An A380 Engine Explodes After Takeoff

A turbine disc bursts over Batam

Seven thousand feet over Batam Island, Indonesia. About four minutes after take-off from Singapore, a turbine disc inside engine number two bursts. Pieces of it go through the left wing.

Within twenty seconds, the investigators' timeline lists thirty-six alert messages on the flight deck. The aircraft will stay in the air for another hour and forty-five minutes. No one on board is hurt.

Five pilots were on the flight deck

This film is built from one document: the Australian Transport Safety Bureau's final report on the flight, published on the twenty-seventh of June, twenty thirteen. Every time and every number here comes from it, with the page on screen.

“There were no reported injuries to the crew or passengers. There were no confirmed injuries to persons on Batam Island.”

p. 7, ATSB AO-2010-089, final report, 27 June 2013

On the fourth of November, twenty ten, Qantas flight thirty-two left runway two zero centre at Changi, bound for Sydney. It was about three minutes before ten in the morning, Singapore time. The aircraft was an Airbus A three eighty with four Rolls-Royce Trent nine hundred engines, numbered one to four from left to right.

On board were four hundred and forty passengers, twenty-four cabin crew, and five pilots.

Five, because this was also a check flight. In the front seats sat the captain and the first officer. Behind them, a second officer, carried for crew relief. And two more captains: a check captain under training, and a supervising check captain watching over him. Together they held about seventy-two thousand flying hours.

An oil fire freed a turbine disc

The trouble had started about a minute earlier, deep inside engine number two, in readings the flight deck displays did not show. A small oil pipe near the turbine bearings had a crack. Oil sprayed into a space where the air was hot enough for it to ignite on its own, and it caught fire.

The fire heated the arm that joins one of the turbine discs to its shaft. At ten oh one and seven seconds, the arm failed. Free of its shaft, the disc sped up past the speed it was designed for. Four seconds later, it burst.

It broke into three main pieces. They went through the engine casing and into the aircraft.

On the flight deck the crew heard two bangs, almost together. The captain selected altitude and heading hold, and the aircraft levelled off. The automatic thrust had stopped working, so he moved the thrust levers by hand.

36 alerts arrived in 20 seconds

The first alert had come three seconds before the burst: an overheat warning on engine number two. ECAM, the aircraft's monitoring system, shows each fault and the steps to deal with it, one procedure after another.

“the aircraft was capable of continued safe flight and landing.”

p. 146, ATSB AO-2010-089, final report, 27 June 2013

Then the list grew. Slats, hydraulics, landing gear, brakes, electrics, air, fuel. The report's timeline shows thirty-six messages in twenty seconds, starting at ten oh one and eight seconds.

The captain confirmed he had control of the aircraft, and told the first officer to start working through the procedures. At two minutes past ten, the crew made a pan call to Singapore air traffic control, an urgency call that does not ask for immediate assistance.

At three minutes past ten they shut engine number two down. They fired its extinguishers, but got no confirmation that they had worked.

Nine laps of a hold over the sea

The aircraft could still be controlled, and it had plenty of fuel. So the crew chose to hold, and work the list before trying to land. They asked air traffic control for about thirty minutes, close to the airport. At eighteen minutes past ten, the aircraft began a racetrack pattern at seven thousand four hundred feet, over the sea north of Bintan Island.

Air traffic control passed on reports that people on Batam Island had found parts of the aircraft. Debris fell over about one and a half square kilometres; one piece found there was about forty per cent of the turbine disc. Buildings were damaged, but there were no confirmed injuries on the island.

In the cabin, everyone was seated, and people could see damage to the left wing, and fuel coming out of it. The second officer went back to look. A passenger, himself a pilot with the airline, showed him the tail camera picture on the seat screen: a fuel leak from the left wing.

The damage was wider than one engine. About six hundred and fifty wires were damaged, in two bundles: one along the front of the left wing, one under the belly. One large piece of disc went through the left wing and its inner fuel tank, and out through the top.

One of the two hydraulic systems was lost. So were the leading edge slats, parts of the ailerons and spoilers, the brakes on the left wing gear, the automatic thrust, the normal way of lowering the landing gear, and the ability to dump fuel.

Fuel was leaking from the tank that fed engine number two, about five thousand kilograms in the air. Fuel in the left outer tank was trapped, while fuel from the right outer tank was moved. Unsure of the damaged fuel system, the crew chose not to start any further transfers. Later simulator tests found the aircraft stayed controllable at every fuel imbalance tested.

At one point a message about the other hydraulic system appeared, on the undamaged side. The crew stopped to ask whether the warning system itself was damaged. They checked the system pages and decided to follow the messages as shown. Airbus later found every message was valid.

Working the procedures took about fifty minutes. In the end the aircraft flew nine laps of the racetrack, over about seventy minutes.

The landing distance gave no result

Next, the landing distance. The extra pilots used a laptop to run the landing performance program. They entered the maximum landing weight and nine systems that no longer worked. The program returned no result: the distance it calculated was longer than the runway.

“should not be read as apportioning blame or liability to any particular organisation or individual”

p. viii, ATSB AO-2010-089, final report, 27 June 2013

They ran it again with the aircraft's real weight, which was higher. This time it worked, with one hundred metres of runway to spare. The investigators later found why: below the maximum landing weight, the program added its safety margin once for every failed system, so a lighter aircraft could need more runway.

The aircraft would land about forty-one tonnes over its maximum landing weight, which the rules allow in an emergency.

The captain called the customer service manager, the senior cabin crew member, and warned of a possible overrun and evacuation. The cabin was prepared for both.

Engine 3 alone set the speed

At about half past eleven, the aircraft left the racetrack and turned for Changi. Before leaving, the crew tested how it handled, and asked for a long final approach. The landing gear came down by gravity, using the emergency extension.

The captain set engines one and four to equal thrust, and controlled the speed with engine three alone. At about eight hundred feet he switched off the autopilot and flew the rest by hand.

Two low energy alerts sounded on the way down, and a stall warning three feet above the runway. The investigators found all three were genuine, and that the safety margins were kept.

At eleven forty-six, the aircraft touched down on runway two zero centre. With the brakes and reverse thrust on engine three, it stopped about one hundred and fifty metres from the end of the runway.

Engine 1 would not shut down

The crew shut the engines down. Engine number one kept running. They tried the master switch again, the fire button, and the extinguishers. It kept running, because damaged wires had taken away the controls to its fuel valve.

The left body gear brakes showed nine hundred degrees Celsius, and rising.

Fuel was still leaking from the left wing. Firefighters laid foam over it. The crew decided against a slide evacuation. Passengers would leave by stairs, from one door on the right, away from the running engine and the fuel.

Passengers began leaving about fifty minutes after touchdown. The last were off a little under two hours after landing.

The crew and the airline's engineers tried other ways to stop engine number one. None worked. In the end, firefighters pumped water and then foam into its intake. It stopped at seven minutes to three in the afternoon, about three hours after landing.

A pipe wall a third of a millimetre thick

The investigation took more than two and a half years. It traced the crack to the oil pipe. When the pipe's end was bored out in the factory, the hole sat off centre. At the break, the wall measured one point four two millimetres on one side, and zero point three five on the other.

“likely provided the safest option”

p. 146, ATSB AO-2010-089, final report, 27 June 2013

The thinner the wall, the higher the stress. Over time, a fatigue crack grew, until on this flight it let oil out.

The part was made at the engine maker's plant at Hucknall, in the United Kingdom, in twenty oh six. The report traces how off-centre bores passed through inspections and reviews over several years without being stopped.

The report says its findings should not be read as blaming any organisation or person.

Inspections and new engine software followed

Qantas stopped flying its A three eighties the same day, and began bringing them back on the twenty-seventh of November. On the first of December, the bureau recommended that Rolls-Royce act on the pipes, and an inspection order for the pipes followed the next day.

On the third of December, Rolls-Royce released engine software that shuts the engine down before a loose disc can reach bursting speed. It was across the fleet within days, and required by European regulators within ten flights.

The engine maker revised its quality procedures. Airbus fixed the landing distance program so that its answer no longer depended on the weight in that way. And the bureau asked the European and American regulators to study the damage to this aircraft, because it went beyond what their design guidance had modelled.

Take-off to touchdown took 110 minutes

Take-off to touchdown: one hour and fifty minutes. Four hundred and sixty-nine people on board. The investigators found the aircraft could still fly and land safely, and that its flight and cabin crew worked as a competent team.

No one on board was hurt. Source: Australian Transport Safety Bureau.