Total power loss Boeing Co 747-436, G-BNLD, 159 km NW Parkes, NSW, 1 March 2002

History of the flight

At 1729 on 1 March 2002, the Boeing 747-436 aircraft departed Sydney, Australia on a regular passenger transport service to Bangkok, Thailand. Approximately one hour into the flight, while the aircraft was in cruise at flight level 330 (FL330), the crew experienced the sudden onset of heavy airframe vibration and received an ENG 3 REVERSER annunciation from the engine indicating and crew alerting system (EICAS). The crew initially reduced the number-3 engine power and carried out the 'Engine Reverser Unlocked' actions from the aircraft quick-reference handbook (QRH). The crew stated that the engine appeared to be functioning normally at that time. After further EICAS status and advisory messages however, the crew elected to carry out other QRH checklists, concluding with the shutdown of the number-3 engine. The captain made a PAN call to air traffic control and subsequently an advisory announcement to the passengers. To reduce airframe vibration after the engine was shut down, the first-officer, who was the handling pilot, descended the aircraft to FL180 and reduced airspeed. A third crew member who was resting at the time of the event went back into the cabin to examine the engines and found extensive damage to the number-3 engine nacelle and strut fairings. After that information was reported to the flight crew, a further QRH checklist Fire Engine, Severe Damage or Separation was actioned, although at no time was there any reported indication or sign of fire. A decision to return to Sydney was made and fuel was jettisoned to establish a landing weight within limits. In consideration of the damage to the engine and to minimise the risk should the engine or components separate, an over-water approach to runway 34L was requested. The aircraft landed safely at 1947.

Injuries to persons

Damage to the aircraft

The damage sustained by the aircraft was mainly limited to the number-3 engine and nacelle assembly. However, areas of isolated damage produced by the impact of debris escaping from the engine were found within the number-3 engine pylon, the right wing, flap, horizontal stabiliser and control surfaces and the right side of the fuselage.

Damage to the airframe

During the course of the on-site investigation, the operator carried out an inspection of the aircraft in accordance with the Boeing 747-400 maintenance manual, section 05-51-06 (Dragged engine nacelle / Engine seizure / Engine and strut damage condition - Maintenance practices - Conditional inspection). Australian Transport Safety Bureau Technical Analysis report number 20/02 section 1.6 summarised the results of that inspection. The most substantial airframe damage was identified as single punctures in the right wing centre leading edge flap section and the right side of the fuselage, between the cabin window and the upper wing surface. The actual point of debris impact was coincident with a bulkhead structure beneath the thinner fuselage skin. That combination of engine and airframe damage constituted an accident under Annex 13 to the Convention on International Civil Aviation.

Damage to the engines & nacelles

The ATSB carried out a general inspection of the failed engine before it was removed from the aircraft. The engine had sustained extensive damage to the low-pressure compressor, accessory equipment, thrust reverser assembly and the fan cowlings. A single fan blade had fractured from a location immediately above the dovetail rotor connection, releasing the full aerofoil length from the hub. Impact marks showed the blade to have struck the fan case at the one o'clock position (looking rearward), however the case was not compromised and the primary blade failure was contained within the engine. Subsequently however, the remaining fan blades had fragmented over the outer fifty percent of their length, with the liberated debris causing extensive tearing and multiple punctures of the intake cowl forward of the fan case. Two major fragment exit trajectories were identified during the inspection - those were aligned with the damaged areas on the fuselage and leading edge flap panel. The uppermost fragment exit trajectory passed through the forward strut region. Examination of that area revealed the separation of an engine to pylon connector that carried circuits for the monitoring of thrust-reverser position, turbine gas temperature and turbine speed and vibration.

Extensive mechanical damage associated with rotor imbalance loads was found amongst the engine accessory equipment and the thrust-reverser structure, which had separated from the front flange section at the riveted joint. That separation allowed the structure to move rearwards by up to thirty millimetres and transferred the retention loads for the thrust reverser unit and integrated nozzle assembly to the fan case hoop plate assembly. The engine manufacturer's stress modelling of the retention loads through that secondary load path showed that a significant reserve remained in the critical load path joint features, when considering the worst-case scenario of a three hour return extended twin-engine operations (ETOPS) flight ^[1].

Inspection of the adjacent (number-4) engine showed scratches, embedded fragments and other evidence of the ingestion of debris liberated from the number-3 engine. A boroscopic survey of the engine core intermediate and high-pressure compressor stages found blade distress that was typical of foreign-object damage.

Personnel information

The aircraft carried an operational flight crew of three and a cabin crew of fifteen. Additionally, a B757 pilot was a passenger. After the engine failure event, that pilot was requested to assist the flight crew in the management of the aircraft and the return to Sydney. Interviews following the event found that the crew were properly licensed and medically fit to conduct the flight.

[1] RB211-524 engines are also fitted to Boeing 767 twin-engine aircraft subject to ETOPS requirements.

Aircraft information

Engine information

The Rolls-Royce RB211-524G engine (serial number 13340) had been installed on G-BNLD in November 1999 and had operated for 9,915 hours and through 1,299 cycles while fitted to that aircraft. The engine was originally manufactured in 1994 and had accrued a total life of 30,075 hours and 4,011 cycles at the time of the failure.

Fan blade information

The failed first-stage low-pressure compressor (fan) blade (part number UL29573, serial number GB77535) was manufactured in 1991. Since that time, the component had accumulated a service life of 32,000 hours and 9,444 cycles, with the last 8,915 hours and 1,299 cycles within engine 13340. The manufacturer's specified maximum service life for the blade type was 15,000 cycles.

Fan blade history and inspection

The manufacturer's service bulletin SB72-9660 specified three different periodic non-destructive tests aimed at detecting service-induced cracking, or damage in various critical parts of the RB211-524 blades. The manufacturer's records indicated that the failed fan blade had been overhauled on three separate occasions. The last overhaul was carried out in October 1999 and included the repair and polishing of the aerofoil surface and the replacement of the blade root dry film lubricant. Non-destructive inspections following the overhaul included a transient acoustic propagation (TAP) test, ultrasonic inspection of the root block and ultrasonic C-scan inspection of the blade aerofoil. Following the satisfactory completion of these tests, the blade was installed into engine serial number 13340 and the engine was fitted to G-BNLD. Of the non-destructive tests specified within SB72-9660, only the TAP test was applicable to on-wing inspections and was required at 200 cycle intervals. The TAP test was designed to detect the loss of vacuum within the internal cavity of the blade; indicating the presence of through-section cracking or other damage. Records from the engine manufacturer indicated compliance with the service bulletin, with the last TAP test carried out on 18 February 2002; ten days prior to the failure. Specific records documenting the results of that test were not available.

Cabin events

The cabin services director (CSD) reported the flight to have been normal until approximately one hour after takeoff. At the time of the engine failure the CSD was at the under-stair station talking with the First Officer on the flight deck via the cabin interphone system. The CSD reported hearing two loud thuds, followed by strong, continuing airframe vibration. Immediately looking out of a right side cabin door window, the CSD saw multiple holes in the number-3 engine cowling and pylon, through which he was able to see the ground below. He reported the weather as very clear and bright daylight. Returning to his station, the CSD attempted unsuccessfully on two occasions to contact the flight deck using the pilot alert interphone function, noting that some passengers were showing concern and wanting information. Instructing the cabin crew to stow the service equipment and secure the cabin, the CSD was about to attempt contacting the flight deck again when he was met by the third pilot who appraised the CSD of the situation. Further information was subsequently provided to the crew and passengers by the captain in a public address (PA) announcement.

A report from the rear cabin purser described the engine failure as a loud noise followed by juddering. Due to unserviceability with the cabin interphone system, the purser was unable to communicate with the CSD. The captain's PA announcement provided the first information to the rear cabin purser regarding the engine failure.

Cabin communication

Information gathered from the crew interviews and the aircraft technical log revealed that areas of the cabin interphone system were unserviceable at the commencement of the flight. To address this, the CSD had briefed the crew before flight for an alternative emergency communication procedure, requiring that pursers report to his station if an alert signal was given. Once he had assessed the event and the extent of aircraft damage, the third pilot assumed the cabin communications role and made several walk-around visits to the cabin to provide information and reassurance to the crew and passengers.

Flight deck security

In a response to a conference on enhanced aircraft security, the aircraft manufacturer had begun the implementation of a two-phase program to address perceived security deficiencies on board its aircraft. As part of its phase-one response, the aircraft operator had installed mechanical internal locks to the flight deck doors and implemented a policy regarding their use. The mechanical locks supplemented the pre-existing electric door locks and were only able to be operated by a flight crew member standing at the door. The electric door locks were capable of being operated by the flight crew in their normal, seated position. The operator's policy required the locking of the modified flight deck door before engine start and unlocking after engine shut down. The stated objective of the policy was to minimise the amount of time the flight deck door was unlocked and achieved this by providing specific procedures for crew interaction. These procedures relied extensively on the use of the interphone and alerting systems. While the minimum equipment list (MEL) documentation for the aircraft at the time of the event permitted operations with partial interphone unserviceability, it specified that the flight deck to cabin connection must be operational in order for the flight deck manual door lock to be used.

Shortly after the engine failure, the flight crew decided to abandon the locked door policy. That decision was taken to facilitate the use of the third crew member as a cabin to flight deck go-between role and to alleviate some of the problems associated with the interphone unserviceability.

Flight recorders

The aircraft was fitted with a Sundstrand Data Control Universal Flight Data Recorder (UFDR). Following the occurrence, the UFDR was removed from the aircraft and a copy of the recorded data was made by the ATSB. The aircraft was also fitted with a Quick Access Recorder (QAR) unit. The data from this device was downloaded by Qantas Airways Limited and the information applicable to the accident was forwarded to the ATSB^[2]. The recovered data from both UFDR and QAR was used to prepare a summary of events and actions during the flight. A print out of the aircraft EICAS log obtained from the aircraft flight deck was used to supplement the recorder data.

The first indication of an anomalous engine condition was recorded at 07:24:15 UTC, with an interruption in the low-pressure spool (N1) speed data from the number-3 engine. One second later, the engine fuel flow and the exhaust gas temperature (EGT) for that engine began to decrease, accompanied by an 'in-transit' annunciation from the thrust reverser system. Another three seconds later (07:24:19), the data showed a reduction in throttle angle and a marked increase in the broadband vibration levels for the number-3 engine. The EICAS captured two 'auto' events at 07:24:22 and 07:24:26; both events showing a loss of N1 and N2 speed, loss of vibration data, a drop in EGT and a loss of fuel flow and oil pressure. The system also flagged multiple number-3 engine faults including the advisory messages ENG 3 FUEL V/V and the reported ENG 3 REVERSER. At 07:24:32, the number-3 engine generator circuit breaker opened and was accompanied several seconds later by a loss of voltage on the number-3 integrated drive generator bus. A loss of data for the engine thrust reverser position, exhaust gas temperature and compressor outlet temperature also occurred at this time. Eight seconds later, data was lost for the engine pressure ratio (EPR) and throttle position.

A comparison of the broadband and individual turbine spool vibration levels produced by the number-3 engine during the time leading up to the failure showed no indications of trends that might have suggested a developing problem.

Tests and research

The ATSB examined the root section of the released fan blade (s/n GB77535), assisted by authorised representatives from the engine manufacturer.

Failure of the blade occurred as a direct result of fatigue cracking propagating transversely through the lower aerofoil section. The origin of cracking was from the upper edge of a pre-existing internal defect at the bonding line between the two titanium alloy plates used to manufacture the blade. Fracture surface features indicated crack growth over multiple flight cycles, continuing to a point where the remaining section failed in ductile tensile overload, releasing the blade aerofoil from the hub. Analysis of the number and nature of the arrest marks extending from the point where the cracking first broke the external surface suggested that around forty flight cycles might have elapsed before final blade failure.

[2] Quick-access recorders are fitted to aircraft as a maintenance tool for the operator and as such, the ATSB does not routinely download data from these units.

The original manufacturing bond-line defect was roughly circular in form and measured approximately twelve millimetres in the chord-wise dimension. Planar growth of the defect by debonding had occurred to a chord width of around twenty-two millimetres. Examination of the blade manufacturing records showed that the original defect had been detected and quantified by radiographic inspection during blade fabrication. Due to the inherent difficulty in achieving flawless bonding within the blade root block area, criteria for the fitness-for-purpose assessment of blades with bonding discontinuities had been developed. The failed blade had been 'concessionally accepted' for service using these criteria.

Following the blade failure, the manufacturer carried out computational stress modelling of a range of incomplete bond defects and determined that the defect in blade GB77535 was located in one of the two most critical locations for generating high stresses and subsequent fatigue cracking. It was also determined that a defect six millimetres in diameter was the largest area of incomplete bond tolerable under the existing declared blade lives.

ATSB Technical Analysis section number 200200646 (20/02) details the examination of the failed blade and the associated engine damage.

Local safety action

Fan blade failure

The failure of the RB211-524 first-stage low-pressure compressor
blade was the first to have originated from a pre-existing
incomplete bond defect in the lower aerofoil section. Previous
failures of a similar nature had occurred from areas of disbonding
in the lower root-block section. In response to the disbond
failures, the engine manufacturer had introduced the requirement to
periodically inspect the root-block using conventional ultrasonic
techniques (Service Bulletin SB72-9660).

In response to its revision of the acceptable bond-line defect
size limit, the engine manufacturer issued Alert Service Bulletin
RB.211-72-AE001 on 12 March 2002, instructing the removal from
service of 109 low-pressure compressor blades that were considered
to be at risk of cracking from incompletely bonded areas. The
service bulletin was afforded 'Recommended' status and instructed
removal of all nominated blades by 15 April 2002. In May 2002, a
revision of the service bulletin was issued to include 77
additional compressor blades in the removal program. These
components were identified as being at risk during a more extensive
review of inspection records. In December 2002, advice was received
from the engine manufacturer to indicate that all of the affected
blades nominated by the original service bulletin and its revision
had been traced and confirmed as removed from service.

RB.211-535 turbofan engines as fitted to Boeing 757 and Tupolev
TU204 aircraft contain low-pressure compressor blades of a design
similar to the RB.211-524 blades. Because of this similarity, the
engine manufacturer considered that the RB.211-535 blades might
also be at risk of a similar failure. To address this risk, the
manufacturer issued Alert Service Bulletin RB.211-72-AE006,
instructing the priority removal of 54 blades by 31 August 2002 or
30 October 2002, dependent upon the blades' service life. A further
58 blades were nominated for removal by no later than 28 February
2003. The UK Civil Aviation Authority approved service bulletin
RB.211-72-AE001 on 12 March 2002 and service bulletin
RB.211-72-AE006 on 24 April 2002.

Cabin communications

In recognition of the communication difficulties experienced by
members of the cabin crew immediately following the engine failure
event, the aircraft operator has implemented the following changes
to the cabin operations.

a) In cases of an aircraft operating with known interphone
unserviceability, a suitable emergency communication plan is now
discussed and agreed upon during the pre-departure cabin and flight
crew briefing.

b) Both normal and abnormal cabin communication scenarios are
now included in the Safety and Emergency Procedures (SEP) training
provided to flight and cabin crew.

c) An article discussing aspects of communication under
emergency conditions has been published in the operator's cabin
crew newsletter.

1. During the 1991 manufacture of the first-stage low-pressure
   compressor blade serial number GB77535, a small area of incomplete
   bonding remained within the interface between the two titanium
   alloy plates used to fabricate the blade component.
2. The presence of the incompletely bonded region was detected
   during preliminary non-destructive inspection, however the blade
   was accepted for service under the manufacturer's 'concessional
   assessment' program.
3. The maximum acceptable bond-line defect size limits as
   specified by the concessional assessment program were too large to
   ensure that fatigue cracks could not initiate and propagate to
   failure within the prescribed life limit of the blade
   components.
4. None of the manufacturer's prescribed periodic in-service
   inspections carried out on the blade during its life had detected
   the incomplete bond defect. None of these inspections were
   specifically designed for the detection of defects within the lower
   aerofoil section where the defect was located.
5. Fatigue cracking initiated and propagated from the upper edge
   of the bond-line defect in response to service loading
   conditions.
6. Fracture and release of the fan aerofoil section from the rotor
   occurred after growth of the cracking to critical size.
7. The number-3 engine failed from damage sustained during the
   blade failure event.
8. The aircraft sustained minor airframe and number-4 engine
   damage resulting from impacts with blade debris liberated from the
   number-3 engine nacelle and cowling.

Approximately one hour after departing Sydney on a regular
passenger transport flight to Bangkok, Thailand, the Boeing 747-436
aircraft, registration G-BNLD, sustained the failure of the right
inboard (number-3) engine, necessitating a return to Sydney airport
where an uneventful one-engine inoperative landing was made.

Failure of the number-3 engine resulted from the fracture and
liberation of a single first-stage low-pressure compressor (fan)
blade. The blade failed through the lower aerofoil section,
immediately adjacent to the dovetail connection with the rotor
disk. While the initial blade impact was fully contained by the fan
casing, many fragments of the fractured blade and the damaged
adjacent blades punctured the intake cowling or escaped forward of
the nacelle, producing damage to the wing, control surfaces,
fuselage and the number-4 engine. Imbalance forces generated by the
blade loss produced extensive damage to the engine accessory
components and disrupted the primary load-bearing path between the
engine fan case and the thrust reverser assembly.

ATSB laboratory examination of the retained root section of the
failed blade established that fatigue cracking had initiated and
propagated from a pre-existing defect at the blade centreline. The
defect was characterised as a 'lack of bond' feature at the
interface between the two sandwiched titanium alloy panels used to
form the blade. Fatigue cracking had initiated from the upper edge
of the defect and propagated under operationally induced bending
and centrifugal loads.

The lack of bond defect had formed during manufacture of the
blade in 1991. While it was detected during manufacturing
inspections, the defect was assessed as non-critical and the blade
was accepted for service under the engine manufacturers
'concessional acceptance' system. The blade subsequently accrued a
service life of 9,444 cycles and 32,000 hours before failing; this
representing 63% of the 15,000-cycle design prescribed blade
life.

In response to the blade failure identified in the
investigation, which was the first of its type, the engine
manufacturer has revised the acceptable bond-line defect size limit
and issued a series of alert service bulletins, requiring the
removal from service of 186 RB.211-524 blades and 112 similar
RB.211-535 blades. These were 'concessionally accepted' components
that, on review of the manufacturing documentation, had been
assessed as being at risk of failure from a similar mechanism. In
December 2002, the engine manufacturer advised that all blades
identified by the service bulletins had been traced and confirmed
as removed from service.