A Boeing 717 aircraft was in a left turn holding pattern, descending through flight level 230, when the right engine shut down. The flight crew actioned the emergency procedures and attempted, unsuccessfully, to restart the engine. They notified air traffic control of the problem, then requested and received a vectored straight-in approach and landing.
Following the event, the operator's maintenance personnel conducted troubleshooting of the right engine. Several fault codes were noted in the computer memory, which related to Channel A of the electronic engine controller (EEC). A maintenance records check found that the right engine fuel metering unit (FMU) had been replaced approximately 50 flight hours prior to the event. At the time of the event, there were no maintenance manual requirements for an EEC stored faults check following an engine run after replacement of the FMU. Maintenance personnel noted, then cleared, the fault codes from the computer memory and the engine was successfully test run. They then chose to remove both the right engine FMU and the EEC for further testing. The EEC unit was sent to the engine manufacturer for bench testing and operating on a test bed engine.
Component testing
The FMU manufacturer's testing found no faults in the unit. Initial testing of the EEC by the engine manufacturer could not duplicate, on the test bed engine, the dual channel failure and subsequent shutdown. Analysis of the fault codes recorded by the operator's technicians following the event confirmed that several FMU electrical related fault codes were pre-existing on Channel A of the EEC at the time of the occurrence. When the engine manufacturer repeated the testing with the recorded fault codes entered into Channel A of the EEC, and simulated loss of Channel B, they successfully repeated the dual channel failure and resulting engine shutdown.
Electronic engine controller
The electronic engine controller was a two-channel (Channels A and B) electronic unit with system redundancy. It controlled, among other items, engine start sequencing, power requirements, operating temperature, turbine speeds, fuel flow, engine monitoring, and automatic relight. It contained fault detection, storage, and readout capabilities, all stored on an electrically erasable/programmable read-only memory (EEPROM) located on a computer board assembly. The EEPROM provided a history for troubleshooting purposes of any fault event within the EEC or associated control systems by logging a fault code of the event. Those fault codes were then stored until intentionally cleared during maintenance action. The distinct two-channels in the unit ensured that should one channel fail, the other would assume control and monitoring of the engine. Testing by the engine manufacturer revealed that repeated random access memory (RAM) parity errors in Channel B of the EEC resulted in repeated multiple resets of the channel. Those repeated resets had proven to result in a loss of Channel B functionality.
Engine rotation during restart attempts
Following the event, the flight crew stated that they could not obtain a windmilling engine N2 (gas generator RPM) value of 14% as required in the emergency procedures for restart of the engine. They stated that the maximum engine N2 witnessed was 8%.
The engine manufacturer recommended a 14% N2 value (approximately 2,380-RPM) at fuel introduction during engine starting procedures. That allowed a cooler start and prevented engine deterioration. The value of 8% N2 for the ALL ENGINE FLAMEOUT emergency windmilling procedure was based on the minimum engine-driven fuel pump pressure to open the engine pressurising valve. The airframe manufacturer reported that windmilling flight tests were successfully demonstrated at airspeeds as low as 240 knots with N2 windmilling rotor speeds as low as 8%.
The airframe manufacturer estimated that at a stable condition of 10,000 ft altitude, and 250 knots indicated airspeed, the occurrence engine should have exceeded 10% N2 before engine start switch engagement. Their review of the digital flight data recorder (DFDR) revealed no evidence of N2 increase as would be seen with engine starter engagement. The airframe manufacturer reported that their understanding was that the anomalies experienced during the event would have prevented the starter air valve opening during the restart attempts.
Flight data recorder
Examination of the recording indicated that the aircraft arrived at the destination and then departed on another flight to the north. The reported ground runs had not been recorded, as required by Civil Aviation Order (CAO) 20.18 Section 6 paragraph 6.6.
Australian CAO 20.18 Section 6 paragraph 6.6 stated, "The operator of an aircraft which is required by this section to be equipped with recorders shall take action to ensure that during ground maintenance periods the recorders are not activated unless the maintenance is associated with the flight data recording equipment or with the aircraft engines."
Australian CAO 20.18 Section 6 paragraph 6.3 stated, "Where an aircraft is required to be so equipped by this section, the flight data recorder system shall be operated continuously from the moment when the aircraft commences to taxi under its own power for the purpose of flight until the conclusion of taxiing after landing."
The intent of the Australian legislation was that when an aircraft commenced taxiing under its own power for the purpose of flight, the flight data recorder (FDR) would record until the aircraft was parked at the conclusion of the flight. That action ensured a continuous record of aircraft operation was maintained for the duration of the flight.
Subsequent Enquiries made to Boeing Long Beach Division, the aircraft manufacturer, revealed that when the aircraft park brake was set, the FDR would cease recording. Boeing Long Beach Division stated that the FDR would begin recording by two methods. The first "normal" recording mode activated when either fuel shutoff switch was set to run and the park brake was released. The second "maintenance" recording mode was activated by accessing a FDR RUN command via the Multifunction Control Display Unit.
Aircraft Australian certification
The Boeing 717-200 was issued a Type Acceptance Certificate in accordance with Civil Aviation Regulation, (CAR) 21.29A which allowed Type Certificate acceptance for imported aircraft certified by the National Airworthiness Authority (NAA) of a recognised country, in this case the United States of America. The Boeing 717-200 aircraft may not comply with the appropriate Australian Civil Aviation Regulations and associated Orders.