A388, en-route Batam Island Indonesia, 2010 (LOC AW)

From SKYbrary Wiki

Summary

On 4 November 2010, a Rolls Royce Trent 900-powered Airbus A380 which had just departed from Singapore was climbing through 7,000 ft when the No 2 engine suddenly suffered an uncontained failure. After careful preparation due to the complex collateral damage, the augmented flight crew made a successful air turnback. After coming to a stop, there were difficulties with engine shutdown which delayed passenger disembarkation. Investigation is ongoing but the engine failure has been attributed to a component manufacturing fault which the engine manufacturer had failed to identify.

Description

On 4 November 2010, a Trent 900 powered Airbus A380-800 being operated by Qantas on a scheduled passenger flight from Changi Airport, Singapore to Sydney Australia was passing 7000 feet2,133.6 m in the climb in day VMC when an uncontained failure of the No 2 engine occurred. A PAN call was made to ATC and a return to Singapore initiated whilst the flight crew collectively responded to multiple secondary effects as well as the engine failure. Initially, in order to accomplish the minimum necessary actions, a holding pattern in the vicinity of the airport was flown. A challenging but uneventful approach and landing were subsequently accomplished and the aircraft was stopped on the runway. It then became apparent that the No. 1 engine could not be shut down which delayed the precautionary disembarkation of the passengers using stairs brought to the right hand side of the aircraft. None of the 469 occupants were injured but some of the debris which had fallen from the aircraft at the time of the engine failure caused minor injuries to two people on the ground. There was obvious evidence of extensive damage to the failed engine and lesser damage to the adjacent airframe structure.

Investigation

After formal delegation from the State of Occurrence, the Indonesian NTSC, an investigation was opened by the ATSB. Attention was focused on establishing the direct cause of the catastrophic engine failure and factually establishing the consequences. A Preliminary Report including one Safety Recommendation relating to engine airworthiness (see below) was issued on 3 December 2010.

The Preliminary Report noted from recorded data that the aircraft had touched down 1 hour 45 minutes after the engine failure and come to a stop about 150 metres from the end of the 4000 metre runway. It also noted that passenger disembarkation had not commenced until about 50 minutes after landing and then taken about 50 minutes to accomplish. All attempts to shut down the No 1 engine had failed and the decision was eventually taken to drown the engine with fire-fighting foam supplied by the RFFS vehicles present which achieved shutdown just over two hours after landing.

The aircraft flight path, reproduced from the Preliminary Report, is shown below - a departure from runway 20C at Singapore, then a left turn over Batam Island to take up a racetrack hold to the east of Singapore prior to a final approach to land back on the same runway.

Aircraft track superimposed on a ground map

The complex situation which the flight crew had faced following the failure was noted as was the presence in the flight deck of an exceptional compliment of on-duty flight crew. In addition to the operating crew of a Captain as pilot in command and a First Officer acting as co-pilot, and a routinely-rostered Second Officer, there was also a trainee Check Captain performing a routine Line Check on the aircraft commander whilst being overseen by a Supervising Check Captain.

The Investigation team was advised by the flight crew of their recollection of the initial sequence of events:

• The first indication of a problem was two, almost coincident ‘loud bangs’, following which the aircraft commander as PF selected ‘ALT’ and ‘HDG’ modes on the Autopilot Control Panel
• Although the autothrust system was engaged, it did not function and as the aircraft levelled off, manual thrust reduction was necessary
• An annunciation of No 2 Engine Overheat was displayed on the ECAM and the thrust on that engine was reduced to Flight Idle as required by the applicable drill
• Multiple further ECAM^[1] messages followed and, having confirmed to the other crew members that he was maintaining control, the aircraft commander called for the commencement of the requisite ECAM actions by the co pilot
• A PAN call was made to ATC and an intention to return to Singapore was advised
• Following a transient engine fire warning for the No 2 engine, it was shut down and discharge of the first fire bottle selected
• After no indication that the selected fire bottle had actually discharged, the second fire bottle was selected with a similar outcome
• After review, the remainder of the engine failure procedure, including selection of an automated process for fuel transfer between tanks, was actioned

The flight crew recollection of the huge number of ECAM systems warnings after the failure of the No 2 engine (yet to be verified by reference to recorded data) was as follows:

• Engines 1 and 4 operating in degraded mode (some air data or engine parameters are not available)
• GREEN hydraulic system (powered by engines 1 & 2) - low system pressure and low fluid level
• YELLOW hydraulic system (powered by engines 3 & 4) - engine 4 pump errors
• Failure of AC bus 1 and AC Bus 2
• Flight controls operating in alternate law (some flight control protections reduced)
• Wing slats inoperative
• Reduced aileron control
• Reduced spoiler control
• Landing gear control and indicator warnings
• Multiple brake system messages
• Engine anti-ice and air data sensor messages
• Multiple fuel system messages, including a fuel jettison fault (the latter fault precluded the jettison of fuel which would normally be made when a long haul air turn back is made to avoid a significantly overweight landing)
• Centre of gravity messages
• Autothrust and Autoland inoperative

The Preliminary Report also included a summary of the secondary damage to the aircraft. Engine components ejected from the No 2 engine were found to have either struck the aircraft or been lost overboard. Sections of the intermediate pressure (IP) turbine disc were found to have penetrated the leading edge of the left wing inboard of the failed engine and caused damage to the leading edge, the front wing spar and the wing upper surface. A small section of turbine disc was also found to have penetrated the left wing-to-fuselage fairing and caused damage to numerous system components, the fuselage structure and parts of the electrical wiring. Released debris was also found to have impacted the lower surface of the left wing causing a fuel leak from the No 2 engine fuel feed tank and left wing inner fuel tank. Other impact damage was found to:

• the No 2 engine pylon
• the No 1 engine casing
• the left fuselage keel beam support splice
• the left wing false spar
• a small area on the left side of the aircraft fuselage.

Some of the impact damage was found to have affected aircraft systems including:

• the electrical wiring supporting the operation of the hydraulic system, landing gear and flight controls
• a number of fuel system components
• the leading edge slat system
• Engine 1 Generator drive disconnected
• Left wing pneumatic bleed leaks
• Avionics system overheat.

The flight crew reported that having discussed the recovery of the aircraft, it was decided that they should remain at their current altitude (7400ft) and obtain ATC permission to carry out a extended racetrack hold for about 30 minutes in the vicinity of Singapore in order to deal with the ECAM messages whilst being able to make an immediate approach to land if necessary.

Whilst the ECAM actions were being carried out, the Second Officer had been sent into the passenger cabin to visually assess the damage to the No 2 engine and had reported seeing damage to the left wing and fuel leaking from that wing. In the light of this information and their assessment of multiple fuel system ECAM messages, the crew had decided not to initiate some further fuel transfer actions which were the normal response to a number of those messages because of their uncertainty about the integrity of the fuel system.

Completion of the initial procedures associated with the ECAM messages eventually took about 50 minutes and was followed by an assessment of the status of all the aircraft systems to determine the implications for approach and landing. It was also suspected that Engine 1 may have been damaged and a review of the lateral and longitudinal fuel imbalances indicated by the ECAM was made.

Since the calculated landing performance was close to limits - indications were that the aircraft would stop with 100 m of runway remaining with reverse thrust only available from one instead of the usual two engines - the cabin crew were given a precautionary brief to prepare the cabin for a possible runway overrun and evacuation.

Prior to leaving the holding pattern, the controllability of the aircraft was verified by a number of manual handling checks at the holding speed. The approach was initially made with Autopilot engaged but after un-commanded disconnects, the last 1000 ft was flown manually.

The Investigation is still ongoing but an Interim Factual Report was issued on 18 May 2011. This noted that a simulation of the flight following the engine failure based on the available recorded evidence and flight crew accounts had confirmed that the aircraft had remained in Normal Law thus ensuring that flight envelope protections had remained in place throughout.

It also confirmed that the IP turbine disc had failed as a result of an overspeed condition, with pieces of the IP turbine disc then penetrating the engine case and wing structure. The disc failure was found to have been initiated by a manufacturing defect in an oil feed pipe which caused a reduction in pipe thickness and led to a fatigue crack which caused an internal engine oil fire that weakened the IP turbine disc. A circumferential fracture was induced around this disc which led to it separating from the turbine shaft and the unrestrained disc then accelerated to a speed which caused the No 2 engine failure and led to the subsequent significant penetration damage to the parts of the airframe structure and a number of aircraft systems. Further investigation showed that the location of the fatigue cracking and misaligned pipe counter bore was not as had been identified in the Preliminary Report but instead as shown in the illustration below.

The revised location of the fatigue cracking, reproduced from the Interim Factual Report

It was found that three progressively modified versions of the failed oil feed pipe were in service and that for the earliest one, which included the failed one, Rolls Royce had no records to show whether production examples had met the ‘minimum acceptable manufacturing’ standard. Incomplete records were available for the second version but complete ones for the version currently being installed on new engines. One of the latter batch was found not to have met the manufacturing standard. As a result of this, replacement of all in-service oil feed pipes except those with measurement records meeting the manufacturing standard have been replaced. As a consequence of this, the Investigation is now looking at the effectiveness of the applicable Quality Assurance process.

The Interim Factual Report advised that ongoing work would include:

• the testing and analysis of the black-coloured soot residue that was found in the left wing internal (No 2) fuel tank.
• additional analysis of the flight simulation test data
• a detailed examination of the secondary airframe and systems damage
• an analysis of the flight crew work load
• a review of the maintenance history of the aircraft and its engines.

Early in the Investigation, it was considered that any more misaligned stub pipe counter-borings like the one found in the failed engine and understood to be associated with the manufacturing process would represent an increased risk of fatigue cracking which could lead to oil leakage and catastrophic engine failure from any resulting oil fire. One Safety Recommendation was therefore issued on 1 December 2010 and included in the Preliminary Report:

• that Rolls-Royce plc address (the identified critical safety issue - the risk to the integrity of the failed oil feed stub pipes) and take actions necessary to ensure the safety of flight operations in transport aircraft equipped with Rolls-Royce plc Trent 900 series engines. [AO-2010-089-AR-012]

The ATSB currently stated early on 19 January 2012 that they anticipated publication of the Final Report of the Investigation “in the third quarter of 2012”.

Related Articles

• Airworthiness
• Uncontained Engine Failure
• Quality Assurance

Further Reading

• ATSB Aviation Occurrence Investigation - AO-2010-089 Preliminary published 3 December 2010.
• ATSB Aviation Occurrence Investigation - AO-2010-089 Interim Factual published 18 May 2011.

Notes

1. ^ Electronic centralized aircraft monitor