Qantas A380 uncontained #2 engine failure
Join Date: Oct 2004
Location: Torono
Age: 56
Posts: 150
Likes: 0
Received 0 Likes
on
0 Posts
Melax, to design for every eventuality is never going to happen. Risk is assessed and duly mitigated if the probability is low enough.
Also, it's impossible to design for a risk that is not considered, who would have ever thought that the A340 event in Toulouse could ever happen, but it's easy with 20/20 hindsight.
However in this (A380) case, there is reason for concern, what we have here is know as "common mode failure" and in my opinion will have been considered in the design of the cable routing, but (at the risk of repeating myself), you cannot design for every eventuality and it appears that this particular risk / event was either mitigated as low probability or never considered.
Also, it's impossible to design for a risk that is not considered, who would have ever thought that the A340 event in Toulouse could ever happen, but it's easy with 20/20 hindsight.
However in this (A380) case, there is reason for concern, what we have here is know as "common mode failure" and in my opinion will have been considered in the design of the cable routing, but (at the risk of repeating myself), you cannot design for every eventuality and it appears that this particular risk / event was either mitigated as low probability or never considered.
Engine #4 ran from 16:00 to 18:48 (almost 3 hours !!!) and was shut down by spraying foam and water into it.b
The way that SQ tells it, they have been "advised" by RR and Airbus not to operate prior to performing precautionary checks. We had one SQ plane here on the ground and it was basically ready to go, but got deplaned and is now sitting there with open engine covers.
Don't know if I am seeing it wrong, but heck, before Airbus and RR issue such an advise, some people must have gotten really concerned. And if they are, so should we be.
Lookig at the data we do have at this stage, this does indeed look like a lot more than precautionary but a massive damage which warrants the classification "accident", even though thankfully nobody was hurt. The airplane certainly was and will need severe work done before it will take to the skies again.
Re the deboarding via stairs, I wonder if the fact that No 1 was still running and by the looks of it could not be shut down any normal way, which made them shy away from an evac but rather have an orderly deboarding via that staircase. At least nobody would run the wrong way.
I am not usually the one to suggest such things, but I think we might well pause for a moment to say and give thanks, everyone in his/her own way, that this one was handled this way and ended well. To the crew and to everyone/thing involved. This could have ended a darn sight worse and I for one am simply extremely happy that it did not.
Join Date: Jan 2008
Location: UK
Posts: 1,515
Likes: 0
Received 0 Likes
on
0 Posts
I believe the point is one of basic systems analysis (an old fashioned term which dates to the introduction of computer controlled systems in 50s and 60s)
Specifically, you can have as many channels of redundancy as you like, but if they route through a Single Point Of Failure (SPOF) then you don't have any redundancy at all.
Now, how might a leading edge be compromised.....
Uncontained engine failure.
High impact birdstrike.
Taxying accident.
Debris on runway
External terrorist activity (small arms fire or MANPAD)
Internal terrorist activity (on board bomb)
Survivable mid air collision
All of which have happened...more than once. I'm thinking an aircraft designer mitigating all of the above, probably should be sticking to model aircraft and UAVs only.
I thought of the fire handle and kinda hoped it had not been pulled...if that don't shut down it down because it is routed the same way..then WTF!!
PS I really want be told I'm totally wrong about all of this. Here's hoping somebody with expert knowledge comes along and straightens me out ASAP.
Specifically, you can have as many channels of redundancy as you like, but if they route through a Single Point Of Failure (SPOF) then you don't have any redundancy at all.
...you cannot design for every eventuality and it appears that this particular risk / event was either mitigated as low probability or never considered.
Uncontained engine failure.
High impact birdstrike.
Taxying accident.
Debris on runway
External terrorist activity (small arms fire or MANPAD)
Internal terrorist activity (on board bomb)
Survivable mid air collision
All of which have happened...more than once. I'm thinking an aircraft designer mitigating all of the above, probably should be sticking to model aircraft and UAVs only.
I thought of the fire handle and kinda hoped it had not been pulled...if that don't shut down it down because it is routed the same way..then WTF!!
PS I really want be told I'm totally wrong about all of this. Here's hoping somebody with expert knowledge comes along and straightens me out ASAP.
Last edited by The Old Fat One; 4th Nov 2010 at 14:52.
Join Date: Dec 2007
Location: Changi
Posts: 127
Likes: 0
Received 0 Likes
on
0 Posts
Hi Guys,
Is it true that in this case the engine is unable to shut down due to the FADEC freezing the FMV at last good value before failure? What kind of failure will render this situation?
Thanks
Is it true that in this case the engine is unable to shut down due to the FADEC freezing the FMV at last good value before failure? What kind of failure will render this situation?
Thanks
Join Date: Aug 2005
Location: Edinburgh and 3C
Age: 72
Posts: 195
Likes: 0
Received 0 Likes
on
0 Posts
Containment
Is the containment symmetrical in the engine, or is it designed to offer greater protection on the inboard and upward directions? I realise there's a weight v protection issue, but it may be possible to sacrifice containment down/out if it would improve protection of other areas of the airframe without significant weight gain.
(Yes, yes, mere SLF but with a background and continuing interest in engineering risk assessment and aerospace design.)
(Yes, yes, mere SLF but with a background and continuing interest in engineering risk assessment and aerospace design.)
Join Date: Feb 2009
Location: Cambridge (the original one)
Age: 76
Posts: 53
Likes: 0
Received 0 Likes
on
0 Posts
local RF commanded engine shutdown.
No way ! You want to enable terrorists to command a total engine shutdown ?
Last edited by Gegenbeispiel; 4th Nov 2010 at 15:17. Reason: typos
Join Date: Sep 2000
Location: Birmingham, England (sometimes)
Posts: 104
Likes: 0
Received 0 Likes
on
0 Posts
Lion_g
There are other ways to shut the engine down not involving the FADEC, but they all require some communication being available between the cockpit and nacelle. If there is a common routing failure here it is possible that that avenue was not possible. My knowledge is limited to the FADEC case but I do know there are shut off valves as well as the FMV.
VnV.
There are other ways to shut the engine down not involving the FADEC, but they all require some communication being available between the cockpit and nacelle. If there is a common routing failure here it is possible that that avenue was not possible. My knowledge is limited to the FADEC case but I do know there are shut off valves as well as the FMV.
VnV.
Join Date: Aug 2002
Location: England.
Posts: 440
Likes: 0
Received 0 Likes
on
0 Posts
Post #42, last picture apparently shows part of a turbine disc recovered from debris ejected by engine #2.
I'd welcome more comment (but only from appropriately qualified PPRuNe members, please) regarding the potential consequences of a possible turbine disc failure for both the Trent 900 in service and for Rolls-Royce. Obviously, much will depend upon the outcome of detailed investigations, but a little informed speculation might nevertheless be educational.
I'll add some admittedly mischievous fuel to the above invitation (assuming that the following is accurate):
Qantas engine drama: reports of debris, explosion | Stuff.co.nz
Scroll well down to find:
PREVIOUS QANTAS INCIDENT
In a recent similar incident, an engine exploded on a Qantas flight to San Francisco on August 30, with debris tearing holes in the engine cover.
Australian Transport Safety Bureau investigators found all of the engine's turbine blades had either fractured or broken away.
The cause of the explosion of the Boeing 747's Rolls Royce RB211 engine is still under investigation.
I'd welcome more comment (but only from appropriately qualified PPRuNe members, please) regarding the potential consequences of a possible turbine disc failure for both the Trent 900 in service and for Rolls-Royce. Obviously, much will depend upon the outcome of detailed investigations, but a little informed speculation might nevertheless be educational.
I'll add some admittedly mischievous fuel to the above invitation (assuming that the following is accurate):
Qantas engine drama: reports of debris, explosion | Stuff.co.nz
Scroll well down to find:
PREVIOUS QANTAS INCIDENT
In a recent similar incident, an engine exploded on a Qantas flight to San Francisco on August 30, with debris tearing holes in the engine cover.
Australian Transport Safety Bureau investigators found all of the engine's turbine blades had either fractured or broken away.
The cause of the explosion of the Boeing 747's Rolls Royce RB211 engine is still under investigation.
Last edited by acbus1; 4th Nov 2010 at 15:01.
Join Date: Jul 2008
Location: brisbane
Posts: 12
Likes: 0
Received 0 Likes
on
0 Posts
Maintenence or design?
Whilst im normally one who takes the opportunity to have a dig at overseas M.R.O,s it would be right to know if in fact as Joyce claims, was this was a new engine from Rolls Royce or has it in fact undergone a rebuild at a facility where turn time is paramount over safety?? I really hope for Qantas,s sake this is not the case. It has once again opened my eyes as to the importance of the job we do as engineers and how 1 small stuff up could cause a catastrophic failure endangering hundreds of lives, to those engineers out there who feel pressured on a daily basis to "just get the aircraft out on time" let this be a timely reminder of what could happen if schedule comes before safety....
Join Date: Jan 2008
Location: Bollington, Cheshire
Age: 72
Posts: 36
Likes: 0
Received 0 Likes
on
0 Posts
A380 Grounding
04 November 2010 14:47:27
Rolls Royce Group Plc Issues statement following grounding of A380 planes; too early to draw conclusions
- The in service fleet of Trent 900 engines is small and relatively new, and the Group feels that it is prudent to recommend that a number of basic precautionary engine checks are performed.This process is now underway.
- We will continue to work closely with our customers as the investigation moves forward.This is at a very early stage and it would be inappropriate to draw any conclusions at this time.
Rolls Royce Group Plc Issues statement following grounding of A380 planes; too early to draw conclusions
- The in service fleet of Trent 900 engines is small and relatively new, and the Group feels that it is prudent to recommend that a number of basic precautionary engine checks are performed.This process is now underway.
- We will continue to work closely with our customers as the investigation moves forward.This is at a very early stage and it would be inappropriate to draw any conclusions at this time.
Will keep Mr. Murphy at bay 
Join Date: May 2007
Location: Bristol
Posts: 184
Likes: 0
Received 0 Likes
on
0 Posts
OK time for a common sense injection.
In isolation it seems that the engines continuing on last known command in the case of massive systems damage is a bad idea. But lets consider a different case. Say for example there is a temporary loss in signal during a take off run. In that situation would you rather the engine shut itself down or kept going?
With these sort of systems you have to look for a failsafe condition which is going to be the most appropriate action for the widest range of incidents. You then have to live with the fact that in very unusual incidents such as this one the failsafe may not provide the ideal response for that particular incident.
You seem to have some sort of mental image of thick bundles of wire labeled 'flight critical' duct taped to the leading edge. The wiring is well enough protected to deal with things like birdstrikes, low speed collisions and debris.
Are you genuinely suggesting that airliners should be designed to take a direct hit from an anti-aircraft weapon or able to survive a mid air collision? How exactly would you expect these tanks to ever get into the air?
It's worth remembering that a turbine disk failure is carrying a similar sort of energy to weapons fire. Generally the idea is to make sure it doesn't happen in the first place rather than try to armour the inside of the aircraft.
As serious as this engine failure appears to be, is it not the bigger issue that partial or complete control of the outboard engine also occurred as a result of the first failure? Was the control failure complete, or just the inability to shut the engine down? Did the crew have any thrust control of the outboard engine after the failure occurred?
I just can't believe that they could not shut the engine down in Toulouse (RE: ETIHAD A340-600 crash into wall) just plain scary. Engine #4 ran from 16:00 to 18:48 (almost 3 hours !!!) and was shut down by spraying foam and water into it.below is a passage from the BEA report:
With these sort of systems you have to look for a failsafe condition which is going to be the most appropriate action for the widest range of incidents. You then have to live with the fact that in very unusual incidents such as this one the failsafe may not provide the ideal response for that particular incident.
There was a comment made earlier about the damage to the leading edge of the wing probably taking out control wiring to the engine. If all communication routes with the engine are routed through the leading edge, it appears to me that this is a design issue which would need to be addressed. Where is the redundancy?
Now, how might a leading edge be compromised.....
Uncontained engine failure.
High impact birdstrike.
Taxying accident.
Debris on runway
External terrorist activity (small arms fire or MANPAD)
Internal terrorist activity (on board bomb)
Survivable mid air collision
Now, how might a leading edge be compromised.....
Uncontained engine failure.
High impact birdstrike.
Taxying accident.
Debris on runway
External terrorist activity (small arms fire or MANPAD)
Internal terrorist activity (on board bomb)
Survivable mid air collision
Are you genuinely suggesting that airliners should be designed to take a direct hit from an anti-aircraft weapon or able to survive a mid air collision? How exactly would you expect these tanks to ever get into the air?
It's worth remembering that a turbine disk failure is carrying a similar sort of energy to weapons fire. Generally the idea is to make sure it doesn't happen in the first place rather than try to armour the inside of the aircraft.