What an on ground American Airlines B767 rotor burst at LAX and an in air A380 engine failure have in common and why this is a problem for the FAA
On the 2 June 2006, an American Airlines B767 experienced an uncontained failure of the GE CF6-80 high pressure turbine (HPT) stage 1 disk 2 in the No. 1 (left) engine during a maintenance ground run at Los Angeles International Airport (LAX), Los Angeles. Although no personnel were injured the aircraft suffered significant damage.
While the focus of the subsequent investigation was on the defect that initiated the failure, rotor bursts during ground runs also provide us with critical data as to the size of rotor fragments which is often missing from in-flight events. Having recovered the rotor fragments we can use this data to correlate fragment size with the level of damage caused, and in turn validate the set of design rules and their underpinning assumptions that are intended to mitigate the effects of rotor bursts.
The NTSB post incident investigation found that the HPT1 stage 1 disc had ruptured into three approximately equal pieces and a smaller triangular piece. One of the major pieces hit the aircraft directly, one hit it on the rebound while the third major piece was found about 2,500 feet away. Referring to AC 20-128A the FAA circular that deals with such matters, section ten requires a safety analysis to be conducted to evaluate the consequences of an unconstrained rotor failure. The model used a simple three tier debris model which assumes:
- a single 1/3 rotor disc (by mass) fragment thrown within +/-3 degrees of rotor plane,
- a single 1/30 rotor disc (by mass) fragment within +/-5 degrees of rotor plane,
- Small fragments liberated within +/-15 degrees of the rotor plane
The circular allows a single 1/3 rotor fragment thrown within +/- 5 degrees to be substituted for scenarios 1. and 2 above so as to simplify the analysis. So in practice only a single large rotor fragment need be considered. The only problem with this approach is that the model does not reflect reality. In contrast to the assumptions of the model in both the AA B767 and the QF32 incident each aircraft was hit by multiple large fragments. In the case of QF 32, the passage of large fragments through the wing also generated significant secondary high speed debris that peppered the aircraft fuselage above the wing. By definition the failure model advanced by the FAA does not deal with a more than one large fragment scenario (as seen in both accidents) nor does it address the possibility of high speed secondary debris being liberated.
If we consider the dynamics of a rotor burst purely as a matter of logic, when one third of a rotor is liberated as a fragment then the remaining two thirds will fly off as well. So why should we assume in a safety analysis that the aircraft will always be hit by the smaller segment? Likewise why should we assume that only one unitary fragment would strike the aircraft, when in both incidents more than one large rotor fragments actually hit the aircraft?
Unfortunately the circular does not advance any statistical argument to justify the selection of a 1/3 rotor fragment size. If such an argument had been developed then this would need to be included in any subsequent risk assessment by the aircraft designer. What the assumptions made by AC-120/28A actually appear to be doing is subtly shifting the rotor burst safety analysis towards a ‘single point of failure’ fault hypothesis, thereby simplifying the burden of development and containing the scope of damage tolerance required of aircraft systems. There also appears to be a subtle shift towards a less than worst case rotor burst scenario.
The damage experienced by both aircraft also calls into question the conclusions of the AIA working group on rotor burst threats (AIA 2010) that system damage will only occur within the near to the engine zone and that wing, nacelle or other heavy aircraft structure will provide some level of effective shielding against larger fragments (3).
My conclusion from reviewing the circular and the associated AIAA study is that a single large fragment model was developed to be consistent with the dominant no single point of failure paradigm of the aviation industry. Unfortunately reality tells a different story.
1. AIA Working Group, AIA Report On High Bypass Ratio Turbine Engine Uncontained Rotor Events And Small Fragment Threat Characterization Volume 1, January 2010.
2. Blakey, M.C., Safety Recommendation, NTSB Letter reference A-06-60 through -64, 28 August 2006.
3. Federal Aviation Administration (FAA) AC 20-128A Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure, 25 March 1997.
1. Defined by the AIA report as being within two nacelle diameters of the engine centerline.
2. Material pulled off or wrenched roughly away.
3. The working groups conclusions are also qualified as ‘some’ and ‘some significant…’, with no clear definition of what these qualifying terms mean. Such qualifications make it difficult to establish what was meant and therefore disprove the hypothesis in a meaningful way, a significant shortcoming of the report.
4. Prior to this accident on 22 September 2000, a US Airways Boeing 767-2B7(ER) airplane, N654US, equipped with GE CF6-80C2B2 engines also experienced an uncontained failure of the HPT stage 1 disk in the No. 1 engine during a high-power ground run for maintenance. A 140 sq. inch, 45 lb portion of the HPT stage 1 disk penetrated the left wing just inboard of the No. 1 engine pylon passed through a dry bay, made a 1-inch-wide vertical cut through the lower half of the forward wing spar, and penetrated a fuel tank before exiting through the top of the wing and passing over the fuselage.