- Qantas Flight 32 at Indonesia
- Accident Overview
- Accident Board Findings
- Accident Board Recommendations
- Relevant Regulations / Policy / Background
- Prevailing Cultural / Organizational Factors
- Key Safety Issue(s)
- Safety Assumptions
- Resulting Safety Initiatives
- Airworthiness Directives (ADs) Issued
- Common Themes
- Related Accidents / Incidents
- Lessons Learned
- Qantas Flight 32 at Indonesia
Photo of Qantas A380
Photo copyright Mark Kwiatkowski - used with permission
History of Flight
On November 04, 2010, Qantas Flight 32, an Airbus A380 powered by four Rolls-Royce Trent 900 engines and operated by Qantas Airways Ltd, departed Changi Airport, Singapore on a scheduled passenger flight to Sydney, Australia. Onboard were five flight crew, 24 cabin crew and 440 passengers. About four minutes after take-off, while the aircraft was climbing through approximately 7,000 feet over Batam Island, Indonesia, the flight crew heard two "bangs." The noises were the result of an uncontained engine rotor failure (UERF) of the No. 2 engine. Debris from the engine impacted the aircraft, resulting in significant damage to the aircraft structure and systems and caused fuel leakage from left wing fuel tank.
Immediately following the engine failure and resulting aircraft damage, a number of system warnings and cautions were displayed on the electronic centralized aircraft monitor (ECAM). Initially, the ECAM displayed a turbine overheat warning for the No. 2 engine. Engine debris had impacted the aircraft, resulting in significant structural and systems damage. A large fragment of the turbine disc penetrated the left wing leading edge before passing through the wing front spar into the left wing fuel tank and exiting through the top skin of the wing. The fragment initiated a short-duration, low-intensity flash fire inside the fuel tank. Ambient conditions within the tank were not suitable to sustain the fire. A large fragment of the turbine disc also severed electrical wiring inside the wing leading edge. Hydraulic and electrical distribution systems were also damaged, which effected other systems.
Photos of No. 2 engine damage, aircraft damage, fuel leakage, and wiring system damage - ATSB accident report
Subsequent to the engine failure, the flight crew received air traffic control (ATC) clearance to enter a holding pattern, where for 50 minutes they completed ECAM procedures and performed aircraft controllability checks. An assessment of landing distance requirements was accomplished that included consideration for a number of critical system failures (e.g. inoperative wing leading edge devices, inactive number one engine thrust reverser, and a high number of system and flight control malfunctions). A successful approach and landing were completed at Changi Airport.
Once coming to a full stop, the captain did not order an emergency evacuation. The offloading of passengers was delayed for approximately one hour, as the flight crew was not able to shut down the No. 1 engine. Investigators determined that the captain had been concerned about the still operating No. 1 engine, high brake temperatures, large fuel leaks, and potential injuries to passengers during an evacuation. Believing that firefighting personnel had minimized the danger of a fire, the captain delayed passenger offloading until an air stair could be brought up to the right side of the airplane, opposite from the running engine. Passenger unloading via the air stair required approximately one hour. The No. 1 engine was finally shut down, about three hours after the aircraft landed, by pumping firefighting foam directly into the engine inlet. There were no reported injuries to passengers or crew. There were no confirmed injuries to persons on Batam Island where a large segment of the IP turbine disk fell.
Photo of damage caused on ground by IP turbine disk - image excerpted from ATSB accident report adn supplied to ATSB by 'Postmetro' newspaper, Indonesia
Rolls-Royce Trent 900 Engine
Illustration of Trent 900 main rotating assemblies (left) and IP turbine module (right) - ATSB accident report. Image source Rolls-Royce RB211-Trent 900 Line and Base Maintenance training guide
As described in the accident report, "The Rolls-Royce Trent 900 is a three-shaft, high-bypass ratio turbofan engine with variants ranging in maximum thrust from 334.3 kN (75,152 lb.) to 374.1 kN (84,098 lb.). The three primary rotating assemblies in the Trent 900 are:
- a low pressure (LP) compressor (fan) connected by a shaft to a five-stage LP turbine
- an intermediate pressure (IP) compressor connected by a shaft to a single stage IP turbine
- a high pressure (HP) compressor driven by a single-stage HP turbine.
Each rotating assembly is supported by bearings at the front and rear of each shaft."
The accident engine was a Rolls-Royce Trent 972-84 t, with a rated maximum take-off thrust of 76,752 lb.
Photo of bearing chamber service pipes in HP/IP support structure - ATSB accident report
The engine is of modular construction with a separate module for the IP turbine. The IP turbine module consists of the IP shaft, turbine disc and blades, nozzle guide vanes (NGVs), IP turbine case, LP turbine front panel, bearings for both the HP and IP, and their support structure. The bearings are located in a hub surrounding an oil fed chamber, and are connected to the IP turbine case via a ring structure that has a front and rear panel. Support struts pass through the IP turbine NGVs.
The oil feed, scavenge, and vent pipes pass through the outer hub, then through the buffer space, and are attached to the inner hub via interference fit. These pipes have an extension, referred to as a stub pipe, which includes additional length, allowing the pipe to reach the inner hub. To accommodate an integral filter in the oil feed stub pipe, the inner hub end of that pipe has an enlarged inside diameter.
Cross section of a generic HP/IP hub with a service pipe (left) and a generic HP/IP hub with an oil feed stub pipe (right) - ATSB accident report
Oil Pipe Manufacturing Error
The oil feed stub pipe within the HP/IP hub assembly was manufactured with insufficient wall thickness. The incorrectly manufactured oil feed stub pipe on the No. 2 engine developed fatigue cracking which led to an oil leak and then an internal oil fire.
Photo of fractured oil feed stub pipe wall measurements (left), diagrammatic representation of the offsets produced during manufacturing operations (right) - ATSB accident report and modified by ATSB from a Rolls-Royce plc supplied model
Illustration of oil feed stub pipe failure and oil fire
Illustration of HP turbine triple seal failure
Illustration of drive arm heating and disc separation from the drive shaft
Illustration of HP unrestrained IP turbine disc acceleration and burst - Note: all images above excepted from ATSB accident report and were modified by ATSB based on a Rolls-Royce plc supplied model
Engine Failure Sequence
Investigators determined that the uncontained failure of the IP turbine rotor progressed in five phases:
1. Oil feed stub pipe failure and oil fire
Fatigue cracking had developed in the oil feed stub pipe. The cracking grew and on this flight led to an oil leak which atomized and likely auto-ignited about one minute prior to engine failure. Pressures and temperatures in the HP/IP bearing chambers were such that auto-ignition was probable. Temperatures in the bearing chamber were in excess of 365 °C, and the auto-ignition temperature of the leaking oil was as low as 280 °C. Investigators believe that auto-ignition occurred immediately when the leak began.
2. HP turbine triple seal failure
About ten seconds before engine failure, the fire breached the front face of the HP/IP bearing chamber and impinged directly on the triple seals. The intense heating distorted the seals, leading to their complete failure and separation from their support structure. When the triple seals were breached, hot gases exiting the HP turbine were drawn into the lower pressure space behind the HP turbine disc.
3. Drive arm heating and disc separation from the drive shaft
The IP turbine drive arm, via the IP drive shaft, transmits power generated by the IP turbine to the IP compressor. Following the failure of the triple seals, the resulting change in the pressure distribution inside the engine resulted in intense heat and flame being directed onto a second triple seal at the rear of HP/IP bearing chamber. This triple seal also failed, allowing flame to be directed onto the drive arm. The drive arm rapidly heated and then failed, separating the IP turbine from the IP drive shaft. The unrestrained turbine then moved rearwards and contacted the LP turbine front panel.
4. Disc acceleration and burst
Immediately after the drive arm failure, HP turbine airflow caused the unrestrained IP turbine disc to accelerate to destruction. The IP turbine disc burst into three pieces, four seconds after failure of the drive arm.
5. Flight crew response leading to engine shutdown
Twenty-nine seconds after the disc separated from the drive shaft, and in response to the ECAM overheat indication, the flight crew reduced thrust on the No. 2 engine to idle. Fifteen seconds later, the thrust lever was advanced and, after an initial thrust increase, the engine surged, whereupon it was shut down by the flight crew.
An animation of the failure sequence is available at the following link:
Photo of decompression damage to HP/IP hub structure - ATSB accident report
Photo of Initial disc segment trajectories, looking rearward - ATSB accident report
Photo of Rolls-Royce Trent 900 engine damage - ATSB accident report
Photo of fire damage to No. 2 engine - ATSB accident report
Following the engine failure, an external fire developed in the lower left region of the No. 2 engine nacelle.
Photo of Flash Fire damage to Fuel Tank - ATSB accident report
A passenger who was seated on the upper left deck of the aircraft reported observing a fire coming from the hole in the left wing skin that lasted for five to six minutes. None of the flight crew reported being aware of a fire in the left wing. Post-accident examination of the left wing revealed a region of sooting inside the fuel tank. Investigators determined that the passenger had a clear view of the No. 2 engine through the damaged section of the wing. Due to the duration of the fire and location of the passenger, it is believed that the passenger observed the No. 2 engine fire rather than the fuel tank's flash fire.
Airplane System Effects
Engine debris damaged a number of systems. As a result, a number of other systems were impacted. Investigators characterized the bulk of system damage as damage to wiring resulting in various system effects as follows: (Excerpted from accident report)
Trajectory of the major disc segments and photos of wiring system damage - ATSB accident report. Left image supplied by Airbus
|System||Loss of function or Effect|
|Air conditioning||The bleed air ducts in the left wing leading edge and center fuselage were damaged from impact by the engine debris, affecting the distribution of bleed air from engines No. 1 and 2 and the APU. The damage was detected by the ODS and the affected pneumatic systems were isolated in less than 10 seconds. There was no operational impact.|
|Braking||-Loss of function to the left wing gear brakes|
-Reduction of function in the right wing gear brakes (including anti-skid)
|Cabin Systems||Partial loss of bleed air, resulting from damage to the:|
-Left wing system ducting
-APU bleed air ducting
|Electrical Power||Electrical power, was affected either as a direct result of the damage from the engine failure, or due to actions taken by the flight crew as part of the ECAM procedures: |
-A loss of electrical power generation at engines No. 1 and 2
-The loss of one of the aircraft's four alternating current (AC) systems
-The inability to connect the aircraft's auxiliary power unit (APU) generators on the ground
|Engine Controls||Auto-thrust function:|
-Reduction in the automatic control function to engines No. 1, 3 and 4
|Engine Fuel and Control||Fuel leakage from the No. 2 engine feed tank|
-Loss of function to engines No. 1 and 2 low pressure fuel shutoff valves
-Loss of function to the No. 1 engine high pressure shutoff valve
-Loss of function of numerous fuel system components (valves and/or pumps)
-Degradation of the fuel quantity management system
-Reduction in capability of the automatic and manual fuel transfer function
-Disabling the fuel jettison system
-Inability to shut down No.1 engine
|Fire Protection||-Loss of function to one of the two extinguisher bottles in engines No. 1 and 2|
|Flight Controls||-Reduced aileron and spoiler function |
-The loss of wing leading edge slats and droop nose function.
|Fuel||-Loss of the fuel isolation valves (LPSOV) for the No. 1 and No. 2 engine|
-Loss of the fire protection system for the No. 1 engine
-All means of shutting down the No. 1 engine
-Loss of fuel transfer system
|Hydraulic Power||-Partial loss of green hydraulic system|
-Reduced redundancy within the aircraft's other (yellow) hydraulic system
|Ice and Rain Protection||Unspecified|
|Landing Gear||-Normal extension function was no longer available|
Post Landing Events
Diagram of LPSOV closure signal redundancy - ATSB accident report. Image supplied by Airbus
Photo of foam being sprayed into No. 1 engine - ATSB accident report. Photo supplied by Air Accident Investigation Bureau of Singapore
Photo of passengers offloading onto runway - ATSB accident report. Photo supplied by Air Accident Investigation Bureau of Singapore
Following landing and after coming to a stop on the runway, the No. 1 engine continued to run at thrust levels above ground idle and could not be shut down. The No. 1 engine was finally shutdown about three hours after landing. Shutdown was accomplished by pumping firefighting foam directly into the engine. Investigators later attributed the inability to shut down the engine to severing of wires in the left wing leading edge and belly fairing of the aircraft which caused loss of control of the No. 1 engine low pressure shutoff valve.
The captain did not order an emergency evacuation. Investigators concluded that the inability to shut down the No. 1 engine, leaking fuel, and hot brakes were a concern to the flight crew. Believing that fire control personnel had minimized the potential for a fire, and amid concerns about the potential for passenger injury, the captain elected to keep passengers on the airplane rather than evacuate. About an hour after landing, passenger offloading was begun using a single exit on the right side of the airplane. Passenger unloading took about an hour and was completed two hours after landing.