Approximately one hour after departing Sydney on a regular passenger transport flight to Bangkok, Thailand, the Boeing 747-436 aircraft, registration G-BNLD, sustained the failure of the right inboard (number-3) engine, necessitating a return to Sydney airport where an uneventful one-engine inoperative landing was made.
Failure of the number-3 engine resulted from the fracture and liberation of a single first-stage low-pressure compressor (fan) blade. The blade failed through the lower aerofoil section, immediately adjacent to the dovetail connection with the rotor disk. While the initial blade impact was fully contained by the fan casing, many fragments of the fractured blade and the damaged adjacent blades punctured the intake cowling or escaped forward of the nacelle, producing damage to the wing, control surfaces, fuselage and the number-4 engine. Imbalance forces generated by the blade loss produced extensive damage to the engine accessory components and disrupted the primary load-bearing path between the engine fan case and the thrust reverser assembly.
ATSB laboratory examination of the retained root section of the failed blade established that fatigue cracking had initiated and propagated from a pre-existing defect at the blade centreline. The defect was characterised as a 'lack of bond' feature at the interface between the two sandwiched titanium alloy panels used to form the blade. Fatigue cracking had initiated from the upper edge of the defect and propagated under operationally induced bending and centrifugal loads.
The lack of bond defect had formed during manufacture of the blade in 1991. While it was detected during manufacturing inspections, the defect was assessed as non-critical and the blade was accepted for service under the engine manufacturers 'concessional acceptance' system. The blade subsequently accrued a service life of 9,444 cycles and 32,000 hours before failing; this representing 63% of the 15,000-cycle design prescribed blade life.
In response to the blade failure identified in the investigation, which was the first of its type, the engine manufacturer has revised the acceptable bond-line defect size limit and issued a series of alert service bulletins, requiring the removal from service of 186 RB.211-524 blades and 112 similar RB.211-535 blades. These were 'concessionally accepted' components that, on review of the manufacturing documentation, had been assessed as being at risk of failure from a similar mechanism. In December 2002, the engine manufacturer advised that all blades identified by the service bulletins had been traced and confirmed as removed from service.
History of the flight
At 1729 on 1 March 2002, the Boeing 747-436 aircraft departed Sydney, Australia on a regular passenger transport service to Bangkok, Thailand. Approximately one hour into the flight, while the aircraft was in cruise at flight level 330 (FL330), the crew experienced the sudden onset of heavy airframe vibration and received an ENG 3 REVERSER annunciation from the engine indicating and crew alerting system (EICAS). The crew initially reduced the number-3 engine power and carried out the 'Engine Reverser Unlocked' actions from the aircraft quick-reference handbook (QRH). The crew stated that the engine appeared to be functioning normally at that time. After further EICAS status and advisory messages however, the crew elected to carry out other QRH checklists, concluding with the shutdown of the number-3 engine. The captain made a PAN call to air traffic control and subsequently an advisory announcement to the passengers. To reduce airframe vibration after the engine was shut down, the first-officer, who was the handling pilot, descended the aircraft to FL180 and reduced airspeed. A third crew member who was resting at the time of the event went back into the cabin to examine the engines and found extensive damage to the number-3 engine nacelle and strut fairings. After that information was reported to the flight crew, a further QRH checklist Fire Engine, Severe Damage or Separation was actioned, although at no time was there any reported indication or sign of fire. A decision to return to Sydney was made and fuel was jettisoned to establish a landing weight within limits. In consideration of the damage to the engine and to minimise the risk should the engine or components separate, an over-water approach to runway 34L was requested. The aircraft landed safely at 1947.
Injuries to persons
Damage to the aircraft
The damage sustained by the aircraft was mainly limited to the number-3 engine and nacelle assembly. However, areas of isolated damage produced by the impact of debris escaping from the engine were found within the number-3 engine pylon, the right wing, flap, horizontal stabiliser and control surfaces and the right side of the fuselage.
Damage to the airframe
During the course of the on-site investigation, the operator carried out an inspection of the aircraft in accordance with the Boeing 747-400 maintenance manual, section 05-51-06 (Dragged engine nacelle / Engine seizure / Engine and strut damage condition - Maintenance practices - Conditional inspection). Australian Transport Safety Bureau Technical Analysis report number 20/02 section 1.6 summarised the results of that inspection. The most substantial airframe damage was identified as single punctures in the right wing centre leading edge flap section and the right side of the fuselage, between the cabin window and the upper wing surface. The actual point of debris impact was coincident with a bulkhead structure beneath the thinner fuselage skin. That combination of engine and airframe damage constituted an accident under Annex 13 to the Convention on International Civil Aviation.
Damage to the engines & nacelles
The ATSB carried out a general inspection of the failed engine before it was removed from the aircraft. The engine had sustained extensive damage to the low-pressure compressor, accessory equipment, thrust reverser assembly and the fan cowlings. A single fan blade had fractured from a location immediately above the dovetail rotor connection, releasing the full aerofoil length from the hub. Impact marks showed the blade to have struck the fan case at the one o'clock position (looking rearward), however the case was not compromised and the primary blade failure was contained within the engine. Subsequently however, the remaining fan blades had fragmented over the outer fifty percent of their length, with the liberated debris causing extensive tearing and multiple punctures of the intake cowl forward of the fan case. Two major fragment exit trajectories were identified during the inspection - those were aligned with the damaged areas on the fuselage and leading edge flap panel. The uppermost fragment exit trajectory passed through the forward strut region. Examination of that area revealed the separation of an engine to pylon connector that carried circuits for the monitoring of thrust-reverser position, turbine gas temperature and turbine speed and vibration.
Extensive mechanical damage associated with rotor imbalance loads was found amongst the engine accessory equipment and the thrust-reverser structure, which had separated from the front flange section at the riveted joint. That separation allowed the structure to move rearwards by up to thirty millimetres and transferred the retention loads for the thrust reverser unit and integrated nozzle assembly to the fan case hoop plate assembly. The engine manufacturer's stress modelling of the retention loads through that secondary load path showed that a significant reserve remained in the critical load path joint features, when considering the worst-case scenario of a three hour return extended twin-engine operations (ETOPS) flight .
Inspection of the adjacent (number-4) engine showed scratches, embedded fragments and other evidence of the ingestion of debris liberated from the number-3 engine. A boroscopic survey of the engine core intermediate and high-pressure compressor stages found blade distress that was typical of foreign-object damage.
The aircraft carried an operational flight crew of three and a cabin crew of fifteen. Additionally, a B757 pilot was a passenger. After the engine failure event, that pilot was requested to assist the flight crew in the management of the aircraft and the return to Sydney. Interviews following the event found that the crew were properly licensed and medically fit to conduct the flight.
|Manufacturer||Boeing Commercial Aircraft Group|
|Year of manufacture||1989|
|Certificate of airworthiness (no.)||033678/003 Issued 6 September 1999|
|Certificate of registration (no.)||G-BNLD/R1 Issued 5 September 1989|
The Rolls-Royce RB211-524G engine (serial number 13340) had been installed on G-BNLD in November 1999 and had operated for 9,915 hours and through 1,299 cycles while fitted to that aircraft. The engine was originally manufactured in 1994 and had accrued a total life of 30,075 hours and 4,011 cycles at the time of the failure.
Fan blade information
The failed first-stage low-pressure compressor (fan) blade (part number UL29573, serial number GB77535) was manufactured in 1991. Since that time, the component had accumulated a service life of 32,000 hours and 9,444 cycles, with the last 8,915 hours and 1,299 cycles within engine 13340. The manufacturer's specified maximum service life for the blade type was 15,000 cycles.
Fan blade history and inspection
The manufacturer's service bulletin SB72-9660 specified three different periodic non-destructive tests aimed at detecting service-induced cracking, or damage in various critical parts of the RB211-524 blades. The manufacturer's records indicated that the failed fan blade had been overhauled on three separate occasions. The last overhaul was carried out in October 1999 and included the repair and polishing of the aerofoil surface and the replacement of the blade root dry film lubricant. Non-destructive inspections following the overhaul included a transient acoustic propagation (TAP) test, ultrasonic inspection of the root block and ultrasonic C-scan inspection of the blade aerofoil. Following the satisfactory completion of these tests, the blade was installed into engine serial number 13340 and the engine was fitted to G-BNLD. Of the non-destructive tests specified within SB72-9660, only the TAP test was applicable to on-wing inspections and was required at 200 cycle intervals. The TAP test was designed to detect the loss of vacuum within the internal cavity of the blade; indicating the presence of through-section cracking or other damage. Records from the engine manufacturer indicated compliance with the service bulletin, with the last TAP test carried out on 18 February 2002; ten days prior to the failure. Specific records documenting the results of that test were not available.
The cabin services director (CSD) reported the flight to have been normal until approximately one hour after takeoff. At the time of the engine failure the CSD was at the under-stair station talking with the First Officer on the flight deck via the cabin interphone system. The CSD reported hearing two loud thuds, followed by strong, continuing airframe vibration. Immediately looking out of a right side cabin door window, the CSD saw multiple holes in the number-3 engine cowling and pylon, through which he was able to see the ground below. He reported the weather as very clear and bright daylight. Returning to his station, the CSD attempted unsuccessfully on two occasions to contact the flight deck using the pilot alert interphone function, noting that some passengers were showing concern and wanting information. Instructing the cabin crew to stow the service equipment and secure the cabin, the CSD was about to attempt contacting the flight deck again when he was met by the third pilot who appraised the CSD of the situation. Further information was subsequently provided to the crew and passengers by the captain in a public address (PA) announcement.
A report from the rear cabin purser described the engine failure as a loud noise followed by juddering. Due to unserviceability with the cabin interphone system, the purser was unable to communicate with the CSD. The captain's PA announcement provided the first information to the rear cabin purser regarding the engine failure.
Information gathered from the crew interviews and the aircraft technical log revealed that areas of the cabin interphone system were unserviceable at the commencement of the flight. To address this, the CSD had briefed the crew before flight for an alternative emergency communication procedure, requiring that pursers report to his station if an alert signal was given. Once he had assessed the event and the extent of aircraft damage, the third pilot assumed the cabin communications role and made several walk-around visits to the cabin to provide information and reassurance to the crew and passengers.
Flight deck security
In a response to a conference on enhanced aircraft security, the aircraft manufacturer had begun the implementation of a two-phase program to address perceived security deficiencies on board its aircraft. As part of its phase-one response, the aircraft operator had installed mechanical internal locks to the flight deck doors and implemented a policy regarding their use. The mechanical locks supplemented the pre-existing electric door locks and were only able to be operated by a flight crew member standing at the door. The electric door locks were capable of being operated by the flight crew in their normal, seated position. The operator's policy required the locking of the modified flight deck door before engine start and unlocking after engine shut down. The stated objective of the policy was to minimise the amount of time the flight deck door was unlocked and achieved this by providing specific procedures for crew interaction. These procedures relied extensively on the use of the interphone and alerting systems. While the minimum equipment list (MEL) documentation for the aircraft at the time of the event permitted operations with partial interphone unserviceability, it specified that the flight deck to cabin connection must be operational in order for the flight deck manual door lock to be used.
Shortly after the engine failure, the flight crew decided to abandon the locked door policy. That decision was taken to facilitate the use of the third crew member as a cabin to flight deck go-between role and to alleviate some of the problems associated with the interphone unserviceability.
The aircraft was fitted with a Sundstrand Data Control Universal Flight Data Recorder (UFDR). Following the occurrence, the UFDR was removed from the aircraft and a copy of the recorded data was made by the ATSB. The aircraft was also fitted with a Quick Access Recorder (QAR) unit. The data from this device was downloaded by Qantas Airways Limited and the information applicable to the accident was forwarded to the ATSB. The recovered data from both UFDR and QAR was used to prepare a summary of events and actions during the flight. A print out of the aircraft EICAS log obtained from the aircraft flight deck was used to supplement the recorder data.
The first indication of an anomalous engine condition was recorded at 07:24:15 UTC, with an interruption in the low-pressure spool (N1) speed data from the number-3 engine. One second later, the engine fuel flow and the exhaust gas temperature (EGT) for that engine began to decrease, accompanied by an 'in-transit' annunciation from the thrust reverser system. Another three seconds later (07:24:19), the data showed a reduction in throttle angle and a marked increase in the broadband vibration levels for the number-3 engine. The EICAS captured two 'auto' events at 07:24:22 and 07:24:26; both events showing a loss of N1 and N2 speed, loss of vibration data, a drop in EGT and a loss of fuel flow and oil pressure. The system also flagged multiple number-3 engine faults including the advisory messages ENG 3 FUEL V/V and the reported ENG 3 REVERSER. At 07:24:32, the number-3 engine generator circuit breaker opened and was accompanied several seconds later by a loss of voltage on the number-3 integrated drive generator bus. A loss of data for the engine thrust reverser position, exhaust gas temperature and compressor outlet temperature also occurred at this time. Eight seconds later, data was lost for the engine pressure ratio (EPR) and throttle position.
A comparison of the broadband and individual turbine spool vibration levels produced by the number-3 engine during the time leading up to the failure showed no indications of trends that might have suggested a developing problem.
Tests and research
The ATSB examined the root section of the released fan blade (s/n GB77535), assisted by authorised representatives from the engine manufacturer.
Failure of the blade occurred as a direct result of fatigue cracking propagating transversely through the lower aerofoil section. The origin of cracking was from the upper edge of a pre-existing internal defect at the bonding line between the two titanium alloy plates used to manufacture the blade. Fracture surface features indicated crack growth over multiple flight cycles, continuing to a point where the remaining section failed in ductile tensile overload, releasing the blade aerofoil from the hub. Analysis of the number and nature of the arrest marks extending from the point where the cracking first broke the external surface suggested that around forty flight cycles might have elapsed before final blade failure.
The original manufacturing bond-line defect was roughly circular in form and measured approximately twelve millimetres in the chord-wise dimension. Planar growth of the defect by debonding had occurred to a chord width of around twenty-two millimetres. Examination of the blade manufacturing records showed that the original defect had been detected and quantified by radiographic inspection during blade fabrication. Due to the inherent difficulty in achieving flawless bonding within the blade root block area, criteria for the fitness-for-purpose assessment of blades with bonding discontinuities had been developed. The failed blade had been 'concessionally accepted' for service using these criteria.
Following the blade failure, the manufacturer carried out computational stress modelling of a range of incomplete bond defects and determined that the defect in blade GB77535 was located in one of the two most critical locations for generating high stresses and subsequent fatigue cracking. It was also determined that a defect six millimetres in diameter was the largest area of incomplete bond tolerable under the existing declared blade lives.
ATSB Technical Analysis section number 200200646 (20/02) details the examination of the failed blade and the associated engine damage.
- During the 1991 manufacture of the first-stage low-pressure compressor blade serial number GB77535, a small area of incomplete bonding remained within the interface between the two titanium alloy plates used to fabricate the blade component.
- The presence of the incompletely bonded region was detected during preliminary non-destructive inspection, however the blade was accepted for service under the manufacturer's 'concessional assessment' program.
- The maximum acceptable bond-line defect size limits as specified by the concessional assessment program were too large to ensure that fatigue cracks could not initiate and propagate to failure within the prescribed life limit of the blade components.
- None of the manufacturer's prescribed periodic in-service inspections carried out on the blade during its life had detected the incomplete bond defect. None of these inspections were specifically designed for the detection of defects within the lower aerofoil section where the defect was located.
- Fatigue cracking initiated and propagated from the upper edge of the bond-line defect in response to service loading conditions.
- Fracture and release of the fan aerofoil section from the rotor occurred after growth of the cracking to critical size.
- The number-3 engine failed from damage sustained during the blade failure event.
- The aircraft sustained minor airframe and number-4 engine damage resulting from impacts with blade debris liberated from the number-3 engine nacelle and cowling.
Local safety action
Fan blade failure
The failure of the RB211-524 first-stage low-pressure compressor blade was the first to have originated from a pre-existing incomplete bond defect in the lower aerofoil section. Previous failures of a similar nature had occurred from areas of disbonding in the lower root-block section. In response to the disbond failures, the engine manufacturer had introduced the requirement to periodically inspect the root-block using conventional ultrasonic techniques (Service Bulletin SB72-9660).
In response to its revision of the acceptable bond-line defect size limit, the engine manufacturer issued Alert Service Bulletin RB.211-72-AE001 on 12 March 2002, instructing the removal from service of 109 low-pressure compressor blades that were considered to be at risk of cracking from incompletely bonded areas. The service bulletin was afforded 'Recommended' status and instructed removal of all nominated blades by 15 April 2002. In May 2002, a revision of the service bulletin was issued to include 77 additional compressor blades in the removal program. These components were identified as being at risk during a more extensive review of inspection records. In December 2002, advice was received from the engine manufacturer to indicate that all of the affected blades nominated by the original service bulletin and its revision had been traced and confirmed as removed from service.
RB.211-535 turbofan engines as fitted to Boeing 757 and Tupolev TU204 aircraft contain low-pressure compressor blades of a design similar to the RB.211-524 blades. Because of this similarity, the engine manufacturer considered that the RB.211-535 blades might also be at risk of a similar failure. To address this risk, the manufacturer issued Alert Service Bulletin RB.211-72-AE006, instructing the priority removal of 54 blades by 31 August 2002 or 30 October 2002, dependent upon the blades' service life. A further 58 blades were nominated for removal by no later than 28 February 2003. The UK Civil Aviation Authority approved service bulletin RB.211-72-AE001 on 12 March 2002 and service bulletin RB.211-72-AE006 on 24 April 2002.
In recognition of the communication difficulties experienced by members of the cabin crew immediately following the engine failure event, the aircraft operator has implemented the following changes to the cabin operations.
a) In cases of an aircraft operating with known interphone unserviceability, a suitable emergency communication plan is now discussed and agreed upon during the pre-departure cabin and flight crew briefing.
b) Both normal and abnormal cabin communication scenarios are now included in the Safety and Emergency Procedures (SEP) training provided to flight and cabin crew.
c) An article discussing aspects of communication under emergency conditions has been published in the operator's cabin crew newsletter.
Technical Analysis Report
Technical Analysis Report: Examination of a Failed Rolls-Royce RB211-524 Turbofan Engine
Boeing Commercial Aircraft Group, 747-436, G-BNLD
History of the flight
On the evening of March 1, 2002, Boeing 747-436 aircraft G-BNLD sustained the failure of the number-3 (right inboard) engine during a scheduled regular passenger transport flight from Sydney to Bangkok. The flight crew experienced vibrations and received an ENG 3 REVERSER engine indicating and crew alerting system (EICAS) message. The crew shut down the number-3 engine and completed checklist items before returning the aircraft to Sydney.
An initial engineering examination found that a fan blade from the number-3 engine had failed and that debris had punctured the engine cowl, the right wing leading and trailing edge flaps and the fuselage; damaging a structural member above the wing root area. The inspection found fractured fasteners and other components beneath the fan cowls and damage to the structure associated with the thrust reverser assembly. Debris from the number-3 engine was also found embedded within the intake cowl of the adjacent number-4 engine.
|Date:||01 March 2002||Investigation status:||Completed|
|Time:||1835 hours ESuT|
|Location:||159 km NW Parkes, (VOR)|
|State:||New South Wales|
|Release date:||24 September 2003|
|Report status:||Final||Occurrence category:||Accident|
|Highest injury level:||None|
|Aircraft manufacturer||The Boeing Company|
|Type of operation||Air Transport High Capacity|
|Damage to aircraft||Substantial|
|Departure point||Sydney, NSW|
|Departure time||1729 hours ESuT|
|Role||Class of licence||Hours on type||Hours total|