The Saab SF340B aircraft was being operated on a scheduled
passenger flight from Dubbo, NSW to Sydney. The crew reported that,
during the descent into Sydney and while passing flight level 110,
they selected the auto-coarsen system ON. After passing through
7,000ft AMSL, the aircraft suddenly yawed to the left and the left
propeller feathered. The crew reported that they immediately
noticed illumination of master warning and caution annunciations
consistent with a left engine failure. A scan of the engine
instruments confirmed that the left engine appeared to have shut
down, with the engine torque and fuel flow indications at zero. At
the time of the apparent engine shutdown the aircraft was under
autopilot control. The crew reported that they were not operating
any engine controls and that the power levers were positioned below
the 64 degree position. The crew reported that the aircraft's
auto-ignition system, which was armed when the ignition system was
selected to NORM at engine start, did not operate throughout the
incident.
The left engine was secured, and the crew informed the flight
attendant and passengers of the situation. The crew declared a PAN
to air traffic control, reporting an engine shutdown, and a local
standby was declared. The crew elected not to attempt an engine
restart due to the aircraft's proximity to the airport, and an
uneventful one-engine inoperative landing was conducted.
Immediately following the incident, the operator's maintenance
personnel carried out operational checks of the left engine. During
those checks the engine and its auto-ignition system were found to
operate normally.
An investigation into the incident, carried out by the operator,
resulted in the removal of the left engine's hydromechanical unit
(HMU) and the digital electronic control unit (DECU) for
examination. The aircraft's fuel system was also extensively
inspected with no defects or anomalies detected. The aircraft was
then returned to service and the problem had not recurred in the 15
months following the incident.
The operator forwarded the removed HMU and the DECU to the
component repair vendor. That examination found no problems with
either component that would have contributed to the incident and
both components were returned to the operator as serviceable items.
The DECU was subsequently fitted to another aircraft in the
operator's fleet. A short period after fitment, the unit was again
removed following engine `torque fluctuation' problems on that
aircraft and the component was again returned to the component
repair vendor for examination. During that examination, a fault
with `stressed' solder joints on a central processing unit board
within the DECU was discovered and corrected. Several internal
microcircuits were also replaced.
The aircraft was equipped with an engine ignition system that,
when selected to NORM, automatically provided `flameout
protection', or auto-ignition. The DECU sensed the rate of engine
deceleration, comparing it to an internally programmed `rate of
change' or `flameout schedule', and at a predetermined figure
energised the ignition system for 7.5 seconds. This was indicated
by illumination of a white ignition light on the flight status
panel. The ignition was shut off when the gas generator speed
decreased below 62% to prevent a `sub-idle relight'. The pilot in
command reported that on the previous sector, the auto-ignition
light had illuminated for a period of about 4 seconds during the
descent, for no apparent reason.
The auto-coarsen system was designed to automatically feather a
propeller in order to achieve a rapid reduction in propeller
windmilling drag in event of an engine failure during takeoff,
approach and go-around. The auto-coarsen system operated in a high
or low mode depending on whether the power levers were above 64
degrees (high) or below 64 degrees (low). The active mode was
indicated by the illumination of an annunciator positioned on the
flight status panel. There were no markings on the power lever
control quadrant to indicate the 64 degree position to the crew.
The auto-coarsen system monitored a number of parameters including
power lever angle and when in high mode, engine torque. The engine
torque signal was provided by the DECU. During an auto-coarsen
event, where an engine failure is not the reason for the event, the
engine can continue to operate at low power with corresponding fuel
flow, inter-turbine temperature (ITT), oil pressure and temperature
indications.
The engine manufacturer reported to the ATSB that they had
received several field reports that identified where an internal
failure within the DECU had resulted in an intermittent loss of the
torque signal output from an engine. The engine manufacturer
further reported that, when allied with conditions of power lever
position and engine parameters that are pre-programmed into the
auto-coarsen computer, an intermittent loss of torque signal could
result in the auto-coarsen computer mistakenly detecting an engine
failure, triggering an inadvertent propeller auto-coarsen
event.
The engine manufacturer reported that they had recently become
aware that their standard acceptance test procedures (ATP),
performed on DECU's following maintenance, had not always been
successful in isolating intermittent loss of torque signal faults.
They advised that they had improved the ATP procedures for DECU's
that had been identified as `loss of torque signal' units. The
occurrence DECU had not undergone the improved ATP inspection when
it had been returned for examination following the occurrence.
The standard operating procedures to be followed by flight crews
were detailed in the operator's Aircraft Operations Manual. These
procedures contained the flight checklists to be followed in
normal, abnormal and emergency situations. The aircraft
manufacturer issued Revision 32 of the Saab 340B Aircraft
Operations Manual in February 2001. That revision modified the
normal checklist, deferring selection of auto-coarsen from the
transition checklist to the landing checklist in order to minimise
the time with auto-coarsen on, thus reducing the probability for an
inadvertent auto-coarsen event. At the time of the occurrence the
operator's checklists specified that auto-coarsen be selected to ON
at FL110, as part of the transition check. The reason the
operator's checklist was not revised to reflect the manufacturer's
data was not available due to subsequent organisational
changes.
The Flight Data Recorder (FDR) information from the aircraft was
analysed by the ATSB to assess the operating parameters of the
engine during the incident. That analysis revealed that
approximately 37 minutes after takeoff, with the aircraft in cruise
flight, the flight data recorder had begun to record invalid
information. This resulted in no useful data being available from
the FDR for the remainder of the incident flight, a period of about
24 minutes. An examination of the aircraft's flight recorder system
carried out by the operator during post incident system checks
found no reason for the malfunction.
