AAIB Bulletin: 7/2018

detected a strong smell of aviation fuel and heard the sound of running liquid. He identified the source as a Bell 412EP helicopter, which was being shipped as cargo on the main deck of the aircraft and noted that fuel appeared to be leaking from a vent on the forward right-hand side of the helicopter. The ground operations agent reported the situation to the flight crew. The Airport Authority and RFFS were notified and the airport emergency response plan was activated. The flight crew shut down the aircraft and opened the escape hatch and upper deck service door to ventilate the aircraft. Upon arrival at the aircraft the RFFS noted that fuel was coming out of the bottom of LX-VCF’s fuselage, close to the left body landing gear, having leaked through the main deck, lower deck and avionics bay and was pooling on the apron beneath the aircraft (Figure 1). The aircraft was evacuated, electrically isolated and quarantined by the RFFS. The RFFS subsequently stated that the measured fuel vapour levels indicated a high risk of explosion and that the fuel flammability limits were potentially in range. After the aircraft had been made safe, all cargo, including the helicopter, was offloaded manually. Figure 1 Fuel exiting lower fuselage of LX-VCF 5 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Examination of the aircraft and helicopter The aircraft and helicopter were examined on 4 April 2017 by representatives from the aircraft operator, the UK Civil Aviation Authority (CAA), the airport authority, the helicopter owner and the owner’s insurer. Based on the initial information available, the AAIB had initiated a Correspondence Investigation and did not attend this examination. However, those who participated in the examination provided information to the investigation and the AAIB subsequently upgraded the investigation to a Field Investigation. The helicopter was encased in strong white plastic shrink-wrap and had been secured to a cargo pallet for the flight, which occupied three loading positions on the right side of the aircraft’s main cargo deck (Figure 2). During the aircraft examination, some fuel was present in the wells of the pallet and the securing straps were soaked with fuel. Figure 2 Bell 412-EP fuselage, wrapped in shrink-wrap, on main deck of LX-VCF prior to being offloaded at Prestwick In the area of the helicopter’s forward right-hand fuel vent, from which fuel was reported to have leaked, the shrink-wrap had been applied so that the opening of the vent was exposed (Figure 3). White tape had been applied on top of the shrink-wrap in the vicinity of the vent. 6 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Figure 3 Vent opening exposed Fig 3 Forward right-hand fuel vent on Bell 412-EP helicopter By comparison, the forward left-hand fuel vent on the opposite side of the helicopter was completely covered in shrink-wrap, so that the vent opening was sealed. White tape had also been applied in this area, but there was no evidence of fuel having leaked from this vent. The shrink-wrap was removed from the helicopter. No standing fuel was observed inside the shrink-wrap but some oil staining was evident on the inner surface of the wrapping. Some absorbent pads were also found inside the shrink-wrap. Upon opening the helicopter cabin, it was noted that the helicopter’s main battery (which displayed a ‘Class 8 (corrosive) hazard’ label) was installed in its normal stowage, but was disconnected. A fire extinguisher was secured to a stowage on the cabin floor. A number of cardboard packages containing various items were also found inside the helicopter cabin. During the examination the helicopter, including all wrapping and the internal packages, was weighed on the pallet and the total pallet weight was noted as 4,200 kg. The fuel filler cap was removed, allowing access to visually inspect the right upper fuel cell; fuel was present and the level was observed to be approximately half-way up the cell. There was no means to visually inspect the remaining cells. The helicopter was powered-up and the cockpit fuel quantity indicator indicated a total quantity of fuel on board of 1,440 lb. The helicopter was subsequently refuelled to full, after which the total fuel quantity indicated was 2,160 lb. The fuel bowser meter registered 467 litres. Following refuelling, the helicopter was observed by the onsite team for a period of two hours and the RFFS continued to observe the helicopter overnight. No fuel leaks 7 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 were observed. The helicopter was subsequently defuelled and shipped to the owner, after which it underwent a ‘5-year’ maintenance inspection. The owner advised that no defects were noted on the fuel system during this inspection which could have accounted for the fuel leak. Aircraft damage The interior of LX-VCF had suffered extensive fuel contamination. After the fuel vapours had dispersed, internal floor panels, ceiling panels and sidewall liners in the aircraft were lifted and contaminated insulation blankets were removed. Additionally, all aircraft system electronics, avionics wire looms and harnesses required decontamination. The aircraft undertook a ferry flight to its home base on 11 April 2017, after which a number of additional actions were required to return it to a fully airworthy condition, including extensive inspections, cleaning and application of corrosion-inhibiting fluid. All insulation blankets and lower deck ceiling liner panels and some elements of the cargo loading system required replacement. Background information In December 2016, the helicopter, a Bell 412EP serial number (S/N) 36414 had been sold by Bristow US LLC based in Louisiana, United States (the seller) to Agrarflug Helilift GmbH and Co in Germany (the buyer). Several agencies and individuals were involved in various aspects of the sale, preparation and transport of the helicopter. In addition to the seller and buyer, these included a sales agent acting as the buyer’s representative in the United States (US) and his assistants. Freight forwarding1 work was carried out by three organisations. A routing agent based in New Zealand was appointed to oversee the export requirements and transportation of the helicopter to Germany. It subsequently sub-contracted this work to a US-based cargo logistics company to act on their behalf in the US, which in turn appointed a US-based shipping agent to prepare the Air Waybill2 and report on progress. The helicopter was disassembled and prepared for transportation by the seller’s staff at their facility and loose items were loaded into crates. To protect it during transport, the helicopter fuselage was shrink-wrapped by a specialist company contracted by the sales agent. A road transport company then collected the shipment from the seller’s facility in Louisiana on 23 January 2017 and transported it by road to Houston Airport. It was intended that the buyer’s sales agent would oversee the disassembly and preparation of the helicopter for transport; however, he was unable to attend and instead sent two assistants to oversee the preparations on his behalf and to ensure that no Footnote 1 A freight forwarder, or forwarding agent, is a person or organisation that organises shipments of goods, often contracting with multiple carriers to move the goods. Freight forwarders who handle international shipments typically have additional expertise in preparing and processing customs and other shipping documentation. 2 The Air Waybill is a document issued by, or on behalf of, the shipper for the air transportation of cargo. It acts as a contract of carriage between the shipper and the carrier(s). 8 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 damage occurred to the helicopter. One assistant was present at the seller’s facility when the helicopter was shrink-wrapped; however, it had already been disassembled prior to his arrival. A second assistant was present to observe the helicopter shipment being loaded onto the delivery trucks. Shipping of the helicopter The shipping agent booked the shipment with the operator’s sales department on 23 January 2017, having previously obtained a quotation for shipment from the operator in August 2016. During the quotation and booking process, the shipping agent explicitly indicated in writing that all fuels and batteries had been removed from the helicopter and that the shipment was non-hazardous. The shipping agent issued an Air Waybill for the shipment on 24 January 2017. The final destination for the shipment was Germany, and it was planned to travel by air via Luxembourg to Brussels and then onward by road to Germany. The shipment, comprising nine loose crates and the helicopter secured to a 20 ft pallet, was delivered to the operator’s facility at Houston Airport on 26 January 2017. After checking the documentation and conducting a visual inspection of the exterior of the wrapped helicopter, it was accepted for travel by the Dangerous Goods Manager from the operator’s contracted Ground Handling Agent (GHA). The loose crates were built-up on two pallets. The shipment was subsequently placed on hold by both the US Department of Commerce and US Customs, and was not released for export until 21 March 2017. It remained in the operator’s cargo warehouse during this time. The shipment was booked to travel on flight CV8617 on 24 March 2017; however, the operator was unable to produce a lashing scheme to secure the helicopter due to a software problem and only the nine loose crates travelled on this flight. The helicopter was re-booked to travel on flight CV8617, on 27 March 2017. However, after having been loaded onto flight CV8617 the operator’s loading supervisor noticed a small fuel leak from the helicopter. The leak was described as a ‘patch/stain of fluid on the ULD under the centre of the helicopter, approximately 6 to 10 inches in diameter’ and was reported to smell like jet fuel. The helicopter was offloaded and returned to the cargo warehouse. The operator’s sales department informed the shipping agent and asked it to arrange for an inspection of the helicopter. On 28 March 2017, a mechanic3 inspected the helicopter at the operator’s cargo facility. Also present was a representative from the shipping agent4 and one from the operator’s sales department. The mechanic, again accompanied by the shipping agent, returned later the same day to re-inspect the helicopter and perform additional work. They were escorted by a GHA agent. Review of CCTV footage from the cargo facility showed that Footnote 3 Who was also one of the sales agent’s assistants and had witnessed the helicopter being loaded onto the road transportation at the seller’s facility. 4 Who had prepared the Air Waybill. 9 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 this inspection lasted approximately 30 minutes. No walkaround was conducted and the mechanic appeared to focus his attention on the lower surface of the helicopter. He did not use any tools or remove the shrink-wrap to facilitate inspection of the helicopter. He used a cleaning spray to clean parts of the exterior surface, inserted absorbent pads between the shrink-wrap and the helicopter skin and applied some white tape over the shrink-wrap. The mechanic and shipping agent informed the cargo operator, and the other agencies involved in the transportation including the cargo logistics company, that the fuel leak had originated from residual fuel in the fuel lines and had been capped off. On 29 March 2017, the shipping agent provided the cargo operator with a revised Air Waybill and Air Cargo Manifest, together with a Purge Certificate indicating that the helicopter was free from fuel. The cargo operator accepted the shipment for travel and it was loaded on flight CV7754, which departed Houston on 30 March 2017. The loading supervisor responsible for this flight checked the helicopter several times prior to, during, and after loading and there was no evidence of a fuel leak or spill. Documentation The aircraft sales agreement for purchase of the helicopter was signed on 30 December 2016. The supporting documentation which formed part of the sales agreement stated that the helicopter was sold on an ‘As is – where is’ basis; that the helicopter was in a non-flyable condition at the time of sale; that the helicopter would be ‘delivered’ (handed over) at the seller’s (Bristow US LLC) facility for shipment at the buyer’s (Agrarflug’s) expense; that the seller would assist the buyer in disassembly and packaging of the aircraft at the seller’s facility, using reasonable packing practices; and, that the buyer’s representatives would be on hand to supervise and accept the packaging. A US Department of Commerce Shipper’s Export Declaration prepared by the cargo logistics company, stated that no hazardous materials were being exported. This document was signed by a Bristow US LLC employee on 23 January 2017, authorising the cargo logistics company to act as a forwarding agent for export control and customs purposes for the export of the helicopter. The original Air Waybill, issued by the shipping agent on 24 January 2017, described the helicopter as ‘Civil Model B412EP Helicopter (Helicopter main cabin)’ and declared the shipment as: ‘Consolidated cargo5 as per attached manifest’, which was also reflected on the original Air Cargo Manifest issued on 29 January 2017. Both the Air Waybill and the Air Cargo Manifest listed the cargo logistics company as the shipper. An Air Waybill requires two signatures, one from the ‘Shipper or his agent’ and one from the ‘Issuing carrier or its agent’. The original Air Waybill had a single signature across both fields. Footnote 5 Consolidated cargo refers to a consignment comprising of multiple packages, originating from more than one person, and shipped under one Air Waybill. 10 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Following inspection of the helicopter in Houston, a new Air Waybill and Air Cargo Manifest were issued by the shipping agent with the following statement added: ‘Not restricted as per special provisions A70.’ The revised Air Waybill was not signed. Additionally, a Purge Certificate dated 29 March 2017, produced by Agrarflug and signed by its Director of Maintenance, was provided to the cargo operator. This stated that the helicopter had been: ‘flushed, purged of all fluids and is clean and dry. Inhibiting fluid in accordance with (IATA) International Air Transportation Associated [sic] and is NOT considered as DANGEROUS GOODS.’ The load sheet for flight CV7754/30 March 2017 on which the helicopter travelled stated that the weight of the helicopter pallet was 4,455 kg. The Notification to Captain (NOTOC6) document for flight CV7754/230 March 2017 did not include any reference to the helicopter shipment. Additional information Bristow US LLC advised that, under the terms of the sales agreement, the buyer had complete responsibility for inspecting and transporting the helicopter. Agrarflug advised that it understood that the seller was responsible for preparing the helicopter for transport. It provided an email from the seller written in December 2016 which stated that ‘the aircraft will be prepared for shipping on 09 Jan.’ Other email correspondence from the buyer indicated that its representatives would oversee preparations of the helicopter for movement to Germany. The buyer’s sales agent confirmed that neither he nor his assistants had performed any work to disassemble, clean, drain, or package the helicopter and were not present when it was disassembled for transport. Additionally, he stated that he had no reason to suspect that the helicopter was fuelled as the Shipper’s Export Declaration provided to him by the seller indicated that no hazardous materials were being exported. Furthermore, based on his previous experience, he was aware that Bristow US LLC usually drained all fuel from helicopters it sold. A representative from the company who shrink-wrapped the helicopter advised that an open-flame torch was used to shrink the plastic wrap and stated that they would not have wrapped the helicopter if they had known it was fuelled. Representatives from both the cargo logistics company and the shipping agent reported that they were not aware that there was fuel or other dangerous good onboard the helicopter, when making arrangements for its transport or producing the Air Waybill. They based this understanding on the Shipper’s Export Declaration which indicated that no hazardous materials were being exported. Footnote 6 The NOTOC is a form which is used to notify the commander of an aircraft when dangerous goods are to be loaded on the aircraft board their flights. The NOTOC describes the nature, quantity of the dangerous goods and the location where it is loaded on the aircraft. 11 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 The mechanic who inspected the helicopter in the cargo warehouse in Houston informed the investigation that he had not seen any active dripping of fuel, just fuel residue. He concluded that escape of fuel was due to residual fuel in a fuel line that had been released when the helicopter was moved. He stated that the drip appeared to have come from the right side of the helicopter in the area of the fuel booster pump. In email correspondence relating to the fuel leak and subsequent inspection of the helicopter in Houston, the cargo logistics company indicated that if the mechanic could remove all the residual fuel, it might still be possible to ship the helicopter as non-hazardous cargo, but that a purge letter would be required from the shipper on company letterhead to verify this. The routing agent indicated that he did not believe the seller would provide this and instead asked Agrarflug to provide this. An email sent by the mechanic on 28 March 2017 following his inspection of the helicopter stated that ‘there was a minimal amount of residual fuel which had collected in the left-hand sump area and was seeping out of the drain’. He also indicated in the email that he had cleaned up the escaped fuel and placed approximately 50 absorbent pads between the fuselage and the shrink-wrap to absorb any additional fuel which might move to the sump area when the aircraft was moved. The buyer’s Director of Maintenance informed the investigation that he had issued the Purge Certificate stating that the helicopter had been flushed and purged of all fluids, following confirmation from the mechanic that the fuel leak in Houston was caused by residual fuel in the fuel lines. Shipping of dangerous goods by air ICAO Annex 18 to the Chicago Convention describes the international standards and recommended practices relating to the ‘Safe transport of dangerous goods by air’. It requires that dangerous goods are carried in accordance with ICAO document 9284 ‘Technical instructions for the safe transport of dangerous goods by air’ (known as the “Technical Instructions”), which contains requirements for the classification, preparation, packaging, documentation and transportation by air of dangerous goods. The International Air Transport Association (IATA) publishes the Dangerous Goods Regulations (DGR), a field manual which describes the requirements of the ICAO Technical Instructions, along with additional explanatory material. It is widely used by IATA member airlines and shippers and, is recognised as the industry standard guidance on the transportation of dangerous goods by air. The 58th edition of the DGR, effective 1 January 2017, was valid at the time the helicopter was packaged and transported. Air transportation of a vehicle, such as the helicopter, falls into the category of ‘UN3166 Vehicle, flammable - liquid powered’ and is considered as Class 9 Dangerous Goods. Shipment by air would require compliance with stringent requirements for preparation, packaging and labelling of the helicopter to identify it as dangerous goods. However, the DGR contained Special Provision A70 relating to the transport of engines and vehicles, which states: 12 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 ‘A70 Internal combustion or fuel cell engines of machinery, being shipped either separately or incorporated into a vehicle, machine or other apparatus, without batteries or other dangerous goods, are not subject to these Regulations when carried as cargo, provided that: (a) For flammable liquid powered engines: 1. The engine is powered by a fuel that does not meet the classification criteria for any class or division; or 2. The fuel tank of the vehicle, machine or other apparatus has never contained any fuel, or the fuel tank has been flushed and purged of vapours and adequate measures taken to nullify the hazard; and 3. The entire fuel system of the engine has no free liquid and all fuel lines are sealed or capped or securely connected to the engine and vehicle, machinery or apparatus. …… When this special provision is used, the words “Not Restricted” and the Special provision number must be included in the description of the substance on the Air Waybill as required by 8.2.6., when an Air Waybill is issued.’ The DGR defines the shipper’s responsibilities when offering a consignment of dangerous goods for air transportation. Section 1.3.2 ‘Specific Responsibilities’ states: ‘ …. (b) the shipper must ensure that the articles or substances are not prohibited for transport by air (c) the articles or substances must be properly identified, classified, packed, marked, labelled, documented and be in the condition for transport in accordance with these Regulations.’ Helicopter transportation guidance Bell Helicopter publish transportation guidance for the 412-series helicopter in a document entitled ‘M412 Transportation Guide’. It describes the actions taken by Bell when a helicopter is prepared for shipping from its manufacturing facility. In the list of components removed for shipping, it recommends that fuel is drained from the helicopter. Agrarflug indicated that it believed the helicopter had been prepared for transportation in accordance with this guidance. 13 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Operator’s procedures The operator’s Ground Operations Manual states the following with respect to accepting shipments: ‘Reasonable measures (e.g. physical check of documentation and/or packages) shall be taken to avoid the transportation of hidden dangerous goods; confirmation shall be obtained from the shipper/forwarder about the contents of any consignment whenever there is any suspicion that it may contain dangerous goods.’ It also states: ‘Vehicles including cars, motorcycles, helicopters etc. shall be booked as dangerous goods, unless they are shipped under Special provision A70 and do not contain any hazardous equipment such as a battery, fire extinguisher, tire-inflation canister, safety device, etc. and completely empty of residual fuel. This means that they must be completely drained, sufficiently cleared of residue and purged of vapors [sic] to remove/nullify potential hazard.’ The operator’s procedures included a Helicopter Acceptance Checklist to be used when an unpackaged helicopter was booked as dangerous goods however, it was not required to be used if a helicopter was shipped under Special Provision A70. Operator’s safety investigation The cargo operator’s safety department conducted an internal safety investigation. It identified a number of issues relating to recurrent training of its staff; however, both the loading supervisors and the GHA DG Manager involved in the shipping of the helicopter held valid dangerous goods licenses. The operator also identified some issues with adherence to its internal emergency notification and response procedures, and the reporting of occurrences pertaining to damaged or leaking dangerous goods to its safety department. Following this event, the operator made a number of revisions to its procedures and made safety recommendations to various areas of its business. This including recommending that its contracted GHA take steps to raise awareness among its staff about the possibility of dangerous goods in general cargo and to improve methods for detecting of undeclared dangerous goods. Bell 412EP fuel system description General The Bell 412EP helicopter is fuelled by Jet A1 fuel and, in its standard configuration, has a total fuel capacity of 337.5 US Gallons (USG)/1,277.58 litres. Fuel is stored in ten interconnected lightweight cells made from a laminated fabric and rubber construction. 14 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 There are six cells below the cabin floor; three on each side, and four cells located below the engine compartments aft of the cabin and pylon (Figure 4). The helicopter is fuelled through a filler cap in the upper right cell, located on the right side of the aft fuselage. Fuel gravity-feeds from the upper cells into lower cells through interconnecting fuel lines. The helicopter being transported in LX-VCF had been modified to add a single rigid auxiliary fuel tank on the left side of the aft cabin, which had a capacity of 81.7 USG (309 litres), giving a total fuel capacity of 419.2 USG (1,587 litres). The auxiliary tank was installed by Bristow US LLC, in accordance with Bell Helicopter’s Service Instruction BHT-412-SI-4 ‘Bell Model 412 Service Instruction for Auxiliary Fuel Kit’. The fuel system includes a number of fuel transfer, boost and ejector pumps located in the lower fuel cells. Each of the six lower cells has a spring-loaded, poppet-type sump drain valve; those in the lower main cells can be opened by either electrical or manual actuation, while those in other lower cells are manually operated, push-to-drain valves. Defuelling valves located in the sump areas of the lower main cells require removal of a plug and insertion of a standard fitting to open the spring-loaded poppet and operate the valve. To enable fuel transfer, an interconnect system, shown by the pink lines in Figure 4, joins the lower cells together. Each lower forward and lower middle cell is permanently connected to its opposite side cell via the interconnect lines and fuel can pass freely from the left to right side and vice versa. The combined capacity of the two lower forward cells is approximately 48.5 USG (183.6 litres) and the combined capacity of the two lower middle cells is approximately 32 USG (121.1 litres). At fuel loads above approximately 1,663 lb, all six lower cells would be full. Fuel vent system The fuel vent system is shown by blue lines in Figure 4. A collective vent on top of upper aft centre cell connects the four upper cell vent spaces with two vertical lines which vent overboard beneath the fuselage. Each lower main cell vents through a line connecting into the upper forward centre cell. A forward vent line on each side of the fuselage connects with the respective lower forward and lower middle cells. These lines rise through the helicopter doorposts to a waterline above the upper cells and then double back downward to vent overboard beneath the fuselage. AAIB investigation The US Federal Aviation Administration (FAA) Hazardous Materials Safety Division were notified of this event and initiated its own separate investigation to explore the issues relating to undeclared and leaking dangerous goods. The FAA interviewed many of the individuals and organisations involved in preparing the helicopter for transportation and issuing the associated shipping documentation. Details from these interviews were shared with the AAIB; however, not all the individuals and organisations engaged directly with the AAIB safety investigation. The AAIB was therefore limited in its ability to explore more fully some of the issues relating to this event. 15 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Figure 4: Bell 412EP Simplified fuel system schematic (Note auxiliary tank not shown) Discussion UPPER RIGHT UPPER LEFT UPPER LEFT UPPER AFT & FWD CENTRE LOWER LEFT FWD LOWER LEFT MIDDLE LOWER LEFT MAIN LOWER RIGHT MIDDLE LOWER RIGHT MAIN LOWER RIGHT FWD UPPER RIGHT Figure 4 Bell 412EP Simplified fuel system schematic (Note: auxiliary tank not shown) Discussion General The escape of fuel from the helicopter represented a substantial hazard to the safety of the aircraft, the flight crew and those on the ground at Prestwick Airport. The airport RFFS advised that the measured fuel vapour levels within the aircraft indicated a high risk of explosion and that the fuel flammability limits were potentially in range. Additionally, 16 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 photographs show that fuel was exiting the aircraft close to the left body landing gear and pooling beneath the aircraft. The presence of fuel in proximity to potentially hot wheel brakes created a substantial risk of fire. Preparation and packaging of the helicopter for transport Correspondence and documentation relating to the sale of the helicopter indicated that the seller would assist the buyer in disassembly and preparation of the helicopter for transportation, under the supervision of the buyer’s representatives. The buyer believed that these preparations would include defuelling of the helicopter. The seller considered that all transportation matters were the responsibility of the buyer, but was aware of the intention for the helicopter to be transported as air cargo. Notwithstanding the issue of where the contractual commitment for preparation and defuelling of the helicopter lay, the disassembly of the helicopter and preparations for its transport took place at the seller’s facility and were conducted by its staff, despite a substantial amount of fuel remaining on the helicopter. The buyer assumed that the helicopter would be prepared in accordance with guidance published by the helicopter manufacturer, which recommends defuelling as part of the preparations for transportation. The preparations also included packaging of the helicopter using an open flame, which would have represented a significant health and safety risk to those involved. Neither the seller’s staff undertaking the disassembly, nor the buyer’s representatives who were subsequently in attendance, identified the fact that a substantial amount of fuel remained onboard the helicopter prior to it being packaged and transported. The following Safety Recommendation is therefore made: Safety Recommendation 2018-011 It is recommended that Bristow US LLC review their procedures relating to the preparation of helicopters for air transportation to ensure that they are defuelled. Shipping and shipping documentation The Shipper’s Export Declaration for the helicopter indicated that no hazardous materials were being exported. This document formed the basis upon which other transportation documentation was raised. However, it did not accurately reflect the presence of fuel on board the helicopter, nor the battery and fire extinguisher within the helicopter cabin, which also required identification as dangerous goods. Special Provision A70 of the IATA Dangerous Goods Regulations allows vehicles such as the helicopter to be transported by air without being declared as dangerous goods, providing batteries or other dangerous goods are removed, that the fuel tank and fuel system has been flushed and purged of all fuel and fuel vapours and that the statement ‘Not restricted as per special provision A70’ is included on the Air Waybill. When using this provision, it is the shipper’s responsibility to ensure that the shipment complies with these requirements. 17 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Email correspondence between the shipping agent and the cargo operator during the booking process specifically stated that all fuels and batteries had been removed and that the shipment was non-hazardous. However, although the paperwork generated for transportation and export of the helicopter indicated that the shipment was non-hazardous consolidated cargo, there were a number of anomalies with the shipping documentation. The original Air Waybill neither declared the shipment as dangerous goods, nor referenced the exemptions of Special Provision A70, and was therefore not in compliance with either the DGR or the operator’s own acceptance procedures. Additionally, neither the original nor the revised Air Waybill contained the required signatures. The operator’s GHA acceptance staff indicated that the decision to accept the shipment was influenced in part by the description of the helicopter as ‘Civil Model B412EP Helicopter Main Cabin’ on the Air Cargo Manifest and the assumption that only the frame of the helicopter was being shipped. Although the revised shipping documentation subsequently indicated the helicopter was being shipped as unrestricted cargo under the provisions of Special Provision A70, it did not reflect the actual condition of the helicopter and the shipment was not in compliance with the requirements of the Special Provision. As such, the helicopter was shipped as non-declared dangerous goods and this hazard was not identified to the operator, nor the flight crew of flight CV7754. Proper declaration and documentation of dangerous goods by a shipper ensures that all parties involved in the transportation chain know what type of goods they are transporting, how to load and handle them and what steps to take in the event of an incident such as a leakage. Three entities were involved in organising the shipping logistics and documentation for the helicopter. The routing agent took a coordinating role, having sub-contracted responsibility for the export and transportation of the helicopter to the cargo logistics company. As the designated shipper named on the Air Waybill, the legal contract of carriage by air was between the cargo logistics company and the operator. The DGR identify that it is the shipper’s responsibility to ensure articles are properly identified, classified, packed, marked, labelled and documented. However, the cargo logistics company further delegated responsibility for production of the shipping documentation to the shipping agent and the documentation did not fully comply with the DGR, nor did it reflect the actual state of the helicopter. The dilution of responsibility among the various individuals and organisations involved in the shipping of the helicopter meant that no single organisation or individual was able to assure that the shipping documentation reflected the actual condition of the helicopter. The investigation did not determine whether this was indicative of a wider issue within the air freight industry, however the cargo operator indicated its belief that it was. Due to the limitations of the AAIB investigation there was not considered to be sufficient evidence to make a formal Safety Recommendation on this subject. However, this report has been shared with the IATA Dangerous Goods Board7 for its consideration. Footnote 7 The IATA Dangerous Goods Board reviews and determines standards and procedures necessary for the safe carriage of dangerous goods by air, and promotes the worldwide recognition, adoption of and adherence to those standards and procedures. It works closely with the ICAO Dangerous Goods Panel, which sets the international requirements for transportation of dangerous goods by air and is responsible for reviewing proposed revisions to ICAO document 9284. 18 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Opportunity to detect the presence of Dangerous Goods in Houston A small fuel leak observed while the helicopter was being loaded onto an aircraft for planned travel on 27 March 2017 resulted in the shipment being offloaded and returned to the cargo warehouse. This fuel leak, and the subsequent inspection of the helicopter by a mechanic and shipping agent, presented an opportunity to detect that the helicopter had not been defueled prior to transport. However, CCTV footage of the inspection shows that while the mechanic cleaned fuel residue from the shrink-wrap coating and inserted absorbent pads, he took no steps to determine the actual fuel state of the helicopter during the inspection. Despite this, the mechanic subsequently confirmed that the source of leak was residual fuel in the fuel lines and this information was communicated to the cargo operator and to the other agencies involved in the transportation of the helicopter. Based on this information, and at the request of the routing agent, Agrarflug issued a Purge Certificate, expressly stating that the helicopter had been purged of all fluids and was not considered as dangerous goods, despite not having been able to verify the actual condition of the helicopter. The Air Waybill and Air Cargo Manifest were updated accordingly and these three documents were presented to the operator. The operator did not question the fact that the Purge Certificate had been issued by the buyer in Germany, as it is not a mandatory document for items shipped under Special Provision A70. With no expectation that dangerous goods were a factor in the transportation of the helicopter, and having taken steps to address the source of the fuel leak from the helicopter, the operator accepted the helicopter for transport on its aircraft. Escape of fuel during the flight During the post-incident inspection at Prestwick, the helicopter battery was observed to be disconnected; therefore, none of the helicopter fuel pumps could have operated during the incident flight. The investigation considered that possible routes for fuel to escape from the helicopter could have included: via the sump drain valves, defuelling valves, the fuel vent lines or a loose connection in a fuel system interconnect line. With the exception of the small fuel leak noticed on 27 March 2017, no fuel was observed to escape from the helicopter during the two-month period it was stored in the cargo warehouse in Houston. Nor did any fuel escape from the helicopter after refuelling in Prestwick following the incident. Furthermore, a subsequent maintenance inspection at the new owner’s facility, did not reveal any defects with the fuel system which could have accounted for the fuel leak. It was therefore considered unlikely that a loose connection in a fuel line or a partially-open or stuck sump drain/defuelling valve could have contributed to the fuel escape during the flight. When the aircraft arrived in Prestwick, the ground operations agent who first entered the aircraft observed that fuel appeared to be escaping via a vent tube on the forward right-hand side of the helicopter. Subsequent inspection of the helicopter identified that the shrink-wrap in which the helicopter had been encased had been applied such that the opening in the forward right-hand fuel vent tube was exposed, while that on the forward left-hand vent was completely sealed. The forward vent lines serve the lower forward and lower middle cells on each side of the helicopter. Although the left and right side vent lines are not connected, each lower forward 19 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 and lower middle cell is permanently connected to its opposite side cell via the interconnect lines and fuel can pass freely from the left to right side and vice versa. The manner in which the helicopter was shrink-wrapped created a seal over the forward left vent tube; this may have prevented the pressure within the four forward fuel cells from equalising in response to aircraft cabin pressure changes during the descent into Prestwick. In the absence of any other defects which could account for the escape of fuel, the investigation considered that this wrapping of the vents may have induced a siphon-like effect, or caused the flexible fuel cells to temporarily deform, as the aircraft’s cabin pressure equalised during the descent to land at Prestwick, causing fuel to be ejected via the forward right-hand vent tube. The aircraft operator reviewed the aircraft’s pressurisation profile for the incident flight and compared it with a number of flights by the same aircraft on the same route. There was nothing unusual about the pressurisation profile on the incident flight. The helicopter manufacturer checked its occurrence database and did not find any reports of customers reporting fuel exiting out of the forward fuel vent tubes. The manufacturer commented that there is a fuel/air separator within the forward fuel vent system which is intended to allow fuel vapours to escape to the overboard vent, while any liquid fuel should drain back into the relevant fuel cell by gravity. However, the circumstances of this fuel leak are somewhat unique, and it is highly unlikely that the behaviour of the helicopter fuel system in such circumstances would have been previously considered or predicted. The precise fuel state of the helicopter prior to its shipment by air is not known however, the post-incident weight of the helicopter pallet was some 255 kg lighter than that noted on the label attached to the pallet and the load sheet for flight CV7754. The scales used to weigh the pallet in Houston and Prestwick were both within calibration requirements. It is therefore concluded that approximately 255 kg of fuel had escaped from the helicopter during the flight, which equates to approximately 322 litres8 of fuel. Only the upper right fuel cell can be visually inspected on the Bell 412EP and during the post- incident inspection in Prestwick this cell was observed to be approximately half full. The fuel distribution within the remaining cells was not determined. The total indicated fuel quantity was noted as 1,440 lb, symmetrically distributed between the left and right cells. When the helicopter was refuelled, 467 litres were required to reach the fully fuelled condition. Given the helicopter’s total fuel capacity of 1,587 litres, the post-incident volume of fuel was determined to have been 1,120 litres. Taking into account the approximate 322 litres which escaped, the fuel state prior to transportation of the helicopter was calculated to have been approximately 1,442 litres. At this fuel state, all the lower fuel cells would have been full. The combined capacity of the lower forward and lower middle tanks, served by the forward vent lines, is approximately 304.7 litres, which is broadly equivalent to the quantity of fuel calculated to have escaped during the flight. Footnote 8 Converting a weight of fuel to a volume of fuel requires the specific gravity of the fuel to be known. The specific gravity of fuel varies with temperature and can be influenced by a number of other factors. The specific gravity of Jet A1 fuel is typically 0.79 at 15oC, but can range from 0.77 to 0.83. The specific gravity of the fuel on the helicopter is not known however a specific gravity of 0.79 has been used for illustrative purposes. 20 ©Crown copyright 2018 All times are UTC Conclusions Regardless of the exact mechanism by which the fuel escaped from the helicopter, the IATA Dangerous Goods Regulations exist to prevent the transportation of hazardous cargo representing a hazard to the safety of an aircraft. Adequate steps were not taken to correctly prepare the helicopter for transport and this situation was not identified prior to it being offered for transportation by air. The investigation identified that the dilution of responsibility among the various individuals and agencies involved meant that no one agency or individual could assure that the shipping documentation reflected the actual condition of the helicopter and was in compliance with the DGR. An inspection of the helicopter prior to travel was superficial in nature and, although no attempt was made to verify the actual fuel state of the helicopter, incorrectly concluded that the helicopter had been defuelled. This resulted in the helicopter shipment being identified as unrestricted cargo, despite containing non-declared dangerous goods. The fuel hazard was not identified to the operator or the commander of the flight on which the helicopter travelled, and they were therefore unaware of the risk it posed. The escape of fuel from the helicopter during the flight represented a substantial hazard to the safety of the aircraft, the flight crew and those on the ground at Prestwick Airport. The containment actions taken by the RFFS at Prestwick Airport substantially reduced the possibility of a more adverse outcome. One Safety Recommendation is made concerning procedures for the preparation of helicopters for air transportation. In addition, the operator has made a number of revisions to its procedures. It has also recommended that its contracted GHA take steps to raise awareness among its staff about the possibility of dangerous goods in general cargo and to improve methods for detecting of undeclared dangerous goods. Bulletin Corrections Following publication of the report the following two corrections were made. Page 11: The first sentence of the section titled ‘Shipping of dangerous goods by air’ has been deleted and replaced to provide additional clarification. Page 17: Footnote 7 has been amended to provide additional clarification. Further information regarding these corrections can be found on the AAIB website - https:// www.gov.uk/aaib-reports/aaib-investigation-to-boeing-747-8r7f-lx-vcf and will be published in Bulletin 10/2018. The online version of the report was amended on 15 August 2018. AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 21 ©Crown copyright 2018 All times are UTC Serious Incident Aircraft Type and Registration: Boeing 787-9 Dreamliner, G-ZBKF No & Type of Engines: 2 Rolls-Royce Trent 1000-J2 turbofan engines Year of Manufacture: 2016 (Serial no: 38622) Date & Time (UTC): 29 April 2017 at 1040 hrs Location: En route from London Heathrow to New Delhi airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 13 Passengers - 124 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 50 years Commander’s Flying Experience: 14,200 hours (of which 1,238 were on type) Last 90 days - 175 hours Last 28 days – 48 hours Information Source: AAIB Field Investigation Synopsis The aircraft was on a scheduled flight from London Heathrow to New Delhi, India. The aircraft was dispatched in accordance with the Minimum Equipment List (MEL) with the left air conditioning (AC) system disabled. Shortly after reaching FL350 the crew were alerted by EICAS that the cabin altitude was increasing above normal, triggered at 8,500 feet. With no additional Environmental control system (ECS) actions available to control cabin altitude, the flight crew initiated a descent. During this descent the cabin altitude exceeded 10,000 ft and the crew completed the relevant emergency actions. The loss of cabin pressurisation was caused by detachment of the lower right air conditioning recirculation fan duct on a sector where the left air conditioning system had been disabled before flight. As a consequence of this finding, the Aircraft Maintenance Manual has been amended to alter the process of replacing the relevant recirculation fan and maintenance procedures to react to a related Maintenance Alert Message have been altered. The investigation also identified a software problem related to the volume of the cabin decompression pre-recorded announcement (PRA) in the passenger cabin which is being addressed by the Operator’s safety action. Three Safety Recommendations are made concerning the testing of the installed performance of CVR systems. AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 22 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 History of the flight Flight crew The aircraft was scheduled to operate from London Heathrow to New Delhi, India. The aircraft flight crew, which consisted of three pilots, reported as normal at 0755 hrs for a scheduled departure time of 0925 hrs. The sector was planned under Extended-range Twin-engine Operational Performance Standards (ETOPS) rules and, due to the forecast of thunderstorms near Delhi, additional ‘holding’ fuel was added to the flight plan. When the flight crew boarded the aircraft, they noted that the aircraft’s electronic technical log reflected that the left AC system had been disabled, in accordance with the MEL. This was because the left No 2 (L2) CAC (Cabin Air Compressor) shaft had failed, which had subsequently damaged the left No 1 (L1) CAC. As a result of this unserviceability the aircraft no longer qualified for ETOPS1 and a new flight plan was requested, with a maximum altitude limit of FL350 to enable the overhead crew rest areas to be used during the flight. The amended flight plan meant an additional two tonnes of fuel was added. The aircraft took off at 1007 hrs and the climb was largely uneventful, although the crew noted a higher than usual temperature and lower than normal airflow in the cockpit. As the aircraft climbed through FL200 the third pilot left the cockpit for the flight crew rest area. At 1032 hrs the aircraft levelled off at the planned cruise level of FL350. Two minutes later, the ‘cabin altitude pressure block’ was automatically2 displayed on the EICAS display. The crew immediately responded, confirming that the cabin altitude was increasing at a rate of about 300 fpm and that both outflow valves were indicating closed. The crew then selected the ‘system status’ page and noted that the ‘recirc fan lwr r ’ status message was displayed. The crew discussed remedial options and initially requested a descent to FL310 to see whether the cabin altitude would stabilise. They began a descent in flight level change (FLCH) mode, at idle power. However, the cabin altitude continued to increase and the commander asked the co-pilot to speak to the cabin service director (CSD) on the interphone, to brief her on the situation and request that the cabin service be stopped. The co-pilot initially called the first-class cabin but the CSD was not there so he spoke with another member of the cabin crew, whom he advised to stop the cabin service. The co-pilot then called the interphone in the next cabin, to locate the CSD. As the aircraft descended through FL330, the commander advised the co-pilot that the cabin altitude was still increasing and he would be declaring a PAN, requesting a further descent. Just as the commander transmitted the PAN, the cabin altitude reached 10,000 ft and the EICAS cabin altitude warning activated. This coincided with the co-pilot speaking to the CSD, whom he advised to stop the cabin service and ensure passengers and crew were Footnote 1 The MEL requires that the aircraft remain within 60 minutes of landing at an airfield. 2 The cabin altitude pressure block is automatically displayed on EICAS when the cabin altitude reaches 8,500 ft. It contains system information and graphics pertaining to cabin altitude, cabin altitude rate, differential pressure, landing altitude, and outflow valve position. 23 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 seated near an oxygen mask. The CSD replied, stating “on oxygen masks okay”, to which the co-pilot responded “no not on oxygen, not on oxygen, just by your seats with them“, before ending the call to don his oxygen mask. In the meantime, the commander had donned his oxygen mask. The crew completed the QRH memory items, with the cabin oxygen system being manually deployed. Having established communications with each other, the crew declared a MAYDAY and made a rapid descent to FL100 with speedbrakes deployed. The aircraft was approximately 25 nm east of Brussels, Belgium. As the aircraft descended through FL258 the cabin altitude reached a maximum value of 10,429 ft before starting to reduce. During the descent the CSD, wearing a portable oxygen system, entered the cockpit. After levelling at FL100, and having confirmed that the cabin altitude was at 7,000 ft and reducing, the crew removed their oxygen masks and completed the QRH checklist for ‘Excessive Cabin Altitude’. The commander then asked the CSD to advise the third pilot, who had remained in the flight crew rest area on a fixed ‘drop down’ oxygen mask, that he could return to the cockpit and that the cabin crew and passengers could remove their oxygen masks if required. The cabin altitude continued to reduce to about 3,700 ft, where it stabilised. Having evaluated the status of the aircraft, the crew decided to return to Heathrow. Before the CSD returned to the cabin, the commander gave her a briefing on the plan to return. Whilst en route, approximately four tonnes of fuel was jettisoned to reduce the aircraft weight below the Maximum Landing Weight (MLW). The approach and landing at Heathrow were uneventful and the aircraft was taxied to the terminal where the passengers disembarked normally. Cabin crew From a cabin crew perspective, the flight progressed normally up to cruise altitude, other than that the CSD reported that she was feeling a little unwell. At cruise altitude a normal cabin service was underway. The cabin crew in the first-class cabin recalled receiving an interphone call from the co-pilot and the request to stop the cabin service and return to their seats. However, before this message could be passed on to the other cabin crew, the cabin oxygen masks deployed. The deployment of the oxygen masks is accompanied by a PRA that advises of the emergency over the cabin loudspeakers, and contains instructions to don the oxygen masks. However, while the PRA was triggered in the cabin, its volume over the speakers was so low that the content of the message could not be heard above the background cabin noise. As a result of not hearing the PRA, and in the absence of any other serious indications of depressurisation, the cabin crew were confused as to what was happening. Many thought the oxygen masks had deployed inadvertently, possibly because of turbulence. The cabin crew did not follow their depressurisation actions but returned their cabin service carts to the galleys and took their seats there. 24 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 The passengers appeared unaware of the emergency. Some remained asleep and many did not fit their oxygen masks. Of those that did fit the masks, some fitted them incorrectly. As the cabin crews’ awareness of the situation developed, they began shouting instructions to the passengers to fit their oxygen masks. Due to the uncertainty of the situation, the CSD took a portable oxygen system and went to the cockpit to ascertain what was happening. During this period several of the cabin crew also used portable oxygen systems. Several of them reported that the systems were difficult to extract from their stowage locations and to use due to the “cumbersome” oxygen bottle. They also found it difficult to tell whether the portable oxygen systems were working. During the return to Heathrow several of the cabin crew and passengers reported feeling unwell, although none required medical attention. Planned RoutePlanned Route Figure 1 Planned route, BA143 London-Delhi 29 April 2017 25 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 Recorded information Sources of recorded information The aircraft was equipped with two Enhanced Airborne Flight Recorders (EAFR), one installed at the front of the aircraft and the other at the rear. The EAFR is a multifunction recorder that records 25 hours of FDR data and 120 minutes of CVR audio into a crash-protected solid-state memory. The CVR audio record for the flight commenced at 1016 hrs, when the aircraft was climbing through FL110, and ended after the aircraft had landed. Flight data was available for the entire incident flight. Both EAFRs record the same flight data, with just over 2,200 parameters available. Parameters of significance included cabin altitude, status of cabin oxygen mask deployment, EICAS and system status display information and the speed of the air conditioning recirculation fans. System fault log information was also available from the aircraft’s Central Maintenance Computing Function (CMCF) and the Aircraft Health Monitoring (AHM) ground-based software service. Recorded data Figure 2 shows pertinent parameters recorded during the incident. The data shown is for the period just before the aircraft reaches FL350, to shortly after the aircraft descended to FL100. Additional information not included in the earlier section ‘History of the flight’ is included below. The Boeing 787 AHM is a ground-based software service that collects, analyses and presents aircraft-generated data to operators to assist them in determining current and future serviceability of their aircraft. Information, which includes ‘low level’ faults that do not require crew action, are presented to the crew as status messages by on-board systems. When a status message is triggered, the crew are made aware on the EICAS, which displays the word ‘STATUS’ in blue text. Selection of the system status page ‘SYS’ presents the associated message on the Multifunction Display (MFD). At 1029:54 hrs, as the aircraft was climbing through FL320, the air conditioning lower right recirculation fan stopped. The cabin altitude was 7,000 ft at this time and at 1033 hrs system status message ‘recirc fan lwr r ’ was triggered by the CMCF. This message was subsequently referred to by the crew about a minute later, after they had been alerted to the abnormal cabin pressure on EICAS. The aircraft manufacturer later reviewed the ‘recirc fan lwr r ’ status message and its associated fault code ‘1031 Motor Driver Current Fault’. The manufacturer stated that the fan shut down, after which the air conditioning system attempted to restart it. After three consecutive failed attempts to restart, the status message ‘recirc fan lwr r ’ is triggered. This is a latched fault that cannot be cleared in flight. The aircraft manufacturer stated that the fault with the fan was most likely associated with it having become detached from the inner duct. 26 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 Figure 2 Descent from FL350 following cabin altitude warning Aircraft information Cabin pressurisation system The cabin pressurisation system fitted to the Boeing 787 is different from earlier aircraft types, in that it does not utilise air bleeds from the engine compressors but is equipped with electrically driven centrifugal impellers, known as cabin air compressors (CACs). Four CACs are fitted, with two CACs (referred to as L1 and L2) providing compressed air to the left air conditioning unit and two CACs (R1 and R2) to the right air conditioning unit. The left and right air conditioning units can each function with only one CAC per side operating. The system includes two recirculation fans, one each in the left and right air conditioning units. These fans are referred to as the ‘left lower’ and ‘right lower’ recirculation fans respectively. The main air conditioning unit components, including the left and right lower recirculation fans, are positioned in non-pressurised areas within the lower fuselage, just forward of the wing box structure. 27 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 The left and right lower recirculation fans are each connected by ducts to their respective left and right heat exchangers. The fan assemblies are connected to the ducts at both ends by sleeved couplings and these ducts are connected to the rest of the system by conventional ‘V-band’ clamps (Figure 3). Access to the right recirculation fan is more restricted, compared to the left fan, due to the left and right air conditioning systems being geometrically similar, rather than ‘handed’. The right unit thus requires reaching through an extensive system of ducting and components to effect fan installation and removal. Cabin decompression Pre-Recorded Announcement (PRA) Manual deployment of the oxygen masks by the crew causes a cabin decompression PRA to be played over the cabin speakers by the passenger address system. This recorded announcement is intended to be heard clearly above the ambient noise in the cabin to alert passengers and cabin crew that they are to don oxygen masks. Passenger privacy screens The operator’s business-class cabin seats fitted to its Boeing 787 fleet are installed with retractable privacy screens. Unlike other aircraft types in this operator’s fleet, the privacy screens on the Boeing 787 do not automatically retract when the cabin oxygen masks are deployed, and are not required to do so. Aircraft examination During the flight sector into Heathrow which preceded the incident flight of 29 April 2017, the crew had reported a status message ‘cabin air cprsr l2’. Engineers attended the aircraft and carried out troubleshooting in accordance with the Fault Isolation Manual (FIM), but initially could not identify the cause of the fault message. Following further investigation, it was found that the L2 CAC shaft had failed and part of it was missing. The inlet of the L1 CAC was removed for comparison and the missing material from the L2 CAC was found at the inlet with damage sustained to the blades of the L1 CAC. This was discovered shortly before the scheduled departure. It was therefore decided to dispatch the aircraft with the left AC system disabled, in accordance with the MEL. Following the return of the aircraft to Heathrow after the incident, an examination took place monitored by the AAIB. It was found that the right-hand inner recirculation duct was disconnected from the lower right-hand recirculation fan (Figure 3). Once the duct and fan unit were removed, there was evidence that the coupling and seal joining the two had been incorrectly aligned when last assembled. The V-band clamp joining the other end of the duct to the heat exchanger was correctly fitted. Examination of the coupling system used to connect the recirculation fan to the inner duct showed that if the coupling were not installed correctly, there was less visible evidence and a reduced tactile feel compared to that of the V-band clamp used at the opposite end of the duct. The connection of the right-hand recirculation fan is located in a position that requires reaching through an extensive system of ducting and components to install it. Viewing of the connection between the duct and fan is also restricted. Figure 3 shows the relative position of the recirculation fan and the disconnected duct. 28 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 Figure 3 Position of Right Lower Recirculation Fan and photograph of disconnected duct Previous maintenance activity Examination of the aircraft records showed that the right-hand lower recirculation fan had been disabled on 8 April 2017 due to a fault and the fan was subsequently changed on 18 April 2017, 11 days before the incident flight. The following day, when the aircraft returned 29 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 to service, the aircraft’s AHM system sent Maintenance Alert Message 21‐0209‐C7403 to the operator’s ground-based data system, indicating that a ‘high leakage/low inflow’ of the cabin pressurisation system had been detected. This message is not displayed to the flight crew. The AHM message 21‐0209‐C740 was assessed by the operator’s engineering department and on 20 April 2017 a work request, D7 32165109 titled ‘CABIN PRESSURISATION CHECKS’, was raised to carry out a pressurisation leak check of the aircraft. The recent work carried out on the aircraft’s right air conditioning pack (8 and 18 April) would have been available by accessing the aircraft’s electronic flight log details. The end date for completion of work request D7 32165109 was set at 5 May 2017. Thereafter, during all of the subsequent flights of G-ZBKF, of which there were 15 prior to the incident flight, Maintenance Alert Message 21‐0209‐C740 was sent by the aircraft to the operator’s AHM ground-based data system. The end date (5 May) for the completion of work request D7 32165109 was not altered. The operator later stated that the AHM system provides just over 1,200 maintenance alerts. From experience, some maintenance alert messages are inadvertently triggered, which has led to refinements to improve the robustness of the system and reduce the level of ‘nuisance’ alerts. The operator had seen alert message 21‐0209‐C740 triggered ‘intermittently’ on other aircraft before and this had caused maintenance staff to question the reliability of this particular alert message. The engineer who had disabled the left air conditioning pack on the morning of the incident had been provided with documentation that included outstanding maintenance activities. This included work request D7 32165109. The operator stated that it was not a requirement that engineers review this particular information as it was included for information purposes only. Cabin decompression Pre-Recorded Announcement (PRA) Under normal operation, the cabin decompression PRA is output at a peak level equivalent to the level of someone shouting. When a cabin announcement is made by the flight crew the PRA is paused and after completion of the cabin announcement the PRA continues. Testing of the cabin audio system, and further investigation by its manufacturer4, found that on recommencement of the cabin decompression PRA (following a cabin announcement from the flight crew), the source of the PRA announcement had reduced the amplitude of the input announcement to the passenger address system to a level just above normal conversation. The manufacturer of the passenger address system verified the system volumes were per design and operated correctly but could not produce the output at the right amplitude with the input signal reduced by the amount stated above. This caused the low level that previously stated was not intelligible. The manufacturer of the In Flight Entertainment System (IFES - which is the source of the PRA announcement) is releasing a software update to correct this deficiency of the PRA source audio levels being supplied at a lower value than specified by the manufacturer. Footnote 3 This fault message is triggered if the outflow valves are less than 5° open in flight. 4 Thales: www.thalesgroup.com 30 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 Passenger privacy screens It was found that passenger safety cards carried on the operator’s fleet of Boeing 787 aircraft incorrectly indicated that privacy screens would automatically retract when the passenger oxygen masks deployed. Cabin crew training also did not reflect this difference. EAFR CVR audio recording quality On 21 November 2014, the National Transportation Safety Board (NTSB) of the USA published report NTSB/AIR-14/01 on an accident to a Boeing 787-8, JA829J that suffered an auxiliary power unit battery fire. During the investigation, the NTSB identified the following discrepancies with the EAFR’s CVR audio recordings: ● ‘only a small percentage of the dynamic range’ was used to record the crew audio channels ● The cockpit area microphone (CAM) channel had ‘excessive cockpit background noise that obscured the inter-crew’s conversations both during the airborne and ground portions of the flight’. ● Superimposed on the crew channels were multiple ‘full volume clicks and pops that appeared randomly throughout the recording’. The NTSB categorised the quality of CVR recordings using its ‘CVR Quality Rating Scale’ which has five ratings: 1) unreadable 2) poor 3) fair 4) good and 5) excellent. The NTSB categorised the EAFR CVR recordings for the Boeing 787-8 registration JA829J as ‘Fair’ which it defines as: ‘The majority of the crew conversations were intelligible. The transcript that was developed may indicate passages where conversations were unintelligible or fragmented. This type of recording is usually caused by cockpit noise that obscures portions of the voice signals or by a minor electrical or mechanical failure of the CVR system that distorts or obscures the audio information.’ The NTSB concluded that: ‘The poor audio recording quality of the enhanced airborne flight recorder could impede future aircraft investigations because the recorded conversations and other cockpit sounds might be obscured.’ To address this the NTSB made the following Safety Recommendation to the FAA: ‘Require Boeing to improve the quality of (1) the enhanced airborne flight recorder radio/hot microphone channels by using the maximum available dynamic range of the individual channels and (2) the cockpit area microphone airborne recordings by increasing the crew conversation signals over the ambient background noise. (A-14-126)’ 5 Footnote 5 The ‘radio/hot microphone channels’ as stated in NTSB Safety Recommendation A-14-126 refer to the three crew audio channels. 31 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 As of April 2018, NTSB Safety Recommendation A-14-126 remains ‘OPEN’, awaiting a final response from the FAA. When both EAFRs fitted to G-ZBKF were replayed by the AAIB, the CVR recordings exhibited the same characteristics to those previously identified by the NTSB, with approximately 10% of the available dynamic recording range used when the crew headset microphones were in use. Subsequently the AAIB became aware that the Australian Transport Safety Bureau (ATSB) and the Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) of France had also experienced the same issues when reviewing CVR recordings from Boeing 787 aircraft. Further to the previous findings of the NTSB, the AAIB also identified that when the flight crew of G-ZBKF had used their oxygen masks, the full dynamic recording range of the crew CVR channels was used, with occasional clipping of the signal. Figure 4 reflects the difference in dynamic recording range when the flight crew used the headset and oxygen mask microphones. Figure 4 G-ZBKF – CVR waveform of crew channel showing difference in use of available dynamic recording range between headset and oxygen mask microphone signals EAFR operation and readout The aircraft is fitted with three audio control panels (ACPs), one for each crew position (commander, co-pilot and observer). Each ACP digitises the respective crew member’s communications and transmits this as digital audio data packets over the aircraft’s Avionics Full Duplex Switched Ethernet (AFDX) network to the EAFR. The data packets include a ‘time stamp’ that is acquired from an integral time reference source within each ACP. The CAM signal is provided as an analogue voltage, which the EAFRs digitise prior to recording. Due to transport latencies of the AFDX network, and ‘drift’ between the ACPs internal time reference sources, corrections are required to ensure that the crew and CAM audio channels 32 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 are synchronised6 during replay. The EAFR CVR readout is made using a ground-based software utility called the Integrated Ground Software (IGS), which is produced by the manufacturer of the EAFR. IGS is used by the AAIB, other safety investigation authorities and operators. The AAIB initially replayed the EAFRs fitted to G-ZBKF using IGS software version 2.11. Analysis of the audio found that each crew channel contained erroneous ‘full volume clicks and pops’. The AAIB subsequently contacted the manufacturer of IGS for assistance, who provided IGS version 2.14, advising that this included several refinements to the alignment process applied to the crew and CAM channel. The recordings from G-ZBKF were reprocessed and the ‘full volume clicks and pops’ were no longer present. The IGS manufacturer subsequently confirmed that version 2.11 and earlier versions of IGS had inadvertently incorporated ‘full volume clicks and pops’ into the audio. The AAIB has notified the NTSB, other safety investigation authorities, and the operator of G-ZBKF of these findings. The IGS manufacturer is also considering notifying other operators of the need to update the IGS software to resolve this anomaly. Certification of Boeing 787 EAFR CVR system The certification of the Boeing 787 EAFR CVR system consisted of two distinct parts. The first related to the certification of the EAFR itself, which was certified by its manufacturer as meeting the requirements of FAA Technical Standard Order (TSO) C123B, ‘Cockpit Voice Recorder Equipment’. The second part of the certification process related to the CVR system fitted to the aircraft, which was certified by the aircraft manufacturer as meeting the FAA operating rules contained in Title 14 of the Code of Federal Regulations (14 CFR) PART 25, Subpart F, 25.1457 – Cockpit Voice Recorders. TSO-C123B required that the EAFR met the minimum performance standard as defined in the European Organization for Civil Aviation Equipment (EUROCAE) document ED-1127 which includes aspects such as the minimum crash survivability of the recorder. ED-112 also included Chapter I-6 that provided requirements for verifying the installed performance of the CVR system. This included: ● ‘For each newly installed system, the quality of the recording shall be established by analysis of information recorded on the ground and in flight. ● Position the microphone for recording general cockpit sounds, voice communications originating at the pilot and co-pilot stations, voice communications of other flight crew members in the cockpit when directed to those stations….. Footnote 6 IGS calculates time synchronisation adjustments using a combination of the recorded arrival time of each ACP audio data packet at the EAFR, and the time that each data packet was transmitted from the ACPs. IGS then adds or removes audio samples from the three crew channels so that they align with the CAM channel, which is used as the master time source. 7 ED-112 - Minimum Operational Performance Specification for Crash-Protected Airborne Recording Systems. 33 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 ● In general, the proper recording level will be confirmed using the oscilloscope to show that the full recording dynamic range has been achieved without excessive clipping of peak signals. A check should be made to confirm that adequate signal to noise ratios exist for all significant input signals8 ● The presence of cockpit sounds, crew speech and audible warnings should be confirmed on the area microphone channel.’ However, in TSO-C123B, the FAA permitted a number of exemptions, including the requirement to meet the performance standards in ED-112 Chapter I-6. The FAA advised that the rationale for the exception was that TSOs normally relate to the specification and performance of equipment as ‘standalone’ units, and that guidance on the installed performance of systems is typically provided in an Advisory Circular (AC)9. When the Boeing 787 CVR system was certified, AC 25.1457-1A dated 1969 was applicable to the CVR system. This provided guidance on the position of the CAM relative to the cockpit loud speakers, but it did not provide guidance on how to verify the installed performance of the CVR system. As a result of the exception to comply with ED-112 Chapter I-6, and a lack of guidance in AC 25.1457-1A, there was no requirement for the aircraft manufacturer to demonstrate that the performance of the Boeing 787 CVR system met any industry approved guidance or standard. Following the NTSB’s findings on the performance of the CVR system fitted to aircraft registration JA829J, it made this Safety Recommendation to the FAA: ‘Either remove the current exception to European Organization for Civil Aviation Equipment ED-112A, “Minimum Operational Performance Specification for Crash Protected Airborne Recording Systems” chapter I-6 in Technical Standard Order 123B, “Cockpit Voice Recorder Equipment,” or provide installers and certifiers with specific guidance to determine whether a cockpit voice recorder installation would be acceptable. (A-14-127)’ The FAA responded to NTSB Safety Recommendation A-14-127 by publishing AC 20-186. This provides guidance on determining that CVR and FDR systems ‘perform as intended’ and defines the test requirements as those specified in ED-112A Chapter I-6 (CVR) and Chapter 2-5 (FDR). However, AC 20-186 is not applicable to the CVR system fitted to the Boeing 787 as the EAFR was certified prior to the applicability of the AC. Footnote 8 In this context, the dynamic range of the audio recording is the ratio between the largest and smallest recorded signals. A non-optimised use of the dynamic range can affect the overall ‘quality’ of a digital recording due to a low signal to noise ratio and quantisation noise. 9 An AC is not mandatory or a regulation, but can provide information on an acceptable means of compliance when applying for certification. 34 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 On 15 November 2016, the NTSB responded to the FAA, stating: ‘We believe that the AC [20-186] contains good guidance, and that, if the guidance were applied to the Boeing 787 CVR installation, the installation would fail in multiple ways.’ However, the NTSB concluded that AC 20-186 met the intent of the Safety Recommendation and classified it as ‘CLOSED-ACCEPTABLE ACTION’. In August 2017, the AAIB and NTSB met with the aircraft manufacturer and FAA to discuss the certification process applied to the Boeing 787 CVR system. The FAA advised that the evaluation of the system performance was delegated to the aircraft manufacturer, who carried out a series of ground tests and a ‘scripted’ flight test (based on that provided in ED-112, which was applicable at the time). The recordings from these tests were evaluated by an Authorized Representative (AR)10 who had worked on previous CVR certification programmes with the manufacturer. The acceptance criteria applied by the AR focused on the intelligibility of ‘voice communications’, in accordance with the regulation11 that states ‘voice communications of flight crewmembers’ shall be recorded. Aural alerts, such as those generated by TAWS, were also confirmed as being recorded. The AR subsequently provided confirmation that the system performance was acceptable and the FAA granted approval. The aircraft manufacturer further commented that the evaluation process applied to CVR systems is ‘subjective’ as it considered that ED-112 and the updated version ED-112A, lacked detail in providing ‘objective’ measurements. Dynamic recording range of crew channels The aircraft manufacturer stated that it had been aware of the difference between the recorded dynamic ranges of the boom headset and oxygen mask signals prior to certification of the Boeing 787. The manufacturer advised that the reason for this difference is that in normal operation the output signal from the headset microphone is about 0.1 volt, whereas, the output signal from the oxygen mask microphone is much higher, at about 2.0 volt. The ACP microphone input is designed12 to accept an analogue voltage range of between 0 volt and 2.1 volt (peak-to-peak) and therefore when digitised, the boom headset microphone signal is at a much lower level than the oxygen mask signal. The Boeing 787 audio system combines the crew headset/oxygen mask microphone signals with the sidetone13 signal. The aircraft manufacturer advised that during the system design Footnote 10 An AR is a qualified individual who may act, for certain functions, on behalf of the regulator (FAA). 11 (14 CFR) PART 25, Subpart F, 25.1457. 12 RTCA DO-214 ‘audio systems characteristics and minimum operational performance standards for aircraft audio systems and equipment’. 13 The sidetone signal is the audio reproduced through the headsets speakers consisting of sound of the pilots own voice, RTF and interphone communications. It may also include other background sounds picked up by the headset microphone. 35 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 it had aimed to comply with the requirement in ED-112 that stated ‘at the summing point, the microphone signal exceeds the level of its corresponding sidetone signal on a high percentage of occasions’. This was to ensure that crew speech would not be inadvertently masked by higher amplitude RTF signals, such as ATC transmissions. During development, the aircraft manufacturer found that the sidetone signal level exceeded the crew headset microphone signal when combined. The manufacturer resolved this by attenuating the sidetone signal, which resulted in the signal using about 5% of the available recordable dynamic range. Analysis of the G-ZBKF incident recording shows that when the sidetone signal is combined with the oxygen mask microphone signal, the sidetone is predominantly masked by the much higher amplitude oxygen mask signal. Certification process used in Europe by the EASA For aircraft certified by the EASA, the performance of CVR systems is to be measured against the requirements currently specified in ED-112A14. For aircraft manufactured in France, the BEA participate informally in the approval process by reviewing pre-certification CVR recordings, and providing feedback on areas that the manufacturer may consider improving upon. The review process is ‘subjective’ in nature. European certification guidance material EASA has advised that as part of Rule Making Task (RMT).0249 it intends to update its guidance material on demonstrating that the quality of the CVR recording complies with the corresponding certification standards. The update is based on EASA Certification Memorandum (CM)-AS-001, which is to be consolidated with views provided by the European Flight Recorder Partnership Group (EFRPG)15. Review of CVR recordings from B787 and other aircraft types The AAIB performed a comparative review of the Boeing 787 EAFR CVR recordings against a range of other turbofan powered aircraft, which included the Boeing 747-400, 777, 767, 737-800, 737-300, Airbus A380, A340, A330, A320 and Embraer 190. These recordings were all from solid-state CVRs, meaning that the relative use of the dynamic recording ranges were directly comparable. The results of the review indicate significant variation between aircraft types of the 1) recorded dynamic range of the crew channels and 2) ambient background noise levels compared to crew speech recorded on the CAM channel. Figure 5 and 6 show the difference between the crew and CAM channels of nine different aircraft types. Of the recordings, the lowest recorded dynamic range when the headset microphone was in use was the Boeing 787 and the highest was the Boeing 757. For the CAM channel, the Footnote 14 or ‘any later equivalent standard produced by EUROCAE‘ 15 The EFRPG is an independent voluntary group of European flight recorder experts represented by manufacturers, national aviation authorities and safety investigation authorities. 36 ©Crown copyright 2018 All times are U T C AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 Boeing 787 and Airbus A380 had the highest levels of background ambient noise which, depending on the phase16 of flight, could mask crew conversation. The Airbus A320 CVR system provided a reasonable balance of the use of the dynamic recording ranges and level of ambient noise on the CAM channel that meant that the majority of sounds and communications could be readily transcribed. Figure 5 Nine aircraft types - differences in dynamic range used for recording of crew channels Figure 6 Nine aircraft types - differences in dynamic range used for recording of CAM channel Footnote 16 Background sound levels were significantly increased during takeoff, when the aircraft was configured for landing and when high engine power settings were used in conjunction with reverse thrust. 37 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 During the meeting in August 2017 (between the AAIB, NTSB, aircraft manufacturer and FAA), several CVR recordings17 were replayed, which included the Boeing 787-8 EAFR CVR flight test recording. It was noted that the intelligibility of the crew communications recorded on the CAM channel during the flight test appeared ‘clearer’ compared to the CAM recording from a ‘routine flight’. The difference between the two recordings may have been due to the ‘scripted’ nature of the flight test, resulting in the crew speaking louder and placing more emphasis on clarity than normal. However, evaluation of the Boeing 787 recordings also showed that when the aircraft equipment cooling system was turned ‘off’ after flight, there was a notable reduction in the ambient noise recorded on the CAM channel. This indicates that airflow from the equipment cooling system in the cockpit was contributing significantly to the ‘high’ ambient noise on the CAM. It was also commented that the CAM recording gave the impression that the cockpit environment was noisy and did not truly represent the actual ambient sound if a human observer were listening in the cockpit. Speech Transmission Index (STI) analysis There are several types of objective analysis technique that can be applied to audio to ensure that a minimum standard of speech intelligibility is achieved. One such technique is the STI, which uses a combination of test tones that are recorded and analysed to provide an index score. An index of one represents perfect speech intelligibility and zero is unintelligible. ED-112, and the later ED-112A18, both specify that an STI test is performed on the CVR unit, with the crew channels and CAM channel requiring a minimum index score of 0.75 (good to excellent) and 0.85 (excellent) respectively. However, this STI test is not applicable to the installed performance of the CVR system. Analysis Operations The flight crew were appraised of issues related to the cabin pressurisation system during their ground briefing before the incident flight on 29 April and discussed those relating to temperature control again during the climb. Shortly after establishing the aircraft in the cruise, the crew were alerted to a higher than normal cabin altitude by the EICAS. They quickly recognised the relevance of this and promptly took action to avoid a cabin altitude exceedance by requesting a descent to FL310. The passenger oxygen was manually deployed. The cabin altitude continued to increase and as it reached 10,000 ft, the commander initiated an emergency descent to FL100. The cabin reached a maximum altitude of 10,429 ft. When the pressurisation warning occurred, the crew carried out the appropriate QRH drills in a timely and comprehensive manner. The emergency descent was conducted in accordance with SOPs and was well co-ordinated with ATC. Footnote 17 Recordings from routine flights, not from safety events. 18 Chapter I-3 ‘minimum performance specification under standard test conditions’. 38 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 In the cabin, the cabin decompression PRA was reported as not being audible. Whilst the passenger oxygen masks deployed, the lack of an apparent accompanying PRA caused confusion amongst the cabin crew as to the exact nature of the situation. Accordingly, the initial response by the cabin crew was uncoordinated and ineffective, with the majority of the cabin crew reacting by returning their service carts to the galleys. The unstructured response of the cabin crew meant the reaction of the passengers was not effective and some passengers did not don their oxygen masks. The relatively low altitude exceedance of just over 10,400 ft, which lasted for only a short duration due to prompt flight crew action, reduced the possibility of medical effects on cabin crew and passengers. However, had the cabin altitude continued to climb the effects of not donning oxygen masks would have been more serious. The CSD recognised that the situation was confused and took the initiative to enter the cockpit to clarify with the flight crew. She was, however, unable to return to the cabin until the aircraft levelled at FL100, so the situation in the cabin was not resolved until after the conclusion of the emergency descent. Engineering The loss of cabin pressure was due to a compromised ECS. This was because of a number of factors: 1. The incorrect fitment of the sleeve and coupling joining the replaced lower recirculation fan to the inner recirculation duct in the right air conditioning (AC) system allowing a leak of cabin air. 2. The maintenance organisation did not identify that the continuing air leakage, which persisted as a consequence of this incorrect fitment of the sleeve on the right AC system, would affect the pressurisation system performance if the aircraft were flown with the left AC unit disabled. 3. Fracture of a component (tie-rod) within the L2 CAC of the left air conditioning system, resulting from a manufacturing quality control shortfall. 4. Damage to the L1 CAC of the left AC system as a result of ingestion of a liberated part of the failed L2 CAC tie-rod and its nut, leading to the disabling of the left AC system before flight. It is not known whether further physical movement of the components of the incorrectly fitted coupling, on the right AC unit, occurred during the incident flight, when the right unit was called upon to pressurise the aircraft on its own. The incorrect fitment of the coupling and sleeve was partly a consequence of the inaccessibility of those components in the right AC unit and the lack of tactile feel enabling an incorrectly assembled coupling to be easily identified. The resulting leakage from the recently assembled coupling was identified by the AHM Customised Alert and analysed by the operator’s Technical Support department. It was decided that, as the aircraft was 39 ©Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 AAIB Bulletin: 7/2018 G-ZBKF EW/C2017/04/02 operating satisfactorily with the leakage present, there were no other abnormal indications and a planned maintenance input was scheduled for the near future, investigation of the leak could be aligned with that input. This decision in turn appears to have been influenced by the perception of the high frequency of data and messages received by AHM on the 787 fleet. The manufacturing quality shortfall in the L2 CAC has been identified by the component supplier as a batch problem and the location of components from that batch established. The potential for damage to the L1 CAC resulting from the ingestion of the failed part of the L2 CAC was not explicitly considered during the original system Fault Mode Effects Analysis (FMEA) carried out by the manufacturer. However, other system-level failures that can cause loss of both CACs in one pack had been considered and accounted for at the design stage and the manufacturer is not aware of any other event where the failure of a CAC has resulted in damage to, or failure of, the second CAC on the same AC pack. The decision to dispatch the aircraft The decision to dispatch the aircraft with the left AC system disabled did not take account of the unresolved leakage problem on the right AC system. Procedures of the operator, common within the industry and consistent with the approved MEL, permitted dispatch of the aircraft with one AC unit disabled provided certain flight routing constraints were observed. In this instance the procedures did not ensure that the operating system would continue to function, with the normal level of reliability. Although the individual who authorised the dispatch with one AC system disabled was provided with information, including details of the status of the right system, that in