AirAsia X A333 near Alice Springs on Aug 16th 2016, engine shut down in flight

Last Update: December 19, 2019 / 15:42:05 GMT/Zulu time

Bookmark this article

Incident Facts

Date of incident
Aug 16, 2016

Classification
Incident

Cause
Engine shut down in flight

Airline
AirAsia X

Flight number
D7-221

Departure
Sydney, Australia

Destination
Kuala Lumpur, Malaysia

Aircraft Registration
9M-XXD

Aircraft Type
Airbus A330-300

ICAO Type Designator
A333

An AirAsia X Airbus A330-300, registration 9M-XXD performing flight D7-221 from Sydney,NS (Australia) to Kuala Lumpur (Malaysia), was enroute at FL380 about 210nm southeast of Alice Springs,NT (Australia) when the crew received a low oil pressure warning for the right hand engine (Trent 772) and shut the engine down. The aircraft drifted down to FL230, subsequently descended to FL190 and diverted to Melbourne,VI (Australia) for a safe landing on runway 34 about 2:15 hours later.

Australia's TSB opened an investigation into the occurrence rated an incident, the final report is estimated for December 2016.

On Jan 13th 2017 the ATSB advised: "The scope of this investigation has been expanded consistent with the ATSB¡¦s increased understanding of the nature of the occurrence. This has impacted on the time taken to complete the investigation. It is now anticipated that the draft investigation report will be released to directly involved parties (DIP) in March 2017 for comment on the factual accuracy of the draft. Any DIP comments over the DIP period will be considered for inclusion in the final report, which is expected to be issued to the public no later than May 2017."

The ATSB updated their initial brief reporting that the engine surged three times over 5 minutes while the crew was working the checklists, the last time the engine thrust lever was at idle when the third surge occurred prompting the crew to declared Mayday and shut the engine down. After the aircraft had levelled off at FL230 the crew attempted an air restart of the right hand engine, which remained unsuccessful however. A second restart attempt about 90 minutes after the first restart attempt about 27 minutes before landing in Melbourne did result in a successful engine relight, the crew however felt vibrations from the engine and shut it down again.

A postflight inspection revealed engine oil levels were normal, there were no leaks, the magnetic chip detectors were all clean, the oil pump shaft neck was fractured, the high pressure assembly was seized due to bearing stress, high pressure assembly ball and roller bearings received damage consistent with engine operation without oil pressure.

The investigation is ongoing to review the company and flight crew procedures, flight crew actions (including the relight of engine #2), air traffic control data, engineering data and human factor aspects.

On Dec 19th 2019 the ATSB released their final report concluding the probable causes of the serious incident were:

Contributing factors

- In response to an engine oil low pressure (ENG OIL LO PR) ECAM, resulting from a fractured shaft within the oil pressure pump, the flight crew continued to monitor the engine parameters instead of shutting the engine down. Due to a mistaken understanding that the alert was a false indication, the flight crew subsequently increased thrust.

- The Airbus A330 engine oil low pressure (ENG OIL LO PR) abnormal procedure included the conditional instruction 'if the condition persists'. This may be interpreted as either requiring the flight crew wait a certain period of time to determine the continuation of the condition, as apparently interpreted by the flight crew, or, as intended by Airbus, that the condition has not changed as a result of the previous procedural step.

- Contrary to operating procedures, the flight crew made two attempts to relight the failed engine.

- The crew diverted to Melbourne instead of the nearest suitable aerodrome. This increased the time that the flight was exposed to the higher risk environment of single engine operations.

The ATSB described the sequence of events:

The loss of oil pressure was detected by the electronic centralised aircraft monitor (ECAM). At 2343:33, the ECAM alerted the flight crew by:

- triggering the ¡¦master warning¡¦ lights, located on the glareshield panel (Figure 3), and associated aural warning alert

- displaying the level 3 red warning alert ¡¥ENG 2 OIL LO PR¡¦ message and associated emergency procedure on the engine/warning display

- displaying the engine schematics on the system display (Figure 3). Included within the engine schematics on the system display were the oil system parameters.

In response to the ECAM alert, the captain took over duty as the PF, and at 2343:47, the engine 2 thrust lever was retarded to idle (ƒþ and blue line on Figure 2). The flight crew reported that, after retarding the thrust lever, the emergency procedure required the flight crew to monitor the engine and to shut the engine down if the problem persisted. While the warning persisted after the thrust lever was retarded, the flight crew stated that all other engine indications were normal. Specifically, while the crew could see that the oil pressure was indicating zero, there was still oil quantity. The flight crew recalled that, as this was the only abnormal indication, they were reluctant to shut engine 2 down. This also led them to believe that the fault might be a false warning from the oil pressure indicator.

The first engine stall

About 3.5 minutes after retarding the thrust lever to idle, at 2347:14, the flight crew advanced the thrust lever for engine 2 to the CL8 position (see „@ and blue line at Figure 2). The flight crew stated that this was done with the intent of checking/troubleshooting the engine. Approximately 40 seconds later, at 2347:55, engine 2 stalled9 and began to run down („A on Figure 2). In an immediate response to the stall, the engine¡¦s full authority digital engine control10 (FADEC) briefly cut the fuel flow to the engine, enabling the engine¡¦s airflow to return to normal. The stall was accompanied by a significant spike in recorded engine vibration.

The ECAM detected the stall at 2347:57, and alerted the flight crew by:

- triggering the ¡¦master caution¡¦ lights and associated caution aural alert

- displaying the level 2 amber ECAM message ¡¥ENG 2 STALL¡¦ with its associated abnormal procedure on the engine/warning display

- displaying the engine schematics on the system display.

The flight crew responded to the ECAM alert by retarding the thrust lever to idle („B and blue line on Figure 2). The engine parameters stabilised at an idle setting.

Shortly thereafter, at 2348:02, the flight crew declared a PAN PAN to air traffic control (ATC), stating that they had experienced an engine stall and requesting descent to FL 250. In communications with ATC over the following 30 seconds, the flight crew stated that they were ¡¥breaking off the airway doing a left turn¡¦ and declared a probable intention to divert to Melbourne.

The second engine stall

At 2348:37, 35 seconds after the first engine stall, the engine stalled again and ran down further („C on Figure 2). The second engine stall was also accompanied by a significant spike in the recorded engine vibration. The FADEC again responded by briefly cutting the fuel flow, however, this time the engine did not recover. The engine continued to run down, and failed. The ECAM detected the engine failure and at 2348:42, alerted the flight crew by:

- again, triggering the master caution lights and associated caution aural alert

- displaying the level 2 amber ¡¥ENG 2 FAIL¡¦ ECAM message, with its associated abnormal procedure on the engine/warning display

- displaying the engine schematics on the system display.

The flight crew responded to the ENG 2 FAIL ECAM alert by commencing the displayed procedure. That procedure included a decision about whether the engine was damaged. The flight crew stated that they consulted the flight manuals and determined that the engine was not damaged. In accordance with the required procedure, the engine master switch was selected to off at 2348:50, shutting the engine down.

...

Two attempts to restart (relight) the failed engine were conducted during the diversion to Melbourne. The flight crew later reported that the intent to relight the failed engine was based on the ¡¥engine fail¡¦ (ENG FAIL) procedure, which instructed the flight crew to consider a relight provided the engine was not damaged. The flight crew reported that, after working through the quick reference handbook and flight crew operating manual, they determined that the engine was not damaged.

At 0002:14 on 17 August, about 13 minutes after shutting the engine down, the flight crew attempted to relight engine 2. The following engine parameters were recorded immediately preceding the relight attempt:

- N1 was indicating a stable 23 per cent rotation
- N2 was indicating a stable 7 per cent rotation
- N3 was indicating 0 per cent rotation.

The relight attempt commenced when the engine master switch was selected to ON at 0002:15, and ceased at 0003:38 when the switch was selected to OFF. During the relight attempt, the aircraft was slowly descending from FL 239 to FL 232 with the airspeed slowly increasing from 258 kt to 280 kt. The attempted relight was unsuccessful. During the relight attempt, the ¡¥ENG 2 START FAULT¡¦ ECAM message was displayed.

At 0132:00, just before commencing descent into Melbourne, a second relight was attempted by the flight crew. During this relight attempt, the aircraft was at FL 190 and the airspeed about 315 kt. The following engine parameters were recorded immediately before the relight attempt commenced:

- N1 was stable at about 25 per cent rotation
- N2 stable at about 6 per cent rotation
- N3 stable at 0 per cent rotation.

The flight data identified that both relight attempts were starter motor assisted relights. For the second relight, there was a 13 second delay from the initiation of the relight until the first indication of rotation of N3. A further 12 seconds later, at 0132:25, N3 achieved sufficient rotation for fuel to be introduced into the engine. At this time, N1 remained at 25 per cent, N2 had increased to 12 per cent and N3 had increased to 25 per cent. At 0132:36 a successful relight occurred, however, N1 remained at 25 per cent, N2 had increased to about 22 per cent, and N3 had stabilised at about 43 per cent. The flight crew later reported that, during the relight, vibrations were felt from the engine. As a result of this vibration, at 0132:46, the flight crew ceased the relight attempt and shut down engine 2.

The ATSB analysed:

While en route from Sydney, NSW to Kuala Lumpur, Malaysia, the oil pressure pump drive shaft for the right engine (engine 2) of an AirAsia X Airbus A330 failed. That shaft failure resulted in the oil pressure in engine 2 dropping rapidly to 0 psi. The aircraft¡¦s electronic centralised aircraft monitor (ECAM) detected the drop in oil pressure and notified the flight crew through the ENG 2 OIL LO PR alert and associated warning signals. In response to the alert, the flight crew reduced the engine¡¦s thrust to idle in accordance with the displayed procedure, but then elected to monitor the engine instead of shutting it down as intended by the procedure. After almost four minutes, the flight crew returned the engine 2 thrust lever to the normal inflight position, resulting in the engine¡¦s thrust increasing. Shortly thereafter, the engine surged a number of times and eventually failed. The flight crew completed the engine failure procedure, shutting the engine down, and initiated a diversion to Melbourne. During the diversion, the flight crew attempted to relight engine 2 twice, the first shortly after the engine failure, and the second just prior to descending into Melbourne. Rolls Royce determined that the drive shaft failed due to fatigue cracking, but this was an unusual failure that had not been observed previously.

Oil pressure alert and subsequent engine failure

The oil pressure pump shaft failure resulted in a level 3 failure red alert, and the ECAM message ENG 2 LO OIL PR and associated procedure being displayed to the flight crew. A level 3 alert is associated with a configuration or failure that requires an immediate crew action, as this configuration or failure may alter the safety of flight. After moving the thrust lever to idle, the procedure included a precondition for initiating the next and final step. That precondition required the flight crew to determine whether the ¡¥warning persists¡¦, and if it did, then to shut the engine down. The flight crew probably interpreted the precondition as a temporal and not a conditional requirement:

- temporal, in that any further action be delayed, an interpretation that could be supported by the Flight Crew Training Manual (FCTM) guidance that urged a bias towards deferring any action that will result in shutting an engine down, and to look beyond the abnormal parameter

- conditional, as is the intent of the Rolls-Royce guidance to Airbus on the procedural design.

The flight crew elected to leave the engine at idle, and instead undertook further analysis of the engine indications. The flight crew¡¦s actions point to two human performance issues in the conduct of the checklist:

- potential ambiguity in the checklist¡¦s construction
- error in the flight crew¡¦s performance, as a result of their mistaken belief as to the source of the level 3 alert.

Ambiguity in the checklist language

The engine manufacturer¡¦s engine operating instructions clearly identified that the procedural response to the OIL LO PR message required the engine to be shut down if the message had not cleared when the idle setting had been achieved. The use of the word ¡¥persists¡¦ in the precondition for completing the procedure in the Airbus ECAM procedure introduced the possibility of misinterpretation of the required precondition by the flight crew.

Effective communication, which includes all transfer of information whether spoken or written, is essential for the safe operation of flight. The quality and effectiveness of communication is determined by its intelligibility, that is, the degree to which the receiver understands the intended message. Individual words can have multiple meanings, while sentence construction and context can further complicate understanding.

While English is the international language of the aerospace industry, English is often not the native language of flight crew. An example of an attempt by an industry organisation to promote clarity in the use of English in technical documents is the ADS-STE100. That document highlights the potential ambiguity of the verb ¡¥persists¡¦. Airbus have also identified that an internal lexicon is used in the construction of ECAM language. That lexicon does not appear to be publicly available.

The flight crew¡¦s action in monitoring the engine parameters after partially completing the required procedure is a strong indicator of a misunderstanding in the language used for the precondition description.

Error in the conduct of the ENG 2 OIL LO PR procedure

Airbus pointed out that procedural non-compliance can be a function of understanding the procedure and its meaning. While the supporting explanation for the ENG OIL LO PR alert in the flight crew operations manual (FCOM) was limited, the ECAM was a level 3 alert. A level 3 or red alert denotes a ¡¥system failure that alters flight safety and requires immediate action¡¦, and the associated procedure is one ¡¥which may result in personal injury or loss of life if not carefully followed¡¦.

The flight crew¡¦s response, however, should also be assessed in light of the FCTM¡¦s guidance on shutting an engine down as well as the apparent miscomprehension of the ¡¥persist¡¦ component of the procedure. The FCTM guidance stated that a flight crew should keep the engine operating unless the procedure required an engine shutdown. Instead of shutting the engine down, the flight crew mistakenly continued monitoring the condition of engine 2.

While monitoring the engine, the flight crew developed a belief that the zero oil pressure readings were due to a gauge error, as all other engine parameters were interpreted as being normal. This led to a mistaken understanding that the alert was a false indication. The flight crew subsequently increased engine 2¡¦s thrust. The increase in thrust resulted in the engine surging then stalling, which triggered the ENG 2 STALL alert. The flight crew correctly actioned this new ECAM procedure, retarding the thrust lever. About 30 seconds later, however, the engine surged again and failed. The engine failing triggered the ENG 2 FAIL alert.

The flight crew¡¦s action of increasing the thrust on engine 2 following the ENG 2 OIL LO PR alert led to the engine stalling and then failing. While it is likely that continued operation of the engine at idle thrust with zero oil pressure would have eventually resulted in sufficient bearing damage that would lead to stalls and engine failure, the increase in thrust accelerated that result and probably increased the damage to the engine.

Finally, as identified by the United Kingdom¡¦s Air Accidents Investigation Branch bulletin 9/2013, there had been a recent series of false low oil pressure ECAM alerts on Rolls-Royce engine A330 aircraft. It is not known whether the flight crew were aware of these, or any subsequent Airbus notifications concerning this issue.

Attempted relights of the failed engine

The flight crew stated that, following the engine failure, they then actioned the ENG 2 FAIL procedure. That procedure included a restart (relight) attempt, and then required a decision about whether the engine was damaged. If the engine was deemed not to be damage, the procedure prompted the flight crew to consider a further relight attempt. The conditions indicative of engine damage were contained within the FCOM, but not displayed on the ECAM. The flight crew later reported that they consulted the FCOM, following which they determined that the engine was not damaged. This may have been influenced by confirmation bias as there was evidence available to the crew that met the criteria for damage, including:

- repeated or uncontrollable engine stalls¡Xthe engine experienced two surges/stalls. The ENG 2 STALL message alerted the flight crew to the first stall, to which they responded in accordance with the required procedure, and from which the engine recovered. The second stall was uncontrolled and resulted in the engine failing. The flight crew stated that they did not recognise the two stall events as being separate, however, they stated that they briefly saw the engine stall message and that the engine then failed. By this account, the engine experienced an uncontrollable engine stall.

- abnormal engine indications¡Xthe guidance cites hydraulic fluid loss, no N2 or N3 indication as examples. The flight crew stated that they assessed the oil pressure indications as being abnormal after they had completed the initial actions for the ENG OIL LO PR alert.

Further, the FCOM version of the ENG 2 FAIL procedure stated, at the end of the procedure, that the engine should be shut down if a relight was unsuccessful.

The ATSB concluded the analysis into the engine relights:

The multiple failures and abnormal indications associated with engine 2 should have raised questions for the flight crew on the cause of the failures and the viability of the engine. The operator¡¦s procedures stated that, if the reason for an engine failure cannot be clearly identified, then it shall not be restarted unless a greater emergency exists. A greater emergency did not exist. Contrary to the operator¡¦s procedures, the flight crew attempted two restarts on the failed engine.