Aviation Investigation Report A05W0222

An Alaska Airlines Inc. Boeing 737-900 aircraft (registration N317AS, serial number 30856) was scheduled to take off at 0700 mountain standard time, on its first flight of the day, from Calgary International Airport, Alberta, to Los Angeles Airport, California, United States. The aircraft was pushed back across the apron from departure gate 26. Following a normal start on the left engine, the crew initiated a start on the right engine. During the start sequence, the right engine discharged a large quantity of flame and smoke from the tailpipe, with smoke eventually entering the aft cabin. The engines were shut down, and all 113 passengers were evacuated using the emergency slides on the two left-side main doors, away from the right engine tailpipe fire. The flight crew requested aircraft rescue and firefighting assistance, and the trucks arrived as the passengers were evacuating. By this time, there was no longer any flame or smoke visible. There were no injuries to passengers or crew. Initial examination determined that the fire was contained within the engine flow path (CFM 56-7B26, serial number 890392). There was no damage to the engine or the aircraft structure.

The flame and smoke was not readily visible to the pilots from the cockpit. Images from an airport surveillance camera showed that a crosswind blew the smoke to the left and rearward from the aircraft. At 0701:17 mountain standard time,^{Footnote 1} 31 seconds after the right engine start was initiated, the pilots were informed by radio of the engine torching^{Footnote 2} by the crew of a nearby aircraft. Eleven seconds after the radio call, the captain shut down the right engine; the left engine was left running. Both the pushback tug operator and the cabin crew reported, via the aircraft interphone, that smoke and fire was visible on the right side. These calls were acknowledged by the flight deck.

At 0702:28, the captain informed the in-charge flight attendant on the interphone that the pilots were aware of the fire and were working on the problem. At that time, the flight attendant informed the captain that smoke had begun to infiltrate the aft cabin. Both air conditioning packs were off for the start, but the auxiliary power unit (APU) was operating. Under those conditions, it is possible for smoke to enter the aft portion of the cabin via the APU intake, through the air conditioning system, and eventually through the aft cabin floor vents.

Passengers seated in the rear of the aircraft became anxious to evacuate because of the visible flame and irritation caused by the smoke in the cabin. The in-charge flight attendant, positioned at the front of the cabin, called the flight deck at 0702:56 to determine if there would be a passenger evacuation. The captain chose to defer the decision to evacuate until the seriousness of the situation was assessed. Numerous calls with relevant information were made to the flight crew from a variety of external sources during the entire event. The captain instructed the first officer to begin to run the tailpipe fire checklist at 0703:01.

At 0703:28, the in-charge flight attendant reaffirmed the existence of smoke in the cabin, the anxiety level of the passengers, and made another query regarding an evacuation. At the request of the cabin crew for a direct discussion of the problem, the first officer released the cockpit door lock. Due to the noise level in the cabin, the flight attendants could not hear the lock release, and the cockpit door remained closed.

The captain requested, on the apron control frequency, that aircraft rescue and firefighting (ARFF) respond to the aircraft. At 0704:28, 3 minutes 11 seconds after receiving the first warning call, and after assessing that it was safe to open the left side doors, the captain ordered an emergency evacuation using the left doors only, with the evacuation slides. The company flight operations manual (FOM) and the evacuation checklist require engine shutdown before opening of doors. When the aft left door was opened by the cabin crew, the evacuation checklist had not been completed by the flight crew to the point of left engine shutdown. Although the engine was shut down 15 seconds after the evacuation order, the deployed slide flapped off the ground momentarily in the coasting airflow from the left engine as it spooled down.

The evacuation of the passengers was conducted in an orderly manner with the assistance of the pushback crew and two passengers delegated by the cabin crew. The passengers were escorted by ground crew and agents from another airline, across the apron to a holding area in the terminal. The flight and cabin crews remained on board until all passengers had evacuated and then deplaned via portable airstairs. In order to gain access to the right side of the aircraft, a responding fire truck elected to pass through a gap in the line of passengers who were proceeding to the terminal (see Figure 1). A construction area adjacent the aircraft's right side prevented access in that direction. The visibility and light conditions allowed the truck's crew to see the passengers. The passengers, seeing the stopped vehicle with its lights flashing, opened a gap and the truck passed safely through. The passenger evacuation was complete at 0708:00, 6 minutes 43 seconds after the first warning call to the flight crew.

Image

Analysis of the digital flight data recorder (DFDR) data by the TSB Engineering Laboratory revealed that, when fuel was introduced during the start of the right engine (CFM 56-7B26, serial number 890392) fuel flow immediately rose to about 8000 pounds per hour (pph), compared with a normal start fuel flow of about 800 pph. This high fuel flow lasted for 43 seconds, until the engine fuel cutoff control was actuated. During the start, the right Engine Control annunciator light and the Master Caution light illuminated, indicating a disagreement between the position of the fuel metering valve (FMV) and its commanded setting. N1 (low pressure compressor turbine speed) did not accelerate beyond 12 per cent compared with that of the left engine, which had stabilized at 23 per cent. There were no engine fire warnings in the cockpit or an excessive exhaust gas temperature (EGT) reading, normally associated with an engine fire. Therefore, the pilots did not activate the engine fire extinguisher system.

Image

The fuel control system for the CFM 56-7B26 engine is a full authority digital engine control (FADEC) system that meters engine fuel flow for any engine operating condition. The hydro-mechanical unit (HMU) responds to electrical signals from an electronic engine control (EEC). The HMU fuel metering function is carried out by one of six integral, four-way electro-hydraulic servo valves (EHSV), which, in turn, command the fuel metering valve (FMV). The two stages of the FMV EHSV consist of a fluidic amplifier first stage and a spool valve second stage. The fluidic amplifier directs a small fuel stream to two ports that deliver this servo fuel to either end of the spool valve. Fluidic amplifier nozzle position is a function of torque motor input from the EEC, with the flow of signal fuel split between the two ports according to commands from the torque motor (see Figure 2). The HMU (model CH-T1, part number 442317-9, serial number BECW1597) was manufactured by Honeywell International Inc. and had 3257 operating hours since overhaul. The EEC was manufactured by BAE Systems.

The high fuel flow event could not be duplicated during functional testing of the HMU and EEC components, either as an integrated unit or individually. Electronic and computer software testing of the EEC did not reveal any anomalies that would have commanded the excessive fuel flow.

During disassembly and visual inspection of the FMV EHSV jet pipe, excessive solder was discovered on the diverter jet nozzle/feedback spring collar joint, with the solder protruding beyond the jet pipe nozzle (see Photo 2). The solder joint between the feedback spring collar and the jet pipe nozzle should be a fillet with no solder above the height of the jet pipe face (see Photo 1). The required air gap between the nozzle and the receiver ranged between 0.0005 and 0.0008 inch. The air gap on the affected nozzle was reduced by the excessive solder to between 0.0001 and 0.00048 inch. A 73-micron fuel filter allowed for passage of particles no greater than 0.0003 inch through the first stage.

Image

Image

Disassembly of the first stage FMV EHSV coil and magnet assemblies revealed an extraneous washer trapped between the C1 coil assembly and the lower pole piece. There was no indication that this washer was detrimental to the operation of the unit. It was determined that the washer was introduced during the overhaul of the FMV EHSV at Honeywell International Inc. facilities. The washer, which should have been discarded, stuck to the reused magnetic coil when the two components inadvertently came together during the overhaul. Standard procedures for the overhaul of the units did not call for segregation of discarded and reused parts that would have prevented foreign object contamination by the washer during reassembly.

The manufacturer's quality assurance program provided for independent checks before the release of any component, but these checks did not detect the excessive solder in this case. Examination of the other five EHSVs from the affected HMU, as well as inspection of 117 other EHSVs, did not reveal similar instances of excessive solder or other foreign object contamination.

Alaska Airlines Inc. procedures in the Flight Handbook called for both pilots to monitor N1 during engine start to confirm engine rotation before introducing fuel flow. Next, the pilots would monitor fuel flow, EGT, and oil pressure. The engine speed indicated by N2 (high pressure compressor turbine speed) would also be monitored to ensure that the engine start switch disengaged at 56 per cent. N1, N2, EGT, and oil pressure anomalies were listed as conditions in the Flight Handbook for aborting a start. However, the Flight Handbook did not offer guidelines for crew action based on abnormal fuel flow indications.

On Alaska Airlines Inc. Boeing 737-900 aircraft, fuel flow indications were presented in digital format on the instrument panel secondary engine display unit. The scale was in thousands of pounds per hour, rounded to the nearest 10 pounds. For example, 820 pph read as 0.820 while 8200 pph read as 8.200. During start, normal fuel flow of about 800 pph was expected. The digital indication for fuel flow did not change colour to indicate values outside normal operating limits as some other instruments were designed to do.

The optimum style for presenting engine information depends, in part, on the use made of that information and the time available for a system operator to process it. Digital displays are effective when a precise numeric value is required for a quantitative reading for recording or calculation purposes, and the values are not continually changing. Analog displays are more useful when the operator is interested in rate and direction of change or system status information, and values are subject to frequent or continual change ^{Footnote 3}, ^{Footnote 4}. In order to infer whether a system is operating normally using purely digital format, the operator must

• know the range of normal values to be expected;
  
• read the specific value displayed;
  
• compare this to the range of normal values; and
  
• make an interpretation of whether the observed value is within the expected range.

Flight crews must devote additional time and cognitive resources to correctly interpret a purely digital display.

Image

The N1, N2, and EGT displays in the occurrence aircraft consist of combined digital and stylized analog round gauges, which allow for easy identification of rate of change and differences between the engines. In addition, exceedence of normal ranges is presented by changes in gauge colour and/or digit colour. Similar trend information and colour coding is featured on presentations for oil pressure, temperature, and engine vibration on combined digital and analog vertical tape displays. The presentation of engine oil quantity is in digital format, with colour change to signify low quantity. Fuel flow indications are in digital format only, with no colour change (see Figure 3).

Boeing offered a side-by-side engine display unit configuration that presented fuel flow in combined digital and analog formats. The Alaska Airlines Inc. new-generation Boeing 737-900 aircraft were not equipped with this option in order to ensure standardization between the company's models in its Boeing 737 fleet.

The reduced clearance between the nozzle and the receiver in the FMV EHSV resulted in an area that would be susceptible to binding due to particle contamination. It was possible that small foreign particles could pass through the 73-micron filter and temporarily interfere with the free movement of the nozzle. To account for the high fuel flow during the engine start, the nozzle was held in a position where it would direct most of its flow into the receiver port responsible for commanding high fuel flow. This resulted in the start fuel flow exceeding the normal start parameters by a factor of 10. Subsequent examination of other units submitted for inspection and overhaul after the occurrence did not reveal any similar manufacturing flaws; therefore, it is likely that this was an isolated event.

A combined digital and analog format for the fuel flow display may have made it easier for the flight crew to identify the abnormal fuel flow during the start of the right engine. The crew's attention was focused on N2, EGT, and oil pressure until the engine stabilized at idle, and this, combined with the type of fuel flow gauge display, explains how the abnormal fuel flow might have been missed.

The very rich fuel/air mixture inside the engine resulted in most of the excess fuel being expelled from the engine and igniting beyond the area of the engine where the EGT temperature probes were located. The EGT therefore remained in the normal starting range. The flames would not have been in the vicinity of the fire warning system, which was designed to detect the more serious under-the-cowl fire, and the cockpit fire warning annunciator light did not illuminate. The only indications of the abnormal start were illumination of the Engine Control annunciator light, the Master Caution light, a reduced N1, and the rapidly changing digital fuel flow display. There were no easily identifiable and compelling instrument indications of the high fuel flow and torching event for the pilots. The large quantity of smoke and flame was not readily visible from the cockpit, and the pilots were receiving information in numerous calls from several sources.

After they were informed of the engine fire, the pilots were occupied with determining the seriousness of the situation and responding with appropriate checklists. Because the cabin crew was not aware that the cockpit door was unlocked by the first officer, it remained closed, and the pilots had to rely upon interphone conversations with the in-charge flight attendant to determine the amount of smoke in the cabin. An open door would likely have allowed the pilots to see the smoke, facilitate direct communication with the cabin crew, and initiate an earlier passenger evacuation.

The following TSB Engineering Laboratory report was completed:

• LP 112/2005 – Data Recorders Analysis

This report is available from the Transportation Safety Board of Canada upon request.

Findings as to causes and contributing factors

1. Excessive solder on a jet pipe nozzle in the overhauled electro-hydraulic servo valves (EHSV) reduced the clearance area so that particle contamination allowed binding, resulting in a nozzle position that commanded excessive fuel flow.
   
2. The manufacturer's quality assurance monitoring did not detect the excessive solder on the jet pipe nozzle, allowing the nozzle back into service.
   
3. Excess unburned fuel, caused by the excessive fuel flow, ignited as it exited the engine and tailpipe, resulting in severe external torching.

Findings as to risk

1. When the evacuation order was given, the evacuation checklist was not complete and, consequently, the left engine was not yet shut down. When the aft, left door was opened and the slide deployed, engine airflow could have resulted in injuries to passengers attempting to use the slide.
   
2. The closed cockpit door likely reduced the effectiveness of communications between the cabin and flight deck crews, and prevented the pilots from directly assessing the amount of smoke in the cabin.

Other Finding

1. It is possible that the digital display format for fuel flow had a bearing on the flight crew's ability to detect the abnormal fuel flow during the start of the No. 2 engine.

Safety action taken

Honeywell International Inc.

Honeywell International Inc. inspected all electro-hydraulic servo valve (EHSV) units returned for overhaul since the occurrence. By 15 June 2006, 117 returned valves had been inspected with no anomalies detected. The overhaul process was subjected to an internal quality review, and changes were made to prevent a recurrence. As well, the following processes were put in place:

• training was conducted for all soldering operators and inspectors;
  
• peer audits were scheduled quarterly;
  
• a quality inspection point was added for all overhauled spring solder joints;
  
• process verification audits were scheduled on an annual basis; and
  
• rejected and reused components were to be completely segregated during disassembly, cleaning, and reassembly.

Alaska Airlines Inc.

Alaska Airlines Inc. revised the company's training program to ensure that flight crews fully complete the emergency evacuation checklist before ordering an evacuation.

Calgary Airports Authority

Operations personnel from the Calgary Airports Authority and tenants of the Calgary International Airport discussed the hazards and mitigations associated with operation of ground vehicles in the proximity of deplaning passengers during emergency situations.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 13 June 2007.