Aviation Investigation Report A01F0020

On 15 February 2001, C-FBUS, Skyservice Flight 6315, an Airbus A330, departed from Medan, Indonesia, at 1055 Coordinated Universal Time (1655 local time) on an approved extended range twin-engine operations (ETOPS) charter flight to Jeddah, Saudi Arabia. On board were 355 passengers and 11 crew members. About 3 hours 8 minutes after departure, while the aircraft was climbing from flight level (FL) 350 to FL390, a loud bang was heard and the No. 2 engine (Pratt & Whitney PW4168, serial number P733335) failed. The engine was shut down as per the electronic centralized aircraft monitoring (ECAM) checklist: the fire button was pushed and one fire bottle was discharged. The aircraft was approximately 30 nautical miles west of Calicut, India, at latitude 11° N, longitude 76° E. The captain initiated a descent to FL230 and began a diversion to Colombo, Sri Lanka. He then briefed the cabin service manager, who in turn briefed the flight attendants and the passengers. The aircraft was vectored for a single-engine instrument landing system (ILS) approach to Runway 22. Ninety minutes after the engine failure, the flight crew conducted an uneventful single-engine overweight landing with emergency response services standing by.

This incident was the second engine failure on this aircraft. The first was the failure of the No. 1 engine on 05 February 2001, 13 engine cycles before this incident. The first engine failure was investigated by Indonesia, with a TSB investigator as an accredited representative. Both engines were sent to Pratt & Whitney facilities in Cheshire, Connecticut, where they were dismantled and examined in the presence of TSB investigation staff. All of the information from the engine examinations was sent to Indonesia.

The No.1 engine (Pratt and Whitney PW4168, serial number P733336) of this aircraft failed on 05 February 2001. The aircraft had been operating as Flight 6308, a ferry flight from Jeddah, Saudi Arabia, to Solo, Indonesia. One to two hours into the flight, the crew received a No. 1 engine electronic centralized aircraft monitoring (ECAM) N₂ vibration advisory. At the time, the crew did not detect any associated airframe vibration. The engine vibration was analyzed by the aircraft maintenance engineer who was on board for the flight and by the maintenance chief at Solo, Indonesia, who was communicating via radio. They concluded that there was likely some damage to the engine fan blades and that the damage would be assessed and repaired when the aircraft reached the maintenance base at Solo.

Based on this information, the captain elected to continue the flight. Approximately 4.5 hours later, the flight crew noted the smell of engine odours, followed almost immediately by the onset of an airframe vibration. The ECAM warning message Eng 1 STALL displayed and, as the flight crew began the engine shutdown procedure, the ECAM message Eng 1 FAIL displayed. The engine was shut down as per the ECAM checklist: the fire button was pushed and one fire bottle was discharged.

The flight crew then declared an emergency with Colombo Radio, decelerated the aircraft to green dot (single-engine) speed, and descended to flight level (FL) 250. They proceeded to Medan, Indonesia, at reduced speed with continuous N₁ vibration and sporadic airframe vibration from the windmilling engine. Upon reaching Medan, the crew flew radar vectors for a single-engine approach to Runway 05. The aircraft landed uneventfully after 2 hours 20 minutes of single-engine operation.

The No. 1 engine was removed and replaced, and the aircraft was returned to service on 10 February 2001. The engine was being prepared for shipment to the Pratt & Whitney facilities at Cheshire, Connecticut, when the No. 2 engine failed on 15 February 2001.

Engine Information

Failure of No. 1 engine (left side) on 05 February 2001:

Part number: PW4168

Serial number: P733336

Date of manufacture: 28 March 1995

Time since new: 18350.54 hours

Cycles since new: 5121

Date of last shop visit: (overhaul) March 1999

Time since shop visit: 6906.20 hours

Cycles since shop visit: 1306

When this engine was disassembled for overhaul in March 1999, some of the second-stage turbine blades were found to be corroded in the under-platform region, and the entire set of blades was replaced. The replacement blades had been refurbished and were from two different sources. These blades had been coated with PWA545 corrosion protection coating before installation.

Failure of No. 2 engine (right side) on 15 February 2001:

Part number: PW4168

Serial number: P733335

Date of Manufacture: 27 September 1994

Time since new: 19906.25 hours

Cycles since new: 5257

Date of last shop visit: (overhaul) July 1999

Time since shop visit: 5199.11 hoursCycles since shop visit: 1020

When this engine was disassembled for overhaul in July 1999, some of the second-stage turbine blades were found to be corroded in the under-platform region, and the entire set of blades was replaced. The replacement blades were new blades, coated with PWA36395-1 (Platinum Aluminide) corrosion protection coating.

After the two engine failures, both engines were returned to the Pratt & Whitney facilities at Cheshire, Connecticut, where they were dismantled and examined. In both cases, the engine failure was determined to be the result of a stress corrosion fracture of a second-stage turbine blade.

History of Stress Corrosion

The first stress corrosion failure of a second-stage turbine blade in a Pratt & Whitney PW4000- series engine occurred in June 1995. Since then, several service bulletins have addressed the stress corrosion issue in the Pratt & Whitney 2000-, Pratt & Whitney 4000-, and International Aero Engines V2500-series engines. This problem appears to affect some operators but not others. Skyservice Airlines Inc. is one of the operators whose engines were susceptible to stress corrosion cracking. To address the problem of premature engine failures due to stress corrosion cracking of the turbine blades, Pratt & Whitney has been applying sacrificial corrosion protection coatings to the under-platform area of the second-stage turbine blades.

In June 1996, Pratt & Whitney began using the corrosion protection coating PW545 on the second-stage turbine blades. In February 1997, Pratt & Whitney issued Alert Service Bulletin PW4G-100-A72-88, an instruction to collect and analyze dirt contaminants from the under-platform cavity of the second-stage turbine blades to determine the salt content of the dirt. The salt content was used as a measure of the corrosive environment inside the engine. In June 1999, a newer coating (PWA36395-1, known as Platinum Aluminide) was introduced. This coating had been shown to provide twice the corrosion protection of the PWA545 coating. In April 2000, Pratt & Whitney changed the metallurgical composition of the second-stage turbine blades from a PWA1484 alloy to a PWA1480 alloy. The PWA1480 alloy is known to be more corrosion resistant. In May 2000, a third type of corrosion protection coating (PWA36330) for the PWA1484 blades was introduced. This coating was shown to be five times more effective than the Platinum Aluminide coating.

Pratt & Whitney stated that the failure of engine P733336 on 05 February 2001, with only 1306 cycles, was within statistically predictable time limits; however, the failure of engine P733335 with 1020 cycles on 15 February 2001 was premature and unexpected. During the examination of the second-stage turbine blades of both engines, it was noted that the corrosion on the uncoated portion of the blade roots was significantly more severe on engine P733335, even though the blades had less time in service. These corrosion pits averaged 0.012 inch in depth, whereas on engine P733336 the depth of the corrosion pits averaged only 0.006 inch. This finding was particularly notable because the blades from engine P733336 had previous time in service and might have had some small degree of pitting before installation in this engine, but the blades from engine P733335 were new at installation.

As part of the investigation into the corrosive environment of the under-platform cavity of the second-stage turbine blades, Pratt & Whitney recovered and analyzed dirt samples from both engines. Calcium magnesium carbonate (dolomite) and calcium sulfate (anhydrite) were identified as significant constituents of this dirt. Since Skyservice Airlines Inc. is based at Toronto, Ontario, Pratt & Whitney also recovered dirt samples from the Toronto/Lester B. Pearson International Airport. Dolomite was a major constituent of these dirt samples. Dolomite is a very common mineral, occurring in a variety of geologic settings, including the Toronto area of southern Ontario; however, calcium sulfate (anhydrite) is not normally found in the Toronto area.

During normal engine operation, environmental contaminants are ingested and carried throughout the engine along the internal airflow paths. The engine manufacturer uses internal air seals to maintain airflow where it is desirable and to inhibit airflow where it is not. One area where airflow is undesirable is the under-platform cavity of the second-stage turbine blades. The accumulation of dirt in this area is an indication that airflow was present.

A visual examination of the rear face of the turbine blades, conducted to determine the status of the rear side plate seals, showed a discrepancy between the two engines. Witness marks on the aft face of the second-stage turbine blades of engine P733336 indicated that the rear side plate seal had been in place before the engine failure. Engine P733335 had no such witness marks, indicating that the rear side plate seal was not contacting the rear face of the turbine blades, thereby providing a path for airflow out of the under-platform cavity. Both rear side plate seals had been repaired during the respective overhauls. After this finding, other engines were examined to determine the status of the rear side plate seals. In five engines that showed no signs of corrosion attacks, the rear side plate seal contact was described as either excellent or good. In eight engines where corrosion was evident, the seal contact was described as either moderate or poor. Engine P733336 was assessed as moderate, engine P733335 as poor. The result of leaking rear side plate seals is that hot gas path air is allowed into the under-platform cavity and allows sulfur, a residue of jet fuel combustion, to mix with the calcium from the dolomite to form calcium sulfate (anhydrite).

Auto Thrust

In both events, after the engine failure, the flight crews found that the auto throttles could not be used. Although this did not cause either flight crew a significant problem, it did add slightly to their workload and was contrary to their training expectations.

Auto thrust engagement is controlled by the flight management, guidance, and envelope computer (FMGEC), which receives relevant signals from each engine full authority digital engine control (FADEC). If the FMGEC detects an engine-out situation, it will authorize the auto thrust on the operating engine.

When the engine is shut down using the engine fire pushbutton, the electronic engine control/ electrical control unit (EEC/ECU) reverts to an N₁ control mode from the engine pressure ratio mode. If the engine is still windmilling at speeds above a threshold of 3.8%-4.8% N₂ while in the N₁ control mode, the FMGEC will detect the electrical signal from the permanent magnet alternator (PMA) and will interpret this signal to mean that the engine is still operating. Since the FMGEC software logic has determined that both engines are operating, but that one is not responding, it will not authorize the auto thrust. Airbus is currently reviewing this software logic.

Modern jet engines are extremely reliable, and in-service failures are rare. This reliability is the basis of the extended range twin-engine operations (ETOPS) approval. When two engines on the same aircraft fail for the same mechanical reasons in such a short time, this reliability is brought into question. In this case, both engine failures were the result of stress corrosion cracking of the second-stage turbine blades, a failure mode that Pratt & Whitney has been actively trying to control through the use of sacrificial corrosion protection coatings. The focus of this investigation analysis was to identify the underlying causes of these two engine failures.

These two engines were manufactured at approximately the same time. Neither had a corrosion protection coating on the second-stage turbine blades. The engines were installed and operated on the same aircraft, exposed to the same environment under the same operating conditions, and maintained with the same procedures. Therefore, it is expected that internal engine condition and wear patterns would be similar. In fact, both engines exhibited similar corrosion damage to the second-stage turbine blades when they were dismantled for overhaul. This damage indicates that the corrosion mechanisms were in place and operating at similar rates in each engine before the overhauls.

The rate of corrosion in both engines increased dramatically after their overhauls, in spite of both engines having corrosion protective coatings applied to the second-stage turbine blades. The service life of the second-stage turbine blades of engine P733336 with the PWA545 coating was expected to be considerably longer than the original, uncoated blades that had been removed from service after approximately 4000 cycles; however, the coated blades failed at only 1306 cycles. The second-stage turbine blades of engine P733335, with the more advanced corrosion protection coating on new blades, were expected to last twice as long as the blades of engine P733336, but these blades failed at only 1020 cycles.

The corrosive environment in the under-platform cavity results from the leakage of hot gas path air past the rim seal, carrying dirt (dolomite) and sulphur, which is deposited on the surface of the blade root under the platform. The calcium and sulphur then mix in a hot environment and form anhydrite. The anhydrite attacks the surface of the turbine blade and forms pits, which are the stress concentration points that become the crack initiation sites. The cracks develop by fatigue until they reach the point of failure. Neither the corrosion nor the cracks are detectable without dismantling the engine. This situation was developing in both engines before they went in for overhaul, an indication that the rear side plate seals were no longer fully effective. That the corrosion became worse after the overhauls indicates the repair work on the seals did not restore them to their original effectiveness. The difference between the two engines was the more pronounced leaking of the rear side plate seal of engine P733335, which allowed greater airflow thus more dirt contamination into the under-platform cavity, thereby increasing the rate of corrosion attack.

Findings as to causes and contributing factors

1. Both engine failures resulted from stress corrosion fractures of second-stage turbine blades. The corrosion was due to the reaction of the coated PWA1484 alloy of the second-stage turbine blades to the anhydrite that had formed on its surface. The resultant corrosion pits were the initiation sites of the fatigue cracks, which progressed to the point of failure.
2. Neither engine had a good fit between the rear side plate seal and the aft face of the second-stage turbine blades. The subsequent air leaks resulted in an increased rate of corrosion attack in both engines. The increased corrosion protection provided by the coatings did not offset the increased rate of corrosion attack resulting from the leaking air seals.

Other findings

1. The flight management, guidance, and envelope computer (FMGEC) software did not recognize that the engine had been shut down and therefore did not authorize auto thrust for the remaining engine.

Action Taken by the Operator

In response to these engine failures, the Skyservice Flight Operations Training Department amended the training program, in areas specifically dealing with the recognition of turbine engine malfunctions, extended range twin-engine operations (ETOPS) diversion procedures, and in-flight communications.

The engine failure/malfunction training includes a video presentation, handout and classroom discussion developed specifically to enhance the pilot's engine failure/malfunction recognition and response. The video discusses several engine failure scenarios, such as compressor surge/stall, engine fire, bird ingestion, engine seizure and slow engine decay. The handout covers basic turbine engine operation, accessory systems, cockpit engine instrumentation and potential engine failure causes and response techniques. These procedures and techniques are expanded upon during initial and recurrent simulator training. Simulator training sessions include multiple engine malfunctions and failures in different phases of flight to reinforce these techniques.

The engine failure and diversion procedures specific to ETOPS are taught during initial and recurrent ground training. This training focuses on ETOPS diversion decision-making, ETOPS alternate criteria, and aircraft malfunctions requiring mandatory diversion. Also discussed are emergency communications requirements and practical diversion strategies. The Skyservice Flight Operations Manual and Quick Reference Handbook provide specific direction on malfunction handling to flight crews conducting ETOPS.

Flight dispatchers receive comprehensive training regarding dispatching and flight following of ETOPS flights. This training includes flight planning and flight following requirements that are specific to ETOPS. It also deals with communications issues in remote/overwater areas. Updated procedures and manuals have been written and approved and all dispatchers have completed training on these new procedures.

Action Taken by the Aircraft Manufacturer

Airbus is developing improved FMGEC software logic which will address the issue of auto thrust following an engine shutdown using the engine fire push button. This new software is expected to be certified for use before the end of 2003.

Action taken by the Engine Manufacturer

Pratt and Whitney has issued Alert Service Bulletins ASB72-1686 and ASB72-133 to provide on-wing and off-wing inspection procedures for all PW4000-94 inch and -100 inch HPT second-stage blades. The information from these inspections has been used to customize the Operator Fleet Management Plans to manage the HPT blade stress corrosion issue. Changes to the rear side plate repair procedure will be addressed in 2003.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 25 March 2003.