Engine failure involving Boeing 787, 9V-OJE, Perth Airport, Western Australia, on 11 October 2018

Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.

The occurrence

On 11 October 2018, at about 1421 Western Standard Time,^[1] a Boeing 787-9, 9V-OJE, operated by Scoot Tigerair (Scoot), departed Changi Airport, Singapore. The aircraft was on a scheduled passenger flight to Perth, Western Australia, with 11 crew members and 356 passengers on board.

Approximately 2 hours into the flight, the crew received two status messages indicating abnormalities within the right engine. Three hours later, during descent, the aircraft was passing through FL 250^[2] when the crew noticed that the right engine was slow to respond to commanded inputs. Throughout the descent, the right engine performance continued to decline. Passing through 9,000 ft, severe thrust asymmetry developed, and the captain noticed rudder input from the autopilot. Shortly after, at 1853, the crew received the engine‑indicating and crew‑alerting system (EICAS) message ENG FAIL R, and the right engine shut down.

In response, the flight crew declared a PAN^[3] and requested air traffic control clearance to level off at 5,000 feet and be vectored off the approach to allow time for completion of the quick reference handbook (QRH) checklist items. Completion of the QRH checklist required the flight crew to decide whether they should attempt to relight the engine. Due to the proximity of the airport and because the aircraft is capable of landing safely with one engine, the flight crew decided that attempting an engine restart was unnecessary. After the checklist was completed, the flight crew conducted a NITS^[4] briefing with the cabin crew.

Subsequently, the flight crew completed the landing performance calculations and advised ATC that they were ready to land. The flight crew also requested that emergency services conduct a visual inspection of the aircraft after landing.

At 1909, the aircraft landed safely at Perth Airport and emergency services carried out a visual inspection. The aircraft was cleared to taxi to the parking bay and disembark passengers normally via the aerobridge.

There were no injuries sustained and no damage to the aircraft as a result of the occurrence.

Context

Subsequent maintenance

Following the occurrence, an engineering team carried out a detailed inspection of the aircraft to address the in‑flight shutdown and status/EICAS warning messages observed by the crew. The technical examination resulted in replacement of the right engine hydro‑mechanical unit (HMU) and a high‑power engine run was then successfully performed.

On 12 October 2018, a non-revenue flight (no passengers or cargo) was conducted to return the aircraft to Singapore for further maintenance, during which time the electronic engine controller (EEC) was replaced. The aircraft then returned to revenue service.

On 15 October 2018, the aircraft was on a flight from Sydney to Singapore when several maintenance messages indicating similar issues to the occurrence flight were generated, but there was no noticeable effect on engine performance. Following the flight, additional components were replaced, including the:

• HMU (further replacement)
• fuel pump
• high‑ and low‑pressure fuel filters
• left and right variable stator vane actuator.

The aircraft was then declared serviceable and returned to service with no further recurrence of the maintenance messages.

Engine fuel system

The Trent 1000 fuel system includes a three-stage pump that supplies fuel from the aircraft to the engine. Fuel runs through a low pressure (LP) pump followed by two high pressure (HP) pumps, identified as primary and secondary, running in parallel. The primary HP pump operates under all conditions, while the larger secondary HP pump increases fuel flow to the engine at periods of high demand, such as take-off.

The HP pumps supply fuel to the HMU, which controls fuel flow to the engine using its fuel metering valve (FMV) as follows:

• Fuel enters the FMV servo assembly within the HMU through an inlet filter.
• To change the flow rate of fuel supplied to the engine, the EEC sends electrical signals to the FMV servo assembly.
• The signals control the position of a valve, which changes the fuel pressures within the servo assembly.
• These servo pressures determine the position of the FMV, which ultimately controls the flow rate of fuel to the burners.

Rolls-Royce investigation

Following the occurrence and subsequent non-revenue flight to Singapore, the engine manufacturer, Rolls-Royce, conducted an investigation into the occurrence. This included reviewing flight data from both flights, examining engine components from 9V-OJE, and based on its findings, assessing the Trent 1000 fleet more widely.

Review of flight data

Approximately 2 hours into the flight, during cruise, the right engine’s EEC generated the following message:

Hydro-Mechanical Unit (Right Engine) fuel metering valve (FMV) torque motor current is too low or too high.

This message indicated that the current required to adjust the fuel flow via the FMV was outside the expected range. Eleven minutes later, another message indicated that the current had exceeded an allowable limit:

Hydro-Mechanical Unit (Right Engine) fuel metering valve (FMV) torque motor current is failed too low or too high.

During descent, approximately 3 hours later, two more messages were generated:

Hydro-Mechanical Unit (Right Engine) fuel metering valve (FMV) is not in commanded position.

Right Engine is failed below idle with fuel switch on.

Rolls-Royce determined that the first message was evidence the FMV was taking longer than it should have to reach the position specified by the EEC. It was found that the second message was generated after the EEC had commanded a deceleration. The FMV moved below the idle position as requested, but once deceleration had occurred, it did not move back to the directed idle position. The right engine then ran at sub-idle speed for a short time before shutting down. Data for the entire occurrence flight indicated that the torque motor current required to control the FMV position increased throughout the flight up until the in‑flight shutdown.

Rolls-Royce also identified that the maintenance messages generated during the flight to Singapore on 15 October 2018 indicated that control of the new FMV was still requiring a higher-than-expected torque motor current. However, the engine continued to operate normally, and the flight was completed without incident.

Component examination

Rolls-Royce examined the HMU from the occurrence flight (HMU 1) as well as the one from the subsequent flight (HMU 2). In both units, a build-up of metallic debris was found in various locations, although more debris was found in HMU 1. The inlet filter to the FMV servo assembly was at least partially blocked with debris in both units.

Rolls-Royce concluded that the in-flight shutdown of 9V-OJE’s right engine was the result of the blocked inlet filter on the FMV servo assembly. The blockage restricted the EEC’s ability to control the FMV, and ultimately, the flow of fuel to the engine.

The FMV servo assemblies from each HMU were scanned using CT imaging. The resulting x-ray cross sections are shown with photographs of each servo assembly in Figure 1.

Figure 1: Blocked inlet filters on both FMV servo assemblies

The build-up of metallic debris was greater on HMU #1. Some deformation can also be observed in the #1 inlet filter x-ray image. Rolls-Royce determined that this was likely due to the high‑pressure differential caused by the blockage.

Source: Rolls-Royce

Analysis of the metallic debris revealed that it consisted of material from the fuel pump bearings and the casing. All three stages of the pump (the LP pump, and the two HP pumps) were disassembled and examined by Rolls-Royce in the presence of the United Kingdom Air Accidents Investigation Branch.

The examination found that the debris originated from the secondary HP pump. The bearings for the secondary HP pump driven gear were heavily worn, with evidence of scoring and missing material (Figure 2). Rolls-Royce found that the casing for the driven gear had more wear than would be expected during normal operation, likely due to shaft movement resulting from the damaged journal bearings. No damage was found on other bearings within the secondary HP pump or the other two fuel pumps.

Figure 2: Worn journal bearings and casing for the secondary HP pump driven gear

Source: Rolls-Royce

Rolls-Royce reviewed the manufacturing records for the secondary HP pump but found that it was typical of the fleet. No abnormalities had been noted, and the pump dimensions were within the accepted tolerances. The material composition of the fuel pump components was checked and found to be similar to the rest of the population. The fuel pump and HMU from the left engine were removed and inspected as a precaution, but there was no evidence of journal wear or debris build-up.

Trent 1000 fleet inspection

On 1 November 2018, another Scoot Boeing 787 generated maintenance messages related to the HMU during start-up, prior to a flight. The engine was inspected, and some wear was also found on the secondary HP pump journal bearings.

To search for similar HMU maintenance messages, Rolls-Royce examined all maintenance data across the fleet of Trent 1000 Package B and Package C engines and continued to monitor ongoing flights. Six other events were found where messages were generated due to fuel pump debris blocking the FMV servo assembly inlet filter. Five of these events were from aircraft operated by Scoot, while one was from a different operator.

Of the events found in the Scoot fleet, the age of the pumps varied between 5,201 and 12,686 hours. The recommended life of the pumps was 22,000 hours. Based on the number of occurrences compared with the greater Trent 1000 fleet, Rolls-Royce determined that the secondary HP pump journal bearings on Scoot aircraft were particularly susceptible to low life journal wear.

In an effort to determine what was increasing wear susceptibility in the Scoot fleet’s bearings, Rolls‑Royce identified a number of potential factors, including the following:

• Pump manufacture and build: The worn pumps found on Scoot aircraft had been manufactured over a number of years from 2015 to 2017. As such, it was determined that a batch or build issue was unlikely to be a common factor.
• Fuel quality: Analysis of fuel samples from Singapore Changi Airport found no anomalies within the 12 months prior to the occurrence involving 9V-OJE. There were also no reports of fuel pump bearing wear from other Trent 1000 operators that used the same airport.
• Operations: Rolls-Royce noted that Scoot generally flew shorter routes than most other Trent 1000 operators, but there were comparable operations with no evidence of fuel pump journal wear. Within the Scoot fleet, aircraft flew to multiple destinations, and there were no specific city pairs associated with the engines with worn bearings.
• Maintenance: Scoot shared its maintenance facilities with another operator that also used Trent 1000 engines. There was no evidence of fuel pump bearing wear from this operator.

Based on its investigation, Rolls-Royce concluded the following:

It is likely that a combination of factors have led to Scoot bearings being particularly susceptible to significant low life wear, but analysis of data to date has not identified any significant differences between worn and unworn bearings, both within the Scoot fleet and the wider Trent 1000 Pack B & C fleets.

It was further noted that the majority of Scoot events occurred between late 2018 and early 2019. With the exception of the occurrence flight, none resulted in an in-flight shutdown.

The Rolls-Royce investigation also considered factors in addition to those listed above but, due to the number of variables, was unable to identify which might have been dominant with respect to the pump bearing wear. However, it identified and implemented interim measures (mainly related to engine data monitoring) to address the risk from low life wear of bearings.

Safety analysis

While on descent into Perth, the right engine of 9V-OJE shut down. After completing the necessary checklists, the flight crew landed the aircraft safely on one engine. There were no injuries sustained as a result.

The engine manufacturer, Rolls-Royce, concluded that the engine shutdown was the result of a blocked inlet filter on the fuel metering valve (FMV) servo assembly. This blockage restricted the electronic engine controller’s (EEC) ability to adjust fuel pressures within the servo. As a result, the EEC had limited control over the FMV position, and consequently the amount of fuel flowing to the burners. When the EEC commanded the FMV to increase fuel flow from sub‑idle to idle levels, it did not respond in time, and the engine shut down. The blockage was due to debris from worn journal bearings in the secondary HP fuel pump driven gear.

Rolls-Royce’s examination of flight data and maintenance records from its Trent 1000 engines identified that Scoot’s fleet of 787 aircraft had been particularly susceptible to low life wear in their secondary HP pump journal bearings over a period of several months. The Rolls-Royce investigation identified various potential factors that might have contributed to low life journal wear, including the fleet’s operation, maintenance, fuel quality, or pump design and construction. However, it found no evidence that any factors were significantly different to the wider Trent 1000 fleet. Additionally, due to the number of variables associated with operations, maintenance, design and manufacture, it was not possible to determine the relative effect of these factors (and possibly others) when combined.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the uncommanded engine shutdown involving Boeing 787-9, 9V-OJE, on 11 October 2018 near Perth Airport.

Contributing factors

• Following a series of status and alert messages related to the aircraft’s right engine, the engine shut down during descent. The flight crew followed the appropriate procedures and landed the aircraft safely using the operational engine.
• The engine shutdown was the result of insufficient fuel delivery due to low pressure in the fuel metering valve servo assembly, as debris from worn fuel pump bearings had blocked its inlet filter.
• The engine manufacturer, Rolls-Royce, identified that between late 2018 and early 2019 the operator’s fleet of 787 aircraft were particularly susceptible to low life wear in the journal bearings of the secondary high‑pressure fuel pump.

Other finding

• Rolls‑Royce identified a number of potential factors that led to the component wear but, due to the number of variables, a single/dominant reason could not be established.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety action by Rolls-Royce

As part of its investigation into the engine failure, Rolls-Royce instructed Scoot to remove the engine’s fuel pump in the event of debris being found in the ports during removal of a hydro‑mechanical unit. In February 2020, the Fault Isolation Manual was updated to instruct all operators to remove the fuel pump and hydro-mechanical unit in the event of a maintenance message regarding the fuel metering valve not being in the commanded position.

Rolls-Royce is investigating the possibility of detecting potential fuel pump bearing journal wear by using flight data (particularly the fuel metering valve torque motor current) to detect partial filter blockage before maintenance messages are generated. It is also continuing to monitor maintenance messages and the condition of unserviceable fuel pumps ‘to ensure that the risk of an in-flight shutdown caused by fuel pump bearing wear is maintained at an acceptable rate’.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the aircraft captain
• Scoot Tigerair
• Rolls-Royce.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the aircraft captain
• the aircraft first officer
• Scoot Tigerair
• Rolls-Royce
• The Boeing Company
• the Civil Aviation Safety Authority
• the Transport Safety Investigation Bureau of Singapore
• the United States National Transportation Safety Board
• the Air Accidents Investigation Branch (United Kingdom).

Submissions were received from:

• Rolls-Royce
• the United States National Transportation Safety Board
• the Air Accidents Investigation Branch (United Kingdom).

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
3. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
4. NITS – Acronym encompassing the nature of the emergency, the intentions of the flight crew, the time available before landing, and the need for a special instructions brief.