Incident Overview
Cathay Pacific Airways flight CPA829, an Airbus A340-300 registered B-HXN, departed Toronto Pearson International Airport at 2352 eastern standard time on a scheduled flight to Hong Kong with a planned refuelling stop in Anchorage, Alaska. The aircraft carried 249 passengers and 13 crew members. About one hour and nine minutes into the flight, while cruising at flight level 350, the pilots detected an airframe vibration and observed the number 1 engine shut down spontaneously. All cockpit indications before the power loss were normal. The pilots secured the engine per the quick reference handbook, continued on three engines, and diverted to Vancouver International Airport, British Columbia. The aircraft landed at 0105 Pacific standard time without further incident.
Engine Shutdown Sequence
The number 1 engine, a CFM International CFM56-5C4 (serial number 741-705), shut down without any warning to the pilots or recorded by the centralized fault display system (CFDS). The flight crew consulted Cathay Pacific technical personnel in Hong Kong, leading to the decision to divert to Vancouver. No signs of engine rotation (N1 or N2) from windmilling were observed, prompting the pilots to assess the engine had seized; therefore, no restart was attempted.
In Vancouver, maintenance personnel printed a post-flight CFDS report, which showed no indication of the shutdown cause. A borescope inspection verified the engine had not seized, and the accessory gearbox oil filter was checked with no anomalies. A non-motoring test revealed N2 only reached 14% rpm instead of the expected 28% rpm. According to CFM, this lower speed is characteristic of a failure of either the permanent magnet alternator (PMA) or the electronic control unit (ECU). The PMA and ECU were removed, and scoring and burning were noted on the PMA rotor and stator, with excessive play in the drive shaft for the PMA rotor. Post-incident analysis indicated a potentially damaged drive shaft bearing.
Findings on the PMA Bearing Failure
The PMA and ECU were replaced, and a second non-motoring test achieved the required 28% rpm. A full engine test run was conducted, but after about 10 minutes, the engine shut down again without warnings or CFDS record. The replacement PMA showed similar scoring and burning. Examination of the entire PMA drive shaft assembly revealed a visible crack in the ball bearing cage supporting the drive shaft. Spalling damage had occurred on the balls and inner race of the ball bearing due to radial overload stress (contact fatigue). It is likely that oil delivery, component design, or inappropriate application (or a combination) led to the contact fatigue.
When the bearing failed, the PMA rotor contacted the stator, creating an intermittent short-circuit that removed required electrical power to the ECU. Due to a known deficiency in ECU software (version C.3.G), the ECU was unable to acquire alternate electrical power from the aircraft, as designed. The intermittent nature of the PMA failure caused the ECU to become stuck in an endless loop of re-acquiring and losing PMA power, leading to the engine shutdown. CFM had been aware of this software deficiency since November 1999; improved software was developed in early 2000 but not certified until November 2003. Airbus classified the software revision as non-critical, with implementation taking two to three years.
Maintenance Manual Gaps
The Airbus A340 maintenance manual and fault isolation manual did not prescribe limits for radial or axial movement of the PMA drive shaft, nor did they note that scoring of the PMA rotor could indicate a damaged or worn drive shaft bearing. Without such information, maintenance technicians dismissed the unusual score marks on the PMA rotor. This information would have facilitated more effective troubleshooting and likely prevented the second PMA failure during testing, but it is unlikely to have prevented the in-flight incident.
Regulatory Considerations
The FADEC system was certified, in part, under FAR 33.28, which aims to minimize the probability that a FADEC failure adversely affects an otherwise serviceable engine. The fail-safe design relied on ECU software to acquire aircraft electrical power during PMA loss. The failure of the ECU to acquire alternat power due to the known software deficiency raises concerns about the continued airworthiness of the FADEC system and the certification process for the Airbus A340/CFM56-5C combination.
Probable Cause
The TSB determined that the engine shutdown resulted from a spalling failure of the ball bearing in the PMA drive shaft, likely due to oil delivery, design, or application factors, causing the rotor to contact the stator and create an intermittent short; a known deficiency in ECU software then prevented the ECU from acquiring alternate electrical power, leading to the shutdown.