Description

On 26 June 2016, dense smoke suddenly appeared prior to a daylight engine start in the cabin of a fully boarded Airbus A330-300 (N276AY) being operated by American Airlines on a scheduled international passenger flight about to depart from stand 307 at London Heathrow. An emergency evacuation was commenced on the initiative of the cabin crew but was subsequently limited to exit via the still-attached airbridge. 277 passengers left the aircraft, the majority onto the airbridge and the smoke had almost disappeared by the time the last passengers left the aircraft. There was one recorded minor injury as a result of the evacuation during which slides were deployed at three exits and used at two of these.

Investigation

An Investigation was carried out by the UK Air Accident Investigation Branch (AAIB). Neither the FDR not the CVR contained any useful data, the former because the engines had not been started and the latter because it was found to have remained powered for “several hours” after the event. CCTV footage recorded by the airport operator was found to show a cloud of white smoke appearing immediately behind the aircraft while it was stationary and as this began to dissipate after approximately 30 seconds, the 3R door could be seen to open. This was “followed five seconds later by the door at exit 4R” and slides deployed at both exits with the first passenger jumping onto the 4R slide one minute after the smoke had first appeared. The CCTV footage showed 12 more passengers using the 4R slide over a period of 33 seconds and the first RFFS vehicle arriving 3 minutes 20 seconds after the smoke had appeared and 2 minutes 20 seconds after slide evacuation had commenced.

It was noted that the 61 year-old Captain had 31,635 total flying hours including 1,912 hours on type, that the First Officer had 12,700 total flying hours including 305 hours on type and that the supernumerary crew seat was occupied by an ‘International Relief Officer’ (IRO) - a pilot qualified as a co-pilot on type - who had 11,725 hours type experience. The cabin crew compliment totalled nine.

What Happened

It was established that passenger boarding had begun late with ground engineers, caterers and cleaners still working on-board and as a result, some cabin crew reported having “felt more pressured than usual as a result” of the somewhat more complex task of supervising passenger boarding. During this time, the APU was being used for air conditioning but since the APU generator was unserviceable, ground electrical power was connected. After dealing with defects logged by the inbound crew, the ground engineers were the last to leave one hour after boarding had commenced after which all doors were closed and armed. Passengers seated in the four row 25 seats designated as “exit seats” had been briefed on the contents of their safety instruction cards in respect of their proximity to the emergency exit doors 3L and 3R which contained guidance on opening those exits. All had, prior to these doors being armed, been “required to agree they were able and willing to open these exits if necessary”. The disposition and identification of all 8 exits is shown in the illustration below.

Two minutes after the airbridge access had been removed, it was reconnected at door 2L to facilitate further engineering assistance because of an indicated navigation system defect and all doors were disarmed. It was noted that the unservisability of the In-Flight Entertainment (IFE) meant that the cabin crew would need to deliver a manual passenger safety demonstration using equipment stored in on-board pouches and whilst at this time, most of them were in the vicinity of their designated seats, three were elsewhere seeking demonstration pouches not stored at their positions.

Shortly after the requested ground engineer had arrived in the flight deck, the Captain thought he could smell burning and, “assuming it was associated with the engineering activity”, asked the engineer what was causing it but the latter did not know. A few seconds later, it was reported that smoke had appeared from behind the Captain’s seat and the ‘Lavatory Smoke’ Warning had illuminated on the ECAM. The Captain stated that “over the sound of this, he believed he heard the words ‘smoke in the cabin’ and possibly ‘evacuate’ spoken” and had observed through the open flight deck door that the cabin was "full of smoke” and seen smoke coming from the windshield vents. Since he was aware that the APU was providing air conditioning, he had assumed it was the source of the smoke and had selected the APU bleed off. The crew commenced the abnormal checklist actions for ‘Smoke/Avionics Vent Smoke/Fumes’ and then ‘Lavatory Smoke’ and commenting afterwards that the sound of the various chimes, alarms and warnings operating together had been a distraction. The IRO reported remembering that one of the cabin crew had come into the flight deck and reported that “an evacuation was underway” and at approximately the same time the Captain had seen from a reflection on the face of the terminal building that one of the rear escape slides had been deployed. At the same time, he reported noticing the annunciation of an APU Auto Shutdown and, having “assumed that the situation was under control because the APU had shut down” he made a PA “to stop the evacuation in order to prevent unnecessary injuries” expecting that “this would stop the use of the slides” and that disembarkation would continue only via the airbridge. The Captain reported having noticed that the cabin interphone call light was on but “assumed the sound of the smoke warning had prevented him from hearing the interphone call alert” and after cancelling it received no response to his own call and so made a radio call to the aircraft operator to announce the presence of passengers on the ramp. He then saw RFFS personnel arriving and assumed that there was now no need for a direct alert to ATC.

Reports indicated that all passengers and cabin crew had been off the aircraft within about 10 minutes, most of the 277 passengers used door 2L onto the attached airbridge but 25 used the slides deployed at the two rear exits. Doors 3L and 3R were both opened and the slide at door 3R was deployed by a passenger but neither exit was used. RFFS personnel boarded and checked the aircraft cabin with no findings once the smoke had dispersed, the three pilots then remained on-board for about half an hour “but did not ensure that power for the CVR was disconnected”.

From the perspective of the cabin crew, it was found that the Senior Cabin Crew Member (SCCM) had been in the forward left toilet situated just aft of the flight deck when the smoke first appeared. She stated that the compartment had filled with smoke in approximately four seconds and that as she opened the door, she thought she had heard the words “smoke in the cockpit” several times, followed by the sound of “smoke bells”. She had then “grabbed a fire extinguisher and a Protective Breathing Equipment (PBE) from under her crew seat” and believing initially that the flight deck was the source of the smoke had tried to pass her extinguisher to the pilots but when it was not taken realised that there was smoke throughout the cabin. She then heard a PA from the one of the aft-stationed cabin crew saying “evacuate, come this way” and in response she and a colleague moved aft through the business cabin “ushering passengers towards exit 2L”. On returning to the vicinity of this exit, the SCCM reported having heard a PA from the commander telling passengers to “stop evacuating” and then saw the Captain standing in the flight deck looking into the cabin. Realising that the cabin still contained thick smoke, she told the cabin crew nearby to continue evacuating passengers and went forward to tell the Captain that they should continue the evacuation. He acknowledged this and she then heard a further PA to continue the evacuation and although his initial instruction to stop evacuating “caused a short interruption”, passengers had responded to shouts from the cabin crew to continue exiting onto the airbridge.

The SCCM estimated that 50 passengers had vacated through exit 2L by this stage and “with some light visible at the aft end of the cabin, believed the doors there were open”. She moved aft encouraging passengers to leave their belongings and get off. At row 25, she noticed that door 3L was open without its slide deployed and so directed passengers forward and placed a safety strap across the open exit. Door 3R was also open with its slide deployed but it was subsequently established that it was not used. It was noted that one of the cabin crew who had remained at the front of the aircraft had considered arming exit door 2R but had not done so after concluding that this “might create confusion and break the flow”. At the time the “dense white smoke” had appeared in the cabin there had been four cabin crew in the rear galley. Some of them described the smoke as having a “chemical or electrical smell”. Three of them reported having attempted to contact the flight deck by interphone without success and, with passengers becoming agitated and some standing up, the decision was taken to arm and open doors 4R and 4L and commence an evacuation. The Captain’s PA to stop the evacuation (but not his subsequent one to resume it) was heard by the aft-positioned crew and use of the aft doors was stopped and the remaining passengers were directed forward. Some of them subsequently said that there had still been a lot of smoke in the aft cabin at that time and “because they were unsure of its source, they believed continuing evacuation using emergency escape slides would have been appropriate”.

As the last passengers were leaving via door 2L, RFFS personnel arrived and instructed the cabin crew to evacuate. Several of them reported having “experienced a burning sensation in their nose, throat and eyes after leaving the aircraft” and some that they had continued to experience “minor discomfort, such as headaches and ongoing irritation of their eyes and nasal passages, for 24 hours or more”. It was noted that the ATC GND Controller had a direct view of the aft section of the aircraft and after observing some smoke and the start of a passenger evacuation initiated an ‘Aircraft Ground Incident’ (AGI). When no radio transmissions were received from the aircraft, the controller had “tried unsuccessfully to make contact on the (Clearance) Delivery frequency”.

Operator Procedures

The performance of crew members in relation to relevant Standard Operating Procedures (SOPs) and the configuration of the aircraft was reviewed in detail. In particular, it was noted that the Operator’s ‘Flight Service In-Flight Manual’ (FSIM) contained much of the information necessary for the cabin crew to manage their response to an abnormal situation such as that which occurred. This included an “Emergency Deplaning / Evacuation at the Gate” procedure for use if an airbridge was still attached and an evacuation became necessary, and if the PA system was used, the instruction to be used was for the passengers to “quickly leave the aircraft”. The FSIM stated that such a situation was to be “considered as an ‘Emergency Deplaning’ rather than an evacuation” but it was found that there was no mention of this procedure in the applicable QRH or in the applicable volumes of either the Flight Manual (not aircraft type-specific) or Operations Manual (type-specific). It was, however, noted that such a procedure is recognised by the IATA in its Cabin Operations Safety Best Practices Guide as ‘Rapid Deplaning’ and also in place as a ‘Precautionary Rapid Disembarkation’ procedure at some operators.

It was found that flight crew training in evacuation procedures was “focussed on rejected takeoffs with fires, leading to a cabin evacuation initiated by the commander” and the pilots “had not experienced evacuation scenarios involving a parked aircraft because there was no requirement for them to do so”. Similarly, evacuation procedures training for the cabin crew involved had not included practice in evacuating a parked aircraft since this was “not required”. The Operator’s response was that its cabin crew training programme “emphasised proper assessment of any evacuation situation and the exercise of sound judgment by the cabin crew in accomplishing safe and orderly evacuation”.

The fact that all cabin crew interphone calls to speak to the pilots following the appearance of smoke in the cabin were made using the normal rather than using the emergency / urgent alerting method, which required the use of a different and appropriately-marked call button, was considered to have been of potential significance insofar as these calls went unanswered at a time when the pilots were busy with their own responses to the problem. The available evidence suggested that none of the cabin crew involved had appreciated the difference between the response they should expect from a normal interphone request to speak with the flight deck and an emergency request to do so. In this and other respects, no evidence was found that there was any joint training of flight and cabin crew in emergency procedures at American Airlines. It was noted that the IATA IOSA Standards Manual (ISM) states that where an operator conducts passenger flights with cabin crew, they “should ensure flight crew members participate in joint training activities or exercises with cabin crew members for the purpose of enhancing onboard coordination and mutual understanding of the human factors involved in addressing emergency situations and security threats”. However, it was noted that IATA also “acknowledges that such joint training may be difficult to organise, especially when cabin crew outnumber flight crew, so joint training in emergency procedures is not mandated but its inclusion in recurrent training is recommended, at least once every 36 months”.

In respect of the failure to electrically isolate the CVR after the event, it was found that on the aircraft involved, the CVR circuit breaker was situated in the avionics compartment below the flight deck rather than in the flight deck and that in the case of occurrences such as an evacuation “pilots were to contact ‘maintenance’ to ensure the CVR circuit breaker was pulled” which did not appear to have happened. It was noted that the regulations that were now in place requiring aircraft over 27000 kg MCTOM and “first issued with an individual CofA on or after 1 January 2021” to be fitted with a CVR with a minimum 25 hour duration represented an effective solution.

Previous Similar Events

The Investigation noted several previously investigated events which had involved either issues relating to the initiation or coordination of ground evacuations or loss of CVR data after failure to trip CVR CBs including an evacuation of a Boeing 747-400 at Phoenix in 2009 and an MD88 landing overrun at New York La Guardia in 2015. . It was also noted that after an NTSB Study of 46 emergency evacuations which had occurred between September 1997 and June 1999 had found that “communication and co-ordination issues between flight crew and cabin crew were common” and that “joint evacuation exercises had proved effective at resolving these problems”. A Safety Recommendation that the FAA “should require air carriers to conduct periodic joint evacuation exercises involving flight crews and flight attendants” had been made, but had not subsequently been accepted. Further Safety Recommendations on flight and cabin crew performance during evacuations had been made as a result of the Investigation of the 2015 La Guardia event referenced above.

The APU Failure

The aircraft’s Maintenance Computer showed that “the APU had automatically shut down due to high oil temperature” which had caused the bleed air valve to close. This had shut off the air supply to the cabin and the excess air/smoke had then been “directed overboard via the gas generator exhaust, causing the plume of smoke seen by ATC”.

It was confirmed that the MMEL requirements for dispatch of an aircraft with an inoperative APU generator had been met. The APU was examined in situ immediately after the event and found to show signs of oil wetting around both the bleed air outlet and the APU air inlet. The oil system chip detector was found to have “collected significant quantities of fine particles of ferrous material but the detector had not been triggered” but “the mechanical visual differential pressure indicators of both oil filters had activated” which indicated that the filters had blocked and were therefore being bypassed by unfiltered oil that had eventually led to the failure of the load compressor carbon seal, which it turn had allowed hot oil to enter the cabin bleed air supply and produce smoke in the cabin. It was not possible to positively identify the source of the oil system debris because of its distribution throughout the whole oil system.

It was noted that in November 2007, the APU manufacturer had issued a Service Bulletin to add a system which would initiate an auto shutdown in the event of lubricating oil contamination but thus had not been installed on the aircraft involved in this event. It was considered that had this SB been incorporated, “it is likely the APU would have shut down automatically prior to the filter bypass condition, thereby preventing the conditions that led to pyrolysed oil entering the cabin”.

The formally-stated Conclusion of the Investigation was as follows:

Smoke entered the cabin after the APU load compressor oil seal became compromised, allowing hot oil to enter and pyrolyse in the bleed air supply to the cabin. Examination of the APU after the event revealed considerable metallic debris in its shared oil system. This debris eventually caused the load compressor carbon seal to fail, allowing hot oil to enter the bleed air supply to the cabin and causing smoke in the cabin. The initiating source of the debris could not be identified positively due to the distribution of debris throughout the oil system.

Modifications exist to mitigate these conditions and two Safety Recommendations have been made (to the effect) that an optional SB, to add enhanced APU automatic shut-down protection for lubrication system contamination, be mandated.

The aircraft manufacturer has reviewed and amended the MMEL to provide enhanced mitigation when operating with unserviceable APU AC auxiliary electrical generation.

This emergency situation, involving an evacuation from an aircraft parked at the gate with the (airbridge) in place, was unusual for the (Cabin Crew) who had not practised it as part of the aircraft operator’s training programme. Prompt and effective communication between the cabin and the flight deck might have avoided an evacuation, but the pilots and the IRO were distracted by the presence of an engineer, who was attending to a defect. The normal interphone call function used by the cabin crew did not attract their attention. The emergency call function may have been more conspicuous but guidance provided by the aircraft operator concerning its use may have been confusing.

An evacuation was initiated because (cabin crew) did not receive specific instructions from the flight crew and the (cabin crew) perceived that the situation was life-threatening. Exits at the front of the aircraft were not used, indicating that the (cabin crew) in this part of the aircraft were trying to achieve an ‘Emergency Deplaning’ via the (airbridge), even though an evacuation was commanded.

This may have been the most appropriate procedure in this situation but it was not a drill familiar to the flight crew and better crew communication was required before using it.

Passengers near exits 3L and 3R had accepted responsibility for exit operation and, with no (cabin crew) in their vicinity when the emergency began, opened the doors but did not deploy one of the slides. This created the hazard of an unprotected five metre drop from the doorway to the ground and, even though one of the cabin crew subsequently placed a security strap across the opening, it was fortunate that nobody used the affected door.

Once the commander had realised an evacuation was underway he instructed it to cease because he believed he had removed the source of the smoke and wanted to prevent injury, but he did not discuss the cabin situation with the cabin crew before making his PA. This indicated a breakdown in communication and co-operation between flight crew and cabin crew members; an issue which is being addressed by the operator through enhanced guidance and training. Other operators may be susceptible to similar shortcomings in these circumstances until regulations for cabin evacuation training are amended to minimise them.

Safety Action taken by American Airlines and known to the Investigation was noted to have included but was not limited to the following:

• A type-specific ’Emergency Deplaning’ drill has been developed for use by pilots on each of the Operator’s aircraft types and incorporated into the OM and the appropriate QRH. This drill is relevant to parked aircraft that are using an airbridge or steps. Details have been promulgated to all crews and pilots have received relevant simulator training.
• A Company safety investigator is expected to contact an aircraft commander by telephone as soon as the ‘Dispatch’ department has been advised of a serious incident or accident. The safety investigator is now required to remind the commander during this contact that action be taken to ensure the circuit breaker for the CVR is pulled without delay.
• A review of the interphone equipment on different aircraft types found that there are differences in the way cabin crew must make an emergency call to the flight deck. These differences include the Airbus A330-300 where the ‘EMER CALL’ button must be pressed once and the Airbus A330-200 where the ’PRIO CAPT’ button must be pressed.

Eight Safety Recommendations were made as a result of the Investigation as follows:

• that the Federal Aviation Administration mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. [2017-022]
• that the European Aviation Safety Agency mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. [2017-023]
• that the Federal Aviation Administration regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. [2017-024]
• that the European Aviation Safety Agency regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. [2017-025]
• that the Federal Aviation Administration reconsider the requirements for briefings given to passengers seated at exits, to ensure they offer appropriate guidance on exiting the aircraft rapidly in an emergency without implying undue responsibility for opening the exits. [2017-026]
• that the Federal Aviation Administration require cabin crew on aircraft that are parked, and with passengers on-board who are neither boarding nor deplaning, to be evenly distributed throughout the cabin and in the vicinity of floor-level exits in order to provide the most effective assistance in the event of an emergency. [2017-027]
• that the European Aviation Safety Agency require cabin crew on aircraft that are parked and with passengers on-board to be evenly distributed throughout the cabin and in the vicinity of floor-level exits, in order to provide the most effective assistance in the event of an emergency. [2017-028]
• that the Federal Aviation Administration require that flight and cabin crew participate in joint training to enhance their co-ordination when dealing with emergencies. [2017-029]

It was noted that Safety Action taken since the occurrence of the investigated event and known to the Investigation had included the following:

• American Airlines recognised that its existing procedures for cabin evacuation were primarily a response to incidents occurring during take-off or landing and that to satisfy its SMS, these needed to be modified. An “Emergency Deplaning and Evacuation Task Force” was formed to establish ways to “improve co-ordination and communication between the workforce in the flight deck, the cabin and on the ramp (and) to mitigate risks to passengers and employees during emergencies”. This resulted in several internal safety actions.
• Airbus made changes to the type MMEL in respect of the dispatch of an aircraft with the APU Generator unserviceable.

The Final Report of the Investigation was published on 14 December 2017.

Related Articles

• Smoke
• Emergency or Abnormal Situation
• Emergency and Abnormal Checklist
• Emergency Evacuation on Land
• Auxiliary Power Unit (APU)
• Aircraft Bleed Air Systems
• Cabin Fumes from Non-Fire Sources
• Standard Operating Procedures (SOPs)
• Minimum Equipment List (MEL)
• B744, Phoenix USA, 2009
• MD88, New York La Guardia USA, 2015