A380 Uncontained Engine Failure ATSB Final Report Published. Figure1. General damage to the engine

Transcription

1 Aerolínea Emisora Aerolínea (s) Aplicable Público al que está dirigida TACA INTERNATIONAL AIRLINES. TACA INTERNATIONAL AIRLINES. PILOTOS TACA INTERNATIONAL AIRLINES. The ATSB has published Its Final Report into the uncontained engine failure on an A380 which departed Singapore 4 November 2010, caused by an undetected component manufacturing fault. Description On 4 November 2010, a Rolls-Royce Trent 900 powered Airbus A being operated by Qantas Airways on a scheduled passenger flight from Singapore to Sydney Australia was passing 7000 feet in the climb in day VMC when an uncontained failure of the No 2 engine occurred. The climb was stopped and a PAN call was made to ATC and preparations for a return to Singapore initiated whilst the flight crew collectively responded to the engine failure and to multiple secondary effects. Initially, in order to accomplish the minimum necessary actions, a holding pattern in the vicinity of the airport was flown. A challenging but uneventful approach and landing were subsequently accomplished and the aircraft was stopped on the runway. It then became apparent that the No. 1 engine could not be shut down which delayed the precautionary disembarkation of the passengers using stairs brought to the right hand side of the aircraft. None of the 469 occupants were injured but some of the debris which had fallen from the aircraft at the time of the engine failure caused minor injuries to two people on the ground. There was obvious evidence of extensive damage to the failed engine and lesser damage to the adjacent airframe structure. Figure1. General damage to the engine

2 Investigation After formal delegation from the State of Occurrence, the Indonesian NTSC, an investigation was carried out by the ATSB. The Investigation was able to access recorded data from the FDR and from a wireless digital aircraft condition monitoring system recorder also fitted. However, after landing, despite attempts by both flight and ground crew to isolate the CVR and protect its 2 hour recording, this proved impossible and event recording data was overwritten. The Investigation noted that at the time of the occurrence, the operator did not have, and was not required by Australian aviation regulation to have a procedure that would enable the CVR to be isolated in conditions of this nature. In contrast, Singapore legislation stated that reasonable measures may be taken to preserve any object or evidence deemed necessary for the purposes of the investigation. The aircraft flight path, reproduced from the Official Report, is shown below - a departure from runway 20C at Singapore and then a left turn over Batam Island to take up a racetrack holds to the east of Singapore prior to a final approach to land back on the same runway. Figure2. Aircraft track superimposed on a ground map It was established that about four minutes after take off, in the climb through about 7000 feet with the aircraft commander as PF, there had been two bangs and a number of warnings and cautions had been displayed on the ECAM. The first of these was an alert of No 2 engine turbine overheat but this was then followed by multiple other messages relating to a number of aircraft system problems, creating a complex situation which could be resolved simply by sequentially following all the ECAM annunciations. Following a transient engine fire warning for the No 2 engine, it was shut down and discharge of the first fire bottle selected. When no indication that the selected fire bottle had actually discharged was seen, the second fire bottle was selected with a similar outcome. Then, after review, the remainder of the engine failure procedure, including selection of an automated process for fuel transfer between tanks, was activated before turning to the other ECAM system alerts displayed.

3 Fortuitously, in addition to the operating crew of a Captain as pilot in command, a First Officer acting as co-pilot and a routinely-rostered Second Officer, there was also a trainee Check Captain performing a routine Line Check on the aircraft commander whilst being overseen by a Supervising Check Captain. This exceptional crew resource was able to be deployed to handle the exceptional prevailing circumstances. A PAN call was made to ATC and an intention to return to Singapore advised and upon crew request, the aircraft was then cleared to enter a holding pattern to the east of Singapore in order to work through the procedures relevant to the messages displayed by the ECAM and establish the state of the aircraft and its systems before making an approach. It became clear that there had been some impact damage caused by debris from the failed No 2 engine and fuel could be seen leaking from the damaged left wing fuel tanks. Since the calculated landing performance at high weight was close to limits - indications were that the aircraft would stop with 100 m of runway remaining with reverse thrust only available from one instead of the usual two engines - the cabin crew were given a precautionary brief to prepare the cabin for a possible runway overrun and evacuation. Figure3. Fuel leaking from the left wing, image supplied by a passenger. Prior to beginning the approach, the controllability of the aircraft was verified by a number of manual handling checks at holding speed. The approach was initially made with the AP engaged but, after some un-commanded disconnects, the last 1000 feet was flown manually to a successful landing back at Singapore about 1 hour 45 minutes after the engine failure. The aircraft came to a stop about 150 meters from the end of the 4000 meters runway used for landing with fuel continuing to leak from the left wing. The attending RFFS applied large quantities of water and foam below the left wing whilst shut down of the remaining three engines was attempted but No. 1 engine continued to run. Passenger disembarkation was eventually commenced about 50 minutes after landing using steps brought to the right hand side of the aircraft and had then taken about 50 minutes to complete. Even after passenger disembarkation, numerous attempts to shut down the No. 1 engine by the flight crew, maintenance engineers and the airport emergency services were all unsuccessful and final shutdown was only achieved about 3 hours after the aircraft landed by means of the pumping of firefighting foam directly into the engine inlet.

4 Figure4. Fire-fighters drowning the No. 1 engine with foam The Investigation found that the flight crew and cabin crew managed the event as a competent team in accordance with standard operating procedures and practices. The No. 2 engine failure sequence was found to have been initiated by an oil leak from a crack in an oil feed pipe which had lost its integrity as a result of fatigue over some time. During the occurrence flight, it was determined that the crack in the feed pipe involved had grown to a sufficient size for oil within it to be released in the form if an atomized spray into the buffer space between the bearing chamber and the hot air surrounding the Intermediate Pressure (IP) turbine disc and the air temperature was sufficiently hot for the oil to auto-ignite. It was established that the resulting fire propagated through the bearing chamber buffer space and eventually impinged upon the IP turbine disc drive arm, resulting in the separation of the disc from the drive shaft. Following this, the engine had behaved in a manner different to that anticipated by the manufacturer during engine design and testing with the disc accelerating to a speed in excess of its structural capacity and bursting into three main segments which exited the core at high speed and with sufficient force to puncture the engine outer casing. The faulty pipe was in a section of the High Pressure/Intermediate Pressure (HP/IP) bearing chamber oil feed pipe known as the oil feed stub pipe and contained an area of reduced wall thickness which it was concluded had been the consequence of misalignment of a counter bore machined into the end of the stub pipe during manufacture. A detailed engineering analysis found that the stresses generated in this oil feed stub pipe were sensitive to the wall thickness and that this had had a significant effect on the fatigue life of the pipe. The Investigation found that the mis-aligned counter bore had not conformed with the corresponding design specification and noted that following the event, Rolls-Royce had found that a significant number of HP/IP bearing support assemblies in service on a number of other Trent 900 engines had been produced with oil feed stub pipes that did not conform to the design specification. As a result of these findings, a Safety Recommendation was issued on 1 December 2010 as follows: that Rolls-Royce plc address (the identified critical safety issue - the risk to the integrity of the failed oil feed stub pipes) and take actions necessary to ensure the safety of flight operations in transport aircraft equipped with Rolls-Royce plc Trent 900 series engines. [AO AR-012]. The Investigation noted

5 that Rolls-Royce had taken action to fully address this Recommendation, which was included in a factual Preliminary Report released by the Investigation on 3 December The formally stated Findings of the Investigation were as follows: (1) Contributing Safety Factors in respect of the disc failure during the occurrence flight, the manufacture and release into service of the failed engine and the opportunity to manage the non-conforming oil feed stub pipes in the Trent 900 fleet. [Three Safety Issues identified]. (2) Other Safety Factors in respect of the release of Trent 900 engines with non-conforming oil feed stub pipe counter bores, the minimization of hazards resulting from an uncontained engine rotor failure and the application of the landing distance performance calculation. [Nine Safety Issues identified] (3) Other Key Findings on six points [No Safety Issues identified] Safety Actions in response to the identified Safety Issues by Qantas Airways, Rolls-Royce, Airbus, EASA and CASA and Proactive Action taken and planned by Airbus in respect of software enhancements to both the fuel trim and electrical systems are been fully documented in the Investigation Report. The only remaining observation from the Investigation was the opportunity to use information gathered to review current guidance on how to minimize hazards from uncontained engine failures since the damage caused had exceeded the parameters of the existing model in the relevant advisory material. As a result, two further Safety Recommendations were issued: that the European Aviation Safety Agency, in cooperation with the US Federal Aviation Administration, review the damage sustained by Airbus A , VH-OQA following the uncontained engine rotor failure overhead Batam Island, Indonesia, to incorporate any lessons learned from this accident into the advisory material. AO SR-039. that the US Federal Aviation Administration, in cooperation with the European Aviation Safety Agency, review the damage sustained by Airbus A , VH-OQA following the uncontained engine rotor failure overhead Batam Island, Indonesia, to incorporate any lessons learned from this accident into the advisory material. AO SR-040. Figure5. General damage to the No. 2 engine