Failures in Aviation - Lessons for Healthcare

Engine failures and other safety issues often witnessed in the aviation industry provide some valuable lessons for healthcare. These include:

Importance of Training and Standard Procedures: Like in aviation, healthcare professionals must undergo rigorous training and adhere to standard procedures. Proper training ensures healthcare professionals have the knowledge and skills to handle unexpected situations effectively.

Effective Communication: Communication is vital in both aviation and healthcare settings. Clear and open communication among healthcare team members and patients helps them understand the situation, share critical information, and make informed decisions.

Situation Awareness: Healthcare providers should maintain a high level of situation awareness, which involves being aware of the patient's condition, available resources, and potential risks. Utilising all available information and engaging in procedural checklists can aid in preventing and managing adverse events.

Decision-Making in Unexpected Situations: In healthcare, as in aviation, unexpected situations may arise. Effective decision-making is essential to manage such cases appropriately. Healthcare professionals should consider all available options, evaluate risks, and decide on the best course of action to ensure patient safety and prevent additional complications.

Review and Continuous Improvement: Regularly reviewing procedures and actions are essential to ensure that best practices are maintained and adapted to changing circumstances. Continuous improvement initiatives can help healthcare organisations identify areas for enhancement and optimise patient care.

Preservation of Critical Data: In the incident report, the inadvertent overwrite of the cockpit voice recorder resulted in the loss of critical information. Healthcare organisations should prioritise preserving essential data, including patient records and incident reports, to support investigations and improve patient safety.

Managing Workload: Managing workload and prioritising tasks become crucial in high-stress situations, such as an unexpected engine failure or a medical emergency. Healthcare professionals should be trained to handle stress and effectively manage their workload to provide safe and quality care.

Risk Assessment and Mitigation: Like aviation safety assessments, healthcare organisations should conduct comprehensive risk assessments to identify potential hazards and implement mitigation strategies to prevent adverse events and medical errors.

Ethical Considerations: In both aviation and healthcare, ethical considerations are significant. Healthcare providers must prioritise patient welfare and make decisions based on the patient's best interests.

By learning from aviation incidents and adopting similar principles, the healthcare industry can enhance patient safety, improve communication, and minimise adverse events to provide the best possible care to patients.

REAL CASE EXAMPLE

What happened

On the afternoon of 18 January 2023, a Boeing 737-838 aircraft, registered VH-XZB and operated by Qantas, departed Auckland, New Zealand on a scheduled passenger service to Sydney, Australia. While in the cruise, about 1 hour and 24 minutes after departure, there was an uncommanded shutdown of the left engine. Due to their location at the time, the flight crew declared a MAYDAY, to prioritise communications with air traffic control and to ensure they were cleared for an immediate descent to flight level 240 (24,000 ft). The engine could not be restarted in-flight, and the flight crew conducted an uneventful single-engine landing at Sydney Airport about 1 hour later.

What the ATSB found

The engine examination identified separation of the radial driveshaft (located in the inlet gearbox), which resulted in a mechanical discontinuity between the engine core and accessory gearbox. Loss of drive to the accessory gearbox resulted in a loss of fuel pump pressure and uncommanded shutdown of the engine. There was also secondary damage to some components as the engine shut down. In addition, the failed driveshaft prevented the engine restarting in-flight. 

Further, the ATSB found that the cockpit voice recorder was inadvertently overwritten during maintenance activities conducted after the aircraft arrived at Sydney Airport.

What has been done as a result

As a result of this incident, Qantas has enhanced their procedures to prevent inadvertent overwrite of cockpit voice recorders and flight data recorders.

Safety message

It has been well established that the importance of training, following standard procedures, and effective communications are crucial to aviation safety. This incident highlighted the positive benefits of effective decision-making and management of an unexpected situation. Such actions are best demonstrated by:

• maintaining a high level of situation awareness, utilising all sources of information, via procedural checklists and communications, including with cabin crew and air traffic control
• consideration of all options and evaluation to decide the best course of action to ensure additional operational difficulties are not inadvertently introduced
• a frequent review to ensure appropriate actions are being maintained throughout changing circumstances.

In addition, operators need to ensure correct procedures are in place to protect information recorded during the flight that enhances the accuracy and effectiveness of a safety investigation.

The investigation

The occurrence

On the afternoon of 18 January 2023, a Boeing 737-838 aircraft, registered VH-XZB and operated by Qantas Airways, was being prepared for a scheduled passenger service from Auckland, New Zealand to Sydney, Australia. On board were 2 flight crew, 5 cabin crew and 143 passengers. The captain was designated as the pilot flying and the first officer was the pilot monitoring.[1]

The captain reported that the pre-flight briefing package identified good weather conditions for Auckland, en route, and Sydney. The weather forecast for additional airports was also included, in case of the requirement for a diversion. The flight was dispatched as an extended diversion time operations (EDTO)[2] flight authorised to operate up to 180 minutes or 1,200 NM (2,222 km) from an alternate aerodrome. The required EDTO maintenance had been completed in Auckland. This inspection included engine and auxiliary power unit (APU)[3] oil quantity checks, and a review of recent oil consumption records. The aircraft departed Auckland at 1430 local time and reached a cruise altitude of flight level (FL)[4] 360 about 20 minutes later.

The flight crew reported that they carried out an EDTO brief before entering the EDTO segment. The EDTO briefing included that, in the event of an engine failure, Auckland and Sydney were the primary airports.

After about 1 hour in the cruise, the flight crew transferred high frequency (HF) radio communications from Auckland to the en route controller at Brisbane Centre (en route controller).[5] Once the en route controller accepted monitoring of the aircraft, the flight crew requested to climb to FL 380. About 3 minutes later, and before the climb was authorised, the flight crew reported hearing a ‘pop’ sound, followed by the autopilot and auto throttle disengaging, with associated warning lights and horn. They then identified left (#1) engine was not operating. The flight crew broadcast MAYDAY,[6] citing an engine failure and requested an immediate descent to FL 240. The en route controller enquired if it was a single or double engine failure, to which the flight crew confirmed a single-engine failure (Figure 1). About 1 minute later, the en route controller authorised a descent to FL 240 when ready.

Figure 1: Map showing VH-XZB flight path and location of the engine failure

Source: APS Flight Analysis System (FAS) using Cesium, annotated by the ATSB

At the same time, following the completion of cabin service, the cabin safety manager (CSM) heard a noise and felt the aircraft yawing in a manner they described as ‘not normal’. After confirming that the cabin crew member next to them had also experienced the event, the CSM advised that they called the flight deck. The captain answered and advised the CSM that they could not talk at that moment as an engine had just failed. The CSM then called the cabin crew team leader at the rear of the cabin to inform them of the situation.

About 5 minutes later, the captain called the CSM to the flight deck and explained the situation, in that the left engine had shut down uncommanded and they were unsure why. The captain further advised that the aircraft was operating safely on one engine, and they were working through the engine failure, and associated checklists. The captain requested that the CSM relay this information to the cabin crew, monitor the passengers and to advise the flight deck if anything changed in the cabin.

Soon after, the CSM advised the flight crew that the cabin was getting quite warm[7] and power was not available to various galley equipment and the rear bathrooms.[8] The APU had been selected to ‘on’ as part of the engine failure checklist, however, cabin airflow had been affected. The flight crew reported they then selected the temperature controller to minimum and conditions improved.

The flight crew continued working through the non-normal checklists, while on a slow descent. Following authorised descent to FL 200, and with all checklists completed, the flight crew decided to attempt the in-flight engine restart checklist. While the first few steps were accomplished, the engine start attempt had to be aborted when a designated parameter could not be achieved. The flight crew then consolidated their plan and prepared for a single-engine landing at Sydney.

Throughout the descent into Sydney, en route and Brisbane Centre air traffic controllers[9] maintained contact with the flight crew, with scheduled check-in times to ascertain location details, operational status, and updates to any requirements in Sydney.

Just prior to top of descent, the flight crew advised Brisbane Centre they were downgrading from a MAYDAY to PAN PAN[10] but would still like aviation rescue fire-fighting services to attend and inspect the left engine before they proceeded to the terminal. Shortly after, air traffic control (ATC) communications were transferred to Sydney.

At about this time the captain made an announcement to the passengers, stating:

• they were to commence the descent into Sydney in a few minutes time
• acknowledging there were some issues with one engine that was affecting the air-conditioning and some electrical systems
• once on the ground, emergency services would attend the aircraft to inspect the engine, as a precaution, before they proceeded to the terminal
• reassuring them that everything was okay, and they would make another announcement once on the ground.

Following an uneventful landing at Sydney at 1526 local time, emergency services met the aircraft on the taxiway. Once cleared, the aircraft was taxied to the terminal, where engineering personnel conducted an additional inspection before the airbridge was positioned. At this point, the captain made a further announcement advising that they had experienced an engine failure about 1 hour out of Sydney. The captain thanked the passengers for their patience and understanding. In addition, the flight crew exited the flight deck and personally addressed each passenger as they disembarked.

Context

Personnel information

The captain held an Air Transport Pilot (Aeroplane) Licence, a current Class 1 Aviation Medical Certificate, and had accumulated 12,335 hours of aeronautical experience. Of this, about 1,620 hours were on the Boeing 737 type, and the captain had logged 230 hours in the preceding 90 days.

The first officer also held an Air Transport Pilot (Aeroplane) Licence, a current Class 1 Aviation Medical Certificate, and had accumulated 10,540 hours of aeronautical experience. Of this, about 794 hours were on the Boeing 737 type, and they had logged 165 hours in the preceding 90 days.

The training records showed the most recent full flight simulator session for the captain was completed in September 2022 and for the first officer in October 2022. In addition, the captain had practiced one engine inoperative situations (including during the cruise, missed approach and landing phases of flight) in November 2020, with the first officer completing this training in February 2022.

The flight crew reported being well rested and alert at the commencement of duty for the flight and there was no evidence to indicate that fatigue affected their performance during the flight.

Aircraft and engine information

General information

VH-XZB was a Boeing Company 737-838 aircraft, powered by 2 CFM56-7B26E[11] high bypass turbofan engines. The engine is a dual-rotor, axial-flow turbofan. The N1 refers to the rotational speed of the low-speed spool, which consists of a fan, a low‑pressure compressor and a low‑pressure turbine. N1 is the primary indication of engine thrust. The N2 refers to the rotational speed of the high-speed spool, which consists of a high-pressure compressor (HPC) and a high‑pressure turbine. The N1 and N2 rotors are mechanically independent. The N2 rotor drives the engine gearboxes.

When the engine is running, the accessory drive system extracts part of the core engine power, from the HPC (or N2) and transmits it through a series of shafts and gearboxes, to drive the engine and aircraft accessories, including the:

• fuel pump and hydromechanical unit
• hydraulic pump
• integrated drive generator.

The starter, also located on the accessory gearbox, used the same gearboxes and shafts to drive the HPC for engine start, either on the ground or in-flight.

Engine examination

An engine teardown inspection was conducted by the engine manufacturer at their technical facility in Malaysia and was observed by Qantas and the Air Accident Investigation Bureau Malaysia (on behalf of the ATSB). The examination identified that the inner radial driveshaft separated at 2 locations, at the mid-length bearing and near the upper spline (Figure 2). Subsequently, the mechanical discontinuity between the HPC shaft and accessory gearbox resulted in loss of fuel pump pressure and uncommanded shutdown of the engine. The mid-length bearing oil feed nozzle appeared clear (nil blockage). There was secondary damage to some components as the engine spooled down.

The failed driveshaft also prevented the starter from driving the HPC, which prevented the in‑flight engine restart.[12]

Figure 2: CFM56-7B engine, showing the accessory gearbox location, associated driveshafts and failure locations (red line)

Source: Operator, annotated by the ATSB

The manufacturer advised that the level of deterioration of the failed driveshaft and mid-length bearing prevented identification of the separation initiator. Further, the inner driveshaft oil supply features were destroyed by the bearing failure and therefore its condition at the time of the event could not be determined. Nevertheless, the engine manufacturer reported that the rupture of the inner driveshaft was considered the primary failure.

It was noted that the CFM56-7B world engine fleet had reported 7 similar radial driveshaft bearing events since 2012. However, there was no consistent component time accumulation prior to the failure. At the time of this incident, the approximate totals for the worldwide fleet were 15,200 engines, with 500 million hours in-service and 258 million cycles in-service.

Engine maintenance requirements

The engine oil system included scavenge screens and magnetic chip detectors that could collect any debris suspended in the oil. Metal contamination of the oil could be indicative of abnormal wear or impending failure of a component. Any metal contamination was to be examined to identify its origin and ascertain the quantity of the material. The engine manufacturer’s procedures then detailed steps to monitor or replace the affected component. In addition, an increase in oil consumption would require further inspection as per maintenance procedures.

The left engine was the original engine for the aircraft and had not been subject to any major repairs or overhaul. On 11 December 2022, a 500-hourly inspection was completed on the left engine oil system. This included a detailed inspection of the forward sump, aft sump, accessory and transfer gearboxes magnetic chip detectors and scavenge screens for debris and/or metal contamination. Further, the EDTO inspection completed in Auckland on 18 January 2023 included a review of the engine oil consumption over the previous 10 flights, to ensure it was within prescribed limits. Maintenance records indicated no metal contamination was identified and the oil consumption was within prescribed limits.

Recorded information

The cockpit voice recorder was downloaded at the ATSB’s technical facilities in Canberra. However, as the aircraft had been powered for maintenance activity following arrival at Sydney Airport, without the cockpit voice recorder being isolated, the audio data recorded during the incident flight was overwritten and not available for this investigation.

Data from the flight data recorder and quick access recorder was provided to the ATSB by the operator. The data showed that, 1 hour and 24 minutes after take-off from Auckland, the left engine abruptly shut down uncommanded. Further analysis of the data did not identify any appreciable changes to engine parameters, such as vibrations or temperature increase, prior to the failure. The flight crew also reported that there were no adverse indications prior to the sudden engine shutdown.

Operational procedures

Declaration of MAYDAY and PAN PAN

The operator’s procedures defined a MAYDAY and PAN PAN call consistent with the international standards as:

• MAYDAY: A condition of being threatened by serious and/or imminent danger and requiring immediate assistance.
• PAN PAN: A condition concerning the safety of an aircraft or other vehicle, or some person on board or within sight, but which does not require immediate assistance.

The flight crew considered the following regarding their decision to declare a MAYDAY:

• their location mid-way between Auckland and Sydney, and considerable distance to any other suitable airport
• desire to establish priority communication with Brisbane Centre via HF, which the flight crew reported could be busy and unreliable at times[13] (there was no satellite communication on the aircraft, therefore, HF radio was the only means of communication with ATC at that time)[14]
• requirement to ensure the airspace was clear for an immediate descent to an optimal altitude for single-engine operation and aircraft controllability
• uncertainty of the reason for the uncommanded shutdown and whether the remaining engine may also be affected.

Further, the flight crew advised that their decision to downgrade to a PAN PAN was based on the following:

• their reducing distance to their destination, and effective very high frequency communications with Sydney ATC
• all checklists were completed
• continued stable operation on one engine
• single-engine landing at Sydney had been planned and briefed by the flight crew.

Decision to continue to Sydney

The final step in the engine failure or shutdown checklist stated ‘plan to land at the nearest available airport’. The operator’s procedures stated that, ‘in a non-normal situation, the pilot-in-command, having the authority and responsibility for operation and safety of flight, must make the decision to continue the flight as planned or divert’. The procedures also stated considerations should include suitability of nearby airports in terms of facilities and weather, in decision-making where ‘the safest course of action is divert to a more distant airport than the nearest airport’.

At the time of the engine failure, the aircraft was located about (distance from) (Figure 3):

• Auckland 611 NM (1,132 km) and a 180° turn
• Sydney 560 NM (1,037 km) continuing on the current track
• Williamtown/Newcastle 550 NM (1,019 km) with a slight diversion to right of track
• Norfolk Island 484 NM (896 km) and a 115° right turn.

Figure 3: Engine failure location with respect to the 400 NM (741 km) EDTO radius from nearby alternate airports

Source: Google Earth, annotated by the ATSB

The Qantas Route Manual Supplement section for Norfolk Island noted several difficulties associated with the airport including:

• ‘actual weather can change rapidly and vary from forecast’ and a diversion to Australia may be required
• high terrain near the airport and rising terrain at the end of runway 11 could result in the illusion of being too high on approach
• strong winds in February and March could produce severe turbulence
• no mobile services
• the supplement-authorised runway at Norfolk Island was identified as 1,950 m long.

The flight crew reported that Sydney was on their direct route, the forecast weather conditions were more favourable, and the airport offered extensive emergency response (if required). In addition, their planned runway for landing was on a straight-in approach and 3,962 m long. The flight crew therefore elected to continue to Sydney.

Flight and cabin crew training

The captain and CSM had flown together previously, however, it was the first time either of them had flown with the first officer. The flight crew and CSM reported that the operator’s crew resource management training, which was conducted with flight and cabin crew combined, fostered an understanding of each area of operation, enabling openness and free-flowing sharing of information between the flight deck and cabin. In addition, role-specific training and use of standard procedures allowed them to each focus on their required tasks during an unanticipated situation.

Safety analysis

While in cruise, about 1 hour and 24 minutes from departure and without command, the left engine shut down. The flight crew reported they did not detect any change in parameters, which may have alerted them to an impending engine issue. This was consistent with the recorded data, which showed there was no warning. In addition, recent maintenance was indicative of a normally operating engine. The reason for the uncommanded shutdown was later established as being the result of the separation of the radial driveshaft. The mechanical discontinuity between the engine core and accessory driveshaft resulted in loss of fuel pump pressure and the subsequent engine failure. The driveshaft failure also prevented the engine restart.

While Norfolk Island was closer at the time of the engine failure, a diversion required a deviation from their current track. In addition, Norfolk Island presented changeable weather and operational conditions. In contrast, Sydney Airport was on their direct route, had favourable weather conditions forecast, had an extensive emergency response, and a straight‑in approach on a very long runway. The flight crew’s decision to continue to Sydney ensured no additional risk was added to an already high workload situation.

The ATSB publication Black box flight recorders highlights the benefits of aircraft flight recorders such as the cockpit voice recorder, by creating a record of the total audio environment in the cockpit area. This includes crew conversations, radio transmissions, aural alarms, and ambient cockpit sounds, check list management, and decision making. As highlighted in the ATSB’s publication, around 80% of aircraft accidents involve human factors, which means that crew performance may have contributed to some events. As a result, the cockpit voice recorder often provides accident investigators with invaluable insights into why an accident occurred. In this case, the recorded audio of this incident was inadvertently overwritten during maintenance operations. However, flight data was available and was found to be consistent with the flight crew’s recollections and ATC audio recordings.

Findings

From the evidence available, the following findings are made with respect to the engine failure involving Boeing Company 737-838, VH-XZB, en route between Auckland, New Zealand and Sydney, Australia, on 18 January 2023.

Contributing factors

• During cruise, separation of the radial driveshaft led to a mechanical discontinuity between the engine core and accessory gearbox. This resulted in loss of the accessory gearbox-driven main fuel pump pressure and uncommanded shutdown of the left engine. In addition, the failed driveshaft prevented the engine from being restarted in-flight. 

Other findings

• Based on the more favourable forecast weather conditions and operational requirements, the flight crew decided to continue to Sydney rather than divert to Norfolk Island, which ensured that no additional risk was added to an already high workload situation.
• The cockpit voice recorder was inadvertently overwritten during maintenance activity following the incident flight. Although not critical to this investigation, this information could have provided direct evidence regarding the flight crew's coordination, check list management, and decision making throughout the flight.

Safety actions

Safety action by Qantas addressing preservation of cockpit voice recorders following an occurrence

Qantas have advised they are taking the following safety action in response to this incident. When a request is received to secure the cockpit voice recorder and/or flight data recorder, the following steps are to be carried out:

• immediately notify the duty technical manager to raise a task in the maintenance software to have the requested item quarantined (or at a minimum, power to the recorders is to be removed)
• follow up with a telephone call to the respective port and ensure the ground engineer is advised of the limited timeframe to secure the data
• continually follow up with the applicable ports until positive confirmation of the requested action has been confirmed.

Source: Australian Transport Safety Bureau

Image Credit: iStock