Qantas A380 uncontained #2 engine failure
Using RF for wireless engine management could be implemented the following way, to avoid a few of the issues related to it being implemented.
Bearing in mind the consequences of giving such a receiver control of the engine, who or what would be given the authority to switch from the wired to unwired control system in a sudden emergency? Safety critical systems normally require a two-out-of-three agreement.
Join Date: May 2007
Location: Bristol
Posts: 184
Likes: 0
Received 0 Likes
on
0 Posts
Using RF for wireless engine management could be implemented the following way, to avoid a few of the issues related to it being implemented.
I think everyone has to remember that when a disk fails it will almost certainly wipe out something important. Fuel, wiring, hydraulics, control cables, structural members, other engines, the drinks trolley.. all critical systems that it could destroy.
Does that mean we should make everything twice as redundant and armour the lot? No, because the idea is that the disk should never fail in the first place!
Join Date: Jan 2008
Location: United Kingdom
Posts: 274
Likes: 0
Received 0 Likes
on
0 Posts
I am amazed that on this thread people are talking about having to re-engine the A380 in light of this recent failure.
When the original 747 Classic started service in the early 1970s engine failures were common place. One of my colleagues lost 2 on one flight for separate reasons.
We live in a modern world where everyone expects technical perfection. Severe engine failures occasionally happen and will continue to do so.
As in the case of the severe engine failure on the Sioux City MD11 manufacturers learn from experience and no doubt RR will do so too.
From some of the comments on this thread you would think that this engine failure signals the death knell for the A380.
When the original 747 Classic started service in the early 1970s engine failures were common place. One of my colleagues lost 2 on one flight for separate reasons.
We live in a modern world where everyone expects technical perfection. Severe engine failures occasionally happen and will continue to do so.
As in the case of the severe engine failure on the Sioux City MD11 manufacturers learn from experience and no doubt RR will do so too.
From some of the comments on this thread you would think that this engine failure signals the death knell for the A380.
Join Date: Jun 2009
Location: Tewksbury Mass USA
Age: 80
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
ADs relevant to This ?
AD 2010-16-07. RB211-Trent 970-84, 970B-84, 972-84, 972B-84, 977-84, 977B-84, and 980-84 turbofan engines. These engines are installed on, but not limited to, Airbus A380 series airplanes. "Wear of shaft rigid coupling on several engines during strip." Earlier history; Refer to MCAI EASA Airworthiness Directive 2010-0008, dated January 15, 2010, for related information.
AD source and Link > Rolls-Royce plc (RR) RB211-Trent 900 Series Turbofan
===============
AD 2010-17-13. RB211-Trent 970-84, 970B-84, 972-84, 972B-84, 977-84, 977B-84, and 980-84 turbofan engines. These engines are installed on, but not limited to, Airbus A380 series airplanes. "To detect cracks in the low-pressure turbine (LPT) casings, which could result in the release of uncontained high- energy debris in the event of a stage 1 blade failure."
AD source and Link >
Rolls-Royce plc (RR) RB211-Trent 900 Series Turbofan
================
Two ADs for other models - but with similar causes. Vent tube blockages.
AD 2010-06-14. 700s series has a problem similar to 800s series. (Boeing 777s) Could this same problem extend to 900s series on A-380s ?
"The Trent 800 has a similar type design standard to that of the Trent 700 and has also been found in service to be susceptible to carbon deposits in the oil vent tube. We are issuing this AD to prevent internal oil fires due to coking and carbon buildup in the HP/IP turbine bearing oil vent tube that could cause uncontained engine failure and damage to the airplane".
AD source and Link > Rolls-Royce plc RB211-Trent 800 Series Turbofan
AD 2010-07-09. RB211-Trent 700 Series. This AD supersedes AD 2007-02-05. These engines are installed on, but not limited to, Airbus A330-243, -341, -342 and -343 series airplanes. "Background; This AD results from further analysis that the cleaning of the vent tubes required by AD 2007-02-05 could lead to loosened carbon fragments, causing a blockage downstream in the vent flow restrictor. We are issuing this AD to prevent internal oil fires due to coking and carbon buildup that could cause uncontained engine failure and damage to the airplane."
AD source and Link >
Rolls-Royce plc RB211-Trent 700 Series Turbofan
=====================
Another AD for 900s series but no mention of uncontained explosion.
2009-18-13; Title: Rolls-Royce plc. (RR) RB211 Trent 900 Series Turbofan Engines
"We are issuing this AD to prevent the release of a high-pressure (HP) turbine blade, which could result in an engine power loss or in- flight shut down of one or more engines, resulting in an inability to continue safe flight. Evidence from development testing and flight test Trent 900 engines has identified cracking on some HP Turbine Nozzle Guide Vane (NGV) Convex Surfaces."
AD source and Link >
Rolls-Royce plc. (RR) RB211 Trent 900 Series Turbofan
=================
Other ADs in a related model ( 800s series) with a mention of uncontained explosion.
2001-26-11; Title: Rolls-Royce, plc RB211 Trent 800 Series Turbofan Engines
"LPC fan blade failure due to cracking, which could result in multiple fan blade release, uncontained engine failure, and possible damage to the airplane."
AD source and Link >
Rolls-Royce, plc RB211 Trent 800 Series Turbofan
===============
End
AD source and Link > Rolls-Royce plc (RR) RB211-Trent 900 Series Turbofan
===============
AD 2010-17-13. RB211-Trent 970-84, 970B-84, 972-84, 972B-84, 977-84, 977B-84, and 980-84 turbofan engines. These engines are installed on, but not limited to, Airbus A380 series airplanes. "To detect cracks in the low-pressure turbine (LPT) casings, which could result in the release of uncontained high- energy debris in the event of a stage 1 blade failure."
AD source and Link >
Rolls-Royce plc (RR) RB211-Trent 900 Series Turbofan
================
Two ADs for other models - but with similar causes. Vent tube blockages.
AD 2010-06-14. 700s series has a problem similar to 800s series. (Boeing 777s) Could this same problem extend to 900s series on A-380s ?
"The Trent 800 has a similar type design standard to that of the Trent 700 and has also been found in service to be susceptible to carbon deposits in the oil vent tube. We are issuing this AD to prevent internal oil fires due to coking and carbon buildup in the HP/IP turbine bearing oil vent tube that could cause uncontained engine failure and damage to the airplane".
AD source and Link > Rolls-Royce plc RB211-Trent 800 Series Turbofan
AD 2010-07-09. RB211-Trent 700 Series. This AD supersedes AD 2007-02-05. These engines are installed on, but not limited to, Airbus A330-243, -341, -342 and -343 series airplanes. "Background; This AD results from further analysis that the cleaning of the vent tubes required by AD 2007-02-05 could lead to loosened carbon fragments, causing a blockage downstream in the vent flow restrictor. We are issuing this AD to prevent internal oil fires due to coking and carbon buildup that could cause uncontained engine failure and damage to the airplane."
AD source and Link >
Rolls-Royce plc RB211-Trent 700 Series Turbofan
=====================
Another AD for 900s series but no mention of uncontained explosion.
2009-18-13; Title: Rolls-Royce plc. (RR) RB211 Trent 900 Series Turbofan Engines
"We are issuing this AD to prevent the release of a high-pressure (HP) turbine blade, which could result in an engine power loss or in- flight shut down of one or more engines, resulting in an inability to continue safe flight. Evidence from development testing and flight test Trent 900 engines has identified cracking on some HP Turbine Nozzle Guide Vane (NGV) Convex Surfaces."
AD source and Link >
Rolls-Royce plc. (RR) RB211 Trent 900 Series Turbofan
=================
Other ADs in a related model ( 800s series) with a mention of uncontained explosion.
2001-26-11; Title: Rolls-Royce, plc RB211 Trent 800 Series Turbofan Engines
"LPC fan blade failure due to cracking, which could result in multiple fan blade release, uncontained engine failure, and possible damage to the airplane."
AD source and Link >
Rolls-Royce, plc RB211 Trent 800 Series Turbofan
===============
End
Join Date: Dec 2004
Location: Portsmouth
Posts: 55
Likes: 0
Received 0 Likes
on
0 Posts
Having some little experience in designing RF systems, I would be rather cautious about installing a receiver immediately adjacent to an engine in extreme environmental conditions, that could be relied upon to operate correctly after sufficient local damage that wired controls had been destroyed.
Bearing in mind the consequences of giving such a receiver control of the engine, who or what would be given the authority to switch from the wired to unwired control system in a sudden emergency? Safety critical systems normally require a two-out-of-three agreement.
Join Date: Jun 2001
Location: Hong Kong
Age: 68
Posts: 105
Likes: 0
Received 0 Likes
on
0 Posts
malcolmyoung a few posts back mentioned the risk of people on the ground in Bintan being hit. Bintan is 2,400 square km with a population of about 200,000. If one guesses the hazard zone for falling debris at an exceedingly conservative 1 square metre, the chance of death or injury from one compact piece would be less than 1:12,000. The risks of falling debris to people on the ground are negligible except near to major cities one would have thought, Lockerbie being a dreadful exception. I'll let others comment on the risks to folks on the plane, but thankfully looks like they were in the safest possible hands...
Join Date: Jul 2005
Location: Canadian Shield
Posts: 538
Likes: 0
Received 0 Likes
on
0 Posts
If it looks like a duck... and sounds like a duck...
It probably is a duck(*)
* Duck in this case being a design fault.
HCD
Per AD:
Wear, beyond Engine Manual limits, has been identified on the abutment
faces of the splines on the Trent 900 Intermediate Pressure (IP) shaft rigid
coupling on several engines during strip. The shaft to coupling spline
interface provides the means of controlling the turbine axial setting and
wear through of the splines would permit the IP turbine to move
rearwards. Rearward movement of the IP turbine would enable contact with static turbine components and would result in loss of engine performance with
potential for in-flight shut down, oil migration and oil fire below the LP
turbine discs prior to sufficient indication resulting in loss of LP turbine disc
integrity. Some of these conditions present a potential unsafe condition to
the aeroplane.
Compliance Time: Engines where the life since new is 250 flight cycles or less (1) Before the engine has accumulated 400 flight cycles since new.
Wear, beyond Engine Manual limits, has been identified on the abutment
faces of the splines on the Trent 900 Intermediate Pressure (IP) shaft rigid
coupling on several engines during strip. The shaft to coupling spline
interface provides the means of controlling the turbine axial setting and
wear through of the splines would permit the IP turbine to move
rearwards. Rearward movement of the IP turbine would enable contact with static turbine components and would result in loss of engine performance with
potential for in-flight shut down, oil migration and oil fire below the LP
turbine discs prior to sufficient indication resulting in loss of LP turbine disc
integrity. Some of these conditions present a potential unsafe condition to
the aeroplane.
Compliance Time: Engines where the life since new is 250 flight cycles or less (1) Before the engine has accumulated 400 flight cycles since new.
HCD
speaking from an IT standpoint, i'd be reluctant to implement any kind of wireless communications on critical systems. Maybe as a backup yes, but not the primary source. Primary must always be hard wired. If this communication fails then yes wireless could be used as secondary.
Wireless comms isn't quite there yet for these kinds of applications. It's still susceptible to the odd glitch - the main one being the power requirements and most importantly, wireless reception loss.
as an aside i believe the rolls royce service is called power by the hour, where they can remotely analyse the telemetry in realtime back at their base.
Wireless comms isn't quite there yet for these kinds of applications. It's still susceptible to the odd glitch - the main one being the power requirements and most importantly, wireless reception loss.
as an aside i believe the rolls royce service is called power by the hour, where they can remotely analyse the telemetry in realtime back at their base.
Join Date: Sep 2010
Location: earth
Posts: 1,341
Likes: 0
Received 0 Likes
on
0 Posts
I am amazed that on this thread people are talking about having to re-engine the A380 in light of this recent failure.
When the original 747 Classic started service in the early 1970s engine failures were common place. One of my colleagues lost 2 on one flight for separate reasons.
We live in a modern world where everyone expects technical perfection. Severe engine failures occasionally happen and will continue to do so.
As in the case of the severe engine failure on the Sioux City MD11 manufacturers learn from experience and no doubt RR will do so too.
From some of the comments on this thread you would think that this engine failure signals the death knell for the A380.
When the original 747 Classic started service in the early 1970s engine failures were common place. One of my colleagues lost 2 on one flight for separate reasons.
We live in a modern world where everyone expects technical perfection. Severe engine failures occasionally happen and will continue to do so.
As in the case of the severe engine failure on the Sioux City MD11 manufacturers learn from experience and no doubt RR will do so too.
From some of the comments on this thread you would think that this engine failure signals the death knell for the A380.
Join Date: Dec 2004
Location: Portsmouth
Posts: 55
Likes: 0
Received 0 Likes
on
0 Posts
I think everyone has to remember that when a disk fails it will almost certainly wipe out something important. Fuel, wiring, hydraulics, control cables, structural members, other engines, the drinks trolley.. all critical systems that it could destroy.
Does that mean we should make everything twice as redundant and armour the lot? No, because the idea is that the disk should never fail in the first place!
Does that mean we should make everything twice as redundant and armour the lot? No, because the idea is that the disk should never fail in the first place!
I think as well, in this case, they had a part of the engine that they thought they would not need to contain, but it failed. What i guess worries me more about this situation is the fact that it could have potentially caused alot more issues than it did.
Join Date: May 2007
Location: Bristol
Posts: 184
Likes: 0
Received 0 Likes
on
0 Posts
There's a 747 thread for the 747 incident.
One of the of the key tenets of civil aviation safety is that you're not allowed to injure people on the ground. Passengers are to an extent expendable, they signed up to fly on the thing and there's an understanding in the public consciousness that sometimes things go wrong on aircraft. Yes the airlines have a liability, but it is to some extent reduced.
However, people on the ground getting hit by debris from above is essentially unlimited liability.
It isn't simply a question of saving money, every extra system adds weight and complexity which simply leads to more stuff to go wrong. The cost of an airliner is a secondary effect of the technology it contains. But the technology is picked based on how effective it is rather than how much it costs.
If it were me on the plane I'd know that the fact the aircraft was still in the air after a disk failure meant that the worst of the risk was already passed.
OK, lets try this again...
A TURBINE DISK FAILURE IS EFFECTIVELY UNCONTAINABLE
Which is why it's designed not to break in the first place. All of the discussion about the damage it caused to other systems is irrelevant. The reason the aircraft gets certified is on the basis that it won't fail in the first place!
malcolmyoung a few posts back mentioned the risk of people on the ground in Bintan being hit. Bintan is 2,400 square km with a population of about 200,000. If one guesses the hazard zone for falling debris at an exceedingly conservative 1 square metre, the chance of death or injury from one compact piece would be less than 1:12,000. The risks of falling debris to people on the ground are negligible except near to major cities one would have thought, Lockerbie being a dreadful exception. I'll let others comment on the risks to folks on the plane, but thankfully looks like they were in the safest possible hands...
However, people on the ground getting hit by debris from above is essentially unlimited liability.
There a load of What If's...and unfortunately each of those What If's have a cost associated with them. I bet that if you were the bean counter on a plane in trouble, you would be having second guesses about what you didn't agree to as necessary to spend on a back up system if it would have helped you in the situation you are in.
If it were me on the plane I'd know that the fact the aircraft was still in the air after a disk failure meant that the worst of the risk was already passed.
I think as well, in this case, they had a part of the engine that they thought they would not need to contain, but it failed.
A TURBINE DISK FAILURE IS EFFECTIVELY UNCONTAINABLE
Which is why it's designed not to break in the first place. All of the discussion about the damage it caused to other systems is irrelevant. The reason the aircraft gets certified is on the basis that it won't fail in the first place!
I think the way it would work (could be way wrong as well, just an idea), is that if for whatever reason the wire control lines were not working, it would automatically kick in the wireless part of the system. i.e it is dead until it knows that the wire control is out of action, OR, there was some other hardware failure or request to kick it in, all over the hard physical way, so that it would not be open to terrorist/nutter threats.
This is a basic system design problem.
Q. How do you know that the standby system is working?
A. By running it continuously, off-line, and comparing its parameters with those of the primary system.
followed by:
Q. When the primary system gives failure readings, how do you know whether it's giving a false negative or the standby is giving a false positive? Think of the consequences if your 'automatic' control makes the wrong decision...
Bear in mind also AndoiP's very valid second paragraph. There will be intermittent failures of the radio system, and these should correctly be ignored during 'normal' operation when the wired system is working. But this apparently flawed arrangement doesn't lend confidence to switching over to it when 500+ lives are on the line.
The world isn't ready for this.
Join Date: Nov 2010
Location: Third rock from the Sun
Age: 55
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
Which is why it's designed not to break in the first place. All of the discussion about the damage it caused to other systems is irrelevant. The reason the aircraft gets certified is on the basis that it won't fail in the first place!
Agreed that turbine disk failures are uncontainable but the damage caused to other systems is not irrelevant.
The aircraft gets certified also because it is shown that the systems (and partly structures) design and installation are such that they can cope with such an event, which is not expected to be extremely improbable. Compliance to UERF requirements is part of the set of certification rules.
IMHO the airframe performed exceedingly well in this situation and probably as expected by the designers, well done to all of the Airbus guys!
Join Date: Dec 2004
Location: Portsmouth
Posts: 55
Likes: 0
Received 0 Likes
on
0 Posts
OK, lets try this again...
A TURBINE DISK FAILURE IS EFFECTIVELY UNCONTAINABLE
A TURBINE DISK FAILURE IS EFFECTIVELY UNCONTAINABLE
You can't contain the uncontainable...
Join Date: Jan 2007
Location: London
Posts: 13
Likes: 0
Received 0 Likes
on
0 Posts
a380 operating environment
A further issue has been discussed concerning the operations of the A380.The theory as to this failure although not established could also be caused by ingestion on takeoff under certain conditions.Remember the Air France Concorde accident? Debris left on the runway by other aircraft? Due to the large size of this aircraft and the immense power of the Trent. Air ingested is sucked in from a larger area in front of the A380 including off runway areas on narrow runways not experienced by other aircraft types.Proximity to the ground with such power may produce a higher risk curve for ingestion or delayed ingestion failure than other aircraft types?
Join Date: Dec 2004
Location: Portsmouth
Posts: 55
Likes: 0
Received 0 Likes
on
0 Posts
I'm afraid that's way too simplistic. You cannot hand over from one control system to another, either manually or "automatically" as you put it, unless and until you are sure that the secondary/standby system is working correctly.
If you have a major failure of all communication to an engine, and there was a 50/50 chance that the wireless would work, I think you would definitely want to have that 50% on your side. Even if it was a lesser percentage, something is better than nothing.
False positives are always difficult to figure out, but not to say that you couldn't figure out a way to cut the threat down, or at least investigate the idea without completely discounting it completely. It is the same as any system with any type of redundancy. One that comes to mind that, the wireless system has two stages of sanity checking, once where the live system picks up when a failure is recorded, and then another when a "go" live signal is received over the wireless to actually kick it in. A two part check, and part of it is figuring out whether or not the percentage of having both "false positives" at the same time.
As for advancement in technology, just look at where we have been and what has been achieved since. It is a continual improvement process, and as better ways of doing things are discovered they are applied. You of course can't deviate from physical real world limitations. Wireless technology will get better, and their reliability will increase as well.
Waste of web-bandwidth?
OK, so why are we suddenly obsessing on the necessity to add another (complicated) engine control system to aircraft? I don't understand the fuss - sure the incident we are discussing here led to a situation where #1 could not be shut down, however I question whether this was a significant safety issue? (At least compared to #2 blowing a good portion of itself into little pieces and flying around making holes in things).
In this instance it was not a safety issue - at least in the context that no one at all was injured as a result of the running engine, the cause was (can we agree) exceptional (are we OK with that statement - uncontained engine failures are rare?) and the result was at worst perhaps a bit of a conundrum.
However, does anyone really think this is likely to happen again in a meaningful time period? How many 4 engined aircraft has this affected in the past? So far I am personally only aware of one, and again the circumstances were exceptional.
I think someone else proposed the only solution that makes any sense to me - a prominent red hatch on the engine pylon, with a big red "OFF" lever behind it, and long pole with a hook on the end of it...
- GY
In this instance it was not a safety issue - at least in the context that no one at all was injured as a result of the running engine, the cause was (can we agree) exceptional (are we OK with that statement - uncontained engine failures are rare?) and the result was at worst perhaps a bit of a conundrum.
However, does anyone really think this is likely to happen again in a meaningful time period? How many 4 engined aircraft has this affected in the past? So far I am personally only aware of one, and again the circumstances were exceptional.
I think someone else proposed the only solution that makes any sense to me - a prominent red hatch on the engine pylon, with a big red "OFF" lever behind it, and long pole with a hook on the end of it...
- GY
OK, so why are we suddenly obsessing on the necessity to add another (complicated) engine control system to aircraft?
Join Date: Mar 2010
Location: overthehillsandmountains
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
trickii
".....Due to the large size of this aircraft and the immense power of the Trent."
Don't forget that engines of the big twins, 777-300ER for example, are much more powerful than the A380's.
Don't forget that engines of the big twins, 777-300ER for example, are much more powerful than the A380's.