An oil pipe that was improperly milled during the manufacture of an Airbus A380’s Rolls-Royce engine developed a fatigue crack that eventually leaked oil, causing a fire inside the no. 2 engine that spurred the violent breakup of a turbine disc as the aircraft departed from Singapore for a flight to Sydney, Australia, the morning of Nov. 4, 2010. Portions of the turbine disc penetrated the engine case and perforated the wing, ripping open a fuel tank and severing large bundles of electrical wiring.
In its final report on the accident, the Australian Transport Safety Bureau (ATSB) commended the Qantas Airways crew for safely returning the crippled aircraft and its 440 passengers to Singapore. “The flight and cabin crew managed the event as a competent team in accordance with standard operating procedures and practices,” the report said.
The uncontained failure occurred in a Rolls-Royce RB211 Trent 972-84 engine. The investigation revealed that “numerous other engines” in the Trent 900 series had the same type of defect — an oil feed stub pipe with a wall section that was thinner than prescribed by the design specification. Investigators found that the discrepancy in the accident aircraft’s engine was not detected or was not reported during manufacture and subsequent inspections.
Qantas Flight 32
Airbus A380
The A380, introduced in 2007, is the largest commercial aircraft currently in operation. As of May 2013, the aircraft was in service with nine airlines worldwide. The double-deck, widebody cabin accommodates up to 525 passengers in three-class configuration or 853 passengers in single-class configuration.
The four-engine aircraft is equipped with either Engine Alliance GP7200 or Rolls-Royce Trent 900 series high-bypass turbofans rated at 311 kN (69,932 lb).
Maximum fuel capacity is 320,000 L (84,544 gal). Range is 15,700 km (8,478 nm), and maximum operating speed is 0.89 Mach.
Composite materials are used in 25 percent of the A380’s structure. Maximum weights are 562 tonnes (1,236,400 lb) on the ramp, 560 tonnes (1,232,000 lb) for takeoff and 386 tonnes (849,200 lb) for landing.
Source: Airbus
The aircraft was being operated as Qantas Flight 32. The A380-842, registered in Australia as VH-OQA, was manufactured in 2008 and had accumulated 8,533 total hours and 1,843 cycles.
There were five flight crew members and 24 cabin crewmembers aboard the aircraft when it departed from Singapore’s Changi Airport at 0956 local time. Visual meteorological conditions prevailed in the area.
The captain had flown Airbus A330s and Boeing 747s before upgrading to the A380 in April 2008. He had 15,140 flight hours, including 570 hours in type. The first officer, a former A330, A340, 747 and 767 pilot, began flying the A380 in August 2008. He had 11,280 flight hours, with 1,271 hours in type. The second officer was a 747 pilot before upgrading to the A380 in February 2009. He had logged 1,006 of his 8,153 flight hours in type.
The primary flight crew was accompanied on the flight deck by two check captains, one of whom was supervising the training of the other pilot in the A380. Both check captains had more than 17,000 flight hours and 800 hours in type.
‘High-Energy Debris’
The aircraft was climbing through 7,000 ft over Batam Island, Indonesia, about four minutes after takeoff, when an oil feed stub pipe in the no. 2 (left inboard) engine’s high-pressure/intermediate-pressure (HP/IP) turbine bearing chamber leaked oil that ignited in the hot chamber.
The resulting fire caused the intermediate-pressure turbine disc to separate from the driveshaft. “The disc accelerated and burst with sufficient force that the engine structure could not contain it, releasing high-energy debris,” the report said.
A large fragment of the turbine disc penetrated the leading edge and the front spar of the left wing, and tore through the left inner fuel tank before exiting the top of the wing. The fragment initiated a flash fire inside the wing tank, and an oil fire occurred in the lower cowling of the no. 2 engine; however, both fires quickly self-extinguished.
The ejected debris damaged several aircraft systems, and that damage in turn affected a number of other systems. “Although some systems sustained direct mechanical damage, most of the affected systems were damaged through debris impact to the respective wire looms,” the report said. “Two main wiring looms were impacted by debris; one running through the leading edge of the left wing and the other in the belly fairing.” About 650 wires were damaged by the debris.
Loud Bangs
The flight crew heard two loud bangs when the uncontained engine failure occurred and then saw the electronic centralized aircraft monitor (ECAM) display fill with warning messages.
Among the initial messages were: turbine overheat in the no. 2 engine, degraded operation of the no. 1 and no. 4 engines, low pressure and low fluid level in the green hydraulic system, failure of two alternating current electrical buses, and reversion of the automatic flight control system to alternate law. The ECAM also displayed several messages regarding the flight controls, brakes and fuel system.
The first officer declared an urgency with air traffic control (ATC) as the captain selected the autoflight system’s heading- and altitude-hold modes, leveling the aircraft at 7,400 ft. The autothrottles did not adjust engine thrust to maintain 250 kt, as expected, so the captain manually reduced thrust to control airspeed.
“The flight crew discussed the available options to manage the situation, including an immediate return to Singapore, climbing or holding,” the report said. “As the aircraft remained controllable and there was ample fuel on board, it was decided that the best option would be to hold at the present altitude while they processed the ECAM messages and associated procedures.”
Accordingly, the crew requested and received clearance from ATC to hold offshore in a 20-nm (37-km) pattern within 30 nm (56 km) of Changi Airport. “ATC also advised of reports that a number of aircraft components had been found by residents of Batam Island,” the report said.
Fuel Leak
After establishing the A380 in the holding pattern, the pilots attended to the myriad of messages on the ECAM. “The primary flight crew processed the ECAM messages and followed procedures in accordance with their training,” the report said. “They used other flight crewmembers at opportune times to share tasks not essential to flight safety and gather information to assist in their decision making. This included communication with the cabin [crew] and obtaining information in relation to the damage to the aircraft.”
While performing the procedure prescribed for an engine overheat, the crew shut down the no. 2 engine. During this time, however, the ECAM displayed another message indicating that the engine had failed. As a precaution, the crew discharged both fire-extinguisher bottles; however, due to damaged wiring, only one of the bottles actually discharged.
The second officer went to the cabin to visually assess the damage. A passenger directed his attention to a view on the in-flight entertainment system provided by a tail-mounted camera, which showed a stream of fluid emerging from the left wing. The second officer then went to the main (lower) deck, where he confirmed that fuel was leaking from underneath the wing and also saw some of the damage that had been inflicted on the wing.
Challenging Landing
While carrying out the procedures associated with the multiple ECAM messages, the crew found that they could not jettison fuel. The crew had begun transferring fuel from the no. 2 engine’s fuel tank as part of the procedure for securing that engine, but they decided to discontinue the transfer due to uncertainty about the integrity of the fuel system.
“It took about 50 minutes for the flight crew to complete all of the initial procedures associated with the ECAM messages,” the report said. Thereafter, they assessed the condition of the systems that normally would be used for landing and found abnormalities including “inoperative wing leading edge lift devices, reduced braking function, reduced number of operational spoilers and inactive left engine thrust reverser,” the report said, noting that only the inboard engines on the A380 are equipped with thrust reversers.
“After some initial difficulty in calculating the landing distance required, due to the high number of system and flight control malfunctions, the fight crew determined that a landing within the distance available on Runway 20C at Changi Airport was achievable,” the report said. The runway was 4,000 m (13,124 ft) long and 60 m (197 ft) wide.
The crew advised ATC of their intention to conduct a long final approach to Runway 20C and requested that emergency services be available on landing. “The captain called the CSM [customer service manager] on the interphone to advise him of the potential for a runway overrun and evacuation, and the CSM and cabin crew prepared the cabin for this possibility,” the report said.
During the approach, the crew conducted controllability tests after each reconfiguration of the aircraft for the landing. “As a result of the damage to the aircraft, extending the landing gear required use of the emergency extension procedure,” the report said.
Slow Deceleration
The captain applied the wheel brakes and reverse thrust on the no. 3 engine after the A380 touched down at 1146. “The flight crew observed that the deceleration appeared to be ‘slow’ in the initial landing roll but that, with the braking effort being used and reverse thrust, the aircraft began to slow,” the report said.
The aircraft came to a stop about 150 m (492 ft) from the end of the runway. Fuel continued to leak from the left wing, and airport emergency services personnel sprayed water and foam below the wing to reduce the likelihood that the fuel would be ignited on contact with the overheated wheel brakes.
Likely because of damaged wiring, the no. 1 (left outboard) engine continued to run after the normal shutdown procedure was performed. “Because of the still-running engine and leaking fuel on the left side, the passengers were disembarked via a set of stairs on the right side of the aircraft,” the report said.
The disembarkation was completed about two hours after the aircraft landed. None of the people aboard the A380 was injured, and no one on the ground had been hurt by the falling debris.
The flight crew, maintenance engineers and airport emergency services personnel tried several methods to shut down the no. 1 engine, but it continued to run. “The engine was finally shut down about three hours after the aircraft landed by pumping firefighting foam directly into the engine inlet,” the report said.
Out of Spec
Investigators found that the oil feed stub pipe in the accident aircraft, as well as those in a “significant number” of Trent 900-series engines in other aircraft, had been manufactured with thin wall sections that did not conform to the design specification.
In the accident aircraft, “the thin wall section significantly reduced the life of the oil feed stub pipe on the no. 2 engine so that a fatigue crack developed, ultimately releasing oil during the flight,” the report said.
According to the report, the defect was introduced when the wall section at one end of the oil feed stub pipe was reduced, or counter-bored, to accommodate the installation of an oil filter. A misalignment during the drilling and reaming of the oil feed stub pipe resulted in a nonconcentric reduction of material in the barrel of the pipe. Investigators found that the wall thickness varied from 1.42 mm (0.06 in) to 0.35 mm (0.14 in).
“How the counter bore in the oil feed stub pipe came to be misaligned, released into service and remain in service undetected was a complex combination of events and missed opportunities that started with the design of the engine,” the report said.
The primary cause of the misalignment was movement of the hub during the milling process. The defect subsequently was “either not detected or not declared by inspection personnel, resulting in the assembly being released into service,” the report said.
The fatigue crack developed from operational stresses imposed on the thinnest section of the pipe. The crack subsequently grew and leaked oil at a low flow rate but at a pressure sufficient to atomize the oil, which auto-ignited on exposure to the 365-degree-C (689-degree-F) airstream in the turbine bearing chamber. The intense fire heated the turbine driveshaft to the point of failure, resulting in the acceleration and release of the turbine disc.
“Following the [accident], the ATSB, Rolls-Royce, regulatory authorities and operators of A380 aircraft with Trent 900 engines took a range of steps to ensure that HP/IP turbine bearing assemblies with non-conforming oil feed stub pipes were identified and either removed from service or managed to ensure their safe continued operation,” the report said.
In addition, Rolls-Royce developed an engine control software update designed to prevent the overspeed of the turbine disc if a similar failure occurs.
“This accident represented an opportunity to extend the knowledge base relating to the hazards from uncontained engine rotor failure (UERF) events and to incorporate that knowledge into airframe certification advisory material in order to further minimise the effects of a UERF on future aircraft designs,” the report said.
“As a result, the ATSB issued recommendations to the European Aviation Safety Agency and the U.S. Federal Aviation Administration, recommending that both organisations review the damage sustained by the aircraft in order to incorporate any lessons learned from this accident into certification compliance advisory material.”
This article is based on ATSB Transport Safety Report AO-2010-089, “In-Flight Uncontained Engine Failure, Airbus A380-842, VH-OQA.” The 305-page report was published on June 27, 2013.