Air France Flight 66

A scheduled flight across the Atlantic

Air France flight AF066 left Paris Charles-de-Gaulle at 09:50 UTC on 30 September 2017 for Los Angeles. The Airbus A380-861, registered F-HPJE, carried 497 passengers and 24 crew. Its flight crew consisted of a captain and two first officers, who divided the rest periods for the long flight. The aircraft had four Engine Alliance GP7270 engines and had entered Air France service in 2011. It initially cruised at FL330, then climbed in stages, reaching FL370 at 11:14.

As the aircraft crossed Greenland, the captain was monitoring and one first officer was flying. The other first officer was resting. At 13:48 the crew asked Gander Oceanic for clearance to climb to FL380. The controller approved the request and asked them to report reaching that level. Engine low-pressure rotor speed increased as the climb began. A minute later, the right outer engine suffered an uncontained failure.

The fan separates

The titanium fan hub in engine No 4 broke into at least three pieces. Its central conical fragment remained attached to the low-pressure shaft. Two other large fragments flew outward, one upward and one downward. Their interaction with the engine casing and inlet tore those structures away. Debris struck the wing, pylon, control surfaces and horizontal stabilizer. The surrounding airframe sustained relatively slight damage, and no debris entered the cabin. The pressure shell remained intact.

The aircraft yawed three degrees to the right in three seconds, with airframe vibrations recorded for about four seconds. An engine stall message appeared on the ECAM, followed by an engine failure indication. The captain took control and engaged his autopilot. He moved the affected thrust lever to idle. The engine shut down automatically, and the first officer operated the engine master and fire pushbuttons. The available recordings showed no warning before the fan separation.

Finding a level the aircraft could hold

The pilots could not see engine No 4 from the cockpit, and the camera on the fin did not show it. A cabin crew member brought forward a passenger's smartphone photograph. The resting first officer returned to help, then went to the upper deck to inspect the damage and take more photographs. He also saw damage to the leading edge slats and small vibrations in the flaps. The crew used Air France's FOR-DEC decision method to assess the failure and the diversion.

During the first minute and a half, airspeed fell from 277 to 258 knots while the aircraft remained at FL370. The flight management system calculated an engine-out maximum level of FL346. The captain began descending, but the A380 could not hold the anticipated level and selected speed. He continued through several lower levels. Each new descent interrupted the ECAM actions. After reaching FL290 with the three remaining engines at maximum continuous thrust, he selected FL270 to reduce the demands on them. Speed stabilized at 279 knots.

The diversion to Goose Bay

Gander Oceanic detected the deviation from the cleared vertical profile through datalink information and asked whether there was a problem. Another aircraft relayed the A380's Mayday, and the crew also sent a Mayday through the datalink. Direct voice contact resumed a few minutes later. The aircraft was outside radar coverage during the descent. No nearby traffic was reported and there were no obstacles along the planned route.

The crew and Air France operations considered Kangerlussuaq, Iqaluit and Goose Bay. Kangerlussuaq was closer, but the pilots were unfamiliar with its available approach and were concerned about surrounding mountains and reduced aircraft performance. Runway length also mattered if the flaps became stuck retracted. Iqaluit had adverse weather. They selected Goose Bay, whose runway 08/26 was 3,368 metres long. At 15:42 the A380 landed on runway 26 after an RNAV GNSS approach. Airport crews collected debris from the runway during the prolonged taxi to the stand.

Passengers and the flight recordings

All 521 occupants survived without injury. There was no emergency evacuation. Goose Bay's immigration, passenger handling and accommodation capacity was insufficient for everyone aboard the A380. Some passengers entered the terminal, and meals were served on the aircraft. The captain met passengers in groups of 50 to explain the situation. The last passenger left at 08:10 UTC on 1 October, and Air France arranged onward travel to Los Angeles.

The extended ground phase also affected the cockpit voice recording. It held about two hours and four minutes of sound. By the time it stopped, the engine failure had been overwritten. The captain had anticipated preserving the recording, but the first officer encountered an incorrect circuit breaker location in the aircraft documents and difficulties accessing the avionics bay. Recording stopped automatically five minutes after the final engine shutdown. The flight data recorder, aircraft computer records, radio recordings and crew statements supplied other evidence about the sudden failure and subsequent flight.

Searching the Greenland ice sheet

The flight data located the failure over Greenland. Denmark delegated the investigation to the BEA, which organized work with the Canadian and American authorities and the manufacturers. The debris search area lay on ice about 100 kilometres northwest of Narsarsuaq. Helicopter flights in October 2017 recovered around 30 pieces, including fan blade and inlet fragments. The missing fan hub remained essential to determining the fracture process, but snowfall ended visual searches.

An airborne radar campaign and a ground search followed in 2018. Investigators encountered background noise, limited radar penetration and a vast search area. The hub fragments were still missing at the end of June. Refined processing of the airborne radar data later identified a promising target. For the next expedition, a Danish university group modified an electromagnetic detector to locate titanium several metres below the snow. A strong signal near a crevasse led to excavation. The recovered hub fragment was handed to the BEA in July 2019, 21 months after the accident.

A crack below the blade slot

Examination under BEA supervision traced the crack to slot No 10, about 14 centimetres behind the hub's front face and 1.4 millimetres below the slot bottom. The crack began in a macro-zone, a region of metal grains with a strong common crystallographic orientation. Metallurgical work established cold dwell fatigue. The material met the applicable requirements for the titanium alloy, and investigators found no associated material quality or manufacturing anomaly. The recovered fracture surfaces also ruled out maintenance damage as the origin.

The crack progressed for approximately 1,650 cycles before the hub failed at 3,534 cycles. Its predicted minimum life had been 15,000 cycles. Much of the early crack growth occurred below the surface, where the scheduled maintenance inspections available at the time could not have detected it. Earlier inspections of other engines had found surface damage that made a maintenance-related failure appear plausible. Recovery of the actual fracture origin changed that assessment and established the subsurface fatigue mechanism.

Microscope examination showed both fatigue striations and faceted regions on the fracture surface. Investigators estimated 1,652 striations and identified a transition associated with the crack reaching the surface after about 773 cycles. They found a micro-textured region about 1.75 millimetres wide and 1.63 millimetres deep at the origin. A polished cross-section allowed the laboratory to map the grain orientations. This map closely matched the faceted fracture region, linking the crack to a concentration of similarly oriented grains. The crack eventually extended about 19.7 millimetres before becoming unstable. These examinations connected the microscopic origin beneath the blade slot with the eventual separation of the much larger fan hub fragments.

Cold dwell fatigue and aircraft performance

Dwell fatigue combines cyclic loading with a period during which stress is held. Titanium can undergo creep at ambient temperatures, and the arrangement of its grains affects susceptibility to this process. At the time of the GP7200's certification, the scientific community, industry and certification authorities generally considered Ti-6-4 insensitive to cold dwell fatigue. Tests after the accident showed that longer dwell times could reduce life significantly. The BEA found that the large, strongly aligned macro-zone and the duration of stress in service probably contributed to crack initiation.

The investigation also explained the unexpected descent. The calculated engine-out ceiling assumed a windmilling failed engine. The seized rotor and extensive engine damage produced additional drag, lowering the sustainable level. Operational documents gave the crew no means of estimating the performance loss from such severe damage. The BEA considered their step down descent the only effective means available to find the actual stabilization level. It found their use of the greendot speed appropriate and described FOR-DEC as effective in managing the occurrence.

Inspections, design changes and recommendations

After the accident, the manufacturer issued inspection instructions adopted by the FAA and EASA. As the failure mechanism became known, a November 2019 service bulletin added periodic ultrasonic inspections to eddy current checks, with inspections every 330 cycles. A more elastic fan blade lock ring eased removal and installation and reduced the risk of maintenance damage; deployment began on 25 November 2019. The report recorded that no crack had been detected by 10 March 2020. Air France had also revised its recorder preservation procedures and aircraft information on 4 January 2018.

The BEA's final report identified insufficient knowledge of cold dwell fatigue in Ti-6-4, absent certification instructions for the phenomenon and macro-zones, limits in non-destructive detection, and the increased risk of large macro-zones in bigger forgings as possible contributing factors. Four recommendations addressed EASA and the FAA. They called for control of the risk through design, manufacturing and production checks, and for review of affected titanium rotor parts with suitable in-service inspections where required.