Engine failure involving Airbus A330, 9M-XXE, near Carnarvon, Western Australia, on 25 June 2017

At 0710 Western Standard Time (WST)^[1] on 25 June 2017, an AirAsia X Airbus A330-343X, registered 9M-XXE, departed Perth, Western Australia, on the scheduled passenger service XAX237 to Kuala Lumpur, Malaysia. The flight crew consisted of the captain, as the pilot flying (PF),^[2] and the first officer, as the pilot monitoring (PM).

The flight was planned as an extended diversion time operation (EDTO)^[3] with a maximum diversion time of 120 minutes. The first EDTO segment commenced about 1 hour into the flight, and 8 NM before the NONOG waypoint.^[4] The flight crew reported that they carried out an EDTO brief before entering the EDTO segment. The EDTO briefing included that, in the event of an engine failure, Perth Airport was the nearest suitable alternate.

The flight had been progressing normally with the autopilot and autothrust systems engaged, when at 0814, about 1 hour and 4 minutes into the flight, the flight crew initiated a planned climb from the initial cruising altitude of flight level (FL) 380^[5] to climb to FL 400. Shortly after (and after passing NONOG), the flight crew reported hearing a ‘metallic’ bang. At about the same time, the electronic centralised aircraft monitor (ECAM) presented a number of alerts, including engine 1^[6] control system fault (ENG 1 CTL SYS FAULT) and engine 1 stall^[7] (ENG 1 STALL). The crew also reported that vibrations through the airframe commenced just after the ENG 1 STALL alert.

The flight crew immediately commenced the required procedures presented on the ECAM (referred to as the ‘ECAM actions’) associated with the ENG 1 STALL alert, including shutting the left engine down. The ECAM then displayed an amber ‘LAND ASAP’ alert.

About the same time as the left engine malfunctioned, air traffic control (ATC) requested the flight crew call on a new frequency. The flight crew did not respond. At 0816 the flight crew declared a MAYDAY to ATC, stating that they had an engine issue and could not maintain level.^[8] ATC acknowledged the MAYDAY and cleared the aircraft to return to Perth, and operate in the block altitude^[9] of FL 290 to 400.

At the same time that the crew commenced the descent, they also made a turn to the right. The crew discussed their options for a diversion. They reported that given the LAND ASAP was amber, not red, they would divert (return) to Perth, as they had briefed for shortly before entering the EDTO region. Regarding other diversion options, the flight crew reported that Learmonth Airport was not considered as it was not an EDTO suitable airport and it did not have any rescue and firefighting services.

At 0835, ATC advised the flight crew that Geraldton Airport was 172 NM south-east of their position and provided the current weather conditions and runway length. The flight crew discussed the option. There was no information on Geraldton in the aircraft database and they determined that the runway at Geraldton was too short for their current weight, so decided that they would continue to Perth (Figure 1).

Figure 1: Image of the western side of Australia, showing the flight track for XAX237 highlighting the location of engine failure and nearby airports

Source: Google earth, modified by ATSB.

The flight crew described the vibrations as initially being severe, but they lessened after the engine was shut down. As the aircraft descended, however, the flight crew noted that the vibrations increased. In an attempt to reduce the vibration, the flight crew varied the aircraft’s speed and altitude. The vibrations, however, remained, and with about the same intensity. The flight crew reported that, while the instruments were shaking as a result of the vibration, the flight instruments and the ECAM could still be read.

About 30 minutes after the left engine malfunctioned, a cabin crew member informed the flight crew that there was black smoke coming from that engine. In response to that observation, at 0843 the flight crew discharged one of the left engine’s two fire extinguisher bottles. There were no further reports of smoke from that engine.

The aircraft landed at Perth at 0957. A post-flight inspection revealed that approximately three quarters of one fan blade (serial number RGF35538) aerofoil was missing on the left engine (Figure 2). No damage to the airframe was identified.

Figure 2: Left engine failed fan blade, with adjacent damaged blades

Image source: Rolls-Royce plc

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. An EDTO is any flight by a turbine-engine aeroplane where the flight time from a point on the route to an adequate aerodrome, at the one engine inoperative speed cruise speed for aeroplanes with two engines, or at the all engine operating speed for aeroplanes with more than two engines, is greater than the threshold time established by the state of the operator.
4. The NONOG waypoint, located at S 25 17 27.91 E 112 27 38.37, was about 430 NM (800 km) north north-west of Perth.
5. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 380 equates to 38,000 ft.
6. The engines on the A330 are numbered from left to right looking forward. Engine 1 is the left engine.
7. A stall in a gas turbine engine is when the normal flow of air through the engine is disrupted. This can result in an engine surge, where the flow through the engine completely breaks down and is reversed.
8. The procedure following an engine out is to cruise descend to the altitude at which the minimum drag speed can be sustained with the remaining engine selected to produce max continuous thrust (MCT).
9. A block of altitudes assigned by ATC to allow altitude deviations without requiring further clearance.

Operator

AirAsia X is based in Kuala Lumpur, Malaysia, operating under an Air Operator’s certificate issued by the Department of Civil Aviation Malaysia. AirAsia X operates long haul air transportation services throughout the Asia-Pacific region and the Middle East.

Aerodrome information

Perth

The operator designated Perth as a destination aerodrome and included it within the list of company preferred alternates. The NOTAMs identified that the aerodrome’s rescue and firefighting services (RFFS) category^[10] varied between CAT 9 and 10 on the day of the occurrence.

Port Hedland

Port Hedland was identified by the operator as a preferred alternate aerodrome.

Learmonth

Learmonth was identified by the operator as an emergency alternate. While it met the required runway criteria, it did not have any RFFS capability.

Geraldton

Geraldton was not listed as a preferred or an emergency alternate aerodrome by the operator. The runway’s available landing distance was 1,981 m. The aerodrome did not have any RFFS capability.

Operator procedures relevant to the diversion

The below provides a summary of the operator’s procedures relevant for the diversion decision made by the crew. For full background information on the aircraft systems that and procedures available to the crew for diverting during extended diversion time operations (EDTO), refer to Appendix A – Additional Operational information.

The engine shutdown resulted in an amber ‘land as soon as possible’ electronic centralised aircraft monitor (ECAM) message. The amber message required a less urgent response than a red message, and the Flight Crew Operation Manual defined the appropriate actions as:

If amber LAND ASAP is part of the procedure, consider landing at the nearest suitable airport.

Note: The suitability criteria should be defined in accordance with the Operator's policy.

The engine malfunction occurred shortly after the aircraft entered an EDTO segment of the flight. The operator’s EDTO procedures included a number of matters relevant to the flight crew’s diversion decision:

• Specific aerodromes were nominated by the operator as preferred (suitable) alternates for use by flight crew should they determine that circumstances, such as an engine failure, required the flight to be diverted to an alternate aerodrome. Those aerodromes were designed to meet specific operational requirements for the A330 type aircraft. Perth and Port Hedland were the closest suitable alternates at the time of the engine failure.
• As the north-western part of Australia had sparse coverage of available alternate aerodromes, the operator had included Learmonth in the list of nominated aerodromes, but specifically as an emergency alternate. While Learmonth was significantly closer at the time of the engine failure, an emergency alternate aerodrome was only to be used in the case of a dire emergency.
• The flight crew had just completed a briefing that included the nomination of alternate aerodromes to be used if required during the EDTO segment. The initial intended diversion destination was Perth.
• Following the engine malfunction, the flight crew determined that a dire emergency did not exist, and therefore Learmonth was not required as a diversion aerodrome.

As a result of the above factors, the flight crew decided to divert to Perth. While Geraldton was offered by air traffic control as an immediate diversion option early in the diversion, the flight crew stated that the absence of data available for that aerodrome and the short landing distance available, eliminated Geraldton as a diversion option.

The ATSB considered the decision by the crew to divert Perth was in line with the operator’s procedures. As a result, the remainder of the report will focus on the engine fan blade failure.

Engine information

The aircraft was powered by two Rolls-Royce Trent 772B-60 (Trent 700) engines. Each engine is a three-spool, high bypass turbofan with three compressor/turbine assemblies, identified as the low-pressure, intermediate-pressure and high-pressure assemblies (Figure 3). The low-pressure compressor is also referred to as the fan.

Figure 3: Trent 700 cutaway diagram

The cutaway identifies the Trent 700’s low pressure assembly (blue), the intermediate pressure assembly (yellow), the high-pressure assembly (orange) and the combustion chamber (red).

Source: Rolls-Royce, modified by ATSB

Left engine damage examination

The left engine, serial number 41778, was removed from the aircraft and sent to Hong Kong Aero Engine Services (HAESL), a joint owned Rolls-Royce maintenance and repair facility. The remaining section of released fan blade was sent to the United Kingdom for laboratory inspection by Rolls-Royce.

The engine strip inspection identified that the blade failure was contained within the engine. There was no evidence of internal or external fire, nor of pre-existing foreign object damage. Secondary damage was observed on the remaining fan blades as a result of impact damage and heavy tip rub. The engine inlet cowling suffered damage due to secondary debris impacting the inner barrel. The low pressure (LP) compressor (fan) shaft was bent by about 0.5 inches (13 mm) along its length and exhibited frictional heating damage between the shaft and the intermediate pressure (IP) front stub shaft. The IP compressor module front bearing house assembly was distorted and damaged by the contact of the LP compressor shaft/bearing housing assembly on to the front face.

Inspection of the mount system did not show any signs of distortion, however due to the magnitude of the loads transmitted through the mounts from vibrations, the hardware was deemed unserviceable.

Maintenance history of the failed blade

The failed fan blade, serial number RGF35538, was manufactured between December 2009 and February 2010. There was no record of the blade requiring rework during manufacture. It was installed new on engine serial number 41778, where it remained until failure.

The fan blade underwent a phased array inspection in accordance with NMSB 72‑AH465 (see Previous Trent 700 fan blade failures service management) on 11 September 2014 at 3,602 cycles since new. The blade accumulated a further 1,099 cycles between that inspection and the failure.

Trent 700 fan blade information

Wide-chord hollow-core fan blade description

The efficiency and cost of modern turbine engines has improved over the years through the use of high bypass ratios and fewer fan blades with a wider chord.^[11] This has led to longer and wider fan blades with complex aerodynamic designs. These large fan blades must be of low weight, to enable the engine to withstand large out-of-balance forces should a fan blade fail, as well as ensuring that a blade failure is contained within the engine. The blades must also have sufficient strength to withstand high aerodynamic loads, low-cycle^[12] and high-cycle^[13] fatigue loads and foreign object damage.

One method of achieving this combination of strength and low weight was through the use of wide-chord hollow‑core titanium blades with an internal support structure. This was the method used in the Trent 700 fan blades which used a corrugation style internal support structure (Figure 4).

Manufacturing process

The manufacturing process for the Trent 700 fan blade used three sheets of a titanium alloy to form the outer panels of the blade and the inner support structure. Diffusion bonding^[14] was used to join the panels, while the super-plasticity^[15] of the titanium alloy enabled the forming an internal support structure and shaping of the blade. The manufacturing process involved diffusion bonding three titanium alloy sheets together at high temperatures. The aerofoil shape was then formed through inflating the cavity of the diffusion bonded construction at elevated temperature between contoured metal dies using an inert gas.

Product assurance standards for the blades were determined through various non‑destructive inspection techniques. These inspection techniques included ultrasonic and radiographic assessment of the diffusion bonds and structures formed during the superplastic forming. They also enabled determination of various internal structural dimensions.

Rolls-Royce investigation

Examination of failed fan blade RGF35538

Ultraviolet light assessment of the failed fan blade did not identify any evidence of major organic contamination, indicating that there had not been any recent bird‑strikes. A 3D scan and x-ray imaging of the retained section of blade did not show any unusual deviations or features consistent with impact damage.

Optical and electron microscope inspection identified a region of fatigue cracking on the inner surface of the convex panel of the fan blade, about mid-chord from the blade leading edge. The fatigue appeared to have initiated on the inner surface of the panel at the acute corner of a membrane-to-panel bond (Figure 4).

Figure 4: Overview of fracture surface showing the initiation point of the fatigue crack on the inner surface of the convex panel

Photograph of the remaining section of the failed blade identifies the initiation point of the stress crack that led to the blade failure.

Source: Rolls-Royce and ATSB.

Initial crack propagation was in a chordwise direction,^[16] before propagating towards the outer aerofoil surface (Figure 5). The remaining fracture surface was comparatively duller and angled; consistent with a ductile overstress failure.

Figure 5: Magnified view of the fracture near the initiation point showing propagation of the fatigue crack from the inner surface of the convex panel

The blue cross indicates the crack initiation point, the red region is the initial chordwise propagation area, and the yellow arrows show the general propagation directions.

Source: Rolls-Royce.

A microstructural examination of the aerofoil did not reveal any anomalies that could be attributed to the initiation of the fatigue crack. It did, however, find that there were macrozones^[17] in the material consistent with the manufacture of the panel by a rolling process. It appeared that the fatigue crack had propagated in a chordwise direction through one of these macrozones along the inner surface of the convex panel. This resulted in the elongated (20:1) crack shape shown in red in Figure 5. Trials undertaken by the manufacturer indicated that, had a crack of this size been present when the previous phased array inspection was undertaken it would have been detected. It was therefore concluded that it was most probable that the crack was smaller and below the rejection criteria in place at that time. It is considered likely that the crack was able to propagate more quickly due to the presence of the macrozone.

Previous fan blade failures

Rolls-Royce advised the ATSB of seven Trent 700 fan blades failure events prior to the failure of this fan blade, the first in August 2006. There was also another failure that occurred about eight months after this failure in February 2018. Rolls-Royce conducted an investigation on all nine of these failures.

The first six of the blade failure events were attributed to manufacturing issues. Most of these related to the use of an incorrect gas, or air ingress into the blade cavity, during the super plastic forming processes that resulted in changes in the properties of the internal layers of blade material. These changes made them more susceptible to premature failure. No such manufacturing issues had been identified with the subsequent fan blade failures.

The Rolls-Royce investigation found that the three most recent blade failures (including this one) were attributed to a fatigue crack that originated in an acute corner that is formed between the internal membrane and the convex panel (the ‘membrane-to-panel acute corner’).

Stress analysis

Effect of manufacturing geometry variations

Rolls-Royce reviewed the electronic manufacturing data for all Trent 700 fan blades produced since 2003. This data included measurements from post-manufacture inspection. The data enabled computer-based modelling of the location and magnitude of peak stress^[18] for each manufactured blade in service. An analysis of that modelling determined that variation in the manufacture of the fan blades, although well within design tolerance, resulted in some variation to the peak stress location and magnitude. . The modelling showed that panel thickness distribution (between the root and tip of the blade) could influence the magnitude of the stress of individual blades at the peak stress location, and showed that two of the three most recent event blades were in the top three per cent of stress levels. Detailed modelling of manufactured blades had showed the stress could vary by plus or minus six per cent through manufacturing tolerance. The failed blade from this occurrence was estimated to have had a peak stress of 104% of nominal.

While the stress analysis provided some indication of a causal factor, Rolls-Royce advised that the increased stress was determined not to increase the localised stress enough to be the only contributor to the fatigue crack.

The acute corner radius

During the detailed laboratory examination of the failed blade geometry, and in comparison, with other high life blade geometries, it was identified that there was some variation in the radius formed in the acute corner where the internal membrane joins with the convex panel (Figure 5). Rolls‑Royce modelled the effects of the exact geometry of the failed blade, to examine the effect of this corner radius. The analysis found that the specific geometry of the failed blade resulted in a very localised stress concentration in the acute corner that had not been identified in the original stress modelling during design. The analysis found that the localised stress concentration effect had increased the stress by almost 170 per cent.

A similar analysis of the other two failed fan blades found that the stress levels within the acute corner were sensitive to the acute corner radius. Of the geometries examined, the stress increased up to 140 per cent in stress concentration. The acute corner radius was not measured during manufacture as it is located inside the blade and cannot by inspected by normal manufacturing inspection techniques. As such, Rolls-Royce were unaware of the variation in the size of the radii, and therefore did not know what effect this stress concentrating feature may have on the in-service fleet.

Trent 700 fan blade design

As part of the investigation, Rolls-Royce also reviewed the blade design, as while all Trent engine fan blades have the same wide chord, hollow-core construction, it was only the Trent 700 blades experiencing issues with aerofoil fatigue cracking. Rolls-Royce considered the differences between blades for each of the engine variants; finding that the panel stresses of Trent 700 blades were relatively high in comparison to other blades in the family. However, the stress levels in the panel were not high enough to be the only contributor to the failure. It was therefore considered that the high stress levels in the panel, in combination with the stress concentrating effects of the small acute corner radii, had sufficiently elevated the localised stresses to initiate cracks at the radius location – ultimately leading to blade failure.

Previous Trent 700 fan blade failures service management

The inspection requirements for the Trent 700 fan blade have progressively changed as a result of partial blade release events and have included a combination of changes to the inspection intervals and inspection method. Appendix B – History of Trent 700 fan blade failures and in-service management, with a detailed time sequence for the Trent 700 fan blade events, the identified cause, and subsequent changes in the maintenance inspection regimes. Below is a summary of that information.

In addition to the previously instructed in-service maintenance for the fan blade, on 15 July 2013, as a result of the first seven blade failures, Roll-Royce released non‑modification service bulletin (NMSB) RB.211-72-AH465. The NMSB stated that the reason for issue was:

Following in-service LP Compressor (LPC) blade release events it is recommended that an in-service inspection (ultrasonic) is undertaken to mitigate against release events. The ultrasonic inspection is capable of detecting sub-surface anomalies in the LP compressor blade aerofoil. This inspection is available for Trent 700 LP compressor blades at shop visit but the intervals between shop visits are too large to only use shop visit opportunities therefore on-going in-service repeat inspections are required.

The NMSB provided two ultrasonic inspection techniques for the fan blades:

• C-scan – an automated technique used in overhaul facilities with the blades removed from the aircraft.
• Phased array – a manual technique that could be used on-wing.

The threshold of the initial inspection was listed as 3,600 cycles since new, and the inspection was to be repeated every 2,400 cycles since the last inspection.

At the time of the blade failure in this occurrence, there were three revisions to the NMSB. The changes are presented in Table 1.

Table 1: NMSB RB.211-72-AH465 revisions

During a review of previous inspection results for the February 2018 event, Rolls‑Royce identified the presence of a low-level indication^[19] that was below the threshold limit. As part of the investigations into the three most recent failure events, Rolls-Royce then also reviewed all available fan blade C-scan inspection results to identify other blades that may have had low-level indications at a similar location.

This review identified 24 possible affected blades, and Rolls-Royce released NMSB RB211-72-K096 on 9 August 2018, which instructed the removal and re-inspection of those blades. Where indications were identified, it was recommended that the affected blades undergo a phased array ultrasonic inspection, before being returned to an overhaul shop for a repeat C-scan inspection to determine if the previous indication had changed. Re-inspection of the blades removed from service found one blade where no crack indication was identified (suggesting the original indication was spurious), while the indication on the remainder were confirmed by repeat C-scan inspection. Three of these had increased in size and were subject to detailed laboratory examination. This work provided further evidence to support the Rolls-Royce analysis that it was not solely panel stress leading to cracking, but that other features such as the size of the acute corner radius, influenced the stress concentrations and the propensity of an individual blade to crack.

__________

10. An aerodrome’s required RFFS is based on a number of criteria, including the overall length and the fuselage width of the aircraft that predominantly use the aerodrome, and a threshold value in the number of movements of the highest category of aircraft. The various levels of RFFS category (CAT) establish a requirement for, among other things, the types and number of rescue and firefighting equipment required to be available at that aerodrome.
11. The chord is the distance between the leading and trailing edge of an aerofoil, measured parallel to the normal airflow over that aerofoil.
12. Loads occur once per engine start-stop cycle.
13. Multiple loading cycles during each engine cycle from air intake disturbances.
14. A solid-state welding technique used in metalworking, capable of joining similar and dissimilar metals. It operates on the principle of solid-state diffusion, wherein the atoms of two solid, metallic surfaces intersperse themselves over time.
15. Property of flowing like hot glass at elevated temperatures under modest applied pressures with no tendency to necking or fracture.
16. From the leading to the trailing edge of the fan blade.
17. A macrozone is a region within a titanium alloy’s microstructure where one of the phases is aligned in a certain direction.
18. The peak stress is the maximum modelled stress that the blade will be expected to experience in service.
19. An indication is the response or evidence from a non-destructive examination that may require further analysis to determine its relevance.

While enroute from Perth, Western Australia, to Kuala Lumpur, Malaysia, a low-pressure compressor (fan) blade from the left engine of an AirAsia X A330, registration 9M-XXE, failed. The blade failure in turn disrupted the operation of that engine. The flight crew completed the ENG 1 STALL procedure, shutting the engine down, and then initiated a diversion (in this case return) to Perth. The diversion to Perth was appropriate considering the operator’s procedures, their location and the status of other aerodromes in the area. As a result, this analysis will only examine the reasons behind the engine fan blade failure.

The failed fan blade

The fan blade failed at 4,701 cycles when a fatigue crack, which had initiated at an internal membrane-to-panel acute corner, grew to a size where the remaining strength in the blade could not sustain operational loads. The engine manufacturer, Rolls-Royce, carried out significant analysis to determine why this, and other Trent 700 blades had failed prematurely.

Detailed examinations did not identify any manufacturing defects or operational damage that would explain why fatigue cracking initiated in the blade. Nor did they identify any operational conditions that may have contributed to the failure.

Structural analysis of normal variations in blade geometry (within manufacturing tolerances) found that the stresses in the convex panel of the blade was about four per cent higher than the initially modelled blade stress. This placed the stress values in the top three per cent of the blade population produced since 2003; however, the level of stress was not sufficient, in itself, to account for the initiation of the fatigue crack.

Further analysis found that the radius in the internal membrane-to-panel acute corner produced a stress concentration, and that, in combination with the increased general stress state, could explain why a fatigue crack initiated at that location.

The crack shape (aspect ratio) was also examined to determine the effect that it had on growth rate. The early stages of the crack growth were predominantly along the internal surface of the panel, initially growing along the chord of the panel, before penetrating into its thickness. It was identified that this growth was characteristic of growth through a macrozone in the material texture. When assessing the effect of this initial crack propagation on the expected life of a fan blade, Rolls-Royce found that the elongated crack shape resulting from growth along a macrozone could, based on typical material properties, reduce the propagation life of the blade by up to 30%.

Rolls-Royce identified that the complex manufacturing processes used in the production of Trent 700 fan blades can result in a variation in the membrane-to-panel geometry; in particular the acute corner radius. Thus, there was potentially a population of Trent 700 fan blades with acute corner radii that made them susceptible to early onset fatigue cracking. The acute corner radius was an artefact of the super plastic forming process and could not be measured using normal production techniques, so Rolls-Royce was not able to identify the size of this population. As such, susceptible blades across the fleet were not able to be identified from the manufacturing records and individually managed.

At the time that the blade failed, there was an existing inspection regime to check for cracking in the fan blades of Trent 700 engines. That inspection had been completed for the failed blade 1,099 cycles prior to the in-service failure, at which time the blade was considered acceptable and returned to service.

The next inspection for the blade was not due for another 1,301 cycles. As such, the existing inspection interval was too great to capture the initiation and growth of the crack that developed in this blade due to the specific crack shape. Thus, the 2,400-cycle inspection interval that was in force at the time of this blade release event may have resulted in an in-service population of fan blades, with similar high stresses and small membrane-to-panel acute corner radii, at risk of premature in-flight failure.

From the evidence available, the following findings are made with respect to the 25 July 2017 in-flight engine failure on AirAsia X Airbus A330 registered 9M-XXE, and its subsequent diversion/return to Perth, Western Australia.

Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• A fan blade in the left engine failed due to fatigue cracking, which had initiated at the corner of a membrane to panel bond, leading to the engine failure, shutdown and diversion.
• The Trent 700 blade manufacturing process produced a variation in internal membrane-to-panel acute corner geometry that, in combination with the inherent high level of blade panel stress, could lead to increased localised stresses in those corner areas and the initiation and propagation of fatigue cracking. [Safety issue]
• The scheduled inspections recommended by Rolls-Royce to detect cracking in Trent 700 fan blades, were insufficient to detect early onset fatigue cracks in the membrane to panel bond before those cracks could progress to failure. [Safety issue]

Other findings

• Following a fan blade failure on the left engine, the flight crew returned to Perth as it was the nearest suitable aerodrome according to the operator’s procedures.

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Fatigue cracking of Trent 700 fan blades

Safety issue number: AO-2017-066-SI-01

Safety issue description: The Trent 700 blade manufacturing process produced a variation in internal membrane-to-panel acute corner geometry that, in combination with the inherent high level of blade panel stress, could lead to increased localised stresses in those corner areas and the initiation and propagation of fatigue cracking.

Inspection period for blade cracking

Safety issue number: AO-2017-066-SI-02

Safety issue description: The scheduled inspections recommended by Rolls-Royce to detect cracking in Trent 700 fan blades, were insufficient to detect early onset fatigue cracks in the membrane to panel bond before those cracks could progress to failure.

Sources of information

The sources of information during the investigation included:

• the flight crew
• Rolls-Royce plc
• AirAsia X
• Airservices Australia

References

Magerramova, L., Volkov, M., Afonin, A., Svinareva, M. and Kalinin, D., Application of Light Lattice Structures for Gas Turbine Fan Blades.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, AirAsia X, Rolls-Royce plc, Airbus, the Civil Aviation Safety Authority, the Air Accident Investigation Bureau Malaysia, the United Kingdom Air Accidents Investigation Branch, and the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile.

Submissions were received from AirAsia X, Rolls-Royce plc, Airbus, the Air Accident Investigation Bureau Malaysia, the United Kingdom Air Accidents Investigation Branch, and the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Additional operational information

Operational information

The Operations Manual suite

The Operations Manual (OM) suite contained the operator’s policies, instructions and procedures necessary for flight operations. There were four parts to the suite:

• Part A General/Basic (OMA) contained non-type related operational policies, instructions and procedures, including operating procedures that covered flight preparation instructions, flight procedures and additional procedures applicable to extended diversion time operations
• Part B Aeroplane Operating Manual (OMB) contained all of the type related airplane operating manuals, including the flight crew operating manual (FCOM) for the A330
• Part C Route and Airport (OMC) contained route and airport information
• Part D Training (OMD) contained training related information.

The electronic centralised aircraft monitor

The ECAM monitors the various aircraft systems, including the aircraft’s engines, and displays information about those systems to the flight crew. The components of the ECAM include the:

• flight warning computers
• engine/warning and the system display units

When the flight warning computers detect a system failure, they automatically trigger the appropriate ECAM alert level. That ECAM alert level will result in the:

• display of the ECAM message attached with the condition on the engine/warning display
• triggering of the alert level’s aural and visual attention-getters
• display of the required emergency/abnormal procedure on the engine/warning display
• system display showing the relevant system schematic.

There were three ECAM alert levels. From a systems perspective:

• The most serious, a level 3 red safety priority alert, denoted a system failure that alters flight safety and required immediate flight crew action. The required action is displayed as a procedure on the lower left section of the engine/warning display (Figure A 1).
• A level 2 amber abnormal priority alert denoted a system failure that does not have a direct consequence on flight safety but required crew awareness. Action in response to a level 2 alert should be taken without delay, time and situation permitting. The required action is displayed as a procedure on the lower left section of the engine/warning display.
• A level 1 amber degradation priority alert required crew awareness and then monitoring.

Figure A 1: The cockpit front panels

The front panels showing the location and exploded view of the engine/warning display and system display, and the master warning/caution lights.

Source: Airbus, modified by ATSB.

Emergency and abnormal procedures

The triggering of an ECAM alert resulted in the required procedure being presented to the flight crew on the engine/warning display. The FCOM contained a detailed examination of the procedures required to be completed for the various ECAM alerts.

The engine control system fault (ENG CTL SYS FAULT) ECAM alert was a level 2 amber caution alert, triggered by the failure of any one of a number of engine control systems, including the loss of the N1 and/or N2 parameters. The flight crew response was dependent on the source of the failure, which was notified to the flight crew on the engine/warning display.

An engine stall would trigger the ENG 1(2) STALL level 2 alert. The displayed ECAM procedure required the flight crew to move the thrust lever to idle, then check the engine parameters.

When the engine’s core speed reduced to below idle while the ENG MASTER switch is ON, the ENG 1(2) FAIL level 2 ECAM message would trigger. The displayed ECAM procedure required the flight crew to move the engine’s thrust lever to idle and then wait for a period of time while the engine automatically attempts to relight. If a relight is not achieved, the procedure required the flight crew to select the ENG MASTER switch to OFF. The flight crew was then required to make a damage assessment. The FCOM provided guidance on indications of damage to an engine.

Placing the ENG MASTER switch to OFF resulted in the engine being shut down, which in turn triggered the ENG 1(2) SHUTDOWN ECAM message. When an engine was shut down, the amber LAND ASAP and ENG 1(2) SHUT DOWN ECAM messages are displayed, along with the associated shutdown procedure. The engine shut down procedure was designed to place the aircraft in a configuration that enabled single engine operation.

The FCOM included following definition for the LAND ASAP ECAM message:

If red LAND ASAP is part of the procedure, land as soon as possible at the nearest airport at which a safe landing can be made.

Note: red LAND ASAP information is applicable to a time-critical situation.

If amber LAND ASAP is part of the procedure, consider landing at the nearest suitable airport.

Note: The suitability criteria should be defined in accordance with the Operator's policy.

Aerodrome data available to the flight crew

The Flight Management Guidance and Envelope Computer

The aircraft was fitted with two Flight Management Guidance and Envelope Computers (FMGES). One of the functions of the FMGES was navigation. Each FMGES was able to compute the aircraft position and steer the aircraft along a pre-planned route using vertical and speed profiles or flight crew selected flight parameters. To perform these operations the FMGES used databases that provided navigation and aircraft performance data. As part of its navigation function, the FMGES was also able to provide the flight crew with a range of navigation information.

The FMGES navigation database included airports, runways, approach and departure procedures, company routes and alternate aerodromes. The aircraft operator was responsible for defining the database content. The operator advised that the FMGES data base contained information for all en route alternate aerodromes, including emergency aerodromes such as Learmonth.

Electronic Flight Bag

The operator provided each flight crew with an electronic flight bag (EFB),^[20] in the form of an iPad. The EFB contained a database which included airport data and airport approach and departure procedures charts. The operator advised that the EFB included charts for all en route alternate aerodromes, including emergency aerodromes such as Learmonth.

Operator’s policies, procedures and guidance

In-flight procedures

The OMA stated that, after an engine failure, the pilot-in-command was required to divert to the nearest suitable airport. Where there was more than one suitable airport available, the nearest in-flight time was to be considered. The OMA provided a number of criteria to be considered by the flight crew in determining whether an airport was suitable or not, including weather, runway conditions and rescue and firefighting services (RFFS) category.^[21] At the time of the engine failure, Perth Airport was the nearest suitable aerodrome using the required criteria specified in the OMA.

Extended Diversion Time Operations

The OMA required that two engine aircraft flying over remote areas and not operating in accordance with extended diversion time operations (EDTO) procedures, should be flown no more than 60 minutes flying time from an ‘adequate’ airport. Commonly referred to as the ‘threshold time’ for EDTO, the 60-minute limit equated to a distance of 430 NM (796 km), based on the A330 one engine inoperative cruise speed. The weather conditions for that adequate airport were required to meet specific requirements at the expected time of arrival. The OMA listed Australia as a remote area.

The occurrence involved an engine failure while the aircraft was operating as an EDTO flight. The OMA defined an EDTO flight as one where a point on the route was more than the threshold time from an authorised EDTO alternate airport. EDTO procedures enabled the threshold time to be exceeded, up to the maximum diversion time approved for that operation. The operational flight plan identified that the occurrence flight was authorised to operate up to 120 minutes at the one engine inoperative cruise speed from an EDTO alternate airport. The requirements to qualify as an EDTO alternate airport included:

• aerodrome technical specifications that met those required for A330 operations
• particular services to be available, including rescue and firefighting services (RFFS) at a minimum of CAT 4, during the expected times that the aerodrome could be required for use.

The EDTO in-flight procedures section of the OMA also contained the following requirement regarding the LAND ASAP ECAM message:

In cases leading to a LAND ASAP message on ECAM or QRH, the crew are to follow the ECAM procedures and land at the nearest suitable airport. LAND ASAP in RED requires greater urgency than LAND ASAP in AMBER.

Preferred alternate aerodromes

The operator published a list of company preferred alternate aerodromes in the OMC. Aerodromes that were company approved destinations were also included within the list of preferred alternates. To qualify as a preferred alternate, the operator published a set of criteria that included:

• runway width of 45 m or better
• landing distance available of 2,100 m or better
• RFFS CAT 7 or better, except for an EDTO alternate, which required CAT 4 or better.

For routes where aerodrome coverage was stated as being remote or sparse, the operator also identified alternate aerodromes that were designated as emergency alternates. These aerodromes did not meet all of the requirements of an EDTO alternate. The OMA stated that emergency alternates were for use only in case of dire emergency.

The FMGES and the EFB databases contained information for specific aerodromes, including runway and approach procedures. Those specific aerodromes were designated as destination, destination alternates or approved en route alternate aerodromes for A330 operations.

Appendix B – History of Trent 700 fan blade failures and in-service management

Table B1 details a time sequence for the relevant information from the failed blade from this event, along with all Trent 700 fan blade events, the identified initiating factor, and in-service management.

Table B1: Timeline of Trent 700 fan blade failure events and in-service management

__________

20. An electronic flight bag is a software and data-services solution to digitise logbooks, charts and other flight documents to achieve a paperless cockpit.
21. An aerodrome’s required RFFS is based on a number of criteria, including the overall length and the fuselage width of the aircraft that predominantly use the aerodrome, and a threshold value in the number of movements of the highest category of aircraft. The various levels of RFFS category (CAT) establish a requirement for, among other things, the types and number of rescue and firefighting equipment required to be available at that aerodrome.

Personnel information – Captain

Personnel information – First Officer