Engine failure involving Fokker 100, VH-FWI, 41 km south-east of Geraldton Airport, Western Australia, on 9 July 2019

Precursor events

On the early afternoon of 9 July 2019, a Fokker F28 Mark 0100 (F100) aircraft, registered VH‑FWI, was being operated by Virgin Australia Regional Airlines (VARA) as regular public transport flight VA1788 from Geraldton to Perth, Western Australia (WA). A captain, first officer, two cabin crew and 24 passengers were on board. The crew were based in Perth (see the section titled General details).

Prior to departing on the previous sector (Perth to Geraldton) the operating crew transferred from another aircraft to VH-FWI. Pre-flight preparations, including a review of the aircraft’s maintenance documentation, highlighted the right engine (engine 2) autothrottle system (ATS)^[1] was unserviceable. To facilitate dispatch, the minimum equipment list (MEL)^[2] maintenance procedures had been applied. This included disabling the associated ATS switch, the application of a ‘caution’ placard for the crew’s awareness beside the ATS control button on the flight mode panel, and activation of a mechanical clutch-tie^[3] between the two thrust levers (see section titled Thrust control).

For the return flight to Perth (incident sector), the crew’s fourth and final leg of their flight duty for that day, the captain was pilot flying (PF), and the first officer was pilot monitoring (PM).^[4]

Take-off and initial climb

In accordance with standard procedure for this sector, primarily to avoid active military airspace, the crew had planned the cruise phase at flight level (FL)^[5] 330, via waypoint IRWIN then airway Z41 to waypoint HINDS (Figure 1).

After a short time at the terminal in Geraldton, the aircraft taxied for departure and at about 1246 hours Western Standard Time,^[6] VA1788 commenced take-off for Perth. The PF elected to climb using the autopilot level change (LVLCH) and the autothrottle climb (CLB) modes (see the section titled Thrust control). During the departure the crew noted a ‘slight deterioration’ in the actual weather compared to the forecast, with a scattered cloud^[7] base at the minimum sector altitude (MSA)^[8] of 2,300 ft.

At about 1250 the aircraft was identified by the Melbourne centre controller who provided a revised clearance to Perth via waypoint CALIG. The amended route was slightly shorter yet still remained clear of military restricted areas immediately west of the aircraft’s revised track (see the section titled Airspace information and considerations).

Figure 1: Actual verses direct route to destination (Perth) following the engine failure

Source: Google Earth (including ATSB annotations)

Right engine rollback and left engine failure

At 1251:10 the left engine (engine 1) thrust started gradually increasing beyond what was commanded by the flight augmentation computer and the ATS, which was not noticed by the flight crew (see the section titled Recorded engine data and appendices A and B). The PF reported that, at about this time, while still climbing and just prior to entering the transition layer,^[] both thrust levers began to move abnormally without crew input. Due to minor ‘play’ characteristic of the clutch-tie mechanism the PF observed a minor split between the two thrust levers during this movement.^[10] The PF reported that throughout this time, there was no indication of engine vibrations and that the engine 2 indications displayed on the multi-function display unit (MFDU)^[11] all remained ‘in the green’ (normal). However, during interview the PF could not recall what any of the actual engine indications were (Figure 2).

Figure 2: Fokker F100 VH-FWI – MFDU and standby engine indications to flight crew.

Source: Jetphotos.net – Paul Hill (with ATSB annotations)

The PF also reported at about this time the aircraft’s nose started to drop slightly, accompanied by a ‘very minor yaw’ to the right. The PM reported being preoccupied with support duties and not detecting either the abnormal thrust lever movement or the engine status.

About 45 seconds after the initial engine 1 thrust increase, and sometime after the PF detected the abnormal thrust lever movement, the engine 1 fuel flow regulator (FFR) ceased to effectively meter fuel (see the section titled Thrust control). This caused the engine 1 rotation to decay and thrust to reduce. As designed, the combined action of the flight augmentation computer and the ATS compensated by increasing engine 2 thrust. This was accompanied by the return of both thrust levers towards about the maximum continuous thrust (MCT)^[12] position. About 30 seconds later, due to lack of fuel, engine 1 flamed out.^[13] The crew received a ‘triple chime’ and a master warning alert,^[14] immediately followed by an ENG 1 FAIL message on the MFDU.

Due to the pre-existing engine 2 autothrottle system unserviceability, the engine failure resulted in immediate reversion to manual thrust control. Consequently, the PF manually realigned the thrust levers towards the ‘upright’ (normal climb) position on the thrust lever quadrant. The PF elected to maintain the incidental two-engine cruise climb speed of 250 knots, which was above the recommended single‑engine climb speed or ‘green dot’ speed (see the section titled Single engine procedures).

At the time of engine failure, VA1788 was about 41 km south‑east of Geraldton (the nearest suitable airport).^[15] The PF verbalised ‘flying the aircraft’ which was the initial step of the operator’s ‘failure management model’ (see the section titled Decision making‑VARA failure management model). The PF then re-confirmed the active autopilot modes via the flight mode annunciators displayed on the primary flight display (PFD).^[16]

At about this time the crew perceived the aircraft was ‘struggling to climb’. Consequently, the PF elected to arrest the climb at FL 150. The crew then discussed and agreed on an ‘immediate plan’, including continuing on their cleared track towards Perth.

The PM reported that in accordance with the operator’s procedures, failure of the left engine was identified based on the ENG 1 FAIL alert on the MFDU and illumination of the engine 1 fuel control lever. The PF then confirmed the PM diagnosis by crosschecking key engine parameters with the corresponding standby engine instrument (SEI)^[17]

The PF then instructed the PM to initiate the next step in the operator’s failure management model (‘take action’) by initiating the ENG 1 FAIL non-normal checklist (single-engine procedure) displayed on the MFDU. The procedure included attempting an engine 1 restart. Initially the PF thought the engine had restarted, however after discussion with the PM it was agreed the relight had been unsuccessful. As there were several indications of continued engine rotation, the crew assessed the engine was not mechanically damaged and therefore, in accordance with the QRH, did not activate the engine 1 fire suppression system.

Continuation to Perth

By 1254 the crew had secured engine 1. The PM reported the flight management system (FMS) calculated engine-out maximum (ENG OUT MAX) altitude displayed at the time was FL 205 (see the section titled Single engine procedures). At about the same time the crew discussed and agreed to not ‘strain the good engine’. This resulted in a collective decision to descend back to FL 140, 6,500 ft below the recommended ENG OUT MAX altitude.

At 1255:10, approximately 3 minutes after the engine failure and following completion of the MFDU checklist, the PM made a PAN-PAN call^[18] to air traffic control (ATC) and advising of the aircraft’s revised altitude. The Melbourne centre controller acknowledged the call.

Following the required adjustment of the traffic collision avoidance system (TCAS) functionality (see the section titled Traffic collision avoidance system), the crew discussed the availability and the aircraft’s glide capability with reference to the various airfields (Jurien Bay, RAAF Pearce and Gingin) to the west of their planned route, should the remaining engine fail (Figure 1 and Figure 3, see the section titled Airport information).

Figure 3: Plan view – Restricted areas R155 and R156 north of Perth

Source: CASA - Airspace Review within 50 NM of Perth Airport, March 2017, page 25 (ATSB annotations)

The crew reported that en route, the cloud was scattered above and below their selected cruise level (FL 140). The PM reported being ‘comfortable’ with the PF’s assessment of glide performance, because the emergency aerodromes discussed were all visible from the aircraft.

At 1303, about 11 minutes after the engine failure, the crew communicated to ATC further details of the situation and their decision to continue to Perth. On receipt of this information, ATC offered a more direct track to Perth through RAAF Pearce airspace. The crew discussed and then declined the track shortening. They later explained that their reasoning was based primarily on workload reduction; specifically, having more time to complete the company’s required procedural steps before conducting a single‑engine approach into Perth.

At this point, the captain transferred aircraft control (PF duties) to the first officer. The captain then briefed the two cabin crew members and made a short announcement to the passengers. The flight crew then completed their outstanding non-normal management items, including reconfirming their initial decision to maintain their cleared track and continue to Perth. The PF reported that the crew were prepared for an approach by about 130 km north‑west of Perth.

From CALIG, the aircraft tracked via a standard terminal arrival route. The crew conducted an approach via the runway 21 instrument landing system (ILS), using single‑engine procedures. Due to the disabled autothrottle system the crew used the autopilot during the descent to about 500 ft. The crew reported that during their approach to Perth the cloud base in the vicinity of the airport was about 3,000 ft, slightly more favourable than during their departure from Geraldton. The aircraft landed at about 1335:10 and was accompanied by airport emergency vehicles from the touchdown point to the domestic terminal.

Post incident maintenance action

Once the passengers deplaned the operator’s maintenance engineering team attempted to restart engine 1. An engine re-light occurred, however the engine would not accelerate beyond ground idle. Troubleshooting resulted in removal of the engine 1 FFR unit ‑ also known as a combined acceleration and speed control (CASC).

The unit was subsequently examined by Rolls-Royce, who found that the internal gear within the drive end assembly was significantly worn (see the section titled Fuel flow regulator and Figure 5). The FFR was replaced, however this unit was also found to be faulty. Another FFR was then fitted and the aircraft was successfully returned to service.

_________

1. Autothrottle system: uses a fuel flow regulating unit (FFR) to meter fuel to the engines to maintain target thrust settings for specific phases of flight. The system is intended to reduce pilot workload and improve fuel efficiency.
2. Minimum equipment list (MEL): an equipment (system) list which provides for the operation of aircraft, subject to specified conditions, with particular equipment inoperative (Source: VARA F100 MEL 22-10-00 – Auto-flight).
3. Clutch-tie: a mechanism joining the two thrust levers below the centre aisle stand in the event of an unserviceable ATS.
4. Pilot flying (PF) and pilot monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances, such as planning for upcoming stages of the flight. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
5. Flight level (FL): at altitudes above 10,000 ft. in Australia, an aircraft’s height above mean sea level is referred to as a flight level. FL 330 equates to 33,000 ft.
6. Western standard time (WST): Coordinated universal time (UTC) + 8 hours.
7. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover. ‘Sky clear’ (SKC) indicates no cloud, ‘few’ indicates that 1-2 oktas (or eighths) is covered, ‘scattered’ indicates 3-4 oktas is covered, ‘broken’ indicates 5-7 oktas is covered, and ‘overcast’ indicates that 8 oktas is covered
8. Minimum sector altitude (MSA): the lowest altitude which may be utilised that will ensure a minimum clearance of 1,000 ft above all objects located in the area contained within the sector of a circle (10 or 25 NM radius), centred on the aerodrome reference point, or more usually the location of the primary radio navigation aid.
9. Transition layer: in Australia, the altimetry system makes use of a region of airspace between the transition altitude (10,000 ft. AMSL) and transition level (depending on local/area QNH, FL 115 to FL 130).
10. This split or lag was due to minor ‘play’ characteristic of the clutch-tie mechanism.
11. Multi-function display unit (MFDU): presents information drawn from a variety of aircraft information systems.
12. Maximum continuous thrust (MCT): the maximum thrust an engine can produce over an extended period. Maximum take-off thrust is a higher thrust setting, usually time limited to 5 minutes (two engines) or 10 minutes (following an engine failure) depending on aircraft/engine type.
13. Flameout: a condition where the combustion process within the burner (gas turbine ‘hot section’) ceases. A flameout will be accompanied by a drop in exhaust gas temperature (EGT), engine core speeds (i.e. N₁ and N₂) and engine pressure ratio (EPR). (Source: Fokker F100 Aircraft Operating Manual – Engine Failure, page 81)
14. Master warning alert: used to draw the attention of the crew to a critical situation with the aircraft systems, flight profile and/or the configuration.
15. Suitable airport: means an aerodrome approved for normal operations and which is forecast not to require an alternate during the period nominated for possible use. Operational requirements for suitable aerodromes are as promulgated by CASA. That is, an adequate airport approved for normal operations where, for the anticipated time of use, weather reports, or forecasts indicate that the weather conditions are at or above the required operating alternate minima and the runway surface condition reports indicate a safe landing will be possible.
16. Primary flight display (PFD): a modern aircraft instrument that combines critical flight information into one compact display including (but not limited to); an altimeter, airspeed, attitude, turn, heading and vertical speed indicators.
17. Standby engine indications (key engine parameters): for the F100 include the engine compressor speed (N₁), engine turbine speed (N₂), exhaust gas temperature (EGT) and engine pressure ratio (EPR).
18. PAN-PAN: an internationally recognised radio call announcing an ‘urgency’ condition that concerns the safety of an aircraft or its occupants, but where the flight crew does not require ‘immediate’ assistance.

Operator information

Virgin Australia Regional Airlines (VARA) is based in Perth, Western Australia (WA) and operated under an air operator’s certificate issued by the Civil Aviation Safety Authority (CASA). The airline operates high-capacity regular public transport and charter flights throughout WA and to a number of major cities including Adelaide, Darwin, Melbourne and Alice Springs. VARA operate a fleet of six Airbus A320 and 14 Fokker F100 aircraft.

Flight crew information

The captain held an air transport pilot (aeroplane) licence (ATPL-A), a multi-engine command instrument rating and a class 1 aviation medical certificate. The captain had about 8,100 hours flying experience, of which over 2,300 hours were accrued on the F100, and had been operating as an F50/F100 pilot, based in Perth, for over 11 years.

The first officer (FO) held an ATPL-A, a multi-engine command instrument rating and a class 1 aviation medical certificate. The FO had about 5,700 hours flying experience, of which about 730 hours were accrued on the F100. The FO had completed the F100 type qualification facilitated by the operator in September 2017.

Both flight crew signed on for duty at Perth airport at 0530, and then operated a flight from Perth to Kalgoorlie, and return to Perth. They then transferred to VH-FWI and operated the third sector of their duty day from Perth to Geraldton. Their return flight to Perth (incident sector) was their fourth and final sector for the day.

Both flight crew reported that they had achieved a reasonable amount and quality of sleep the night before and did not feel tired or fatigued at the time of the occurrence. The captain conducted two flights the previous day and had completed office‑based work in the four days prior to that. The FO had been on standby duty the day prior and had operated two flights the day prior to that. The FO did not report any problems with sleep prior to those duties.

Aircraft and engine information

General

Production of the F100 ceased in early 1997. The Australian F100 fleet is the largest in the world comprising about 66 aircraft operated by four high capacity or charter operators. The majority of the national fleet service the fly-in fly-out mining and resource industry.

Powerplant

The F100 is powered by two Rolls-Royce RB 183 Tay Mark 650-15 (Tay 650) engines mounted on the aft fuselage. Each engine is an axial flow, two shaft medium by-pass turbo-fan design rated at 15,100 pounds of thrust (Figure 4).

Figure 4: Rolls-Royce Tay 650-15 cutaway drawing

Source: Rolls-Royce

Thrust control

F100 thrust is controlled by thrust levers mounted in the cockpit centre aisle stand, which (through cables) move fuel control mechanisms via an engine-specific FFR unit mounted within each engine nacelle. The management of forward thrust can be augmented by the autothrottle system (ATS), which automatically moves the thrust levers, based on commands from one of two channels within the automatic flight control and augmentation system (AFCAS).^[19] Each ATS channel drives the corresponding thrust lever. The ATS can be used as long as one channel is operative. During normal operations in the autopilot level change (LVLCH) mode, the AFCAS, via the ATS, controls the fuel flow rate to maintain climb (CLB) engine pressure ratio (EPR).^[20]> There are two motor-and-clutch systems installed in the aisle stand below the thrust levers. A selectable clutch-tie joins the two and if one ATS channel fails the clutch tie will permit the remaining channel to drive both levers.

Existing thrust control defects

Multiple VARA flight crew had reported various autothrottle faults on VH-FWI in the days leading up to the incident (Table 1). The MEL allowed for the unserviceability of one autothrottle channel as a category C (Cat C)^[21] maintenance item, which allowed continued operation for 10 calendar days before repair or replacement was required.

Table 1: Relevant maintenance history of VH-FWI Autothrottle System (5-9 July 2019)

Date	Maintenance Log Entry	Maintenance Action
5 Jul 2019	Autothrottle System (ATS) 2 – Fault in Cruise, disarmed via MFDU procedure	Pilot reported on arrival Adelaide. MEL 22-10-03 applied, Category (Cat) C system expired 15 Jul 19.
5 Jul 2019	ATS 2 – Fault in Cruise, disarmed via MFDU procedure	Pilot reported on arrival Perth. AFCAS interrogated. ATS switch fault. MEL 22-10-03 removed.
8 Jul 2019	ATS 2 – Fault in Cruise, disarmed via MFDU procedure. Reset not successful.	Pilot reported on arrival Broome. MEL 22-10-03 reapplied, Cat C system expired 18 Jul 19.
8 Jul 2019	ATS 2 - Fault in Cruise, disarmed via MFDU procedure. Reset not successful.	Pilot reported on arrival Perth. MEL 22-10-03 reapplied, Cat C system expired 18 Jul 19.
9 Jul 2019	Aircraft released for Perth-Geraldton return with ATS 2 unserviceable and MEL 22-10-03 applied.

Source: ATSB in consultation with VARA Engineering and airworthiness department

Manual thrust reversion

Modern aircraft are designed to be capable of safe operations, despite malfunctions, through designed redundancy. The ongoing single channel autothrottle unserviceability would normally have permitted continued automatic thrust control, however, when combined with an engine failure on the opposite engine, the aircraft systems reverted to manual thrust control. The captain reported that during his last cyclic assessment in the simulator he had been required to demonstrate an ILS approach using manual thrust.

Single engine procedures

The Fokker F100 aircraft operating manual (AOM)^[22] provided the following guidance regarding the conduct of single‑engine operations:

After confirming the engine out condition, the PROG [FMS CDU^[23] ‘progress page’] may be used to identify the MAX ENG OUT altitude. Maximum altitude [engine out] is that altitude maintained with one engine operating at maximum continuous thrust and the other wind milling.

The MAX ENG OUT altitude enables the highest terrain clearance possible and the maximum glide capability in the event of a second engine failure. Immediately following the engine failure, using the aircraft’s weight and environmental conditions, the FMC calculated the MAX ENG OUT altitude to be FL 205 (20,500 ft).

The manual also noted:

For all single engine accelerations, climbs and drift down descents, operation is accomplished at maximum continuous thrust and V_FTO speeds [green dot].

The calculated maximum flight level is restricted by a 1.2G (1.2 x gravity) buffet margin (from stall) and the capability of climbing with a 300 ft per minute rate of climb. The maximum flight level is therefore slightly higher than the ENG OUT MAX altitude as displayed on the FMC progress (PROG) page. The AOM defined green dot speed as the final take-off climb speed (V_FTO). It is displayed as a green ‘O’ at the PFD speed scale. Green dot speed is used for various computations and limits, including drift-down and maximum angle climb.

Given the aircraft weight, altitude and environmental conditions at the time, the green dot speed (V_FTO) was in the range of 155­­–170 knots.

Glide performance

One of the design improvements over the original Fokker F.28 Mark 100, in creating the more efficient F100, was a more aerodynamic wing. This resulted in an increase to the aircraft specific lift/drag ratio to 16.8:1^[24] that, in nil wind, translates to a glide distance of about 16.8 NM (31 km) for every 1 NM (1.85 km), or 6,076 ft of altitude.

The FMC-calculated, single-engine optimum altitude of FL 205, equated to a glide distance (nil wind) of about 57 NM (106 km). However, at the altitude the crew adopted (FL 140), the glide distance (nil wind) reduced to about 39 NM (72 km).

Figure 1 illustrates the glide ranges from FL 140 and FL 205 respectively. At the time of the engine failure, the forecast wind at FL 140 was south‑westerly at 15–20 knots. This would have reduced the glide range if/when the aircraft was turned west towards any of the available alternate airports.

Recorded data

Analysis of flight data recorder (FDR) information showed that early in the climb phase the engine 1 FFR began to malfunction. Initially this led to over-regulation of fuel to engine 1, resulting in increased EPR. To maintain constant EPR, ATS 1 retarded the engine 1 thrust lever. As a consequence of the clutch tied thrust levers, the engine 2 thrust lever also rolled back from MCT towards flight idle.^[25]

Coincident to engine 2 thrust approaching flight idle, the engine 1 FFR ceased delivering adequate fuel to engine 1, leading to a reduction in thrust and eventual flameout (engine failure). As designed, during the initial drop in engine 1 thrust, engine 2 resumed delivering the thrust commanded by the crew via the AFCAS (see Appendix A and B). Due to the pre-existing fault with ATS 2, when the aircraft systems detected failure of engine 1 control of engine 2 thrust reverted to manual control. FDR data indicated that the time from when the engine 1 FFR began to significantly over-regulate fuel, to the engine failure was approximately 45 seconds.

Following arrival in Perth, the aircraft remained powered to facilitate maintenance action including an engine ground run. Consequently, the cockpit voice recorder data was overwritten and not available for this investigation.^[26]

Fuel flow regulator

A fuel flow regulator (FFR) is a device that controls the flow rate of fuel supplied to the injectors within the combustion chamber of an engine. In effect, an FFR is used to regulate the thrust produced by a gas turbine engine. The FFR (Part No: CASC509, S/N L1660) had been overhauled in March 2011 by Goodrich Control Systems, including the renewal of all seals, testing and recalibration. On 20 August 2013 it was fitted to engine S/N 17268 with 2,349.9 total hours/1,406 cycles. At that time, this engine was fitted to another VARA aircraft, VH‑FSQ.

On 18 June 2019 engine S/N 17268 (incident engine) was removed from VH-FSQ and fitted to VH-FWI. At the time of the engine failure (9 July 2019), key aspects regarding the FFR service history (time/cycles) included the following time since:

• component maintenance overhaul (FFR S/N L1660) - 14,334.1 hours/7,607 cycles
• installation to incident engine (engine S/N 17268) - 11,984.2 hours/6,201 cycles
• installation on incident aircraft (VH-FWI) - 77.4 hours/47 cycles.

Following the engine failure, the FFR (S/N L1660) was removed and sent to an approved overhaul facility (Rolls‑Royce) for detailed examination. Their report found that the internal planetary and sun gears within the FFR had worn, which would have contributed to the loss of drive, leading to the in-flight shutdown event (Figure 5).

Figure 5: Internal damage to drive, planetary and transfer gear within the FFR

Source: Rolls-Royce

The CASA‑approved system of maintenance^[27] for the Tay 650-15 engine and its accessories at the time of the occurrence was derived from the Rolls-Royce engine management plan (EMP). The EMP allowed two options to establish FFR service life (time since overhaul, TSO). The first option required management in accordance with the FFR component management program (CMP)^[28] that permitted a maximum service life of 16,000 hours (full life). The alternative option required a mid-life overhaul between 8,000–12,000 hours (mid-life). At the time of the incident VARA was operating under the first option. In addition, the CMP permitted the FFR to be maintained independently of the engine.

Between about August 2010 and August 2015, Rolls-Royce identified a number of in‑flight engine shutdowns and operational disruptions due to failure of internal components of the CASC509 FFR. Therefore, on 21 August 2015 Rolls-Royce issued a Notice to Operators which stated that the failures were due to the FFR being operated beyond the recommended in-service life.^[29] The notice recommended that operators manage Tay engine accessories in accordance with intervals published in the Tay 650 generic EMP.

Appendix D highlights the reported CASC509 FFD failures within the Australian F100 fleet between 2011–2019, noting that the most recent three failures (including the subject occurrence) had accrued over 12,000 hours in service.^[30]

Route knowledge

Regular public transport pilots often operate the same routes between familiar airports. Civil Aviation Regulation 218 – Route qualifications of pilot in command of a regular public transport flight requires they develop and maintain knowledge and understanding regarding important route characteristics including:

• surrounding terrain (lowest safe altitudes)
• adjacent airport information (runway orientation, lighting, local conditions)
• nearby airspace information (location of non-controlled and controlled areas)
• seasonal weather phenomena unique to the route
• typical traffic (other aircraft operations) along the route and at each airport.

Additionally, the operator’s Flight Operations Policy and Procedures Manual indicated that:

Flight crew must maintain an appropriate knowledge of airports located on or next to air routes that may be used in an emergency…

Route knowledge assists decision making in both normal and non-normal situations, particularly during the management of events such as engine malfunctions or failures.

Airport information

Geraldton Airport

Geraldton Airport is located about 11 km east of Geraldton. It is a non-controlled, common traffic advisory (CTAF)^[31] airport and a base for a number of charter and general aviation operators. The facility has a number of runways, though the F100 could only use runway 03/21, with a length of 2,400 m (7,874 ft) and width of 45 m. VARA designated Geraldton as an approved (main) airport ^[32] (regular destination). However, Geraldton was not equipped with aviation rescue and firefighting (ARFF) services (see appendix E).

Perth Airport

Perth Airport is a major international facility, a main airport and the home base for VARA, which provided maintenance capabilities. The facility is serviced by two runways and three separate instrument landing systems (ILS). All runways could be used by the F100. Flying operations are supported by continuous (24 hour) category 9 ARFF services.

Perth primary radar has range of 50 NM (93 km). The secondary surveillance radar has range of about 250 NM (463 km). The Australian automatic dependent surveillance – broadcast system (ADS-B)^[33] provides radar-like coverage above 5,000 ft throughout most of Western Australia.

Emergency airports

The operator‑approved emergency airports between Geraldton and Perth were RAAF Bases Pearce and Gingin (Figure 1 and Figure 3). This permitted them to be utilised when an ‘immediate risk’ to the aircraft and occupants exists. That is, for time-critical emergencies only, such as an aircraft fire and/or a dual engine failure. RAAF base Pearce is serviced by two runways that are F100 capable.^[34] By day, RAAF Pearce was equipped with category 5 ARFF services and Gingin was equipped with category 4 ARFF services.

Jurien Bay Airport

Jurien Bay Airport is located about 100 NM (185 km) south of Geraldton Airport. The airport is primarily used for sky-diving and general aviation (recreational) flying. The main runway (02/20) is 1,300 m long and 18 m wide. The secondary runway is significantly shorter. The main runway did not satisfy the operator’s guidance to crew regarding the ‘physical characteristics’ of emergency airports (runway length > 1,500 m and runway width > 30m).

Airspace information and considerations

In accordance with Annex 11 to the Convention on International Civil Aviation, Australian airspace is classified as either class A, C, D, E or G (Figure 6). The classification determines the category of flights permitted and the level of air traffic services provided.

Class G airspace is not controlled and the primary defences against aircraft collisions are radio‑alerted procedural separation for instrument flight rules (IFR)^[35] flights and/or see-and-avoid procedures for visual flight rules (VFR)^[36] aircraft.

In class E airspace, IFR are separated from other IFR flights and ‘receive traffic information on VFR flights as far as is practicable’. As with class G airspace, VFR flights separate using the ‘see and avoid’ principle. While class E provides additional defences for IFR aircraft over class G, it does not provide the same level of protection as classes A, C or D.

By direct track, the airspace within about 110 NM (204 km) of Geraldton is class G, from the surface to FL 180. Between FL 180 and FL 245 the airspace is class E. Airspace in this region above FL 245 is class A. From about 110 NM to 135 NM from Geraldton class E airspace is established from 8,500 ft to FL 180.

Analysis of the flight path (indirect track combined with adopted single engine cruise at FL 140 showed that, following the engine failure, the aircraft remained outside controlled airspace (class G) for about 95 NM (176 km). At the aircraft’s adopted speed (250 knots), this distance equated to about 23 minutes flight time outside of controlled airspace. The aircraft then entered class E airspace at about 35 NM north-west of CALIG and class C airspace (Perth terminal area) about 6 NM prior to CALIG at FL 140. This equated to about 8 minutes flight time in class E airspace. That is, about 30 minutes in airspace in which risk was increased marginally, versus class A or C airspace. By way of comparison, the flight planned track combined with either; the original cruise FL 330 altitude or the single engine optimum altitude (FL 205) would have resulted in the aircraft being outside controlled airspace for a total of about 8 minutes while departing Geraldton and climbing to that altitude.

Figure 6: Cross section - airspace between Geraldton and Perth (Surface to FL600)

Source: ATSB (derived from Australian aeronautical information package en route low and high charts for WA)

Traffic collision and avoidance system

High‑capacity transport aircraft such as the F100 are required to be equipped with an advanced traffic alert and collision avoidance system (TCAS).^[37] TCAS is designed to prevent mid‑air collisions between aircraft. TCAS operates independently of ATC by using an on-board surveillance capability^[38] to detect other transponder equipped traffic and provides:

• Traffic display including proximate traffic^[39] and traffic advisories (TA)^[40] for situational awareness of relatively close aircraft.
• Resolution advisories (RA)^[41] for very close aircraft with vertical guidance to resolve the threat.

Both TA and RA alerts are generated according to the projected closest point of approach (CPA) or miss distance and the time to co-altitude (TAU). In general, the thresholds (time and distance) for CPA and TAU increase as altitude increases.^[42]

In the event of an engine failure, flight crew are procedurally required to degrade the functionality of the TCAS to prevent generation of a climb RA that cannot be achieved due to the associated reduction in aircraft’s climb ability due to the OEI condition.

Regulatory information

Conditions for flight continuation

Civil Aviation Order (CAO) 20.6 Continuation of flight with 1 or more engines inoperative defined important conditions on the pilot-in-command (PIC) of all Australian registered multi-engine aircraft, where an engine has failed, or its rotation has stopped. This included the requirement to notify ATC immediately^[43], giving all relevant information and stating intended action in regard to conduct of the flight. It also identified relevant factors that the PIC ‘must’ practically consider prior to a decision to continue beyond the nearest suitable airport, including:

• the nature of the malfunction and the possible mechanical difficulties which maybe encountered if flight is continued
• the nature and extent of any city, town or populous area over which the aircraft is likely to fly
• availability of the inoperative engine to be used
• weather conditions en route and at possible landing airports
• air traffic congestion
• the type of terrain (overflight), including whether the flight is likely to be over water
• the distance to be flown coupled with the performance availability should another (remaining) engine fail
• relative characteristics of the aerodromes available for landing
• aircraft altitude, weight and useable fuel at the time of the failure or shutdown
• familiarity of the pilot with the aerodrome to be used.

Multi-engine flight review requirements

Part 61 of the Civil Aviation Safety Regulations requires high‑capacity aeroplane pilots to complete annual proficiency checks and, if the aircraft is multi‑engine, the pilot must also hold a multi-engine aeroplane instrument endorsement. Further, such pilots are usually required to complete an instrument proficiency check (IPC)^[44] in either an aircraft or simulator of the same category, within the preceding 90 days. The IPC also includes a check of medical certification, licence documentation and a knowledge assessment.

The associated Part 61 Manual of Standards described the standards for a multi-engine aeroplane type rating renewal, including the following categories:

• conduct flight
• aircraft systems
• navigation
• airspace
• instrument flying
• manage non-normal and emergency conditions
• non-technical skills, and
• management of passengers and cargo.

The category of ‘manage non-normal and emergency conditions’ specified four aspects that must be assessed:

• simulated engine failure in the take-off segment
• partial engine failure
• simulated complete engine failure and execute a simulated asymmetric approach and landing
• other aircraft system malfunctions.

The operator’s flight crew cyclic simulator program for the preceding 24 months (six cyclic exercises) focussed on these aspects and each cyclic session included management of an engine failure in the take-off segment (below 1,500 ft), initial climb, climb and cruise (see appendix F).

Threat and error management

According to Endsley (1996), achieving and maintaining situational awareness is one of the most challenging aspects for flight crew. Civil aviation advisory publication (CAAP) 5.23-1(2): Multi-engine aeroplane operations and training outlined the considerations for flight crew following an en route engine or system failure, which included:

• maintaining situational awareness
• understanding aeroplane specific systems
• applying correct drills and procedures
• declaring the appropriate level of emergency
• positively managing the subsequent flight profile
• utilising contingency plans determined prior to flight.

The CAAP also summarised the manner in which threat and error management should be applied within the operational context, including:

• anticipation of potential threats and errors associated with each flight, that is contingency planning which necessitates planning and execution countermeasures
• comprehensive briefing of planned procedures prior to departure, including anticipated threats
• continuous monitoring and verification of visual and instrument indications to maintain awareness of energy state

Decision making

General

Aeronautical decision making is defined by the Federal Aviation Administration (FAA)^[45] as:

A systematic approach to the mental process used by aircraft pilots to consistently determine the best course of action in response to a given set of circumstances.

Flying a high-technology aircraft requires both skilled psychomotor performance and real-time decision making – reliant on situational awareness, educated choice among alternatives and an accurate assessment of risk within a limited time-frame.^[46]

The operator’s periodic (cyclic) training and assessment program consisted of a rolling four-month testing period. That is, each flight crew member would be assessed within a flight simulator three times per year. Different elements of decision making were examined in each of the cyclic simulator sessions.

Supporting procedures

To assist crew in the decision-making process, the operator utilised a standard mnemonic:

S – State the problem

A – Analyse the options

F – Fix the problem

E – Evaluate the result.

Further, as part of the ongoing ‘evaluation phase’ crew were expected to assess the following items:

Is the current situation still the most appropriate?

How can we improve the current solution?

What other options are now available?

Risk mitigation

Risk management feeds into decision making in two ways: during the assessment of the precipitating (perceived) threats and in accurately evaluating potential courses of action. In general, if there is limited time, the pilot will tend to implement the course of action that experience dictates is most likely to be successful.

In the February 2018 issue of FAA Safety Briefing^[47], the concept of ‘risk mitigation’ (mitigate) was proposed versus ‘administrate’. That is, the FAA now hold that the task of ‘administrate’ after an event should focus on the mitigation of residual risk through the optimisation of the planned (original) path, or the ‘recovery path’ following a non-normal event. An initial urgency call, notifying the controller and other aircraft in the immediate vicinity regarding the nature of a non-normal situation would very likely assist the crew in mitigating subsequent risk.

VARA failure management model

To support sound decision making the operator’s procedures included a generic failure (non‑normal) management framework. This was used by the crew to provide structure to the way they responded to emergency situations and to facilitate safe continuation of flight. The stages of the operator’s failure management model were, in priority sequence:

1. Fly the aircraft
2. Confirm the failure - PM should call the failure and PF confirms
3. Immediate plan – to ensure flight path (PF should state intentions, PM should inform ATS)
4. Take Action – carry out appropriate recall and checklist items
5. Circuit breakers – check the status of relevant CBs in accordance with procedures
6. Normal checklists
7. Long Term Plan – gather information, choose best alternative, periodically re-evaluate.

The procedures also reiterated the requirements of CAO 20.6 including (not limited to):

Following an in-flight engine shutdown, it is a requirement to notify the nearest Air Traffic Services unit immediately, giving all relevant information, stating the action the Pilot-in-Command intends taking in regard to the conduct of the flight.

VARA flight crew training

Evidence based training (EBT) aims to identify, develop and evaluate the competencies required to operate safely, effectively and efficiently in a commercial air transport environment while addressing the most relevant threats according to evidence collected in accidents, incidents, flight operations and training.^[48] EBT takes the concepts of these programs further by structuring recurrent assessment and training according to evidence-based priorities based on a comprehensive analysis of safety and training data from a wide variety of sources.^[49]

The International Air Transport Association (IATA) document; Evidence based training implementation guide, a tripartite document comprised between the IATA, ICAO and the international federation of airline pilots’ associations (IFALPA) recommends that an engine failure during the climb should be assessed every three years.  

The PM had completed a co-pilot F100 type qualification, facilitated by the operator (VARA), in September 2017. The type qualification included a simulator session that specifically assessed the crew’s actions following an engine flameout. The session also included the procedures for an attempted relight progressing to the remaining engine also failing (dual engine flameout). As part of the training, the instructor also facilitated a discussion regarding F100 glide performance (range) and forced landing considerations, specifically those associated with ditching. 

The operator’s EBT framework had not included specific assessment of engine malfunctions or failures during the climb phase of flight for the preceding six assessment cycles^[50] or 24 months. However, both the PF and PM had been exposed to a multitude of non-normal scenarios as part of the EBT based periodic training and assessment program during the preceding few years. All assessments had included an examination of their ability to manage the aircraft following an engine failure after take-off. 

_________________

19. Automatic flight control and augmentation system (AFCAS):  controls the auto-throttle, yaw damper, stabiliser trim and rudder limiter. The F100 AFCAS receives inputs from two flight control computers.
20. Engine pressure ratio (EPR): the ratio of the total gas pressure at the exit of the propelling nozzle divided by the pressure at the entry to the compressor. Jet engines use either EPR or compressor/fan RPM as an indicator of thrust.
21. Source: CAAP 37-1(5) - Minimum Equipment Lists, March 2016.
22. Source: VARA Fokker 100 aircraft operating manual (AOM), Book 2 – Procedures, p 560-568. Book 2 provides information specific to limitations, procedures, checklists flight techniques, performance, flight planning and weight and balance. Book 1 provides crew information specific to the aircraft systems.
23. Flight management system computer display unit (FMS CDU).
24. Babikan, R., The Historical Fuel Efficiency Characteristics of Regional Aircraft from Technological, Operational and Cost Perspectives, SM Thesis, Massachusetts Institute of Technology, June 2001.
25. Flight idle: is set at an engine core speed which enables rapid spool up (acceleration) time to maximum continuous power. Ground idle is set at a lower engine core rpm closer to the engine self-sustaining speed.
26. The short recording cycle of CVRs (either 30 minutes or 2 hours) means that they are relatively quickly overwritten. The CVR data was recorded over as the aircraft was powered (electrically) to facilitate trouble-shooting and subsequent maintenance action following the aircraft’s arrival in Perth.
27. System of maintenance: refers to the consolidated orders, instructions and procedures required to provide for the continuing airworthiness of an aircraft.
28. Source: Rolls Royce component management program (CMP) No.050 - Combined acceleration and speed control (CASC) 509, approved 4 June 2019.
29. Source: Rolls-Royce Notice to Operators (Tay engines) No. 67; Overhaul interval times of accessories for the Tay engine.
30. Source: CASA defect reporting service (DRS) database - Tay 650-15 CASC509 FFR history.
31. Common traffic advisory frequency (CTAF): non-controlled aerodrome with a terminal area of 5 NM (9 km) radius.
32. Approved (main) airport: refers to an airport regularly serviced by an operator with adequate and approved maintenance facilities.
33. Automatic dependent surveillance – broadcast (ADS-B): is a surveillance technology in which aircraft independently verifies its position via satellite navigation and periodically broadcasts it, enabling the aircraft to be tracked.
34. RAAF Pearce runway 18R/36L is not F100 capable due to weight limitations (<5700 kg), the runway width (30 m) and the aircraft classification number (ACN).
35. Instrument flight rules (IFR): rules and regulations established to govern flight under conditions in which flight by outside visual reference is not safe. IFR flight depends upon flying by reference to instruments in the flight deck, and navigation is accomplished by reference to electronic signals, GPS and/or FMS generated position.
36. Visual flight rules (VFR): a set of regulations under which a pilot operates an aircraft in weather conditions clear enough to allow the pilot to remain visual (see along the flight path).
37. Civil Aviation Order (CAO) 20.18 and Regulation 262AA-AJ of the Civil Aviation Regulations 1988 (CAR 1988) stipulates traffic alert and collision avoidance system type II (TCAS II) be fitted to all aircraft exceeding 5,700kg maximum certified take-off weight or having a maximum authorised passenger capacity exceeding 19. TCAS II includes the capability of generating; ‘proximate traffic’ and both ‘traffic advisory’ and ‘resolution advisory’ if necessary.
38. Surveillance capability: provided by primary radar, secondary surveillance radar (SSR) transponders and/or automatic dependent surveillance (ADS) systems.
39. Proximate traffic: any other aircraft with a transponder identified that is known, but outside the TCAS surveillance envelop.
40. Traffic advisory (TA): an alert issued by an airborne collision avoidance system (ACAS) when the detected traffic may result in a conflict. Pilots are expected to initiate a visual search for the traffic causing the TA.
41. Resolution advisory (RA): a manoeuvre, or a manoeuvre restriction, calculated by an airborne collision avoidance system (ACAS) to avoid a collision. Pilots are expected to respond immediately to an RA unless doing so would jeopardize the safe operation of the flight.
42. Source: Eurocontrol ACAS Guide – Airborne Collision Avoidance, December 2017.
43. Immediately: in the context of CAO 20.6, combined with the general concept of ‘aviate, navigate, communicate and mitigate (and/or ‘administrate’), refers to as soon as possible, following the appropriate immediate actions necessary to address the initial emergency condition and formulation of an immediate plan.
44. Instrument proficiency check (IPC): an assessment conducted by CASA (or an ‘approved delegate’) regarding the capability to operate an aircraft without visual references (in cloud and/or during dark night conditions).
45. Federal aviation administration (FAA): the federal agency responsible for aviation regulation in the United States.
46. Wen-Chen Li, The causal effects of aviation accidents related to decision errors in the cockpit by system approach, Journal of Aeronautics, Astronautics and Aviation, Series A, Vol. 43, No. 3, pp 159-166.
47. Aviate-navigate-communicate-administrate (ANCA).
48. CASA Civil Aviation Advisory Publication (CAAP); CAR 217 Flight Crew – Training and checking organisations, October 2014, p 6.
49. International Air Transport Association (IATA); Evidence based training implementation guide, 1^st edition, July 2013, p 38.
50. See Appendix F: Summary of engine related malfunctions – VARA cyclic assessment program (Jul 2016-Aug 2020).

Introduction

The number 1 engine failed (flameout) due to failure of the associated fuel flow regulator (FFR) and resultant lack of fuel supply to the engine. This analysis will explore the circumstances of the component failure.

Additionally, while the flight crew’s management of the occurrence resulted in a safe landing, aspects of their response to the engine failure will also be considered, including the:

• decision to not return to the nearest suitable airport (Geraldton), instead continue to Perth
• execution of the recovery (diversion)
• benefits of flight crew training.

Engine failure

About five minutes after take-off, the engine 1 FFR seized due to internal gearing wear that was associated with the unit’s high time since overhaul (14,334.1 hours). This resulted in failure of the FFR to regulate fuel to engine 1, which then consequently flamed out.

As a result of previous, similar occurrences, Rolls-Royce was aware, and had advised operators of the potential for wear related FFR failure due to extended service life. Despite this, the subject FFR failed while being maintained within the service life limits of the Rolls-Royce engine management programme. Since this occurrence, Rolls-Royce have introduced a 10,000-hour midlife inspection and rework requirement for the FFR maintenance option selected by VARA (see the section titled Safety action). This requirement, which includes replacement of the sun and planet gear assemblies, would likely have prevented the subject failure and should reduce the future frequency of this failure type.

Presentation of the failure

In complex multiengine aircraft, one engine can rollback unnoticed by the flight crew, due to the autopilot and autothrottle masking the thrust asymmetry created. In this case, the PF noticed unusual thrust lever movement (due, in part, to the clutch tie), but did not associate that movement with the uncommanded increase in engine 1 thrust (due malfunctioning FFR). Further, although the PF noticed the movement of thrust lever 2, the progressively significant reduction in thrust (rollback) of engine 2 was not detected. 

It is likely that the deteriorating health of engine 1 went undetected by the crew due to the effect of the automation/clutch tie and the absence of any cockpit alert. Additionally, at the time, the PF reported being focussed on the unusual (slightly decoupled) and uncommanded movement of the thrust levers due to the action of the clutch-tie mechanism. The PM was preoccupied with various support duties including cabin crew coordination, communicating with air traffic control and the completion of transition procedures.

Single engine operation

The operator’s F100 aircraft operations manual, provided clear guidance on the management of an engine failure throughout the varying phases of flight. These procedures were designed to maximise the aircraft’s single‑engine climb performance in order to ensure terrain clearance, allow flight in controlled (higher) airspace, avoid low level weather, and to optimise glide range should the remaining engine fail. In a limited fuel situation, these procedures also served to maximise single‑engine range and/or endurance.

For this event, at the point of engine flameout, fuel remaining, and terrain clearance were not limiting factors. However, by not slowing the aircraft towards the best angle of climb (green dot) speed, and by not increasing engine 2 thrust from CLB towards MCT the aircraft’s single‑engine climb performance was degraded, resulting in the crew’s decision to descend to FL 140. The crew recalled this collective decision was due to concern with ‘straining the good engine’ associated with any attempt to increase altitude, being ‘well above the lower safe altitude, with clear skies’ and ATC coverage. That is, they couldn’t see any advantage to going higher.

That the aircraft was only capable of manual thrust control was significant for the crew, as the autothrottle system provides automatic speed and gust protection, inputs to the angle of attack (alpha)^[1] mode protection, and windshear protection. If required, a missed approach, regardless of landing point (Perth or Geraldton), would need to be carefully executed manually to prevent exceeding any engine limitations. Both flight crew reported that they had practiced a manual thrust approach in the operator’s preceding cyclic (simulator) assessment session, and this assisted their conduct during the single‑engine recovery into Perth.

Post incident - course of action

Decision to continue to Perth

Regardless of experience, flight crew require time to initially identify a non‑normal condition (engine failure) and consider their ‘immediate plan’. Once the aircraft was in the vicinity of waypoint IRWIN (Figure 1), the crew had a number of options:

• return to the point of departure and the nearest suitable airport (Geraldton)
• maintain their incidental altitude (FL 140) and original track continuing to avoid active military airspace, or
• optimise their recovery path to Perth.

The decision to continue, divert or return can be complex and requires crew to have a comprehensive understanding of the characteristics of the route, including the suitability of proximate airports, the forecast and actual weather, airspace factors and their respective aircraft’s systems.

The operator’s procedures in the event of an engine failure or shutdown required the crew to land as soon as practicable^[52] Notionally, the concept of ‘land as soon as practicable’ versus land as soon as possible^[53] is predicated on the crew considering the existence and/or risk of further complications such as a fuel leak, fuel contamination and/or engine fire.

With respect to the relevant factors outlined in CAO 20.6 for continuation of the flight to Perth, the crew reported considering the following:

• although above alternate minima, a deteriorating cloud base on return to Geraldton may have necessitated a non-precision approach, at least for the initial segment
• anticipation of increased workload at Geraldton due to local traffic (two aircraft)
• the aircraft’s thrust control system had reverted to manual thrust only
• Perth runway 21 was ILS capable and significantly longer than the runway 21 in Geraldton
• Perth airport was supported by category 9 ARFF services.

These factors supported their course of action to continue to Perth. However, the ATSB considered that the following factors supported returning to Geraldton Airport following the engine power loss, consistent with the operator’s procedural requirement to ‘land as soon as practicable’:

• it was the nearest suitable airport
• as a regularly used VARA port, the crew were thoroughly familiar with it
• the weather at the time would probably have permitted an approach in visual flight conditions.

While continuation to Perth was a permitted option, it also resulted in longer exposure to one engine inoperative flight risks, compared to a return to the nearby Geraldton Airport.

Additionally, the route selected, combined with the decision to adopt a cruise altitude 6,500 ft below the recommended (FMS generated ENG OUT MAX) single engine altitude, resulted in the aircraft remaining outside of:

• controlled airspace, or in class E airspace until about 167 km (90 NM) north of Perth
• glide range to Perth Airport or an emergency airport for about 222km (120 NM) track miles, or about 30 minutes flight time.

In accordance with the operator’s single engine procedures, the crew also degraded the functionality of the TCAS to prevent the production of unachievable climb advisories (RA) when operating on one engine. This reduced the mechanisms by which the crew could avoid conflicting traffic.

Recovery execution

Technically, the continuation to the planned destination (Perth) was also a ‘recovery’, as the aircraft was operating under a non-normal (single‑engine) condition. The PF reported that the crew’s key priorities for the recovery included maintaining a safe aircraft configuration, availing the crew planning time and managing the increased workload associated with single‑engine and manual thrust operations.

Although the recovery track to Perth remained unaltered, the adopted cruise level (FL 140), below the recommended single engine altitude, limited the aircraft’s potential glide distance by about a third. Continuing the climb closer to, or at the green dot speed with increased engine 2 thrust would have availed the crew more time and glide distance in the exceptionally unlikely^[54] event that remaining engine also failed.

The crew recalled being confident that in the event of the failure of their remaining (right) engine they could have recovered to either RAAF Pearce or Gingin, ATSB analysis found that this would not have been possible for a further 30 minutes after the initial engine failure. Prior to this point, the crew discussed the option of Jurien Bay Airport. While Jurien Bay did not meet the operator’s requirements as an emergency airport for flight continuation decision making, once the decision to continue to Perth had been made, it would have provided a viable option in preference to an off‑field landing in the event of a second engine failure. However, by maintaining their diverging (as cleared) track away from the coastline and around military airspace, the aircraft actually tracked away from Jurien Bay and Gingin (Figure 1) for a period.

Following the application of the operator’s failure management procedures, the crew were required to reassess (evaluate) their understanding of the evolved risk profile of continued flight via the SAFE model. The crew probably assessed that the likelihood of a second engine failure was remote but may not have fully contemplated the operational risks associated with continued single-engine flight at the lower altitude. Consequently, opportunities were missed to further mitigate operational risk via repositioning the aircraft into controlled airspace, more expeditious (direct) tracking to Perth and the optimisation of their glide range. The crew reported their overriding concern was workload management. Naturally, due to the abnormal situation, workload was increased. However, a direct track to Perth Airport or the runway 21 ILS initial approach fix could have further reduced their workload (given visual conditions).

In any event, a prompt landing is a key precaution against the risk associated with failure of the second engine, or further issues arising from the original engine failure, including effects on other aircraft systems. Should it occur, the resulting consequence (a forced landing on an unprepared area or a short runway) could be significant. Therefore, when faced with a one engine inoperative situation, consideration should be given to minimising the remaining flight time through track shortening and maximising the glide range of the aircraft. In this case the recovery path selected did not mitigate risk to as low as reasonably practical (ALARP).^[55]

__________________

52. Land as soon as practicable: extended flight is not recommended, however infers other than an ‘immediate landing’. In accordance with the intent of CAO 20.6, the landing site and duration of the flight are at the discretion of the individual with operational control that is, the pilot-in-command (aircraft captain).
53. Land as soon as possible: infers land without delay at the nearest available or emergency airport. As opposed to ‘land immediately’ which infers imminent danger exists to the aircraft and occupants if the aircraft remains in-flight (e.g. uncontrollable airframe or engine fire).
54. See appendix C – Probability of dual engine failure specific to the Australian F100 fleet.
55. As low as reasonably practicable (ALARP): refers to the principal in which any residual risk (following a change in circumstances) within a safety-critical environment shall be reduced as far as reasonably practicable. The concept involves weighing residual risk against the effort, time and costs required to further mitigate it.

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the engine failure involving the F100 registered VH-FWI and continuation of the flight from about 41 km south of Geraldton. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• About 5 minutes after take-off, while climbing away from Geraldton, the engine 1 fuel flow regulator failed, resulting in fuel starvation to the engine and the total loss of thrust (flameout).
• The fuel flow regulator seized due to internal gearing wear, despite being maintained within the recommended service life limits of the Rolls-Royce Tay 650-15 engine management programme.

Other factors that increased risk

• Following the failure of engine 1 the crew did not adjust the aircraft speed or thrust, electing to maintain the aircraft’s incidental (cruise climb) speed of 250 knots. This degraded the single‑engine climb performance resulting in increasing the time that the aircraft was outside controlled airspace and the glide range of an emergency airport.
• The decision to continue to Perth following the engine failure resulted in a longer exposure to one engine inoperative flight risks, compared to a return to the nearest suitable airport (Geraldton).

Other findings

• Thrust variation from engine 1 (over about 45 seconds) due to the failing fuel flow regulator went undetected by the crew due to the effects of automation/clutch tie, focused attention on other cockpit tasks and the absence of any alert prior to the engine failure.
• Flight crew competency regarding execution of a manual thrust approach had recently been assessed as part of the operator’s F100 cyclic training and assessment program and was found to have assisted during the approach to land.

Sources of information

The sources of information during the investigation included:

• the flight crew
• Air Accidents Investigation Branch, United Kingdom
• Airservices Australia
• Australian Bureau of Meteorology
• Civil Aviation Safety Authority (CASA)
• Fokker Services
• Rolls-Royce (United Kingdom)
• Virgin Australia Regional Airlines (VARA)

References

Airservices Australia - Safety Bulletin – what happens when I declare an emergency? 18 July 2016.

Civil Aviation Safety Authority (CASA), Airspace review within 50 NM of Perth Airport, May 2017.

Civil Aviation Safety Authority (CASA), Safety Defect Report database, May 2020.

Civil Aviation Safety Authority (CASA), Safety behaviours: human factors for pilots, Resource booklet 7 – Decision making, 2^nd Edition, 2019.

Civil Aviation Advisory Publication (CAAP) 37-1(5) Minimum equipment lists (MEL), March 2016.

Civil Aviation Advisory Publication (CAAP) 215-1(3.2) Guide to the preparation of Operations Manuals, March 2020.

Dos Santos Marques, G, Engine condition monitoring as a route to savings, November 2010.

Endsley, M (1996), Automation and situational awareness in R. Parasuraman and M. Mouloua (Eds.) Automation and human performance: Theory and applications (pp 163-181) Mahwah, N.J., Lawrence Erlbaum.

Eurocontrol Publication: Guidelines for controller training in the handling of unusual/emergency situations, 2^nd Edition, 31 July 2003.

Federal Aviation Administration (FAA) Safety Briefing- Back to Basics, 29 Jan 2018.

International Air Transport Association; Evidence-based training implementation guide, 1^st Edition, July 2013 (triparted guidance document: IATA, ICAO and IFALPA).

Innes-Jones, G, & Scandpower L.R, Complacency as a causal factor in accidents – fact or fallacy? 2012.

International Civil Aviation Organisation (ICAO) Doc: 9137-AN/898 Airport Services Manual, Part 1 – Rescue and Firefighting, 4^th Edition, 2015.

Orasanu, Judith & Martin, Lynne. (2008). HESSD ’98 100 Errors in Aviation Decision Making: A Factor in Accidents and Incidents.

Ross, S Prof, Introduction to Probability and Statistics for Engineers and Scientists, 5^th Edition, 14 Aug 2014.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew (captain and first officer)
• the operator’s (VARA):

-    head of flying operations

-    head of airworthiness

-    head of safety

• an accredited representative of the Aviation Accident Investigation Board (AAIB)
• Rolls-Royce
• CASA

The ATSB received submissions from CASA, Rolls-Royce, the operator (VARA) and the aircraft captain. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A - Fuel flow regulator malfunction and engine failure

Failure sequence:

A detailed review of the recorded data (see also Appendix B) identified that:

• The application of the minimum equipment list (MEL) provisions regarding channel 2 of the autothrottle (ATS) had the following effects:

-    the engine 2 thrust lever was mechanically clutch-tied to the engine 1 thrust lever. Therefore, ATS 1 via the engine 1 thrust lever was driving both engine thrust levers. That is, the ATS had no ability to command engine 2 thrust directly.

-    The automatic engine pressure ratio (EPR)^[57] synchronisation capability was unavailable to the crew. Instead the PF was required to synchronise the thrust of the engines manually via manipulation of the associated levers. This explains the minor EPR split from take-off through to about 1248:40 (see parameters at 0448:40 above).

• As the PF was using LVLCH mode in climb (CLB), ATS 2 was commanding climb EPR.
• From about 1248:40 to 1250:00 the EPR appears to have been synchronised by the PF. However, from that point EPR synchronisation ceased. As designed, the engine 2 fuel flow continued to gradually reduce as altitude increased. This is normal as engine performance increases with altitude due to decreasing total air temperature.
• Engine 1 thrust increase - At about 1251:10 (about 5 minutes after take-off) the engine 1 FFR unit began to malfunction and was unable to provide the required reduction in fuel flow as altitude increased. This resulted in a higher engine 1 engine pressure ratio (EPR) and associated increasing EPR split between the two engines from about 1251:10 onwards.
• Engine 2 thrust decrease - Due to the action of the autothrottle system (channel 1) and the clutch-tie mechanism, the engine 2 thrust lever followed the engine 1 thrust lever resulting in gradually reducing engine 2 EPR (thrust). .
• Consequentially, the tie clutched engine 2 thrust lever was dragged back with the engine 1 thrust lever. This presented to the pilot flying (PF) as a gradual roll-back of both thrust levers. The EPR on the MFDU during this time indicated a marginal increase in engine 1 EPR and a reducing engine 2 EPR.
• At 1251:17 engine 2 fuel flow decreased at a higher rate due to increasing thrust from engine 1. At this point the EPR split was 0.03 (engine 1 EPR of 1.62, engine 2 EPR of 1.59). The engine 1 fuel flow continued to increase to produce a maximum EPR of 1.69.
• At about this point, the PF reported observing abnormal thrust lever movement. The PF recalled thrust lever engine 1 retarding while engine 2 thrust lever followed, albeit more slowly. The ATSB was unable to clarify the degree of thrust lever movement throughout the failure sequence as the FDR data did not include parameters associated with thrust lever position.
• This discrepancy between the thrust lever positions (both rolling back together), and the indicated thrust (asymmetric), with absence of any aircraft warning system alerts, is likely to have contributed to the late identification of the failure by the crew during transition (high workload period).
• Engine 2 rollback - At 1252:03, engine 1 parameters reached their maximum values. As designed, the AFCAS continued to reduce engine 2 fuel flow towards flight idle, producing the engine 2 rollback.
• Engine 1 FFR failure - As engine 2 parameters reach their minimum values the engine 1 FFR ceased to effectively meter fuel.
• At 1252:04 engine 1 fuel flow decreased sharply. The split between each engine EPR was 0.45 (engine 1 EPR of 1.69, engine 2 EPR of 1.24). As designed, the AFCAS detected the decay in engine 1 rotation (refer to N₁ and N₂) and commanded a rapid increase in engine 2 thrust to restore the total commanded thrust.
• At 1252:07 engine 2 fuel flow started rising sharply, followed by the engine 2 EPR. Other associated engine 2 parameters increased rapidly. This corresponded to the PF observation that the thrust levers returned to the ‘wedges’.^[58] At this point ATS1 was still engaged and the thrust lever movement was due to ATS1 inputs.
• Engine failure and manual thrust reversion - At 1252:29 engine 1 flamed out and the ENG1 FAIL, and master warning alerts were generated by the aircraft’s warning system. Immediately following this, as designed, the engine 1 ATS disconnected resulting in reversion to manual thrust control.

Appendix B - Recorded flight data: Flight overview

Appendix C - Probability of dual engine failure specific to the Australian F100 fleet

If p is the probability of an engine failing or requiring an inflight shutdown per hour flown, then the following is approximately true:

• 2p is the probability of a failure or inflight shutdown of one engine on a twin‑engine aircraft
• 2p² is the probability that both engines have an engine failure or inflight shutdown on a twin‑engine aircraft

Importantly, this assumes that the failures were not related to each other (mutually exclusive) and that the probability of a second engine failing is not changed after the first engine fails. That is, that thrust is not increased above MCT, which would further ‘strain’ the engine. There are similar relationships for more engines.

For the period 2008 to 2012, the Australian specific F100 fleet reported 11 engine related occurrences, of which 5 occurred during take-off and 4 during the climb phase.

This data highlights a combined engine failure and inflight shutdown (IFSD)^[59] rate of about 3.63 per 10,000 hours^[60] (3.63 x 10^-4).

Therefore, for the period, 2p ≈ 3.63/10,000 and p ≈ 1.82/10,000.

This equates to a probability of both engines failing of 2p² ≈ 2 x (1.82/10,000)² ≈ 6.6/100,000,000 hours (6.6 x 10^-8). Which suggests it is exceptionally unlikely^[61] that both engines fail or have inflight shutdowns (assuming there is no common cause).

Appendix D - Historical data related to FFR CASC509 (Australian F100 fleet)

Date	Defect Number (DR)	Operator	Aircraft Registration:	FFR (CASC509) Serial No:	Effect (Failure Summary)	FFR hours at time of failure
6 Feb 20	Rolls-Royce ‘Service Letter’ revising maximum time between overhaul down from 16,000 10,000 hrs.
9 Jul 19	611953944	VARA	VH-FWI	L1660	Engine Failure / IFSD	14,334.1
8 Nov 18	611852944	Network	VH-NQE	L2261	No throttle response during engine ground run	12,053.0
21 Nov 17	611751124	VARA	VH-FNR	L1578	IFSD	12,448.4
3 Mar 17	611749845	VARA	VH-FNN	L1783	Aborted take-off (low speed)	5,148.0
2 Aug 16	510023701	Network	VH-NHF	Unknown	Engine rollback	Unknown
19 Apr 16	210051600	Alliance	VH-FKF	L1647	High EGT and associated alert	3,787.9
28 Aug 15	510021981	VARA	VH-FNC	L2274	High EGT - aborted take-off	12,374.7
9 Oct 13	510017804	Alliance	VH-XWN	B2429	FFR out of limits	2,595.9 [62]
17 Sep 13	510017687	Alliance	VH-XWR	L1473	High EGT	460.3 [63]
24 Jul 13	510017350	Alliance	VH-FKG	L2271	No thrust response (low power) – FFR adjusted.	N/A
20 Sep 12	510015662	Alliance	VH-XWN	L1599	No engine acceleration	3,249.6 [64]
2 Mar 12	510014420	Alliance	VH-FWH	L1906	No engine acceleration	146.1 [65]
24 Feb 12	510014395	Alliance	VH-FWH	L1906	No engine acceleration – NIL defects identified.	N/A
3 Jan 12	510014111	Alliance	VH-FWH	L1454	No acceleration during take-off	Unknown[66]
13 Dec 11	510014030	Alliance	VH-FKC	L1540	No acceleration during take-off	Unknown[67]
22 Nov 11	510013921	Alliance	VH-FKC	L1540	Engine stagnation	Unknown
6 Jan 11	510015288	Alliance	VH-FWH	L1584	Rejected T/O due Low thrust	Unknown

Source: CASA Safety Defect Report (DRS) database

Appendix E - Australian Aviation Rescue Fire Fighting (ARFF) Categories

The principal objective of an ARFF service is to save lives in the event of an aircraft accident or incident occurring at or in the immediate vicinity of an airport. The ARFF service is provided to create and maintain survivable conditions, to facilitate egress routes for occupants and initiate rescue of those occupants unable to make their own escape without direct aid.

Aerodrome ARFF Category	Minimum number of ARFF vehicles	Aeroplane Length (m)	Maximum fuselage width (m)
1	1	0 < L < 9	< 2
2	1	9 ≤ L < 12	< 2
3	1	12 ≤ L < 18	< 3
4 [68]	1	18 ≤ L < 24	< 4
5	1	24 ≤ L < 28	< 4
6 [69]	2	28 ≤ L < 39	< 5
7	2	39 ≤ L < 49	< 5
8	3	49 ≤ L < 61	< 7
9	3	61 ≤ L < 76	< 7
10	3	76 ≤ L < 90	< 8

Source: ICAO Annex 14, Table 9-1 and 9-2 and ICAO Airport Service Manual, Part 1.

Notes:

1. Category 4 ARFF: a specialised albeit relatively limited emergency response capability specific to aviation operations.
2. Category 9 ARFF: refers to significant capability including large amounts of stored water, foam discharge rate/capability and dry chemical availability. In Australia, Category 9 ARFF is available at Adelaide, Brisbane and Perth airports. (Source: Part 139H CASA Manual of Standards Chapter 2).

Appendix F - Summary of engine malfunctions – VARA cyclic program (Jul 16 - Aug 20)

Cyclic No.	Assessment Period	Simulated environment	Engine failure after take-off (EFATO)	Engine failure IFSD and/or single engine operations (SEO) by phase of flight
				Initial Climb[70]	Climb	Cruise	Relight Attempt	Des &/or App[71]
6	Jul-Dec 2016	Darwin-Alice Springs	AFCAS & ATS ON, Engine Fire	[72]
7	Feb-Jun 2017	Perth-Kalgoorlie	NAV/PROF	Double Engine Flameout [73]
8	Jul-Dec 2017	Adelaide-Alice Springs	night, Captain & First Officer
Note: The PM (First Officer) completed engine failure training during the climb phase as part of an initial aircraft type (F100) qualification (Training simulator session #8) in late September 2017
9	Jan-Apr 2018	Perth TMA[74] & Perth-Kalgoorlie	night V1 cut (Severe damage)
10	May-Aug 2018	Adelaide TMA & Adelaide-Alice Springs	low visibility V1 cut					[75]
11	Sep-Dec 2018	Alice Springs TMA & Alice Springs-Darwin	night V1 cut + crosswind
12	Jan-Apr 2019	Karratha TMA & Karratha-Perth	V1 cut	[76]
13	May-Aug 2019	Melbourne TMA & Melbourne-Kalgoorlie	low visibility V1 cut
Incident date: 9 July 2019 (41 km south of Geraldton, WA)
14	Sep-Dec 2019	Coondewanna TMA & Coondewanna-Broome	V1 cut
15	Jan-Apr 2020	Melbourne TMA & Melbourne-Adelaide	After take-off
16	May-Aug 2020	Adelaide TMA & Adelaide to Mildura	Wet runway V1 cut at 50 ft. AGL

Source: VARA flight operations training – F100 flight crew training cyclic simulator instructor guides

Notes:

This summary does not include all cyclic matrix (assessment) items. Each simulator session is time limited. Engine failure after take-off (EFATO) is assessed for every cyclic assessment. V₁ refers to the decision speed to continue with the take-of that is, if an engine fails at or after V₁ you are trained to continue with the take-off. V₁ cut refers to a simulated engine failure in very close proximity to the aircraft achieving the V₁ speed during the take-off roll (manoeuvre).

________________

57. Engine pressure ratio (EPR): refers to the total pressure ratio across a jet engine, measured as the ratio of the total pressure at the exit of the propelling nozzle divided by the total pressure at the entry to the compressor. Jet engines use either EPR or compressor/fan RPM as an indicator of thrust. An EPR of 1.0 equates to zero thrust.
58. Wedges: the forward point of thrust lever position on centre aisle stand (equates to maximum continuous thrust).
59. Inflight shutdown (IFSD): statistically regarded as the equivalent of an engine failure. IFSD occur in multi-engine aircraft to preserve the engine for myriad reasons including; low oil pressure, high oil temperature and fuel control faults etc.
60. Source: ATSB aviation research report AR-2013-002, p 22. (F28/F100 - 11 x engine related occurrences in the period).
61. Source: ATSB Analysis, Causality and Proof in Safety Investigations AR-2007-053.
62. Hours since new at time of failure 15,117.9 hours.
63. Hours since new at time of failure 25,306.3 hours.
64. Hours since new at time of failure 26,643.3 hours.
65. Hours since new at time of failure 30,890.1 hours.
66. Hours since new at time of failure 30,890.1 hours.
67. Hours since new at time of failure 10,810.3 hours.
68. By day Gingin Airfield is ARFF Category 4 capable.
69. Fokker F100 is ICAO category 6. (Source: ICAO Doc 9137-AN/938 Airport Services Manual Part 1 Rescue & Firefighting, 4th Edition, Appendix 2 – Aeroplane classification by airport category.
70. Initial climb: between the completion of the take-off phase (ground level to 1,500 ft AGL) and about the transition layer.
71. Descent and/or approach (Des and App).
72. Engine failure simulated at 500 ft AGL.
73. First engine failure simulated to occur at 9,000 ft. After engine was secured, remaining engine simulated flameout (double engine failure). Lesser requirement for ‘failure management’ related decision making by virtue of the critical nature of a double engine flameout. However, if an initial decision was not made to return following first flameout (engine failure), the second failure would reinforce the importance of risk mitigation post engine failure.
74. Terminal manoeuvring area (TMA): also known as the terminal control area (TCA), defines area of controlled airspace surrounding a major airport where high air traffic volume exists. Normally a circular configuration centred on the aerodrome reference point (ARP). In Australia, this airspace is either Class C or D.
75. Captain only.
76. Engine failure simulated in the take-off phase (at about 1,000 ft AGL).

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.