Engine shut down in-flight involving Airbus A330-302, B-18358, 887 km east-north-east of Darwin Airport, on 3 October 2013

History of the flight

On 3 October 2013 at 1223 UTC, an Airbus A330-302 aircraft, registered B-18358 and operated by China Airlines, departed Sydney, Australia on a scheduled passenger transport flight to Taipei, Taiwan ROC. On board the aircraft were 205 passengers and 13 crew.

At 1611, when the aircraft was approximately 890km ENE of Darwin, Australia, the flight crew received an ECAM^[2] low oil quantity advisory and, a minute later, a low oil pressure warning for the No. 1 engine. The flight crew initiated a precautionary shutdown of the affected engine at 1613 and then diverted the aircraft to Cairns, Australia where it landed at 1813 without further incident. There were no injuries as a result of the occurrence.

Post-occurrence

Preliminary examination of the No. 1 engine by maintenance personnel at Cairns found that the air turbine starter had sustained an uncontained failure. Debris released from the starter had severed the adjacent B-sump engine oil scavenge pipe and damaged (without rupturing) the C-sump oil scavenge pipe (Figure 1). This resulted in the complete loss of oil from the No. 1 engine, necessitating the engine shut down.

The starter (Figure 2) and associated starter air valve were initially sent to the ATSB for visual examination before being forwarded to the starter manufacturer for detailed disassembly and inspection.

Figure 1: Damage to oil pipes visible after removal of the starter

Source: China Airlines

Figure 2: The air turbine starter removed from B-18358, as-recovered

Source: ATSB

__________

2. Electronic Centralised Aircraft Monitoring system, the purpose of which is to monitor and display aircraft system information as well as indicate required flight crew actions in most normal, abnormal and emergency situations.

Recorded data

The aircraft was fitted with both a cockpit voice recorder (CVR) and flight data recorder (FDR). The aircraft operator provided a download of the FDR for analysis by the ATSB. Analysis of the data confirmed the sequence of events and showed that the engine oil quantity for the No. 1 engine decreased to zero at a steady rate, commencing at 16:10:33 UTC, for a duration of approximately 1 minute. The engine oil pressure subsequently started to decrease once the oil quantity reached the minimum recordable level. This resulted in the oil pressure warnings received by the flight crew. There were no other anomalies noted in the recorded data.

The FDR data also contained the 20 previous flight sectors and start sequences for the aircraft engines. The data was examined by the ATSB and the engine manufacturer and showed no evidence of any errors or anomalies relating to the air turbine starter or starter air valve.

Engine details

Aircraft propulsion was provided by two General Electric CF6-80E engines. Engine serial number 811612 was installed in the No. 1 position and was a new engine at the time of installation. The engine had completed 4,096 hours and 1,169 cycles at the time of the occurrence. The failed air turbine starter was the original part fitted to the engine at the introduction to service.

Air turbine starter

The air turbine starter utilises pressurised air from either the aircraft auxiliary power unit, another aircraft engine or a ground power unit to drive a turbine at high speed. The high-speed, low-torque from the starter turbine is converted to a lower-speed, high torque output via a reduction gear and the engine accessory drive system. The starter output is used to drive the engine high pressure rotor. Air supply to the starter is controlled by the starter air valve, which is pneumatically operated and electrically controlled.

Engagement of the air turbine starter with the engine is controlled via a ratchet and pawl clutch assembly (Figure 3). At zero or low speeds the three pawls are engaged with the ratchet, which is driven by the starter turbine. The pawl carrier is integral with the starter output shaft, which is constantly engaged with the engine. On a normal start, after ignition, the engine will accelerate to a speed whereby the pawls, acting like flyweights, will disengage from the ratchet to prevent the engine from back-driving the starter. The output shaft continues to rotate with the engine.

The 3505468-6 starter design was introduced to service in February 2009 beginning at serial number GRTF2607. The -6 designation included improvements to turbine axial containment.

Figure 3: Ratchet and pawl clutch example

Source: Aircraft Gas Turbine Engine Technology, Treager, 1996.

Air turbine starter investigation

Disassembly and examination of the starter was conducted by the starter manufacturer at their investigation facility and a detailed report was provided to the ATSB. The report concluded that the failure sequence was initiated by failure of the output shaft support bearing. This allowed contact between the rotating pawl carrier and ratchet, which subsequently failed, along with the hub gear. Failure of these components resulted in the fracture of the starter casing and release of debris with enough energy to sever the adjacent B-sump scavenge pipe on the engine.

Recovered output shaft bearing components were limited to fragments of the bearing cage, one fractured ball and one ball with significantly reduced diameter. The inner and outer bearing races were extensively damaged, but intact. It was likely that the output shaft continued to run for some time after the loss of oil, which caused additional damage to the bearing. It was therefore difficult to accurately assess the bearing failure mechanism. Nevertheless, the report indicated that based on analysis of the starter components, the most probable factor contributing to failure of the output shaft bearing was damage caused by a prior crash-engagement^[3] of the clutch.

Following on from the initial report from the starter manufacturer, the engine manufacturer conducted further analysis of the starter failure. Their investigation concluded that a high transient load sustained by the output shaft bearing could subsequently lead to overrunning bearing failure. Further work by the engine manufacturer showed that trimming of the engine accessory gearbox horizontal drive shaft could prevent this axial load. As a result, a change in design had been approved at the time of writing this report, with the redesigned shafts to be available from November 2015. The change will be introduced to both the CF6-80C2 and the CF6-80E1 engines, which utilise a common Horizontal Driveshaft (HDS). It should be noted that the CF6-80C2 design already included extra axial clearance, which has prevented the over-running bearing failures, like those seen on the CF6-80E1.

Maintenance history

The Aircraft Maintenance Manual (AMM) recommended air turbine starter oil level checks at intervals of 800 hours and oil changes at intervals of 1,600 hours or 800 cycles. At the time of the occurrence, the AMM stated that the oil quantity until overflow was 800mL and that the quantity if visible at the bottom of the sight gauge was 700mL. At an oil check or change, if the oil level quantity was less than the sight gauge (700mL), a further check for evidence of oil leakage around the seals was required, and if recorded at less than 600mL the starter was to be replaced. Additional information stated that the output shaft bearing could fail from lack of lubrication and overheat when the oil level dropped below 600mL.

The AMM advised that normal oil consumption between maintenance operations was 30 – 200mL. The airline’s task card instructed that the starter had to be replaced if more than 200mL of oil was required during an oil check.

It was a requirement to record the level of oil drained from the starter during each oil change. Maintenance records indicated that the starter had undergone a previous oil check on 3 September 2013 at 3,715 hours since new (TSN) and 1,075 cycles since new (CSN) and an oil change on 8 July 2013 at 2,979 TSN and 887 CSN. At that most recent change, only 610mL of oil was recorded to have been drained, which was close to the lower limit of 600mL.

There was a discrepancy between what was included in the maintenance documentation and the data plate attached to the starter motor. The data plate on the starter stated an oil change at 800 hours as opposed to the 1600 hours stated in the AMM.

As a result of the findings related to potential low oil levels in the starter, the manufacturer conducted a number of tests running the starter with varying levels of oil. Their testing found that the starter actually had a capacity of 1000mL and was more susceptible to damage during operation with high oil levels rather than low. The starter could also be operated with almost zero oil without failure. However, it was noted that it would be unlikely to survive a series of engine starts with no oil due to failure(s) of the starter bearings, particularly turbine shaft bearings.

Following the occurrence, oil samples were collected from various sources, including oil from the same container that was used to service the failed starter, oil from in-service starters that had been serviced by the same container, and oil from the current container that was being used at the time of the sampling. Analysis of the oil samples found them to be within acceptable limits.

Starter air valve

The starter air valve (SAV) regulates the flow of pressurised air to the starter. The SAV was examined and subjected to functional testing at the manufacturer’s test facility. The results showed that the SAV was functioning as designed and had no pre-existing condition that would preclude normal operation.

Previous occurrences

There had been 13 over running bearing failures relating to the ATS200-61 starter model between January 2007 and August 2014. Five of these failures were identified as being uncontained relative to the starter housing;

• On 7 July 2014, an Airbus A330 aircraft performed an air turn back following low oil quantity and pressure indications approximately 90 minutes after departure. Post-flight inspection revealed a fire in the starter area as a result of the uncontained failure of part number 3505468-6 starter. The starter had been installed in November 2013 and had accumulated 3,105 hours and 483 cycles since that time. The most likely failure scenario was low starter oil quantity as a result of leaking pressure fill fittings.
• In November 2013, a part number 3505468-6 starter sustained an uncontained failure on an Airbus A330-300 aircraft. The mechanism of failure was similar to that of the subject occurrence, except that the failure occurred while the aircraft was on the ground and there was no secondary damage to the engine. The air turbine starter failed 16 days after the last oil change, and 2,758 hours since new. The failure was directly attributed to a lack of lubrication.
• In July 2013, an uncontained starter failure was found during the post-flight inspection. The starter had 216 hours since new. The failure was related to a lack of lubrication with no oil found in the sump.
• The fourth uncontained starter failure was in December 2011, and was again attributed to a lack of oil with the sump being found to completely dry. The starter was 27 hours since an oil change, and 6,180 hours since overhaul.
• In 2007, the ATSB investigated an uncontained air turbine starter occurrence (AO-2007-052), featuring a 3505468-4 starter. In that occurrence, the turbine bearings failed, allowing the turbine disk to move axially inside the starter. The starter was fitted with cutter pins to remove the turbine blades in such an event, to prevent the starter going into a free-run condition. The pins partially separated the blades, but the starter did not contain the blades as designed, resulting in secondary damage to the engine. As a result of this occurrence, the manufacturer implemented corrective actions to prevent reoccurrence of this failure mechanism.

The starter manufacturer used the current failure data to perform a risk analysis of the hazard of a dual inflight shut down due to over running bearing failures. Three of the failures above were used to calculate the risk to the fleet, the two in flight shut down events and the diversion. They identified that bearing failures could be attributed to three main scenarios: axial overload from the main engine, crash engagement or improper oil servicing. The manufacturer’s risk assessment concluded that the risk to the fleet from all failure scenarios was at an acceptable level.

__________

3. A crash engagement of the clutch can occur in situations where an engine re-start is attempted while the engine, and hence the starter output shaft, is still rotating above the pawl lift-off speed. Introduction of high pressure air to the un-loaded starter will cause the ratchet to accelerate to its free-running speed. As the engine continues to slow, the pawl springs will overcome the centrifugal force of the pawls, which will force the pawls to engage with the free-running ratchet, resulting in a crash engagement.

The most likely failure sequence of air turbine starter (part number 3505468-6, serial number GRTF6248) was a failure of the output shaft bearing, followed by the hub gear, pawls and ratchets and then finally failure of the housing. The starter manufacturer determined that the most probable cause was excessive loading, which could have been associated with a previous crash engagement or a transient load provided by the horizontal driveshaft. While direct evidence of a crash engagement was not detected on the previous 20 starts, the starter manufacturer indicated that it did not necessarily mean the output shaft had not been damaged prior to this time and that it may have taken operation over an extended period to manifest in a failure. The starter manufacturer demonstrated that the impact load and subsequent damage to the shaft was a function of velocity and acceleration at engagement and the backlash in the start system at the moment of engagement. The engine manufacturer also performed some analysis which showed that a high transient load applied to the bearing could lead to overrunning bearing failure.

The risk analysis conducted by the starter manufacturer, covering the period from January 2007 to August 2014, identified 13 bearing failures in the starter type. The overall risk to the fleet was determined to be at the acceptable level.

At the most recent oil change, the quantity of oil drained was just above that required for a replacement starter to be installed. While a lack of lubrication did not appear to be an issue in this case, the high loss of oil between maintenance leading up to the failure was potentially indicative of a leak. This allowed the oil level to get down to around the lower limit of 600 mL, where previously the oil had shown little loss between inspections. The engine manufacturer indicated that output shaft seal leaking was responsible for a high number of starter shop findings. The design of the output shaft seal assembly meant that it was installation-sensitive and steps have been taken by both the engine and starter manufacturers to clarify and provide additional information to operators and maintainers of the affected starters.

Furthermore, while the aircraft operator had been conducting maintenance on the starter in accordance with the CMM, the discrepancy between information in the CMM and on the air turbine starter data plate had the potential to affect future air turbine starter maintenance. At the time of writing, the starter manufacturer had initiated an engineering change to remove maintenance information from the data plate.

From the evidence available, the following findings are made with respect to the in-flight engine shutdown, involving an Airbus A330-302 aircraft, registered B-18358 that occurred 887 km ENE of Darwin, Northern Territory on 3 October 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The number one engine air turbine starter experienced an in-flight failure of the over-running output section as a result failure of the output shaft bearing.
• Debris originating from the starter failure was not contained by the starter casing and severed the number one engine B-sump oil scavenge pipe. (Safety issue)
• Complete loss of engine oil through the severed oil scavenge pipe resulted in a forced-shutdown of the number one engine.

Other factors that increase risk

• The starter was operated for a period of time with a marginal oil level which may have affected the longevity of the output shaft bearing.

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Uncontained failure of air turbine starter led to loss of engine oil

Safety issue number: AO-2013-172-SI-01

Safety issue description: Debris originating from the starter failure was not contained by the starter casing and severed the number one engine B-sump oil scavenge pipe.

Sources of information

The sources of information during the investigation included the:

• China Airlines
• Honeywell
• General Electric
• Airbus

References

Treager I E, 1996, Aircraft Gas Turbine Engine Technology, Third Edition, Glencoe/McGraw-Hill New York, p 381.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to China Airlines, Honeywell, General Electric, the Aviation Safety Council (ASC, Taiwan ROC), The National Transportation Safety Board (NTSB, USA), Airbus and the Bureau d’Enquêtes et d’Analyses (BEA, France).

Submissions were received from to China Airlines, Honeywell, General Electric, the Aviation Safety Council (ASC, Taiwan ROC), The National Transportation Safety Board (NTSB, USA), Airbus and the Bureau d’Enquêtes et d’Analyses (BEA, France). The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.