A333, vicinity Atlanta GA USA, 2018
A333, vicinity Atlanta GA USA, 2018
On 18 April 2018, an engine fire warning was annunciated on an Airbus 330-300 which had just taken off from Atlanta. The warning remained after engine shutdown but was eventually replaced by a fire detection caution. Although not visible to the crew, a continued/reignited engine fire was subsequently seen by ATC on final approach and extinguished after landing. The Investigation concluded that the avoidable delay in the return to land had considerably increased the engine and pylon damage and noted that continuation of the fire had been facilitated by hydraulic fluid passing through a valve held partly open by debris.
Description
On 18 April 2018, an Airbus 330-300 (N806 NW) being operated by Delta Air Lines on a scheduled international passenger flight from Atlanta to London Heathrow as DL30 with an augmented crew which included a Training Captain conducting a Line Check on the Operating Captain returned for an overweight landing after a right engine fire occurred shortly after a day VMC takeoff. Although it appeared that the fire had been successfully extinguished whilst airborne, it reignited and substantial damage was caused to the engine pylon. The aircraft was stopped on the runway after landing and with no fire propagation beyond the affected engine and pylon, the fire was extinguished and the aircraft then towed to the gate where the 288 occupants disembarked normally.
Investigation
An Investigation was carried out by the National Transportation Safety Board (NTSB) with FDR data available but an understanding of discussions between the pilots present about the indications of an engine fire and the response which followed was hindered by the fact that relevant CVR data was overwritten. The crew members were not interviewed but statements were submitted.
The flight was rostered as a Line Check for the 60 year-old Captain in command who had a total of 18,730 hours flying experience including 260 hours on type and 7,418 hours in command on all types. The Check was routine after his first six months on type. The 50 year-old First Officer had a total of 9,056 hours flying experience which included 748 hours on type, all of the latter obtained on the accident aircraft. The 62 year-old Training Captain conducting a Line Check on the Captain in command had a total of 15,906 hours flying experience and the Relief First Officer occupying the second flight deck supernumerary seat had a total of 4,740 hours flying experience.
What Happened
Shortly after takeoff from runway 26L with the Captain as PF, the aircraft was around 700 feet agl when an ECAM annunciation of a right engine fire occurred accompanied by a ‘LAND ASAP’ message. The Captain transferred control to the First Officer, carried out the ECAM fire warning actions including discharging both fire shots, but noted that after the engine shut down and extinguisher action, the fire indication had remained. The Relief First Officer declared an emergency to ATC and advised of the intention to return after which he assisted the Captain in completing the ECAM action items.
Once the flight was being radar vectored towards an approach, the First Officer transferred control back to the Captain and resumed PM duties. According to the Training Captain’s statement, at this point, he “changed his role to a regular flight crew member to assist the crew” and took over responsibility for communication with the cabin crew and made a PA to the passengers advising them that the aircraft had engine trouble and would be returning to Atlanta and stopping on the runway so that the emergency services could inspect the airplane.
The fire warning remained illuminated after engine shut down for more than 10 minutes until, with the aircraft on an extended downwind leg, it was replaced with the ‘ENG 2 FIRE DET FAULT caution and the red ‘LAND ASAP’ indication changed to amber. About four minutes after this, an ECAM caution for low fluid level in the Yellow Hydraulic system was annunciated and actioned.
Having assessed that the replacement of the extended duration engine fire warning and red ‘LAND ASAP’ message by the detector fault and amber land back caution had fully resolved the engine fire situation, a few minutes later the flight made a left turn to position onto a right base leg for runway 27R and TWR subsequently cleared the aircraft to land on that runway.
Soon after receiving the readback of this landing clearance, with the aircraft on about a 5 mile final, the controller advised the flight crew that the right engine appeared to be “still smoking”. The aircraft subsequently touched down 26 minutes after takeoff and during the landing rollout, the crew asked the controller “if a fire could still be seen on the right engine” and received the response “affirmative”.
The autobrake remained engaged until the aircraft had decelerated to about 40 knots and was stopped about 2,380 metres past the landing threshold of the 3,775 metre-long runway. The crew advised that they had an indication of hot brakes in addition to the engine fire. The attending RFFS crews “observed smoke and flames emanating from the right engine” and sprayed it with fire-retardant foam which extinguished the fire. The crew then shut down the left engine and the aircraft was subsequently towed to the gate for a normal passenger disembarkation.
Why It Happened
The extensive soot and dark discoloration along one side of the engine core were consistent with a fuel-rich fire. The right side of the engine had sustained the most thermal damage and “multiple fuel and hydraulic components, hoses, and lines” on that side of the engine were “thermally damaged or consumed”. A substantial quantity of charred material and residue was found in the drip pan located beneath the pylon panel which directs any fluid leaks downward and then overboard. This evidence and other evidence pointed to “an intense sustained fire that was likely fed by fuel and/or hydraulic fluid originating from the pylon panel interface” (see below).
It was found that in the days leading up to the accident flight, the aircraft had twice undergone maintenance to resolve reported fuel leaks from the right engine with the defect cleared after replacement of a fuel hose (FM-13) which was part of the engine/pylon interface (see the illustration below). During the on-scene Investigation, the pylon fuel connections were examined and a borosope inspection of the interior of the pylon was performed with no fluid leaks observed. However, the lower flange of the rigid fuel pipe appeared deformed and it was considered that this might have compromised the seal at the interface of this pipe and the flange on the previously replaced FM-13 hose. This would have allowed fuel to leak from the FM-13 hose to the rigid fuel pipe interface which would have enabled leaked fuel to drain to and pool at the bottom of the nacelle with the diffuser, turbine, and exhaust case temperatures all hot enough to ignite the fuel.
It was found that the FM-13 hose fire sleeve removed the day before the accident flight had been observed to be “wet and shiny” which indicated that the fire sleeve had been saturated with fuel. If the replacement FM-13 hose fire sleeve had been saturated with fuel, it would have represented a concentrated fuel source and whilst the hose itself was rated as “fireproof”, this meant only that it could withstand 15 minutes of exposure to fire. The presence of fuel both underneath and on the fire sleeve would be likely to have reduced the hose liner protection and accelerated the failure. Then, after engine shutdown and the closure of the LP valve in the pylon and the HP valve at the engine fuel pump, it was considered that “this residual fuel in the FM-13 hose and other fuel/hydraulic hoses would have leaked into the engine compartment when the hoses were thermally breached”.
Hydraulic fluid is more difficult to ignite than fuel due to a higher ignition temperature and fire-inhibiting properties and the evidence suggested a relatively low level of ignited hydraulic fluid. However, after landing, the indicated contents for both the yellow and green hydraulic reservoirs were low on both the hydraulic service panel and the flight deck. It was estimated that a dripping leak of hydraulic fluid (see the illustration below) which had pooled below it had begun at least 10 minutes after the engine had been shutdown and therefore well after the engine shutoff valves had been closed as part of the engine fire drill.
The fact that hydraulic fluid supply to the affected engine fire zone allow had not been prevented meant that the fire was able to continue after both fire bottles had been discharged. However, it was found that hydraulic system shut off and check valves had functioned normally and concluded that the most likely way for hydraulic fluid to have been able to fuel the fire was via an open yellow hydraulic system in-line case drain check valve, probably attributable to its obstruction by foreign debris of which some was found in the line concerned.
The accident engine pylon hydraulic interface panel with a blue arrow indicating the FM-13 hose and the red circle indicating where hydraulic fluid was first observed dripping from. [Reproduced from the Official Report]
In respect of the eventual occurrence of an ECAM alert for a low level of fluid in the yellow hydraulic reservoir it was noted that the requirement to switch off the system electric pump had rendered two of the spoilers inoperable for the final 9½ minutes of the flight. It was also noted that because the fire had not been due to an internal engine failure but initially and mainly fuel fed, “the key engine parameters would have remained nominal”.
The reason for the fire detector caution was noted as the fact that fire loops are fire-resistant rather than fireproof and were only required to remain functional for 5 minutes in actual fire conditions after which, as in this case, they could be rendered inoperative.
The flight crew response and procedures in relation to both emergency response and the fact that a Line Check was in progress at the time were reviewed.
- A post accident simulator exercise found that it would have been possible for a crew to have landed back about 12 minutes after takeoff by following an optimum flight path - less than half the time actually taken. The crew had intentionally extended the flight time as they responded to the event having concluded on the basis of a fire detection caution eventually replacing the engine fire warning that a landing as soon as possible was no longer necessary.
- If a fire loop failure was annunciated in any condition, the operator's OM required flight crews to “monitor engine parameters more closely than normal for signs of fire and/or over-temperature”. This instruction might have been perceived as of more significance when it replaced the continuing engine fire warning rather than if it had appeared during an otherwise previously normal flight but appeared not to have been.
- A review of training syllabi at Delta and four other operators found that there were no simulator training scenarios in use where a simulated fire continued to burn and the fire indications were deactivated. Most operators used scenarios in which a simulated engine fire warning would prompt the corresponding response after which either the fire would be extinguished or if not then the fire warning message and associated master warning would continue.
- In respect of situations where a Line Check was being conducted from a supernumerary crew seat when an emergency occurs, the Investigation was informed that “if conditions deteriorate to the point that the safety of the flight is in jeopardy and with the Captain’s direction/concurrence, the observing Check Pilot can lend any assistance as directed” with the outcome of the Check subsequently determined in coordination with the Chief Line Check Pilot”.
The Investigation determined that the Probable Cause of the accident was “the flight crew’s delayed landing after an in-flight engine fire, which reignited after both fire bottles were discharged and resulted in substantial damage to an engine pylon”.
Two Contributory Factors were also identified as follows:
- In respect of the delayed landing - the flight crew’s perception that the fire had been extinguished due to the disappearance of the primary engine fire warning indications after the fire detection loops were damaged and that a landing as soon as possible was not perceived to be necessary.
- In respect of the duration of the fire - the contamination of an engine fire isolation system component which resulted in hydraulic fluid leaking into the designated engine fire zone after the engine was shutdown and the fire button was pressed.
Safety Action taken as a result of this event and findings from the Investigation of it was noted as including the following:
Delta Air Lines:
- advised that it would be updating its Flight Crew Training Manuals and creating a mandatory training module for the A330 initial and recurrent training that will include a briefing of this event and a simulator session. The briefing will highlight the operation of the fire warning system and lack of warning if a fire remains un-extinguished and will focus on ECAM priority and the need for an immediate landing.
- Advised that it is also modifying Line Check Pilot guidance to emphasise when such a Check should be stopped during an emergency so that the line Check Pilot can transition from evaluating a pilot to assisting the flight crew.
Airbus:
- updated the A330 IPC to clarify the installation position of the rigid fuel pipe flange against the hydraulic interface panel and updated the AMM to warn maintenance personnel working on engines near fuel, hydraulic and bleed lines to be aware of the risk of flammable fluid leaks and subsequent fire if those lines are disturbed.
The Final Report was published on 2 October 2021. No Safety Recommendations were made.