Uncommanded engine shutdown involving De Havilland Aircraft of Canada DHC-8, VH-LQD, 77 km north-north-west of Brisbane Airport, Queensland, on 26 June 2018

What happened

On the 26 June 2018, a QantasLink De Havilland Aircraft of Canada (formerly Bombardier Inc.) DHC-8-402, registered VH-LQD (LQD), was operating a regular passenger service within Queensland from Brisbane to Mackay and returning to Brisbane. The flight crew consisted of two captains, one in the right seat who was training to get an approval to operate the aircraft from the right seat, and a training captain who was pilot in command.

When the flight crew arrived at LQD to begin their pre-flight preparations, they identified a number of maintenance requirements for the right engine related to ongoing inspections. These requirements were for advice-only to the flight crew. After completing their pre‑flight preparations, they flew from Brisbane to Mackay with no issues.

The return flight to Brisbane had four crewmembers and 74 passengers on board. For this flight, the training captain was the pilot monitoring (PM) and the trainee captain, acting as first officer, was the pilot flying (PF).^[1]

At approximately 1749 Eastern Standard Time,^[2] as the aircraft approached the top of descent at FL 250,^[3] the aircraft yawed and there was a warning chime. The flight crew identified that the full authority digital engine control (FADEC) had shut down the right engine without warning. Due to their concern about the resultant windmilling propeller,^[4] the crew actioned the engine shutdown procedure from memory rather than by using the quick reference handbook. As this did not result in the propeller feathering,^[5] they selected the alternative feathering system. They observed the ‘feather pump running’ advisory light was illuminated, indicating that the alternative feather pump was working. The crew reported the propeller continued to turn at approximately 270 RPM and that the remainder of the checklist items were actioned.

The crew assessed the available landing options and decided that despite being slightly closer to the Sunshine Coast Airport, they would continue to Brisbane as they were prepared and had briefed for that approach. As expected, the aircraft could not maintain speed at FL 250 with one engine inoperative, so they slowed towards 190 kt. The PM contacted air traffic control (ATC) to advise them of the situation and requested a descent to FL 200, which was approved. They then made a PAN PAN^[6] call and advised ATC that emergency services would be required on landing.

The PM contacted the cabin crew to advise them of the situation and requested that they prepare the cabin and passengers. A public announcement was then made to the passengers.

The propeller was still rotating at approximately 270–300 RPM, but as the aircraft descended and the airspeed increased, the propeller rotations increased to approximately 660 RPM. To reduce the RPM, the flight crew slowed the aircraft. During the descent, the batteries in the PF’s noise cancelling headset failed. It was reported that, as the batteries were being changed, the PF could hear what appeared to be grinding from the rotating propeller. Consequently, the PM contacted the company’s engineering section to ensure all appropriate actions had been completed.

About 45 km from the airport, the training captain took over flying the aircraft. As they descended through 5,000 ft, the aircraft exited cloud and the crew sighted the airport. They requested radar vectors for the Runway 19 instrument landing system, to ensure they were set up to conduct a stabilised approach. They then advised ATC that they expected to conduct a normal landing but as the propeller had not feathered, they could not guarantee missed approach performance and so would not conduct a missed approach.

At 1845, the aircraft landed and was stopped on the second high speed turnoff. This allowed the aviation rescue firefighting (ARFF) service to inspect the engine for excessive residual heat or oil leaks. Following advice from the ARFF that there were no observed engine issues, the aircraft was cleared to taxi to the bay.

The flying pilot observed that the only handling difference from an engine failure practiced in the simulator was that when the operating engine was selected to flight idle during the landing, the aircraft yawed significantly more than expected. He commented that it required almost full right rudder to maintain the aircraft on the centreline.

__________

1. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
4. Windmilling: a rotating propeller being driven by the airflow rather than by engine power, and results in increased drag at normal propeller blade angles.
5. Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
6. PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Engine and propeller examination

The aircraft was equipped with two Pratt & Whitney Canada PW150A engines, each driving a Dowty Propellers’ six-blade R408 propeller system. The affected engine, serial no. PCE-FA0815, was sent to a Pratt & Whitney Canada engine facility in Canada for inspection. Their examination identified that the uncommanded engine shutdown was the result of a No. 30 bearing fracture. Due to the extent of damage, it was not possible to establish the bearing fracture mechanism.

The No. 30 bearing is part of the tower shaft for the accessory gearbox that runs the main engine oil pump and fuel metering unit, among other systems.

Figure 1: No. 30 bearing broken cage pieces, damaged ball bearings and spalling on the inner and outer bearing races

Source: Pratt & Whitney Canada report received from the operator

The propeller pitch control unit, propeller overspeed governor, and auxiliary feather pump were sent to the relevant manufacturer for inspection. The auxiliary feather pump was not test run prior to being disassembled and inspected however, nothing was found during the inspections that contributed to the propeller not feathering.

The operator advised that while the propeller did not feather, and the reason for this could not be identified, the propeller did go to a safe coarse condition due to the counterweights in the propeller system, as it would if there was no oil in the propeller system. The manufacturer’s analysis showed that with one engine inoperative, the difference between a counterweight coarsened propeller and a fully feathered propeller was a 0.5–0.9 per cent decrease in aircraft performance.

Airworthiness and maintenance

The operator had a Civil Aviation Safety Authority-approved Civil Aviation Safety Regulation (CASR) Part 42 continuing airworthiness maintenance organisation (CAMO). The CAMO maintained the aircraft maintenance program, which included:

• maintenance planning
• the reliability program
• recording of data in the maintenance information system.

The operator also had a CASR Part 145 approved maintenance organisation (AMO) to perform the required maintenance on the aircraft.

The CAMO planned the maintenance actions and issued work orders to the AMO. The work orders contained task cards that directed the AMO to conduct specific tasks. Personnel from the AMO were required to:

• complete the task
• record what work was completed
• sign the task as complete
• attach the task card to the work order.

The overarching work order was then signed as being complete and a summary recorded. Those records were then returned to the CAMO to assess the completed work and record the information in the maintenance information system. Information in the system was available to both CAMO and AMO personnel.

Engine monitoring systems

During the 12 months prior to the incident, the operator had been introducing a new engine monitoring system across their DHC-8 fleet—the flight-data acquisition, storage and transmission (FAST) system. This system provided automated transmission of flight and engine health data to an organisation contracted to provide technical support. An automated email was sent to selected people within the CAMO if a fault was generated within the critical (as specified by the engine manufacturer) health data.

At the time of the incident, the procedures for what data was emailed and how to use the data had not been implemented. Since this occurrence, the installation of the FAST system has been completed across the fleet. Procedures on how to deal with notifications generated by the FAST system have also been introduced.

The FAST system had been installed on LQD. The system was producing data, and emails relating to faults were being sent to selected people within the CAMO.

While the FAST system was being installed across the fleet, the operator conducted regular engine trend-monitoring inspections as per the approved maintenance program. This included a work order to conduct routine interrogation of the engine central diagnostic system (CDS) by personnel within the AMO every 50 hours. Each work order contained a task card instructing the AMO to check, investigate and clear CDS faults and to record the relevant faults. Relevant faults codes included those which occurred during normal operations:

• resulting in the subsequent reset of a system in accordance with the De Havilland Supplemental Procedure Ground Reset Guide (SPGRG)
• or maintenance activities and required a subsequent maintenance action to clear.

Maintenance actions prior to the uncommanded engine shutdown

On the 13, 18 April, and 27 May, personnel within the CAMO received automated emails from the contracted organisation notifying them of ‘Fault code 938 – Turbomachinery chip detector’ generated by the FAST system, for the right engine on LQD. No actions were taken in response to these emails, and as the procedures were not yet in place, no action was required.

On the 13 April, earlier on the day the CAMO received the first email relating to the fault, personnel working within the AMO signed a work order as complete, recorded that there were no defects and ticked the ‘Fault code(s)’ ‘No’ box on the task card. The fault, recorded in the email received by the CAMO, was most likely generated after this check was completed. This fault was probably cleared on the 18 April, when a separate powerplant message was cleared, and the fault generated again on a flight later the same day resulting in the second email being forwarded to the CAMO. An inspection on 20 April was also completed with no faults recorded and the ‘Fault code(s)’ ‘No’ box ticked.

During an inspection on 26 April, ‘Fault code 938 – Turbomachinery chip detector’ was detected on the CDS. On further inspection, ‘minor fuzz’ was detected on the turbomachinery chip detector. The AMO categorised the debris as ‘permitted’, which was described in the aircraft maintenance manual as a ‘small quantity of hair like filaments (fuzz) or powder provided there has been no prior history of debris (allowable or non-allowable) within the last 400 hours’.

After consulting the aircraft maintenance manual, the engine was returned to service. The debris was not analysed, and there was no requirement to do so. The fault was recorded in the technical log, and the fault code ‘No’ box was ticked on the task card and work order (Figure 2).

Figure 2: Example of two task cards from different maintenance inspections

The task card on the left references the task in the technical log and shows that the fault code ‘No’ box is ticked although a fault code was present.
The task card on the right is the task on the 30 May 2018, where the fault code 938 had been received and cleared in the CDS and no information about the maintenance task had been recorded on the task card. These tasks were completed by different engineers.
Source: Operator annotated by ATSB with identifying information redacted.

The AMO conducted nine more inspections of the CDS with no defects recorded and the fault code ‘No’ box ticked on each occasion. Different personnel within the AMO completed these inspections.

After the incident, the operator interrogated the CDS to investigate why the FAST system had recorded 938 fault codes, but no such fault codes were recorded during most of the 50 hourly routine tasks. The interrogation found that during the maintenance task on the 30 May, the ‘Fault code 938 – Turbomachinery chip detector’ had been cleared in the CDS. This indicated that when the maintainer interrogated the CDS, they identified fault code 938, and had cleared it.

The AMO could not provide evidence that further actions had been taken in relation to CDS ‘Fault code 938 – Turbomachinery chip detector’ although they stated that it was highly likely that the appropriate maintenance actions had taken place when the faults were cleared.

This omission in the recording of maintenance had not been detected by the AMO, as there was no requirement to ensure that the work completed was recorded in the paperwork correctly. It was also not detected within the CAMO, as personnel working within the technical records area have no way of knowing what unscheduled maintenance was completed unless it was written on a task card.

A review of tasks cards found a number on which the maintainer had listed the fault codes that had been detected and the work completed to clear those codes, but the fault code ’No’ box was ticked (see Figure 2). This was not detected during the assessment of the paperwork by the technical records area, as there was no requirement to check this specific area of the form. The AMO could not explain why the same error was made by different maintainers over a number of inspections.

There is a regulatory requirement that an operator ensure that all stages of maintenance are complete and recorded, with details of the maintenance conducted, before an aircraft is released to service. There is also a regulatory requirement that licenced aircraft maintenance engineers’ record all maintenance conducted within the continuing airworthiness records system before an aircraft is released to service.

Oil sampling trial

On 18 May, an oil sample was taken from the occurrence engine as part of a trial being conducted by the engine manufacturer. There were no requirements on the operator to collect the sample and no procedures on how quickly the sample was to be sent for analysis to the engine manufacturer’s facility. The sample was sent to the manufacturer’s facility on 25 June. The results, which indicated that the bearing and gear material were above the set threshold, were not received by the operator until 12 September.

Maintenance actions immediately prior to the uncommanded engine shutdown

Overnight on 25 June, the FAST system recorded three fault codes - ‘Fault code 938 – Turbomachinery chip detector’, ‘Fault code 915 - Main Oil Filter’ and ‘Fault Code 932 - Scavenge Oil Filter’. Due to the system’s set-up, personnel from the CAMO received an automated email from the contracted organisation notifying them of ‘Fault code 938 – Turbomachinery chip detector’. On receipt of this email, they raised an urgent technical service request (UTSR) which was sent to the AMO.

During scheduled maintenance on the evening of 25 June, personnel from the AMO also noted that the CDS had recorded ‘Fault code 938 – Turbomachinery chip detector’, ‘Fault code 915 - Main Oil Filter’ and ‘Fault Code 932 - Scavenge Oil Filter’. As a result, they conducted an inspection of the engine.

Personnel from the AMO found debris on the turbomachinery chip detector and the main oil filter and classified this as ‘Non-Permitted Category 3’ debris (dark irregular magnetic chips or small clusters of magnetic flakes or all other debris not defined elsewhere, Figure 3). This required that a sample of the debris be sent to a laboratory for analysis.

They then, in consultation with personnel from the CAMO, used a flow chart to determine whether to return the engine to service. This flow chart indicated that if the turbomachinery had a history of contamination within the previous 400 hours, they must ‘wait for the results of the previous lab report prior to continuing operation’. The personnel from the AMO and CAMO together decided not to include the previous permitted ‘minor fuzz’ found on the chip detector on the 26 April, which was within the previous 400 flight-hours, due to an assessment that it did not constitute an occurrence of debris. There was no record in the maintenance information system that ‘Fault Code 938 – Turbomachinery chip detector’ had been received and cleared on previous occasions, as this had not been recorded on the task cards.

The personnel from the AMO and CAMO discussed the steps in the flow chart procedure and assessed that with no history of debris, the engine could be returned to service with a 20 flight‑hour limitation. The debris was sent for laboratory analysis. The report with the results of the debris analysis, which showed the sample contained bearing material, was received by maintenance personnel while the aircraft was in cruise, 35 minutes before the engine shutdown.

The personnel from the AMO and CAMO did not consult with the engine manufacturer during this process as it was not a requirement when following the Aircraft Maintenance Manual.

Debris assessment

The aircraft maintenance manual PSM 1-84-2, covered the classification and required actions to be taken when debris was detected on the turbo machinery chip detector. As part of their investigation into the incident, the operator reviewed the relevant sections of the manual and found a number of ambiguities in terminology and required actions.

In the section to classify the debris found in the turbomachinery and reduction gearbox oil system (subtask 79-22-00-750-009 table 601, Figure 3), the debris classification table used the terms ‘permitted’ and ‘non-permitted’ to classify the debris. However, in the definitions, the terms were changed to ‘allowable’ or ‘non-allowable’. The next section interchangeably used the terms ‘debris’ and ‘contamination’, ‘bearing material’ and ‘material’.

Figure 3: Extract of task 79-22-00-750-009 table 601 giving criteria for classification of debris found in oil system

The table shows the debris type and definition.

Source: Aircraft manufacturer

In the classification system, category 3 debris was smaller than category 1 debris. Unlike category 2 debris, the category 3 debris definition did not consider if there was a history of debris within the previous 400 hours.

The aircraft maintenance manual directed the user to a flow chart that set out the steps to be taken when debris was detected on the turbomachinery chip detector and/or the main oil filter. Step 16 in the flow chart (Figure 4) asked if the turbomachinery had ‘a history of contamination within 400 hours?’. This step changed the term from ‘debris’ to ‘contamination’ and it also did not include the words ‘allowable’ or ‘non-allowable’.

Figure 4: Extracts of flow chart of decision-making map for debris on turbomachinery chip detector

Source: Aircraft manufacturer

If the answer to step 16 was ‘yes’ then the flow chart directed the user to step 29 (Figure 5). This asked if a laboratory report was available for the previous event of contamination and if the answer was ‘no’, directed the user to go to step 30. Step 30 stated ‘wait for the results of the previous lab report prior to continuing operation’.

Figure 5: Extracts of flow chart of decision-making map for debris on turbomachinery chip detector

Source: Aircraft manufacturer

The operator found that the personnel from the ‘AMO and CAMO were then faced with a situation whereby the guidance required them to wait for the results of a debris analysis that had not taken place’. This step also directed the user to Note 6 (Figure 6) which directed the user to obtain an analysis of the ‘last’ sample. The operator noted that the use of the word ‘last’ here was open to interpretation, as this could be interpreted as ‘last’ being the previous debris or ‘last’ being the latest debris. It also did not specify that the debris could be ‘allowable’ or ‘non-allowable’, as specified in other sections of the manual.

Figure 6: Extract from aircraft maintenance manual Note 6

Source: Aircraft manufacturer

To assess the clarity of the procedure, the operator conducted an informal survey of other maintenance staff using this documentation. They found that the maintenance staff came to different conclusions as to the action to be taken.

Engine manufacturer’s comments

The engine manufacturer considered that the in-flight shutdown of the turbomachinery was a preventable occurrence. They classified the debris identified on 25 June as ‘Non-permitted Category 2’ (Any quantity of hair like filament (fuzz) or powder if the module has a history of generating debris (allowable or non-allowable) within the previous 400 hours). They advised that the ‘minor fuzz’ detected on the 26 April should have been classified as ‘previous history’ for the purpose of considering the debris identified on 25 June. This would have required the aircraft to be grounded until the results from the analysis of the debris was received.

The engine manufacturer also advised that worldwide, this was the third fracture of the No. 30 bearing since May 2013, when the entire fleet had incorporated service bulletin SB35216. There have been over 10 million hours flown worldwide since the service bulletin was incorporated. In all three events, it was impossible to detect what had led to the bearing fracture, but two of the three events had resulted in uncommanded inflight engine shutdowns.

Introduction

During cruise flight, a bearing fracture within the intercompressor case resulted in an automated shutdown of the right engine. Due to the extent of the damage, and consistent with previous similar occurrences, it was not possible to establish the bearing fracture mechanism.

After the uncommanded engine shutdown, the propeller did not feather as expected, instead going into a design coarse position. This decreased the aircraft’s one engine inoperative performance by up to 0.9 per cent from that expected had the propeller feathered. Detailed technical inspection was unable to identify the reason why the propeller did not feather.

This analysis will discuss the indications of the deterioration of the bearing and the maintenance actions in the months and days preceding the uncommanded engine shutdown. It also examines the maintenance procedure used to determine whether the aircraft should be grounded pending the analysis of the debris found on the turbomachinery chip detector.

Maintenance action

During a number of regular inspections leading up to the detection of what maintenance personnel considered to be category 3 chip detector debris, different maintainers from the operator’s approved maintenance organisation (AMO) had identified ‘Fault Code 938 – Turbomachinery Chip Detector’. For reasons that could not be determined, and contrary to the required procedure, these faults were cleared without recording the fault and maintenance actions in the task card. The associated fault code ‘No’ box was also ticked on each occasion.

There was no process, nor was there a requirement within the AMO, to ensure that the completed maintenance related to fault codes were correctly recorded in the maintenance documentation. Additionally, there was no way or means for personnel within the continuing air maintenance organisation (CAMO) to detect when unscheduled maintenance was completed but not documented. They also did not have a procedure to ensure that when there were faults recorded on the task card, that the fault code ‘Yes’ box was ticked.

As a result, the opportunity to identify the developing debris trend associated with the gearbox bearing deterioration was missed.

On the evening of 25 June, ‘Fault Code 938 – Turbomachinery Chip Detector’ fault was detected, and debris found on the turbomachinery chip detector and the main oil filter. The debris was classified as ‘Non-permitted Category 3’ debris. In consultation, personnel from the CAMO and the AMO decided that the previous instance of debris (26 April) did not constitute a history of debris.

Based on that assessment, they used the information provided in the aircraft maintenance manual to release the engine to service with a 20 flight-hour limitation while a sample of the debris was sent for analysis.

The engine manufacturer’s intent was that the prior ‘fuzz’ should have been considered a history of debris. This would have required the debris detected on the 25 June to be analysed and the results reviewed, before the aircraft was released to service. Had that occurred, the uncommanded engine shutdown would probably have been avoided.

Procedural confusion

The aircraft maintenance manual procedures for assessing chip detector debris were written in a way that could cause confusion and error. For example, in describing the classification of the debris, the ‘Non‑permitted Category 3’ description did not mention a previous history of debris. This allowed the user to read the classification description in isolation and, as in this case, disregard the previous instance of ‘permitted’ debris. This was not the manufacturer’s intended interpretation.

Additionally, some of the required maintenance steps relied on the results of debris analysis but it was not always clear what debris was being referred to—current or previous. Terminology was also interchanged without explanation.

These aspects of the assessment flowchart most likely influenced the maintenance personnel’s decision to discount the previous history and release the engine to service with a 20 flight-hour limitation, while they waited for the results of the debris detected on the 25 June to be analysed.

From the evidence available, the following findings are made with respect to the uncommanded engine shutdown involving a De Havilland DHC-8, registered VH-LQD, near Brisbane, Queensland, on 26 June 2018.

Contributing factors

• During cruise, a bearing in the intercompressor case fractured, leading to an automated in‑flight engine shutdown.
• Following detection of category 3 debris on the chip detector and the oil filter, the maintenance personnel discussed a previous detection of debris but incorrectly concluded that it did not need to be considered. This resulted in the aircraft being released to service, and the uncommanded engine shutdown, within the 20 flight-hour limitation.
• The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing. [Safety issue]

Other safety factors

• Multiple maintenance personnel did not record 'Fault code 938 - turbomachinery chip detector' as required when conducting 50 hourly inspections.
• There were no processes within the aircraft maintenance organisation or QantasLink to ensure that maintenance tasks associated with fault codes were correctly documented.

Other findings

• After the uncommanded engine shutdown, the propeller did not feather. Instead, it moved to a safe coarse position, which resulted in a decrease in the aircraft’s one engine inoperative performance of 0.5‑0.9 per cent compared to a feathered propeller.

Unclear procedures in Aircraft Maintenance Manual

Safety Issue number: AO-2018-049-SI-01

Safety issue description: The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing.

Safety recommendation description: The Australian Transport Safety Bureau recommends that Pratt & Whitney Canada takes safety action to improve the clarity of procedures within the chip detector debris analysis section of the aircraft maintenance manual.

Safety action not associated with an identified safety issue

Safety action by QantasLink

QantasLink now proactively requires all debris detected during inspections of engines and turbomachinery chip-detectors to be sent for analysis. The results of this analysis is stored and can be referenced, should further faults be detected, without having to wait for analysis.

QantasLink’s AMO introduced a ‘supervisor documentation quality check’ and issued a maintenance standing order. Shift supervisors are now required to conduct final checks of all aircraft maintenance and check packages for correct completion, certification and coordination in accordance with the:

• AMO Internal Procedures Manual
• Continuing Airworthiness Maintenance Organisation’s Approved Maintenance Program
• certification practices and procedures and the Civil Aviation Safety Regulations.

Following these checks, all necessary maintenance records and data are to be sent to the CAMO technical records department.

While the CAMO ‘Documents & Procedures’ course is delivered to new AMO employees, a recurrent course has not previously been available. A recurrent ‘Docs & Procs’ online course is now under development. This course is intended to ensure all certifiers remain current with all aircraft maintenance documentation recording requirements.

Implementation of the FAST system has now been completed on all QantasLink Dash-8 aircraft. This system allows monitoring of faults, including accessing the date and time the faults were triggered via the contracted organisation’s systems portal. For selected fault codes, as recommended by Pratt & Whitney Canada (P&WC), an automated alert email is also provided to selected staff by the contracted organisation. A ‘work instruction’ detailing the process to react to FAST system generated alerts, has been published (AWI-TS10). This ‘work instruction’ is based around P&WC Service Information Letter PWC150-045 along with other P&WC data.

Sources of information

The sources of information during the investigation included:

• interviews with the flight crew
• QantasLink
• De Havilland Aircraft of Canada
• Pratt & Whitney Canada
• the Transportation Safety Board of Canada.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, QantasLink, Pratt & Whitney Canada, De Havilland Aircraft of Canada, the Transportation Safety Board of Canada, Transport Canada and the Civil Aviation Safety Authority.

Submissions were received from the flight crew, QantasLink, De Havilland Aircraft of Canada, Pratt & Whitney Canada and Transport Canada. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly. Australian Transport Safety Bureau

The ATSB is an independent Commonwealth Government statutory agency. The ATSB is governed by a Commission and is entirely separate from transport regulators, policy makers and service providers. The ATSB’s function is to improve safety and public confidence in the aviation, marine and rail modes of transport through excellence in: independent investigation of transport accidents and other safety occurrences; safety data recording, analysis and research; fostering safety awareness, knowledge and action.

The ATSB is responsible for investigating accidents and other transport safety matters involving civil aviation, marine and rail operations in Australia that fall within the ATSB’s jurisdiction, as well as participating in overseas investigations involving Australian registered aircraft and ships. A primary concern is the safety of commercial transport, with particular regard to operations involving the travelling public.

The ATSB performs its functions in accordance with the provisions of the Transport Safety Investigation Act 2003 and Regulations and, where applicable, relevant international agreements.

Developing safety action

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues in the transport environment. The ATSB prefers to encourage the relevant organisation(s) to initiate proactive safety action that addresses safety issues. Nevertheless, the ATSB may use its power to make a formal safety recommendation either during or at the end of an investigation, depending on the level of risk associated with a safety issue and the extent of corrective action undertaken by the relevant organisation.

When safety recommendations are issued, they focus on clearly describing the safety issue of concern, rather than providing instructions or opinions on a preferred method of corrective action. As with equivalent overseas organisations, the ATSB has no power to enforce the implementation of its recommendations. It is a matter for the body to which an ATSB recommendation is directed to assess the costs and benefits of any particular means of addressing a safety issue.

When the ATSB issues a safety recommendation to a person, organisation or agency, they must provide a written response within 90 days. That response must indicate whether they accept the recommendation, any reasons for not accepting part or all of the recommendation, and details of any proposed safety action to give effect to the recommendation.

The ATSB can also issue safety advisory notices suggesting that an organisation or an industry sector consider a safety issue and take action where it believes it appropriate. There is no requirement for a formal response to an advisory notice, although the ATSB will publish any response it receives.