Aeroengine Safety

Figure "Problems of maintenance manuals"

Figure "Transfer failures during maintenance" (Lit. 19.1.3-7): in these diagrams interresting differences of the influences on communication problems between personnel of different regions can be seen. This is especially true for the „humanly“ factors of the identifying feature A2-A6 (see the page before). Instead the most important identifying feature for all that is the demand for help (A1). This can be the identifying feature for a deficit, which the concerned person possibly does not want to show. Surprisingly is, that unsufficient English (B4) in Europe also compared to the USA, represents a minor communication problem.
To avoid communication problems in all cases a translation is most effective (C1). A consistent terminology (C3) is outside the USA obviously especially important.

Illustrations 19.1.3-3.1 and Ill. 19.1.3-3.2 (Lit. 19.1.3-1): this accident can be traced back at unsufficient work documents during overhaul.

Concerned is a fan engine with small bypass ratio, as this is for elder engine types usual. The compressor disks consist out ot a corrosion resistant Steel. But this is sensitive to pitting corrosion (volume 1 Ill. 5.4.1.1-3). As corrosion protection a nickel-cadmium (CD) coating is applied of which the nickel layer shall prevent a damaging direct contact of the cadmium layer with the base material (volume 4 Ill. 16.2.2.3-11). If it comes in spite of this to corrosion pits (Fig. "Description of technical terms") they have a high notch effect and reduce unacceptable the vibration fatigue strength just in the life determining bores. So they they have to be suitable removed during overhaul, before a new protection coating is applied.

The investigations after the accident showed, that the 7th high pressure compressor stage (sketch middle right) was multiple fractured. From the fragments only 2, of which one belonged to the half of the disk, were found in the destroyed casing of the acessory gearbox . The triggering crack obviously started from a stress reliefing bore “SR1” (stress redistribution hole = SR hole, Ill. 19.1.3-3.2). The fatigue crack (LCF) propagated from up to about 0,1 mm deep corrosion pits, which were covered with a Ni-Cd-coatingt. This prooves, that according to the overhaul of the OEM there have been forbidden pittings even before the last overhaul. The crack runs radial inward and at the outer side up to the calculated overall critical crack length (volume 3, Ill. 12.2-3 and Ill. 12.2-7) of about 40 mm (detail bottom left). The fracture analysis resulted on the basis of the crack propagation lines (striations, volume 3, Ill. 12.2-6), that already at the overhauls years before at 4 400 start-stop cycles a crack of about 12 mm length must have existed, which therefore must be classified as detectable. From these indications the former overhaul at the operator must be evaluated as follows:

• The, at the inspection existed crack length shows, hat no suitable test was accomplished. The responsible for the overhaul primarily ascribed this, that for a tet according to the manual of the OEM, only the bolt holes on the same pitch circle, but not the stress relief bores were mentioned (see deficits in the overhaul manual). Later was declared, that the stress relief bores indeed have been tested, but with an other standard than the tensioning bolt holes. This tolerates single surface defects up to 0,075 mm without repair.In contrast the overhaul manual of the OEM forbids not repaired surface defects in the holes/bores and 3 mm around at the neighboring surfaces. If there is an obscurity about the stress reliefe bores the operator should have called back at the OEM.
  

But also the manual of the OEM exhibited deficits:

There a disk is shown with only 12 instead the actual 24 bores.
Texts in the manual can be interpreted, that defects up to 0,075 mm don't need a rework. In spite this failing the definitely instruction in the manual persists, that no defects are allowed in or around the holes/bores.

• The disk, made of an tempering steel, is crack inspected at an overhaul magnetic test under the UV lightwith fluorescent particles. Thereby inevitably the surface near regions of the bores/holes are also tested. The narrow distances of the different bores virtually force its consideration at the test without exeption. The crack in the bore and at the disc surface schould have been thereby sufficient visible. That allows the conclusion, that the operator did not execute at the last overhaul a suitable crack inspection.Because the engine manual was available in English, the OEM demanded already at the overhaul 4 years ago process sheets (work cards) in the language of the operator (see also Fig. "Transfer failures during maintenance" and Ill. 19.1.3-3.3).
  

Illustration 19.1.3-3.3 (Lit. 19.1.3-1): Usually the instructions in the manual are transferred into process sheets (work cards). They should be written in the native language. Such an approach is applied for maintenance tasks and, like in this case, for repairs in line of an overhaul. The sheets assign detailed the single work steps. Thereby they describe sufficient detailed the specific sequences, repair processes, and the existing, for the activities necessary shop equipment. Every of this steps demands the signature by the maintenance personnel. The steps should also contain cross references at the particular spot in the overhaul manual. So also the correct use of the process can be guaranteed.

Such a documentation improves also the airworthiness proof of the parts for the assembly.
For the last overhaul before the accident (Ill. 19.1.3-3.1) those claims were not implemented. The investigation comes from, that a higher individual responsibility in terms of signatures for the single steps makes this more possible. This motivates a complete execution up to the end.

The review in line with the clarification of the failure also showed, that some other parts were labeled as penetrant inspected with a green wire, but such an inspection had not been carried out. Similar is also true for the magnatic crack inspection.

Such a conclusion was possible, because those parts did not show fluorescent particles, which should be expected after the inspection with fluorescent magnetic particles.

So the necessary detailed documentation for such an stepwise overhaul process lacks.

At such compressor disks obviously in all but a unexplained case of an other operator, never such a failure emerged. This case could have been from the current point of view a parallel case. Also the cracks seemed to be never found. With this a certain frustration if then inspection personnel could have been developed (volume 4, Ill. 17.3.1-9). So the question after a suitable, motivating training for these processes emerges. The operator had for this no convincing verification documents.

Figure "Description of technical terms" (Lit. 19.1.3-12 and Lit. 19.1.3-13): from mechanics and inspectors the identification and evaluation of failures/defects will be expected (Fig. "Maintenance specific trauning" and Fig. "Job descriptions of repairers").

The meaning of such knowledge will be demonstrated with the example of pit like surface damages. Such pits/pittings, here for example at the inner race/ring of an anti friction bearing, can be based on very different failure mechanisms (chapter 23.1.1). Thereby entirely different remedies can be required. A correlation, e.g., to descriptions in the manual, can afford the differentiation. This needs a not to underestimate degree of definition sureness and expertise. Terefore the term pit/pittings is not sufficient for a correlation and should always be used with a characterising adding.

Fatigue pits (obove left): they develop at the race tracks (roll off surfaces) by overrunnings. A typical failure mode shows features of a fatigue crack surface. Flat metal particles (chips) develop. They are for bearing- or gear failures an important early indicator. During maintenance found filter residues of debris at the magnet plugs frequently show the failures sufficient early, before a catastrophic component break down (chapter 22.3.4).

Corrosion pit/pittings (above right): this deals with local corrosion attack with its notch effect. The ground of those pits therefore shows no fracture surface, instead a, by reaction products coated or an etched structure. Those pits reduce the fatigue strength of the concerned component and are therefore the origin of fatigue fractures (Ill. 19.1.3-3.1).

Electrical pitting (melting craters, initial fusions, middle left): those failures/damages on rolling surfaces are frequently the result of a electric continuity, e.g., during a lightning (volume 1, chapter 5.1.3). Also incorrect welding can trigger such damages. From those deteriorations can spread fatigue failures. The arrangement and the typical appearance is that of a crater with features of melting/fusing (volume 4, chapter 16.2.2.6).

Indentation pits/pittings (middle right): this damage normally is caused by foreign objects, that get between the rolling surfaces (race tracks). Foreign (and own) objects can be transported by the oil into the lubrication gap, or as dust and labyrinth abrasion blown in e.g., by sealing air. Such indentations are the origin of fatigue breakouts (chapter 23.1). Typical feature is a plastically deformed ring zone around the indentation. This is the flat rolled bulging.

(Vibration-) brinelling pits (bottom): those shallow, smooth deepenings in the roller/ball distribution/distance are produced by micro movements (fretting) during stand still, for example during transport (Fig. "Causes of brielling on bearings"). Also they can trigger fatigue breakouts.

Illustrations 19.1.3-5.1 and 19.1.3-5.2 (Lit. 19.1.3-14): from the investigation resulted, that a crack brought the combusion chamber outer case (= CCOC, sketch in the middle) to rip. Such failures are not a single case for the concerned engine type (Lit. 19.1.3-10, Fig. "Operation load limiting repair of casings" and volume 3 Ill. 11.2.2.2-9). The explosion happened during high operation loads at the start (inner pressure, intrenal stresses) when the critical crack lenth was reached. The crack started in the region of a bore in the rear, to the inside orientated casing flange (detail at the bottom) as (LCF?) fatigue. Than it grew intergranular about 40 mm. After this an about 90 mm long LCF fatigue fracture followed from which the residual fracture as a forced fracture started. Tille to the residual fracture the fracture surface was heavy oxidised.

Formerly already comparable failures occurred. Therefore several Airworthiness Directives (= AD) have been issued by the FAA during the time of 5 years before the accident on hand. They determine the inspection intervals on the basis of start-stop cycles (compilation at the right). Additional the casings had to be tested/inspected at every shop visit of the engine. Concerned were besides the flanges the as critical identified zones of the part as welded fixing eyelets for the pipe lines. The test has to be carried out during a shop visit because extensive disassembly work was needed. Eddy current, ultrasonic testing, penetrant inspection, magnetic particle inspection and a visual inspection were scheduled. Casings with a crack had to be eliminated.

About five years and ca. 7500 cycles before the described failure an inspection took place. In the time between the engine was two times in the repair shop. In both cases no control of the rear flange for cracks took place because there were sufficient cycles till the end of the inspection interval. This, although at the second shop visit the welded fixing eyelets have been inspected. After about 2000 further cycles the failure occurred.

Execution of the AD in the repair area:

the mechanics work after process sheets/work cards (engineering orders = EO). These have been issued by the operator under supervising of the responsible administration on the basis of the ADs. The cards contained informations about the due repair work as well as periodical inspections. But not the instruction for the inspection of the flanges at every shop visit of the engine. The inspectors and mechanics signed indeed the process sheets/work cards for the necessity of a testing. However there lacked instructions about the extent of the inspections and the applicable method. An EDP notation merela confirmed, that a test took place and the number of cycles to the next inspection. In the case on hand no mechanism existed, which controlled once again the actuality of the test requirements.

So the wrong interpretation of the AD lead to this, that the both scheduled shop visits, which could have avoid the failure, were not used for the rather prescribed crack inspection.

Fig. "Accident by maintenance deficits" (Lit. 19.1.3-15): After the accident a first investigation showed a dry oil sump of the power turbine. Unfortunately therefore no steel chips were transported by the oil to the magnatic chipdetectors. They would have warned before an engin failure. The oil deficiency caused the dry run of the bearings number 6 and 7 (lower sketch). Those overheated the neighboured components. That lead to the interruption of gas generator turbine and compressor.
The construktive design of the T-connection (detail in the midle) and the course of the radial fresh oil line through the hot struts of the turbine intermediate casing favour oil coke. This is removed as good as possible with a drilling process during the 300-hours-inspection. In the case on hand obviously coke flaked off and blocked the oil jets. The oil coke formation seeme too fast for the scheduled operation hours since the heavy maintenance of the engine. This points to the cause that during the overhaul coke had been left. The investigative administration deduced from this the following causative influences:

• Indeed, during the overhaul the carbon seal of the bearing 5 was detatched, and oil coke removed out of the scavenge oil line and the scavenge oil sump. Than the engine was turned, to guarantee the oil flow.The oil jets of the bearings 6 and 7 and the T-connection were against the operation manual and the overhaul manual from the OEM not removed and cleaned from coke.
  
• The unfavourable construktive design of the fresh oil supply favoured a dangerous coke formation. No suitable filter cartrige exists in the line before the oil jets. Later versions have been appropriate retrofitted.
• The by the OEM specified cleaning process does not sufficient describe the inspection for coke formation and removing the coke in the line.
• Unsuitable cleaning of the T-connection during overhaul and during the two following field inspections.

Figure "Development of a maintenance manual" (Lit. 19.1.3-4): technical books (Lit. 19.1.3-8) are addicted to the theme of the creation of manuals. The here shown scheme shows the typical process and its phases. Its about an iterative process, whose significant step is the feedback of problems from the user with the documentation. So misunderstandings between the intention of technical authors and the after this working mechanics (aircraft maintenance technicians = AMT) can be detected and corrected. Additional safeguards are :

• Inspection of the execution on site.
• Cognitive walkthrough of the tasks and their execution (chapter 19.1.1). By this, the faults and weak points of the documentation will be discovered in different manners:
  
• Experience and training. The results depend from the experience and education of the attendants (engineers, mechanics, Fig. "Job descriptions of repairers").
  
• Faults during approach (e.g., sequence, process).
• Faults as cause of language/speech problems (e.g., clearness and sense , Fig. "Transfer failures during maintenance").The development process of manuals (maintenance manual, overhaul manual, repair hand book/mauual).
  

The new manual/hand book: manuals because of their importance for operation respectively the flight safety, are based in the first line on experience. Threrefore a manual develops evolutionary, i.e., it uses the established form and the suitable content of manuals of former series/types. Therefore it is essential, that the operation loads and the part/component behaviour of the new device, are sufficient known und comparable. Especially for aero engines already here is a difficult noticeable obstacle. For the behaviour of the engine and its components during testing and operation (see volume 1, Ill. 3-2) basic principle is applied:
„The engine will tell us!”

This means that the durability as well as maintenance and repair with their limits in a narrow frame can be applied for the particular engine type and its specific application. Those limits are not sufficient analytical acessible and known. Let us think about tolerable or repairable foreign object damages at compressor blades (chapter 21.2-6 and volume 1 Ill. 5.2.1.1-9). Already variants of the same engine type can unexpected considerably differ in the load of the components like vibrations, temperatures respectively thermal stresses or wear. This is also true for manual editions. The tendency of increasing service loadings with engine speeds, temprtatures (volume 3 Ill. 11.1-6), aerodynamic loads respectively pressure ratios and warranted operational life makes this negotiation always more risky. Those are at the beginning, when a new engine type is introduced, very tight conceived and can be widened with increasing experience from the feedback For this serve the „fleetleaders“, engines with longer operation time.

Basically the authors of manuals should be trained. Thereby especially the proving of the manual at the user must be practised.

Technical author, authors of manuals/handbooks: Normally manuals are issued in responsibility of the OEMs. They need for the inevitable evolutionary creation ot a new manual much experience and expertise. These are preconditions to make sufficient certain designations about failure modes and their limits. The author must have sufficient professional basic knowledge about the realm he has to cover. Intensive contacts to the specialist department like design, engineering, „stress people”, materials department and process engineering, repair, maintenance/overhaul and cusomer service seem essential.

Proofreading and revision has been made by the tangented specialist departments. Even a juristic survey (product liability) is to advise. Also without a consultation of the operator (user, Fig. "User relevant development of a maintenance manual") this will hardly be successful. Concept and layout of necessary technical sketches and the selection of the pictures/photographic images (for example for the identification of typical failures) are a further task.
The publication of the manual takes place with a validation.
Reviews of the Manual result predominant from the feedback of experience in the serial operation, especially from maintenance and repair. A special importance in this process have the operators/users. Their systematic involvement into the development of the manual shows Fig. "User relevant development of a maintenance manual". The process of necessary iteration steps is scheduled and leads to revised versions. It is a particular task, to document respectively update at time the valid edition of the manual at all users.

Figure "User relevant development of a maintenance manual" (Lit 19.1.3-4): The user as operator and performer of maintenance and repair/overhaul has a key position in the development of appropriate manuals. Already before the introduction and the collection of experiences with the use of the manual, an integration of the user must be assured. An essential step in all phases is the assessment in the applicatory test. Findings from this must flow back into the development process and when indicated permit an iterative optimisation.

Figure "Safety risk by not reported manual problems" (Lit. 19.1.3-5): The safe utilisation ot he manuals depends essential from the iterative improvement. Therefore it is from special interest, how often this chance is utilised. That even in 15 % of all cases sufficient certain a feedback occurs is alarming (Fig. "Consequences of manual problems"). The information of the users about the importance of their response demands especially für their work training and motivation. At reasons for not happened feedback it can be suggested from the Illustrations 19.1.3-10, 19.1.3-11, 19.1.3-12.

Figure "Quality of maintenance manuals" (Lit. 19.1.3-5): This, rather generally impression of the user can be applied for naintenance manuals which are compiled by the four big aircraft manufacturers. The diagrams, especially the by intermittent lines represented evaluation let suggest a rather positive assessment about the general quality of the maintenance manuals. The detailed, critical opinion of the mechanics (AMTs) gets obvious in Fig. "Evaluations of maintenance manuals". Comparing small and large aircraft manufacturers quite differences can be seen (details see the indicated literature).

So it's not about aircraft engine manufacturers. However also for those, this evaluation can give important hints.

Informations about the evaluated parameters:

Usability: Included are the simplicity of the use, the compliance with the tasks, the distinctiveness of the tasks as well as the depth of the informations.

Quality: Although differen development strategies are used for the compilation of the manuals, their evaluation is still very similar. The translation of a manual into the english language seems in contrast problematic and resulted in clearly worse assessments.

Illustraion 19.1.3-11 (Lit. 19.1.3-5, Lit. 19.1.3-11): Besides the general, astonishing positive evaluation of the manual quality in Fig. "Quality of maintenance manuals" this picture also includes the assessment of the main noted deficits. The diagram at the bottom stands for an aspired optimal estimation. The intermittent curves should serve to facilitate a comparison.
It must be advised to resume the appraisals uncritically. The experience from similar situations, for example if there is asked for informations in the daily office routine from superior positions, shows a likewise evaluation. Is this too positive, this can also be problematik for the evaluator. That would seem a blunder more serious in connection with a manual. Therefore evaluations which are in detail justified are more helpful. However, the literature on hand lacks of such informations.

Fig. "Optimisation of maintenance manuals" (Lit. 19.1.3-5): This concerns recommendations of questioned maintenance mechanics, which are here analogously reflected. Those can definitely be helpful for a practice suitable creation.

Figure "Consequences of manual problems" (Lit. 19.1.3-5): Problems with manuals/handbooks have for the utilising practitioners different influences. The diagrams show the evaluation of the answers from a questioning of the maintenance personnel. For an assessment we must be clear on, how seldom an IFSD (in flight shut down) may be occur. Therefore there only a very small probability is acceptable for safety relevant problems (page 19.2-1 and volume 1 Ill. 2-7). For example the likelihood of disk fractures must be under one in 1 000 000 000 flight hours.

„A“ (I make it better than in the manual stated): Obvious failings in the manual where quite identificated, but not revised. The assumption is obvious, that at last the necessary feedback is missing. The comment let suggest a certain presumption, which can be dangerous if there is inexperieence.

„B” (components/parts will be damaged): This can only be about recognised cases, where a counteraction took place in time. Such a situation obviously occurs seldom, but has a especial high risk potential (chapter 19.2 and chapter 23.4.2).

„C“ (not correct mounted components/parts): Those problems are especially safety relevant, because a relative high percentage of such cases will be discovered not until a malfunction (chapter 19.2). Will the same failure be made successive, this can have as consequence the outage of several engines at a singlr aircraft (Fig. "Nightshift problems", Fig. "Simultaneous maintenance work" and Fig. "Maintenance error leading to engine failure"). To minimise this danger, equal maintenance work will be carried out at different maintenance dates at any one time (Fig. "Reduce risk of simultaneout maintenance work 2").

„D” (components/parts were not correct adjusted or attached): This problem is, measured at the danger potential quite noteworthy. For example this is also true for tensed or rubbing pipe lines, depending from their function. Tensioned pipe lines/tubes especially under fretting wear tend to fail by fatigue with catastrophic secondary failures (chapter 23.5.1). By wear damaged electrical lines can fail to transfer function necessary signals, damage other components by spark formation or, if there are flammable emergent media, ignite a fire.

„E“ (I make it my way): this frequency scale approximates „A”. It seems not logic, that he who believes he can resolve the task better than the manual demands, also tends to perform the task in his way. The risks of this behaviour resemble well those described in „A“.

„F” (help from a collegue): This approach must be valued positive. Does it yet minimise potential risks. Therefore we would wish a higher frequency of the percentage from „often“ and „very often” . The utilisation of such a chance depands not at least from the corporate culture and the self assertiveness with a sound self-criticism of the personnel (Fig. "Transfer failures during maintenance"). In this case improvements can be expectated from motivating training.

„G“ (objection, guilt): It can be count as experience, that a „punitive management” does rather motivate negative. So the danger arises, that because of the fear to get punished important informations for remedies and measures are omitted. So a modern management control the „tightrope walk“ to motivate positive, eben at blunders witout to abet a „jog trot” with indulgence. The diagram shows a behaviour that is to evaluate positive. Apparently the solution is standing in the foreground (percentage of „often“ and „very often”), not the punishment.

„H“ (no flight standard): This problems must be seen as extremely grave. Even if they are found in time, this is alarming. So it is still to reckon with an „outgoing”. That means, there must be expected failures, even when this are only few, which find their way into the flight operation. In this direction points, that the percentage from „often“ and „very often” is indeed low but not zero.