Aeroengine Safety

Figure "Assembly fault causing exit of fragments" (Lit.20.2-1): About 9 minutes after the start in a hight of about 1 900 meters the rim of the 2nd stage high pressure turbine disk (left frame) of one aeroengine separated. Fragments punctured the turbine casing and the aeroengine nacelle. Also the fuselage and the neighbored engine became damaged. The shut down of the engine followed. In the failure area a fire developed which however could be extinguished. Afterwards a landing without problems was carried out.

The aeroengine had not more than 267 hours total operation time with 58 start/stop cycles.

The following investigation showed:
The bladed rim was ripped off over the whole circumference. In the upper quadrant the turbine stator in front had been slipped out of the fixing notch in the turbine casing (left frame). This proved as result of a faulty assembly. So the inner shroud of the stator could move backwards during the start under the high gas loads. It came to the contact with the 2nd HP-rotordisk. Thereby a circumferential notch developed (volume 2, Ill. 8.2-21.1 and Ill. 8.2-21.2) which weakened the bearing cross secction in a manner that the disk rim ripped off.

It was noticed, that in the concerned quadrant of the stator, the threads of the fixing bolts protruded markedly less than usual from the mounting flange (detail down right). Obviously the studs of the vanes did not already sit in the fixing notch during the assembly. Instead they rested on the centering flange. So the bolt ends did not protrude as far as usual.

Before, the high pressure turbine module was reworked at the disk by the OEM. There have been written and illustrated explanations for the assembly. However in these the assembly process was not described. For the 30 vane segments 90 fixing bolts had to be tighend. Also the devices to check the dimensions, especially the axial clerances, had not been provided. With those the chance existed to notice the fault after the complete assembly.

Anyway everything looked like a single case, the following measures and recommendations were made:

• Inspection of all assembly documents and sequences of the critical joinings at comparable turbine modules.
• Inspection of all documents about rework at turbine modules, joinings and centrings.
• Immediate check of suspect aeroengines. In case of doubt those must be at once removed from operation.
• From the responsible aeronautical authority a X-ray test was demanded (Ill. 25.2.2.2-5), with which it is possible to identify if the turbine stator is accurate assembled.This must be applied to all aeroengines before the mounting on the wing.
  

In a „sampling program“ 10% of the aeroengines with less than 100 operation hours must be inspected within the next 100 operation hours.

Figure "Assembly caused engine separation" (Lit. 20.2-3): This catastrophic flight accident can not be dirrectly traced back to the mounting of the aeroengines at the airplane (Fig. "Removing an engine for maintenance"). It is causative associated with the mounting of the engine supporting pylon on the wing. This work is carried out during the maintenance.

At critical point during the airrcraft rotation at the start (volume 1, Ill. 2-12 and Ill. 2-13) the mounting failed. By reason of its thrust the aeroengine swung around the leading edge of the wing (upper sketch). Thereby the control flaps of the wing have been damaged. Additionally to the lacking thrust at the wing a not by the warning system indicated stall occurred. The airplane tilted in a height of about 100 meters to the left. It hit a field over the wing and fuselage tip.

Figure "Removing an engine for maintenance" (Lit. 20.2-3): The in Fig. "Assembly caused engine separation" described catastrophic flight accident was essential promoted from the susceptible design of the pylon mounting on the wing. Contributory was the unsufficient supervision by the responsible aeronautical authority. So the unsuitable maintenance procedure was not identified, though already former cases of damages during the same maintenance process had been occurred.

Accordant to the maintenance manual of the airplane by the OEM, first the aeroengine must be removed from the pylon. Then the detachment of the more than 900 kg heavy pylon from the wing must be carried out. The position of its center of gravity is about 1 meter in front of the front mount. Pylon and aeroengine weigh together almost 7 tons with a center of gravity position about 3 meters in front of the front mount. For a number of aeroengines the maintenance procedure of the pylon mounting with a mounting and dismounting was pending.

Therefore the OEM issued an engineering change order (ECO) which described the maintenance procedure. This procedure obviously was not sufficiently tested and differed significant from the primarily approach. This planed to lift the aeroengine with the pylon as a unity with a fork lift into the mounting position. So 200 man hours per airplane (2 aeroengines on the wing) can be saved. Thereby even the safety will be improved, because the separating and connecting of pipe lines and cables is not necessary. Other operators use for this assemvly version instead of the fork lift an above positioned hoisting device. As support for the aereoengine the lower part of the transportation container was used. In that the aeroengine can be shifted axial about 30 cm into two selectable positions. So a deviation of the center of gravity can be adjusted for two different aeroengine types. The fork lift was equipped with a force measurement facility. This was used during the dismounting in optimising steps (trial-and-error principle), till the front mount was loosened. To loosen the rear mount, the fork lift had to be new positioned. This was even more complicated, because the distance from the mounting point to the fork lift was about 5 meters. In this case the loosening of the mounting bolts required a high force and for the receptions existed a high danger of damaging. The danger increased if first the rear mount was loosened because of the leverage effect due to the front mount which acts as center.

If the change of an aeroengine with help of a fork lift is closer considered, a multitude of possibilities of a dangerous forced contact arose between the mount components at the wing and the pylon. Because of the very narrow tolerances between the moving parts, the maintenance personnel had to act extremely cautious. A little fault of the fork lift operator could cause dangerous damages on the bearing structure. Obviously cracks up to 15 cm length could develop by the leverage effect round the mounting hinges. These could grow during the operation till instability (forced fracture) occurred.

Fig. "Consequence of an assembly mistake" (Lit. 20.2-4): A check up investigation of this flight accident showed, that the power turbine has separated from the propeller. A planet gear in the propeller gear was broken. It created considerably secondary failures. The freed power turbine triggered a runaway and all rotorblades separted. The whole failure mode permitted the conclusion, that the journal bearing bore of the plannet gear fixed liner/bushing had rotated. Obviously wire pieces from the oil screen in the hollow axle (detail below) came with the lubrication oil flow into the journal bearing. So the bushing was blocked and began to rotate inside the planet gear. An investigation of the oil screen region showed:

The oil screen featured a

• deformed teflon insertion,
• a jammed O-ring,
• a bent lip and
• fretting marks in the casing. This argued for a false assembly of the oil screen. The screen wires had vibration fatigue fractures. Partly they showed corrosion.
  

Obviously the assembly fault happened during the last overhaul several years ago. Already previous the OEM had possibily identified this failure type. Therefore the overhaul manual was revised 2 years before this accident, to make the assembly procedure of the oil screen clear. However the loosening of screen wires continue a threat. A periodically check of the chip detectors was obviously not sufficient. A continued display in the cockpit (annunciator system, Fig. "Monitoring particle formation in oil") would have been better.

Figure "Assembly caused fuel leak a nd fire" (Lit. 20.2-5 up to Lit. 20.2-7): The accident investigation showed as cause a high pressure fuel leak. It was located in the region of the fuel cross-over tube flange to the accessory gear (lower sketch). The thread inserts have been pulled out from the threads in the light alloy flange (detail below left).

Cause were imprecise instructions in a service bulletin (SB) of the OEM. Following these an overhaul shop had attached unsuitable thread inserts. The SB described a rework of the, obviously already as critical identified flange threads. So the reliability against fuel leaks should be improved. Reworked flanges had to be marked. So the description of the rework process in the SB promoted the attaching of wrong thread inserts.

An operator identified already 4 years before this accident, that the exchange-thread inserts had been obviously smaller than the bore and could simply slip through. At this information a modified thread insert was approved by the OEM. However the corresponding SB was not revised by the OEM. But the operator edited an add on to the SB.

In the meantime the flange of this later failure case was reworked in the repair shop, corresponding to the primarily SB. But the attached batches of thread insert did not correlate with the SB, they had been too small. Additionally the thread pitch was not right. Also this stayed unnoticed (Fig. "Error risks by different systems of units"). This allowed the loosening of the bolting and with this the fuel leak.
As reaction at the flight accident the OEM and the inspecting authority edited an „alert service bulletin” (ASB). It describes the singular visual inspection of a reworked manifold flange for the attaching of the right thread inserts. After this an airworthiness directive (AD) of the authority followed. The primarily SB was cancelled.

Comment: This case shows how intense the exact formulation and comprehensibility of instructions must be emphasised. There is a doubt if the problematic instruction was checked in a practical test before editing (Fig. "Development of a maintenance manual" and Fig. "User relevant development of a maintenance manual").

The chance to avoid such faults increases with the experience and the sensitivity of the assembly personnel. With this they represent an important link in the safety of aereoengines.

Figure "Engine failure by repair test rig and manual" (Lit. 20.2-8): The investigation of the aeroengine after the flight accident showed heavy destructions in the area of the combustor. In the plane of the 3rd turbine stage the casing was buckled to the outside by many hits, some did perforate it. For this the beneath running fractured blades of the 3rd turbine rotor stage have been responsibel. The fractures showed without exception features of forced fractures. The leading edges of the blades were damaged by a rubbing event with the brazed turbine stator in front (2nd stage, detail). The corresponding inner shroud area showed characteristics of heavy rubbing.

The brazing showed inhomogenities and flaws as well as a not approved window patch (repair) at the outer shroud. The serial number of the stator seemed to be changed. It did not conform with any of the OEM. Enquiries unfolded that this stator was about half a year before sent for the repair of cracks. However the executing company for crack detection rejected the part. So obviously a repair or the classification as suitable for operation did not occur. However the stator was reintegrated during an overhaul at the test rig few months before the flight accident. To this, the documents lacked. The notes of the operator and the OEM contained an other serial number as the part of the accident.

The certification run took place in a test rig wich was not approved by the OEM. So measurements, demanded by the OEM, could not be carried out.

According to those findings as cause of the accident the failing of the turbine stator which was weakened by cracks was determined as probably. The secondary damages let expect a heavy drop in performance without extinguishing of the engine.

Comment: The strength of e new part can not be expected from a repair solution (Fig. "Limits of welding and brazing repair"). Additionally the high load of a turbine stator by the gas forces should be known (Fig. "Limited inserted number of repaired parts") and remind for caution. Obviously this fact was not sufficiently aware. So the necessary caution/sensitivity could lack. This is expeciall true for the documentation of this quite critical component.

Illustrations 20.2-7.1 and 20.2-7.2 (Lit. 20.2-11): The investigation of the failed aeroengine allowed the conclusion that the failure developed in the region of the 1st stage low pressure turbine (LPT). At the flange (details below) of the turbine rotor typical features of an overspeed (rubbing as result of a plastically widening) could be seen. To this also fitted the decrease of the disk thickness (plastically contraction) in the region of the hub bore. All fractures and cracke showed features of forced fractures. Indications of fatigue could not be found. The overspeed of the LPT rotor could be plausible explained with a `shaft separation' (volume 1, Ill. 4.5-4). This happened after the 60 boltings of the flange

beteween 1st and 2nd stage failed. The bolt heads were heavy damaged and showed smearings of a tool steel. The failure mode suggested a longer operation time during which the steel fragments swirled free in the LPT rotor. So obviously a sufficient number of bolts have been damaged up to the failing.

In the aeroengine five heavy deformed pieces of tool steel (M-50) have been found. These could not assigned to an aeroengine part/component (e.g., anti friction bearing). They only could got into the rotor when it was opened. In the assembled condition this space is closed.
An identification of the tool was no more possible, because of the deformation at the rests of the foreign object.

In a time period of 2 years two similar failures emerged at an other operator and also one on an test rig of the OEM (Lit. 20.2-12). Obviously in these cases also a tool has been forgotten in the LPT-rotor drum.

Comment: The frequency of leaved tools, points at unsufficient „human factors“ during the LPT assembly. Thinkable is a bad visibility at the bolts. So the suspicion seems likely, that the socket of the screw wrench unnoticed stuck on a nut (Fig. "Design caused problematic assembly"). It could later came loose during operation. So it would be also explainable if after the assembly during slow turning of the rotor no noises have been heared.

Note: Unsuitable assembly situations caused by the design `almost tempts fate'. This requires an special attention from the technician.

Figure "Assembly caused failing of the fuel system" (Lit. 20.2-9): The aeroengine had about 530 operation hours since the last overhaul.

The spline toothing of the front coupling bushing from the axial compressor and the corresponding shaft (frame below) was worn. So no torque moment could be transferred to the shaft and the assessory gear.

Laboratory investigations showed the following features:

• The hardness of the nitrided coupling bushing was in ranges below the OEM specification. Obviously it was not correct heat-treated.
• In the coupling a slotted washer was installed, corresponding with the modification of the OEM. It was broken. With the washer the axial shifting clearance of the coupling bushing should be limited to 1 mm. So it should be avoided, that the shaft could move till the end of the bushing. The washer had to be renewed during every overhaul.
• The oil reservoir was overfilled with an oil-fuel mixture. In the coupling channels a grease like substance was found. It was a sliding grease (anti-seize) which was not sheduled by the OEM.
  

The overhaul manual describes an oil analysis (spectrometric oil analysis = SOAP) which must be carried out. Overruns the iron content a limit value, this is the sole reason, that an otherwise operational aeroengine is not allowed to carry on running. However this limit value was not exceeded. At repeated oil analyses several weeks before, a mean moderate content of low alloyed steel was determined. However with the analysis assigned personnel didn't sufficiently know the OEM instructions about oil contaminations and a dilution with fuel.

A prescribed vibration control (Fig. "Condition indicator using vibration sensors" and Fig. "Assessment of vibration measurement") some hundred operation hours before the accident showed no anomalies.

Failure cause: The location of wear marks in the spline coupling let suggest an unsufficient axial join joining of the coupling system. This lead to bending vibrations and to increased wear. Thereby the slotted washer got overloaded. So the wear conditions of the spline coupling further degraded. That the coupling lost engagement can be seen in connection with the unsufficient hardness of the new part. Not approved sliding grease may have been already at the assembly on the fuel tube. From there it was transferred to the teething of the coupling. So it may have prevented the, for an effective lubrication necessary, oil flow in the splines. With this the intended lubrication was affected what additional accelerated the wear. The oil analysis could not identify the failure in time because the limt value of the iron content was not overrun.

The fracture of the centric fuel tube can be interpreted as secondary failure.

Comment: This is an inpressive example for a chain of deficiencies which can lead to, respectively promote, an aircraft accident. In the case on hand to this belong the

• susceptible design (possible axial displace, slotted washer),
• faulty production of new parts (low hardness), the
• problems during assembly (axial positioning),
• incorrect sliding grease (anti-seize) and the
• ineffective monitoring (vibrations, oil analysis).

Figure "Problems with unproven versions" (Lit. 20.1-13): Both aeroengines with the connecting gear have been tested on an approved test rig. Equipped with the appropriate torque control unit (TCU) then did not behave as expected. Their rotation speed oscillated and they accelerated delayed. In contrast „contolled by hand” the behaviour was normal. Despite devided TCUs the problem continued. After that the speed control of the power turbine (Nf) was exchanged against several others with about the same operation time.

In those cases the drive behaved normal, with and without connected TCU. Compared with the exchanged controls the primarily attached speed control showed an unusual position of the control
lever. After that the levers of the control were brought into a normal position. Now the aeroengine was functioning normal. In the crosscheck with the `exchange controls' but with relocated control levers, corresponding with the failed aeroengine, the engine did not run normal.
An investigation showed, that during a maintenance the TCU was exchanged on demand of the operator because of torque oscillations. Because no subsitute was available, the OEM recommended to assemble a new „TCU version“. This was approved for a different version of the aeroengine type. In contrast to the original control unit the bleed openings of this TCU version were shut with covers. This influenced the control unit (Nf) of the power turbine from both aeroengines. Therefore the levers of the TCU have been adjusted, but this procedure was not comprised in the maintenance manual. The OEM cared for the necessary instructions. However this TCU version had no certification test for the aeroengine type of the accident. In this condition after 150 operation hours the accident occurred.

From this the accident cause resulted as following:

• The assembly of a torque control unit (TCU) which did not correspond the standard of the used aeroengine type required to adjust the speed control (Nf) for the low pressure turbine/power turbine. This not approved adjustment increased the reaction at the usual control deterioration/wear. This lead to the observed instabilities ond the performance drop.
• Fluctuations of the rotation speed and torque may already increase at normal wear a typical susceptibility of the actuated speed control of the parallel aeroengine.Comment: Especially attention at not sufficient tested components of deviant versions from an aeroengine type. Even seemingly trifles can get dangerous in combination with other components. To this belong typical (allowed) changes over a longer period of operation time.
  

Figure "Blade fractures by malfunctioning bleed valve": A malfunction of bleed valves can lead to dangerous problems. To those belong

• Compressor surge with the risk of an overload of the compressor blading, performance drop and an overheating of the turbine (volume 3, Ill. 11.2.1.2-1). A so called rotating stall (volume3, Ill. 11.2.1.1-1) which unnoticed means a vibration load of the compressor blading, can be even more perfidiously (volume 3, Ill. 11.2.1.2-6). A blade fracture as result can have catastrophic consequences.
  

Malfunctions of bleed air systems can have different causes:

• problems of the control system,
• mechanical adjustment problems,
• valve problems (e.g., contamination, Fig. "Importance of cleaning 1").
• operation caused problems (e.g., wear, corrosion)

Figure "Assembly influences at weak points" (Lit 20.2-2): The bginning of the failure was the fatigue fracture of the central gear (bull gear, frame below left). Gear wheels of this gear belong to the highest loaded. Since the introduction in the early 80ies it came in this connection to a multitude of failures. In several cases fragments escaped from the gear box or through the air intake. Thereby at times the propeller was hit. This centrifuged the

fragments what caused extensive damages at the airplanes fuselage. The OEM traced the failure back to an insufficient tooth contact pattern (Fig. "Tooth contact patterns at gears") of the bevel and the central gear (bull gear) which could have the following effect:

• Load buffets lead in the central gear (bull gear) of the planet gear to resonance vibrations (Fig. "Vibration fatigue at gear wheels"). As result of this dynamic overload it can come to fatigue fractures in the gear rim (sketch below right).
  
• Formation of fatigue cracks at the tooth root (Fig. "Failures of gear wheels") which propagate into the rim and lead to its fracture.Those failures are promoted by contributing influences:
  
• Changes in the production method/process lead to adverse tooth profiles. With this the load of the already highly stressed teeth increased.
• During the operation plastic deformations occurred at the divider wall of the casing. Probable it was creep (volume 3, Ill. 12.5-1) of the light metal alloy under high load and operation temperatures. So the bearings of the central gear (bull gear) have been shifted into the divider wall. This lead to an offset of the axis up to 0,150 mm. The result were edge bearers and increased flange wear (Fig. "Gear wheels failure mechanisms").
• The rework of the tooth profiles during overhaul (see remedies further down).
• Combination of not matched gears. First remedy measures (rework) have been introduced already 7 years before:
  
• Vibration damping at the gear diaphragm with a thermal spray coating underneath the gear rim. Thus the amplitudes of the different, dangerous vibration modes should be reduced.
• Shot peening (volume 4, chapter 16.2.1.6) of the tooth roots to increase the fatigue strength of high dynamically loaded zones.During the testing/proving of those „improvements” now new problems with the high speed pinion unfolded. Obviously this was about a so called „disimprovement“ (volume 1, Ill. 3-2 and Ill. 3-3).
  

The remedies apparently lead to a degradation of the bearing behaviour respectively increase of the tooth load.

The combination of used high speed pinions with reworked central gears (bull gears) was at the expense of the contact geometry and with this at the tooth load.

Operation experiences with the remedies showed that the rework reduced the number of resonance failures/vibranc ot the tooth rim. But now the unhardened splines of the coupling between bevel and aeroengine began to wear out. Here fatigue cracks developed which lead to a shaft fracture.
Compared with the reworked central gears (bull besrs) especially treated new parts performed better by trend. However failures also occurred. This may be traced back to the possibility, that the deformation problem of the dividing wall which causes the mismatch of the shafts, naturally could not be solved by the measures at the gear.

The unusual heavy wear of the tooth flanks with a bad contact pattern lead to the measure of periodic oil analysis (SOAP all 200 operation hours, Ill. 22.3.4-2.1/-2.2). So the chance existed to identify the failure in time.

A final remedy should bring in the end a redesign (spiral bevel gear, thicker rim and thicker diaphragm, better cooling) of the high-speed pinion and central gear (bull gear). This was introduced several months after this flight accident. Possibly with the cooling also the deformation problem of the divider wall is eased.

Figure "Danger of seemingly harmless process deviations" (Lit 20.2-11): About 3 minutes after the start in about 1500 m hight the crew sensed a dull explosion. The airplane turned hard to the left and vibrated. In the same moment instrument displays in the cockpit of an aeroengine became agitated and suggested at a major failure. Suitable emergency measures have been initiated and the vibration ended. In the region in question of the aeroengine a fire short-term emerged. Then hydraulic functions and control/steering functions failed. they were resumed by the emergency facility. So an emergency landing at an alternate airport could be managed. There it arose:

• The left wing, the pylon of the inner aeroengine and the fuselage showed fragment impacts.
• In the region of the neighbouring outer aeroengine (upper sketch) pylon and wing showed pronounced fire damages.

Prehistory: About half a year before the accident the failed aeroengine was overhauled at the operator. About 1 month before the accident it was mounted during an overhaul of the airplane. The following flight test proceeded normal.

The documents of the aeroengine overhaul showed cracks at the anti-twist device of the 4th stage compressor stator. It was replaced. The securing holding ring is fixed with 90 rivets from the inside on the compressor casing. It clinches with lugs in suitable slots at the outer shroud of the stator (detail left). The bosses of threee borescope openings penetrate the compressor casing and the outer stator shroud. Together with the screwed in plugs they form an additional, not scheduled by the design, anti-twist protection of the stator.

For the assembly a new anti-twist ring was provided with the necessary papers. For the necessary 90 rivets, which are provided in a yellows bag, such a certificate lacked. The involved technician stated, that there have been still sufficient surplus rivets of former assemblies available.

Ftom the failure mode it could be concluded, that the locking anti twist ring rotated inside the casing and destroyed it. The bore holes for the fixing rivets in the casing showed no signs, that rivets had been atteched. Also no remains of rivets have been found. The rivets consist of a material which differs from the ring and the casing. Merely the borescope bores showed damages by the high circumferantial load of the securing anti twist ring.

From those findings the investigating authority draw the conclusion, That during the assembly the fixing rivets of the anti twist ring from the 4th stator had been forgotten (detail right). The three borescope plugs could nit guarantee the locking effect for a lpong operation time. So the overloaded anti twist ring began to rotate. It milled through the compressor casing till an explosively bursting occurred.

Comment (view of the author): Obviously the failure is causative connected with the unplanned respectively unusual utilisation of available rivets at the work place. That promotes a neglecting of the securing process. The usual yellow bag with the new rivets on site must be estimated as effective remionder.

At the security of the compressor stator against twisting rivets are inserted from the inside through new drilled holes in the slided imn anti twist ring. Then from the outside the rivet head is formed.
If a shift changeover promoted the misbehaviour cn't be seen in the documents at hand, but is a quite plausible szenario.