Rolls-Royce (R-R) is modifying Trent 700 oil pressure sensor systems to prevent misleading readings that have led unnecessary engine shutdowns, a U.K. Air Accident Investigations Branch (AAIB) incident report says.

The changes, one to Electronic Engine Controller (EEC) software and one to oil pressure measurement system hardware, would minimize the possibility that excessive engine vibration causes the system to deliver warning messages normally triggered by an oil pump failure.

Trent 700 oil pressure monitoring includes a safety mode that overrides actual pressure readings in certain circumstances, such as when sensors disagree. Designed to protect engine bearings when the oil pump fails, the mode delivers a low oil pressure warning on the flight deck’s Electronic Centralized Aircraft Monitoring (ECAM) system. It also displays the pressure level as zero on the engine’s instrument display.

However, conditions that are not oil pressure-related, such as vibration from a damaged fan or Integrated Drive Generator (IDG), also can trigger the mode, generating false cockpit warnings.

Procedures call for the crew to shut down the affected engine if the low oil pressure warnings persist. An engine shutdown also is the only way the safety mode-related zero oil pressure indication is reset.

There have been at least eight instances of vibration-induced low oil pressure warnings on Trent 700-powered Airbus A330s, AAIB says. Five were triggered by IDG failures, two stemmed from fan damage following bird strikes,and one combined an incorrect hardware configuration with vibration-inducing ice on the fan.

In six of the occurrences, the crew shut down an engine as a precaution.

The latest reported instance came in January, when a Virgin Atlantic A330 hit a flock of ducks while departing Orlando International Airport (MCO). The aircraft suffered “multiple birdstrikes” just after liftoff from MCO’s Runway 35L, an AAIB report on the incident says.

Almost immediately, a “significant vibration” was detected throughout the aircraft. The crew traced the vibration’s source to the left engine, which was generating an ECAM message. The message specified a low oil pressure warning, and the engine’s display indicated zero oil pressure.

The pilot monitoring then confirmed the messages and declared an emergency to air traffic control. The pilot flying increased the right engine’s thrust, shut the left engine down, and flew the plane safety back to MCO.

The time from the initial warning to engine shutdown was 1 min., 46 sec., AAIB says

Post-incident examination confirmed damage to, among other things, three left engine fan blades, AAIB says. “No defects” were found in the engine’s oil system, the agency adds.

“Initial investigation of these events by [R-R] suggests that vibration generated by a failing IDG, or higher than normal engine vibration, can produce fluctuations within the oil pressure transducer or its supply lines of sufficient magnitude and duration to trigger the EEC oil pump failure logic,” AAIB says. “The behavior of the oil pressure monitoring system during high vibration events continues to be investigated by the engine manufacturer.”

Before the Virgin Atlantic event, R-R had alerted Trent 700 operators “that high fan vibration or an IDG failure may trigger the EEC oil pump failure logic, which would result in an oil pressure reading of zero being presented to crews,” AAIB says. The manufacturer “also alerted operators and overhaul facilities of the possibility of occurrence through incorrect pipe support clipping,” which was a factor in at least one of the incidents, AAIB adds.

R-R says it is developing a change to Trent 700 EEC software and modifications to the system to reduce its sensitivity to vibration. “However, the engine manufacturer has not provided the AAIB with indicative timescales for the introduction of either of these two modifications,” AAIB notes, leading the agency to officially recommend the changes.

R-R’s Trent 800 has a similar oil pressure monitoring system to the Trent 700, but does not have a safety mode that sets pressure to zero if sensors disagree. In addition, a slightly different architecture minimizes the system’s sensitivity to vibration, AAIB says.