Executive summary
What happened
On 4 April 2022, the pilot of a de Havilland Canada DHC-2/A1 Beaver aircraft, registered VH-AAX, was conducting parachute flights overhead Moruya Airport, New South Wales. Shortly after the parachutists had exited the aircraft, the pilot heard a loud bang and experienced vibrations as the engine failed. In response, the pilot conducted a forced landing at Moruya.
A post-flight examination of the aircraft identified holes in the cowling above the engine compartment, perforation of the external wall of the engine combustion chamber, holes through the exhaust assembly, and significant damage to the turbine section.
What the ATSB found
The ATSB found that a low-cycle fatigue crack had initiated in the 3rd-stage turbine wheel of the Honeywell International Inc turbo-propeller engine and grown to failure. Errors made by a previous maintainer when determining the engine operating cycles and total equivalent cycles accrued by engine components resulted in the 3rd-stage turbine wheel remaining in-service beyond the component life-limit.
In addition, the ATSB established that the operator had estimated the number of engine shutdowns conducted each day based on recollection only. This increased the likelihood that the recorded cycles were incorrect. The ATSB was unable to determine if this resulted in any errors.
What has been done as a result
The maintainer who inadvertently introduced the errors into the count of engine operating cycles and component total equivalent cycles has audited these values for the other in-service turbine engines they maintained. In addition, this maintainer introduced new procedures including independent checks of input variables and calculations, and 6-monthly internal audits of cycles monitoring.
To ensure accurate recording of information on the aircraft maintenance release, the operator introduced a flight log for the pilot to record each flight, including noting whether there was an engine start associated with each flight.
Safety message
Accurate records of equivalent cycles accrued by an engine and engine components is a safety critical activity. As such, they should be diligently recorded, calculated, and checked to ensure the equivalent cycles accrued by a component is known with confidence. This means that components can be replaced prior to the published in-service life-limit being reached.
The investigation
The occurrence
On 4 April 2022, a de Havilland Canada DHC-2/A1 Beaver aircraft, registered VH-AAX, was being operated at Moruya Airport, New South Wales on parachuting flights. The pilot was conducting the second flight of the day and the aircraft had been operating normally. The pilot recalled that the wind was 5 to 10 kt from the NW on the ground and there was ‘quite a strong’ westerly wind up to 15 to 20,000 ft (estimated to be approximately 20 kt).
On approaching the drop zone (Figure 1), the aircraft descended from flight level (FL)[1] 150 to FL 145 in preparation for the parachute run, which would typically take about 30 seconds. The pilot reported checking the engine parameters just prior to and just after the parachutists exited the aircraft. Engine parameters were indicating normal engine performance. A few seconds after, the pilot reportedly heard a loud bang and detected some vibrations lasting a short time.
The pilot believed they had experienced an uncontained engine failure,[2] as they had observed small holes in the engine cowl. The pilot responded by pulling the fuel emergency shut-off lever, to shut-off fuel to the engine and release the oil pressure in the propeller system, resulting in the propeller blades moving into the feathered[3] position. They also shut down the electrical system, configured the aircraft for best glide speed, and contacted the company on the ground frequency to establish where the parachutists were.
The pilot broadcast a MAYDAY[4] call and no other aircraft were in the area at the time. The pilot identified runway 18 as the safest option for a forced landing as it was away from the parachute drop zone and other obstacles (Figure 1), despite a slight quartering tailwind. The aircraft landed safely and was manoeuvred onto a grass area clear of the runway.
Figure 1: Moruya Airport and parachuting drop zone
Source: Google Earth, annotated by the ATSB
A post-flight examination of the aircraft revealed holes in the cowling above the engine compartment (Figure 2). Examination of the engine identified a perforation of the external wall of the combustion chamber, holes through the exhaust assembly, failure of the main shaft and the torsion shaft,[5] damage to the turbine section, and loss of the 2nd and 3rd-stage turbine wheels (Figure 3).
Figure 2: Damage to upper engine cowl of VH-AAX
Source: ATSB
Figure 3: Damage to the engine combustion chamber, turbine section, and exhaust assembly
Source: ATSB
Context
Pilot information
The pilot held a Private Pilot (Aeroplane) Licence and had a total flying experience of 1,078 hours, of which 540 hours were on the de Haviland Canada DHC-2/A1 Beaver. In the previous 90 days, the pilot had flown 154 hours total and 140 hours on the Beaver. The pilot was also employed by the operator as a licence aircraft maintenance engineer.
Aircraft information
General
VH-AAX was a de Havilland Canada DHC-2/A1 Beaver high-wing aircraft, with a single turboprop engine. At the time of the incident, the aircraft’s total time-in-service was 17,039.2 hours. The aircraft was last serviced 70 hours prior and there were no outstanding maintenance items recorded on the maintenance release.
Engine information and history
The engine fitted to VH-AAX was a Honeywell International Inc (formerly AlliedSignal, Garrett, and AiResearch) model number TPE331-2-201A, turbo-propeller engine (Figure 4), serial number P90018C. It consisted of:
- a 2-stage centrifugal compressor
- an annular combustion chamber
- a 3-stage axial turbine
- a reduction gear and shaft section.
The turbine section contained the 1st, 2nd and 3rd-stage turbine wheels. The exhaust assembly was considered part of the turbine section.
Figure 4: Schematic of Honeywell TPE331-2-201A Engine
Source: Honeywell, annotated by the ATSB
On 18 June 2009, the engine was overhauled and the engine components were certified with zero cycles at this time. On 14 August 2014, new 1st and 2nd-stage turbine wheels were fitted and a hot section inspection[6] was performed.
On 2 September 2019, the engine was removed from VH-AAX and sent for preservation to allow for an airframe rebuild by the new owner. Up until this time, the engine had been primarily maintained by a single organisation, the ‘first maintainer’. The engine was reinstalled in VH-AAX on 18 August 2020 and operated without issue until the date of the incident. The most recent 100‑hourly maintenance inspection was performed on 21 February 2022 by the ‘current maintainer’. The owner had arranged for the 1st, 2nd, and 3rd-stage turbine wheels to be replaced during an upcoming scheduled maintenance event as, according to the engine logbooks, the 3rd‑stage turbine wheel, part number 868630-9, was approaching the component life-limit.
Engine examination
The engine was transported to a Honeywell facility in the United States for a teardown and detailed examination supervised by the National Transportation Safety Board. The examination found that:
- there was evidence of rotational instability in the engine while the engine was running
- the main shaft and the torsion shaft had fractured
- a fragment of turbine wheel was lodged in the outwards rupture of the combustion case; this fragment (Figure 5) was consistent with the specified material of the 3rd-stage turbine wheel. No other parts of the 3rd stage turbine wheels were found in the engine
- evidence of low-cycle fatigue cracking[7] was identified on the fragment of the 3rd-stage turbine wheel found lodged in the combustion case (Figure 5 and Figure 6)
- the 2nd stage turbine wheel was not present
- the aft turbine bearing and bearing support, aft sump scavenge pump, aft bearing support struts, turbine nut, and tail cone were missing
- there was ‘no uncontainment’ of the combustion case.[8]
Both Honeywell and the National Transportation Safety Board concluded that the most likely reason for the engine failure was a low-cycle fatigue failure of the 3rd-stage turbine wheel.
Figure 5: Recovered fragment of 3rd-stage turbine wheel found lodged in the combustion case viewed from the aft (left) and forward sides (right)
Source: Honeywell, annotated by the ATSB
The photograph in Figure 6 shows the fracture surface on the 3rd-stage turbine wheel fragment. The fracture surface is in the radial plane located at a rivet hole. The crack initiation area has been indicated.
Figure 6: Fracture surface on the 3rd-stage turbine wheel fragment
Source: Honeywell, annotated by the ATSB
The scanning electron microscope image in Figure 7 taken of the fracture surface, showed features consistent with fatigue cracking. The direction of crack growth (white dash arrows), informed by the striations, indicated that the crack originated from the reduction in diameter of the rivet hole.
Figure 7: Microscopic fracture surface features adjacent to the fracture initiation area indicating fatigue crack growth
Source: Honeywell, annotated by Honeywell and the ATSB
Equivalent cycles in special operations
On 9 August 2006, the United States Federal Aviation Administration issued airworthiness directive (AD) 2006-14-03, applicable to Honeywell TPE331 series turboprop and TSE331-3U model turboshaft engines. The AD was issued to prevent an uncontained engine failure resulting from fracturing of the turbine rotor[9] due to low-cycle fatigue. This AD was developed in response to several reports of uncontained turbine rotor separation[10] that had resulted in metal fragments either penetrating the engine case or exiting the tail pipe, on engines used in ‘special-use’ operations. Special-use operations was defined as those aircraft that make multiple take-offs and landings without an engine shutdown, such as parachute and agricultural spraying operations. The additional take-offs and landings result in the life-limited parts accruing low-cycle fatigue damage at a faster rate when compared with passenger and freight transport flights.
The previously established cycle counting and life limits for life-limited parts used in Honeywell TPE331 turboprop engines were based on a cycle that consisted of an engine start, aircraft take‑off, cruise, landing, and engine shutdown (Figure 8). This is typical of a passenger transport flight. Applying this, an engine component such as a turbine wheel, would accrue a single cycle for each engine start/shutdown, irrespective of how many landings occurred.
Figure 8: Example of a passenger transport flight corresponding to a single engine cycle
Source: ATSB
The AD required implementation of a new flight cycle counting method, which involved tracking ‘equivalent cycles’ for turbine wheels in aircraft undertaking special-use operations (Figure 9). An equivalent cycle incorporated a damage fraction factor for each additional landing that occurred with no engine shutdown followed by a take-off. This was in addition to the cycle for one landing associated with the start/shutdown as shown in Figure 8. Total equivalent cycles were the sum of equivalent cycles for all operational flights.
Figure 9: Example of a special-use operation requiring an equivalent cycle calculation
Note: Schematic showing hypothetical day of operation for an aircraft used for ‘special-use’ operations. This example shows a total of 2 shutdowns and 5 landings.
Source: ATSB
The AD also referred to the use of Honeywell service bulletin TPE331–A72–2111, first issued in 2002, to determine the total equivalent cycles for TPE331-2 model engines. This included the engine fitted to VH-AAX, which was overhauled after the introduction of the AD and was reportedly always involved in special-use operations. The method outlined in the service bulletin for determining equivalent cycles for a turbine wheel in this engine, used the equation:
Where, the damage fraction applicable to the 1st, 2nd and 3rd-stage turbine wheels was 0.5, 0.6 and 0.2, respectively. For the part numbers fitted to the incident engine, the ‘turbine wheel removal schedule’ specified for the retirement of the 1st, 2nd and 3rd-stage turbine wheels was at 5,700, 5,400 and 6,000 total equivalent cycles, respectively.
Shutdowns and landings recorded by the operator
Operators conducting special-use operations, which included parachuting flights conducted in VH‑AAX, recorded the number of landings associated with each start/shutdown cycle to monitor the accumulation of equivalent cycles. The operator of VH-AAX recorded the total number of shutdowns and the total number landings performed in a day of operation as part of the daily line item on the maintenance release. The total number of equivalent cycles accrued by engine components was not calculated at the end of each shutdown as described in Honeywell service bulletin TPE331–A72–2111. Instead, the calculation was performed by the maintenance organisation at scheduled maintenance events.
The operator used their parachuting manifest to accurately record the number of landings that occurred in a day. The number of engine shutdowns was estimated by the operator at the end of each day, rather than by a pilot record being made at the time of each shutdown.
Equivalent cycles calculations by the maintenance organisations
Two maintenance organisations, the ‘first maintainer’ and the ‘current maintainer’, were primarily responsible for the maintenance of the engine since it was rebuilt in 2009. There was another maintenance organisation, the 'second maintainer’, that was only briefly responsible for maintenance of the aircraft. The maintenance organisations used the maintenance release to calculate total equivalent cycles accrued by engine components. At a scheduled maintenance event, the maintainer would sum the number of shutdowns and the number of landings for the period of the maintenance release. Then they would calculate the cycles accrued by a component over that period according to the following equation:
Where shutdowns was the total number of engine shutdowns recorded on the maintenance release, landings was the total number of landings recorded on the maintenance release, and damage fraction was 0.5, 0.6 and 0.2, for the 1st, 2nd and 3rd-stage turbine wheel, respectively. The maintainer would then add the equivalent cycles for the latest maintenance release period to the previous total recorded to obtain the new value.
The ATSB completed a review of the equivalent cycle counting recorded by the 3 maintainers, for the time from the engine rebuild in 2009 until the engine failure (Table 1). Comparison of the engine logbook and maintenance release identified errors in the total equivalent cycles and engine components recorded by the first maintainers. Calculation of the accurate number of cumulative equivalent cycles for the 3rd-stage turbine indicated that the turbine had completed 477.6 more equivalent cycles than recorded, resulting in the part having exceeded the retirement limit by 357.6 cycles at the time of the engine failure (red text in Table 1). The first maintenance organisation stated that a single individual was tasked with calculating and recording cycles and that there was no secondary check by another worker.
Another discrepancy between recorded and corrected total equivalent cycles related to the second maintainer appeared to be related to rounding.
The current maintainer did not record the total equivalent cycles accrued by engine components in each logbook entry, instead the remaining cycles was calculated in the work packs. The remaining cycles, rounded down to a whole number, were then communicated to the operator. No errors were identified in the total equivalent cycles recorded by the current maintainer.
Table 1: Number of equivalent cycles accrued by the engine and turbine wheels fitted to VH-AAX
Safety analysis
Low-cycle fatigue crack
When a low-cycle fatigue crack on the 3rd-stage turbine wheel, grew to a critical size, a fragment of the wheel was liberated under load, which initiated the engine failure. The fragment impacted the combustion case and became lodged. The separation of this wheel fragment resulted in significant rotational imbalance, which led to fracturing of the main and torsion shafts. Detached turbine section components then exited the engine, damaging the exhaust assembly. There was no evidence that any turbine wheel fragments exited through the combustion case with sufficient energy to cause a hazard to the aircraft. As such, the failure was deemed to be contained.
When the engine failure occurred, the pilot was descending from FL 145 above the airport, so had sufficient time to conduct all engine failure checks and prepare for a forced landing. The decision to land on runway 18, despite the tail wind, reduced the risk the aircraft posed to the parachutists.
Cycle counting error for 3rd-stage turbine wheel
The ATSB’s examination of the engine logbooks and available maintenance releases determined that the aircraft’s first maintainer made a number of traceable errors when calculating and recording engine cycles, and engine component equivalent cycles. There was limited opportunity to avoid these errors as the calculations were performed by one individual and no independent checking was incorporated into the process.
The cumulative effect of the errors meant that the 3rd-stage turbine wheel had accrued 477.6 equivalent cycles more than the reported value. Consequently, at the time of the engine failure, the 3rd-stage turbine wheel had exceeded its component life-limit by 357.6 equivalent cycles. The operator had planned to replace the 3rd‑stage turbine wheel upon reaching the life-limit (as recorded in the engine logbook). If the equivalent cycles had been correctly recorded, the part would have been replaced before an engine failure occurred.
Number of engine shutdowns estimated
The operator’s method for estimating engine shutdowns on a day of operation also introduced a potential source of error in accounting for cycles. The estimation of the number of shutdowns at the end of each day, combined with delaying the calculation of total equivalent cycles until a scheduled maintenance event, deviated from the method for monitoring equivalent cycles described in Honeywell service bulletin TPE331–A72–2111.
The maintainers relied on the record of landings and shutdowns in the maintenance release for the calculation of total equivalent cycles accrued by a component. In practice, if the information recorded on the maintenance release accurately reflected the operation of the aircraft, there would have been no difference between performing the calculation after each start/shutdown cycle or using the total number of landings and starts shutdowns for the period of the maintenance release. It was not possible for the ATSB to quantify the errors, if any, introduced by the operator’s estimation method without a record to compare the estimated and actual shutdowns.
Findings
|
These findings should not be read as apportioning blame or liability to any particular organisation or individual. |
From the evidence available, the following findings are made with respect to the engine failure involving de Havilland Canada DHC-2 Beaver, registration VH-AAX, overhead Moruya Airport, New South Wales, on 4 April 2022.
Contributing factors
- A low-cycle fatigue crack, which had initiated on the 3rd-stage turbine wheel, grew to a critical size liberating a fragment of turbine wheel. Following this, the engine failed, requiring the pilot to shut down the engine and conduct a forced landing.
- Errors in cycle counting made by a previous maintainer resulted in the 3rd-stage turbine wheel remaining in-service beyond the component life-limit.
Other factors that increased risk
Safety actions
Safety action by the first maintainer
In response to the incident, the first maintainer has implemented the following safety action:
- They have conducted an audit of the calculations of engine cycles and engine component total equivalent cycles for the in-service turbine engines they maintain, and any errors were corrected.
- They introduced new procedures for the calculation of engine cycles and engine component total equivalent cycles. The procedures included an independent check of input variables and calculation results. In addition, the maintainer will conduct 6-monthly internal audits of calculations.
Safety action by the operator
In response to this incident, the operator has introduced a flight log for the pilot to record each flight, including whether there was an engine start associated with the flight. The total number of flights and engine starts on the flight log are then used to populate the maintenance release with verifiable accurate information.
Safety action by Honeywell
Honeywell had been analysing engine performance data from aircraft with TPE331 engines in both agricultural spraying and parachuting operations. They found that, while agricultural spraying operations incur damage at a higher rate than the United States Federal Aviation Administration procedure originally used to set the cycle limits of the turbine wheels, parachuting operations incur damage at an even higher rate. Honeywell, working with the Federal Aviation Administration, is in the process of issuing a revised cycle counting methodology that will address the operating characteristics of parachuting and agricultural spray applications.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
- pilot of VH-AAX
- operator of VH-AAX
- maintenance organisations for VH-AAX
- Civil Aviation Safety Authority
- Honeywell International Inc
- United States National Transportation Safety Board.
References
Aerospace Industries Association (2010) AIA Project Report on High Bypass Ratio Turbine Engine Uncontained Rotor Events and Small Fragment Threat Characterization 1969-2006, Volume 1, published January 2010, accessed 11 April 2023. https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/App%20B%20-%20Vol1%20AIA%20Rotor%20Burst%20Small%20Fragment%20Committeee%20Report%20Fina%20r1%20(2).pdf
Federal Aviation Administration (1997) Design considerations for minimising hazards caused by uncontained turbine engine and auxiliary power unit rotor failure, Document Number: 20-128A (Advisory Circular), published 25 March 1997, accessed 29 March 2023. https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_20-128A.pdf
Federal Aviation Administration (2006). AD 2006-14-03, Document Number: 06-5929, Published 7 July 2006. Effective 9 August 2006. Accessed 6 January 2023. https://www.federalregister.gov/documents/2006/07/05/06-5929/airworthiness-directives-honeywell-international-inc-tpe331-series-turboprop-and-tse331-3u-model
Honeywell International Inc. (2002) ALERT Category 1: Safety ENGINE – SERVICE LIFE – SERVICE LIFE LIMITS OF CRITICAL LIFE LIMITED COMPONENTS – SPECIAL USE OPERATION – PARTIAL CYCLE COUNTING, Document Number: TPE331-A72-2111 (Service Bulletin), published 12 November 2002.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
- pilot and operator of VH-AAX
- maintenance organisations for VH-AAX
- Civil Aviation Safety Authority
- Honeywell International Inc
- United States National Transportation Safety Board.
Submissions were received from Honeywell International Inc. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigationsThe objective of a safety investigation is to enhance transport safety. This is done through:
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. TerminologyAn explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing informationReleased in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023
Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly. |
[1] At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 150 equates to 15,000 ft.
[2] Uncontained failure of a turbine engine was any failure that resulted in the escape of turbine rotor fragments from the engine that had sufficient energy to create a hazard. An industry report differentiated between fragments breaching the engine casing and tail-pipe debris (including material passing through the wall of the tailpipe), which was considered lower energy and lesser risk (Aerospace Industries Association 2010).
[3] Feathering is the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
[4] MAYDAY is an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
[5] The torsion shaft, which is coupled to the reduction gear section, is positioned concentrically inside the main shaft, which, along with the compressor impellors and turbine wheels, formed the rotating assembly.
[6] A hot section inspection involves examination of components in the hot section of the engine, which includes the combustion, turbine, and exhaust sections. Typically, the condition of several key engine parts, including the turbine blades, the combustion chamber, the stators, the vane rings, the compressor impellers, and the shroud segments are examined.
[7] Low-cycle fatigue cracking is associated with relatively high-loads, which produce elastic strain as well as plastic strain during each cycle. This is distinguished from high-cycle fatigue cracking, which is associated with relatively low-loads where the strain resulting from each cycle is primarily elastic. High-cycle fatigue cracking, nominally, requires more than 104 cycles to failure.
[8] ‘No uncontainment’ is equivalent to stating that the engine failure was contained.
[9] The turbine wheels are referred to as rotors in AD 2006-14-03 (Federal Aviation Administration 2006).
[10] In this context, ‘turbine rotor separation’ means the breaking apart, and fragmentation, of a turbine wheel.