In-flight engine shutdown involving Airbus A380, VH-OQG, near Los Angeles, United States, on 20 May 2017

What happened

On 20 May 2017, an Airbus A380-842 aircraft, registered VH-OQG, was operating Qantas flight QF 94, from Los Angeles International Airport (LAX), United States, to Melbourne, Victoria. The aircraft departed from runway 24 left (24L) at LAX at about 0542 coordinated universal time (UTC),^[1] at the maximum take-off weight of 569 tonnes.

The flight crew comprised the captain, the first officer and two second officers.

The aircraft was cleared by air traffic control (ATC) to climb to flight level (FL) 320.^[2] After reaching that level, the captain and a second officer (SO2) left the flight deck for the crew rest area. The first officer then took over as pilot flying (PF) and the other second officer (SO1) was pilot monitoring (PM).^[3]

About two hours after departing LAX, the flight crew requested and received ATC clearance to climb to FL 340. The flight crew commenced the climb and increased the thrust on all four engines to 93 per cent ‘N1’^[4].

As the aircraft passed FL 325, the crew on the flight deck heard a loud bang and felt a sudden and unusual vibration of the aircraft, which reduced significantly after about 2 seconds. The first officer noticed No. 4 engine’s N1 was much lower than the other three engines – at about 49 per cent (although the flight data showed about 71 per cent N1). The captain, who was in the crew rest area, heard the bang and felt the vibration so he returned to the flight deck.

Flight data showed that as the aircraft passed FL 325, the No. 4 engine intermediate pressure turbine experienced an overspeed and its N2 increased from 92 per cent to the redline limit of 98.5 per cent over the next 2 seconds. An electronic centralised aircraft monitoring (ECAM) ‘ENG 4 N2 OVER LIMIT’^[5] message and master warning appeared for 2 seconds.

The SO1 and first officer saw an ECAM message flash up but it disappeared before they could read it.

Shortly after, an advisory message (ADV) appeared on the engine warning display and 6 seconds later the message ‘ENG 4 NORM MODE FAULT’ appeared on the ECAM, along with the associated checklist, a single chime and illumination of the master caution. The ECAM message indicated that there was a problem with the full authority digital engine control (FADEC) of that engine. That fault was triggered by the automatic reversion of the FADEC of engine 4 to alternate mode, caused by the loss of air data or engine sensing parameters.

The flight crew actioned the ECAM first because it had a higher priority than the advisory message^[6].

There were only two items on the ECAM checklist. The first required the flight crew to select the switch to set the FADEC to alternate mode for all engines. The second item was to set the autothrust as required (the autothrust was already at an appropriate setting). After completing those two actions, the ECAM message cleared and there were no other ECAMs at that stage.

The first officer received an interphone call from a cabin crewmember in the forward main galley reporting a bang and feeling vibrations. He then received a second interphone call from the cabin crewmember in the main economy galley, reporting that a passenger had seen flames and sparks coming from the right outboard engine.

As the flight crew finished actioning the engine 4 normal mode fault ECAM checklist, the captain arrived on the flight deck, about 60 to 90 seconds after he had heard the bang. The SO1 made the required callout to the first officer when the aircraft was 1,000 ft below FL 340, then swapped out of the captain’s seat. The first officer briefed the captain on the events, and the captain resumed the PF role from the left seat and the first officer became the PM.

The SO1 received multiple calls from cabin crewmembers advising that the aircraft was vibrating in an unusual way, and some had seen sparks and flames. The flight crew found this information very useful because at that stage they had no indication on the flight deck of engine fire.

The flight crew investigated the cause of the ADV message and found that the N1 vibration signal for engine No. 4 indicated 10 units, which was the maximum value.

At about 0724, the aircraft levelled off at FL 340 and the flight crew commenced the abnormal checklist for high engine vibration. According to the flight data, at 0726:17, the flight crew reduced the thrust on engine No. 4 to idle (then generating around 24 per cent N1).

At 0726:44, the engine fire warning ‘ENG 4 FIRE’ ECAM message displayed. The flight crew did not finish the high vibration checklist because the engine fire warning had the highest priority and the flight crew actioned the associated checklist. At 0727:02, the flight crew selected the No. 4 engine master switch off, then pushed the engine No. 4 fire button and discharged one fire retardant agent. The engine fire ECAM cleared.

With the No. 4 engine shut down, the flight crew discussed their options. The aircraft was short of the equal time point between Los Angeles and Honolulu and the weather at both airports was suitable for a diversion, so the crew decided to return to Los Angeles.

The SO1 spoke to the company (Qantas) maintenance watch about the aircraft’s status and to the integrated operations centre about the return to Los Angeles. He also sent a message via the aircraft communications addressing and reporting system (ACARS) advising the company of the engine fire and that they were returning to LAX. The first officer declared a PAN^[7] and requested ATC clearance to descend initially to FL 300 and later to FL 290, advising they had shut down an engine and required a diversion to LAX. Air traffic control cleared the aircraft to return to LAX, which was about 2 hours away.

The captain made a public address to the cabin crew and passengers stating that they had an engine issue and had shut down one engine, and were returning to Los Angeles.

There was a light easterly wind at LAX, which would mean a tailwind on runway 25L of about 3 kt. Despite this, the flight crew assessed that it was preferable to land on runway 25L than runway 07 right (07R). This was because of sand dunes and a relatively dark area on the approach to 07R and, more significantly, because autoland^[8] is not permitted on runway 07R. They therefore planned for an autoland on runway 25L at a landing weight of about 500 tonnes, and this was programmed into the flight management system. The FO and captain discussed the autobrake setting and elected to set autobrake 2.

When the flight crew received the next weather update, there was an indication of a 5 to 6 kt tailwind on runway 25L. They reworked the landing calculations and found that there was still sufficient margin available on runway 25L as their preferred runway for autoland. They decided, however, to jettison fuel down to a landing weight of 461 tonnes, which gave them a safety margin of 860 m runway length.

At 0944, the fuel jettison was completed over water prior to crossing the coast, about 140 NM from LAX.

The flight crew conducted a normal approach and autoland landing onto runway 25L at about 0956.

During the landing roll, as the aircraft decelerated to 80 kt, the captain deselected autobrake and used the full length of the runway to gradually stop the aircraft. After receiving ATC clearance, the captain taxied the aircraft to the parking bay escorted by airport firefighting services.

The maximum brake temperature recorded was 535 °C, within the normal range. As such, there was no requirement for an emergency disembarkation and the passengers and crew disembarked at the gate.

Communication between cabin crew and flight crew

If the cabin crew have concerns about something that potentially affects the safety of the flight, they should immediately contact the flight deck. According to the flight crew, the cabin crew had provided timely and vitally important information to them, particularly regarding flames and sparks that the flight crew had not known about.

However, due to the number of cabin crewmembers located in different places on the aircraft, several calls were made to the flight deck. The flight crew’s priority at the time was to respond to the fire warning, so they were unable to respond to all of the calls immediately. When the captain tried to contact the flight deck on the interphone after hearing the bang, it was engaged due to the cabin-flight deck communications.

Engine vibrations

The first officer indicated that unlike his experience of Boeing aircraft, where there was a hard limit for engine vibration, they did not get an ECAM generated for the high vibration. According to the captain, flight crew are trained to strictly adhere to ECAM protocols. The high engine vibration procedure was part of the abnormal procedures menu and not presented as an ECAM. Therefore, the FADEC ECAM had higher priority than the high vibration advisory, and the crew did not shut down the engine until the engine fire warning ECAM required this action.

The flight crew operating manual (FCOM) stated that the ECAM vibration advisory is mainly a guideline to monitor the engine parameters and does not call for an immediate engine shutdown. The FCOM also states that high N2 vibrations can occur with or without airframe vibrations and that flight crew should cross-reference other engine parameters in order to determine the required course of action.

Airbus provided the following rationale for the procedure to be followed by flight crew for engine vibrations:

• The advisory message blinks when there is an abnormal vibration, that is, when N1 or N2 exceed 5 units.
• When the advisory illuminates, flight crew can check the associated ECAM Not Sensed procedure ENG HI VIBRATIONS, which recommends monitoring engine parameters and reducing thrust if possible to maintain vibration level below the advisory threshold.
• If vibration is still above the advisory threshold, the decision to shut down the engine is left to the crew – the checklist item states ‘ENG (AFFECTD) MASTER OFF…CONSIDER.’

Autoland and fuel jettison

The A380 is designed so that it can return immediately to the runway from where it departed, and the runway distance will be sufficient to land. The aircraft was certified to autoland at maximum take-off weight. It had taken off from LAX at the maximum take-off weight of 569 tonnes.

Jettisoning fuel enables the flight crew to reduce the aircraft weight to about 440 tonnes. The flight crew elected to jettison fuel to increase the safety margin with the tailwind on the preferred runway.

A prime consideration for an overweight landing is minimisation of the rate of descent on touchdown, where possible to less than 300 ft per minute. Autoland is recommended to reduce the rate of descent on touchdown, and it allows a more consistent approach profile. With one engine shut down, the attitudes, speeds and thrust settings differ from the normal landing phase. The autoland manages those settings and allows the flight crew to monitor the aircraft more effectively.

The overweight landing auto-generates a report that includes touchdown weight and descent rate. After landing in LAX, engineers performed the diagnostic checks and found the touchdown rate of descent was within the limits and the aircraft was wings level at touchdown.

The reduced weight also lessened the risk of hot brakes and wheel fires, and would improve performance in case a go-around was required.

Engineering inspection

Initial engineering inspection of the No. 4 engine following the incident found damage to the low‑pressure turbine blades. There was no visible indication of fire and the event was contained, such that there was no breach of the engine casing. There was minor damage to the right flap and flap fairing from debris exiting the rear of the engine.

Safety analysis

Engine manufacturer investigation

Rolls-Royce, the manufacturer of the aircraft’s Trent 900 engine, conducted an investigation into the engine failure that caused the shutdown.

A teardown of the engine found internally-corroded low-pressure turbine stage 2 (LPT2) blades. The corrosion led to fatigue cracking and subsequent release of blade shroud debris, resulting in significant downstream engine damage.

The corrosion resulted from chemical residue in the hollow blades from cleaning operations at the last service (July 2015). Consequently, Rolls-Royce conducted a thorough audit of cleaning operations and took additional safety action (see Safety action section).

Fire

The fire and overheat detection system was assessed in an attempt to determine the cause of the fire warning. No issues were identified and the fire/overheat detector assemblies were removed and returned to the vendor for further assessment.

The detector manufacturer identified wear in the unit that would have made it more sensitive to vibration and increase the chance of spurious warnings. Rolls-Royce assessed that it was very likely that the wear, coupled with the vibrations associated with this event, contributed to the spurious fire warning.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Internal corrosion of low-pressure turbine stage 2 blades resulted in fatigue failure and separation of blade debris and downstream damage through the engine.
• The blade corrosion resulted from chemical residue associated with the cleaning procedure used during the last engine service.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Rolls-Royce

Rolls-Royce, the engine manufacturer has advised the ATSB that it has taken the following safety actions as a result of this occurrence:

• Twelve other engines with blades potentially affected by the cleaning process were identified for removal from service under Rolls-Royce Alert non-modification service bulletin (NMSB) RB.211-72-AJ933. At least five engines had been removed at the time of publication of this report.
• Stage 5 low pressure turbine blades that had been exposed to the same processing corrosion issue were also identified. As a result, Rolls Royce drafted an additional, recommended NMSB to address engines with exposed Stage 5 blades installed.
• Blade overhaul cleaning operation instructions were revised, with additional detail to incorporate best practice with respect to removal of process solutions and chemical residues. This included modifying the orientation and support of the blades during the cleaning process and pressurised water flushing of aerofoil cavities after cleaning to ensure removal of residual cleaning compounds. The rationalised best practice has been applied at all facilities that conduct cleaning of Trent 900 Stage 2 low pressure turbine blades.
• Blade serial numbers are to be marked at the root so they are easily identified in future instead of at the tip where shroud losses more commonly occur.
• The engine manufacturer distributed an internal safety alert report to highlight the potential issue that could affect other Rolls-Royce engine types.

European Aviation Safety Agency

The European Aviation Safety Agency released Airworthiness Directive (AD) 2018-0121, effective June 2018, relating to the potential for blade corrosion due to residual cleaning contaminants. The AD mandated replacement of the affected blades in accordance with the Rolls-Royce NMSB RB.211-72-AJ933.

Safety message

This incident highlights the importance of reviewing maintenance processes to ensure best practice is followed.

The incident is also an example of effective crew resource management techniques. The flight crew reported that their actions and response, from the initial engine issue when only two members of the flight crew were in the cockpit to the approach and landing with all four crewmembers on the flight deck, flowed very smoothly. They also felt that their collaborative decision-making was excellent and that the highly experienced second officers provided valuable support to the flying pilots.

__________

1. Coordinated Universal Time (UTC): the time zone used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 320 equates to 32,000 ft.
3. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
4. In a 3-spool turbine engine, N1 refers to the low-pressure (LP) shaft speed, expressed as a percentage of a nominal datum speed. N2 refers to the intermediate pressure (IP) shaft speed.
5. The triggering condition was the automatic reversion of the FADEC of engine 4 to alternate mode caused by the loss of either air data or engine sensing parameters.
6. An advisory message means that an instrument is showing an indication outside the normal range.
7. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
8. A fully automated landing procedure.