History of the flight
At 1729 on 1 March 2002, the Boeing 747-436 aircraft departed Sydney, Australia on a regular passenger transport service to Bangkok, Thailand. Approximately one hour into the flight, while the aircraft was in cruise at flight level 330 (FL330), the crew experienced the sudden onset of heavy airframe vibration and received an ENG 3 REVERSER annunciation from the engine indicating and crew alerting system (EICAS). The crew initially reduced the number-3 engine power and carried out the 'Engine Reverser Unlocked' actions from the aircraft quick-reference handbook (QRH). The crew stated that the engine appeared to be functioning normally at that time. After further EICAS status and advisory messages however, the crew elected to carry out other QRH checklists, concluding with the shutdown of the number-3 engine. The captain made a PAN call to air traffic control and subsequently an advisory announcement to the passengers. To reduce airframe vibration after the engine was shut down, the first-officer, who was the handling pilot, descended the aircraft to FL180 and reduced airspeed. A third crew member who was resting at the time of the event went back into the cabin to examine the engines and found extensive damage to the number-3 engine nacelle and strut fairings. After that information was reported to the flight crew, a further QRH checklist Fire Engine, Severe Damage or Separation was actioned, although at no time was there any reported indication or sign of fire. A decision to return to Sydney was made and fuel was jettisoned to establish a landing weight within limits. In consideration of the damage to the engine and to minimise the risk should the engine or components separate, an over-water approach to runway 34L was requested. The aircraft landed safely at 1947.
Injuries to persons
| Injuries |
Crew |
Passengers |
Others |
Total |
| Fatal |
|
|
|
|
| Serious |
|
|
|
|
| Minor |
|
|
|
|
| None |
18 |
272 |
Nil |
290 |
Damage to the aircraft
The damage sustained by the aircraft was mainly limited to the number 3 engine and nacelle assembly. However, areas of isolated damage produced by the impact of debris escaping from the engine were found within the number 3 engine pylon, the right wing, flap, horizontal stabiliser and control surfaces and the right side of the fuselage.
Damage to the airframe
During the course of the on-site investigation, the operator carried out an inspection of the aircraft in accordance with the Boeing 747-400 maintenance manual, section 05-51-06 (Dragged engine nacelle / Engine seizure / Engine and strut damage condition - Maintenance practices - Conditional inspection). Australian Transport Safety Bureau Technical Analysis report number 20/02 section 1.6 summarised the results of that inspection. The most substantial airframe damage was identified as single punctures in the right wing centre leading edge flap section and the right side of the fuselage, between the cabin window and the upper wing surface. The actual point of debris impact was coincident with a bulkhead structure beneath the thinner fuselage skin. That combination of engine and airframe damage constituted an accident under Annex 13 to the Convention on International Civil Aviation.
Damage to the engines & nacelles
The ATSB carried out a general inspection of the failed engine before it was removed from the aircraft. The engine had sustained extensive damage to the low-pressure compressor, accessory equipment, thrust reverser assembly and the fan cowlings. A single fan blade had fractured from a location immediately above the dovetail rotor connection, releasing the full aerofoil length from the hub. Impact marks showed the blade to have struck the fan case at the one o'clock position (looking rearward), however the case was not compromised and the primary blade failure was contained within the engine. Subsequently however, the remaining fan blades had fragmented over the outer fifty percent of their length, with the liberated debris causing extensive tearing and multiple punctures of the intake cowl forward of the fan case. Two major fragment exit trajectories were identified during the inspection - those were aligned with the damaged areas on the fuselage and leading edge flap panel. The uppermost fragment exit trajectory passed through the forward strut region. Examination of that area revealed the separation of an engine to pylon connector that carried circuits for the monitoring of thrust-reverser position, turbine gas temperature and turbine speed and vibration.
Extensive mechanical damage associated with rotor imbalance loads was found amongst the engine accessory equipment and the thrust-reverser structure, which had separated from the front flange section at the riveted joint. That separation allowed the structure to move rearwards by up to thirty millimetres and transferred the retention loads for the thrust reverser unit and integrated nozzle assembly to the fan case hoop plate assembly. The engine manufacturer's stress modelling of the retention loads through that secondary load path showed that a significant reserve remained in the critical load path joint features, when considering the worst-case scenario of a three hour return extended twin-engine operations (ETOPS) flight [1].
Inspection of the adjacent (number-4) engine showed scratches, embedded fragments and other evidence of the ingestion of debris liberated from the number-3 engine. A boroscopic survey of the engine core intermediate and high-pressure compressor stages found blade distress that was typical of foreign-object damage.
Personnel information
The aircraft carried an operational flight crew of three and a cabin crew of fifteen. Additionally, a B757 pilot was a passenger. After the engine failure event, that pilot was requested to assist the flight crew in the management of the aircraft and the return to Sydney. Interviews following the event found that the crew were properly licensed and medically fit to conduct the flight.
[1] RB211-524 engines are also fitted to Boeing 767 twin-engine aircraft subject to ETOPS requirements.
Aircraft information
| Manufacturer |
Boeing Commercial Aircraft Group |
| Model |
747-436 |
| Serial number |
23911 |
| Registration |
G-BNLD |
| Year of manufacture |
1989 |
| Certificate of airworthiness (no.) |
033678/003 Issued 6 September 1999 |
| Certificate of registration (no.) |
G-BNLD/R1 Issued 5 September 1989 |
Engine information
The Rolls-Royce RB211-524G engine (serial number 13340) had been installed on G-BNLD in November 1999 and had operated for 9,915 hours and through 1,299 cycles while fitted to that aircraft. The engine was originally manufactured in 1994 and had accrued a total life of 30,075 hours and 4,011 cycles at the time of the failure.
Fan blade information
The failed first-stage low-pressure compressor (fan) blade (part number UL29573, serial number GB77535) was manufactured in 1991. Since that time, the component had accumulated a service life of 32,000 hours and 9,444 cycles, with the last 8,915 hours and 1,299 cycles within engine 13340. The manufacturer's specified maximum service life for the blade type was 15,000 cycles.
Fan blade history and inspection
The manufacturer's service bulletin SB72-9660 specified three different periodic non-destructive tests aimed at detecting service-induced cracking, or damage in various critical parts of the RB211-524 blades. The manufacturer's records indicated that the failed fan blade had been overhauled on three separate occasions. The last overhaul was carried out in October 1999 and included the repair and polishing of the aerofoil surface and the replacement of the blade root dry film lubricant. Non-destructive inspections following the overhaul included a transient acoustic propagation (TAP) test, ultrasonic inspection of the root block and ultrasonic C-scan inspection of the blade aerofoil. Following the satisfactory completion of these tests, the blade was installed into engine serial number 13340 and the engine was fitted to G-BNLD. Of the non-destructive tests specified within SB72-9660, only the TAP test was applicable to on-wing inspections and was required at 200 cycle intervals. The TAP test was designed to detect the loss of vacuum within the internal cavity of the blade; indicating the presence of through-section cracking or other damage. Records from the engine manufacturer indicated compliance with the service bulletin, with the last TAP test carried out on 18 February 2002; ten days prior to the failure. Specific records documenting the results of that test were not available.
Cabin events
The cabin services director (CSD) reported the flight to have been normal until approximately one hour after takeoff. At the time of the engine failure the CSD was at the under-stair station talking with the First Officer on the flight deck via the cabin interphone system. The CSD reported hearing two loud thuds, followed by strong, continuing airframe vibration. Immediately looking out of a right side cabin door window, the CSD saw multiple holes in the number-3 engine cowling and pylon, through which he was able to see the ground below. He reported the weather as very clear and bright daylight. Returning to his station, the CSD attempted unsuccessfully on two occasions to contact the flight deck using the pilot alert interphone function, noting that some passengers were showing concern and wanting information. Instructing the cabin crew to stow the service equipment and secure the cabin, the CSD was about to attempt contacting the flight deck again when he was met by the third pilot who appraised the CSD of the situation. Further information was subsequently provided to the crew and passengers by the captain in a public address (PA) announcement.
A report from the rear cabin purser described the engine failure as a loud noise followed by juddering. Due to unserviceability with the cabin interphone system, the purser was unable to communicate with the CSD. The captain's PA announcement provided the first information to the rear cabin purser regarding the engine failure.
Cabin communication
Information gathered from the crew interviews and the aircraft technical log revealed that areas of the cabin interphone system were unserviceable at the commencement of the flight. To address this, the CSD had briefed the crew before flight for an alternative emergency communication procedure, requiring that pursers report to his station if an alert signal was given. Once he had assessed the event and the extent of aircraft damage, the third pilot assumed the cabin communications role and made several walk-around visits to the cabin to provide information and reassurance to the crew and passengers.
Flight deck security
In a response to a conference on enhanced aircraft security, the aircraft manufacturer had begun the implementation of a two-phase program to address perceived security deficiencies on board its aircraft. As part of its phase-one response, the aircraft operator had installed mechanical internal locks to the flight deck doors and implemented a policy regarding their use. The mechanical locks supplemented the pre-existing electric door locks and were only able to be operated by a flight crew member standing at the door. The electric door locks were capable of being operated by the flight crew in their normal, seated position. The operator's policy required the locking of the modified flight deck door before engine start and unlocking after engine shut down. The stated objective of the policy was to minimise the amount of time the flight deck door was unlocked and achieved this by providing specific procedures for crew interaction. These procedures relied extensively on the use of the interphone and alerting systems. While the minimum equipment list (MEL) documentation for the aircraft at the time of the event permitted operations with partial interphone unserviceability, it specified that the flight deck to cabin connection must be operational in order for the flight deck manual door lock to be used.
Shortly after the engine failure, the flight crew decided to abandon the locked door policy. That decision was taken to facilitate the use of the third crew member as a cabin to flight deck go-between role and to alleviate some of the problems associated with the interphone unserviceability.
Flight recorders
The aircraft was fitted with a Sundstrand Data Control Universal Flight Data Recorder (UFDR). Following the occurrence, the UFDR was removed from the aircraft and a copy of the recorded data was made by the ATSB. The aircraft was also fitted with a Quick Access Recorder (QAR) unit. The data from this device was downloaded by Qantas Airways Limited and the information applicable to the accident was forwarded to the ATSB[2]. The recovered data from both UFDR and QAR was used to prepare a summary of events and actions during the flight. A print out of the aircraft EICAS log obtained from the aircraft flight deck was used to supplement the recorder data.
The first indication of an anomalous engine condition was recorded at 07:24:15 UTC, with an interruption in the low-pressure spool (N1) speed data from the number-3 engine. One second later, the engine fuel flow and the exhaust gas temperature (EGT) for that engine began to decrease, accompanied by an 'in-transit' annunciation from the thrust reverser system. Another three seconds later (07:24:19), the data showed a reduction in throttle angle and a marked increase in the broadband vibration levels for the number-3 engine. The EICAS captured two 'auto' events at 07:24:22 and 07:24:26; both events showing a loss of N1 and N2 speed, loss of vibration data, a drop in EGT and a loss of fuel flow and oil pressure. The system also flagged multiple number-3 engine faults including the advisory messages ENG 3 FUEL V/V and the reported ENG 3 REVERSER. At 07:24:32, the number-3 engine generator circuit breaker opened and was accompanied several seconds later by a loss of voltage on the number-3 integrated drive generator bus. A loss of data for the engine thrust reverser position, exhaust gas temperature and compressor outlet temperature also occurred at this time. Eight seconds later, data was lost for the engine pressure ratio (EPR) and throttle position.
A comparison of the broadband and individual turbine spool vibration levels produced by the number 3 engine during the time leading up to the failure showed no indications of trends that might have suggested a developing problem.
Tests and research
The ATSB examined the root section of the released fan blade (s/n GB77535), assisted by authorised representatives from the engine manufacturer.
Failure of the blade occurred as a direct result of fatigue cracking propagating transversely through the lower aerofoil section. The origin of cracking was from the upper edge of a pre-existing internal defect at the bonding line between the two titanium alloy plates used to manufacture the blade. Fracture surface features indicated crack growth over multiple flight cycles, continuing to a point where the remaining section failed in ductile tensile overload, releasing the blade aerofoil from the hub. Analysis of the number and nature of the arrest marks extending from the point where the cracking first broke the external surface suggested that around forty flight cycles might have elapsed before final blade failure.
[2] Quick-access recorders are fitted to aircraft as a maintenance tool for the operator and as such, the ATSB does not routinely download data from these units.
The original manufacturing bond-line defect was roughly circular in form and measured approximately twelve millimetres in the chord-wise dimension. Planar growth of the defect by debonding had occurred to a chord width of around twenty-two millimetres. Examination of the blade manufacturing records showed that the original defect had been detected and quantified by radiographic inspection during blade fabrication. Due to the inherent difficulty in achieving flawless bonding within the blade root block area, criteria for the fitness-for-purpose assessment of blades with bonding discontinuities had been developed. The failed blade had been 'concessionally accepted' for service using these criteria.
Following the blade failure, the manufacturer carried out computational stress modelling of a range of incomplete bond defects and determined that the defect in blade GB77535 was located in one of the two most critical locations for generating high stresses and subsequent fatigue cracking. It was also determined that a defect six millimetres in diameter was the largest area of incomplete bond tolerable under the existing declared blade lives.
ATSB Technical Analysis section number 200200646 (20/02) details the examination of the failed blade and the associated engine damage.
