On 3 December 2010, Rolls-Royce released NMSB RB.211-73-AG639, advising Trent 900 operators of the introduction of a revised standard of engine management software that featured an IP turbine overspeed protection system (IPTOS).
The IPTOS was intended to detect engine conditions with the potential to lead to an IP turbine over speed. In response, IPTOS would shut down the engine before the IP turbine disc reached its critical burst speed. Shaft breaks and disc separation, such as occurred in VH-OQA can occur for mechanical reasons such as component fatigue, an over torque being applied to the shaft or a manufacturing defect, or by localised heating such as from an oil-fed fire. During the course of the investigation into the No.2 engine failure in VH-OQA, the ATSB was provided a detailed summary of the IPTOS protection system, which works on the following logic:
The first element arms the system, and is based on detecting a prescribed rate of temperature change of turbine cooling air at the front (TCAF) or rear (TCAR) of the IP turbine. Such rates of change indicate that a fire has developed within the engine that may lead to localised heating of the IP turbine disc or shaft.
Once armed, if an abnormally high rapid rate of compressor deceleration is detected, a shaft break or disc separation is indicated and the EEC (engine electronic controller) will instantly shut off the fuel, open all the bleed valves and close the variable stator vanes.
Flight crew are alerted to an IP shaft failure through a flight deck annunciator alert that raises the message ‘ENG FAIL-SHAFT FAILURE’.
Rolls-Royce reported that the engine EEC software upgrade that included the IPTOS functionality was incorporated across the Trent 900 fleet by 6 December 2010.