Aviation Investigation Report A01F0101

A Boeing 737-200, registration C-FRYG, operated by Canada 3000 Ltd., with 107 passengers and six crew members on board, was on an instrument flight rules flight from Cayo Largo Del Sur, Cuba, to Montréal / Mirabel International Airport, Quebec. About 20 minutes after take-off, the flight crew noted fluctuating oil pressure in the right engine (P&W JT8D-9A) and a low oil level indication. As a precaution, the crew shut down the engine, declared an emergency, and requested to divert to Fort Lauderdale Airport, Florida. When the aircraft was established in a holding pattern, the engine fire alarm sounded. Both fire extinguisher bottles were discharged in the right engine nacelle, but the fire did not go out. The pilot advised air traffic control of the situation and directed the aircraft toward Fort Lauderdale Runway 27R. After landing, the aircraft stopped on the runway, and the aircraft was evacuated. The right engine was still on fire. Emergency services extinguished the fire, and no injuries occurred.

The Boeing 737-200, operating as flight CMM2226, took off from Cayo Largo Del Sur, Cuba, bound for Montréal / Mirabel International Airport, Quebec, around 2320 Coordinated Universal Time.^{Footnote 1} The first officer was the pilot flying in the right seat, and the captain was the pilot not flying. Around 2340, while the aircraft was climbing through 20 000 feet above sea level (asl), the flight crew noted that the oil pressure in the right engine was fluctuating and that the oil level was at 0.5 gallon (USG). The oil temperature was high but below the maximum of 165° C. At the time of departure from Cayo Largo, the oil level was between 3.5 and 4 USG.

At 2340, as a precaution, the engine was shut down and continued to windmill,^{Footnote 2} following the Engine Failure/Shutdown checklist in the Quick Reference Handbook. The low-pressure compressor rpm was indicating 10 per cent, and the high-pressure compressor rpm was indicating 20 per cent. The aircraft was flying in Cuban airspace, about 20 nautical miles (nm) west of Varadero / Juan Gualberto Gomez Airport, Cuba. The flight crew declared an emergency to Havana Control Centre and requested and was cleared to maintain 16 000 feet.

Around 2350, radio contact was established with Miami Area Control Centre, Florida. The aircraft was identified by radar at about 6 nm south of the TADPO intersection, which marks the boundary between Cuban and US airspace on air route UG448. Around 2357, after requesting a weather briefing, the crew elected to continue to Fort Lauderdale, Florida, and requested that emergency services be put on standby for landing.

At the request of the captain, flight CMM2226 was cleared for a holding pattern. The pattern was flown 20 nm east of the JUMAR fix, which is 11.3 nm east of the threshold of Fort Lauderdale Runway 27R. When the aircraft was about to enter the holding pattern, a flight attendant entered the cockpit and advised the flight crew that some passengers had seen sparks under the right engine nacelle. The captain asked the flight director to confirm the information. A few minutes later, the flight director returned and confirmed to the captain that sparks could be seen.

Suddenly, the following warning lights for the right engine came on: Dual Bleed, Oil Filter Bypass, and Start Valve Open. At that time, there were no indications of an engine overheating or an engine fire on any of the cockpit instruments. Except for the Dual Bleed warning light, the checklists for Oil Filter Bypass warning lights and Start Valve Open warning lights led the flight crew to perform the Engine Failure/Shutdown checklist. However, that checklist was already completed at 2340. The captain asked the flight director to prepare the cabin for an emergency landing, which he planned for within the next 20 minutes.

When the aircraft was established in the holding pattern, the Engine Overheat light came on. While the captain was executing the appropriate checklist, the Engine Fire Warning Switch light came on, and the fire alarm sounded. The captain completed the Engine Fire, Severe Damage or Separation checklist. One of the two fire extinguisher bottles was discharged inside the engine nacelle. Since the Engine Fire Warning light was still on, the second fire extinguisher bottle was discharged. It could not be determined when the first fire indication appeared but at 0043, the captain advised the arrival controller at Fort Lauderdale that he wanted landing priority because of an uncontrollable fire in the right engine. Meanwhile, the first officer directed the aircraft toward the airport, initiated the descent, and increased speed to about 324 knots.

During the approach, at about 3000 feet asl, the captain took the controls and landed the aircraft on Runway 27R. After the aircraft came to a stop on the runway, the evacuation began. Most passengers were evacuated via the three emergency exits on the left side (L1, WE1, and L2). The right front door (R1) had been opened, and some passengers exited through that door, despite the fire on that side. Emergency services responded and put out the fire. The blaze was hard to extinguish because it was in the accessory gearbox, which is made of a magnesium alloy. When this material is burning, it is very hard to put out unless the correct extinguishing agent is used.

The flight crew was certified and qualified for the flight, in accordance with existing regulations. The captain had 4485 flying hours, including 2735 hours as captain, of which 87 hours were as captain on the Boeing 737. The first officer had 4000 flying hours, including 605 hours as first officer on the Boeing 737.

Configuration of the aircraft for a landing with one engine out requires a higher-than-normal speed on the approach. When the engine was shut down, the aircraft weight was approximately 114 000 pounds, which is 11 000 pounds over the maximum certified landing weight specified by the manufacturer. Since C-FRYG was not equipped with a fuel jettison system, it would have had to fly for more than two hours with one engine out to reduce its weight below the maximum certified landing weight. Landing an aircraft with a weight exceeding the maximum certified landing weight is not prohibited in an emergency. Although the flight crew did not establish a specific target weight for the landing, they agreed to fly a holding pattern for about one hour to reduce aircraft weight while completing all pre-landing checks.

The weather forecast for Varadero and Havana indicated a possibility of rain showers associated with storms, reducing visibility to 3 km for the period from 1900 to 0200. The forecast for Miami and Fort Lauderdale called for rain showers but no storms.

The Engine Failure/Shutdown checklist indicates the requirement to plan for a landing at the nearest possible suitable airport. Neither the Quick Reference Handbook nor the Boeing 737 Operations Manual provides a definition for "suitable airport". A definition for "suitable airport" exists, but it applies only to extended-range twin-engine operations (ETOPS), which was not the case with flight CMM2226. Appendix B of Transport Canada's publication TP6327E, Safety Criteria for Approval of Extended Range Twin-Engine Operations (ETOPS), states that for an airport to be suitable, it must "have the capabilities, services and facilities necessary to be designated as an adequate airport and have weather conditions and field conditions at the time of the particular operation which provide a high assurance that an approach and landing can be safely completed with an engine and/or systems inoperative, in the event that a diversion to an enroute alternate becomes necessary."

The flight crew of CMM2226 determined that Fort Lauderdale Airport, despite not being the nearest, was the most suitable. The grounds cited were the following: confidence to obtain better air traffic services, weather conditions, familiarity with this airport and better support to the passengers. Continuing the flight allowed more fuel to burn and reduced the aircraft weight before landing. Continuing the flight also allowed more time to complete all the checks for a landing with one engine out. Because the right engine was windmilling, the flight crew had no reason to believe that its condition would deteriorate further.

The engine fire detection system consists of a dual detector inserted in a sleeve, which is covered by a perforated metal shield. The detection system monitors the upper and lower parts of the engine and is wired in series. One detector senses high temperatures and the other detects fires. In the event of overheating, an amber light marked Engine Overheat comes on when the temperature sensor detects a high temperature of 400°F. In the event of fire, a red light illuminates on the handle marked "1" (for the left engine) or "2" (for the right engine). The two main alarm lights also illuminate and a fire alarm bell sounds.

The engine fire extinguishing system is a gaseous smothering system, designed to flood either engine cowling area with an inert gas. A switch for each engine in the cockpit electrically controls the fire extinguishing system. Each engine uses two extinguisher bottles containing 3.5 pounds of halon pressurized with dry nitrogen. The flight crew can discharge either extinguisher bottle by selecting the applicable fire switch. The extinguishing agent is released through discharge diffusers installed above and at the centre of the engine.

Sparks, observed by the passengers, are typical of a fire fuelled by magnesium. When magnesium burns, it generates its own oxygen. It is very difficult to put such a fire out with halon extinguishers. Once ignited, these alloys give off intense heat, and the fire is hard to control.

The engine oil lubrication system consists of a high-pressure oil distribution system that supplies lubrication to the main bearings and various accessories. Oil flows down by gravity from the oil tank to the engine pump inside the accessory gearbox compartment. Oil is forced under pressure through an oil filter and proceeds to the fuel-cooled oil cooler. From there, the oil flows to various bearings in the engine. If the oil filter or the oil cooler becomes clogged, bypass valves in these components will open to allow oil to continue flowing through the system. An adjustable pressure control valve on the pressure side of the pump in the accessory gearbox maintains pressure and keeps oil flowing in the system by returning oil to the pump intake.

Four scavenge pumps return oil from the bearing cavities to a sump in the accessory gearbox. From there, oil flows back to the oil tank again. A breather system links the engine bearing cavities, accessory gearbox, and oil tank to maintain proportional oil flow and to prevent cavitations of the pump during engine operation.

According to information received from Canada 3000, the oil level in the engines was adjusted during a stopover in Toronto, Ontario, on the day of the occurrence. The aircraft flew from Toronto to Cayo Largo via Montréal without requiring any oil to be added. The carrier had been using Shell 560 oil, recommended by the engine manufacturer, for some time. The engine oil level on departure from Cayo Largo was about the same in both engines, that is, between 3.5 and 4 USG. The journey logbook also indicates that one litre of oil was added to the constant speed drive of the right engine on three occasions: 06 June 2001, 12 June 2001, and 24 July 2001.

The aircraft was built in accordance with Federal Aviation Regulations (FARs) Part 25. FAR 25-1203(a) states that "there must be approved, quick acting fire or overheat detectors in each designated fire zone, and in the combustion, turbine, and tailpipe sections of turbine engine installations, in numbers and locations ensuring prompt detection of fire in those zones." Model 737-200 aircraft, including C-FRYG, were exempted from one provision of
FAR 25-1203(a), allowing an exemption from the requirement to have a fire detection system in the tailpipe section. This exemption did not play a role in this event, since the fire was not in the tail pipe section.

FAR 25.1195(b) states that "the fire extinguishing system, the quantity of the extinguishing agent, the rate of discharge, and the discharge distribution must be adequate to extinguish fires. It must be shown by either actual or simulated flight tests that under critical airflow conditions in flight the discharge of the extinguishing agent in each designated fire zone specified in paragraph (a) of this section will provide an agent concentration capable of extinguishing fires in that zone and of minimizing the probability of re-ignition."

FAR 25-1197(a)(1) requires that "the extinguishing agents be capable of extinguishing flame emanating from any burning of fluids or other combustible materials in the area protected by the fire extinguishing system." FAR 25.1309(a)(1) and (2) state that "the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable" and that "the occurrence of any other failure condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable."

Federal Aviation Administration (FAA) Advisory Circular AC20-135, entitled Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards and Criteria describes the test performed to certify magnesium parts. The parts must be fireproof or fire resistant. To qualify as fireproof, each part must be able to withstand a temperature of 2000°F for at least 15 minutes. To qualify as fire resistant, materials must withstand a temperature of 2000°F for at least five minutes.

C-FRYG was equipped with a cockpit voice recorder (CVR) and a flight data recorder (FDR). The CVR is a Fairchild model A100A, part number 93-A100-80, serial number 56480. The FDR is an Allied Signal model 980-4100-GMUN 11, serial number 10582. Both recorders were sent to the TSB Engineering Laboratory in Ottawa. The CVR was analysed but yielded no information; power to the aircraft was cut off after the occurrence, and when it was restored later, the messages were recorded over. Since the CVR retains only the last 30 minutes of the flight, conversations during the occurrence flight could not be played back. The FDR records 11 parameters, but only one engine parameter.^{Footnote 3} The FDR revealed that the right engine was shut down 27 minutes after engine startup, which is about 20 minutes after take-off.

It was only on 08 August 2001, four days after the occurrence, that TSB took charge of the investigation, in accordance with Annex 13 of the Convention on International Civil Aviation and following discussions with the US National Transportation Safety Board (NTSB). Teardown of the engine took place at New Jet Engine Services in Miami from 14 to 16 August 2001 inclusive, in the presence of the NTSB, the aircraft manufacturer (Boeing), the engine manufacturer (Pratt & Whitney), Transport Canada, and a representative of the carrier (Canada 3000). The analysis focussed on the causes of the loss of oil and of the fire that started about one hour after the engine was allowed to windmill.

The right engine on C-FRYG was a model JT8D-9A, serial number 666715, built by Pratt & Whitney. It had accumulated 44 961 hours and 36 031 cycles since new. The engine had accumulated 3817 hours and 2459 cycles since the last inspection of the engine's hot section on 20 September 1999. Records show that, during that inspection, the accessory gearbox and the high- and low-pressure turbines were inspected visually. The high- and low-pressure compressors, the diffuser and combustion sections, and the exhaust section were repaired. The engine was imported to Canada and leased to Canada 3000. It was installed on aircraft C-FRYG on 11 December 2000.

The post-occurrence engine teardown revealed the following:

• The starter was found intact and hanging from the start valve; it had burn marks on the outside and could not turn freely.
• The pressure side of the breather tube for the No. 4 bearing housing was partly clogged with coke residue, and the pressure side of the breather tube for the No. 4 bearing inside the diffuser was completely clogged with coke residue. The end of the breather tube associated with the No. 4 bearing was also clogged.
• External surfaces of the high- and low-pressure turbine shafts exhibited blackening and discolouration.
• The No. 1 bearing was intact and wet with oil; several rollers in the bearing exhibited bluish colouration. The No. 3 bearing was intact and turned freely, but the oil in the bearing housing felt sticky. The No. 5 bearing was intact and wet with oil and turned freely; the rollers in the bearing showed light wear near the centre, as indicated by a change in colour from gold to silver. All other bearings were intact and showed no signs of damage.
• The left side of the accessory gearbox was consumed by fire from the centre of the fuel pump to the starter mounting bracket, exposing the internal gearing and the oil filter. The centre bracket, the left side bracket, the starter mounting bracket, and the oil tank in the accessory gearbox were all consumed by fire. Paint on the exterior of the gearbox casing was blistered. The de-oiler was separated from the accessory gearbox, severely burned and damaged. A portion of the outer casing was missing. The shaft between the high-pressure compressor and the accessory gearbox was intact.
• The oil-fuel cooler was tested for leaks. All oil-side components of the cooler must withstand a pressure of 200 pounds per square inch (psi). All fuel-side components must withstand 1000 psi for 5 minutes. During the test, the oil side showed a drop in pressure to 5 psi, and the fuel side showed a drop in pressure to 2 psi. Both O-rings were hardened but intact, and the outer surfaces were flattened.
• A review of the report on limited life components revealed that none of them had exceeded their life cycle.
• The accessory gearbox was sent to the TSB Engineering Laboratory to determine the cause of the fire. Because of the condition of the parts, the analysis yielded no information.

The pilot-in-command is responsible for the aircraft's safe operation. S/he can decide at any time to land at the airport of his/her choice if, in his/her judgment, it is safe to do so. In this case, the flight crew decided that it was more suitable to continue to Fort Lauderdale rather than land at Varadero / Juan Gualberto Gomez Airport, which was closer. The crew's decision to proceed to Fort Lauderdale was influenced by their doubt as to the reaction time and the quality of emergency services at Cuban airports in general, better weather conditions forecasted at Fort Lauderdale, a familiarity with that airport, and by better service provided to passengers. The flight crew could not have foreseen that the condition of the right engine would deteriorate further, since the engine had been secured in accordance with the Engine Failure/Shutdown checklist.

The decision to continue toward Fort Lauderdale and then fly a holding pattern there for one hour with one engine out is questionable. Despite the low probability that the other engine would fail, the risk was sufficiently high to warrant expediting a landing as soon as possible.

The engine teardown was conducted to determine why the engine caught fire after windmilling for more than an hour. A significant quantity of oil, that is, about 3 USG, was lost in the first 20 minutes of flight. Due to extensive damage caused by the fire, the investigation could not determine the cause of the lost oil. According to the engine manufacturer, the engine can windmill for several minutes even if the oil level is at the minimum. Inadequate lubrication normally damages the bearings, but not in this occurrence.

An analysis of occurrences involving magnesium alloy transmission casings revealed that, in most cases, fire was caused by a ruptured fuel line or oil line or a cracked transmission casing. In this occurrence, the investigation could not determine the cause of the fire. The fact remains that a large quantity of oil was lost within a relatively short period. A fire can be caused by that amount of oil contacting the hot section of the engine. However, if that quantity of leaked oil had contributed to the fire, there is a strong possibility that this would have happened before or just after the engine started windmilling, while the engine was still hot. The fire detection system would then have detected it.

The oil system ensures that engine bearings receive enough oil at all phases of operation. Since the engine was turning at reduced rpm (windmilling), the reduced quantity of oil was adequate, and air pressure to the bearings provided minimum lubrication. The condition of the bearings confirms that they did not deteriorate from inadequate lubrication. Internal engine parts made of metal alloys can withstand high temperatures. If lubrication had become inadequate, the engine, in the worst case, would seize and stop but would not incur major damage and catch fire.

The shaft between the high-pressure compressor and the accessory gearbox was intact; therefore the accessory gearbox was being driven and was turning until the landing. The accessory gearbox contains mostly gears made of materials such as steel, and the gears are inside a magnesium casing. Since the quantity and supply of oil was limited, lubrication to the accessory gearbox was inadequate. The low quantity of oil probably created a temperature sufficient to ignite the oil and cause the magnesium to catch fire.

Although the aircraft complied with existing air regulations, the parameters recorded by the CVR and the FDR provided very little useful information for the investigation. The FDR confirmed that the right engine was shut down 20 minutes after take-off. No information was recorded regarding oil level, oil pressure or temperature, or high-pressure compressor rpm. These parameters might have yielded valuable information.

The fire extinguishing system must be able to extinguish the fire. Extinguishing agents must be able to extinguish flames from the combustion of fluids or other materials in the area protected by the extinguishing system. Regulations state that the "occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable" and that "the occurrence of any other failure condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable."

The investigation demonstrated that a magnesium fire is difficult, if not impossible, to extinguish; the extinguishing agent from the fire extinguishing system was unable to put out the fire. This occurrence might have had disastrous consequences had the aircraft been farther from a suitable airport.

The flight crew's decision to prolong the flight exposed the aircraft occupants to a hazardous situation. The engine manufacturer does not specify the maximum windmilling time for the engine following a significant loss of oil, and the aircraft manufacturer has not clearly defined the expression "nearest suitable airport".

The following TSB Engineering Laboratory reports were completed:

• LP 060/01 – CVR and FDR Analysis
• LP 069/01 – Gearbox Analysis

Findings as to causes and contributing factors

1. The loss of oil reduced lubrication to the accessory gearbox, thereby increasing the heat inside the magnesium casing and possibly contributing to ignition of the casing.
2. Although the fire extinguishing system met certification requirements, the system was unable to—and was not designed to—extinguish a magnesium fire.

Findings as to risk

1. The aircraft manufacturer has not clearly defined the expression "nearest suitable airport". The manufacturer does not specify a maximum flight time when an emergency requires that the aircraft land at a suitable airport.
2. The flight crew's decision to continue the flight and plan a holding pattern with one engine out is questionable. Despite the low probability that the other engine would fail, the risk was sufficiently high to warrant expediting a landing.

Boeing undertook a review of Operations Manual advice to crews about the Non-Normal checklist instruction to "Plan to land at the nearest suitable airport". As a result of that review, Boeing revised the Non-Normal Operation Section of the Flight Crew Training Manual for all Boeing airplanes to include the basis for landing at the nearest suitable airport and how it is applied.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 5 December 2002.