Las Vegas, NV, USA
G-VIIO
BOEING COMPANY BOEING 777-236
A British Airways Boeing 777-236ER, powered by two General Electric (GE) GE90-85BG11 turbofan engines, had started its takeoff ground roll at McCarran International Airport, Las Vegas, Nevada. During the takeoff roll, the cockpit voice recorder (CVR) recorded a "bang" sound. Immediately afterward, the airplane veered to the left. and the CVR recorded the engine indicating and crew alerting system (EICAS) aural annunciation "engine fail." The captain moved the thrust reverser levers to their idle positions and began the rejected takeoff maneuver. The airplane's airspeed at the time of the rejected takeoff maneuver was about 77 knots. According to the British Airways B777 Flight Crew Operations Manual Quick Reference Handbook (QRH), the decision to reject a takeoff must be made in time to start the maneuver by the takeoff decision speed, which was 149 knots for the flight. The start of the rejected takeoff maneuver occurred 2 seconds after the "bang" sound, and the airplane came to a stop 13 seconds after the rejected takeoff maneuver began. Thus, the captain made a timely decision to reject the takeoff and performed the maneuver in accordance with company training and procedures. The uncontained left engine failure resulted from a fatigue crack in the high-pressure compressor (HPC) stage 8 disk. The fatigue crack started on the aft face of the disk web and progressed through the web and in the circumferential direction. The fracture region had an intergranular appearance near the aft face of the web and a transgranular appearance farther away from the initiation site. The transgranular area exhibited striations consistent with low-cycle fatigue crack growth. GE considered worst-case conditions (highest stresses and temperatures and minimum material properties) in predicting the low-cycle fatigue crack initiation lifetime at the stage 8 disk aft web faced and found that it had a low-cycle fatigue initiation life of about 29,800 cycles. (A fatigue facture can be divided into an initiation phase and a propagation phase. During the initiation phase, the material structure is changing due to the cyclic loads, but no cracks have formed. Eventually a crack forms and begins to grow, indicating the onset of the propagation phase. FAA Advisory Circular 33.70-01 uses the concept of detectable crack initiation, which is the size of a crack that can be detected using a nondestructive inspection method, to demarcate the transition from initiation to propagation.) The HPC stage 8-10 spool had accumulated 11,459 total cycles and the low-cycle fatigue crack had propagated over approximately 5,400 of those cycles, the balance was the number of cycles for crack initiation, approximately 6,000 cycles. Thus, GE's predicted crack initiation life (low-cycle fatigue life) at the aft web face was approximately five times greater than the estimated crack initiation life at the aft web face of the accident disk. During its metallurgical examination of the event HPC stage 8-10 spool, it was observed that the aft surface of the stage 8 disk outer web had lower-than-expected shot peen coverage. GE's examination of other similar spools also found reduced shot peen coverage on the aft surface of the stage 8 disk web. When GE's estimates low-cycle fatigue life, the calculations do not account for the benefits of shot peening. As a result, GE determined that the lower-than-expected shot peen coverage on the aft surface of the stage 8 disk could not account for the fatigue crack initiation and eventual fracture of the spool. Evidence indicated that the crack initiated by an environmentally assisted failure mode. With the sustained-peak low-cycle fatigue failure mode, a cyclic stress profile with an extended hold time, combined with an oxidizing atmosphere and elevated temperature, leads to oxidation of grain boundaries, which become brittle and eventually crack along an intergranular path. A cyclic stress profile with an extended hold time occurred during each takeoff, when the engines were at full power, and during operations, when the stage 8 disk would have been under a sustained load. A metallographic cross-section through the crack initiation area revealed an oxide layer on the fracture surface, including its intergranular region, demonstrating an oxidizing atmosphere. Elevated temperatures occurred whenever the engine was operating; the highest temperatures occurred during takeoff. Thus, the crack initiated by the sustained-peak low-cycle fatigue failure mode. GE was unable to determine why a crack initiated via sustained-peak low-cycle fatigue in the disk web. GE has not previously experienced environmental cracking under the operational conditions to which the stage 8 disk web was subjected and GE's postaccident inspections of additional HPC stage 8-10 spools did not find any cracks in any other disk webs. Further inspection of the accident stage 8 disk did not find additional cracks in the web (other than secondary cracks in the immediate area of the crack that led to the disk failure). The disk web was not an area that required routine inspections, so the crack on the accident disk went undetected. Federal Aviation Administration Advisory Circular 33.70-1, "Guidance Material for Aircraft Engine Life-Limited Parts Requirements," stated that the surface length of a crack that can be detected using a nondestructive inspection method is 0.03 inch. During maintenance in September 2008, when the HPC was removed from the engine and disassembled, exposing the stage 8-10 spool, the surface crack length would have been about 0.05 inch. Thus, if the disk web had been required to be inspected during this maintenance, the crack should have been detectable. By the time of the June 2014 maintenance, during which the HPC was removed from the engine but was not disassembled, the length of the surface crack would have increased to about 0.19 inch. After the accident, GE implemented inspection procedures at the piece-part, rotor, module, and engine levels to detect disk web cracks. While the airplane was decelerating to a stop, the fire warning bell sounded. When the airplane came to stop, the captain called for the engine fire checklist. The third item on the checklist was to move the fuel control switch on the affected side (in this case, the left side) to the cutoff position, which shuts down the respective engine. The spar valve terminates fuel flow to an engine after it is shut down. Flight data recorder (FDR) data showed that about 28 seconds elapsed between the start of the engine failure and the time of the spar valve closure, and Boeing estimated that about 97 gallons of fuel had spilled onto the runway during this time. FDR data also showed that 22 seconds elapsed between the time that the captain initially called for the engine fire checklist and the time of the spar valve closure. (Thirteen seconds had elapsed between the time that the captain repeated his call for the engine fire checklist and the time of the spar valve closure.) If the left engine had been shut down sooner, there would have been less fuel on the runway to feed the fire. The flight crew informed the passengers and flight attendants to remain seated and await further instruction, which was consistent with the flight crew's training and procedures if an evacuation was not going to immediately occur. The cabin crew reinforced the flight crew's expectation by instructing passengers to remain seated. As part of the flight crew's evaluation of the situation, the relief pilot left the cockpit and entered the forward cabin so that he could look outside a window. Before the relief pilot returned, the CVR recorded the captain's statements indicating that the airplane should be evacuated. The relief pilot returned to the cockpit shortly afterward and informed the captain of the need to evacuate on the right side of the airplane because of the fire. The captain then commanded the evacuation, and a flight crewmember activated the evacuation alarm. When the relief pilot went into the cabin to assess the situation outside of the airplane, a flight attendant told him that she had been trying to call the flight crew. The CVR recorded a sound similar to an interphone call from the cabin to the flight deck, but the flight crewmembers most likely did not answer the call because they were focused on securing the left engine and deciding whether to evacuate. After the captain's evacuation command, the flight attendants assessed their areas and opened the doors that they deemed usable. Five of the eight door exits were initially blocked by flight attendants, which was appropriate given the hazards associated with the smoke, fire, and unusual attitude of two slides. A sixth door, which was initially opened, was blocked once a flight attendant saw flames on the runway, which was also appropriate. Although only two of the eight door exits were used throughout the evacuation, the passengers and crewmembers were able to evacuate before smoke and fire encroached the fuselage. The captain commanded the evacuation (step three in the evacuation checklist) before calling for the evacuation checklist and performing the first two steps in the checklist. Step two of the evacuation checklist instructs the captain to shut down both engines. The left engine was shut down as part of the engine fire checklist, but the right engine continued operating for about 43 seconds after the captain's evacuation command. The unusual attitude of two slides (the 3R and 4R slides) resulted from the jet blast coming from the right engine while it was operating. The captain did not use the QRH to read and do his evacuation checklist items. The right engine was shut down after the relief pilot noticed EICAS indications showing that the engine was still running. Also, the captain's call for the evacuation checklist occurred after the relief pilot stated that the checklist needed to be performed. (The first officer had stated, just before the relief pilot, "we haven't done the engine checklist," but he most likely meant the evacuation checklist.) Because the captain did not follow standard procedures, his call for the evacuation checklist and the shutdown of the right engine were delayed. British Airways' engine fire checklist, which was based on the Boeing 777 engine fire checklist, did not differentiate between an engine fire occurring on the ground or during flight. The third step of the checklist instructed the flight crew to cut off the fuel control switch on the affected side to shut down that engine. However, for an engine fire on the ground, the checklist did not include a step to shut down the unaffected engine or indicate that some steps did not apply. If the engine fire checklist had specifically addressed fires during ground operations, the flight crew could have secured the right engine in a timelier manner and decided to evacuate sooner. In February 2018, as part of its final report on the American Airlines flight 383 investigation, the NTSB issued two related safety recommendations, A-18-6 and A-18-10, to address this issue. The relief pilot relayed pertinent information to the captain and first officer as the emergency unfolded. The relief pilot pointed out the smoke to the flight crew and volunteered to assess the situation outside the airplane from a window in the cabin. After returning to the cabin and reporting his assessment, the relief pilot indicated that the airplane was still on fire on the left side, and the captain commanded the evacuation. The relief pilot also noticed that the right engine was still running and indicated that it needed to be shut down. Thus, the relief pilot played an important role in ensuring the safety of the airplane occupants. During a group debriefing by the Air Accidents Investigation Branch, the flight attendants stated that some passengers evacuated with carry-on baggage; however, the flight attendants thought that carry-on baggage retrieval did not slow the evacuation. They thought that most passengers who retrieved baggage did so after the airplane came to a stop and before the evacuation was commanded and that the flight attendants' assertive commands limited further retrieval. The flight attendants at the two most-used exits (doors 1R and 4L) recalled seeing very little baggage at their exits, and neither cited carry-on baggage as a problem. However, the NTSB notes that the accident airplane was only 55% full. Although not a factor in this evacuation, the NTSB remains concerned about the safety issues resulting from passengers evacuating with carry-on baggage, which could potentially slow the egress of passengers and block an exit during an emergency. The NTSB previously addressed carry-on baggage in a June 2000 safety study on evacuations of commercial airplanes and issued Safety Recommendation A-18-9 in February 2018 as part of its final report on the American Airlines flight 383 investigation.
HISTORY OF FLIGHT On September 8, 2015, about 1613 Pacific daylight time, British Airways flight 2276, a Boeing 777-236ER, G-VIIO, powered by two General Electric (GE) GE90-85BG11 turbofan engines, had started its takeoff ground roll on runway 7L at McCarran International Airport (LAS), Las Vegas, Nevada, when an uncontained engine failure in the No. 1 (left) engine and subsequent fire occurred. The flight crew aborted the takeoff, stopped the airplane on the runway, and evacuated the airplane. The fire was extinguished by aircraft rescue and firefighting (ARFF) personnel after the evacuation ended. The 157 passengers and 13 crewmembers evacuated on the runway via emergency slide/rafts; during the evacuation, 1 cabin crewmember sustained a serious injury, and 19 passengers sustained minor injuries. The airplane was substantially damaged from the fire. The flight was operating under the provisions of 14 Code of Federal Regulations Part 129 from LAS to London Gatwick International Airport (LGW), Horley, England. Preflight activities were uneventful, and the airplane departed the gate at 1555, 10 minutes ahead of the scheduled 1605 departure. The captain was the pilot flying, and the first officer was the pilot monitoring. A relief pilot was also in the cockpit; he was sitting in the jumpseat, which was behind and between the two pilot seats. The captain taxied the airplane to runway 7L for an intersection takeoff at taxiway A8, which was about 2,662 ft from the runway 7L threshold. The flight data recorder (FDR) showed that the airplane turned onto the runway heading at 1612:30. The captain advanced the engines to takeoff power 6 seconds later, and the engine N1 (low-pressure compressor), the longitudinal acceleration, and the ground speed increased, consistent with the start of the takeoff roll, at 1612:42. The cockpit voice recorder (CVR) recorded the sound of a "bang" at 1612:51.5, which was followed during the next 2 seconds by a sound similar to an engine spooling down, the engine indicating and crew alerting system (EICAS) aural annunciation "engine fail," and the captain's "stop" callout. During postaccident interviews, the first officer and the relief pilot stated that they heard a "thud" and a "bang," respectively, just before the airplane reached 80 knots, at which time the airplane veered to the left. The FDR showed that, at 1612:53, the left and right master warning lights illuminated (which occurred about the same time as the engine fail warning) and that the thrust levers (as indicated by the left and right throttle lever angle parameters) were moved to idle; 1 second later, the airplane began decelerating from about 77 knots, which was the peak airspeed achieved. The takeoff decision speed (V1) for the flight was 149 knots. At 1612:58, the CVR recorded a sound similar to the fire warning bell, which lasted for 1.8 seconds, and the FDR showed that the left engine fire warning had illuminated. At that time, the captain stated, "tell [air traffic control (ATC)] we're stopping"; the first officer made this notification at 1613:05. During a postaccident interview, the first officer stated that, as the captain applied wheel braking, he noticed that the thrust levers began moving forward, so he disconnected the autothrottle. (Before reaching 80 knots, the Boeing 777 autothrottles attempt to set takeoff power if the thrust levers are retarded with the autothrottles still engaged.) The captain also reported that he did not use maximum braking because he initially thought that a tire had burst, and the first officer stated that he did not select reverse thrust and deploy the ground spoilers during the rejected takeoff (both pilot monitoring responsibilities) because he was "distracted by the thrust lever increasing." FDR data showed that the airplane came to a stop at 1613:07 (15.5 seconds after the CVR recorded the sound of the bang); at that time, the CVR recorded the captain's second call for the engine fire checklist, which the first officer acknowledged. (The captain had previously called for the engine fire checklist at 1612:58, when he was also instructing the first officer to notify ATC that the airplane would be stopping on the runway.) At 1613:12, the relief pilot asked if he should make an announcement to the passengers and cabin crew; the captain agreed and indicated that they should "stay there where they are." At 1613:19, the relief pilot used the public address (PA) system to instruct the passengers and cabin crew to "please remain in your seats and await further instructions." About 1 second later, the captain contacted ATC, stating "mayday mayday" and "request fire services," and the tower controller responded that fire services were on the way. The first officer performed the engine fire checklist memory items. FDR data showed that he moved the left fuel control switch to the cutoff position (1613:20) and pulled and rotated the left fire switch to its stop to discharge the first of two fire extinguisher bottles (1613:27). The engine fire checklist called for the second bottle to be discharged 30 seconds later if the FIRE ENG message still appeared. The first officer selected the electronic checklist on the multifunction display in the cockpit to use the 30-second timer to determine when to discharge the second bottle. At 1613:42, the FDR recorded the second fire extinguisher bottle being discharged (15 seconds after the first bottle), and the CVR recorded the first officer stating, "fire's now gone out." (FDR data show that the left engine fire warning light went out close to the time that the second fire extinguisher bottle was activated.) During a postaccident interview, the first officer stated that he activated the second fire extinguisher bottle earlier than indicated in the checklist because of the need to evacuate. At 1613:47, the relief pilot asked if he should look outside a window, and the captain agreed. During a postaccident interview, the relief pilot stated that he queried the captain because he (the relief pilot) had seen a "large shadow" outside and above the fuselage. After leaving the flight deck and looking outside a cabin window, the relief pilot observed black smoke with an orange glow and the cabin window glass becoming "crazed." (According to Federal Aviation Administration [FAA] Advisory Circular 25.775-1, "Windows and Windshields," dated January 17, 2003, "crazing is a network of fine cracks that extend over the surface" and is "induced by…exposure to organic fluids and vapors.") The relief pilot told a cabin crewmember to get ready to evacuate and, after returning to the flight deck, stated (at 1615:50), "doesn't look good to me." Also at that time, the CVR recorded a sound similar to the interphone (a call from the cabin to the flight deck), which was not answered. At 1614:03, the CVR recorded a flight attendant's announcement (over the PA system) that the passengers should remain seated. About 4 seconds later, the captain stated, "I think there's too much fire. I think we've got to get out," which was followed by the first officer's statement, "well [the fire light] says it's gone out," and the captain's statement, "no, we've got to evacuate." At 1614:23.2, the captain announced, over the PA system, "this is an emergency. This is the captain. Evacuate. Evacuate," which occurred 31.7 seconds after the CVR recorded the bang sound. About 4 seconds later, the first officer told the tower controller, "we are evacuating on the runway. We have a fire," and the controller acknowledged this information. The CVR recorded a sound similar to the evacuation alarm at 1614:29, which sounded for 33 seconds. . At 1614:35, the CVR recorded background sounds from the cabin that were consistent with an evacuation, which continued until the end of the recording (at 1615:36). At 1614:42, the captain made a PA announcement to evacuate on the right side of the airplane. At 1615:03, the relief pilot asked if both engines were shut down. After the first officer stated no, the relief pilot indicated that the right engine needed to be shut down. (During a postaccident interview, the relief pilot stated that he noticed the right engine EICAS indications.) The FDR recorded the right engine shutdown at 1615:06 after the first officer moved the right engine fuel control switch to the fuel cutoff position. According to FDR data, the right engine continued to operate for 43 seconds after the captain commanded the evacuation and about 2 minutes after the airplane came to a stop. The relief pilot then indicated that the evacuation checklist needed to be performed, and the captain called for the checklist at 1615:13. During a postaccident interview, the captain stated that he did not use the British Airways B777 Flight Crew Operations Manual (FCOM) Quick Reference Handbook (QRH) to "read and do" his evacuation checklist items and instead attempted to perform the checklist items from memory, but he missed the second step, which was to ensure that both engines were shut down. The CVR recorded the first officer performing the steps on the QRH evacuation checklist, one of which was to open the outflow valves (using toggle switches on the cockpit overhead panel) to depressurize the airplane for the evacuation. The first officer stated that he spent between 15 and 20 seconds attempting to open the outflow valves, and FDR data showed that the valves remained in the automatic position, which sets pressurization to a predetermined level. (According to the QRH evacuation checklist, the outflow valves should have been moved to the manual position, which allows a flight crew to control pressurization.) About the same time as the right engine was shut down, the forward cargo bay fire warning light had illuminated. (FDR data showed that the forward cargo smoke warning became active at 1615:04.) The fire bell sounded in the cockpit for about 2 seconds starting at 1615:22. The captain reported, during a postaccident interview, that he noticed the forward cargo bay fire warning light and armed the cargo fire switch, but he was not certain if he discharged the cargo fire extinguisher bottles because other things were going on during that time, including the other two pilots preparing to exit the airplane. (During a postaccident examination of the airplane, three of the five cargo fire extinguisher bottles were found discharged.) All occupants, including one lap child, and the flight and cabin crewmembers evacuated the airplane through the 1L, 1R, or 4L door slides. (The flight attendants estimated that only five passengers evacuated using the 1L door slide, which was subsequently blocked due to fire.) The National Transportation Safety Board (NTSB) obtained videos that showed that the evacuation was completed about 2 minutes 32 seconds after the captain's initial command to evacuate (1614:23). ARFF vehicles were dispatched to the scene after the captain requested fire services (1613:19), and the videos showed that the first vehicle arrived on scene about 1 minute 59 seconds later (1615:18). The fire was likely extinguished by 1617:44, about 2 minutes 26 seconds after the first ARFF vehicle arrived on scene and about 4 minutes 52 seconds after the left engine failure. According to airport personnel, video evidence, and FDR data, the left engine failure occurred about 1,030 feet from the runway 7L intersection with taxiway A8 (the takeoff location), and the airplane came to a full stop about 897 feet from the engine failure location. Skid marks on the runway surface, from both main landing gear assemblies, started about 700 ft before the airplane's final position on the runway. Postaccident examination of the airplane found that the fire had substantially damaged the left engine, the inboard left wing, and a portion of the left and right fuselage. A postaccident examination of the cockpit found that the left and right throttle lever angles were in their idle position and the thrust reverser levers were stowed; the left and right fuel control switches were in their cutoff position; the left engine fire handle was in the pulled position and rotated toward the No. 2 fire bottle position; and the guard on the evacuation command switch was raised and in the ON position. The captain, age 63, held an airline transport pilot license issued by the European Aviation Safety Agency (EASA) on July 23, 2013; his initial United Kingdom airline transport pilot license was issued on July 8, 1997. The captain received a type rating for the Boeing 777 on April 14, 1999, and he also held type ratings for the Boeing 747-100 through -300, 747-400, and 787; McDonnell Douglas DC-10; and Lockheed L-1011. The captain held a United Kingdom Civil Aviation Authority (CAA) class I medical certificate, dated April 28, 2015, with the limitation that he must have available corrective spectacles (glasses) and carry a spare pair of glasses. The captain stated, during a postaccident interview, that he was not wearing his glasses at the time of the accident because he could see the cockpit instruments and the environment outside the airplane without them. The captain added that his spectacles were "intended for close vision." The captain began work for British Airways in August 1973. He estimated that he had accumulated about 30,000 hours of total flight time. Documentation that British Airways provided showed that the captain had accumulated about 12,000 hours on the Boeing 777 and about 15,000 hours as pilot-in-command. He had flown 220, 80, and 15 hours during the previous 90, 30, and 7 days, respectively. The captain's last line check occurred on July 9, 2014, and his last recurrent simulator training occurred on March 23, 2015. The captain stated that he had previously flown with the first officer but not the relief pilot. According to CAA records, the captain had no previous accidents, incidents, or enforcement actions and had no record of training failures. The captain stated he had not previously experienced an engine fire in his career, except during simulator training, and that he had performed a rejected takeoff during a flight only once (due to an instrument failure) before the accident. Also, until the accident, he had not conducted an evacuation during a flight. The captain stated that he was off duty on September 5 and 6, 2015. (British Airways records showed that he had flown a 4-day trip from September 1 to 4.) He went to sleep about 2230Z and awoke about 0630Z. (Z stands for Zulu and indicates Universal Time Coordinated [UTC]; at the time of the accident, Pacific daylight time was 7 hours behind UTC.) On September 7, he reported for duty at LGW at 0845Z and flew to LAS as a positioning (nonflying) crewmember. After arriving in LAS on September 7, he took a walk and joined the relief pilot about 1800 for a meal. He went to sleep about 2100 and awoke on September 8 about 0400. He did not sleep again during the day but rested in his hotel room until 1430, when he had to leave for the airport. The captain stated that he experienced an "8-hour" time change in the 24 hours before the accident and felt "out of phase" with his body clock; he also stated that he felt "alright" overall and that he was "okay, but not as good as [he] could have been." The First Officer The first officer, age 30, held an airline transport pilot license issued by EASA on August 6, 2010, and he received a type rating for the Boeing 777 on January 11, 2011. The first officer also held a type rating for the Boeing 787 and Airbus A320. He held a CAA class I medical certificate, dated March 11, 2015, with no restrictions. The first officer began work for British Airways in January 2006. Documentation that British Airways provided indicated that the first officer had accumulated about 6,400 hours of total flight time, 3,100 hours of which were in the Boeing 777. He had flown 220, 80, and 19 hours during the previous 90, 30, and 7 days, respectively. The first officer's last line check occurred on December 8, 2014, and his last recurrent simulator training occurred on September 2, 2015. According to CAA records, the first officer had no previous accidents, incidents, or enforcement actions and had no record of training failures. 72-Hour History T
The failure of the left engine high-pressure compressor (HPC) stage 8-10 spool, which caused the main fuel supply line to become detached from the engine main fuel pump and release fuel, resulting in a fire on the left side of the airplane. The HPC stage 8-10 spool failed due to a sustained-peak low-cycle fatigue crack that initiated in the web of the stage 8 disk; the cause of the crack initiation could not be identified by physical inspection and stress and lifing analysis. Contributing to this accident was the lack of inspection procedures for the stage 8 disk web.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
