Atlanta, GA, USA
N806NW
AIRBUS A330 323
The Delta Air Lines flight had departed from Hartsfield-Jackson Atlanta International Airport (ATL), Atlanta, Georgia. When the airplane was at an altitude of 700 ft, the flight crew received continuous warnings of a right engine fire. According to the crew’s statements, the captain transferred control of the airplane to the first officer and performed the required electronic centralized aircraft monitor (ECAM) procedures, including discharging both fire extinguishing bottles. However, the fire reignited before landing, and aircraft rescue and firefighting crews needed to extinguish the fire. Because the fire was not extinguished or re-ignited quickly (uncontrolled), the airplane sustained substantial damage to the right pylon. However, the fire remained contained in the engine compartment between the engine, nacelle and pylon components and there was no fire propagation to the aircraft. The right engine throttle was moved to the idle position 51 seconds after the fire warning first appeared, and the right engine was shut down 1 minute 36 seconds later. According to flight crewmember statements, they followed the required ECAM procedures and associated checklists and ran the landing performance calculations in a thorough manner. The airplane landed at ATL about 26 minutes after takeoff. Postaccident simulator testing revealed that a crew could land the airplane about 12 minutes after takeoff. One reason to explain the airplane’s additional time in the air is that the captain might have questioned the validity of the initial fire warning; his postaccident statement mentioned that the initial fire warning disappeared for several seconds and then reappeared. DFDR data showed that the alert transiently disappeared for about 1 second. Unfortunately, the Cockpit Voice Recorder (CVR) was overwritten after the event and any discussion between crew members about the engine fire was unrecoverable. In addition, about 10 minutes into the flight, a FIRE DET 2 ECAM alert was triggered, but was not directly displayed to the crew at that time since it was a lower priority than already displayed messages. The alert was triggered by thermal damage to both fire detection loops that were exposed to a fire longer than the 5-minute fire resistant certification requirement. This fault resulted in the ECAM fire alert and associated local fire indications being cancelled; simultaneously, the LAND ASAP message changed from red to amber on the ECAM display, despite an ongoing fire. This might have lessened the crew’s concern about landing immediately. Also, the flight crew might have thought that the fire had been extinguished, especially since the cabin crew could not confirm if the engine was still on fire. At the time of the fire detection fault, the airplane was being flown on an extended downwind. A few minutes later, the flight crew made a 270° left turn to enter the right base leg, adding about 4 minutes to the flight likely so that the crew could run the less urgent ECAM items. However, Airbus’ ECAM system logic did not account for an engine fire detection fault that would be triggered while the fire warning is already active, resulting in the fire warning being extinguished. DAL (and four other US air carriers) had no simulator training scenarios involving engine fires in which the simulated fire continued to burn after the halon bottles were discharged and the fire indications deactivated. Training scenarios simulated a fire that was either extinguished by the halon bottles or continued with fire warning messages remaining illuminated or audible. Although the fire warning remained active after the halon was discharged during this accident, it did cancel out when the fire loops were damaged. Thus, because the accident flight crew had not been trained on an in-flight engine fire event in which the cockpit fire indications cease after a significant time but a fire remains, may have been another reason why the flight crew believed the fire had been extinguished. When the halon bottles were discharged, the active fire should have been extinguished, but if all the leaked combustible fluids had not been consumed or drained before bottle discharge and fuel and hydraulic fluid continued to enter the engine compartment, the fire could have reignited after the halon dissipated. According to flight data recorder data, when the right engine was shut down, the engine parameters decreased at a nominal rate. About 9 minutes after the shutdown, the right engine exhaust gas temperature (EGT) spiked from about 200ºC (392ºF) to about 600ºC (1,112ºF). The spike in the data occurred when the EGT signal came back online and the EGT thermocouples registered the heat transfer from the engine fire to the engine case. Even though the right engine was shut down, its EGT was higher than the operating left engine’s EGT for about 8.5 minutes, at which time the right engine EGT began to decrease. This evidence indicated that the fire burned for a prolonged period after both fire bottles were discharged and the fire shutoff valves (FSOV) were closed. In the days preceding the accident, the airplane had undergone maintenance twice to address reported fuel leaks. The first fuel leak was observed from the FM-13 hose interface at the pylon panel. The FM-13 hose and upper and lower seals were replaced with new parts to address the second fuel leak. During the on-scene investigation, the pylon fuel connections were examined, and the interior of the pylon underwent a borescope examination. No fluid leaks were observed. However, the lower flange of the rigid fuel pipe appeared deformed. The rigid fuel pipe flange deformation might have affected the seal at the interface of the rigid fuel pipe flange, the seal, and the FM-13 hose flange. An improper seal fitting may have allowed fuel to leak from the FM-13 hose to the rigid fuel pipe interface, enabling fuel to run down the right side of the engine and pool at the bottom of the nacelle. The diffuser, turbine, and exhaust cases temperatures were hot enough to ignite the fuel. At ignition, an over-pressurization occurred, which opened all four pressure relief doors on the thrust reverser inner fixed structure. Because the fire was not due to an internal engine failure, the key engine parameters would have remained nominal. The FM-13 hose fire sleeve that was removed the day before the accident flight was reported to be wet and shiny, indicating that the fire sleeve had been saturated with fuel. If the replacement FM-13 hose fire sleeve had been saturated with fuel, the hose would have been a concentrated fuel source. The FM-13 hose is rated as fireproof, indicating that it can withstand 15 minutes of fire exposure, but the presence of fuel both underneath and on the fire sleeve would likely have reduced the hose liner protection and accelerated the failure. After engine shutdown and the closure of the low-pressure shutoff valve in the pylon and the high-pressure shutoff valve at the engine fuel pump, the residual fuel in the FM-13 hose and other fuel/hydraulic hoses would have leaked into the engine compartment when the hoses were thermally breached. Engine fuel components would have provided an additional fuel source when those parts were thermally damaged. The engine diffuser and turbine case surfaces reach operating temperatures high enough to ignite both fuel and hydraulic fluid, but a flammable fluid leak will not necessarily immediately ignite when it contacts hot cases surfaces. Variables such as undercowl airflow, leak type, and airplane attitude are all factors. The extensive soot and dark discoloration at the 6:00 position and along the right side of the engine core were consistent with a fuel-rich fire. The right side of the engine had substantially more thermal damage and discoloration compared with the left side, and multiple fuel and hydraulic components, hoses, and lines on the right side of the engine were thermally damaged or consumed. The fuel and hydraulic hoses/lines connected to the pylon hydraulic interface panel exhibited thermal damage, and several were thermally severed at the panel connection. A substantial amount of charred material and residue had accumulated in the drip pan located beneath the pylon panel (which directs fluid leaks downward through the 6:00 drain mast and then overboard). The severity of the thermal damage at the pylon panel and the charred debris in the drip panel indicated that there was an intense sustained fire that was likely fed by fuel and/or hydraulic fluid originating from the pylon panel interface. Soot and discoloration patterns on the right side of the engine further support this scenario. The first fault message triggered during the event, came from a component located on the bottom part of the engine, and extensive damage to several components in that area could also suggest a fire initiation around the 6:00 position. The concentrated damage to the hose/line connections at the hydraulic interface panel was consistent with a fire in the drip pan beneath the panel. Debris accumulation, coking, or a blockage at the bottom of the pan might have prevented the drain system from working properly. The plumbing from the bottom of the pan to the 6 o'clock drain mast under the engine was not flow tested for obstructions during the on-scene examination because all debris had been cleaned out the pan during and/or after the boost pump leak check. However, photos of the pylon hydraulic interface panel drip pan immediately after landing at ATL shows it full of debris. Hydraulic fluid is more difficult to ignite than fuel due to a higher ignition temperature and fire-inhibiting properties. The analysis of fault messages related to the low level of hydraulic fluids during the event provided an estimated leak rate and the time at which the leak may have started. Evidence suggested that the yellow hydraulic leak occurred after engine shutdown. Specifically, the yellow hydraulic system low level caution annunciated between 10 minutes 11 seconds and 12 minutes 11 seconds after the fire pushbutton was pressed. This finding indicated that hydraulic fluid loss occurred well after the FSOVs were closed. After landing, both the yellow and green hydraulic reservoirs were low on the hydraulic service panel gauges and on the cockpit hydraulic system display. A failure to shutoff hydraulic fluid from entering the designated engine fire zone following FSOV closure resulted in a fire that continued to burn after both halon bottles had been discharged. The amount of hydraulic fluid was limited to what was contained in the reservoirs. The yellow hydraulic reservoir low level ECAM procedures required the crew to shutdown the yellow hydraulic system electric pump, which the accident crew did, rendering spoilers 4 and 6 inoperable during the final 9.5 minutes to the flight. A review of the A330-300/PW4168 system architecture identified an open yellow hydraulic system in-line case drain check valve as the most probable leak point. However, multiple bench tests showed that the green and yellow hydraulic system FSOVs and check valves functioned according to design. Thus, the most likely reason that the yellow hydraulic system in-line case drain check valve might have allowed hydraulic fluid to enter the designated engine fire zone was a foreign debris obstruction.
HISTORY OF FLIGHTOn April 18, 2018, about 1809 eastern daylight time, Delta Air Lines (DAL) flight 30, an Airbus A330-300, N806NW, experienced a right engine fire during initial climb from Hartsfield-Jackson International Airport (ATL), Atlanta, Georgia. The flight crew received a right engine fire electronic centralized aircraft monitor (ECAM) indication when the airplane was at an altitude of about 700 ft above ground level (agl), declared an emergency, shut down the right engine, discharged both fire bottles, and initiated a turn back to ATL. During the return to ATL, the fire warning indication cleared, and the crew made an uneventful overweight single-engine landing. No passengers or crewmembers were injured. The airplane sustained substantial damage to its right engine pylon. The flight was operated under Title 14 Code of Federal Regulations Part 121 as a regularly scheduled flight from ATL to London Heathrow International Airport, London, England. The captain, first officer, line check pilot, and relief first officer all provided postaccident statements. (The cockpit voice recorder had been overwritten, and the crew was not interviewed.) The relief first officer stated that he had conducted an exterior walk-around inspection of the airplane before departure and noted nothing unusual or abnormal. The captain was the pilot flying at the time of the engine fire. He was receiving a 6-month line check at the time of the event. The flight departed from runway 26L. The captain stated that, when the airplane was between 500 and 1,000 ft agl, the flight crew received the ECAM warning “ENG 2 FIRE” and the associated visual (red lights: Master Warning, Fire Pushbutton and Engine Master Lever) and aural (continuous repetitive chime) cockpit indications, which included a red “LAND ASAP.” The captain also stated that, during the first minute of the ECAM messages, all the non-normal messages disappeared for about 2 to 3 seconds, and then the engine fire alert and associated visual and aural indications reappeared. The captain transferred control of the airplane to the first officer, performed the ECAM procedures, and discharged both fire extinguishing bottles. The relief first officer contacted air traffic control (ATC) to declare an emergency and coordinate the airplane’s return to ATL, and he aided the captain in performing the ECAM action items. Flight data recorder (FDR) data showed that the right engine thrust lever went to idle at 1810:13 and was shut down at 1811:49 and that engine parameters, including exhaust gas temperature, spooled down at a nominal rate. According to the captain, the fire indication remained “on for some time” after both fire bottles were discharged, and the right engine was shut down. While the flight was being vectored by ATC for the approach, the first officer transferred control of the airplane back to the captain, and the first officer resumed the duties of the pilot monitoring. According to the line check pilot’s statement, when the captain transferred control of the airplane to the first officer, the line check pilot changed his role to a regular flight crewmember to assist the crew. While the captain and the first officer completed the ECAM checklist, he coordinated communication with the cabin crew and supported the captain with the checklist actions. After the checklist was completed, he contacted the purser about the nature of the problem and stated that the airplane would be returning to ATL and that the cabin crew should prepare the cabin for landing. In addition, he made an announcement to the passengers, advising them that the airplane had engine trouble, the flight would be returning to ATL and stopping on the runway, and emergency vehicles would be approaching the airplane so that emergency personnel could inspect the airplane. The fire warning remained illuminated for more than 10 minutes. The fire warning was replaced with the ENG 2 FIRE DET FAULT caution, which indicated the fire detection capability was lost. Also, the red LAND ASAP indication changed to amber. At the time of the fire detection fault, the airplane was being flown on an extended downwind. A few minutes later, the flight made a 270° left turn to enter the right base leg. According to FDR data, at 1820:30, the right engine exhaust gas temperature spiked from about 200ºC (392ºF) to about 600ºC (1,112ºF). Air traffic control voice recordings and radar data indicated that, about 1831, one of the pilots contacted the tower controller, who cleared the airplane to land on runway 27R. About 1 minute later, the tower controller advised the flight crew that the right engine appeared to still be smoking; the timing correlated to the airplane’s position on an approximate 5-mile final. Radar data indicated that the airplane touched down about 1834. During the landing rollout, the flight crew queried the controller if a fire could still be seen on the right engine; the controller responded, “affirmative.” After landing, the autobrake remained engaged until the airplane had decelerated to about 40 knots. The captain stopped the airplane about 7,800 ft from the approach end of the runway. The flight crew informed airport rescue and firefighting (ARFF) via the tower frequency that there was an indication of hot brakes in addition to the engine fire. ARFF crews met the airplane on the runway and observed smoke and flames emanating from the right engine. ARFF sprayed the engine with fire-retardant foam and extinguished the fire. Afterward, the flight crew shut down the left engine, the airplane was towed to the gate, and the passengers disembarked via the jet bridge. PERSONNEL INFORMATIONSpecific training related to this event that the pilots accomplished was the following: Captain—engines and auxiliary power unit (APU), November 2, 2017. First officer—engines and APU, April 22, 2017; systems review for Airbus A330 engines and APU, September 9, 2017. Line check pilot—engines and APU, June 22, 2015; systems review for Airbus A330 engines and APU, September 1, 2017. Relief first officer—engine and APU, May 30, 2016; systems review for Airbus A330 engines and APU, October 3, 2017. Additional information about training appears in the Organizational and Management Information section of this report. AIRCRAFT INFORMATIONThe airplane was powered by two Pratt & Whitney PW4168A engines and was configured with 2 pilot seats, 2 cockpit observer seats, 12 flight attendant seats, and 293 passenger seats. The right engine had about 49,723 hours and 6,515 cycles since new and about 25,009 hours and 3,170 cycles since overhaul in Singapore in November 2012. The engine was installed on the accident airplane the next month. The A330’s fire indication system consisted of indications for the left and right engines. Each system comprised two detection loops that sensed a fire and/or overheat conditions. When the system sensors detected a high temperature, it would trigger an ECAM warning “ENG 1 (2) FIRE” and the Master Warning light illuminate the FIRE pushbutton light located on the center overhead panel and activate a continuous repetitive chime (except during take-off between V1 and lift-off +15 seconds). The fire loops were fire-resistant (not fireproof) and had a 5-minute certification requirement to function as designed. For a fire with a duration of more than the 5-minute certification requirement, the loops could be destroyed and fail to operate as intended. If a component in each loop fails, a FIRE DET FAULT caution would appear on the ECAM display to indicate that the system is no longer able to detect a fire. If the fire loops were to fail, DAL’s A330 operations manual required flight crews to monitor engine parameters more closely than normal for signs of fire and/or over-temperature. Airbus’ software for the ECAM was designed to provide stacking of messages in order of priority. Specifically, the software identifies the most important message and places it at the top of all the ECAM messages, and each subsequent message follows in order of importance. The system was also designed to stack all red warning messages on top of amber caution messages. The A330 has three closed-loop hydraulic systems. The blue hydraulic system is for the left engine, the yellow system is for the right engine, and the green system is for both engines, thereby providing hydraulic system redundancy. The hydraulic system operating pressure is regulated to 3,000 psi, and the reservoir tanks are pressurized to 70 psi. FDR data showed that the flight crew received a YELLOW HYDRAULIC RESERVOIR LOW LEVEL warning about 14 minutes after the ENG2 FIRE warning. The A330 was designed to isolate the engine from the wing/airframe in the event of a fire. The ECAM procedure instructs flight crews to pull back on the throttles to the idle position for the affected engine, and turn off the engine. When the engine master switch is selected off, the fuel low-pressure shutoff valve (SOV) in the pylon and the high-pressure SOV at the engine fuel pump both close, cutting off fuel flow to the engine. The crews were then instructed to press the engine fire button in the cockpit, which sends a signal to close the green and yellow hydraulic fire shutoff valves (FSOV) near the pylon. The hydraulic pressure (return) lines from the hydraulic engine-driven pumps (EDP) and the EDP case drain lines have inline one-way check valves that prevent hydraulic fluid from flowing back to the engine after passing through the check valve. The thrust reverser doors are attached to the engine pylon structure. The thrust reverser doors include an internal fixed structure that has two pressure relief doors on each side. The pressure relief doors were designed to prevent over-pressurization of the core compartment. The handbook instructed flight crews to discharge agent 1 (fire bottle No. 1) 10 seconds after the engine fire button was pressed to allow time for the FSOVs to close and for the undercowl airflow to subside as the engine rapidly spooled down. An explosive squib charge then punctures the fire bottle diaphragm, and pressurized halon is ducted through nozzles into the engine core compartment/fire zone. If the fire ECAM warning remains active 30 seconds after the first fire bottle was discharged, the crews were instructed to discharge agent 2 (fire bottle No. 2). DAL aviation maintenance technicians at Amsterdam Airport Schiphol (AMS), Schiphol, Netherlands, provided written statements that summarized the maintenance actions performed on the airplane on April 15, 2018 (3 days before the accident flight). The technicians noticed that fuel was puddling on the ground under the right engine drain mast during predeparture checks. The cowls were opened, and fuel was observed dripping from the main fuel supply hose (FM-13) to the pylon hydraulic interface panel connection, which are shown in figure 1. Figure 1. Pylon hydraulic interface panel connections (left) and hardware from the accident engine (right) (Source: left figure is from Pratt and Whitney’s “Hydraulic Interface Panel” part drawing). Note: The red circles show where dripping was first observed. The blue arrow shows the FM-13 hose. The FM-13 hose upper flange seal was replaced, and a right engine motor leak test was performed. No fuel leaks were observed during the leak test or subsequent postmaintenance/predeparture checks, and the airplane was returned to service. On April 17, 2018 (2 days and 2 flights later), maintenance crews at Amsterdam Airport Schiphol again observed fuel puddling under the right engine drain mast during predeparture checks. The technicians performed a visual inspection of the engine and reported that the FM-13 hose fire sleeve appeared wet and shiny and that the fire sleeve silicone exterior surface was torn. A leak check was performed, and which showed that fuel appeared to leak from the tear in the fire sleeve. The FM-13 hose and upper and lower seals were removed and replaced with new parts. No leaks were observed during post-maintenance/predeparture checks, and the airplane was returned to service. The accident engine fire occurred three flights later. AIRPORT INFORMATIONThe airplane was powered by two Pratt & Whitney PW4168A engines and was configured with 2 pilot seats, 2 cockpit observer seats, 12 flight attendant seats, and 293 passenger seats. The right engine had about 49,723 hours and 6,515 cycles since new and about 25,009 hours and 3,170 cycles since overhaul in Singapore in November 2012. The engine was installed on the accident airplane the next month. The A330’s fire indication system consisted of indications for the left and right engines. Each system comprised two detection loops that sensed a fire and/or overheat conditions. When the system sensors detected a high temperature, it would trigger an ECAM warning “ENG 1 (2) FIRE” and the Master Warning light illuminate the FIRE pushbutton light located on the center overhead panel and activate a continuous repetitive chime (except during take-off between V1 and lift-off +15 seconds). The fire loops were fire-resistant (not fireproof) and had a 5-minute certification requirement to function as designed. For a fire with a duration of more than the 5-minute certification requirement, the loops could be destroyed and fail to operate as intended. If a component in each loop fails, a FIRE DET FAULT caution would appear on the ECAM display to indicate that the system is no longer able to detect a fire. If the fire loops were to fail, DAL’s A330 operations manual required flight crews to monitor engine parameters more closely than normal for signs of fire and/or over-temperature. Airbus’ software for the ECAM was designed to provide stacking of messages in order of priority. Specifically, the software identifies the most important message and places it at the top of all the ECAM messages, and each subsequent message follows in order of importance. The system was also designed to stack all red warning messages on top of amber caution messages. The A330 has three closed-loop hydraulic systems. The blue hydraulic system is for the left engine, the yellow system is for the right engine, and the green system is for both engines, thereby providing hydraulic system redundancy. The hydraulic system operating pressure is regulated to 3,000 psi, and the reservoir tanks are pressurized to 70 psi. FDR data showed that the flight crew received a YELLOW HYDRAULIC RESERVOIR LOW LEVEL warning about 14 minutes after the ENG2 FIRE warning. The A330 was designed to isolate the engine from the wing/airframe in the event of a fire. The ECAM procedure instructs flight crews to pull back on the throttles to the idle position for the affected engine, and turn off the engine. When the engine master switch is selected off, the fuel low-pressure shutoff valve (SOV) in the pylon and the high-pressure SOV at the engine fuel pump both close, cutting off fuel flow to the engine. The crews were then instructed to press the engine fire button in the cockpit, which sends a signal to close the green and yellow hydraulic fire shutoff valves (FSOV) near the pylon. The hydraulic pressure (return) lines from the hydraulic engine-driven pumps (EDP) and the EDP case drain lines have inline one-way check valves that prevent hydraulic fluid from flowing back to the engine after passing through the check valve. The thrust reverser doors are attached to the engine pylon structure. The thrust reverser doors include an internal fixed structure that has two pressure relief doors on each side. The pressure relief doors were designed to prevent over-pressurization of the core compartment. The handbook instructed flight crews to discharge agent 1 (fire bottle No. 1) 10 seconds after the engine fire button was pressed to allow time for the FSOVs to close and for the undercowl airflow to subside as the engine rapidly spooled down. An explosive squib charge then punctures the fire bottle diaphragm, and pressurized halon is ducted through nozzles into the engine core compartment/fire zone. If the fire ECAM warning remains active 30 seconds after the first fire bottle was discharged, the crews
The flight crew’s delayed landing after an in-flight engine fire, which reignited after both fire bottles were discharged and resulted in substantial damage to an engine pylon. Contributing to the delayed landing was likely the flight crew’s perception that the fire had been extinguished due to the disappearance of the primary engine fire warning indications after the fire detection loops were damaged and that a landing as soon as possible was not perceived to be necessary. Contributing to the duration of the fire was the contamination of an engine fire isolation system component which resulted in hydraulic fluid leaking into the designated engine fire zone after the engine was shutdown and the fire button was pressed.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
