Description

On 30 September 2017, an Engine Alliance GP7270-powered Airbus A380-800 (F-HPJE) being operated by Air France on a scheduled international passenger flight from Paris CDG to Los Angeles as AF066 was in the cruise FL370 and beginning an intended cruise-climb to FL 380 in day VMC when the number 4 engine suddenly suffered an explosive and uncontained failure. Secondary damage to the airframe, engine 4 pylon and the right wing was minor and no debris penetrated the cabin. After drift down, the crew elected to divert to Goose Bay and this was accomplished without further event.

Investigation

Following delegation by the Danish AIB, an Investigation was carried out by the French Civil Aviation Accident Investigation Agency, the BEA. Data was successfully downloaded from the CVR and FDR, although as the former had continued to record after the event, relevant data was thereby overwritten. This was found to have been a result of the absence of any on-board aircraft operator documentation which properly described how the flight crew could stop the CVR recording after an event such as the one under investigation. A definitive determination of the cause of the engine failure could not be made until recovery of specific ejected debris had been achieved, which in itself turned out to be a long and very complex operation which did not lead to the location and recovery of the required fan hub remains from beneath the ice until July 2019.

Extraction of the fan hub part which enabled the cause of failure to be identified. [Reproduced from the Official Report]

It was noted that the flight crew consisted of a Captain and two First Officers, one of the latter being designated as a Relief First Officer. The 60 year-old Captain had a total of 19,568 flying hours of which 15,260 hours were as Captain and of those 3,249 were on type. He had been type rated on the A380 since the delivery of the aircraft involved to Air France in 2011. The 45 year-old First Officer had a total of 8,549 flying hours of which 796 hours were on type and had been type rated on the A380 the year prior to the accident. The 42 year-old Relief First Officer had a total of 8,811 flying hours of which 260 hours were on type and had been type rated on the A380 earlier in 2017.

What Happened

When the flight was around 100 nm east of the coast of Greenland with the Relief First Officer as PF, and had already step-climbed to FL370, CDPLC contact was made with Oceanic ATC and clearance to climb further to FL380 was obtained. Almost immediately following the increase in thrust required to accomplish this climb - from 98% to 107% N1 - had been set, an explosion suddenly occurred and asymmetric thrust attributable to malfunction of the number 4 engine became evident accompanied by severe airframe vibration. ‘ENG 4 STALL’ and ‘ENG 4 FAIL’ ECAM messages were annunciated simultaneously.

The Captain announced that he was taking over as PF and engaged AP1. He then set the number 4 engine thrust lever to flight idle and an automatic engine shutdown followed. The Relief First Officer then followed this by selecting the number 4 engine Master and Fire switches to off. The damaged engine could not be seen from the flight deck or on the image from the external camera on the leading edge of the vertical stabiliser but one of the cabin crew brought a photograph of it taken by a passenger to the fight deck. The First Officer who, in the absence of any SOP requiring it, had returned to assist the operating crew, then went to the upper deck to assess the damage and take more photographs, noting impact damage to the right wing leading edge slats and minor vibration in its trailing edge flaps. These pictures showed that the front of the number 4 engine had disappeared and just the central part of its fan hub was still attached to the low pressure shaft.

The damaged engine after the accident flight - a piece of ejected fan blade can be seen embedded in the Outlet Guide Vanes (OGVs). [Reproduced from the Official Report]

Having begun to address the situation by applying the operator’s standard FOR-DEC decision making process, the Captain noticed that maintaining FL370 was being accompanied by a steady decrease in indicated airspeed - almost 20 knots over 90 seconds - decided to progressively descend until it was possible to achieve a constant speed in level flight. With the FMS-calculated engine out drift-down level being FL346, he reported having been “surprised” that not until FL290 with MCT (maximum continuous thrust) set was it possible. He then decided to descend to and stay at FL 270 to slightly reduce the thrust required to remain in level flight. It was subsequently observed during the Investigation that the documentation available to the crew did not include a reminder that the FMS-calculated drift-down level assumes a failed engine that is windmilling, a condition that, as in this case, is not necessarily achievable.

Around five minutes after the descent from FL370, ATC detected the unexpected descent and sent a CPDLC message asking if there was a problem at about the same as receiving a relayed MAYDAY message which had transmitted shortly after the engine failure. A CDPLC reply was sent to confirm the MAYDAY status and a few minutes later, VHF communications became possible and it was decided, after consulting Company Operations Control, that the flight would divert to Goose Bay and a direct track was obtained from ATC. The remainder of the flight was completed without further event with an RNAV GNSS approach to Goose Bay runway 26 flown and a landing there almost two hours after the engine failure. Taxiing to the allocated parking position was delayed when it was necessary to stop several times so that the airport services could collect debris which had fallen onto the runway during the landing and engine shutdown did not occur for a further 40 minutes.

The 497 passengers were not able to leave the airport because the airport immigration system could not handle such a large number and in any event neither could the accommodation available at Goose Bay. Some passengers were able to go into the airside part of the airport terminal and were later all served a meal on the aircraft. An alternative routing to Los Angeles was arranged and, 16 hours after arriving at Goose Bay, the last passenger left the disabled aircraft at 0500 local time the following morning to resume their interrupted journey.

An initial examination of the aircraft found that the titanium fan hub of the number 4 engine had separated into at least three parts as a result of the progression of a fatigue crack originating from within the hub near to one of the fan blade slots. The central fragment of the hub had remained attached to the LP (low pressure) shaft and the other had been ejected, one upwards and the other downwards and the remaining HP part of the engine was locked solid. Collision between the liberated fan rotor fragments and the fixed parts of the engine had resulted in the destruction of the forward part of the engine casing and the separation of the air inlet which had both fallen to the ground. It was apparent that some of the debris from the front of the engine had struck the right wing and the adjacent airframe structure but had caused only superficial damage.

Determining the Cause of the Engine Failure

It was found that the failed engine had been manufactured in 2009 and installed on the aircraft in 2013. At the time of failure, it had completed 30,769 hours and 3,534 cycles since build. The design and manufacture of the engine fan was the responsibility of Pratt and Whitney (P & W) and comprised a fan hub and blades. After removal of the remains of the damaged engine, it was flown to an approved workshop in the UK for examination in the presence of BEA Investigators. It was confirmed on disassembly that only the LP fan (i.e. the compressor) had been damaged and all the damage was confirmed as being consistent with failure of the fan hub and its separation from the engine.

An annotated cross section of a GP7270 engine. [Reproduced from the Official Report]

It was noted that the (hollow) fan blades and the fan hub were made from the titanium alloy Ti-6-4 which included 5.5 to 6.75 % by weight of Aluminium and 3.5 to 4.5 % by weight of Vanadium. The fan hub was forged from a large billet of this alloy. Examination of the fracture surfaces on the remaining central conical part of the fan hub using a scanning electron microscope showed that they were “characteristic of sudden failure due to overload”. There was no evidence that a bird strike had occurred or any other evidence as to the cause of the failure. Examination of the computers which controlled the operation of the failed engine showed that no operating anomaly had been detected prior to the sudden failure and this absence of any fault prior to the failure was considered to be indicative of the suddenness of the failure.

As the factual findings of the Investigation in relation to the fan hub failure became increasingly apparent, the engine manufacturer Engine Alliance, began publishing a number of SBs and ASBs (Alert Service Bulletin) relating to in service inspection of the GP7270 fan hub, beginning with one-time inspection and later repetitive inspection. These initially required visual inspections and later also Eddy Current Inspection (ECI) of the slot bottoms of the fan hub. The FAA, as certification authority for the engine, then issued ADs based on the ASBs.

However, it was not until the eventual finding of an ejected piece of the engine 4 fan hub under the ice in southern Greenland some 21 months after the accident that the cause of its failure could be determined. Laboratory analysis of this piece of the fan hub found that the failure had originated in a micro texture region (otherwise referred to as a macro zone) of the subsurface of a blade slot bottom under the blade root. It had been triggered by “cold dwell fatigue” in the titanium alloy from which the fan hub had been manufactured. A consequent crack had then increased over a period of several years in service until sudden and total failure of the hub resulted. This finding completely invalidated the previously-considered most likely origin of hub failure.

The predicted life for the hub was 15,000 cycles, compared to the 1,650 cycles it had accumulated at the time of failure and was neither anticipated nor prevented by an operational or maintenance action. The inspections which were integral to the hub manufacturing process had not revealed any anomaly and it was concluded that as specified, they could not be guaranteed to do so. The macro-zone in which the crack had been initiated was found to have been “an order of magnitude larger and more intense than the average micro texture region observed by the manufacturer”, both elsewhere within the failed hub and in other hubs manufactured from the same billet.

The risk of cold dwell fatigue being introduced at manufacture was not recognised during either the engine certification process or in the engine design process and at the time the hub was designed and certificated, “it was accepted by the scientific community, the industry and the certification authorities that Ti-6-4 was not sensitive to the cold dwell fatigue phenomenon”. This meant that macro-zones, which were already known to be “inherent to the manufacturing process of Ti-6-4 forged parts”, were not associated with the also-known increased risk of crack-initiation due to cold-dwell fatigue in such macro-zones. It was noted by the Investigation that despite in-depth research into cold dwell fatigue in certain alloys used in aerospace and other manufacturing, “the mechanisms at the origin of the initiation of a cold dwell fatigue crack were still not completely understood at the time of the accident and are still not understood today”.

The findings of the Investigation made it clear that “a lack of knowledge of both the activation envelope of the cold dwell fatigue phenomenon on Ti-6-4 and the conditions conducive to the appearance of intense macro-zones meant that a cold dwell fatigue crack was initiated at a stress level lower than that accepted up until now by only taking into consideration pure fatigue, and at a significantly lower number of cycles”.

The Conclusion of the Investigation was that the uncontained failure of the no 4 engine fan hub was the result of “a cold dwell fatigue phenomenon (which) caused the development and progression of a crack in the subsurface of a blade slot bottom (and that) neither the manufacturer nor the certification authorities had anticipated this phenomenon in this alloy during the design of the engine”.

Four Contributory Factors to the fan hub failure were formally documented:

• the engine designer/manufacturer’s lack of knowledge of the cold dwell fatigue phenomenon in the titanium alloy, Ti-6-4;
• the absence of instructions from the certification bodies about taking into account macro-zones and the cold dwell fatigue phenomenon in the critical parts of an engine, when demonstrating conformity;
• the absence of non-destructive means to detect the presence of unusual macro-zones in titanium alloy parts;
• an increase in the risk of having large macro-zones with increased intensity in the Ti-6-4 due to bigger engines and in particular, bigger fans.

The Final Report was made available in both English translation and in the definitive French language version on 22 September 2020.

Related Articles

• Uncontained Engine Failure
• Ageing Aircraft - Structural Failure
• Certification of Aircraft, Design and Production
• Non Destructive Testing of Composite Materials in Aviation
• Airworthiness
• Continuing Airworthiness