Qantas A388 near Singapore on Nov 4th 2010, uncontained engine failure

Last Update: June 27, 2013 / 07:23:33 GMT/Zulu time

Bookmark this article
Incident Facts

Date of incident
Nov 4, 2010

Classification
Accident

Airline
Qantas

Aircraft Registration
VH-OQA

Aircraft Type
Airbus A380-800

ICAO Type Designator
A388

The Australian Transportation Safety Bureau (ATSB) released their final report stating that "although there was significant damage to the aircraft structure and systems, the aircraft was capable of continued safe flight and landing. Furthermore, the flight crew operated in accordance with standard operating procedures and practices. Therefore, this analysis is focused on the failure of the No. 2 engine and the factors that lead to the failure." and concluding the probable causes of the uncontained engine failure were:

Contributing safety factors

- Over time, a fatigue crack had developed in the thin-wall section of the oil feed stub pipe in the No. 2 engine to the extent that, during the occurrence flight, opening of the crack through normal movement within the engine released oil into the HP/IP buffer space.

- Auto-ignition of the oil leaking from the oil feed stub pipe created an intense and sustained fire within the HP/IP buffer space that resulted in localised heat damage to the intermediate pressure (IP) turbine disc.

- The IP turbine disc separated from the drive arm and accelerated.

- Following the separation of the IP turbine disc from the drive arm, the engine behaved in a manner that differed from the engine manufacturer’s modelling and experience with other engines in the Trent family, with the result that the IP turbine disc accelerated to a rotational speed in excess of its design capacity whereupon it burst in a hazardous manner. [Safety issue]

- During the manufacture of the HP/IP bearing support assembly fitted to the No. 2 engine (serial number 91045), movement of the hub during the machining processes resulted in a critically reduced wall thickness within the counter bore region of the oil feed stub pipe.

- It was probable that a non-conformance in the location of the oil feed stub pipe interference bore was reported by the coordinate measuring machine during the manufacturing process, but that the non-conformance was either not detected or not declared by inspection personnel, resulting in the assembly being released into service with a reduced wall thickness in the oil feed stub pipe.

- The statistical analysis used to estimate maximum likely oil feed stub pipe counter bore misalignment, and resulting thin wall section, did not adequately represent the population of actual misalignments in engines already released into service, nor did it implicitly provide a level of uncertainty in the results.

- The language used to define the size of the non-conformance on the retrospective concession form did not effectively communicate the uncertainty of the statistical analysis to those assessing and approving the concession.

- The engine manufacturer did not have a requirement for an expert review of statistical analyses used in retrospective concession applications. [Safety issue]

- The engine manufacturer's process for retrospective concessions did not specify when in the process the Chief Engineer and Business Quality Director approvals were to be obtained. Having them as the final approval in the process resulted in an increased probability that the fleet-wide risk assessment would not occur. [Safety issue]

- The retrospective concession was not approved by the Chief Engineer and Business Quality Director, as required by the group quality procedures relating to retrospective concessions, denying them the opportunity to assess the risk to the in-service fleet.

Other Safety Factors

- Numerous other engines within the Trent 900 fleet were also found to contain a critical reduction in the oil feed stub pipe wall thickness. [Safety issue]

- During preparation of the manufacturing process for the HP/IP bearing support assembly structure, a manufacturing datum was introduced because the location of the oil feed stub pipe counter bore could not be referenced to the design definition datum. That manufacturing datum was not constrained to the location of the oil feed stub pipe and as such could not ensure that the counter bore was concentric with the stub pipe, as the designers had intended.

- The engine manufacturer did not require its manufacturing engineers to consult with the design engineers to ensure that design intent would be maintained when introducing manufacturing datums. [Safety issue]

- The use by an inspector, during the first article inspection process, of the manufacturing stage drawings to verify the oil feed stub pipe counter bore features precluded the inspection from showing that the manufacturing process could produce an item that conformed to the design definition, or the intention of the design.

- The procedure for the first article inspection process contained ambiguities that resulted in an interpretation whereby the use of the manufacturing stage drawings was deemed to be acceptable. [Safety issue]

- A culture existed within the engine manufacturer's Hucknall facility where it was considered acceptable to not declare what manufacturing personnel determined to be minor non-conformances in manufactured components. [Safety issue]

- The coordinate measuring machine was programmed to measure the location of the oil feed stub pipe interference bore with respect to the manufacturing datum, instead of the design definition datum as specified on both the design and manufacturing stage drawings. [Safety issue]

- During the production of a number of HP/IP bearing support assemblies, the coordinate measuring machine identified a non-conformance in the location of the oil feed stub pipe interference bore.

- It was likely that when making the determination that the non-conforming HP/IP bearing support assemblies were acceptable for use, the manufacturing personnel did not know that the coordinate measuring machine referenced a different datum to the design definition drawings and unknowingly released thin-walled pipes into service based on an alternative (wire gauge) measurement method.

- The engine manufacturer’s group quality procedures did not provide any guidance on how manufacturing personnel were to determine the significance of a non-conformance, from a quality assurance perspective. [Safety issue]

- When the retrospective concession was processed, the non-conformance was not reported to the Quality Review Board because manufacturing personnel did not identify it as a significant non-conformance.

- The manufacturer’s classification, relating to the criticality of failure, of the HP/IP bearing support assembly was inappropriate for the effects of a fire within the buffer space and hence, the requirement for an appropriate level of process control was not communicated to the manufacturing staff. [Safety issue]

- The partial first article inspection carried out in 2009 on the HP/IP support structure was not compliant with the engine manufacturer’s procedures.

- The evolution of the current advisory material relating to the minimisation of hazards resulting from uncontained engine rotor failures was based on service experience, including accident investigation findings. The damage to Airbus A380-842 VH-OQA exceeded the modelling used in the UERF safety analysis and, therefore, represents an opportunity to incorporate any lessons learned from this accident into the advisory material. [Safety issue]

- The calculation method in the aircraft manufacturer’s landing distance performance application was overly conservative and this could prevent the calculation of a valid landing distance at weights below the maximum landing weight with multiple system failures. [Safety issue]

Other Key Findings

- A large fragment of the hot intermediate pressure turbine disc passed through the left inner fuel tank, which resulted in a short-duration low-intensity fire. Conditions within the fuel tank were not sufficient to sustain combustion and a hazardous situation did not result.

- There was a short-duration oil fire in the No. 2 engine lower nacelle that self-extinguished, resulting only in localised damage to the nacelle.

- Despite significant system and structural damage following the uncontained engine rotor failure, the aircraft was capable of continued safe flight and landing.

- The duration of the CVR recording was insufficient to capture the entire occurrence that included the engine failure and subsequent ground operation up to passenger disembarkation.

- The crew’s decision to perform a precautionary disembarkation via the stairs likely provided the safest option, particularly given the low immediate safety threat and the elevated risks associated with an emergency evacuation into a potentially hazardous external environment.

- The flight and cabin crew managed the event as a competent team in accordance with standard operating procedures and practices.

 

The ATSB analysed:

The uncontained engine failure was the result of an internal engine fire in the high pressure/intermediate pressure (HP/IP) bearing support assembly that heated the intermediate pressure (IP) turbine drive arm until the material failed.

A fatigue crack had formed in the wall of the oil feed stub pipe over a period of time, and on the occurrence flight the crack reached a size that permitted the release of oil as an atomised spray into the buffer space between of the HP/IP bearing chamber. It was sufficiently hot within this chamber for the oil spray to auto-ignite.

The fire propagated through the bearing chamber buffer space, eventually impinging upon the IP turbine disc, resulting in the separation of the disc at the drive arm. The IP turbine disc moved rearwards and the engine surged. Within 4 seconds, the disc accelerated, and while the engine was running down from the surge, the HP system partially recovered, supplying additional energy to the IP turbine disc, allowing it to accelerate to a rotational speed in excess of its structural capacity.

The disc fractured into three main sections that had sufficient energy to penetrate the engine case and exit at high speed. Sections of the IP turbine disc and associated debris impacted and damaged the aircraft structures and systems.

The crack that formed in the oil feed stub pipe was a result of the normal operating movement of the HP/IP hub and the increased stresses in the pipe as a result of its reduced wall thickness. The reduced wall thickness was due to the counter bore for an oil filter being misaligned with the axis of the oil feed stub pipe during manufacture.

The ATSB continued stating that the (partial) high pressure system recovery, that added energy to the intermediate pressure (IP) turbine disc, had not been expected by the engine manufacturer. Previous experiences in other engine surges had shown that the system would not recover from the surge and the IP turbine would thus not reach a speed in excess of its design capabilities.

The ATSB continued: "How the counter bore in the oil feed stub pipe came to be misaligned, released into service and remain in service undetected was a complex combination of events and missed opportunities that started with the design of the engine." explaining the oil feed stub pipe became misaligned when "between the time when the location of the timing pin was measured and the inner hub counter bore was formed, the inner hub moved relative to the milling machine. Because the interference bore, into which the oil feed stub pipe was later fitted, had previously been formed on the axis of the timing pin, the inner hub counter bore was not aligned with the axis of the interference bore, and hence the axis of the oil feed stub pipe."

The manufacturer oil feed stub pipe subsequently went through a coordinate measuring machine. The machine was programmed to issue an error report if the position of the counter bore measured relative to the inner hub counter bore would be outside defined limits. Those records were not retained however, it is likely that the machine according to its programming did issue a non-conformance report for the oil feed stub pipes that later were assembled into VH-OQA's engine #2. The ATSB analysed: "Even if an error was produced, there may have been a number of reasons to explain why it was not reported as a non-conformance. This could have included a problem with the print-out, simply missing it when reviewing the report or an erroneous second measurement that indicated that there was no error."

The ATSB analysed that the non-conformance report (CMM) would indicate a non-conformance of the interference counter bore and made a reference to the design drawing, however would not state that it referenced the non-conformance to datum M (manufacturing datum derived from the inner hub counter bore) instead of datum AA (outer hub clearance hole, that became inaccessible with the oil stub feed pipe installed) as referenced in the drawing. The non-conformance report such created the impression that there was a possible lack of clearance between the pipe and the outer hub. Inspectors therefore likely used the wire gauge check and determined that there was sufficient clearance and the part was acceptable for use.
A major quality inspection at the engine manufacturer revealed that components were released to service despite a large number of non-conformances that had not been declared in the documentation. "Post-accident determination of the oil feed stub pipe wall thickness from a number of the HP/IP hub assemblies produced prior to the Hucknall major quality investigation indicated that there were a significant number that did not conform to the design intent. It was therefore likely that HP/IP hub assemblies were released with undeclared non-conformances. Given that there were a number of inspectors involved over the 3-year period leading up to the major quality investigation, it was likely that a culture102 existed within the Hucknall facility that considered that not strictly adhering to the non-conformance management procedures in the group quality procedures was a viable form of behaviour. Specifically, it was considered acceptable to release parts with undeclared non-conformances that were considered by at least some of the inspectors to be ‘minor’."

The ATSB thus concluded the analysis of how the hub became misaligned: "Even though the errors identified by the CMM were an indication that there was a potentially thin wall on the oil feed stub pipe, the opportunity to detect this was missed because of the difference between the datum used in the CMM program and the one listed on the drawings." and added: "To ensure that an acceptable wall thickness was maintained, the designers applied a tight tolerance on the allowable deviation of the location of the interference bore and counter bore. However, when the manufacturing drawings were produced, those tolerances were increased - the location of the interference bore by a factor of 10 and the counter bore by a factor of two. Both further increased the potential size of any misalignment of the counter bore in the oil feed stub pipe. The ATSB was unable to determine why those tolerances had been increased."

The ATSB analysed with respect to design and manufacturing drawings of the oil feed stub pipe, that although correct measurements of the first parts confirmed the conformance of the part with the manufacturing drawings, the parts did not conform to the design drawings and the intent of the designers. Those checks of the first parts thus did not "close the loop" between manufacturing methods and design intent. The ATSB believes that this missed opportunity mainly can be explained by ambiguous wording of the "definition requirement" to be used for the first article inspections, that referenced the manufacturing drawings as "other documents", that were not to be used for showing conformity, but did not clearly define the design drawings as reference until the manufacturing drawings were verified to attain the design intent.

The ATSB analysed that the damage to the aircraft as result of the uncontained engine failure was "greater than the modelling outlined in the advisory material. Primarily, this was the result of combined damage from multiple fragments on different trajectories that affected redundant system paths. This included systems such as the flammable fluid shut-off valves (fuel low pressure shut-off valves for the No. 1 engine, and the hydraulic shut-off valve for the No. 2 engine) and the fire extinguishing system of the No. 1 engine. Notwithstanding this, the aircraft was capable of continued safe flight and it landed at Changi Airport, Singapore." The certification of the aircraft with respect to minimize hazards associated with uncontained engine failures was based on lessons learned in past uncontained engine failures and results of investigations into such occurrences. The ATSB thus summarized: "This accident represents an opportunity to extend the knowledge base relating to the hazards from UERF events and to incorporate that knowledge into the airframe certification advisory material in order to further minimise the effects of UERF on future aircraft designs."

Based on passenger reports, who indicated seeing flames above the wing originating from holes in the wing and being visible for up to 10 minutes though decreasing over time, and photos as well as evidence (soot) left on the surface of the wings the ATSB determined that there had been a flash fire in the wing fuel tank. The ATSB analysed: "The conditions within the tank were suitable for a flash fire; however, they were not suitable to sustain the fire."

The ATSB analysed with respect to the landing distance performance calculations: "The inherent conservatism in the landing distance calculation by the landing distance performance application, for aircraft weights below the maximum landing weight and multiple failures, had the potential to increase flightcrew workload. Further, if the calculation incorrectly showed that the aircraft was unable to land safely at the nearest airport, it had the potential to influence crews to delay landing to reduce weight or to divert to an alternate airport."
Aircraft Registration Data
Registration mark
VH-OQA
Country of Registration
Australia
Date of Registration
LljbqgAinel e Subscribe to unlock
Airworthyness Category
Mh jbiliggAdmbiibj Subscribe to unlock
Manufacturer
AIRBUS INDUSTRIE
Aircraft Model / Type
A380-842
ICAO Aircraft Type
A388
Year of Manufacture
Fhgj Subscribe to unlock
Serial Number
Enpk Subscribe to unlock
Maximum Take off Mass (MTOM) [kg]
Ffdpbe Subscribe to unlock
Engine Count
N Subscribe to unlock
Engine
Pcfbnlhikckfdngclqpeihpqhfdc ndkfdAbqdbmild Subscribe to unlock
Main Owner
Q flcnlpeccdkhhhbmbmhelhjflAiieiebkepeqgkcbbcmigiiimkklbgffgAd jlnlAcAdfhcmkhdgfA Subscribe to unlock
Main Operator
Pm fghpAi hAmgqlhcgebgkidmkhnpipccAhmAhqecddmegnpnmp qbkkeqcdckd plgjmqglfgfij Subscribe to unlock
Incident Facts

Date of incident
Nov 4, 2010

Classification
Accident

Airline
Qantas

Aircraft Registration
VH-OQA

Aircraft Type
Airbus A380-800

ICAO Type Designator
A388

This article is published under license from Avherald.com. © of text by Avherald.com.
Article source

You can read 2 more free articles without a subscription.

Subscribe now and continue reading without any limits!

Subscribe now
Are you a subscriber? Login
Subscribe

Read unlimited articles and receive our daily update briefing. Gain better insights into what is happening in commercial aviation safety.

Compare our plans

Send tip

Support AeroInside by sending a small tip amount.

Send tip

Related articles

Newest articles

Subscribe today

Are you researching aviation incidents? Get access to AeroInside Insights, unlimited read access and receive the daily newsletter.

Pick your plan and subscribe

Partner

Blockaviation logo

A new way to document and demonstrate airworthiness compliance and aircraft value. Find out more.

ELITE Logo

ELITE Simulation Solutions is a leading global provider of Flight Simulation Training Devices, IFR training software as well as flight controls and related services. Find out more.

Blue Altitude Logo

Your regulation partner, specialists in aviation safety and compliance; providing training, auditing, and consultancy services. Find out more.

AeroInside Blog
Popular aircraft
Airbus A320
Boeing 737-800
Boeing 737-800 MAX
Popular airlines
American Airlines
United
Delta
Air Canada
Lufthansa
British Airways