Seattle, WA, USA
N375HA
AIRBUS A330-243
A confluence of four fuel system anomalies caused a blockage of a fuel filter in the engine control system of the Rolls Royce Trent 700 that led to the loss of control of the left-hand (No. 1) engine thrust during approach and landing. The Rolls-Royce Trent 700 features several protective fuel filters throughout the many fuel components that constitute the engine’s fuel system. An extensive teardown of the fuel system components of the No. 1 engine revealed a significant blockage of the Variable Stator Vane (VSV) Torque Motor (TM) supply port (SP) filter. The VSV TM constantly modulates the VSV actuators to match the rotational speed, altitude, temperature, and power requirements of the engine. Without this matching, the internal airflow of the engine will be disrupted resulting in multiple surges, overspeed, over temperature and incorrect fuel scheduling. The reason for the blockage of the VSV TM was not readily apparent; however, it was concluded that long-term use of fuel containing higher concentrations of sulphur compounds caused debris to adhere and accumulate to the upstream side of the VSV Control Unit Main Inlet Filter (MIF) element, with sulfate acting as the binding agent. Laboratory testing and analytical assessment of the fuel system determined the most likely sequence was that a larger-than-normal quantity of water was introduced into the fuel lines dissolving the water-soluble sulphate and releasing the MIF deposits/debris. The MIF debris particles flowed downstream to the partially blocked VSV TM SP filter, completely blocking it. The EEC increased the fuel flow to maximum fuel flow based on an erroneous VSV position, causing fireballs and fire streaks from the exhaust pipe and subsequent thermal damage to the wing. Only the forced closing of the wing spar valve stopped the exhaust fire. The reason for the larger-than-normal quantity of water to be introduced into the fuel was the omission by the maintenance provider to ‘sump’ the wing tanks after ten days of the airplane being stationary for unrelated scheduled service. Examination of other components of the fuel system revealed the presence of aluminum sulfate (alum) nodules. Since aluminum sulfate can only be dissolved in water and not fuel this implies the presence of water in the fuel. The four conditions that precipitated this event were. Water in the fuel: The most likely scenario was that the airplane wing tanks contained water that had accumulated and settled during the 10 days while it was undergoing maintenance and the maintenance provider failed to manage routine fuel tank sumping on the airplane as recommended by the manufacturer. One hour, prior to start 4,300 pounds of fuel was uploaded to the airplane. This was considered to be sufficient time for any water to settle back to the bottom. The engines are started with 120 liters of the original fuel in the engine fuel system components and lines. The fuel consumed during engine start, idle and taxi was estimated to be about 87 liters. The selection of takeoff power requires high VSV servo flow for 500 milliseconds to position the VSVs quickly in response to the power demand, thus drawing the high-water-content fuel from the tanks through the VSVC MIF, thereby liberating previously deposited material from the filter into the servo passages. As the takeoff power was achieved, low fuel flow to the servo allowed the liberated debris near the VSV TM supply port filter. During the flight, there is low servo fuel flow in the VSVC since there is not a large change in power; however, during landing approach, high servo flow was again commanded, and a ‘cloud’ of liberated debris almost completely blocked the VSV TM SP filter, creating a slow VSV response, leading to increased N2 and subsequent N1 speed increase upon reverse thrust selection. Aluminum Sulfate (alum) was found throughout the left engine fuel system and is unique to this event. Alum is not used in the aviation industry, and it is not likely that the alum was introduced into the fuel system by simple fueling contamination. Recent industry research on the quality of fuel distributed in the United States indicated that fuel distributed on the west coast can, in the long-term cause more sulfate precipitate in the fuel system and be dissolved by water than fuel distributed on the east coast. These studies also suggest that sulfates increase a chemical binding phenomenon that was observed in the VSV torque motor filter. The long-term use of west coast fuel may increase the precipitation of sulfate salts in fuel lines. Examination of the left engine main high-pressure fuel pump revealed cavitation erosion. The elemental makeup of metallic debris found in the VSV TM SP filter was very similar in composition to that of the main high pressure fuel pump parts. Ordinarily this fine material should pass easily through the filters (MIF mesh size is 45 microns (µ) and the VSV TM SP filters mesh size is 80 µ; however, there appears to be an unexplained process in which the fine fuel pump particles clump together, using the fuel breakdown products (sulfate) as a binder. Because the normally smooth engine internal airflow was disrupted due to the VSV slow response, the engine became internally stalled and unstable during approach. Due to the inhibited cockpit warnings during final approach, the pilots were not aware of the increasing internal engine airflow instability. During landing the EEC logic changes modes so that it controls the N1 spool; however, because of the airflow disruption from the mis-scheduled VSVs, the N1 spool did not respond in accordance with the reverse power demand. The EEC kept increasing fuel flow until it reached the maximum flow rate, causing excess fuel in the combustor and unburnt fuel to exit the tailpipe where it mixed with fresh air and became ignited, causing thermal damage to the airplane skin.
SUMMARY On November 7, 2017 at approximately 9:00 PM Pacific Daylight Time a Hawaiian Airlines Airbus A330-243 airplane, Registration Number N375HA, flight 8075, sustained a control issue of the left-hand (LH) Rolls Royce (R-R) Trent 700 turbofan engine resulting in pulses of flame from the aft of the engine just after landing on runway16L at Seattle-Tacoma International Airport (SEA). After touchdown, the engine emitted sufficient liquid fuel and flames from the exhaust to cause thermal damage to the nacelle, pylon, wing, and flaps. The repositioning flight originated at Paine Field (PAE), Washington and was on a ferry flight after having interior upgrades installed, a 10-day job, and was enroute to Seattle, Washington, to begin regular service. No engine work was carried out during this period. There were two crew and no passengers on board. It was reported that the pilot was unaware of the fire and was informed of the condition by the control tower. The first officer shut down the left engine using the engine fire switch and discharged one fire bottle. Seattle aircraft rescue and Firefighting (ARFF) responded; however, the fire was extinguished before they arrived. During an initial inspection, the maintenance staff discovered fire distress on the engine common nozzle assembly, underside of the wing, pylon, flap track fairings, spoilers, and flaps. The initial examination of the incident airplane and engine occurred between November 9 to 12, 2017 at the Seattle-Tacoma Airport. The engine was shipped to a Rolls-Royce Trent overhaul facility, N3 Engine Overhaul Services (N3EOS) GmbH in Arnstadt, Germany where the team met between December 17 and 19, 2017 to remove specific external fuel related components for detailed teardown. DETAILS OF THE INVESTIGATION On-Scene Examination Engine Data Review The engine health monitoring (EHM), the aircraft communication addressing, and reporting system (ACARS) and the aircraft condition monitoring system (ACMS) data was reviewed, and the following observations were revealed. ESN 42543 exceedance messages: - 05:00:17 (UTC) N2 Redline Exceedance for 3 seconds - 05:00:32 (UTC) N2 Redline Exceedance for 7 seconds - 05:01:15 (UTC) N2 Over Limit - 05:02:46 (UTC) N2 Redline Exceedance for 8 seconds - 05:03:26 (UTC) Turbine Gas Temperature (TGT) Redline Exceedance Each exceedance was approximately 104 percent (%) N2 speed. The following observations were made from the findings: A comparison of the variable stator vane (VSV) positions revealed that there was a large behavior difference between the LH and RH engines. The P30 pressures of LH and RH engines were both equal and stable; however, while the VSV positions on the RH engine corresponded to the VSV demand, the LH engine exhibited large variations and did not correspond to the VSV demand. VSV variations directly impact N2 speed and the high angle of the LH engine VSVs directly increased the N2 to overspeed. The fuel flow (FF) did not correspond to the engine speed increase during the overspeed events, indicating that the electronic engine control (EEC) was not commanding the overspeed. The variation in engine pressure ratio (EPR) did not correspond to the FF variation, indicating that the FF was not the significant cause of the EPR variation. The EEC did not stop the overspeed occurrences because its logic only intervenes above 114%. Because of these findings, the fuel metering unit (FMU), EEC and VSV control system were examined in more detail. Event Timeline Data Review During descent VSV control was slow to respond and engine became increasingly unstable. The electronic centralized aircraft monitor (ECAM) message ENG1 CTL SYS FAULT “avoid rapid thrust change” message inhibited as aircraft on final approach permitting full reverse thrust application. Aircraft landed at - 05:01:48. Full thrust reverse was selected at - 05:01:51 – It is noted that during reverse thrust operation, the EEC logic controls in N1 mode. The VSV system did not respond to engine power selection, and FF increased to maximum output at about 31,600 pph to achieve the demanded N1 speed. This would indicate that flames from the engine tailpipe had not occurred until after the aircraft had landed. Little or no response from VSV system to commanded thrust resulted in restriction to core airflow and suppression of N1 speed. Simultaneously the resultant N3/P30 mismatch triggered P30 pipe failure detection, which inhibited the engine surge detection function. The EEC commanded an increased FF to maximum of about 32K pph in an attempt to achieve the demanded N1, incorrect VSV position resulted in engine surge - 05:01:56. Unburnt fuel continued to ignite at and behind the engine tail pipe. Thrust reverse cancelled and EEC logic changed engine governance from N1 to N3 control - 05:02:14. At this point N3 speed, which was within the specified EEC synthesized levels, stagnated at about 67%, and the control system logic maintained the high FF delivery. The engine continued to surge, and the airport closed circuit TV (CCTV) footage indicated that unburnt fuel continued to ignite to the rear of the engine tail pipe. TGT exceeded 900°C and EEC reduced the FF at 05:02:43. FF demand was only reduced when the EEC detected an engine TGT exceedance, and shortly afterwards the flight crew shut the engine down. Pilot made aware of tail pipe fire by ATC and engine was shut down using the fire handle (aircraft low pressure spar valve closes) - 05:02:46. Engine master lever selected “off” and engine shutdown - 05:02:47. Analysis of the VSV positional data taken from the N2 exceedance reports observed a disagreement between the demanded and actual position of the VSVs, to a point where control was lost. Further assessment noted the VSV response time had become increasingly sluggish for each N2 exceedance. General Airplane Examination Initial examination of the incident airplane and engine occurred from November 9 - 12, 2017 at the Delta Airlines maintenance facilities in Seattle, Washington. Investigation team members including the NTSB, FAA, Hawaiian Airlines, UK AAIB, R-R, and ALPA were in attendance. The left-wing external composite panels on the common nozzle assembly, lower panels of the flaps, and flap track covers had evidence of burn patterns and blistered paint consistent with unburnt fuel vapors igniting towards the back of the engine The event engine was detached, lowered from the airplane, placed on an engine stand, and moved to a secure area. The engine was externally intact and undamaged. The fan could be turned with normal effort and when turned, no grinding or other abnormal sounds could be heard emanating from the engine core. The engine pylon mount hardware was intact and undamaged. There were no leaks in any of the oil or fuel lines. The engine was externally clean. There were no signs of mechanical or thermal distress. The fan cowls and thruster reverser cowls were undamaged and clean. The front spinner cone was undamaged and exhibited only operational erosion of the paint. The last stage of the LP turbine was undamaged. There was no obvious unusual discoloration on the LP turbine blades. The fan blades were undamaged. The fan case track liner was undamaged and showed no evidence of scoring. The fan was not further disassembled or examined. The scavenge oil filter and LP fuel filter were removed, examined, and found to be in an unremarkable, nominal clean condition. A borescope inspection of the entire rotating group was performed and included the LP turbine, high-pressure nozzle guide vanes, HP turbine, combustion section, HP compressor, IP compressor, and IP turbine. All rotating group components appeared to be intact and undamaged. An external visual inspection of the VSV system found no obvious damage or distress. The VSV rams were disconnected from the unison rings to enable the independent movement of the vanes. The movement of the assembly was noted to be consistently smooth throughout the range with minimal input load. The common nozzle assembly was intact, however; there was evidence of oily soot at several locations. There was a dislocated panel at the 2 o’clock location that displayed heat distress. The external surface showed evidence of heat distress at the 9 o’clock position consisting of light blistering and discoloration of the paint surface. Engine Externals Examination and Findings The engine was shipped to a Rolls-Royce Trent engine overhaul facility, N3 Engine Overhaul Services GmbH where the team met to remove external components below that were germane to the faults observed: - Fuel metering unit (FMU) - EEC and power control unit (PCU). - VSV controller and the RH and LH VSV actuators - FOHE and LP fuel filter - Fuel Pump (an assembly, consisting of the HP and LP pumps) - High pressure (HP) filter – 70 micron (µm) Variable Inlet Guide Vane (VIGV) & VSV Control System Description The variable inlet guide vanes direct air into the intermediate pressure compressor at the correct angle-of-attack to avoid compressor surge and stall while maintaining optimum engine efficiency. A single stage variable inlet guide vanes are located immediately behind the engine section stators. A further two stages of variable stator vanes are located after the first and second stages of the intermediate compressor. Two identical VSV actuators provide the power to move the VSV mechanism to the required position. Each actuator is connected to the unison rings via an adjustable bellcrank linkage. The unison rings then connect to the individual VSV airfoils via a lever arm. The actuators are powered by high-pressure (HP) fuel from the VSV actuator control valve and there are separate fuel lines to the ‘extend’ and ‘retract’ sides of the actuator. A variable stator vane control system operates the variable inlet guide vane system by receiving an electrical signal from the EEC that sets positional demand to match the demanded engine power condition. The torque motor responds by directing servo fuel to either side of the control servo valve to extend or retract the VSV actuators to the required position. Fuel Metering Unit (FMU) The purpose of the FMU is to control the flow of fuel to the fuel spray nozzles and combustion chamber from electrical inputs from various control units. The FMU was scanned using computerized tomography (CT) at Rolls-Royce, Bristol facilities and no evidence of internal damage or anomalous features was found. Electrical testing of the unit confirmed the main metering valve, shut-off valve, turbine overspeed, and linear variable differential transducer functions all met the component maintenance manual (CMM) test requirements. No further testing was done. Engine Electronic Controller (EEC) The EEC is a dual channel digital unit located on the LP fan case of the engine. Movement of the aircraft throttle levers generates a command signal for the EEC. The EEC converts this signal to an Engine Pressure Ratio (EPR) value or N1 value (when in N1 control mode). VSV scheduling is a function of compressor airflow. This is calculated by the EEC, using measurements of rotor speed (N2) and air pressure (P30). The EEC performs a VSV sweep check on engine starting and engine shutdown and tests the speed of operation of the VSV actuators and alerts maintenance of an impending failure if the time is longer than specified causing action to service the VSV system. The EEC did not issue any warnings of an impending blockage of the supply port fuel filters within the TM, considering the 95% blockage of the filter. A review of the fault store found the initial EEC fault set during the last flight was for a slow VSV torque motor response, which coincided with the momentary ENG 1 CTL SYS FAULT warning in the cockpit. It was noted that the cockpit ECAM warning “ENG1 CTL SYS FAULT” with the associated message “avoid rapid thrust changes” was observed by the flight crew during approach. However, the aircraft system subsequently suppressed the electronic centralized aircraft monitor (ECAM) fault warning to reduce the flight crew workload during demanding phases of flight. United Technologies Aerospace Systems (UTAS) stated that these faults normally relate to filter blockage, or slow response of the VSV controller, constant pressure valve (CPV), pressure drop regulator (PDR) or the actuator control valve (ACV) itself due to debris or surface lacquering. EEC NVM data confirmed the faults associated with reduced / loss of VSV control, including - a) N2 redline limit exceedance. b) P30 pressure tube leakage / blockage – N3/P30 mismatch (actual reading and not a tube fault). c) EPR shortfall – Engine control limiting power due to maximum limit. An ambient, thermo-cycle and vibration test was done with no faults found. No further testing of the EEC was done. Power Control Unit (PCU) The PCU is located adjacent to the EEC and converts 115-volt (V) alternating current (AC) aircraft electrical power supply and engine dedicated generator output to 22V direct current (DC) for use by the engine EEC. The power control unit was tested with no faults found and was returned to service. VSV Controller Unit The VSV controller unit consists of the control servo valve (CSV), the constant pressure valve (CPR), the pressure drop regulator (PDR), the main inlet filter (MIF), the torque motor (TM) and the extend & retract filters. The original unit fitted to the engine on entry-into-service with no removals for repair recorded. The CT scan of the VSV controller and actuators revealed no evidence of internal damage or anomalous features, so they were forwarded to the manufacturer for a teardown and examination without functional testing. The Control Servo Valve (CSV) There was no binding or resistance to movement of the CSV. The CSV contained very fine black debris particles and displayed no significant level of lacquering. The valve was not examined further. The Constant Pressure Valve (CPV) and Pressure Drop Regulator (PDR) The CPV and the PDR contained very fine black debris particles and dark staining was observed around the end of valves. There was no significant level of lacquering. The valves were not examined further. The Extend and Retract Filters The extend and retract filters were clear of contamination and not further examined. The LP Return Check Valve The LP return check valve was clear of contamination. It was not further examined. The Main Inlet Filter (MIF) (45µ) The MIF filter (45µ) showed no visible distortion or breaching of the filter element and was remarkably clean, considering it was just stream of the contaminated torque motor supply port filter. The MIF from the sister engine was removed and a backflush of both MIFs revealed a marked difference of captured debris. Significantly more debris was recovered from the sister MIF compared to the event engine MIF. The captured debris consisted primarily of carbon (C), oxygen (O), sodium (Na), and sulfur (S). Other elements present included iron (Fe), nickel (Ni), zinc (Z), aluminum (Al), silicon (S), magnesium (Mg), and copper (Cu), all consistent with component wear. Compared to field experience of other engines this clean MIF was inconsistent with its time in service. Evidence of contamination of aluminum sulfate (also known as alum) was found in the VSV actuators and the LP fuel filter. The presence of alum provided evidence of free water within the system, with the water providing the main driver for the potential “cleaning” effect of the MIF, sending a cloud of higher concentration of debris to the downstream TM supply filter causing a sudden increase in blockage instead of predictable gradual operational change. R-R controls specialists stated that VSV faults were almost always caught by the EEC checks on the ground during start or shutdown. In comparison, the thrust instability on the event engine occurred in cruise/landing phases of flight and different to “normal” experience with this type of fault, indicating a sudden anomaly rather than normal gradual behavior. The Torque Motor (TM) The TM opera
The loss of control of the left-hand engine and the subsequent thermal damage to the left wing on landing during engine reverse operation was due to a blockage of the variable stator vane torque motor filter that resulted in the engine’s electronic engine control to improper schedule maximum fuel flow resulting in flames out the engine’s exhaust tailpipe that impinged the wing. Contributing to the event were: - The presence of water containing dissolved aluminum sulfate (alum) in the airplane fuel system that initiated a sudden blockage of the engine VSV TM SP filter. - The maintenance provider omitted to sump the fuel tanks during the 10-day period of inactivity of the airplane. - While the engine was in an internally stalled condition during the reverse and post-reverse thrust operation, the electronic engine control logic allowed the fuel metering unit to supply maximum fuel flow despite the throttle at idle speed.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
