cable had broken during the impact as a result of relative movement between the wings and fuselage. The possibility was considered that the failure of the indicator cable may have occurred prior to impact, which would have caused the pointer to indicate zero flaps regardless of their actual position. The cable failure was subjected to a metallurgical examination, which confirmed that the failure was due to overload and thus had occurred at impact. It is likely this occurred as a result of the failure of the pulley cable; each section either side of the failure would have recoiled due to the release of strain energy, causing a snatch load on the much lighter indicator cable. Elsewhere on the aircraft it was found that a degree of charring had occurred on a sheath containing a cable bundle behind the left side of the instrument panel. This appeared to be the result of partial penetration by a piece of sheet metal from the fuselage ahead of the left side of the windscreen. Opening up the sheath revealed that the lead connecting the battery to the master switch had been cut and the insulation had burned away over a localised area, exposing the conductor. This damage also extended to an adjacent cable, where the conductor had also been exposed. The damage had effectively bypassed the master switch, with the short circuit accounting for the fact that the electrics could not be turned off by the first responders. 44 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 Aircraft performance The aircraft was subject to additional limitations for performance calculation in accordance with ‘CAA Change Sheet 1, Issue 1, to the Cessna 150M 1976 Flight Manual.’ This change requires the addition of 15% to the scheduled takeoff run and distance, and a decrease to the scheduled rate of climb of 150 ft/min. At the maximum weight of 726 kg and in the prevailing conditions the aircraft should have required 520 m takeoff distance to clear a 50 ft obstacle. The distance from the start of Runway 18 to the line of trees is 740 m. Takeoff performance figures are not provided for other than the flaps-up position, but a note in the Flight Manual indicates that although the ground roll may be reduced with flap 10°, takeoff distance to 50 ft will not be improved. The Flight Manual includes the following note: ‘Flap deflections greater than 10° are not recommended at any time for take- off.’ The instructor who had flown with the pilot stated that he thought it was likely that 10° flap would have been selected for takeoff on the grass runway surface. This was the club policy and had been practised during the training and familiarisation flights. Pilot’s checklist The checklist provided in the Flight Manual does not include an action to deploy the flaps prior to a walkround inspection. However, the pilot’s commercially available checklist, like many others commonly in use, does include this action. The instructor commented that the pilot’s use of the checklist was methodical and during training they had some discussions about the layout of his checklist. Specifically, it was discussed that the selection of the master switch on as part of the ‘Internal’ checks, before carrying out a long sequence of actions including retracting the flap, might drain the aircraft battery. The instructor noted that the pilot had made some marks on his checklist to highlight the problem. The instructor stated that he had suggested that the pilot should comply with the checklist, but perhaps purchase the one used at the club which had a different pre-start sequence. The pilot’s checklist, recovered from the aircraft after the accident, showed that two items of the ‘Internal’ checks had been amended by hand, changing the order of actions prior to engine start (Figure 5). 45 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 Figure 5 Pilot’s amended checklist The pilot’s checklist was found open at the ‘Vital Actions’ and ‘Take Off’ page. The ‘Vital Actions’ section of the checklist includes an action to select Flap 10° for takeoff. This was in accordance with the club policy. Weight and balance According to the most recent Weight and Balance schedule for G-BDZC, dated 10 July 1996, the Basic Empty Weight was 517 kg (1,142 lb) and the Maximum Authorised Weight (MAW) was 726 kg (1,600 lb). The aircraft was fitted with a 49 litre fuel tank in each wing, giving a maximum fuel capacity of 98 litres, of which 13 litres were unusable. Using the best available data, a post-accident weight and balance calculation was completed; 22 kg (48 lb) of baggage recovered from the aircraft was included. The result suggested that the aircraft was within the allowable CG range, but approximately 40 kg (88 lb) above the MAW. 46 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BDZC EW/C2016/10/03 Accident history GASCo study The GASCo study of UK stall/spin accidents noted: ‘There have been 11 accidents on the Cessna 150 but only one on the Cessna 152, with 60% more hours flown by the C152. The reasons for this apparent difference in accident rate between the variants was not fully explained, although some of the handling characteristics were further explored. A recommendation made in the report was: ‘The Cessna 150 and Cessna 152 should not be treated as the same type and in particular pilots transferring from the Cessna 152 to the Cessna 150 should undertake formal Familiarisation Training.’ Inadvertent deployment of 40° flap The AAIB has reported on two previous fatal accidents where the unintended deployment of Flap 40° in a Cessna 150 was considered to be a factor. In February 1999, during a practice EFATO manoeuvre demonstrated by an instructor, a C150