QF32

Taking 966 days to produce, the 305-page QF32 report is the largest investigation the ATSB has ever conducted using resources from more than 10 organisations spanning seven countries.

QF32, carrying five pilots, 24 cabin crew and 440 passengers, suffered a catastrophic failure to its number-two Roll-Royce Trent 900 engine about 14 minutes after take-off from Singapore.

The new element that gained the most attention around the globe was the Australian Safety Transport Board’s comments on Rolls Royce. The ATSB said “it found a culture ‘within the engine manufacturer’s Hucknall facility where it was considered acceptable to not declare what manufacturing personnel determined to be minor non-conformances in manufactured components’.”

The ATSB added the “engine manufacturer’s group quality procedures did not provide any guidance on how manufacturing personnel were to determine the significance of a non-conformance from a quality assurance perspective.”

Criticism indeed to which Rolls Royce, to its credit, agreed.

In a statement the company said it supported the conclusions into the failure of the Trent 900 engine.

Colin Smith, director engineering & technology for Rolls-Royce said: “This was a serious and rare event which we very much regret. At Rolls-Royce we continually strive to meet the high standards of safety, quality and reliability that our customers and their passengers are entitled to expect. On this occasion we clearly fell short. The robustness of the Airbus A380 and the professionalism of the Qantas crew members assured that the aircraft and all its passengers landed safely.

“We support the ATSB’s conclusions and, as the report notes, have already applied the lessons learned throughout our engineering, manufacturing and quality assurance procedures to prevent this type of event from happening again.”

The report tells a tale of extraordinary systems failures and the equally extraordinary efforts by the Qantas flight crew to rescue an almost impossible situation.

“This was a serious and rare event which we very much regret.”
Rolls-Royce

The ‘what ifs’ are chilling, with pieces of the disc weighing up to 70kg missing the A380’s fuselage by just metres.

The official finding of the cause of the catastrophic explosion was “that a number of oil feed stub pipes within the high pressure/intermediate pressure (HP/IP) hub assembly were manufactured with thin wall-sections that did not conform to the design specifications. These non-conforming pipes were fitted to Trent 900 engines including the No. 2 engine on VH-OQA. The thin wall-section significantly reduced the life of the oil feed stub pipe on the No. 2 engine so that a fatigue crack developed, ultimately releasing oil during the flight that resulted in an internal oil fire. That fire led to the separation of the intermediate pressure turbine disc from the drive shaft. The disc accelerated and burst with sufficient force that the engine structure could not contain it, releasing high-energy debris.”

Detailing the reasons for the failure the ATSB noted:

• During preparation of the manufacturing process for the HP/IP bearing support assembly structure, a manufacturing datum was introduced because the location of the oil feed stub pipe counter bore could not be referenced to the design definition datum. That manufacturing datum was not constrained to the location of the oil feed stub pipe and as such could not ensure that the counter bore was concentric with the stub pipe, as the designers had intended;

• The engine manufacturer did not require its manufacturing engineers to consult with the design engineers to ensure design intent would be maintained when introducing manufacturing datums;

• The use by an inspector, during the first article inspection process, of the manufacturing stage drawings to verify the oil feed stub pipe counter bore features precluded the inspection from showing that the manufacturing process could produce an item that conformed to the design definition, or the intention of the design;

• The procedure for the first article inspection process contained ambiguities that resulted in an interpretation whereby the use of the manufacturing stage drawings was deemed to be acceptable;

• The engine manufacturer’s group quality procedures did not provide any guidance on how manufacturing personnel were to determine the significance of a non-conformance, from a quality assurance perspective;

• When the retrospective concession was processed, the non-conformance was not reported to the Quality Review Board because manufacturing personnel did not identify it as a significant non-conformance; and

• The manufacturer’s classification, relating to the criticality of failure, of the HP/IP bearing support assembly was inappropriate for the effects of a fire within the buffer space and hence, the requirement for an appropriate level of process control was not communicated to the manufacturing staff.

The ATSB found that in fact “in March 2009, a manufacturing engineer at Rolls-Royce identified that oil feed stub pipe counter bores were misaligned in previously manufactured and released HP/IP bearing support assemblies.”

It said the engineer was “the first to identify the effect that misalignment of the counter bore had on the wall thickness of the pipe”.

In an attempt to estimate the potential size of the misalignment within all of the previously-manufactured HP/IP bearing support assemblies, the engineer measured all nine of the HP/IP bearing support assemblies available at the facility at that time and performed a statistical analysis on those measurements.

“Based on that analysis, the engineer applied for an engineering assessment to establish the suitability of those non-conforming oil feed stub pipes for continued use. This application was submitted through the manufacturer’s non-conformance management system. There was a level of uncertainty inherent within the statistical analysis method used in that assessment. The uncertainty was not effectively communicated to, or understood by, the engineers that assessed the application and retrospective approval was given to permit those non-conforming HP/IP bearing support assemblies to remain in service.”

Rolls-Royce’s approach has been twofold. It has now modified the engine software to prevent a turbine disc from bursting as a result of over-speeding following a similar failure. It has also implemented better quality assurance processes with supporting training and improved manufacturing and design procedures.

ATSB chief commissioner Martin Dolan told Australian Aviation that its report had not made any recommendations related to the engine-maker because Rolls-Royce’s manufacturing processes “have been addressed to our satisfaction”.

“They [Rolls-Royce] have done everything necessary,” Dolan added.

However the fall-out for the prestigious engine-maker may not be over yet with flight attendants aboard QF32 pursing legal action against Roll-Royce over psychological trauma.

Led by flight attendant Sandy Lam (31), the suit alleges loss and damage as a result of “Rolls-Royce’s alleged negligence in the manufacture, inspection and installation of the pipe in the failed engine.”

Lawyers for Ms Lam have succeeded in obtaining a list from Qantas of the passengers on board to expand the class action.

However, the Qantas pilots Captain Richard de Crespigny, first officer Matt Hicks, second officer Mark Johnson and check pilots Dave Evans and Harry Wubben have not joined the action.

Getting away from the headline-grabbing elements the key message of the report was that the extent of damage to the Qantas A380 showed that design standards of aircraft needed to be reconsidered.

“We have said to the [European Air Safety Agency and the US Federal Aviation Administration] that they should review their guidance material about certifying aircraft in this area to deal with uncontained engine failures to see if it remains reliable,” Dolan said.

“It is an opportunity for the regulators to learn, because these are rare events, but when they happen they have potentially major consequences.”

Dolan added that this “accident represented an opportunity to extend the knowledge base relating to the hazards from uncontained engine rotor failure (UERF) events and to incorporate that knowledge into airframe certification advisory material in order to further minimize the effects of a UERF on future aircraft designs.

And that damage was extensive.

Two major wiring looms were damaged impacting 650 wires.

The ATSB outlined the massive extent of the damage in the report, which also includes systems shutdowns as a result of actions taken by the flight crew as part of the ECAM procedures.

The detail of the damage takes up a staggering 51 pages of the report and includes:

• Hydraulic power, as a result of:

– the loss of function to the aircraft’s green hydraulic system

– reduced redundancy within the aircraft’s other (yellow) hydraulic system.

• Electrical power, resulting from:

– a loss of electrical power generation at engines No. 1 and 2

– the loss of one of the aircraft’s four alternating current (AC) systems

– the inability to connect the aircraft’s auxiliary power unit (APU) generators on the ground.

• Flight controls, through:

– reduced aileron and spoiler function

– the loss of wing leading edge slats and droop nose function.10

• Engine control, as a result of:

– loss of auto thrust function

– reduction in the automatic control function to engines No. 1, 3 and 4.

• The landing gear normal extension function was no longer available.

• Braking, through a:

– reduction of function in the right wing gear brakes (including anti-skid)

– loss of function to the left wing gear brakes.

• Partial loss of bleed air, resulting from damage to the:

– left wing system ducting

– APU bleed air ducting.

• Fuel system, resulting from:

– fuel leakage from the No. 2 engine feed tank

– a loss of function to the engines No. 1 and 2 low pressure fuel shutoff valves

– the loss of function to the No. 1 engine high pressure shutoff valve

– loss of function of numerous fuel system components (valves and/or pumps)

– degradation of the fuel quantity management system

– a reduction in capability of the automatic and manual fuel transfer function

– disabling the fuel jettison system.

• Engine fire protection, as a result of a loss of function to one of the two extinguisher bottles in engines No. 1 and 2.

There was also damage to the airframe as under;

• No. 2 engine pylon

• No. 2 engine thrust links

• left wing box structure, including the:

– front spar

– upper wing skin

– lower wing skin

– wing ribs

• fuselage butt-straps number three and four.

The ATSB praised the crew of the A380 and had earlier said that it was the skill of the pilots that saved the aircraft.

“Put simply the aircraft would not have arrived safely in Singapore without the focused and effective action of the flight crew”. It notes the additional crew, while helpful with some support functions, were not critical to the successful outcome.

“The ATSB praised the crew of the A380 and had earlier said it was the skill of the pilots that saved the aircraft.”

“On the flightdeck, the supporting flight crew provided valuable input and assistance to the primary flightcrew – in terms of conducting PA announcements, liaison with the cabin crew and visual observations of damage.”

It added: “although the additional flight crew were a valuable resource, had they not been available the primary flight crew would have likely responded to the situation in a similar manner. However, the gathering of information to assist in decision-making would have required the use of alternative resources and methods. This may have resulted in prolonging the airborne time before landing or it is also possible that the flight crew may have shed tasks not essential to flight safety. This was unlikely to have affected the safety of the flight because the crew’s training and the aircraft manufacturer’s procedures required them to complete prescribed tasks before attempting to land.”

It has been noted earlier the crew flying the plane focused on the standard two-crew operation as previous accidents had shown that where the normal procedures were deviated from the outcome was often tragic.

On the design impact lessons of QF32 the ATSB noted that the Aerospace Industries Association conducted a study of uncontained rotor failures and their consequences over the period 1969 to 2006.

The study’s findings were released in a report in January 2010 and the intent of the report was to provide ‘a single rotor burst database for high bypass turbofans’, as recommended by the NTSB.

The report found there were 67 recorded disc-burst events in the period studied, of which 58 were uncontained by the engine nacelle. A breakdown of those failures indicated that 46 involved first generation engines and 12 second generation engines. The second generation engines were ‘those designed in the 1980s with the understanding and incorporation of lessons learned from the first generation’.

The failure of the No. 2 engine on VH-OQA was the first UERF involving a third generation engine. Third generation engines were those ‘designed to incorporate the lessons learned from the second generation.

While not claiming the QF32 incident is a watershed in aircraft damage analysis, Dolan does say that the damage to VH-OQA “exceeded the modelling used in the UERF safety analysis and, therefore, represents an opportunity to incorporate any lessons learned from this accident into the advisory material.”

There is no doubt Airbus, Boeing and engine-makers will pour over the findings which are as comprehensive as they are a fascinating insight to the performance of both crew and airframe under extreme stress.

Either way, aviation should be the winner.