What you don’t know can ABSOLUTELY hurt you

When QANTAS Flight 32's No.2 engine exploded in 2010, it came close to killing all 469 on board, it cost Rolls-Royce, Airbus, and the airlines Hundreds of Millions of Dollars, and, ironically, it likely saved the A380 type from suffering a similar fate as that of the 737 Max.

What was this unrelated problem that surfaced because of QF32? It was a novel failure mode in the aluminium chosen for parts of the wing structure.

Whilst the story behind the link between QF32 and wing structure is fascinating, even more important is learning the lessons that will prevent similar mistakes in the future.

A Cautionary Tale

On the 4th of November 2010 QANTAS Flight 32, A380 VH-OQA, was climbing out of Changi Airport, Singapore, when it suffered an uncontained engine failure of its Number 2 engine, a Rolls Royce Trent 900. The resulting damage to the wing and aircraft systems was so extensive that, arguably, only the superb flying skills of all FIVE crew [1] in the cockpit were what prevented the incident from ending in tragedy.

I will not be discussing that incident here [2]; however, it was this event that I argue also saved the A380 from suffering a similar fate to the 737 Max. Why? Serendipity. The destruction of the QF32 No. 2 Engine’s Intermediate Pressure Turbine disc punctured the wing box in multiple places and the subsequent repair of VH-OQA (the most expensive in history at ~US$145 million), required extensive reworking of the wing structure. During this repair [3] the engineers found unanticipated cracks in the wing ribs; in an aircraft that had been flying for just over two years.

Airbus instigated inspections of other A380 aircraft and found more rib cracking. These cracks were in the feet that attached the ribs to the wing skins (see?below), and alongside more conventional cracks they found something unusual; the rib loading mechanism meant that any cracking would be expected to nucleate in the inboard-outboard direction, but these feet were cracking fore-aft. It was a puzzle. It was also a prelude to a massive safety issue.

Useful Infographics from Graphic News

Airbus issued Alert Operator Transmissions to operators to inspect their aircraft, and these were mandated by EASA under a series of Airworthiness Directives (ADs 2012-0013, -0026, -0114, and 2013-0108R3). Initially only higher time aircraft needed a one-off inspection ($). Then the inspections were extended to all aircraft and required internal High Frequency Eddy Current techniques ($$), and then the inspections were changed from one-offs to repetitive ($$$). Finally, Airbus created in-service modifications to remove the rib feet entirely ($$$$).

It is difficult to quantify exactly how expensive this was for Airbus. By November 2012 EADS was estimating €260 million in direct costs, but the overall costs may have been much higher in the end. ???

What went wrong?

Airbus famously had realised at the Preliminary Design Review (PDR) that it needed to reduce the weight of A380 by the mass of one of its single-aisle aircraft, if it was to be viable. The weight reduction program was extensive, and it included the development of new aluminium alloys [4]. Of these new alloys, Airbus and Alcan further developed type 7449 for use in the A380 wing ribs. Here they used 7449-T7651 for ribs and rib caps [5]. ?Unbeknownst to the engineers was that 7449 is susceptible to an Environmentally Assisted Cracking (EAC) called Hydrogen Embrittlement. This is where environmental hydrogen (from water generally) migrates to areas of high sustained triaxial stress in the metal and leads to cracking. So, cracks develop over time, and not necessarily because of cyclic loading. Hydrogen Embrittlement is relatively well understood for metals such as steel, but it was not generally known to occur for aluminium at these temperatures. Those certifying the new material evidentially did not consider EAC a plausible failure mode and did not adequately address it in their certification programme. ???????

Less well publicised, the A400M was suffering a similar problem. Airbus now had a certified material, and they had used it for the main wing support frames on the military transport aircraft. There is less information available in the public domain, but by 2016 there were news reports in Germany drawing attention to the issue, where Airbus said the problem was due to an aluminium alloy which exhibited a "previously unknown material behaviour" [6]. What is known is that Airbus was looking to change out the main frames on their entire A400M fleet, because it was suffering the same issue as the A380.

Serendipity

QF32 led to the finding of the problem, but the true serendipity was how early it was, just 2 years into service on the 14th shipset. This gave Airbus the crucial time it needed to fix the issue in a staged affair. The Guidance Material for 21.A.3B (covering when you need to ground aircraft during an AD Campaign) involves a fair bit of loose criteria and rough assessments of risk to be made by the airlines [7], and by design it allows for fleet aircraft to operate at significantly higher risk of catastrophic failure, for short time periods, than are allowed for a certified type [8]. This was the lifeline that Airbus needed. By demonstrating that the rib-feet cracking was predictable and that it would take some time to develop, they could inspect and modify during in-phase maintenance. It would be expensive but manageable.

On the other hand, if Airbus had been presented with a fleet at an advanced stage of cracking, which would have occurred if the rib-feet cracking had been found by normal maintenance, then the entire fleet would have been grounded for an extensive period of time as the issue was dealt with (See 737 MAX groundings). Whether the A380 would have ever flown again can only be, of course, a matter of conjecture [9]. ??

Lessons Learned

Answering the question, “What have we learned?”, is the reason for this article. Airbus understandably have not publicised the affair, and because it caused no crashes, its exposure in the media is minimal and the FAA cannot put it in their Lessons Learned library. But there are some big lessons here.

Every time a CVE assesses a certification programme for material characterisation and damage tolerance (CS 2X.57X, 2X.603, 2X.613, and others) they are making a judgement call as to what failure modes are relevant. For example, when AMC 20-29 is used to certify a composite component, the engineers have assessed which damage mechanisms are appropriate and they probe them and demonstrate robustness of the materials and the design. That said, there may be some broad-spectrum testing to validate the CVEs assumptions, but we all know that this is quite limited. For cost and time reasons one needs a REASON for a test.

So, if you are using novel materials, novel uses of materials, or significant differences in aircraft usage for the same materials, then consider that you may provide the opportunity for novel modes of failure. The hydrogen embrittlement of 7000 series aluminium was not well known during the A380 certification programme, but it was known [10]. Hindsight is 20-20, but environmental testing of rib-feet after the fact is known to have created significant results. Results that would have been unmistakable had the tests been carried out.

In this case a more comprehensive certification test programme might just have saved Airbus that GDP-of-a-small-nation worth of costs. Of course, hindsight is 20-20, but how many times has a CVE wanted to carry out a test but been convinced by the program to cut it because the material was already well understood? ???

Lightning never strikes twice

“Yes”, you say, “but this won’t happen on my programme”. True, Airbus was unlucky. However, they were pushing the envelope to get the weight down on their aircraft. Did they also push their luck? ?

To answer this, I can point to Air France Flight 66 in September 2017, coincidentally another A380. This one was flying over Greenland when its No. 4 engine suffered an uncontained engine failure (unrelated to QF32). This was not a Rolls Royce unit, but an Engines Alliance GP7000. The aircraft landed safely in Goose Bay Labrador, but the investigation was delayed for two years by the difficulty in finding the engine hub which had embedded itself in the Greenland icesheet. ?

When the incident investigation was released [11], it reported that the failure mode was due to cold dwell fatigue of the Ti-6Al-4V fan hub. This failure mechanism had been known since the 1970s [12], although not in-service for this alloy of titanium. It was, however, known internally by “an engine manufacturer” to be a potential issue for Ti-6Al-4V, albeit they hadn’t apparently communicated this fact with the regulators. It is relevant to note that since AF066 in 2017, a B777 and another A380 have suffered engine failures associated with cold dwell fatigue of Ti-6AL-4V [13].

The certification compliance for fatigue of the GP7000 used an FAA approved analysis tool, which was supported by test evidence [14]. However, the FAA approved tool used did not consider Cold Dwell effects, and post-incident testing and correlation showed that there was at least a 6-fold, and likely 20-fold, unconservative error in the tool due to this oversight.

So, again, we have an unusual failure mechanism, but not an unknown one, that had not been considered at certification, and which completely undermined the certification process because of an unanticipated failure mode. ????

Takeaways

1. The QANTAS Flight 32 incident arguably saved the A380 fleet from a long duration grounding. Whilst eye-wateringly expensive, it was orders of magnitude cheaper than it might have been for Airbus.
2. Novel failure modes are more common than you think, and to not recognise them during certification undermines that certification.
3. Novel materials and implementations demand more scrutiny during certification. To not do so exposes the public to increased risk of failure and TC holders with extremely expensive rectifications.

Fin

? Stephen Dosman, 2023. Unauthorized use and/or duplication of this material without express and written permission from the author is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Stephen Dosman and this site with appropriate and specific direction to the original content.

Footnotes

[1] The Captain, First Office, Second Officer, Check Captain, and Supervising Check Captain.

[2] For that see my article Black swans and fatigue failures.

[3] See QANTAS Flight 32 Airworthiness Directive and this Aviation Herald news story.

[4] Aluminum Alloy Development for the Airbus A380.

[5] My understanding is the change in material may have saved on the order of 50kg per aircraft.

[6] The Airbus A400m Cracks To Do. A400M ADs are not public domain, but EASA AD 2021-0021 and 2023-0097 “Fuselage - Frames 35, 36 and 37 / Inner Flange Upper and Lower Couplings – Inspection” may be related:

[7] See EASA soft law GM 21A.3B(d)(4).

[8] In fact, it was this allowance for higher risk which was the basis for the arguments used by the FAA, when they initially refused to ground the 737 MAX after the second in-flight loss in March 2019.

[9] Considering that without QF32 the problem would only likely to have been found at the first heavy-maintenance period (12 years for the A380, so around the year 2020), then not only would most aircraft be expected to exhibit cracking at that point, but the fleet would be more than twice the size of that in 2012/2013. There are insufficient worldwide repair facilities to carry out extensive modifications (Mods 68705 73685, 73686, as described in AD 2013-0108R3 Table 1) to over 250 of these huge aircraft simultaneously, so the backlog of grounded aircraft would last for years. By comparison, the 737 Max groundings lasted less than two years and are estimated to have cost Boeing $80 BILLION in direct and indirect costs (CNN). Given the current lack of appetite by airlines for new A380s, it is unclear how Airbus would have extricated itself from this pickle. To quote the Airbus CEO of the time, “We made a little mistake here and we are repairing it as quickly as possible” (Reuters). ???

[10] See this paper from 1996 for an overview of the state-of-the-art at that time.

[11] AF066 Investigation Report.

[12] Attributed to RB211 engines on a L1011 Tristar and on GE CF6 engines on several aircraft, but all with different Titanium alloys (Investigation Report IBID, para 1.18.5.4).

[13] Investigation Report IBID, para 1.18.5.1.

[14] Investigation report IBID, para 1.18.1.2.