Qantas Flight 32

Date

4 November 2010

Phase of flight

Climb

Location

Overhead Batam Island, Indonesia; landed at Singapore Changi Airport

Aircraft

Airbus A380-842

Registration

VH-OQA

Operator

Qantas Airways

Flight

Qantas 32

Occupants

469

Fatalities

0No injuries among the 469 on board (5 flight crew, 24 cabin crew and 440 passengers) and no confirmed injuries on Batam Island

Investigating body

Australian Transport Safety Bureau

Final report

AO-2010-089

Report date

27 June 2013

Report title

In-flight uncontained engine failure, Airbus A380-842, VH-OQA, overhead Batam Island, Indonesia, 4 November 2010

On 4 November 2010 Qantas flight 32, an Airbus A380 bound from Singapore to Sydney, was climbing through about 7,000 ft over Batam Island, Indonesia, when the intermediate pressure turbine disc of its No. 2 engine burst. Fragments passed through the left wing, a fuel tank and the belly fairing, cutting about 650 wires. The crew faced a long series of ECAM messages, returned to Changi Airport and landed safely. No one on board was injured.

The Australian Transport Safety Bureau (ATSB) investigated. Its final report, AO-2010-089, published on 27 June 2013, traced the burst to an oil fire inside the Rolls-Royce Trent 900, started by a fatigue crack in a pipe whose wall had been machined too thin during manufacture. It also found that the damage exceeded what the design guidance for uncontained engine failures had assumed.

For pilots, flight 32 is a study in managing a complex failure without hurry: fly the aircraft, gain time, share out the work, check what the aircraft can still do, and only then land.

The flight

VH-OQA was an A380-842, serial number 0014, built in 2008 and powered by four Rolls-Royce Trent 972-84 engines, numbered 1 to 4 from left to right. It had flown 8,533 hours and 1,843 cycles. On the day it took off at 464,040 kg, against a maximum take-off weight of 569,000 kg.

The flight deck held five pilots: the captain, the first officer, a second officer for crew relief, and two check captains, one under training and one supervising him. There were also 24 cabin crew and 440 passengers. The weather was good, with light winds and no significant weather, and the flight was conducted in visual conditions. Times below are UTC; Singapore local time was UTC + 8 hours.

The accident

Flight 32 departed from runway 20C at Changi at 01:56:47. At about 02:01, climbing through 7,000 ft at 250 kt, the crew heard two almost coincident loud bangs. The captain selected altitude and heading hold. The autothrust was no longer available, so he retarded the thrust levers by hand to control speed.

The ECAM first showed a No. 2 engine turbine overheat, then many other messages. The captain confirmed he had control and the first officer began the procedures. The crew transmitted a PAN, shut down the No. 2 engine and tried to discharge both of its fire extinguisher bottles, but received no confirmation that either had fired.

With the aircraft controllable and ample fuel on board, the crew chose to hold rather than hurry back. They asked ATC for a holding area within 30 NM of Changi and flew a racetrack pattern at 7,400 ft. Cabin crew and passengers could see damage to the left wing and fuel escaping from it. The second officer went into the cabin to assess the damage, helped by the fin camera view on the entertainment system.

The damage affected many systems. The report lists, among others:

• Hydraulics: loss of the green system and reduced redundancy in the yellow system.
• Electrics: loss of generation from engines 1 and 2 and of one of the four AC systems.
• Flight controls: reduced aileron and spoiler function; loss of the leading edge slats and droop nose.
• Engines: loss of autothrust; engines 1 and 4 in degraded mode and engine 3 in alternate mode.
• Landing gear and brakes: no normal gear extension; reduced right wing gear braking and no left wing gear braking.
• Fuel: leaks from the left wing, fuel jettison inoperative, and fuel transfer restricted.
• Fire protection: one of the two extinguisher bottles lost on each of engines 1 and 2.

Completing the ECAM procedures took about 50 minutes. The crew then assessed what still worked and calculated the landing distance with the landing performance application (LPA). Entering the maximum landing weight and nine inoperative systems produced a "no result" message; using the actual weight showed a landing on runway 20C was possible with about 100 m to spare. The crew checked handling before leaving the hold and in each new configuration, extended the gear by gravity and flew a long final, controlling speed with the No. 3 engine while engines 1 and 4 gave symmetrical thrust.

The aircraft landed at 431,712 kg, about 41 tonnes above its maximum landing weight of 391,000 kg. During the approach the flight envelope protection generated two "low energy" alerts, at 1,000 ft and 362 ft radio altitude, and a stall warning at 3 ft; Airbus later confirmed that all three were genuine and that the margins were maintained. The captain flew the last 800 ft by hand after a second automatic autopilot disconnection. The aircraft touched down at 03:46:47 and, with manual braking and reverse thrust on the No. 3 engine, stopped about 150 m from the end of the 4,000 m runway.

After shutdown the aircraft's electrical system reverted to a configuration similar to emergency power, leaving one display and one VHF radio. The left body gear brakes were indicating 900 °C and rising, fuel was leaking from the left wing, and the No. 1 engine would not stop. Firefighters laid foam under the wing. With the fire risk being managed, the crew decided that a precautionary disembarkation by stairs, through a single door on the right side and with the other doors kept armed, was the safest course. The last passengers left about two hours after landing. The No. 1 engine was stopped by pumping foam into its intake, about three hours after landing.

The investigation

A cracked oil pipe and an internal fire

Each Trent 900 has three shafts: a fan driven by a five-stage low pressure turbine, an intermediate pressure (IP) compressor driven by a single-stage IP turbine, and a high pressure (HP) compressor driven by a single-stage HP turbine. A short oil feed stub pipe supplies oil to the HP/IP bearing chamber.

In the No. 2 engine a fatigue crack had grown in that pipe. On the accident flight it opened far enough to release an atomised oil spray into the buffer space around the bearing chamber, where air temperatures were 365 to 375 °C. The engine oils had auto-ignition temperatures as low as 280 °C, and the oil ignited. The ATSB described the rest in phases: the fire breached the buffer space and caused the HP/IP seals to fail, then played on the IP turbine drive arm until it failed at 02:01:07. The unloaded disc moved aft and accelerated.

The manufacturer expected that after such a separation the disc would rub on the structure behind it, the engine would surge, and the HP compressor would stay stalled and run down, keeping the disc below its burst speed. Instead the HP compressor partly recovered from the surge, keeping enough pressure behind the IP turbine to drive it past its burst speed. The disc failed at 02:01:11, four seconds after it separated, breaking into three main segments that penetrated the case. The Trent 900 had overspeed protection for its LP shaft failure but none for an IP shaft failure, because the designers had expected the engine behaviour to prevent a hazardous IP overspeed.

How the pipe came to be thin

The stub pipe's nominal wall thickness at its counter bore was 0.91 mm, and the minimum permissible, calculated by the ATSB from the design tolerances, was 0.82 mm. Measurements of the failed pipe showed a wall varying from 1.42 mm down to 0.35 mm. The counter bore had been machined off-centre because the hub moved during manufacture. The manufacturer's stress analysis showed how much this mattered: calibrated to the failed pipe's 677 cycles at 0.35 mm, the worst-case fatigue life rose to 5,445 cycles at 0.50 mm.

The ATSB found a chain of missed opportunities at the Hucknall facility that made the part. A manufacturing datum introduced during development was not tied to the stub pipe's position. The first article inspection in 2005 used manufacturing drawings instead of the design drawings. The coordinate measuring machine referenced a different datum from the drawings. A culture existed in which "minor" non-conformances were not declared. In 2009 an engineer identified misaligned counter bores in engines already in service, but the retrospective concession that allowed them to remain in service was granted without the required approval of the Chief Engineer and Business Quality Director, who would have assessed the risk to the fleet.

Damage beyond the design assumptions

A380 certification required design precautions to minimise the hazards of an uncontained engine rotor failure, following advisory material (AMJ 20-128A, and AC 20-128A in the United States) that assesses single fragments of defined sizes and spread angles, one scenario at a time. On VH-OQA, several fragments on different trajectories affected redundant system paths, including the No. 1 engine's fuel low pressure shut-off valves and fire extinguishing system. A large disc fragment passed through the left inner fuel tank and started a short, low-intensity flash fire that the tank conditions could not sustain; an oil fire in the No. 2 nacelle went out by itself. Despite the damage, the ATSB found that the aircraft remained capable of continued safe flight and landing.

The crew

The ATSB found that the flight and cabin crews "managed the event as a competent team". The additional pilots made announcements, liaised with the cabin and inspected the damage while the captain and first officer ran the procedures. Several weaknesses emerged. Cabin crew tried to call the flight deck using the emergency call, but the pilots cancelled the horn, taking it for another ECAM alert. The two-hour cockpit voice recorder kept running with the No. 1 engine and recorded over the in-flight audio. The LPA's logic applied its safety margin once for each failure at weights below the maximum landing weight, which could make a landing appear impossible when it was not.

Probable cause and contributing factors

The ATSB does not state a single probable cause; it lists contributing safety factors. In its summary, the disc failure "was the result of an internal oil fire within the Rolls-Royce Trent 900 engine that led to the separation of the intermediate pressure turbine disc from its shaft", and "the oil pipe cracked because it had a thin wall from a misaligned counter bore that did not conform to the design specification".

Contributing safety factors included:

• a fatigue crack in the thin-walled stub pipe, which released oil that auto-ignited;
• engine behaviour after disc separation that differed from the manufacturer's modelling, so the disc accelerated past its design capacity and burst;
• movement of the hub during machining, which left a critically thin wall, and a probable non-conformance that was not detected or not declared;
• a statistical analysis and concession process that did not convey its uncertainty, and a retrospective concession that the Chief Engineer and Business Quality Director never approved.

Safety recommendations and what changed

Qantas grounded its A380 fleet on the day of the accident and began returning it to service on 27 November 2010, permitting only flights that did not need maximum engine thrust. Rolls-Royce issued service bulletins requiring inspections of all Trent 900 engines, which Airbus required its operators to follow, and EASA issued emergency airworthiness directives 2010-0236-E and 2010-0242-E. On 1 December 2010 the ATSB recommended that Rolls-Royce address the misaligned counter bores (AO-2010-089-SR-012); inspections then had to be completed within two flight cycles.

IPTOS shuts down the engine when a rapid rise in turbine cooling air temperature is followed by an abnormally fast compressor deceleration, and alerts the crew with "ENG FAIL-SHAFT FAILURE". The overwritten recorder was cited when an ICAO panel recommended in January 2013 extending cockpit voice recorder duration to 15 hours.

Lessons for pilots

Buy time when the aircraft allows it. The crew had a controllable aircraft, fuel and good weather, so they held close to Changi instead of rushing an approach, and reviewed that decision repeatedly as fuel changed. The same logic sits behind any structured approach to managing non-normal situations: the urgency of the landing follows from the state of the aircraft.

Use every crew member. The primary crew kept flying and running the ECAM while the extra pilots gathered information, spoke to the cabin and inspected the wing. The ATSB noted that a two-pilot crew would probably have reached the same outcome, but might have needed longer or shed non-essential tasks. This is crew resource management in practice: workload shared, information fed in, and one leader.

Check what the aircraft can still do. Controllability checks at altitude and in each approach configuration, and a landing distance based on the real weight and failures, turned uncertainty into a plan. Know how your performance tools treat overweight landings and multiple failures, and apply judgement when they return no result. See landing distance.

Protections change with the control law. Mainly because of the loss of the slats, the A380's flight control laws reverted from NORMAL to ALTERNATE 1A. Although ECAM reported the flight envelope protections as lost, the only one lost was alpha floor, which automatically sets maximum thrust. The stall warning, not needed in NORMAL law, was restored. The low energy alert, the first level of protection, still called for a manual thrust increase, and the captain responded correctly.

Engine failures are not always contained. Debris can damage systems far from the engine, and after landing the No. 1 engine could not be stopped from the cockpit. After major damage, tell the rescue services which engines are still running.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.