De-icing boot failure involving Saab 340, VH-ZLH, Esperance Airport, Western Australia, on 26 May 2018

What happened

On 26 May 2018, at about 0647 Western Standard Time (WST)^[1], a SAAB 340B, VH-ZLH, operated by Regional Express Pty Ltd, was taxiing at Esperance Airport, Western Australia (WA). The aircraft was on a scheduled passenger flight to Perth, WA, with three crew members and 32 passengers on board.

While taxiing, the first officer (FO) conducted an ice protection test and received a Master Caution. The crew observed that the STAB BOOT IND light^[2] was not illuminating and the Ice Protection Master Caution light^[3] on the Central Warning Panel (CWP) was on. The crew noted that the TIMER light^[4] did not illuminate during the test as expected. The crew conducted a lamp test and concluded that the TIMER light was functioning correctly.

Before entering the runway, the crew conducted their failure management procedure and went through the Quick Reference Handbook Checklist (QRH); ‘Boot remains inflated and boot indication light remains on or off’. In addition, the flight crew checked the Minimum Equipment List (MEL) to ensure there were no operational requirements that would ground the aircraft.

The Captain and the FO discussed the warnings and their observations that:

• no visible defects were detected during the daily walk-around check
• the TIMER light was working, but did not illuminate in conjunction with the STAB light
• the warnings received did not follow any of the scenarios in the QRH
• the MEL permitted dispatch outside of known or forecast icing conditions
• the forecast freezing level was 7,500 ft and if necessary, the flight to Perth could be conducted as low as 4,000 ft.

Following their discussion, the flight crew concluded that the warnings were most likely the result of a faulty sensor and there was no risk to the safety of the flight. Subsequently, they elected to proceed with the flight as scheduled and the flight was conducted without further incident.

During the post-flight walk-around, the FO observed that the right-hand stabiliser boot had a tear approximately six inches (150 mm) in length (Figure 1). The de-icing boot was replaced in accordance with the aircraft maintenance manual before the aircraft was returned to service. There were no other faults found with the de-icing system.

Figure 1: Photo of the damaged de-icing boot

Source: Aircraft operator annotated by the ATSB

De-icing boot system

The wing, vertical and horizontal stabiliser de-icing systems consist of inflatable boots, located on the leading edges of the vertical and horizontal stabiliser and the wing. The boots are inflated using precooled engine bleed air, controlled by a pressure regulator and supply valve. De-icing occurs when accumulated ice is cracked by rapid inflation of the boots. A timer control unit regulates the boot inflation cycles.

The crew can monitor inflation of the de-icing boots by observing the boot indication lights, located on the overhead panel. A fault light illuminates if a fault is detected in either the operation of the valves or the boots. If a boot remains inflated after normal operation of the system, the fault light will also illuminate.

A ruptured or torn stabiliser boot can be indicated by a series of cautions:

• the ‘STAB light’ will not illuminate, indicating that the respective boot is not pressurised; and
• the ‘Timer light’ will illuminate, indicating either that a boot is not pressurised or the activated timer has given a ‘no inflation’ signal; and
• the ‘Ice protection master caution’ on the CWP light will flash, advising the flight crew of a fault within the ice protection system.

All of the cautions need to be present to indicate a ruptured or torn boot.

Airworthiness directive

Airworthiness directive (AD) AD 2017-0144 was released in August 2017, superseding AD 2015‑0129. The AD addressed the issue of rupturing of the horizontal stabiliser de-icing boots in flight which, in some reported events, had formed a large open scoop. The AD indicated that the condition, if left unrepaired, could lead to loss of the de-icing function and severe vibrations, possibly resulting in reduced control of the aeroplane.

To address this potentially unsafe condition, the following measures were stipulated:

• a recommendation to select ‘Flaps 0’ for landing in the event of a suspected rupture of the de-icing boot on the horizontal stabiliser
• inspection of de-icing boots as per Service Bulletin (SB) 340-30-094
• repeated inspections at a maximum interval of 400 flight hours of the horizontal stabiliser de-icing boots
• replacement of the left and right horizontal stabiliser de-icing boots with improved double stitched boots within 18 months of the release of AD 2017-0144, as per SB 340-30-095.

Inspections

The operator’s inspection procedures followed the requirements defined in AD 2017-0144. The Flight Crew Operating Manual (FCOM) outlined the visual inspection requirements for the de-icing boots during the daily, post-flight and crew change inspections. The FCOM contained a requirement to inspect the de-icing boots for surface damage such as abrasions, cracking, foreign object damage, loose repair patches and tears. The flight crew were responsible for documenting identified defects on the aircraft maintenance log, which was then provided to the engineering team for assessment.

The flight crew reported that they had flown VH-ZLH into Esperance the evening before the incident. The de-icing boots had remained operational during that flight. The FO did not identify any defects on the de-icing boots during the post flight walk-around.

The morning of the incident, the FO conducted the daily walk-around in accordance with the FCOM procedures. The FO carried out the aircraft inspection at dawn, in overcast and low-light conditions. Due to the light conditions, the inspection was conducted with the aid of a torch. The flight crew indicated that discontinuities in the de-icing boot surface are usually readily identified using torch light.

The horizontal stabiliser is located approximately 4 m from the ground with the top surface of the de-icing boot sweeping back over the horizontal stabiliser to be parallel to the ground. The flight crew indicated that a visual inspection of all surfaces of the boot is possible from the ground, however, it can be more difficult to see the uppermost surface. The tear in this occurrence was located on the lower surface of the stabiliser boot (Figure 1), which is an easily inspected location from the ground.

Continuation of flight with defects

For any crack, slit or tear in the boot, a temporary or permanent repair patch must be applied before the aircraft can be returned to service.

There were five MELs that allowed for operation of the aircraft with partially or wholly inoperative (but not torn) de‑icing boot system. One MEL had an associated pilot‑in‑command (PIC) maintenance inspection and all of the MELs permitted dispatch of the aircraft provided the flight crew did not operate in known or forecast icing conditions^[5].

Flight crew comments

As a result of this occurrence, the flight crew of VH-ZLH indicated they had learned that when faced with ambiguous situations, it is important to take precautions and take the time to consider all the options. If the situation does not make sense, go back to the bay and confirm that everything is as it should be before you take off.

Safety analysis

On examination by the engineering team, the only fault found within the de-icing system was a torn de-icing boot. It was therefore likely that the cockpit warning lights were indicative of that defect, despite the fact that the unlit TIMER light was not consistent with a torn boot as described in the QRH. The TIMER light not illuminating during testing was likely to have been a system anomaly and there was, in fact, a defect present in the de-icing boot that either went undetected during visual inspections or ruptured during the pre-flight test.

The TIMER light not illuminating during the de-icing system testing was not a known issue to either the operator or the manufacturer. The operator’s engineering team tested the TIMER light after repairing the de-icing boot and found it to be serviceable.

The FO did not observe any defects in the surface of the de-icing boots during the walk-around inspections, either the evening before or on the morning of the incident. During the post-flight walk-around however, the FO identified the tear without difficulty. It was therefore likely that if there was a pre-flight tear, it was small in nature, allowing it to go undetected. That being the case, aerodynamic loading on the horizontal stabiliser during the flight would have resulted in the defect increasing to the size that was readily identified post-flight.

Prior to departing, the flight crew assessed the criteria in QRH and the MEL (section 30-10-5, Boot indication lights), to ensure the aircraft was safe to depart. Under MEL 30-10-5, ‘all [indication lights] may be inoperative provided the aircraft is not operated in known or forecast icing conditions’. That MEL did not require any PIC maintenance. Based on the assumption the abnormal indications were due to a faulty sensor and knowing that the scheduled flight could be conducted below the forecast freezing level, the flight crew felt satisfied that there was no risk to the safety of the flight to continue as scheduled. That assessment, while understandable, included a likely incorrect assumption regarding the defect in the de‑icing system that led to the flight being conducted with a torn de‑icing boot.

The flight crew reported that they did not experience any in-flight controllability issues or abnormal vibrations during the flight to indicate that there was a torn de-icing boot. While a torn boot is not guaranteed to result in controllability issues, without any inflight indications there was no reason for the crew to suspect a torn boot and conduct a ‘Flaps 0’ landing as per the AD recommendation.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• It was likely that the crew conducted a flight with a small defect in the aircraft’s horizontal stabiliser de-icing boot, which increased to a readily detectable size during the flight.
• The timer light for the de-icing system did not illuminate, giving the flight crew indications that were inconsistent with a torn de-icing boot. The reason for the unlit timer light could not be determined.
• The flight crew managed the risk of airframe icing prior to continuing with the flight.

Safety action

Aircraft operator

As a result of this occurrence, the aircraft operator advised the ATSB that they had taken the following safety actions:

• provided additional training on the de-icing systems and associated MELs to the flight crew
• discussed the potential occurrence of a torn de-icing boot with no associated TIMER light with the manufacturer
• all five de-icing boot MELs have been amended to include PIC maintenance visual inspections.

Safety message

This incident highlights that there is the potential for anomalies to occur in the operation of warning systems. In the event that fault indications are ambiguous and there is the possibility of affecting the safety of the flight, it is important to take the necessary conservative precautions to resolve the issue prior to conducting the flight.

__________

1. Western Standard Time: Coordinated Universal Time (UTC) + 8 hours
2. The STAB light (green) illuminates when the horizontal stabilizer de-icing boot is pressurised.
3. The Ice Protection Master Caution light flashes whenever a caution light associated with the ice protection system illuminates.
4. The Timer light (amber) will illuminate in a number of scenarios, including if (1) no pressure is sensed downstream of the valve sequenced for opening within four seconds; (2) the activated timer gives no inflation signal.
5. Icing conditions existed when the outside air temperature on the ground and for takeoff, or static air temperature in flight, was 5°C or below, and visible moisture in any form (clouds, fog, rain, snow, sleet or ice crystals) was present.