On November 13,2020, an Antonov 124 departed from Novosibirsk with destination Vienna, Austria loaded with auto parts.
Shortly after take off, the aircraft lost all radio communication and was observed circling the field for landing back at the same runway it departed from.
The aircraft overran the runway and part of its landing gear collapsed but the crew escaped unharmed, thankfully.
What was publicly recorded on the internet after the mishap pointed in a direction of probable cause and a cascade of events that led to the mishap. In historic perspective not all that uncommon...
In the pictures circulating on the internet, one can see the #2 engine forward section had separated from the remaining part of the engine and high energy debris penetrated the upper part of the fuselage and left hand wing root.
Being so close the the wing root, it is highly likely that the damaged area is dense with fuel lines, wiring, control cables ,etc. This may explain the loss of communication during the mishap flight.
The landing itself, reportedly, was conducted without control of; spoilers, thrust reversers and brakes and without electric power. This explains the unavoidable overrun under such circumstances.
The missing fan section and nose cowl of the engine and fuselage and wing damages, points to release of high energy debris from the fan possibly the fan rotor disk, followed by a subsequent damage cased by imbalance.
There can be many reasons for such a critical part to fail; damage, overload (overspeed), material flaws, material deterioration due to certain circumstances, certified life exceedence, to mention a few. Although the consequences of engine rotor busts are always potentially catastrophical, they are not all that uncommon.
The official investigation will probably shed light on what went wrong here. One can not tell unless a detailed metallurgical and records investigation has been conducted and only time will tell if the investigation is conducted properly.
Is this a unique case? Not entrirely. Let's look back in history..
Case #1 A380 30-Sep-2017, GP7000 Fan disk burst uncontained
The above picture is a similar case of fan disk failure and subsequent self destruction of the engine on the #4 engine on an Air France A 380 on 30-Sep-2017. The Engine Alliance GP7000 series engine is shown with the complete fan section, containment ring and inlet cowl missing during its flight diversion, post event.
It was found that the Titanium alloy fan disk fractured radially and the two fragments departed the engine upward and downward respectively. This direction of departure was random. Had they departed horizontally and laterally, the consequences could easily have been catastrophical as the fragments would have likely taken out engine #3 on the same wing and penetrated fuselage and wing spars.
The fan disk failed at 3000 cycles into its (at the time) 15000 cycle certified life. A subsurface crack in the fan disk initiated in one of the fan blade root dovetails and progressed to critical length undetected.
The ultimate root cause of the failure was determined to be a phenomenon called "cold dwell fatigue" to which Titanium alloys in particular are sensitive. This phenomenon was not well understood in the industry until recently.
The American DOT (department of transportation) sponsored a study into the phenomenon by the Johns Hopkins University. This paper is publicity available as DOT/FAA/TC-17/57 and was published February 2018. (so after this mishap). Downloadable below.
In short; up to recently, crack initiation, progression and residual strength calculations were based on cyclic loading (low cycle fatigue) and field data, rather than hold at max (stress)value (dwell) fatigue. Total fatigue life of engine rotors should take both low cycle fatigue and cold dwell fatigues into consideration. This insight may affect disk life calculations of multiple types of commercial turbofan engines. The study indicates that the effect of cold dwell fatigue is dependent on the metallurgic granular structure of the affected area's.
Potentially this novel insight may require to re-calculate and re-certify life limits of engine rotors.
Below the accident investigation report:
Below the study on the cold dwell fatigue phenomenon
Case #2 A380, 2010; RR Trent 900 IPT (Intermediate Pressure Turbine) Disk failure uncontained
The above pictures are from a Qantas A380 that suffered an uncontained engine failure that caused extensive secondary damage, resulting in many system failures, the crew had to contend with. The crew managed to get the aircraft back to departure airport Singapore.
After landing the aircraft safely, the system failures progressed to a point that all cockpit displays went blank and the crew were unable to shut down engine #1. This engine was shut down by spraying excessive amounts of foam into the engine, causing it to flame out.
The sequence of events appeared to beinitiated by a fatigue crack in an oil feed line to the Intermediate pressure and high pressure turbine bearing chamber. Due to the fatigue crack, under operating oil pressure, atomised oil spray caught fire and raised the temperature in the bearing compartment, progressively breaking down the sealing of the compartment, eventually allowing combustion gas into the bearing cavity which raised the temperature of the IPT disk which eventually disconnected from its shaft, driving the Intermediate compressor, and subsequently accelerated unrestrained beyond burst speed and caused the uncontained failure.
In other words; this uncontained rotor burst was caused by an external factor, unrelated to fatigue life of the part, but with potentially catastrophic results nonetheless.
Ful accident reports downloadable below.
Case #3; B767-300ER, CF6-80C2 series HPT (High Pressure Turbine) stage 2 disk burst uncontained
On 26-Oct-2016 a American Airlines Boeing 767 aborted its take off at V1 of approximately 134 knots. The right hand engine had failed uncontained and caused the crew to abort the take off.
The HPT stage 1 disk burst and the largest segment of the burst disk was found approximately 3000 feet (900 m) from the aircraft. The fragment entered the dry dry bay through the lower wing skin, ruptured fuel lines, severed wing rib #6, exited the wing structure through the upper wing skin and ended up 3000 feet from the aircraft.
Needless to say that a fire inferno resulted, but no casualties but one injury were reported. In flight, this failure would most certainly have been catastrophic.
The fractured disk (see picture above) which set off the sequence of events had 10984 cycles since new and the part number had a life limit of 15000 cycles.
Post incident metallurgic analysis of subject disk revealed that there were a number of low cycle fatigue cracks (one of which obviously reached critical length causing the disk to fail) that initiated from a subsurface material flaw that was undetectable with prescribed surface based NDT (Non Destructive Test) techniques but would have been detectable with Ultrasonic inspection techniques.
Build records of the failed disk were retrieved and traced back to the triple melt process records of the nickel alloy from which the disk was made.
As opposed to the above cases #1 and #2, this failure was due to a material flaw that occurred in production as was retroactively determined.
Below full NTSB report
Case #4; B767-241ER, CF6-80 series HPC (High Pressure Compressor) 2-9 spool rotor burst, uncontained
On 7-June-2000 a Varig B767-241ER aborted take off from Sao Paolo, Guarulhos at 60 knots due to a loud bang from Engine #2 and stopped on the runway. The copilot subsequently opened the sliding window to look outside and observed a fire around the landing gear. The crew attempted to taxi the aircraft off the runway but realised that it was the engine that was on fire. The crew blew both engine fire bottles but without extinguishing the fire and then ordered an evacuation.
Subsequent investigation revealed that the HPC spool disintegrated and failed uncontained, rupturing fuel lines.
Subsequent analysis revealed that the reason for the failure of the HPC spool was "Dwell time fatigue" (sound familiar?)
The accident investigation report by Brazilian investigators (CENIPA) is very brief and written in Portuguese only.
On 22-Sep-2000, a US Airways B767 was taken out by a maintenance crew for engine runs for the purpose of checking for an oil leak after a gearbox seal replacement (unrelated to the imminent failure).
During the run, several high power applications were made and during the last application, the engine # 1, HPT stage #1 disk failed and penetrated the fuel tank, subsequent to which a large fire ignited.
The maintenance crew blew both engine fire bottles without result and subsequently evacuated the aircraft safely. The aircraft burnt beyond repair and was written off.
Segments of the disintegrated and failed HPT rotor disk penetrated the fuel tank and also penetrated the fuselage, departed the other side of the fuselage, and lodged into the engine #2 case. Full NTSB report is no longer available on their website
On 8-December 2002, an Air New Zealand 767, climbing out of Brisbane for Auckand experienced a LH engine failure at FL 110 (approximately 11000 ft), indicated by a loud bang and a lurch of the aircraft to the left, after following all the checklist procedures, the crew declared an emergency and safely returned to Brisbane.
Subsequent investigation showed that a part of the first stage HPT blade disk had departed the aircraft, causing significant damage to the pylon and wing structure, as well as to the engine cowls. No injuries sustained.
The failed disk had accumulated less cycles than its certified life (12485 cycles with 15000 cycles certified part life). Interestingly, during the life of the failed disk, manufactured in 1984, the certified life of the part number has been incrementally increased from initially 6430 cycles to 15000 cycles.
During its life, the disk had been swapped five times to 4 different engines and was repaired twice and upgraded to a higher part number by the manufacturer.
Metallurgic inspection of the remaining part of the failed disk revealed that it had multiple cracks originating from the HPT blade attachment "fir trees". The accident investigation conducted by the ATSB (Australian Transport Safety Board) and the manufacturer of the failed disk was unable to determine a conclusive root cause for the failure but did determine that contributing factors were:
Damage to the rear end of the fir tree slots during manufacture
Handling damage
Damage sustained by abusive shot peening (possibly during repairs)
The FAA issued several AD (Airworthiness Directives) to mitigate the type of failures
Full accident report below
Final contemplations
The official investigation reports of the above accidents contain a series of safety recommendations to Aviation Authorities that had and most likely will have profound consequences to certification of commercial gas turbine engines and maintenance practices.
A few elements of engine certification standards pertaining to rotor bursts:
The commercial Engine Certification standards (CS-E) require manufacturers to conduct a safety analysis as described in CS-E 510, the text of which is shown below.
"CS-E 510 Safety Analysis (See AMC E 510)
(a) (1) An analysis of the Engine, including the control system, must be carried out in order to assess the likely consequence of all Failures that can reasonably be expected to occur. This analysis must take account of:
(i) Aircraft-level devices and procedures assumed to be associated with a typical installation. Such assumptions must be stated in the analysis.
(ii) Consequential secondary Failures and dormant Failures.
(iii) Multiple Failures referred to in CS-E510 (d) or that result in the Hazardous Engine Effects defined in CS-E 510 (g)(2).
(2) A summary must be made of those Failures that could result in Major Engine Effects or Hazardous Engine Effects as defined in CS-E 510 (g), together with an estimate of the probability of occurrence of those effects. Any Engine Critical Part must be clearly identified in this summary.
(3) It must be shown that Hazardous Engine Effects are predicted to occur at a rate not in excess of that defined as Extremely Remote (probability less than 10-7 per Engine flight hour). The estimated probability for individual Failures may be insufficiently precise to enable the total rate for Hazardous Engine Effects to be assessed. For Engine certification, it is acceptable to consider that the intent of this paragraph is achieved if the probability of a Hazardous Engine Effect arising from an individual Failure can be predicted to be not greater than 10-8 per Engine flight hour (see also CS-E 510 (c)).
(4) It must be shown that Major Engine Effects are predicted to occur at a rate not in excess of that defined as Remote (probability less than 10-5 per Engine flight hour).
(b) If significant doubt exists as to the effects of Failures and likely combination of Failures, any assumption may be required to be verified by test."
The above text indicates probabilities of events per FLIGHT HOURS. Not per flight cycles.
Given the fact that engines on a long range aircraft produce a factor 8 or higher more hours than flight cycles, makes that failures of the mentioned categories are met with more ease than short haul operating engines. This would allow failures to occur more frequently in terms of flights than on short haul engines. How safe this is perceived to be would be open to discussion I think.
Another interesting piece of text in the AMC (Acceptable Means of Compliance) of E510 is shown below:
"Improper maintenance on parts such as discs, hubs, and spacers has led to Failures resulting in Hazardous Engine Effects. Examples of this which have occurred in service are overlooking existing cracks or damage during inspection and Failure to apply or incorrect application of protective coatings (e.g. anti-gallant, anti-corrosive).
In showing compliance with CS-E 510 (e)(2), it is expected that, wherever specific Failure rates rely on special or unique maintenance checks for protective devices, those should be explicitly stated in the analysis."
The fact that critical engine rotor elements are not physically, and very limited visually accessible without disassembling the engine, this would limit inspectability of these parts on-wing. This is one of the reasons that rotor parts are on a life limit. Given the diversity of factors of uncontained failures with associated high safety risks, one could reconsider mitigation strategies.
Factors contributing in potentially catastrophic rotor bursts are:
Manufacturing material flaws undetected during producttion
Maintenance practices (as described in above AMC)
Flaws in the life limit analysis
Frequent handling (replacements, swaps) of critical engine rotor parts
External factors as described in the Qantas accident
To mitigate all of the above factors would require review of the AMC and published maintenance procedures
Feel free to leave comments!