On November 4, 2010, an Engine Burst Apart on Qantas Flight 32. The Cause Was a Pipe Wall Machined Too Thin

Qantas Flight 32 suffered an uncontained engine failure over Batam Island, Indonesia, on November 4, 2010, four minutes after leaving Singapore for Sydney. Debris from the Airbus A380’s No. 2 engine tore through the left wing and damaged about 650 wires. The crew flew back to Changi, and all 469 people on board were unhurt.

Within six weeks, every Trent 900 engine in the world had new software that shuts it down before a turbine disc can overspeed. Forty engines came off the wing, and Rolls-Royce rebuilt the quality system that had let the bad part out of its factory.

The Australian Transport Safety Bureau’s final report, AO-2010-089, published on June 27, 2013, traced it all to an oil feed pipe whose wall had been machined too thin. It also shows the problem had been spotted inside Rolls-Royce about 20 months before the flight.

How QF32 went from a routine climb to 50 minutes of alarms

Flight 32 was the Singapore to Sydney leg of Qantas’s London service. The aircraft was VH-OQA, the first Airbus A380 Qantas had taken, in service since September 2008 with four Rolls-Royce Trent 972 engines.

The flight deck was unusually full. Besides the captain, first officer and a second officer for crew relief, a check captain under training and the supervising check captain overseeing that training were also aboard. All five were in the cockpit when the engine failed.

At about 10:01 local time, climbing through 7,000 feet at 250 knots, they heard two almost simultaneous bangs. The captain selected altitude and heading hold, and the aircraft leveled off with a slight yaw. The autothrust had dropped out, so he pulled the thrust levers back by hand.

The ECAM, the A380’s alerting and checklist display, began with a No. 2 engine turbine overheat and then filled with messages. The captain kept flying while the first officer read the procedures. A minute later the crew made a PAN urgency call to Singapore.

The fire extinguisher bottles in the No. 2 engine would not confirm a discharge. Fuel was streaming from the left wing, and the fuel system page showed so much damage that the crew chose not to transfer any more fuel. Jettisoning it was impossible.

Because the aircraft was still controllable and had plenty of fuel, they chose to hold rather than rush back. They asked air traffic control for a racetrack pattern within 30 nautical miles of Changi and flew it at 7,400 feet while they worked.

The report lists what the debris did. One hydraulic system was lost and another degraded, two engine generators went, the leading-edge slats stopped working, and fuel leaked from the left wing. Both outboard engines dropped into degraded modes, and the No. 1 engine’s fuel shutoff valves were knocked out.

Landing 41 tonnes heavy with a calculator that said no

The initial ECAM procedures took about 50 minutes. Then the extra pilots ran the onboard landing performance application on a spare laptop, entering the maximum landing weight and nine inoperative systems. It returned “no result”: the runway was not long enough.

They ran it again with the aircraft’s actual weight, which was higher. This time it said a landing on Changi’s runway 20C was feasible, with 330 feet (100 m) to spare. The crew went with it.

The aircraft weighed about 951,800 pounds (431,712 kg) at touchdown against a maximum landing weight of about 862,000 pounds (391,000 kg), roughly 90,000 pounds (41 tonnes) over. The gear had to be lowered by gravity, and the left wing gear had no brakes at all.

The captain flew the last 800 feet by hand after the autopilot disconnected for a second time. The A380 touched down at 11:46 and stopped about 490 feet (150 m) from the end of the runway.

Then the No. 1 engine would not shut down. The master switch, the fire push button and both extinguisher bottles all failed to stop it, because debris had disabled the valves that cut its fuel. Fuel was leaking from the left wing, near brakes indicating 1,650°F (900°C).

The crew judged an emergency slide evacuation beside leaking fuel and a running engine riskier than a slower exit by stairs. Firefighters laid foam, stairs arrived about 35 minutes after landing, and passengers left through a single door. The engine finally stopped about three hours after touchdown, drowned in firefighting foam.

What the ATSB investigation found inside engine 91045

The ATSB found that a fatigue crack had grown in a thin-wall section of an oil feed stub pipe in the No. 2 engine, serial number 91045. On this flight the crack opened and released oil into a hot cavity next to the turbine bearings.

The cavity ran at about 690°F to 705°F (365°C to 375°C), and the oil could auto-ignite as low as 536°F (280°C). The result was an “intense and sustained fire” that heated the intermediate pressure turbine disc until it separated from its drive arm.

Freed from its shaft, the disc accelerated. The engine then behaved differently from Rolls-Royce’s modelling, and the disc spun past its design speed and burst into three main pieces. About 40% of it was found later on Batam Island.

The thin wall was a machining error. A counter bore cut into the end of the pipe at Rolls-Royce’s Hucknall plant was off-center, leaving one side critically thin.

The measuring machine checked the bore against a manufacturing reference instead of the design one. The ATSB found it probably flagged this part anyway, but the non-conformance was either not detected or not declared.

The report also found that the debris damage exceeded what the industry’s certification guidance predicts from a rotor burst. Even so, it concluded the aircraft “was capable of continued safe flight and landing”, and that the crew “managed the event as a competent team”.

How a part flagged in 2009 was still flying in 2010

This is the part of the report most retellings skip. The problem began in 2005, when the first of these bearing support assemblies was inspected against the manufacturing drawings instead of the design drawings. The flawed reference went into production unnoticed.

The ATSB also found “a culture” at Hucknall where staff considered it acceptable not to declare what they judged to be minor non-conformances. After a 2007 audit found high levels of unreported defects, Rolls-Royce stopped all output from the unit for a time.

In March 2009, a manufacturing engineer realized that misaligned counter bores thinned the pipe wall. The engineer measured the nine assemblies on hand and applied for a “retrospective concession” to leave the parts already in service where they were.

The concession was approved without the sign-off of the Chief Engineer and the Business Quality Director, which Rolls-Royce’s own procedures required. The ATSB said that denied them the chance to assess the risk across the fleet. A later internal audit found only 7 of 138 such concessions raised from 2009 to 2011 had followed the procedure.

Engine 91045 itself was built in June 2006, first fitted to the No. 4 position on VH-OQA, and had flown normally until November 4. Nothing in its maintenance history, including its oil use, stood out.

The engine and quality rules that came from Qantas 32

Qantas grounded its six A380s on the day of the accident and began bringing them back on November 27, 2010, at first only on routes that did not need maximum thrust. On November 10, EASA issued emergency airworthiness directive 2010-0236-E, making repeated inspections for oil leaks in the turbine structure binding on every Trent 900.

On December 2, Australia’s Civil Aviation Safety Authority directed Qantas to measure the stub pipe bores on its engines within two flights. Rolls-Royce set a minimum wall thickness of 0.020 inch (0.5 mm) for engines to stay in service, and 40 Trent 900s came off the wing worldwide, five of them from Qantas aircraft.

The fix that matters most for passengers is software.

The intermediate pressure turbine overspeed protection system detects the signs of an internal fire, then a sudden deceleration, and cuts the fuel before the disc can reach burst speed. It was on the whole Trent 900 fleet by December 6, 2010, and EASA AD 2010-0262 made it mandatory on December 13.

New pipes were held to a tighter production limit of 0.028 inch (0.70 mm) from December 2010. In 2011 Rolls-Royce tightened how design and manufacturing engineers agree on references, added a statistics expert review to concessions, and brought senior approvals forward. It later reclassified the bearing support from “unclassified” to “reliability sensitive”.

Airbus fixed the calculator. A software update released to A380 operators on October 4, 2011, made the landing distance result consistent whatever the weight, so an emergency crew is not told “no result” when the runway is long enough.

One change has not reached the FAA’s books. The ATSB asked EASA and the FAA to fold the VH-OQA damage into their guidance on surviving an uncontained rotor burst. The FAA still lists that guidance, Advisory Circular 20-128A, as active in its March 1997 edition.

Qantas 32 belongs next to United Airlines Flight 232, where a flawed fan disc also burst and a crew landed an aircraft its designers never expected to fly. The difference is that QF32 had the redundancy to survive, and the industry learned its lesson with no one hurt.

Like US Airways Flight 1549, it is remembered for the crew. The report’s harder lesson is about a factory: a defect seen, measured and signed away. It is one of the flights that changed aviation without a single fatality.