Friday, November 05, 2010

The "A" Model

There's an old saying in aviation that goes "Never fly the 'A' model of anything!" It neatly encapsulates the conservatism and resistance to change that, whether through innate personality, training, or experience, is an enduring trait of professional aviators. There's also the hard fact that a number of new aircraft designs over the years had hidden flaws that became apparent only after a fatal crash or two. Much more commonly, the bugs aren't serious enough to cause an accident, but cost early-adopting operators considerable time, money, and operational reliability while they work through the teething stage. This was the case with Horizon when they were the launch customer for the Q400, and with the JungleBus when jetBlue, USAir, and Republic took their first deliveries (At jetBlue, it was popularly known as the E180...because you'd always make a "180" back to the gate!).

On Thursday, a Qantas A380 suffered an engine failure six minutes after takeoff from Singapore's Changi Airport enroute to Sydney. Although modern engine failures are quite rare, they do happen, and they're not always indicative of a design or widespread manufacturing flaw. Even in a new design like the A380, an inflight engine shutdown would likely attract little interest outside of Qantas, Airbus, and Rolls-Royce.

This engine, however, failed in a very violent fashion, essentially blowing itself apart - a rare event known as catastrophic failure. When any such failure does happen, it most typically originates in the fan stage. For this reason, cowlings are built extraordinarily strong in the area around the fan blades, and engine manufacturers conduct rather spectacular tests to ensure they are sufficient to contain any catastrophic failure. You can see the "Blade Off" test for the A380's Rolls-Royce Trent 900 engines here.

In this case, the failure appears to have originated in the high-pressure compressor or turbine sections, creating an uncontained engine failure. Any uncontained failure is an extremely eye-raising event, given its extreme rarity and potential danger, but never more-so than in a brand new design. What makes this one worse yet is the extensive damage it did to the airplane. The worldwide press, usually happy to hype minor incidents out of proportion, has been unusually reserved in reporting this as a mere engine shutdown or loss of a cowling. Photos of the damage to tell an entirely different story:

There are at least two major complete perforations of the wing visible, along with several smaller ones. Fuel vapor is visibly streaming out of the two large holes in the upper picture. Considering that those holes were likely made by turbine blades that have a normal operating temperature of 500-900ยบ C, and that onboard witnesses reported seeing flames around the engine, I think the potential for a catastrophic fire resulting in the loss of the aircraft and 466 souls was very real. I don't think Qantas, Lufthansa, or Singapore Airlines were overreacting by grounding their remaining Trent-900 powered A380 fleets pending initial inspections.

Whether this failure originated in a design flaw or faulty procurement or manufacturing processes, or was simply a one-off fluke, will probably take some time to determine. In the meantime, there will be plenty of very concerned folks at Airbus, Rolls-Royce, and the early A380 operators - to say nothing of A380 passengers. Meanwhile, I don't think anyone at Boeing is popping champaign corks over their competitor's troubles: the forthcoming B787 is powered by the similar Trent 1000 engine, which suffered a very similar uncontained failure during ground testing this last August.


Don Hodges said...

Aviation Week says they are looking at failure of the shaft spline retaining the compressor disk, allowing the disc to translate aft into stator ring.

Sam said...

Don, I just read that article as well. There is an existing AD to address premature wear on the intermediate pressure (IP) shaft splines; however, failure of the splines would allow the IP *turbine* to move rearward, not the compressor. The damage is most consistent with turbine failure, as most of it appears to be aft of the hot section. One presumes that AD had been complied with on this aircraft, I wonder if the inspection intervals are about to get a whole lot smaller....

Sam said...

From the text of the AD:

"Wear, beyond Engine Manual limits, has been identified on the abutment
faces of the splines on the Trent 900 Intermediate Pressure (IP) shaft rigid coupling on several engines during strip. The shaft to coupling spline interface provides the means of controlling the turbine axial setting and wear through of the splines would permit the IP turbine to move rearwards. Rearward movement of the IP turbine would enable contact with static turbine components and would result in loss of engine performance with potential for in-flight shut down, oil migration and oil fire below the LP turbine discs prior to sufficient indication resulting in loss of LP turbine disc integrity. Some of these conditions present a potential unsafe condition to the aeroplane."

Among the wreckage found on the ground in Batam is a shattered (in three pieces) turbine disc, reportedly an IP turbine disc but I haven't seen that confirmed anywhere official.

Ron said...

Is the cowling around the turbine section not as robust as the area surrounding the fan? I just figured the whole cowling was designed to withstand whatever parts might be ejected from the rotational movement of that section. Even though the fan might be the place where most failures occur, the fan is turning a lot slower than the turbine section!

Anonymous said...

Sam- I dont know what I was refering to with 175- I meant Junglebus :)
I am also suprised at the medias restraint- although had it occured in the US, it probably would have been different...
When you get the chance I sent you an email with a few questions

Jeremy said...

Besides the fuel leak being downplayed by the media, I find it amazing there hasn't been more interest in the state of the #1 engine. According to everything I've read on the aviation sites, the electrical cables linking its FADEC to the cockpit were severed, and the engine "rolled back" to idle. There was not even any way to shut it down after landing (hence the water shutdown with the fire engines). So with #2 completely gone, and #1 at idle, this was essentially a dual, same-side engine out situation - which is pretty unprecedented for a modern 4-engine jet, yes? Not that it wasn't totally within the capabilities and design of the airframe to land safely on the remaining two engines, of course.

Dafydd said...

As an aside - in boat building a similar maxim applies . Build your first one for a customer - the second for a friend - and the third for yourself !

Jack said...

Do you even think the rich sheep PAX that ride these scarebuses know what an A380 is?

Anonymous said...

An unattributed list of the damage to QF32:

* massive fuel leak in the left mid fuel tank (the beast has 11 tanks, including in the horizontal stabiliser on the tail)

* massive fuel leak in the left inner fuel tank

* a hole on the flap canoe/fairing that you could fit your upper body through

* the aft gallery in the fuel system failed, preventing many fuel transfer

* fuel jettison had problems due to the previous problem above

* bloody great hole in the upper wing surface

* partial failure of leading edge slats

* partial failure of speed brakes/ground spoilers

* shrapnel damage to the flaps

* TOTAL loss of all hydraulic fluid in the Green System (beast has 2 x
5,000 PSI systems, Green and Yellow)

* manual extension of landing gear

* loss of 1 generator and associated systems

* loss of brake anti-skid system

* unable to shutdown adjacent #1 engine using normal method after landing

due to major damage to systems

* unable to shutdown adjacent #1 engine using using the fire switch!!!!!!!!

Therefore, no fire protection was available for that engine after the
explosion in #2

* ECAM warnings about major fuel imbalance because of fuel leaks on left side, that were UNABLE to be fixed with cross-feeding

* fuel trapped in Trim Tank (in the tail). Therefore, possible major CofG
out-of-balance condition for landing

Sam said...

Ron-- The certification regulations require engine makers to test for containment of the "most critical" fan blade, compressor blade, or turbine blade - that is, the one considered to be the likeliest to escape the engine core. Usually the fan blades are considered critical because of their much higher mass (although they do generally spin much slower than HP compressor or turbine blades). In this case, though, it appears that the IP turbine disc itself failed, not merely the blades...this is so massive that no economical or efficient engine could contain it.

Jeremy, I don't believe the #1 engine was at idle during the approach, from what I understand there was full control over engine speed but the wires controlling engine shut down as well as emergency shutdown were severed.

Jack-- Obvious you don't care for Airbusses but I don't think you can blame this one on the frogs. Their design survived some pretty massive damage. RR Trent engines also power the 777 and 787, and are developed from the RB211, which powered the L1011, DC10, and many B747s. This isn't just an Airbus thing.

Anonymous-- I've seen that unattributed list making the rounds. While I'm taking it with a grain of salt, the damage listed does seem to square with photographic evidence and first-hand passenger accounts. It's obvious that the crew had their hands very full dealing with multiple failures (for which combinations there were likely no established QRH procedures). A combination of crew skill, aircraft design, and good old fashioned luck kept this one from being a whole lot worse, I think.

Squishy said...

A catastrophic failure, for sure. It's always good to see a crew competent enough to put a plane on the ground after such damage. I work on King Air 90's (straight 90's, A,B, and C's) and the A versions always have a lot more beginning problems and much more maintenance work. Hopefully, whatever failed is fixed in later versions.

Anonymous said...

From sources in the airline that list is correct. Imagine what would be said if you copped something like that in a sim!

Sam said...

Yeah AvWeb confirmed most of that list the other day, as well as some previously unrevealed damage (heavily damaged wing spar...gulp!). No question these pilots earned every penny and then some getting the beast back to SIN...

Anonymous said...

This is really bad, I have seen the video too!


Anonymous said...

As has already been indicated here, there was no loss of thrust control to #1 engine. Communication with the FADEC was lost. In addition to standard AFDX communications, there is a secondary control path for throttle lever angle which in the evend of AFDX being lost, will be used in secondary control law. This is simply an analogue path which is connected to potentiometers on the throttle levers. As noted above, starting / shutdown, manual fire handle deployment, etc can only be executed if FADEC AFDX comms are still alive. On the T900 many functions found on older aircraft are handled by the FADEC without interaction from the cockpit; for example continious ignition is selected when water ingestion is detected and auto-relight is performed if the engine flames out. This is why it took a lot of effort to put the engine to rest with a fire hose.