Description

On 28 October 2016, the crew of a Boeing 767-300 (N345AN) being operated by American Airlines on a scheduled passenger flight from Chicago O'Hare to Miami as AA 383 rejected take off in day VMC after a very loud noise was heard from the vicinity of the right engine, a GE CF6-80C2B6, just before V1. As soon as the aircraft stopped, a fuel fed fire developed rapidly in the right hand engine and as it spread, an emergency evacuation during which 1 of the 161 passengers was seriously injured and one member of the 7 person cabin crew and 19 passengers sustained minor injuries.

The right hand side of the aircraft with the evacuation complete and the fire extinguished. [Reproduced from the Official Report]

Investigation

An Investigation into the accident was carried out by the NTSB. DFDR and CVR data was successfully downloaded and was of assistance to the Investigation.

It was noted that the 61 year-old Captain had accumulated about 17,400 total flying hours including about 4,000 hours on type and 1,500 hours were in command to which he had been upgraded about 2½ years prior to the accident. He had originally obtained his Boeing 757/767 type rating in 1995 when a pilot with TWA and had after that flown DC9 variants, particularly the MD80, and had continued to do so with American Airlines when it absorbed TWA in 2001. The 57 year old First Officer had accumulated about 22,000 total flying hours which included about 1,600 hours on type.

What Happened

It was established that the Captain had been acting as PF for the takeoff from runway 28R which was commenced from the runway’s intersection with taxiway N5. This was approximately 990 metres from the start of the runway and provided a TORA of approximately 2,970 metres. Spool up of the engines was normal as was the takeoff until 11 seconds after the routine ’80 knots’ call at which point a large “bang” was recorded on the CVR, the FDR recorded acceleration suddenly diminishing and both pilots reported having felt the aircraft “drift to the right”. Within less than 2 seconds, the FDR recorded the thrust levers being set to flight idle. One second later, the autobrakes, which had been set to the ‘RTO’ position, activated followed after a further 2 seconds by the auto speedbrakes at which time the airspeed peaked at 134 KCAS which was equivalent to the calculated V1 for the takeoff. The First Officer advised ATC that the aircraft would be stopping on the runway and the controller responded with “roger roger fire” which was the first indication the pilots had that a fire had begun. Almost immediately an EICAS Warning ‘ENG FIRE R’ was annunciated with the aircraft decelerating through 35 knots. The CVR recorded the Captain calling for the Engine Fire Checklist (which commenced with five memory items) 20.6 seconds after the CVR had recorded the ‘bang’ sound. Six seconds later, the aircraft came to a stop 26.4 seconds after the right engine failure, about 800 metres along the runway from where it had occurred.

Once stopped, the Captain reported that he had immediately smelled smoke. Whilst the fire drill for the right engine was being run, the left engine remained at idle. Thirty five seconds after the aircraft had come to a stop, the Captain called for the Evacuation Checklist. The second and third steps in this Checklist involve depressurising the aircraft which the Captain subsequently stated took “a long time”. He also stated that whilst this Checklist was being run, he could hear a “commotion” on the other side of the flight deck door and realised that the cabin crew had begun an evacuation. He added that after completing the fourth step in the Evacuation Checklist, which was to shut down the left engine, he had made a cabin PA ordering an evacuation and had activated the emergency evacuation signal switch. The crew then completed the remainder of the Checklist and vacated the flight deck into the cabin where “a lot of smoke” was evident – the Captain subsequently described not being able to see further than “about 2 feet” in front of him. They were met by the Senior Cabin Crew Member (SCCM) who informed them that all passengers and all the other cabin crew were already off the aircraft and the three of them then left the aircraft too, the Captain last.

Once outside, it was quickly apparent to the crew that ignition of fuel leaking from the damaged right engine and pooling under the wing once the aircraft had stopped, was leading to rapid development of the fire. The RFFS arrived at about this time and began extinguishing the fire.

The Engine Failure

Some debris from the right engine and wing was found on the runway where the engine had failed. Most of the engine’s second stage High Pressure Turbine (HPT) disc, which had disintegrated and had been the source of the failure, was found in four pieces one of which (a 26 kg section labelled ‘A’ in the illustration of the recovered disc fragments below), had passed though the inboard section of the right wing, over the fuselage and into a UPS warehouse facility 895 metres south of the engine failure position. The origin of the initial fatigue fracture was found by visual laboratory examination of the fragments which identified a discoloured (heat-tinted) area on the disc surfaces separating fragment A and fragment B. This disc had failed after 10,984 cycles out of a life limit of 15,000 cycles.

Metallurgical examination of the fractured nickel-based alloy surfaces then revealed “multiple subsurface micro-structural discontinuities with multiple cracks initiating along the boundary of the discontinuities”. These dark grey-coloured discontinuities were observed to be elongated in the direction of the grain structure pattern produced during forging. Multiple cracks had started along the edges of the discontinuities and then grown in both directions. Scanning Electron Microscope (SEM) images of the fracture surface showed crack propagation had been “consistent with crack growth by low-cycle fatigue, followed by a transition to cyclic tensile crack growth and then tensile overstress”. Such material weakness was characterised as a “stealth anomaly”.

The main fragments of the HPT Stage 2 Disc viewed from the front. [Reproduced from the Official Report]

It was noted that the industry standard techniques for detecting material weakness such as that which eventually resulted in the disintegration of the disc have, for many years, been dependent on Ultrasonic Inspections and that the undetected fault in the material used to manufacture the disc which failed was the first known case involving this alloy. Once the engine was in service, it was noted that the inspection interval and methods prescribed for routine maintenance had not been effective as a means to risk management. This was because the in-service inspections were only aimed at the detection of surface and near-surface cracks rather than sub surface cracks of the type which led to the failure.

The Evacuation

The Investigation could find no evidence that, once the evacuation was complete, the cabin crew had carried out a count of all evacuees as specified in the Company Boeing 767 Operations Manual and no evidence that the Captain fulfilled his responsibility to ensure that at least one crew member remained with the passengers. It was concluded that “even though this situation did not result in any adverse outcomes […] (members of the flight and cabin crew) did not coordinate in an optimal manner once the passengers were evacuated”.

The only serious injury during the evacuation was to a passenger who was one of those who left the aircraft by one of the left side overwing exits. He subsequently stated that on reaching the ground after using the left overwing exit slide “he stood up to get away from the airplane and was blown over by the jet blast coming from the back of the left engine”. He added that “as he stood up again and ran to a grass strip next to the runway, he felt pain in his back”. At the time the jet blast was encountered, the left engine was running at idle thrust.

As part of a detailed analysis of the evacuation, the Investigation sought to establish why the left engine was still running and how an exit near to an operating engine came to be in use. The eight emergency exits consisted of doors on both sides at the front and rear and two adjacent overwing exits on each side at the centre, each pair feeding the same evacuation slide leading rearwards off the wing. The seven cabin crew were located next to all but one of these exits, the exception was one of the right side overwing exits. The cabin crew began the evacuation as soon as the aircraft stopped, with the first exit, (2L) being opened by one of the cabin crew 10 seconds after the aircraft stopped and the adjacent 3L exit being opened by a passenger at about the same time. The front exits 1L and 1R were opened 18 and 22 seconds after the aircraft stopped and finally exit 4L was opened 38 seconds after the stop. There was no record of evacuation from exit 1R but the first passenger out on the left hand side was recorded using the left hand overwing evacuation slide 15 seconds prior to left engine shutdown - and spool-down took a further 10 seconds. The 4L evacuation slide was initially deployed 23 seconds prior to left engine shutdown but although it remained attached, it was (correctly) not used until it returned to its normal position after the left engine was shut down.

Cabin crew at the centre and rear cabin positions all reported that passengers had been keen to evacuate without delay after seeing the fire on the right hand side develop during the deceleration following an obvious major engine failure on the right hand side. Many had begun moving across the cabin and away from the centre of the cabin whilst the aircraft was still moving. Three of the cabin crew reported having had difficulties using their interphone/PA handsets because they were of a different (newer) design to others on the airline’s 767 fleet, the change having occurred in 2003. A crew training issue was found in this respect as the accident aircraft had the new model interphone installed but although the two cabin crew training simulators used each had a different interphone model installed, only the older equipment was functional, the newer type being a non-functioning mockup.

The guidance on the initiation of an evacuation by cabin crew was found to include the statement that it is “critical” for the Captain to be updated if cabin conditions warrant an evacuation because those in the flight deck may be unaware of life- threatening situations such as excessive smoke and/or fire and also that “if the aircraft is on the taxiway and time permits, notify the flight deck prior to initiating the evacuation.” It was noted that those cabin crew who had “attempted communication using the interphone system were unsuccessful in reaching the flight crew”. It was also found that the cabin crew manual required that, on aircraft so equipped, an ‘evacuation signalling system’ located at all cabin crew stations should be activated if an evacuation was being commenced and would provide an aural and a visual alert in the flight deck. The accident aircraft was so equipped but none of the cabin crew did this and the Investigation was unable to establish why.

The fact that one of the cabin crew at the left overwing exits had permitted their use when it should have been obvious that the continued operation of the left engine even at idle thrust represented an ‘unsafe condition’ was noted as having been contrary to specific direction in the evacuation guidance for cabin crew contained in the ‘Flight Service Inflight Manual’. This requires a prior check that both the exit and escape route are safe to use.

Since the delay in shutting down the engine on the side which most of the evacuation was going to have to take place was an important factor in delaying the evacuation and had been contributory to passenger pressure on cabin crew to let them off as well as to the single directly-consequent serious passenger injury, flight crew actions once the aircraft was stopped and the procedures on which these actions were predicated were reviewed.

The flight crew priority was the 16-step Engine Fire Checklist. Because the (light) surface wind had been a crosswind, the smoke was not blowing towards the flight deck and the crew “could not readily see the amount of smoke coming from the right engine” since it was confirmed that the First Officer would have been unable to see the right engine and most of the right wing through the right-side window from his seat. The pilots were therefore “unaware of the severity of the fire (or that) that the cabin was beginning to fill with smoke”. The Engine Fire Checklist was designed for both the in-flight and on-ground case, and the Captain reported having recognised that “continuing the engine fire checklist would not be appropriate because the airplane was on the ground” he had then called for the Evacuation Checklist, which had nine steps, about 4 seconds after first seeing external smoke.

The Evacuation Checklist was required to be called by the First Officer, performed by the Captain and cross checked by the First Officer. Following setting or confirming that the Parking Brake was set, the second and third steps were required to depressurise the aircraft which the Captain reported “took a long time, even though the airplane had not yet been in flight”. There was no obvious reason for such a delay since “at this point, the exits would have been opened, so the cabin would have already been depressurised”. Shutdown of both engines using the fuel cut off was the fourth step - although in this case, the right engine had already been shut down as part of the Engine Fire Checklist.

The Investigation concluded that the Captain’s decision to perform the Engine Fire Checklist first was “appropriate given his training, the information provided by ATC, and the fire warnings” but noted that “the design of the Engine Fire Checklist delayed initiating the Evacuation Checklist” and thereby the shutdown of the left engine and giving of an order to evacuate from the fight deck. It was observed that a risk of unnecessary delay in beginning an emergency evacuation because of an engine fire on the ground could be removed if there were separate Engine Fire Checklists for use in flight and on the ground.

Related Evacuation Issues identified in previous NTSB Investigations

It was noted that various evacuation-related crew communications issues had been identified in two previous accidents investigated by the NTSB with both being the subject of corresponding Safety Recommendations to the FAA, in one case with intended action still pending and another with no action taken. The former was the 2015 landing overrun by a Delta Airlines MD88 at LaGuardia and the latter the engine fire-caused evacuation of an American Airlines MD82 at Lambert St, Louis in 2007. This latter Investigation recommended in 2009 that the FAA should revise AC 120-48 ‘Communication and Coordination Between Flight Crewmembers and Flight Attendants’ which still has not been revised since its issue in 1988.

It was also noted that at the time of completion of this Investigation, there were two other ongoing NTSB-investigated accidents involving engine fires in which emergency evacuation had also begun prior to engine shutdown, the Boeing 777-200 rejected takeoff at Las Vegas in 2015 and the Boeing 767-200 taxiing out for takeoff at Fort Lauderdale also in 2015.

Uncontained ‘Rotor Burst’ Engine Failures

The Investigation noted that the FAA’s original 1988 version of AC 20-128 “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure”, had been revised and re-issued in 1997 after the 1989 uncontained engine failure accident to a United Airlines DC 10 at Sioux City and that the FAA had recently advised that a further revision and re-issue, prompted particularly by the 2010 Qantas Airbus A380 uncontained engine failure climbing out of Singapore, was expected to be issued in draft form by the end of 2018.

It was noted that “during the 20 years since (the revised version of) AC 20-128 was issued, the NTSB has investigated, participated in the investigation of, or become aware of at least 40 uncontained rotor burst events” in addition to the A380 one. It was particularly noted that although the Boeing 767 in the event being investigated satisfied the design guidance in that AC aimed at preventing fuel being liberated by uncontained engine debris wing damage, this had not prevented a serious fuel-fed fire beginning almost as soon as wing damage had occurred. It was also noted that a fire of similar origin which had occurred during an engineering ground run at Philadelphia in 2000, also demonstrated that there was a clear need for modified design guidance to achieve the intended prevention of fuel-fed fires arising from uncontained engine failure damage.

The Probable Cause of the accident was determined as “the failure of the high-pressure turbine (HPT) stage 2 disk, which severed the main engine fuel feed line and breached the right main wing fuel tank, releasing fuel that resulted in a fire on the right side of the airplane during the takeoff roll. The HPT stage 2 disk failed because of low-cycle fatigue cracks that initiated from an internal subsurface manufacturing anomaly that was most likely not detectable during production inspections and subsequent in-service inspections using the procedures in place.”

Two Contributory Factors were also identified in respect of the serious passenger injury which occurred during the emergency evacuation:

1. the delay in shutting down the left engine which was contributed to by:
   • the lack of a separate checklist procedure for Boeing 767 airplanes that specifically addressed engine fires on the ground and
   • the lack of communication between the flight and cabin crews after the airplane came to a stop;
2. a flight attendant’s deviation from company procedures, which resulted in passengers evacuating from the left overwing exit while the left engine was still operating.

A total of 9 Safety Recommendations were made as a result of the Investigation as follows:

• that the Federal Aviation Administration should establish and lead an industry group that evaluates current and enhanced inspection technologies regarding their appropriateness and effectiveness for applications using nickel alloys, and use the results of this evaluation to issue guidance pertaining to the inspection process for nickel alloy rotating engine components. [A-18-3]
• that the Federal Aviation Administration should require subsurface in-service inspection techniques, such as ultrasonic inspections, for critical high-energy, life-limited rotating parts for all engines. [A-18-4]
• that the Federal Aviation Administration should revise Advisory Circular (AC) 20-128A, “Design Considerations for Minimising Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure,” based on an analysis of uncontained engine failure data since the time that the AC was issued, to minimise hazards to an airplane and its occupants if an uncontained engine failure were to occur. The revised AC should include modifications to the accepted design precautions for fuel tanks given the fires that have occurred after uncontained engine failures. [A-18-5]
• that the Federal Aviation Administration should, when approving the operating procedures of a 14 Code of Federal Regulations Part 121 air carrier, require operators to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation. [A-18-6]
• that the Federal Aviation Administration should develop and issue guidance to all air carriers that conduct passenger-carrying operations under 14 Code of Federal Regulations Part 121 regarding (1) discussing this accident during recurrent flight attendant training to emphasise the importance of effectively assessing door and overwing exits during an unusual or emergency situation and (2) providing techniques for identifying conditions that would preclude opening exits, including an operating engine. [A-18-7]
• that the Federal Aviation Administration should review the training programs of all 14 Code of Federal Regulations Part 121 operators and make changes as necessary to ensure that the programs provide flight attendants and flight crews with training aids and hands-on emergency scenarios that account for the different interphone systems that air carriers operate. [A-18-8]
• that the Federal Aviation Administration should conduct research to (1) measure and evaluate the effects of carry-on baggage on passenger deplaning times and safety during an emergency evacuation and (2) identify effective countermeasures to reduce any determined risks, and implement the countermeasures. [A-18-9]
• that Boeing should work with operators as required to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation. [A-18-10]
• that American Airlines should, for all airplanes operated, review existing engine fire checklists and make changes as necessary to ensure that the procedures would expeditiously address engine fires occurring on the ground without unnecessarily delaying an evacuation. [A-18-11]

Two Previously Issued Safety Recommendations were also formally re-iterated:

• that the Federal Aviation Administration should revise Advisory Circular 120-48 ‘Communication and Coordination Between Flight Crewmembers and Flight Attendants’ to update guidance and training provided to flight and cabin crews regarding communications during emergency and unusual situations to reflect current industry knowledge based on research and lessons learned from relevant accidents and incidents over the last 20 years. [A-09-27]
• that the Federal Aviation Administration should develop best practices related to evacuation communication, coordination, and decision-making during emergencies through the establishment of an industry working group and then issue guidance for 14 Code of Federal Regulations Part 121 air carriers to use to improve flight and cabin crew performance during evacuations. [A-16-26]

The Final Report of the Investigation was adopted on 30 January 2018.

Related Articles

• Uncontained Engine Failure
• Wing Fire
• Emergency Evacuation on Land
• Emergency and Abnormal Checklist
• Emergency or Abnormal Situation
• MD82, vicinity Lambert St Louis MO USA, 2007
• B772, Las Vegas NV USA, 2015
• DC10, en-route, diversion Sioux City USA, 1989
• A388, en-route Batam Island Indonesia, 2010

Further Reading

• FAA AC 120-48 Communications and Coordination Between Flight Crewmembers and Flight Attendants, 13 July 1988