National Aeronautics and Space Administration
Office of Safety and Mission Assurance
NASA Safety Center Logo

Escape to Failure

The Qantas Flight 32 Uncontained Engine Failure

Nov. 4, 2010, over Batam Island, Indonesia: Qantas Flight 32, an Airbus A380-842, departed from Singapore Changi International Airport (SIN) for Sydney Kingsford Smith Airport (SYD), Australia. But, as the 500-ton airliner climbed past 7,000 feet, two loud bangs reverberated throughout the aircraft, startling passengers and crew. An uncontained turbine failure blew shrapnel through the aircraft’s port wing, severing wiring harnesses. The crew was unable to shut down the huge, damaged engine and prepared for an emergency landing.

Background

The Airbus A380

As the world’s largest passenger airliner, the Airbus A380 can seat up to 853 passengers and fly them over 3,750 miles. The double-deck, wide-body Qantas Flight 32 was powered by four under-wing turbofan Rolls-Royce Trent 900-series engines — each capable of producing over 80,000 pounds of thrust. The engines are numbered No. 1 (outermost port engine) to No. 4 (outermost starboard engine).

The Trent 900-Series Engine

The Rolls-Royce Trent 900-series engine is a third generation, three-shaft, high-bypass ratio turbofan design with variants capable of producing 84,098 pounds of thrust. The Trent 900 contains three primary compressor/turbine assemblies: a Low Pressure (LP), an Intermediate Pressure (IP), and a High Pressure (HP) assembly.

What Happened

EscapeToFailure-Image-1

Figure 1. Passengers aboard Qantas Flight 32 documented the damage to the port wing via mobile phone cameras. Source: ATSB

Flight

Qantas Flight 32 was departing from SIN, climbing through 7,000 feet at 250 knots. At approximately 10:01 a.m. local time, passengers and crew heard two loud bangs. The crew immediately put the aircraft into altitude and heading hold mode. They manually reduced thrust in response to a slight yaw and disabled autothrust system. The cabin crew and passengers observed damage on the port wing of the aircraft. The cabin crew attempted to contact the flight crew concerning the damage, but the flight crew did not answer.

The flight crew were inundated with Electronic Centralized Aircraft Monitoring (ECAM) system messages, beginning with a No. 2 engine turbine overheat warning. The flight crew idled the No. 2 engine for monitoring while alerting air traffic control (ATC) at SIN. A crew member reported seeing an ECAM system warning for a momentary No. 2 engine fire that reverted back to an overheat warning. The crew decided to shut down the No. 2 engine; however, during the shutdown, the ECAM system displayed a No. 2 engine failure warning.

Believing that the No. 2 engine was seriously damaged, the crew attempted to discharge the engine’s two fire extinguishers multiple times. The crew received no indication that the extinguishers had discharged. Following the A380 engine failure procedure, the crew initiated fuel transfer from the No. 2 engine. The ECAM system displayed a failed mode for the No. 2 engine, with the No. 1 and No. 4 engines reading as degraded and No. 3 operating in an alternate mode.

With a large reserve of fuel, the crew maintained altitude and processed ECAM system messages and related procedures. SIN ATC vectored Qantas Flight 32 to a holding area within 30 nautical miles east of SIN. SIN ATC also notified the crew that aircraft debris had been found by residents of Batam Island, Indonesia.

A flight crew member left the cockpit to visually assess damage from the cabin and observed a fuel leak from the port wing near the No. 2 engine; however, the crewman was unable to see the normally visible turbine housing from the cabin.

Because of a fuel system integrity ECAM system message and concerns of damaging the fuel system further, the flight crew opted to halt fuel transfer or begin fuel dumping. The ECAM system messages and initial procedures were completed in approximately 50 minutes. After completion, the crew decided that they were ready to land at SIN’s 13,123-foot runway.

Descent and Landing

After a system check and landing calculations, the crew began descending to land on runway 20C at SIN. Inoperative wing leading edge devices, reduced braking function, inoperable spoilers and an inoperable left engine thrust reverser created a uniquely challenging configuration. After performing manual controlability checks, the flight crew notified SIN ATC that Qantas Flight 32 was leaking fuel and that they would require emergency services. The cabin crew was advised to prepare for possible evacuation upon landing.

Qantas Flight 32 touched down at 11:46 a.m. The captain reversed thrust on the No. 3 engine (only the inboard No. 2 and No. 3 engines are capable of reverse thrust on an A380 by design) and applied brakes. Although the aircraft — almost 95 tons overweight — was slow to decelerate, it rolled to a stop approximately 500 feet from the end of the runway.

EscapeToFailure-Image-2

Figure 2. Firefighting crews douse the No. 1 engine. The sheared No. 2 engine turbine housing is pictured center frame. Source: ATSB

Forced Shutdown

After landing, the flight crew was unable to shut down the No. 1 engine. Fuel spilled onto the tarmac from the port wing as the aircraft’s brakes cooled from 1,650 degrees Fahrenheit. Firefighting crews doused the fuel soaked tarmac with fire retardant and drowned the engine by shooting water and foam into the No. 1 engine intake for approximately three hours. Passengers safely disembarked two hours after touchdown using a starboard-side exit. No confirmed injuries were sustained by crew, passengers or inhabitants of Batam Island.

The failure of the No. 2 engine on Qantas Flight 32 was the first uncontained engine rotor failure involving a third generation, high-bypass turbofan engine.

EscapeToFailure-Image-3

Figure 3. A Trent 900 IP turbine disc after an overspeed burst test. The disc that ruptured on Qantas Flight 32 broke into three main pieces and created holes in the port wing large enough for an adult to enter the wing. Source: Rolls-Royce plc./ATSB

Proximate Cause

Upon initial inspection, investigators from the Australian Transportation Safety Bureau (ATSB) determined that the No. 2 engine sustained an uncontained failure in the turbine region; liberated engine components then damaged the airframe and systems. While some systems sustained direct mechanical damage, most affected systems were compromised from damage to their wiring assemblies.

After thorough investigation, the ATSB determined that a fatigue crack developed in the No. 2 engine HP/IP oil feed stub pipe. Although it was not determined when the crack started, the crack grew enough to allow an atomized oil spray to leak out into a buffer space. The synthetic oil, with an auto-ignition point of 536 degrees Fahrenheit, ignited in the 686- to 707-degree Fahrenheit buffer space. The ensuing fire damaged the HP turbine seal, and then continued with the direction of airflow, heating the drive arm. The IP turbine disc separated from the drive shaft and continued, uninhibited by the shaft, to accelerate from the ambient air flow, ultimately accelerating to the point of bursting. The fractured disc projected outward in three main pieces with enough force to breach the engine casing and damage the aircraft.

Underlying Issues

The ATSB found that the No. 2 Trent 972-84 engine oil feed stub pipe within the HP/IP hub assembly was manufactured with thin wall sections that did not conform to design specifications. The nonconforming thin pipe stressed and cracked under normal operating movement of the HP/IP hub. The oil feed stub pipe’s reduced thickness was the result of a misaligned bore axis during manufacturing.

Design Intent and Altered Manufacturing Process

A combination of events led to the misalignment of the oil feed stub pipe bore axis. During the initial Trent 900 design definition, sets of datums — or relational measurements between relative components — were used in design definition drawings. The primary datums used for the oil feed stub pipe outer hub clearance hole was identified as datum AA. The design definition was frozen when the engine was certified in 2004. Any manufacturing issues associated with the design had been reviewed and corrected.

During manufacture, engineers identified that the oil feed stub pipe needed to be fitted and welded in place before the counter bore could be machined. With the pipe fitted, the inner surface of the clearance hole was not accessible to the machining or inspection probes. As a result, datum AA could not be used as a reference for further machining. No design or manufacturing personnel identified this issue before manufacturing. Manufacturers introduced an alternate datum, datum M, which referenced the inner hub counter bore. The ATSB found no evidence that manufacturing engineers consulted with design engineers concerning the change. Manufacturers reported that there was no process in place for such consultation to occur. Similar to the design process, measurements were presented on manufacturing process papers, with datum M signifying the inner hub counter bore. However, no other references to positional tolerance were made to datum M on the sheet, freeing datum M from geometric constraint with respect to the interference bore. The result was that the minimum thickness for the oil feed stub pipe wall could not be determined using specifications laid out in the manufacture stage drawings; thus, specifications could not ensure a safe thickness of the counter bore.

EscapeToFailure-Image-4

Figure 4. The oil feed stub pipe fits between the inner hub and outer hub
of the IP/HP hub assembly. Source: ATSB.

During manufacturing, after the inner and outer hubs were bolted together, the HP/IP hub assembly was placed into a machining fixture. The inner hub had a pre-drilled hole where the oil feed stub pipe was to be located. A timing pin was fitted into that hole and the assembly was oriented and aligned on the machining fixture.

The manufacturer reported that all of the oil feed stub pipe features, including the outer hub clearance hole, interference bore and inner hub counter bore, were referenced from the axis of the timing pin, replacing datum AA (as datum M, the inner hub counter bore, had not been created yet). Using the timing pin as reference undermined both the design stage drawings and the differing manufacturing stage drawings.

Moreover, it was assumed that the location of the timing pin would remain aligned with the axis of the hole into which it was initially inserted. However, during the investigation it was found that the hub had shifted in relation to the machining apparatus during a process when the clamp arrangement changed. The machining of the inner hub counter bore occurred several hours after the initial (and only) timing pin calibration. This resulted in an offset inner hub bore in relation to the interference bore (machined with the timing pin in place).

 

Inadequate Inspections and Quality Investigation

Many opportunities existed to catch non-conformances during the manufacturing process. After the hub assembly underwent visual inspection for burrs, damage and surface defects, it was loaded into a Coordinate Measuring Machine (CMM), a computer controlled inspection apparatus. The CMM inspected the measurement and size of the inner hub counter bore, the interference bore and the outer hub counter bore. The interference bore was inspected against the inner hub counter bore (datum M), rather than the outer hub clearance bore (datum AA) as specified in the design and manufacture drawings.

The first article inspection performed required the hub to adequately follow the definition requirements, adding that observations, such as lack of drawing clarity, be marked as unsatisfactory in the inspection. Although the first article conformed to the manufacture stage drawings, it was not considered that the manufacture stage drawings could be capable of producing an article that differed from the design intent.

At the time the Trent 972-84 engine on Qantas Flight 32 went into production in June 2006, CMM programs were written, reviewed and implemented by inspectors at the manufacturer without a formal validation process and without manufacturing engineers. A formal process that involved both inspectors and manufacturing engineers went into effect in August 2007 after a June 2007 major quality investigation into inspection records and CMM process inspections. The investigation uncovered a large number of nonconformances and a culture that allowed numerous inspectors to operate outside of nonconformance management procedures. Specifically, the ATSB noted that the manufacturer felt it was acceptable to release parts with undeclared nonconformances considered “minor” by at least some of the inspectors.

Manufacturing engineers realized the effect datum M was having on nonconforming parts in 2009; however, the statistical analysis that was used to determine the extent of the nonconformance was based on the nine work-in-progress assemblies in the factory at the time. The sample was not large enough to provide results that were representative of the fleet in service. Additionally, conveyance of the datum M effect was unclear, giving the impression to management that the nonconformance was known to be limited to a 0.7 millimeter difference in the wall thickness, and not 0.7 millimeter plus or minus an unknown amount.

 

Aftermath

After notification of the uncontained engine failure on Qantas Flight 32, Qantas elected to immediately ground its fleet of A380 airliners on Nov. 4, 2010. After Qantas’ own investigation and analysis of the failure, it reintroduced A380 fleet services on Nov. 27, 2010. Many other A380 operators (even those using engines from Airbus’ alternate A380 engine supplier, Engine Alliance) also decided to limit or ground A380 flights. Rolls-Royce, the Australian Civil Aviation Safety Authority and the ATSB issued a range of measures to identify and remove or service Trent 900 HP/IP hub assemblies with nonconforming oil feed stub pipes. Additionally, Rolls-Royce released an IP turbine overspeed protection system software update designed to shut down an engine in the event of an overspeed.

According to the ATSB, Rolls-Royce has also improved their quality management system in respect to the management of nonconforming parts, both in the manufacturing process and in-service.

Relevance to NASA

The highly critical and complex nature of Airbus A380 aircraft and Trent 972-84 engines shares similarities with many of NASA’s own systems. With such complex systems, numerous interdependencies exist of a tightly coupled nature that demand regular and open communication between all design, manufacturing and quality personnel. These systems — and their components — require adherence to strict configuration control, workmanship and process control requirements. In regards to Qantas Flight 32, a breakdown is apparent in communication between the design and manufacturing phases.

Recently published NPR 8735.2B defines critical acquisition items as “Products or services whose failure poses a credible risk of loss of human life; serious personal injury; loss of a Class A, B, or C payload (see NPR 8705.4); loss of a Category 1 or Category 2 mission (see NPR 7120.5); or loss of a mission resource valued at greater than $2M.” Complex acquisition items are defined as “Hardware products which have quality characteristics that are not wholly visible in the end item and for which conformance can only be established progressively through precise measurements, tests, and controls.” For procurement of critical and complex items, NASA contractors are required to adhere to various higher-level quality and workmanship requirements (e.g., SAE AS9100, J-STD-001, ANSI Z540.3, ANSI ESD S20.20, SAE AS5553), and NASA oversight of contractors is required to include detailed surveillance procedures (e.g., inspections, tests, process witnessing, record review, quality system audits).

References

In-flight uncontained engine failure: Airbus A380-842, VH-OQA. Final Report. Australian Transportation Safety Bureau. June 27, 2013.

Responsible NASA Official: Steve Lilley

Thanks to Brian Hughitt for his help with this study.

This is an internal NASA safety awareness training document based on information available in the public domain. The findings, proximate causes and contributing factors identified in this case study do not necessarily represent those of the agency. Sections of this case study were derived from multiple sources listed under References. Any misrepresentation or improper use of source material is unintentional.