Qantas A380 QF32 : défaillance moteur à Singapour

For each engine, two personnel were required, it stated, and that the examination would typically take 9-14h for a revenue flight and 6h for a non-revenue flight.

An oil fire is believed to have been responsible for the failure of the intermediate turbine disc on the Qantas plane forced to make an emergency landing in Singapore on November 4.

Rolls-Royce will will introduce a software fix that will stop the engine from getting near the point where it disintegrates, as well as hardware modification related to bearings.

The changes were revealed today by Airbus, which also said it would pull already modified engines from its production line to help Qantas get its aircraft back in the air.

Airbus Chief Operating Officer John Leahy told reporters in Sydney that Rolls-Royce had at some point fixed the bearing box on newer versions of the massive Trent 900 engine, a model designed for the massive A380 superjumbo. He said Rolls was now fixing it on older versions. The Herald Sun reported his comments on its website.

His comments did not address why Rolls-Royce had not fixed the bearing box in older versions of the engine.

Four problems dating to 2008 led to two warnings for airlines to check parts of the Trent 900.

Three of the four previous problems centered on the turbines or oil system.

Joerg Handwerg, a spokesman for the pilots' union for German airline Lufthansa, said that minor problems are routine for any jet engine, but it is possible that the issues were an indication that regulators did not adequately check the engine before approving it for commercial use.

"When you see we have a problem with not just one of these engines but several then it points towards that we have a problem in the certification process," Handwerg said

Questions are emerging about the design and vulnerability to serious malfunction of both the Rolls-Royce Trent 900 engine and the Airbus A380 airframe following the destructive failure of one of the turbofans on Qantas Flight QF32 Nov. 4.

Flying debris from the engine’s uncontained failure caused extensive airframe damage, and appears to have punctured fuel tanks and knocked out some of the A380’s hydraulic and electrical systems, as well as rendered the No. 1 engine unresponsive to shutdown attempts.

Moreover, it is not an isolated failure in Rolls-Royce’s Trent family. The Qantas incident comes shortly after a similar uncontained failure of a Boeing 787’s Trent 1000 during ground tests in August. While Rolls denies any direct link between them, in both cases the Trent’s intermediate pressure turbine (IPT) and oil system are suspect.

The European Aviation Safety Agency identifies an oil fire as the likely cause of the engine failure in its Nov. 10 airworthiness directive (AD) requiring additional inspections of Trent 900s.

In the wake of the Qantas incident, up to half of the world’s Trent-powered A380 fleet has been temporarily grounded. The engine failure occurred about 4 min. after Flight QF32 departed Singapore, bound for Sydney. The crew shut down the No. 2 engine, having received abnormal engine indications, and the aircraft returned to land about 45 min. later, after dumping fuel.

As investigators try to establish the sequence of events that led to the Trent’s failure, they are also probing the A380 hydraulic and engine control systems’ apparent vulnerabilities to damage. And Rolls has to address concerns raised by senior industry executives over its safety philosophy, as neither the Trent 900 nor 1000 have automatic or mechanical systems to shut off fuel supply in an oil-fire-related ITP failure.

Under scrutiny is why the engines continued to operate once the failures started, amplifying the destruction. Rolls designed the engine to run down intact after a turbine failure, yet it did not.

From an airframe perspective, the failure of the A380’s standard and emergency engine shutdown systems, as well as the apparent loss of one of the two hydraulic systems, may also force system redesign.

Another aircraft system question stems from the fact the No. 1 engine could not be shut down. The high-pressure fuel shutoff valve, normally controlled by the full authority digital engine control on the ground during engine start, is inhibited when the engine is running above idle or is in flight. “Fuel off” is normally selected to shut down the engine in this condition by activating a master lever to the “OFF” position in the flight deck. An emergency shutdown system, which also appears to have failed, consists of low-pressure fuel shutoff valves commanded by pushing the engine fire switch.

The A380’s control surface actuators are powered by two independent hydraulic systems (Green and Yellow), with most surfaces having backup electrical power from one of two independent systems. Images from the AF32 incident show evidence of certain inoperative control surfaces, pointing to a failure of the Green system. According to industry sources, debris from the uncontained failure punctured at least one fuel tank and may also have caused problems with the fuel system controls, which became partially inoperative and prevented some cross-feed functions.

The exploded engine was scary enough. But in the days following the emergency landing of the Qantas A380 in Singapore, it has become clear just how dangerous the situation was. Multiple systems on the aircraft failed and a disaster was only narrowly avoided.

Rarely had so much flying expertise been assembled in one cockpit. A training pilot was sitting behind Captain Richard de Crespigny, who was completing his annual flight test. Sitting next to them was a third captain whose job was to supervise the training pilot. Together, the Airbus A380 operated by Australia's Qantas Airways had a total of 100 years of flying experience sitting in its cockpit.

Four minutes after takeoff from Singapore, that accumulated expertise was suddenly in great demand. At an altitude of 2,000 meters (6,560 feet), engine two of the double-decker aircraft exploded. The loud bang of the detonation had hardly faded away before 53 error messages appeared on the monitors.

Rarely had so much flying expertise been assembled in one cockpit. A training pilot was sitting behind Captain Richard de Crespigny, who was completing his annual flight test. Sitting next to them was a third captain whose job was to supervise the training pilot. Together, the Airbus A380 operated by Australia's Qantas Airways had a total of 100 years of flying experience sitting in its cockpit.

Four minutes after takeoff from Singapore, that accumulated expertise was suddenly in great demand. At an altitude of 2,000 meters (6,560 feet), engine two of the double-decker aircraft exploded. The loud bang of the detonation had hardly faded away before 53 error messages appeared on the monitors.

"It was unbelievably stressful. But in a situation like that, you have no choice but to keep on going," says Richard Woodward. The captain knows what he is talking about. He also flies the A380 for Qantas, is the vice president of the International Federation of Airline Pilots' Associations (IFALPA) and has looked after the crew since the near-catastrophe almost two weeks ago. "The crew has dealt with this situation extraordinarily well," Woodward reports. "They're like horseback riders who, after a fall, are eager to get back on their horses."






"This raises the question of whether the aircraft is improperly designed," says Woodward. "Apparently certain connections are not redundant; or the two cables are positioned so close together that the shrapnel destroyed them simultaneously."

The aircraft manufacturer is defending itself against such accusations. The aircraft, says Airbus spokesman Stefan Schaffrath, was "controllable until the landing," and the autopilot continued to function. "There are two separate hydraulic and electrical systems," Schaffrath adds.
But some of the brakes were no longer working properly. Luckily, the pilots were able to land in Singapore, which has a very long, 4,000-meter runway.

Another dramatic aspect of the emergency landing was that an anti-lock system also stopped working. Three tires burst when the plane touched down as a result, sending sparks into the air. "And that was with two holes in the tank!" says Woodward.

Very Conservative

At least the reason for the engine explosion is now clear. Last week, Rolls-Royce identified a defective part in the turbine, which caused an oil leak that led to the fire. Of the superjumbo jets delivered to date, 20 are affected by the problem, including three at Lufthansa. The defective engine part will gradually be replaced.

Qantas pilot Woodward is pleased that his company has made a "very conservative safety decision" to temporarily ground the A380. But he does wonder why the other airlines potentially affected by the engine defect are not taking similar precautions.
Lufthansa points out that it has such short maintenance intervals that dangerous oil leaks are bound to be discovered. But Woodward isn't convinced, saying: "Our plane had just returned from maintenance in Frankfurt, and the accident happened nonetheless."

The Airbus presentation to accident investigators of the damage done to QF32 on November 4 gives new technical insights into this near disaster involving a Qantas A380 with 466 persons on board.

The examination of the damage is far from complete, as the presentation makes clear. It doesn’t deal with the other dimensions of this serious incident, which are the loss or impairment of various systems on the giant airliner, and the emerging difficulties the crew faced from fuel load imbalance caused by some of those failures.


The diagrams need to be compared to the photos shown later in this report








One thing needs to be kept firmly in mind. Rolls-Royce the maker of the Trent 900 engine which disintegrated knew about the faults that the current airworthiness directive concerning these engines says are likely to have caused an intense oil fire in a structural cavity in the intermediate pressure turbine area of the engine.

Rolls-Royce had designed and was introducing a fix for the oil leak issues for this into the engines at its own speed. Qantas was left in the dark. It is fair to suggest that Qantas needs to review relationships with engine manufacturers in which it pays for power by-the-hour and leaves much of the maintenance and oversight of those engines to the designer and manufacturer.

To emphasise the obvious. The interests of the engine maker and holder of the service agreements are not the same as those of the airline. A carrier might want to correct and replace inadequate design features to a different, more urgent timetable that the party that benefits from the support contract, and has its own brand image to protect.











Some impact damage was done to underbelly and side of the A380

The set of graphics shown above were accompanied by a brief written and photographic overview of the damage as currently assessed.














Reviewing these images makes it clear why Qantas was quick, and correct, in grounding its A380 fleet.

The wing of the jet shows remarkable structural strength in sustaining damage that might have destroyed the airliners of earlier decades, but the questions as to whether control system revisions are necessary to deal with some of the consequences in terms of failed hydraulics and fuel imbalance are said to be very actively under consideration.

And the questions concerning the timeliness of the Rolls-Royce responses to a known problem, and its capacity and willingness to share them with the airlines concerned will not go away. If the engine maker doesn’t address them its customers will.

Assessment of the Qantas Airbus A380 involved in an in-flight engine failure has revealed the extent of peripheral damage to the jet from ejected fragments.

While the Australian investigation team leading the inquiry has yet to produce a preliminary report, ATI has ascertained that three high-energy fragments were released by the intermediate-pressure turbine disk during the failure of the inboard left-hand Rolls-Royce Trent 900 engine on flight QF32.

Two of the three sections of disk debris cut through two wiring routes and this damage subsequently prevented the shutdown of the adjacent outboard engine after the aircraft landed at Singapore.

Sources familiar with the investigation state that the crew "had to manage a dynamic situation" as the A380 sustained structural and systems damage in several other areas.

While all flight-control surfaces remained available in the pitch and yaw axes, roll control was affected although it continued to be available through the inner aileron on the left wing, and the mid- and inner aileron on the right wing.

Several spoilers - four on the left wing, and five on the right - were also able to contribute to roll control. These spoilers were those activated by the 'yellow' hydraulic channel, one of two hydraulic systems on the type.

Slats on the aircraft - which are linked to the 'green' hydraulic channel - were jammed in the retracted position but the flaps, which are connected to both channels, were available to the pilots.

Loss of the slats and partial degradation of the roll control led the A380's flight-control laws to revert to 'alternate', while 'normal' law was retained in the longitudinal and lateral axes.

"Flight envelope protections were still active," the source states.

As the aircraft returned to Singapore following the engine failure, the autopilot remained engaged until the jet descended to about 700ft at which point the crew took manual control of the aircraft, with the flight directors on.

This also included manual control of the three remaining operational engines on the stricken aircraft. Flaps were in position '3', one stage from full deployment, the normal configuration for approach. The landing took place about 1h 40min after the failure.

Normal braking was available on the fuselage landing-gear bogies, including anti-skid, while alternate braking without anti-skid was available on the wing landing-gear. "The crew modulated braking in order to stop close to emergency services," says the source.

Airbus and Rolls-Royce simply state that they are assisting the Australian Transport Safety Bureau with the investigation and are supporting other operators of Trent 900-powered A380s.

Australian safety authorities expect by the end of this week to finish their inspection of the Qantas Airbus A380 engine that suffered an uncontained failure near Singapore on Nov. 4.

The Rolls-Royce Trent 900 engine “is being progressively dismantled” in an engine workshop in Singapore, according to the Australian Transport Safety Bureau (ATSB). The agency says it will issue a preliminary factual report by Dec. 3.

The areas of most concern have been investigated, with the removal of the low-pressure turbine module enabling access to the damaged intermediate-pressure turbine area. The disassembly and examination of the rest of the engine should be completed within days.

Scrutiny of the aircraft itself is likely to continue for at least the rest of this week, the ATSB says. Some wing and body fairing panels have been removed “to facilitate the examination of the underlying structure and systems affected by the engine failure.”

Meanwhile, the ATSB says analysis has been completed on the recovered section of the No. 2 engine turbine disk that was identified as being crucial to the investigation. This was carried out at a Rolls-Royce facility in the U.K., under the supervision of the ATSB.

The search for the rest of the turbine disk and other engine debris has been concluded by the Indonesian National Transportation Safety Committee and the ATSB. Several smaller components were discovered, including turbine blades and blade attachments, but remaining “significant parts” of the turbine disk were not found, the ATSB says.

An Airbus information telex (AIT) to all A380 operators was dispatched by the manufacturer on 17 November informing them, basically, of what the crew of flight QF32 had to deal with when their No 2 Rolls-Royce Trent 900 engine suffered an uncontained engine failure.

Provided to Flight International by an industry source, the AIT is intended to inform operators about what systems remained operational despite the extensive damage to the airframe, particularly the wing close to the leading edge near the engine. This is what the AIT says:

"This AIT has been approved for release by the Australian Transport Safety Bureau (ATSB) who leads the on-going ICAO Annex 13 investigation.

"The second R-R inspection program applicable to the Trent 900 engine family and covered by EASA Engine Airworthiness Directive has been published allowing continuous operations of the fleet. Together with its partners, Airbus is providing support to the operators for engine logistics to minimize interruptions to the fleet.

"One single high energy fragment [see graphic] is considered from a certification requirement viewpoint. The damage assessment has established that the intermediate pressure turbine (IPT) disc released three different high energy fragments, resulting in some structural and systems damage, with associated ECAM warnings. Therefore the crew had to manage a dynamic situation.

"Despite the situation, amongst the various available systems supporting the crew to operate the aircraft and return safely to Singapore were:

•"The flaps remained available (slats were jammed retracted);
•"All flight control surfaces remained available on the pitch and yaw axis
•Roll control was ensured through the following controls: (a) on the left wing: inner aileron, spoilers 1, 3, 5 and 7; (b) on the right wing: mid and inner ailerons, spoilers 1, 3, 5, 6 and 7.
•"Flight control law reverted to Alternate Law due to the loss of the slats and of some roll control surfaces. Normal Law was kept on longitudinal and lateral axes.
•"Flight envelope protection was still active.
•"The autopilot was kept engaged [during approach] until about 700ft on radio altimeter, at which time the crew took over manually. Flight Directors were ON.
•"Manual control of engines 1, 3 & 4 was maintained till aircraft stop.
•"Landing in Singapore took place about 1 hour 40 minutes after the engine 2 failure with flaps in configuration 3.
•"Normal braking was available on both body landing gears with antiskid, and alternate braking without antiskid on both wing landing gears. The crew modulated braking in order to stop close to emergency services.
•"The reason engine No 1 could not be shut down after the aircraft came to a stop, has been determined: Two segregated wiring routes were cut by 2 out of the 3 individual units of disc debris."