Human Error in Aviation: A Case of Qantas Flight 32
Analyze and evaluate the findings of the official investigation and compare with your findings
On 4 November 2010 at about 02:01 Coordinated Universal Time (UTC), passengers aboard an Airbus A380 plane registered VH-OQA heard a bang midair. The plane, which was operated by Qantas flight 32 was moving from Changi Airport, Singapore to Sydney, Australia. The craft had 24 cabin crew and 440 passengers (Hradecky 2011). The aircraft had sustained an uncontained engine rotor failure (UERF) (ATSB 2013, p. 5) on its second engine, a Rolls-Royce Trent 900. The debris from the damaged engine flew into the airplane’s fuselage causing severe structural and systems damage. Nevertheless, the crew managed this accident and safely returned and landed the aircraft at Changi Airport.
According to the Australian Transport Safety Bureau (ATSB), the mid-air accident was caused by a leakage in the oil feed stub pipe within the High Pressure/Intermediate Pressure (HP/IP) hub assembly of the second engine (ATSB 2013 p. 5). Rolls Royce had developed oil feed stub pipes that did not conform to the design specifications for the Trent 900 engines, which was the one that was operating on VH-OQA. The stub pipe in the High Pressure/Intermediate Pressure (HP/IP) hub assembly had been manufactured with thin walls, which significantly reduced their life and made them develop fatigue crack. The internal oil leakage in the hub assembly resulted in an oil fire, which led to the separation of the intermediate pressure turbine disc from the drive shaft. As a result, the disc accelerated and burst with so much energy that it broke through the engine structure releasing debris at high velocity.
Notably, the investigators discovered that the thickness of the fractured end of the oil feed stub pipe wall was not uniform and it varied from 1.42 mm to 0.35 mm. The thinnest region of the oil stub developed a crack since it had the highest stress levels. During the flight, the fatigued crack grew in the HP/IP oil feed stub pipe below the shoulder where it fits into the HP/IP bearing chamber inner hub. The crack grew in size, resulting in the oil leakage in the buffer space. Although the leak happened at a slow rate, it had enough pressure which resulted in an atomized oil spray (ATSB 2013, p. 99). According to Rolls Royce, the temperature in the chamber was between 365 and 375 degrees Celsius. Since synthetic oils used in engines have an auto-ignition temperature of 280 degrees Celsius, the leaking oil auto-ignited when it atomized on entry into the buffer space. The ignition in the buffer space caused the engine to fail, which resulted in the subsequent damages on the engine housing and fuselage.
I agree with the analysis and evaluation of the experts on the cause of the QF32 accident. However, I also believe that human error also contributed to this accident. From my analysis, the mechanical failure was also due to Rolls Royce failure in referencing all features to the design definition. In particular, the counterbore for the interference and stub pipe were measured to datum M and not datum AA as required. Due to the position of the stub pipe when drilling, it was difficult for the engineers at Rolls Royce to see datum AA for referencing; therefore used datum M that had same measurements. Unfortunately, they did not anticipate there would be movements in the plates during drilling, which would affect their drilling alignment. Furthermore, the mechanical engineers did not consult with those in the design department who would have tested the final product to see if it matched their design.
Finally, although the oil leakage on the buffer space had been anticipated, Rolls Royce had not established a safety mechanism to stop the engine in case of the eventuality. On its part, the company believed that the engine would surge and shut down, and the turbine would not reach its burst speed. In this regard, there was a human error from the management on its judgment of the failure process of its engine.
The official report did not cover this issue since the failure was due to the unavoidable causes. For example, although the engine would ordinarily surge after a fire in the buffer space, the engine in QF 32 became so powerful that it recovered from the surge, which resulted in the catastrophe. Additionally, the obstructed visibility when drilling the counterbore for the interference and stub pipe made the engineers reference their measurements with datum M; it was not due to negligence. Moreover, the movements of the plates during the machining had not been anticipated.
Lessons Learnt and Their Contribution to Aviation Safety
The aviation industry learned the importance of ensuring that all manufactured components should be identical to their designs. The use of such components would reduce cases of fatigue and stress on mechanical parts, which is dangerous and can result in an accident due to the failure of the affected part (Squair 2012). For example, the QF32 accident revealed to the ATSB that misalignment of the stub pipe counter-boring could result in an elevated risk of fatigue crack initiation that could cause an oil leak, which could lead to a catastrophic engine failure (Richard 2015). In response to the safety issue, Rolls-Royce assessed the oil feed stub counter bore geometrics across its Trent 900 engines. After a stress analysis, it was concluded that the minimum acceptable thickness of the oil feed stub pipe counter bore geometrics is 0.5millimeters. Accordingly, all engines with stub pipe wall thickness of less than 0.5 mm were removed from service. In December 2010, the minimum wall thickness was revised upwards to 0.7mm for all new engines (ATSB 2013, p. 151).
Human error was another issue addressed by the QF32 accident. In particular, the failure of manufacturing engineers to consult with those in design had resulted in Rolls Royce making wrong calculations on the size of the datum. Following the accident, the company required the manufacturing engineers to consult with design engineers in ensuring that they would maintain the designs of all its products when developing manufacturing datum (ATSB 2013, p. 154). In January 2011, Rolls Royce issued a technical package that established greater cooperation between the design and manufacturing engineers. In this regard, cooperation in the manufacturing process would reduce the cases of design errors, effectively minimizing the risks of accidents
Another valuable lesson learned from the QF32 accident is the importance of clarity on the procedures to be followed by engineers and technicians in the manufacturing process. For example, before the accident, the procedure for the inspection used by Rolls Royce contained ambiguities on where manufacturing stage drawings were deemed to be acceptable (ATSB 2013, p. 155). Following the accident, in January 2011, the company revised its First Article Inspection (FAI) process to provide further guidance to personnel if the established design could not be met.
The accident also resulted in a greater adherence to processes in the manufacturing of components for aircrafts. Before the accident, for example, a culture existed in Rolls Royce Hucknall facility where it was acceptable for personnel not to declare minor non-conformances in the manufactured components. In response, the company undertook safety actions in 2007, where employees were informed on the importance of declaring all non-conformances to the engineering drawings for assessment (ATSB 2013, p. 155). After the accident, this issue was revisited, and employees were encouraged to continue forwarding any issues of non-conformance to their supervisors for assessment.
Policy to Reduce the Effects of Human Factors on Latent Conditions and Active Failures
Policy: All components in the manufacturing plant should be manufactured only after a consultation between the design and manufacturing engineers on how these parts will be developed, and also after the testing of the first ten pieces.
The consultation between the design and manufacturing engineers will ensure that the final product is similar to the design made by the design engineers. Since there is usually some error in the manufacturing process; therefore, the consultation between the design and manufacturing engineers will ensure that this error is maintained within acceptable limits (Royal Aeronautical Society Australian Division 2016). In the QF32 accident, for example, the lack of consultation between the design and manufacturing engineer resulted in the latter manufacturing the oil feed stub pipe whose thickness on certain parts was less than the minimum acceptable limits. As a result, the pipes incurred significant stress that resulted in a crack, which led to the leakage of the engine oil to the buffer space, in turn, resulting in an engine fire.
A test of the first ten pieces after the consultation will be crucial in ensuring that the final product meets the desired characteristics. Usually, the surest way of knowing whether the final component has the characteristics of the product design is through testing. In light of this, the test of the first ten pieces will enable both the manufacturing and design engineers to know if they have developed their desired product.
Australia Safety Transport Bureau [ATSB], 2013, In-flight uncontained engine failure Airbus A380-842, VH-OQA, overhead Batam Island, Indonesia, 4 November 2010. ATSB Transport Safety Report, AO-20101-089 Final- 27 June 2013, pp. 1-305, viewed 7 December 2017 <https://www.atsb.gov.au/media/4173625/ao-2010-089_final.pdf>.
Hradecky, S 2011, Accident: Qantas A388 near Singapore on Nov 4th 2010, uncontained engine failure, The Aviation Herald, viewed 7 December 2017, <http://avherald.com/h?article=43309c6d>.
Richard, H 2015, Technical lessons from QF32, viewed 7 December 2017, <https://qf32.aero/2015/09/19/7334/>.
Royal Aeronautical Society Australian Division, 2016, QF32-The story behind the story, 2016, 14 May, viewed 7 December 2017, <https://www.youtube.com/watch?v=8TQTG0RE42g>.
Squair, M, 2012, Lessons from QF 32, viewed 7 December 2017, <https://criticaluncertainties.com/2010/11/06/lessons-from-qf-32/>.