IMPROVING SURVIVABILITY OF AIRCRAFT FROM UNCONTAINED GAS TURBINE ENGINE FAILURES
By: Chris Adams and John Manion
Figure 1 The Failed Rolls-Royce Trent 900 Engine Being Removed From a Qantas Airbus
A 380 (Australian Transport Safety Bureau)
Modern, high-bypass ratio aircraft gas turbines used in commercial aviation and on military transports have an exceptionally high level of reliability; however, events do occur that lead to catastrophic engine failures. While typically the engine is destroyed in such events, it is desired to fully contain any debris and not have a fire that spreads. Occasionally, an engine will suffer an uncontained engine debris event. Most engines are required to meet a specific level of debris containment, but more severe events can and do occur, such as the 4 November 2010 incident of Qantas flight 32 (an Airbus A380 aircraft with Rolls-Royce Trent 900 series engines) (see Figure 1). The number 2 engine sustained an uncontained failure of the intermediate pressure (IP) turbine disc soon after takeoff from Changi Airport, Singapore, for Sydney, Australia.
Commercial airplane manufacturers are required by both the U.S. Federal Aviation Administration (FAA) and European Aviation Safety Agency (EASA) to certify that their designs are able to meet stringent requirements of flight safety in case of a catastrophic event. Recent military aircraft programs, using specific military designs and commercial derivatives, have also required certification similar to FAA and EASA requirements.
Although the design safety requirements are now essentially the same for commercial and military aircraft, there currently is no standard methodology for certifying the safety of the aircraft in the event of a hazardous uncontained engine event for both military and commercial aircraft. FAA Advisory Circular (AC) 20-128A, “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure,” provides additional guidance for completion of the numerical analysis although no specific methodology is identified [1].
Each aircraft manufacturer and engine company has its own methodology, and only recently has the U.S. military adopted a common tool, the Uncontained Engine Debris Damage Assessment Model (UEDDAM), for its methodology to consider uncontained events in a more realistic manner. UEDDAM can handle the analysis for the release of the primary rotordisk segment plus smaller engine debris fragments in directions out of the plane of rotation.
In the case of military use of commercial derivative aircraft, there are usually two separate safety assessments required. The original aircraft must be certified by the FAA and EASA for the first. Second, following the modifications for the military, the same aircraft must again be safety-certified by essentially the same rules.
A common methodology for analyzing the hazard from uncontained engine debris would benefit engine manufacturers, air framers, and customers with increased reliability and reduced costs. It would result in confidence that the results for all the different agencies are in agreement. Further, it would reduce efforts in the case of multiple assessments both in the civil cases of aircraft or engine repair and in the case of military modification to a commercial aircraft.
The debris from an uncontained engine event consists of high-energy penetrators that range in mass from tens of grams (a few ounces) to a high of 135 kg (300 lbs) and that should be viewed as aircraft combat survivability damage mechanisms because they can perforate, slice, sever, crush, or dislodge flight-critical components or other aircraft critical components. Their velocity when exiting the engine cowling can be up to 305 m/s (1,000 ft/s). Any assessment methodology must model the effects of all debris potentially penetrating into the aircraft, passing into and through structural components, and impacting aircraft flight-critical components.
Thus, these assessments must evaluate both effects of damaged flight-critical components on their aircraft system function and the cascading effects that multiply degraded systems have on overall aircraft flight capability. The larger, more massive, debris fragments can also create structural and decompression failures. Therefore, an analysis methodology would require both physical (e.g., finite element) and functional modeling of all the aircraft components within the zone of debris expansion from an engine.
In the case of the Qantas Airbus A380 incident, the uncontained engine debris cut electrical and hydraulic lines in the leading edge of the wing, causing the loss of multiple systems. Additionally, two fuel tanks were penetrated, causing significant fuel loss and creating a fire hazard. Although damage began with a single-engine event, the cascading damage effects quickly led to more than 50 automated system warnings to the crew regarding systems failures or impending failures. Civilian commercial aircraft are designed with redundancy for reliability and safety, such that if a single system fails, another system can provide the same or similar function. However, as Dr. Robert Ball described in his book The Fundamentals of Aircraft Combat Survivability Analysis and Design, redundancy without effective separation is only reliability and not survivability (avoiding or withstanding the damage effects of a damage mechanism) [2].
In the late 1990s, the FAA initiated an effort to develop an assessment methodology that would model of all the aircraft components within the zone of debris expansion from an engine. The Naval Air Warfare Center Weapons Division (NAWCWD) in China Lake, CA, was funded to develop a tool to assess the hazard from an uncontained engine debris event. This effort resulted in a computerized methodology for hazard assessment based on existing, well-established, and well understood tri-Service vulnerability assessment methodology. The UEDDAM code is based on two principal vulnerability assessment codes: FASTGEN and the Computation of Vulnerable Area Tool (COVART). Each of these codes has been used for more than 25 years for the assessment of damage effects on an aircraft from incident kinetic energy penetrating objects (i.e., missile fragments).
As shown in Figures 2 and 3, UEDDAM models both the physical and functional characteristics of all aircraft components within the debris zone, the functional relationships of all flight-critical components and systems, the penetration of the debris through the aircraft, and the damage characteristics of debris against component. Then it sums up the results into a probabilistic “hazard level” of an event as a function of aircraft flight phase.
UEDDAM requires an input of a three-dimensional (3D) geometric description of aircraft component positions within the aircraft and, thus, in relationship to each other. The description (“aircraft model”) uses a specific input format, a format that can be processed by FASTGEN to develop debris travel vectors (“rays”) through the aircraft and identify which components are intercepted by each ray and the geometry of this intersection. These debris rays are then used in COVART to assess the penetration depth the debris would be elected to achieve along each ray. COVART identifies which critical components are hit and gathers the probability of component damage of each component hit. Naturally, this subprocess also requires input data on damage characteristics associated with every possible critical component. COVART will also predict the effects on overall system function as a result of critical component damage; this prediction is accomplished by using an input file that defines component/ system functional flow characteristics. UEDDAM then post-processes the output data from COVART, which uses FASTGEN rays to yield the hazard levels as a function of a particular debris event.
Adopting an assessment methodology such as UEDDAM results in a universal standard and uniformity of debris hazard evaluation across the involved agencies. Maintaining the 3D aircraft geometry model and its component/system functional flow data generated by aircraft manufacturers during their initial hazard assessment would simplify later debris hazard reassessments required by maintenance, repair, or military-modification to a commercial aircraft. And because UEDDAM already exists; many see this this tool as the low-cost solution to creating this assessment standard for both commercial and military.
Figure 2 UEDDAM Simulated Engine Debris
Figure 3 Hydraulic Pressure Line in a Generic Twin-Engine Aircraft
ABOUT THE AUTHORS
Mr. Christopher Adams is the Director of the Center for Survivability and Lethality at the Naval Postgraduate School in Monterey, CA, where he currently teaches combat survivability. He is also the former Associate Dean of the Graduate School of Engineering and Applied Sciences, and he has more than 20 years of operational flight experience in F-14s and EA-6Bs, serving multiple tours in Iraq and Afghanistan. Mr. Adams holds a B.S. in aerospace engineering from Boston University and an M.S. in aerospace engineering from the Naval Postgraduate School.
Mr. John Manion is currently the Survivability Assessment Branch Head for the Naval Air Warfare Center Weapons Division, in China Lake, CA. He has approximately 30 years of combined Government and industry experience in combat aircraft survivability research, design, testing, and analysis. Mr. Manion holds a B.S. in mechanical engineering from the University of Pittsburgh and an M.S. in systems engineering from the Naval Postgraduate School.
References [1] Federal Aviation Administration. “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure.” Advisory Circular 20-128A, March 1997. [2] Ball, Robert E. The Fundamentals of Aircraft Combat Survivability Analysis and Design. Second Edition, AIAA Education Series, American Institute of Aeronautics and Astronautics, 2003.
