Engine thrust reverser malfunction involving Airbus A320, VH-VGZ, Sydney Airport, New South Wales, on 20 September 2018

What happened

On 20 September 2018, at about 1620 Eastern Standard Time^[1], an Airbus A320, VH‑VGZ, operated by Jetstar departed Brisbane Airport, Queensland, on a scheduled passenger flight to Sydney, New South Wales, with six crewmembers and 178 passengers on board.

During the landing roll, the flight crew selected both engines to ‘reverse thrust’ and received an Electronic Centralised Aircraft Monitor (ECAM) ‘reverse fault’. The captain called, ‘no reverse’ and the first officer completed the landing utilising normal braking. The flight crew taxied the aircraft off the runway at the planned exit. The captain later recalled that, during the pre-flight checks, he had not observed any indications on the engine cowls, in the cockpit or on the technical log to show that the thrust reversers were de-activated.

There was no damage to the aircraft, or injuries sustained during the incident.

Engineering inspection

Following the incident, an engineering inspection revealed that the thrust reversers were in the de‑activated position; with the minimum equipment list (MEL) lockout pin installed (Figure 1). The lockout pins were removed from each of the engines, thrust reversers were tested and found to be serviceable, and the aircraft was returned to service.

Figure 1: MEL lockout pin installed in thrust reverser hydraulic control unit (HCU)

Source: Operator, annotated by the ATSB

Maintenance prior to the incident flight;

On 17 September 2018, VH-VGZ arrived at the Qantas maintenance facility in Brisbane, Queensland. The aircraft was scheduled for a three-day maintenance check and was due to return to service at 2040 on 20 September 2018.

Two days into the maintenance, the engineers identified that the horizontal stabiliser actuator required replacing, which added half a day of work to the schedule. To recover the lost time, a team was organised to begin work at 0400 the following day. At about 0600 on 20 September 2018, the actuator replacement was completed and the team proceeded to finalise the remaining scheduled maintenance tasks.

At about 0840, a licenced aircraft maintenance engineer (LAME) completed and certified the task card for a required thrust reverser functional check. Based on the system test of the thrust reversers, but contrary to the required procedure, he also completed the certification for the same check on the ‘hangar release’ task card.

The check coordinator (CC) instructed the engineering team to return all equipment to the tool crib, so that he could complete signoffs on the work packages. Two hours later, the CC received a call from Jetstar to inform him that the aircraft departure time had been brought forward to 1620. The CC assessed the request based on outstanding workload, certification and resource requirements and accepted the reschedule. The CC communicated the new schedule to the engineering team. To avoid a shift handover during the final maintenance signoffs, the CC instructed the engineers to complete the maintenance by the end of first shift at 1500. Due to the compressed schedule, many of the engineers worked through their lunch breaks to ensure they could complete the maintenance on time.

After completion of the engine ground run checks, the engineers discussed the remaining maintenance items on the ‘hangar release’ task card (Figure 3), giving consideration to the limited time remaining. The engineers noted that:

• the thrust reverser functional check was not a requirement in the aircraft maintenance manual (AMM) following the engine leak check
• the functional check on the hangar release card had already been signed concurrently with the thrust reverser functional check completed earlier that morning.

On that basis, and with consideration to the remaining time, the engineers decided that they did not need to repeat the functional check on the thrust reversers after completing the engine leak checks. That was contrary to the requirements associated with releasing the aircraft back to service (see the section titled Maintenance procedures).

Shortly after, the engineers pushed the aircraft out of the hangar to complete the final checks, which included the engine leak checks. The AMM engine leak check procedure required the left and right engine thrust reversers to be de‑activated. The de-activation procedure specified the use of warning notices in the cockpit and a lockout pin with a red warning flag attached (Figure 2). The AMM lockout pin was located in the tool crib. Checking out the AMM lockout pin from the tool crib would have resulted in delays to the closure of the work package as that could only be done when all tools were checked back in. The MEL lockout pin, which was functionally the same but did not have a warning flag attached, was located inside the engine cowling. In an effort to keep to schedule, the engineers decided to use the MEL lockout pin as a substitute. The engineers did not put additional warning notices in the cockpit for thrust reverser de-activation as they considered the ‘maintenance in progress’ notice to satisfy the AMM requirement.

The installed MEL lockout pins were not identified following completion of the engine leak check procedure. Consequently, both engine cowlings were closed with the lockout pins in place and the thrust reversers inoperative.

Figure 2: Lockout pin with warning flag

Source: Operator

At about 1240, 3 hours and 40 minutes prior to the incident flight, the final paperwork was completed and the engineers released VH-VGZ to service.

Maintenance procedures

A typical work order for any maintenance check contained a number of ad hoc task cards that were required to be completed and certified to record the work done. During aircraft maintenance checks, ‘non-routine’ task cards could be raised by the engineers to complete defect rectification or other work resulting after carrying out inspection tasks of the check’s work pack and/or technical log defects.

The ad hoc task card for the hangar release check, contained a note regarding the importance of completing all post-maintenance checks as standalone tasks; and provided an order of jobs to be completed sequentially (Figure 3).

Figure 3: Operator’s task card for A320 hangar release check

Source: Operator, annotated by the ATSB

Engineers’ comments

The maintenance engineers provided the following comments after the incident:

• During the final maintenance tasks, some of the engineers reported feeling tired as a result of a combination of factors including:
  • early start times
  • skipped meal breaks
  • circumstances outside work, which had limited their ability to get quality sleep the previous evening.
• Each of the engineers felt a sense of responsibility and pressure to provide on-time performance to the customer.
• The schedule compression and increased pressure for on-time performance influenced their decision to use the MEL lockout pin, as it would not delay the completion of the maintenance paperwork.
• At the start of the maintenance check, the engineers placed a generic ‘maintenance in progress’ warning notice over the controls in the cockpit. The generic warning notice was considered by some of the engineers to concurrently satisfy the requirement in the individual AMM tasks to place specific warning notices over the controls.

Qantas’ comments

Following an internal review of the incident, Qantas provided the following comments:

• The individuals involved in this occurrence were all working in compliance with the maintenance organisations’ approved fatigue management framework.
• The awareness of following the AMM safety precautions steps, such as placing specific warning notices over the controls, at the Brisbane base was not as robust as it should be.

Safety analysis

Following non‑operation of the thrust reversers during the landing roll, an engineering check revealed that the MEL lockout pins were installed in the hydraulic control units (HCU) resulting in deactivation of the thrust reverser system. The pins were installed as part of required maintenance action and unintentionally not removed prior to flight.

Although the AMM procedure did not require a functional check of the thrust reversers following reactivation, the operator’s task card did. The task card was a supplemental procedure to the AMM and it was a requirement that a licenced engineer sign and certify that each step was completed. The task card specifically noted the importance of conducting the post‑maintenance checks as stand-alone tasks. Contrary to the written procedure, the engineers did not follow the task card sequentially and signed off the operational check based on testing that they had completed earlier in the day. While that action was probably motivated by the desire to expedite the aircraft’s return to service, if the engineers had completed the functional check in sequence, they would have discovered that the thrust reverser was still de-activated.

Although the required operational check of the thrust reverser would have prevented this incident, other maintenance actions hampered detection of the HCU lockout. Thrust reverser de-activation required the use of a lockout pin with a red flag attached to provide a visual indication that the HCU was de-activated. The MEL lockout pin that was actually fitted was designed for in service use and was much less visually obvious than the pin used during maintenance.

The replacement of the horizontal stabiliser actuator and change to the revenue flight departure time had a compounding effect on the maintenance schedule. The engineering team probably felt pressure to expedite the maintenance, working through meal breaks in an effort to achieve this. The engineers stated that they felt pressured to return all tools to the tooling crib so that the CC could complete the paperwork, and that this was an influential factor in their decision to use the MEL lockout pin.

The AMM thrust reverser de-activation procedure also required the use of specific warning labels in the cockpit, stating that ‘thrust reverser HCU is de-activated’. However, it was reportedly common practice to only use a generic maintenance warning notice. That action, in combination with use of the MEL lockout pins, removed opportunities to identify the status of the thrust reverser system during the final inspection, and before the aircraft was returned to service.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Deviation from the required maintenance procedures resulted in the aircraft being returned to service with the thrust reverser system inadvertently deactivated.
• Operational pressure to expedite the maintenance probably influenced the engineers’ decision to deviate from the written procedures.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas Engineering

As a result of this occurrence, the maintainer has advised the ATSB that the following safety actions were taken:

• A Quality Alert was issued, with a requirement for all Brisbane‑based maintenance staff to read and sign. The Quality Alert reminded engineers to ‘always use the lockout pins issued from the tool crib unless a MEL is required to be applied to the aircraft.’
• The occurrence was discussed with all Jetstar’s aircraft-certifying staff, including the effect of perceived time pressures and the importance of documentation and compliance.
• A review of the process of previous lockout pin management in Brisbane was conducted to rule out a systemic problem with lockout pin management.
• All A320 thrust reverser lockout pins were inspected to confirm they were correctly identified and flagged.
• An A320 de-activation board, containing the correct A320 lockout tooling, has been constructed. The trolley will sit next to the aircraft during maintenance visits for ease of access.

Safety message

Operational pressures are a reality of the aircraft industry, with aircraft delays having a substantial cost impact to operators. Such time and production pressures have the potential to influence safe work practices. It is imperative in the aircraft maintenance industry that, at all levels of an organisation, employees feel empowered to stop a process when they observe procedural violations or foresee that an error is likely to occur.

This incident serves as a reminder that a failure to follow procedures, such as functional checks, can result in unintended consequences. Functional checks are the last line of defence in maintenance work and can identify a range or errors that may have occurred during the job completion process. The extra few minutes taken to complete a functional check could detect an unsafe situation.

The United States Federal Aviation Authority has conducted research into the topic of ‘failure to follow procedures’. A number of useful articles and training tools can be found on their website, including:

• FFP The Buck Stops with Me
• Failure to Follow Procedures: Deviations are a Significant Factor in Maintenance Errors
• Addressing Failure to Follow Procedures – Again

The ATSB SafetyWatch report, Fatigue, provides information on how to recognise if fatigue may be affecting your performance.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.