Lessons Learned

Technical Related Lessons

Airplane level hazards associated with an uncontained engine failure are mitigated by the combined safety strategies for both the engine and airplane. This is accomplished by:

FOR THE ENGINE - Engine design, manufacturing, and maintenance programs are developed and implemented in order to achieve the lowest possible risk of experiencing an uncontained engine failure.

FOR THE AIRPLANE - Airplane design, manufacturing, maintenance, and operation programs are developed and implemented in order to minimize hazards to the airplane should an uncontained engine failure occur. (Threat Category: Uncontained Engine Failure)

  • In this accident, investigators learned that the oil feed stub pipe had been manufactured out of conformance with the approved design and installed on the accident engine. Once the accident engine entered airline service, fatigue cracks developed in the oil feed stub pipe, resulting in an internal oil leak and fire that progressed into an uncontained engine failure.  
  • The A380 accident airplane experienced damage to airplane structure and systems from the uncontained engine debris. In spite of the extent of damage, continued safe flight and landing was accomplished. Investigators attributed this to system isolation and redundancy which mitigated the associated hazards and allowed the flight to continue to navigate, control the flight path, and land safely.

For turbine engines, certain types of lubrication system failures or malfunctions have the potential to damage highly loaded rotating machinery, and in some cases can lead to uncontained engine failures. (Threat Category: Uncontained Engine Failures)

  • Lubrication system failures can result in a series of cascading failures that have the potential to result in catastrophic airplane effects. In this accident, an oil feed stub pipe in the intermediate pressure turbine section developed a fatigue crack which over time progressed into an atomized oil leak. The leaking oil was being introduced into a high temperature area and was determined by investigators to have autoignited and compromised the triple blade seal in the IP turbine bearing chamber. Once the blade seal was destroyed, fire rapidly progressed into a lower pressure region of the engine, rapidly heating nearby components and destroying the IP turbine drive arm. Once the IP turbine disc separated from the drive arm, the IP turbine oversped and burst into three pieces. Pieces of the ruptured disc penetrated the wing, and created a fuel leak which continued until after landing. Investigators concluded that the progression of events, from initiation of the oil leak, and culminating in the uncontained rotor burst elapsed over approximately one minute.

Fuel tank breaches pose an extremely hazardous condition for passenger safety, and can very quickly develop into external fires than can lead to injuries and loss of life. (Threat Category: Uncontrolled Fire/Smoke)

  • In this accident, the captain did not order an emergency evacuation. The flight crew was concerned with the combination of a fuel leak, fuel pooling under/around the airplane, hot brakes, and the potential for passenger injury during an evacuation. Fire and rescue personnel were at the airplane, applying firefighting foam to the undercarriage. Believing that the potential for fire was under control, the captain elected to keep the passengers on board the airplane until fire and rescue personnel had completely mitigated the fire threat.
  • A fuel system breach can easily result in ignition, and thus, fire or explosion. Large fuel leaks have quickly led to external fires resulting in loss of life and/or airplane hull loss. Although the process involved in the ignition of jet fuel vapors is complex, post-accident fuel ignition can generally be attributed to two causes:
    • Hot surface ignition: This is the auto-ignition temperature of a substance, and is the lowest temperature at which it spontaneously ignites. For most jet fuels, this temperature can be as low as 400 degrees F. A post-accident aircraft can have many surfaces well above this temperature, such as turbine engine tailpipes and aircraft brakes.
    • Electrical arcs: This ignition process is usually related to the fuel vapor flammability envelope, and is also influenced by ambient temperatures and pressures. For Jet-A fuels, vapor ignition can take place at extremely low spark energy levels, and in some conditions, with a spark as little as one thousandth of a Joule, or less. Such a small spark is barely visible to the human eye. Damaged wiring can easily involve sparking with energies well above these levels.

Common Theme Related Lessons

Risk management processes relative to manufacturing escapes/non-conformities should be consistently applied regardless of the delivery status of the parts in question. (Common Theme: Organizational Lapses)

  • Rolls-Royce discovered that 100 oil feed stub pipes had been produced with misaligned counter bores, potentially thin pipe walls, and released into service. Investigatores stated that a process to assess the degree of non-conformance (or significance of a manufacturing error on the integrity of the stub pipe) for parts that had already entered service did not exist. A statistical analysis was performed on nine stub pipes that were in process in the factory, and it was determined, based on the results of the study, the 100 pipes already in service could remain in service. Additionally, as stated in the accident report, the non-conformance "was assessed to have no effect on the customer." As a result, the 100 affected stub pipes were not retrieved and remained in service.

Back to top