ATR72 VH-FVR Missed Damage: Maintenance Lessons (Virgin Australia Regional Airlines [VARA] VH-FVR)

In 2014 we first reported on the preliminary information from the Australian Transport Safety Bureau (ATSB) on a serious incident with a Virgin Australia Regional Airlines (VARA, formerly Perth, WA based SkyWestATR 72 VH-FVR on 20 February 2014. We followed up on this with a more detailed report on the day the ATSB issued a first Interim Report in June 2016 which we updated further after the second Interim Report in May 2017 in and the Final Report in May 2019 (a report issued 63 months after the serious incident!).  This article looks specifically at the maintenance failures that followed the damage.

History of the Flight

While operating a scheduled passenger flight from Canberra to Sydney, the ATSB say that:

While passing through about 8,500 ft, the aircraft encountered a significant windshear that resulted in a rapidly decreasing tailwind. This led to a rapid increase in airspeed, with the airspeed trend vector (displaying predicted speed on the primary flight display) likely indicating well above the maximum operating speed (VMO) of the aircraft of 250 kt. The first officer reduced engine power and made nose-up control inputs in an attempt to slow the aircraft.

The Aircraft Commander (the Pilot Monitoring) “perceived a need to take over control of the aircraft, with the intention of preventing the airspeed exceeding VMO” but only announced 5-6 s later that he was taking control.  In the interim the flight crew had made opposing inputs and thee aircraft sustained a pitch disconnect in which aerodynamic loads “exceeded the strength of the horizontal stabiliser and resulted in significant damage.”

Damaged Horizontal Stabiliser on VARA ATR72 VH-FVR (Credit: Sydney Airport CCTV via ATSB)

Damaged Horizontal Stabiliser on VARA ATR72 VH-FVR (Credit: Sydney Airport CCTV via ATSB)

Crucially the damaged went undetected during a subsequent inspection and was only detected 13 flights later.

Continuing Airworthiness, Maintenance, Quality System and Fatigue Risk Background

Maintenance of the VARA ATR72 was contracted to Brisbane based Toll Aviation Engineering (TAE), an arrangement commenced by SkyWest in 2011.

Operating within the VARA CAMO [Continuing Airworthiness Management Organisation approved by CASA in accordance with  CASR Part 42 8 months earlier] were maintenance watch personnel who were tasked to coordinate the rectification or deferral of defects, provide technical support to line maintenance personnel, and brief management as required. In consultation with the CAMO manager or fleet manager, the maintenance watch engineer was to decide on the appropriate action to ensure any disrupted aircraft were safely returned to service. Part of the coordination role was liaison with each [line station] to ensure adequate resources were available to perform the assigned work. If additional personnel, equipment or hangar space was required…they applied to the TAE production and planning section in Brisbane which could provide purchase orders during their normal working hours of that section.

However, ATSB note that:

…it would seem to be impractical for the maintenance watch engineer to proactively provide technical support and monitor resourcing at the Sydney line station.

From a European perspective it is slightly odd that the VARA CAMO was expected to provide greater operational support and oversight than would be normal in Europe for a 3rd party maintenance organisation’s line station.

For any significant line maintenance events, the Aircraft Line Maintenance Event Consideration Worksheet was to be used. This form was intended as a management and coordination guide for capturing essential data and provided notification protocols to ensure that a standard approach to control and coordination was applied to aircraft recovery.

Furthermore:

In 2012, the LAMEs involved in maintenance of ATR 72 aircraft were given an outline of the objectives and elements of the Skywest safety management system. [T]here had been significant changes to the Skywest-VARA SMS [since but no evidence of any update to LAMEs or any other TAE staff].

In Sydney TAE had a Senior Base Engineer.  However:

The role of senior base engineer was not defined in the TAE MOE [Maintenance Organisation Exposition] and there was no evidence that the company had formally or explicitly communicated their expectations to the Sydney senior base engineer since he was appointed in 2012.

The individual believed the role was “primarily administrative with no responsibility for the coordination of maintenance or the performance of other Sydney-based engineers”.

The TAE MOE required that all work be performed in accordance with the applicable CASA‑approved system (or program) of maintenance, the MOE itself, and approved data.

Licensed Aircraft Maintenance Engineers (LAMEs) were required to “apply human factor principles” according to the ATSB, though there is no clarity on whether that applied to any other maintenance personnel.

TAE specified that an employee could not be authorised to certify for maintenance if they had not carried out human factors training in the previous two years. The stated aims and objectives of TAE human factor training was to make employees aware of the techniques for the control and avoidance of human error through possible countermeasures and interventions. It was intended to reduce the probability of aviation accidents and incidents due to human errors made during maintenance.

Fatigue risk management was covered in the human factors training. According to the MOE, LAMEs were only permitted to certify for maintenance that they themselves had carried out or had directly supervised, and for maintenance that was carried out in accordance with approved data.

If line stations had to carry out complex work using worksheets, this was to be generated by the aircraft operator and passed to the TAE planners who would assign a job number and direct the package to the applicable line station. All other work was contained in the aircraft operational log.  The term ‘complex work’ was not defined in the MOE.

In relation to rosters:

The TAE MOE contained guidance and procedures to minimise human error during maintenance, including the management of fatigue.

The International Civil Aviation Organisation (ICAO) defines fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase, or workload (mental and/or physical activity) that can impair a crew member’s alertness and ability to safely operate an aircraft or perform safety related duties.

At the time there was a maximum of 13 hours duty in a 24-hour period, extendable to 16 hours with supervisor/manager approval and a minimum rest period of 10 hours. ATSB note that:

…evidence exists that fatigue risk increases over the course of a shift in an approximately exponential manner. Therefore, risk increases substantially once a shift becomes greater in length than 8 hours. The risk of a roster of 12-hour shifts is some 27.6 per cent higher than a roster of 8-hour shifts. Thus, shifts longer than 12 hours are clearly undesirable and the guidelines recommend that the extent to which an overtime shift should be lengthened is limited to 13 hours. In addition, the CASA guidelines recommend that the break between two successive shifts is to be sufficient to allow appropriate travel, rest, sleep, and sustenance. The European Union’s Working Time Directive sets this limit to 11 hours and the CASA guidance material adopted this limit.

At the time of the incident:

When engineers were rostered for duty they were assigned to a morning or afternoon shift of one or two LAMEs each. The rostering created a shift overlap as the morning shift was nominally from 0600 to 1650 [10.5 hours] and the afternoon shift was from 1300 to 2230 [9.5 hours]. The Sydney-based engineers were nominally rostered for four consecutive days of duty followed by four consecutive days free of duty. This pattern, however, was often modified to accommodate engineer unavailability and unscheduled maintenance. In February 2014 [for example], two of the Sydney engineers were unavailable for rostered duty between 12 and 14 February and one of those engineers remained unavailable after 15 February. [T]here was no evidence that the senior base engineer had received any training on managing the fatigue of a team of engineers.

From a quality system perspective:

TAE was a legacy supplier that the aircraft operator had assessed through quality assurance audits conducted in August 2011 and May/December 2013. Then, in January 2014, the CAMO arranged for a quality assurance audit of TAE maintenance activity at Brisbane and Sydney with a follow-up audit after the occurrence. In general, these audits of TAE did not identify any serious deficiencies or risks that warranted immediate action by the aircraft operator or CAMO. It is noted, however, that the auditors identified under-resourcing of the TAE quality assurance system and out-of-date interface procedures, which were recurring findings.

Post Incident Maintenance – 20 February 2014

ATSB explain that:

After the pitch disconnect, and while the aircraft was inbound to Sydney, ground operations for the airline advised the [two TAE duty] engineers [at Sydney (the ‘Senior Base Engineer’ and ‘LAME 1’)] that the captain requested they attend the aircraft on arrival. No reason was given, but this type of request was common practice if an aircraft had a problem. When the engineers arrived at the bay and saw the aircraft with emergency services in attendance, they ascertained that something serious had occurred. From a quick conversation with the crew, through a flight deck window, the engineers were aware there had been a pitch disconnect and possible overspeed.

Given the likelihood of maintenance action, the engineers retrieved their laptop for access to the aircraft maintenance manual. [T]he flight crew made an entry in the aircraft maintenance log of ‘pitch disconnect in-flight’.  LAME 1 requested the flight crew include more information in the maintenance log. From his perspective, a pitch disconnect could be associated with a range of problems and he needed more information to make an engineering assessment. LAME 1 accessed the maintenance data display of the aircraft systems computer and printed off a post‑flight report and G-meter report. These reports confirmed the pitch disconnect and recorded a number-1 engine oil pressure low warning at the same time…There was no record of a VMO exceedance.

A 3.34g acceleration was also recorded which surprised the flight crew.

The crew added ‘associated with moderate turbulence’ to the maintenance log entry. LAME 1 established from the aircraft maintenance manual that the maximum ‘g’ was outside of the acceptable limits for the aircraft weight. As a result, he grounded the aircraft. He identified the applicable maintenance as the ‘Inspection after flight in turbulence and/or exceeding VMO’. This tasking was accepted by the LAMEs without any request to [the VARA] maintenance watch for technical advice or logistical support.

ATSB comment that at the time there was no specific inspection for a pitch disconnect and that…

…most of the time and effort required to carry out the ‘Inspection after flight in turbulence and/or exceeding VMO’ was associated with detailed visual inspection (DVI) of the wing attachment area. There was no DVI specified for the tail. The data from the quick access recorder was downloaded…and transferred electronically to VARA maintenance watch [and] forwarded to the ATR Airlines Technical Response Centre.  [T]he maintenance watch engineer on duty in Brisbane confirmed the inspection that would be required and arranged for the Sydney engineers to carry out that task.

ATSB they reveal that (our emphasis added):

Consistent with common practice at the time, maintenance watch did not issue any documentation to the engineers.

They comment that this implies that the inspection was not considered a complex task requiring stage sheets / worksheets.  In addition although the maintenance watch had become aware that the pitch disconnect was due to dual control inputs they did not pass that information to the line station.  Meanwhile:

…the senior base engineer took the opportunity to walk around the aircraft and look for damage.  During the walk-around the senior base engineer stood below the tail and looked up. No damage was observed.

The aircraft was towed to a remote stand for further inspection at 1837.  However:

LAME 1 and the senior base engineer had started duty at 0530 and 0730… For the day of the occurrence, the senior base engineer was rostered for an afternoon shift, which was the fourth consecutive afternoon shift of a five-day series. The senior base engineer had a 4 hours 30 minutes to 5-hour sleep opportunity the night prior to the occurrence then worked a 17-hour day [having] decided to start early [at 0600] to observe a propeller blade change on one of the ATR 72 aircraft [having finished 2230-2300 the previous evening] then continued into the afternoon shift. LAME 1… was also rostered for an afternoon shift, as the last of a five-day series, but in consultation with the senior base engineer began early at 0530 to perform the propeller blade change. He also continued into the afternoon shift. Given the duty finish at 2200 the night before and relatively short commuting time, the engineer had a sleep opportunity of 5 hours 30 minutes before the early start on the day of the occurrence. Both had exceeded the [MOE] duty time limit for a day’s work and had less than the minimum 10 hours recommended rest period the night before commencing work. The senior base engineer appeared to have had less than half the recommended rest period.

The two duty engineers stated in interview that such a long duty day was a very rare occurrence and their day had not been arduous between the time of the propeller change and the arrival of VH-FVR but did believe that they were becoming fatigued… Given this start time and the anticipated amount of work to conduct the turbulence/VMO exceedance inspection…the senior base engineer called in one of the other Sydney based engineers who had been on a rostered day off…(referred to as LAME 2)…

The maintenance watch had informed the line station that the aircraft was required for 0800 the next day.  LAME 2 had just had 3 days of rest and was due to return a day later.

On arrival at the TAE office sometime between 1830 and 1900, LAME 2 participated in a discussion with the senior base engineer and LAME 1 about the occurrence and requirements of the assigned inspection. The ATR job instruction card, JIC 05-51-11 DVI 10000 Inspection after flight in turbulence and/or exceeding VMO required a general visual inspection of the fuselage, stabilisers and wings, with more detailed inspections if any anomalies were found. A detailed inspection of the wing attachment fittings was also required irrespective of the results of the general visual inspection.

The discussion involving the LAMEs was not a formal shift handover and there was no record of the matters discussed nor any directions given. The senior base engineer recalled that he discussed the turbulence inspection with LAME 2. He also recalled he then advised that he and LAME 1 would help with the tasks that required more than one person, such as the removal of overhead lockers in the cabin to gain access to the wing attachment fittings. LAME 2 recalled that when he arrived at the office, the other engineers were printing job instruction cards for inspection of the wing attach fittings and discussing the requirements. He was advised that the g loading was outside of the acceptable limits and that maintenance watch had requested a turbulence inspection. LAME 2 recalled that the senior base engineer advised him he had carried out quite a detailed walk-around of the aircraft in daylight and found no signs of defects.

Based on this LAME 2 understood that the general visual inspection of the aircraft had been done and he was now only required to assist with a detailed visual inspection of the wing attachment fittings.  This was a crucial miscommunication.  The ATSB also note an”apparent lack of clarity as to the ongoing roles and responsibilities”.

Although the senior base engineer did not recall handing over the inspection to LAME 2…it was his intention to do so. LAME 1 recollections did not include any detail [and] LAME 2 recalled that there was no discussion about who was running the inspection or how the inspection would be coordinated.

The inspection commenced at about 2000 with LAME 1 assisting LAME 2 remove aircraft trim to access the wing attachment fittings.

The senior base engineer viewed his role during this period as keeping an overview, and providing support, without being completely involved in the inspection. For some of the time, the senior base engineer was attending to another matter. While the LAMEs were inspecting the aircraft, maintenance watch completed an event notification for ATR with the following event description (with ATSB editing for clarity):

During descent with autopilot engaged both pilots noticed the airspeed rapidly accelerate and have both reached for the controls causing pitch disconnect. During this event, the aircraft sustained 3.34 G in-flight acceleration causing the flight attendant to become injured.

The notification indicated that an in-flight turbulence inspection was being carried out and the pitch disconnect test had been carried out with nil defects reported. Maintenance watch subsequently transferred a copy of the QAR data to the ATR centre. At about 2200, the detailed visual inspection of the wing attach area was completed with nil defects identified. All of the engineers returned to the office and the two engineers who had been on duty for up to 16 hours 30 minutes, signed off at about 2230.

This was an exceptionally long duty period, considering their rest had been truncated by starting early too.

When the senior base engineer left the office, he considered the general visual inspections were still to be completed and this would be done by LAME 2.  [However] no arrangements were made by the senior base engineer or the LAMEs to borrow or hire a high-access platform…for close inspection of the horizontal stabilisers.

ATSB comment that

…TAE engineers did not have access to a high-access platform unless TAE maintenance planning issued a purchase order, and there is no evidence of such orders for six of the seven [prior] VMO exceedance inspections [examined by ATSB].

They go on that:

After attending to an arriving aircraft, LAME 2 returned to VH-FVR at about 2300. The engineer borrowed a nearby fixed-height stand to provide an elevated platform and positioned it to the rear of the left wing. That stand was described as the best he could get at that time and was of a height that provided a view of the top of the wing but not the top of the stabilisers. While on the stand, the engineer shone a torch over the upper surface of the wing, rear fuselage and tail. vhfvr atr72 cctv aircraft in work The engineer was on the stand for about a minute and the torchlight was directed to the rear fuselage and tail for a couple of seconds. No damage was identified.

ATSB, perhaps surprisingly, expressed concern that engineers might not be aware that a general visual inspection (GVI) of the stabilisers included a close examination of the upper surface. LAME 2 treated his work as a “a continuation” of an inspection started by the other engineers even though the prior senior base engineer inspection had not been signed for.

On reflection, LAME 2 described the external inspection he conducted as a final check prior to certification rather than the general visual inspection as specified in the job instruction card. The senior base engineer advised the ATSB that LAME 2 was not entitled to certify on his behalf and it was not standard practice for that to occur. At 2330, LAME 2 certified in the aircraft maintenance log that the Inspection after flight in turbulence and/or exceeding VMO was carried out in accordance with ATR JIC 05-51-11 DVI 10000, with nil defects evident. The engineer explained to the ATSB that he understood he was signing for the work carried out by himself and the other two LAMEs involved in the post-occurrence maintenance.

In further evidence of a lax approach to managing fatigue:

LAME 2 was rostered to start work at 0600 the next day [and] he was expecting that would be changed in response to his late finish. However, as LAME 2 was finishing up in the office, [he was asked to] start work at 0600, as rostered. LAME 2 agreed to the early start and signed off at about 2345.

He had just 5 hours sleep opportunity.

Post Incident Maintenance – 21 February 2014

LAME 2 started at 0600 with another engineer (referred to as LAME 3).  LAME 2 considers their alertness was “lower than the previous night’s…but not to a dangerous extent”.  They had however had less than half the TAE MOE recommended rest period. The two worked on other tasks on VH-FVR which included:

….an operational test of the pitch uncoupling mechanism re‑engagement system and a check that the pitch uncoupling mechanism had reconnected. On the basis that all of the maintenance log entries had been certified as closed, LAME 3 issued a certificate of release to service at 1330.

This was 5.5 hours later than originally requested but it appears the operator had been able to juggle the available aircraft satisfactorily.

Post Incident Maintenance – 21 – 25 February 2014

During the next 5 days the aircraft was operated on 13 flights and was subject to routine walk‑around visual inspections by flight crew and engineers, including:

  • Line check         21 February
  • Line check         22 February
  • Weekly check    23 February
  • Line check         24 February

These  included a visual inspection of the aircraft during a ‘walk-around’ at ground level. No defects were identified.

Given the distortion of the horizontal stabiliser that was visible on the CCTV footage of the aircraft before and after the maintenance was conducted, the ATSB considers that external indications of structural deformation would have been visible when the aircraft was inspected after the occurrence.

This is probably an optimistic expectation as the walkround would be too close for the difference in stabiliser angle to be as visible as it is on CCTV.

No one identified any anomalies until flight crew observed some damage after a suspected bird strike [on 25 February 2014]. [A] LAME, who was LAME 1 from 20 February, used scissor lift equipment to gain access to, and inspect the stabiliser. The LAME did not find any evidence of a birdstrike, such as blood or feathers. However, the LAME did find indications of significant structural damage to the horizontal stabiliser, and contacted maintenance watch to cancel the following flights.

Damaged Horizontal Stabiliser on VARA ATR72 VH-FVR (Credit: via ATSB)

Damaged Horizontal Stabiliser on VARA ATR72 VH-FVR (Credit: via ATSB)

Upon further examination and discussion with VARA, it became evident that the damage found at Albury was probably a consequence of the occurrence on 20 February. The aircraft was grounded and subjected to extensive maintenance that included replacement of the horizontal and vertical stabilisers.

ATSB comment that:

While the CAMO could have done more to assess the ongoing capability of TAE to conduct ATR 72 line maintenance, it is not clear that this would have altered the outcome of this occurrence.

Additionally:

The ATSB requested a copy of the Sydney line station diary entries for January and February 2014 but TAE advised they were unable to locate them.

Oddly ATSB avoids any mention of CASA’s oversight of the airlines or the maintenance organisation.

ATSB Analysis

The ATSB concluded that:

The LAMEs involved…did not carry out the general visual inspection of the stabilisers as specified probably because of a breakdown in the coordination and certification of the inspection tasks. As a result, the damage was not detected and the aircraft was released to service.

In addition, the ATSB identified other maintenance-related factors that increased risk:

  • ATR (aircraft manufacturer) did not provide a maintenance inspection to specifically assess the effect of an in-flight pitch disconnect. As a result, if an in-flight pitch disconnect occurred, the aircraft may not be inspected at a level commensurate with the criticality of the event. And, as a legacy of there being no inspection specific to an in-flight pitch disconnect, there is potential for other ATR aircraft to have sustained an in-flight pitch disconnect in the past and be operating with undetected horizontal stabiliser damage.
  • In the job instruction card JIC 05-51-11 DVI 10000 Inspection after flight in turbulence and/or exceeding VMO, ATR (aircraft manufacturer) did not specify the ground support equipment required or clearly state that the general visual inspection (GVI) of the stabilisers included a close examination of the upper surface. Given engineers tasked with the inspection may not be aware that ATR referred to the standard definition of a GVI, there was a risk that engineers tasked with the inspection would not interpret the card correctly.
  • Toll Aviation Engineering (approved maintenance organisation) did not define, document, or otherwise assure the intended arrangements for coordination of maintenance at line maintenance stations, which allowed for the development of local operating practices that were not consistent with the expectations of an approved maintenance organisation management.
  • Although Toll Aviation Engineering (approved maintenance organisation) specified fatigue management procedures, the licenced aircraft maintenance engineers (LAMEs) who were involved in the inspection after flight in turbulence and/or exceeding VMO operated outside the nominated hours of work. As such, the LAMEs were at risk of fatigue on the day of the inspection and/or the day following.

Initial Airworthiness Safety Actions

In March 2014, VARA issued an airworthiness memo about release to service of ATR aircraft following an in-flight pitch disconnect.

In June 2014, Toll Aviation Engineering (TAE) provided guidance to maintenance personnel about safety reporting. Later, in February 2016, Toll Aviation and TAE issued a safety alert to affected personnel to advise that an aircraft was to be grounded for maintenance after an in-flight pitch disconnect.

ATR released an All Operators Message in February 2016 to inform operators of revised maintenance and operational documentation relating to the pitch control system and pitch disconnect occurrences. The revised documentation included the requirement for a detailed visual inspection after an in-flight pitch disconnect. Before the occurrence, there was no inspection specifically provided for a pitch disconnect in-flight. After the occurrence, in September 2015, ATR issued job instruction card JIC 55-10-00 DVI 10000 ‘Detailed inspection of horizontal to vertical junction’ to be complied with following an in-flight pitch disconnect. This was followed in February 2016, by an All Operators Message (AOM: 42/72/2016/03 issue 1) to advise of the release of new maintenance documentation related to in-flight pitch disconnect occurrences. Later, in July 2016, ATR issued an All Operators Message (AOM: 42/72/2016/13 issue 1) to advise of stabiliser damage found during a scheduled maintenance check. ATR recommended in the AOM that operators perform a one-time inspection of the horizontal to vertical stabilizer junction as per the instructions in SB ATR42-55-0015 or ATR 72-55-1008 at the next convenient opportunity, no later than 6 months from release of the AOM.

On the matter of fatigue, in March 2015, TAE amended their procedures so that:

  • no scheduled shift is to exceed 12 hours
  • there is a maximum of 13 hours duty in a 24-hour period, extendable only with supervisor/manager approval
  • the minimum rest period of 11 hours

Other Safety Resources (Maintenance Human Factors / Maintenance Fatigue and Alertness)

Aerossurance has previously written on these associated topics:

UPDATE 30 December 2019: White Air ATR-72-212A CS-DJG, operating for TAP Portugal, landed at Fez on 6 July 2018 after an unstabalised approach according to Portuguese accident investigators (the Gabinete de Prevenção e Investigação de Acidentes com Aeronaves [GPIAA]) but struck its tail onto the runway, touching down hard (+2.88G).  The aircraft sustained abrasion damage to the  aft fuselage, deformation between frames 35-38, sheared rivets and wear on the tail-skid.

Fuselage Damage to White Airways ATR 72 CS-DJG (Credit: GPIAA)

Fuselage Damage to White Airways ATR 72 CS-DJG (Credit: GPIAA)

The Aircraft Commander prepared for the return flight by performing a walk-round, carrying out a general inspection, looking for problems on the main landing gear and checking the tail strut (‘pogo stick’) fitted under the bumper when parked.  He did not detect any anomalies and the aircraft was flown back to Lisbon before the damage was detected.  GPIAA comment on:

….excessive reliance on aircraft acceptance without sharing and discussing with the operator’s technical services [and a] organizational culture with inadequate or nonexistent procedures and individual centered decision-making without effective implementation of the CRM philosophy.


Flight Safety Foundation BARS Maintenance Observation Programme (MOP)

Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:

mop

Aerossurance and its partners can provide proven, practical expertise to successfully implement a MOP, introduce an effective competence assessment process or analyse the hazards of maintenance tasks before an occurrence.


Aerossurance has extensive air safety, operations, airworthiness, human factors, aviation regulation and safety analysis experience.  For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com