This article describes new measures to improve survivability of aircraft from uncontained gas turbine engine failures. The US military has adopted a common tool—Uncontained Engine Debris Damage Assessment Model (UEDDAM)—for its methodology to consider uncontained events in a more realistic manner. UEDDAM can handle the analysis for the release of the primary rotor-disk segment plus smaller engine debris fragments in directions out of the plane of rotation. The UEDDAM code requires an input of a three-dimensional geometric description of aircraft component positions within the aircraft and thus, in relationship to each other. The description uses a specific input format. Adopting an assessment methodology, like UEDDAM, results in a universal standard and uniformity of debris hazard evaluation across the involved agencies. Maintaining the 3D aircraft geometry model and its components/system functional flow data generated by aircraft manufacturers during their initial hazard assessment would simplify later debris hazard reassessments required by maintenance, repair, or military-modification to a commercial aircraft.
Modern, high-bypass ratio aircraft gas turbines used in commercial aviation and on military transports have an exceptionally high level of reliability; however, events do occur that lead to catastrophic engine failures. While typically the engine is destroyed in such events, it is desired to fully contain any debris and not have a fire that spreads. Occasionally an engine will suffer an uncontained engine debris event. Most engines are required to meet a specific level of debris containment, but more severe events can and do occur such as the November 4, 2010 incident of Qantas flight 32 (an Airbus A380 aircraft with Rolls-Royce Trent 900 series engines). The number 2 engine sustained an uncontained failure of the Intermediate Pressure (IP) turbine disc soon after takeoff from Changi Airport, Singapore, for Sydney, Australia.
Commercial airplane manufacturers are required by both the US Federal Aviation Administration (FAA) and European Aviation Safety Agency (EASA) to certify that their designs are able to meet stringent requirements of flight safety in case of a catastrophic event. Recent military aircraft programs, using specific military designs and commercial derivatives, have also required certification similar to FAA and EASA requirements.
Although the design safety requirements are now essentially the same for commercial and military aircraft, there currently is no standard methodology for certifying the safety of the aircraft in the event of a hazardous uncontained engine event for both military and commercial aircraft. The FAA document Design Considerations for Minimizing Hazards caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure (AC 20-128A) provides additional guidance for completion of the numerical analysis although no specific methodology is identified.
Each aircraft manufacturer and engine company has its own methodology, and only recently has the US military adopted a common tool, UEDDAM (Uncontained Engine Debris Damage Assessment Model), for its methodology to consider uncontained events in a more realistic manner. UEDDAM can handle the analysis for the release of the primary rotor-disk segment plus smaller engine debris fragments in directions out of the plane of rotation.
In the case of military use of commercial derivative aircraft, there are usually two separate safety assessments required. The original aircraft must be certified by the FAA and EASA for the first. The second is following the modifications for the military, where the same aircraft must again be safety certified by essentially the same rules.
A common methodology for analyzing the hazard from uncontained engine debris would benefit engine manufacturers, air framers, and customers, with increased reliability and reduced costs. It would result in confidence that the results for ah the different agencies are in agreement. Further, it would reduce efforts in the case of multiple assessments both in the civil cases of aircraft or engine repair and in the case of military modification to a commercial aircraft.
The debris from an uncontained engine event consists of high energy penetrators that range in mass from 10s of grams (a few ounces) to a high of 135 kg (300 pounds) and should be viewed as aircraft combat survivability damage mechanisms since they can perforate, slice, severe, crush, or dislodge flight critical components or other aircraft critical components. Their velocity when exiting the engine cowling can beupto305 m/s (1,000 ft/s). Any assessment methodology must model the effects of all debris potentially penetrating into the aircraft, its passing into and through structural components, and its impacting aircraft flight critical components. Thus, these assessments must evaluate both effects of damaged flight critical components on their aircraft system function and the cascading effects that multiply degraded systems have on overall aircraft flight capability. The larger, more massive, debris fragments can also create structural and decompression failures. Therefore, an analysis methodology would require both physical (e.g., finite element) and functional modeling of ah the aircraft components within the zone of debris expansion from an engine.
In the case of the Qantas Airbus A380 incident, the uncontained engine debris cut electrical and hydraulic lines in the leading edge of the wing causing the loss of multiple systems. Additionally, two fuel tanks were penetrated causing significant fuel loss and creating a fire hazard. Although damage began with a single engine event, the cascading damage effects quickly lead to over 50 automated system warnings to the crew regarding systems failures or impending failures. Civilian commercial aircraft are designed with redundancy for reliability and safety, such that if a single system fails another system can provide the same or similar function. However, as Dr. Robert E Bah described in his book The Fundamentals of Aircraft Combat Survivability Analysis and Design, second edition, redundancy without effective separation is only reliability and not survivability (avoiding or withstanding the damage effects of a damage mechanism).
In the late 1990's, the FAA initiated an effort to develop an assessment methodology that would model of ah the aircraft components within the zone of debris expansion from an engine. The Naval Air Warfare Center Weapons Division (NAWC-WD), China Lake, was funded to develop a tool to assess the hazard from an uncontained engine debris event. This effort resulted in a computerized methodology for hazard assessment based on existing, well-established, and well understood Tri-Service vulnerability assessment methodology. The code, Uncontained Engine Debris Damage Assessment Model (UEDDAM), is based on two principal vulnerability assessment codes: FASTGEN and COVART. Each of these codes has been used for over 25 years for the assessment of damage effects on an aircraft from incident kinetic energy penetrating objects — i.e., missile fragments. The UEDDAM code models both the physical and functional characteristics of ah aircraft components within the debris zone; the functional relationships of all flight critical components and systems; the penetration of the debris through the aircraft; the damage characteristics of debris against component; and, it then sums up the results into a probabilistic “hazard level” of an event as a function of aircraft flight phase.
The UEDDAM code requires an input of a three-dimensional (3D) geometric description of aircraft components positions within the aircraft and, thus, in relationship to each other. The description (“aircraft model”) uses a specific input format; one that can be processed by FASTGEN to develop debris travel vectors (“rays”) through the aircraft, to identify which components are intercepted by each ray and the geometry of this intersection. These debris rays are then used in COVART to assess the penetration depth the debris would be expected to achieve along each ray. COVART identifies which critical components are hit, and gathers the probability of component damage of each component hit. Naturally, this sub-process also requires input data on damage characteristics associated with every possible critical component. COVART will also predict the effects on overall system function as a result of critical component damage; this is done by using an input file that defines component/system functional flow characteristics. UEDDAM then post-processes the output data from COVART, which utilized FASTGEN rays, to yield the hazard levels as a function of a particular debris event.
Adopting an assessment methodology, like UEDDAM, results in a universal standard and uniformity of debris hazard evaluation across the involved agencies. Maintaining the 3D aircraft geometry model and its component/system functional flow data generated by aircraft manufacturers during their initial hazard assessment would simplify later debris hazard reassessments required by maintenance, repair, or military-modification to a commercial aircraft. Given UEDDAM already exists; we see this as the low-cost solution to creating this assessment standard for both commercial and military.