Description

On 9 February 2023, a Boeing 777-200ER (PH-BQO) being operated by KLM on a scheduled international passenger flight from Amsterdam to Johannesburg as KL591 was in the cruise at FL 330 with an augmented crew when the cabin crew reported smoke in the galley coming from one of the ovens. The junior purser was nearby and took control, discharging the contents of six fire extinguishers around and then inside the oven concerned before the smoke/fumes ceased. It was decided that although an en-route diversion was no longer necessary, with three of the cabin crew and twelve of the passengers experiencing breathing difficulties, a return to Amsterdam was appropriate and was completed without further event. The passengers and crew suffering from the aftermath of fumes/smoke exposure were treated as necessary and damage to the oven was found to be internal only.

The overheated oven minus its insert and trays. [Reproduced from the Official Report}

Investigation

A Serious Incident Investigation was carried out by the Dutch Safety Board. Relevant data was downloaded from the FDR but data from the 2 hour CVR only included flight deck communications from just after the smoke episode had been dealt with until shortly after the aircraft had arrived at the gate after returning to Amsterdam and therefore did not include any exchanges during the fire fighting process. It was also stated that “on the Boeing 777, it is not possible to preserve the recording as the CB for it is located in the avionics bay (which is) not accessible to the flight crew during flight”.  

It was noted that the flight crew consisted of a Captain, First Officer and Second Officer. They had been employed by the operator as pilots since 1995, 2011 and 2022 respectively. The Cabin Crew consisted of a Senior Purser, a Purser and eight other cabin crew.

What Happened

Twenty minutes after takeoff, the cabin crew switched on the five ovens in the rear galley. After a further hour, with the aircraft in the cruise at FL330, a passenger seated towards the rear of the aircraft alerted the Purser, who was serving passenger meals, to smoke coming from the rear galley. The Purser responded by immediately proceeding there and discovered that smoke was coming from oven number 3. She alerted other cabin crew and took charge of fire fighting whilst ensuring that both the flight deck and the Senior Purser were informed of the situation.

The first step of the relevant procedure required that the galley main power should be switched off but when she checked, she discovered that the green indicator light of the corresponding Push Button Switch Indicator (PBSI) (see the illustration below) was not on and assumed that this meant that the galley main power must have turned off automatically. The Purser donned fire resistant gloves and Protective Breathing Equipment (PBE) and directed the other cabin crew members present to also use PBE to avoid smoke inhalation. She then began to discharge Halon fire extinguishers in the space around the oven but this did not appear to be having much effect.

Meanwhile, the Captain had already started the electronic Smoke, Fire or Fumes Checklist, but had paused before completing it in order to obtain more information on which to base his own assessment of the situation. He therefore went to the rear galley and asked the Purser if the galley main power had been switched off, “which she confirmed”. He then “encouraged the cabin crew to use ample Halon fire extinguishers to fight the oven fire” before returning to the flight deck to review the possible diversion and speak with the company OCC. He also directed the Second Officer to go to the rear galley to continue to monitor the situation there.

After three extinguishers had been discharged in the vicinity of the smoking oven, the Purser assisted by two other cabin crew, opened the oven door in order to remove the oven tray-holding insert in order to look at the back of the oven which appeared to be the area from where the smoke had originated. Both the Purser and the Second Officer could see something glowing at the bottom of the oven and an “orange glow behind the back wall of the oven”. The smoke intensity was considered to have reduced somewhat but, encouraged by the Second Officer, she began discharging further extinguishers into the oven which initially appeared to intensify the smoke before it eventually ceased.

The Galley Main Electrical Power Switch. [Reproduced from the Official Report]

According to the crew involved at the scene, the whole smoke episode “lasted about 20 minutes” with six fire extinguishers discharged around and then into the oven and a seventh was for use. The Captain determined that although there was no longer any need to consider an en-route priority diversion, a return to Amsterdam from their position now south of Marseille was appropriate. The OCC was requested to arrange medical assistance on arrival for the twelve passengers and three cabin crew who were experiencing “breathing difficulties as well as dizziness”. The flight subsequently landed there after 3 hours and 38 minutes airborne and after dumping 30 tonnes of fuel to avoid an overweight landing. Once at the assigned parking position, medical personnel entered the aircraft and checked the affected cabin crew and passengers. 

The oven itself was assessed to be damaged beyond economic repair. Severe heat damage was observed inside the oven and on the back of the oven but there were no signs of heat damage on the oven’s outer shell. The galley floor was heat damaged as a result of the aluminium insert and its trays being placed on it when they were removed from the oven after the oven door had been opened.

Why It Happened

1. The Oven Electrical System
   Normal temperature control in the oven type involved, which was in widespread use at the operator, is facilitated by the Oven Control Module (OCM) which keeps the oven temperature at a constant 180°C when in use. The OCM is powered separately from the oven heating elements although both are supplied from the utility bus. If the normal temperature control functioning of the OCM fails then there is an additional “3-phase safety device” which removes power to the oven if it exceeds the maximum allowed temperature. However, this device does not switch off power to the oven if it simply fails to function for other reasons. If it does remove power due to excessive temperature, it can be reset once the temperature returns to normal by using the reset button on the back of the oven although this can only be done if the oven is removed from its installed position. To electrically isolate both the OCM and the oven heating elements, it is necessary to switch off the Galley Main Power PBSI which also has a specific and adjacent CB (circuit breaker) which, if tripped, has the same effect (see both on the right side illustration above). All parts of the oven power - for the heating elements, the motor which controls the fan and for the OCM - are directly and automatically controlled by the Power Control Board (PCB) which is mounted on the back of the oven. The PCB automatically controls via power semiconductors the switching of the fan motor and the three heating elements required by the program selected on the OCM. These semiconductors produce some heat when operating and are cooled by a heat sink installed at the back of the oven. The PCB is recognised as heat-sensitive and if it becomes too hot, it may “inadvertently switch on the three heating elements when only the fan motor should be on”. PCB cooling is therefore enabled by the provision of external aluminium cooling ribs.
2. How and Why the Oven Overheat Occurred
   The oven was disassembled under supervision. It was found that the meal carrier insert which had been placed in the oven was not the type “strongly recommended” by the Oven OEM and (significantly) had an almost closed back rather than the open back of the usual one (see the illustration below). It was also designed to take seven meal trays rather than the six trays of the correct insert. The almost closed meal carrier insert resulted in an increased temperature behind it (where the fan and the PCB were located) because of the reduced circulation of the heat produced by the three heating elements to the inside of the carrier. This alone was considered to have “placed the oven at a higher risk of an overheat condition”. 

The correct open back meal tray carrier (left) and the closed back meal tray carrier in use. [Reproduced from the Official Report]

The ambient temperature in the vicinity of the PCB was found to have reached at least 75°C and this was assessed to have led to the PCB generating a false ‘on’ signal to the heating elements (a known risk) and ceasing to function as the primary oven temperature control though the OCM. This and the fact that independent the 3-phase safety device had been damaged at some time in the past and was no longer capable of cutting power to the oven, meant that the three heating elements remained on continuously. This caused the oven to begin emitting smoke and the oven heating elements to glow as seen when the oven door was opened.

The initial smoke generated was found to have come mainly from melting parts installed on the back of the oven which then came through the upper cavity between the oven and its surrounding stowage. This smoke was then added to by smoke from the inside of the oven generated as a direct result of the discharge of successive Halon fire extinguishers onto the heating elements and the melting aluminium fan. No other source for the increased amount of smoke after extinguisher use into the opened oven was available. However, since aluminium melts at temperatures between 575 °C and 638 °C and the heating elements were estimated to have reached up to 900 °C, the release of Halon on heated parts inside the overheated oven would have resulted in its decomposition into toxic products which do not remain colourless. Also, the fact that Halon has a higher specific weight than air and would therefore cause the smoke/fumes/Halon mixture to fall rather than rise was consistent with the observation reported from one of the cabin crew present.

The reason why the Galley Main Power PBSI had not been illuminated, leading the Purser - responding to the smoke by commencing the oven smoke/fire procedure - to assume that because it was not illuminated it must have been automatically turned off, was not investigated. The reason for this was that “a cause would be difficult to trace (and) because the benefit of knowing the exact cause.....would be limited, as the light in this PBSI could fail at any time during the flight”. However, it was considered significant that the oven smoke/fire procedure did not include a step to reliably verify that electrical power to all galley equipment has been removed. A replication of the event sequence was able to confirm that had the galley power been switched off, the oven overheat condition would have stopped “within minutes”.

Finally, the oven was examined to establish what eventually caused the removal of electrical power to it and thus eventually stopped the smoke (other than that caused by the decomposition of the Halon discharged into the oven). It was found that two of the three heating elements had eventually sustained enough damage to cease functioning and the third already had sustained enough previously undetected pre-existing damage to restrict the heat it was capable of emitting. This had then allowed the temperature of the PCB, which had been only temporarily disabled by the overheat, to drop sufficiently to restore its normal signal to the OCM to switch off all power to the heating elements. Although the PCB had remained fully functional throughout the overheating, its already-known sensitivity to failure when the normal environmental temperature is exceeded was confirmed.

Conclusions in Summary

• The use of a tray holder insert which was not the type “strongly recommended” by the oven OEM had significantly restricted the airflow at the back of the oven where the power control module was located and was what had initiated the overheating.
• Neither of the automatic oven electrical power cut off systems worked as required, one because it was temporarily disabled by the overheat and the other because it was defective but this had not been detected. The oven therefore continued to overheat when the main galley electrical power was not manually de-selected. This key point was not explicitly covered by a verification requirement in the oven smoke/fire procedure. Company procedures also dictated that cabin crew could only trip the galley power (or any other) CB if the Captain had already been consulted.
• Opening the oven door was directly contrary to the instructions for responding to oven-source smoke/fumes with no fire visible.
• Discharge of Halon extinguishers into the oven interior because the glowing oven heating elements were perceived to be on fire resulted in an increase in both smoke and toxic fumes intensity but had no effect on the overheating because the PCB had been rendered temporarily incapable of shutting off electrical power and the ‘backup’ OCM 3-phase safety device had a pre existing defect.
• The smoke eventually ceased as the oven temperature began to reduce because damage to the three heating elements led two of them to fail when the third had already developed a fault which significantly reduced its heat output. This allowed the normal PCB temperature control to be re-activated through the OCM and oven electrical power to be automatically disconnected.

The identified underlying Cause of the oven overheat was therefore the use of an inappropriate meal tray liner in the oven without any evaluation of the potential overheating consequences.

However:

• Had either the power to the oven been switched off manually as per the oven smoke/fire drill or the backup’ OCM 3-phase safety device not had an undetected pre-existing defect, then the duration and consequences of the smoke episode would have been minimal. 
• The failure of the aircraft operator to follow OEM issued guidance to ensure the continued serviceability of the oven was also identified as the underlying reason why the oven overheat was not automatically prevented from developing by the ‘back up’ power-off system when the normal one was already functionally at risk because of its heat-induced sensitivity. Other OEM guidance on how to install “certain oven overheat protection devices and safety features” had also not been followed. 
• The entirely inappropriate opening of the oven door followed by the continued use of Halon fire extinguishers to deal with smoke simply increased the amount and toxicity of the smoke and extended the time taken to eliminate it.

Safety Action taken by KLM as a result of the event was noted as having included: 

• The identification of several areas for improvement in the training of cabin crew on the importance of checking for flames during smoke events, as well as the difference between training equipment and the equipment on board an aircraft.
• An intention to implement the previously ignored OEM guidance on how to ensure reliable function of the oven OCM 3-phase safety power cutoff device was declared.

The Final Report was issued on 10 June 2024. No Safety Recommendations were made.

Related Articles

• Smoke
• Halon fire extinguishers
• Emergency and Abnormal Checklist
• Standard Operating Procedures (SOPs)
• Airworthiness
• Continuing Airworthiness