British Airways Flight 2276

NTSB narrative

A British Airways Boeing 777-236ER, powered by two General Electric (GE) GE90-85BG11 turbofan engines, had started its takeoff ground roll at McCarran International Airport, Las Vegas, Nevada. During the takeoff roll, the cockpit voice recorder (CVR) recorded a "bang" sound. Immediately afterward, the airplane veered to the left. and the CVR recorded the engine indicating and crew alerting system (EICAS) aural annunciation "engine fail." The captain moved the thrust reverser levers to their idle positions and began the rejected takeoff maneuver.

The airplane's airspeed at the time of the rejected takeoff maneuver was about 77 knots. According to the British Airways B777 Flight Crew Operations Manual Quick Reference Handbook (QRH), the decision to reject a takeoff must be made in time to start the maneuver by the takeoff decision speed, which was 149 knots for the flight. The start of the rejected takeoff maneuver occurred 2 seconds after the "bang" sound, and the airplane came to a stop 13 seconds after the rejected takeoff maneuver began. Thus, the captain made a timely decision to reject the takeoff and performed the maneuver in accordance with company training and procedures.

The uncontained left engine failure resulted from a fatigue crack in the high-pressure compressor (HPC) stage 8 disk. The fatigue crack started on the aft face of the disk web and progressed through the web and in the circumferential direction. The fracture region had an intergranular appearance near the aft face of the web and a transgranular appearance farther away from the initiation site. The transgranular area exhibited striations consistent with low-cycle fatigue crack growth. GE considered worst-case conditions (highest stresses and temperatures and minimum material properties) in predicting the low-cycle fatigue crack initiation lifetime at the stage 8 disk aft web faced and found that it had a low-cycle fatigue initiation life of about 29,800 cycles. (A fatigue facture can be divided into an initiation phase and a propagation phase. During the initiation phase, the material structure is changing due to the cyclic loads, but no cracks have formed. Eventually a crack forms and begins to grow, indicating the onset of the propagation phase. FAA Advisory Circular 33.70-01 uses the concept of detectable crack initiation, which is the size of a crack that can be detected using a nondestructive inspection method, to demarcate the transition from initiation to propagation.)

The HPC stage 8-10 spool had accumulated 11,459 total cycles and the low-cycle fatigue crack had propagated over approximately 5,400 of those cycles, the balance was the number of cycles for crack initiation, approximately 6,000 cycles. Thus, GE's predicted crack initiation life (low-cycle fatigue life) at the aft web face was approximately five times greater than the estimated crack initiation life at the aft web face of the accident disk.

During its metallurgical examination of the event HPC stage 8-10 spool, it was observed that the aft surface of the stage 8 disk outer web had lower-than-expected shot peen coverage. GE's examination of other similar spools also found reduced shot peen coverage on the aft surface of the stage 8 disk web. When GE's estimates low-cycle fatigue life, the calculations do not account for the benefits of shot peening. As a result, GE determined that the lower-than-expected shot peen coverage on the aft surface of the stage 8 disk could not account for the fatigue crack initiation and eventual fracture of the spool.

Evidence indicated that the crack initiated by an environmentally assisted failure mode. With the sustained-peak low-cycle fatigue failure mode, a cyclic stress profile with an extended hold time, combined with an oxidizing atmosphere and elevated temperature, leads to oxidation of grain boundaries, which become brittle and eventually crack along an intergranular path. A cyclic stress profile with an extended hold time occurred during each takeoff, when the engines were at full power, and during operations, when the stage 8 disk would have been under a sustained load. A metallographic cross-section through the crack initiation area revealed an oxide layer on the fracture surface, including its intergranular region, demonstrating an oxidizing atmosphere. Elevated temperatures occurred whenever the engine was operating; the highest temperatures occurred during takeoff. Thus, the crack initiated by the sustained-peak low-cycle fatigue failure mode.

GE was unable to determine why a crack initiated via sustained-peak low-cycle fatigue in the disk web. GE has not previously experienced environmental cracking under the operational conditions to which the stage 8 disk web was subjected and GE's postaccident inspections of additional HPC stage 8-10 spools did not find any cracks in any other disk webs. Further inspection of the accident stage 8 disk did not find additional cracks in the web (other than secondary cracks in the immediate area of the crack that led to the disk failure).

The disk web was not an area that required routine inspections, so the crack on the accident disk went undetected. Federal Aviation Administration Advisory Circular 33.70-1, "Guidance Material for Aircraft Engine Life-Limited Parts Requirements," stated that the surface length of a crack that can be detected using a nondestructive inspection method is 0.03 inch. During maintenance in September 2008, when the HPC was removed from the engine and disassembled, exposing the stage 8-10 spool, the surface crack length would have been about 0.05 inch. Thus, if the disk web had been required to be inspected during this maintenance, the crack should have been detectable. By the time of the June 2014 maintenance, during which the HPC was removed from the engine but was not disassembled, the length of the surface crack would have increased to about 0.19 inch. After the accident, GE implemented inspection procedures at the piece-part, rotor, module, and engine levels to detect disk web cracks.

While the airplane was decelerating to a stop, the fire warning bell sounded. When the airplane came to stop, the captain called for the engine fire checklist. The third item on the checklist was to move the fuel control switch on the affected side (in this case, the left side) to the cutoff position, which shuts down the respective engine. The spar valve terminates fuel flow to an engine after it is shut down. Flight data recorder (FDR) data showed that about 28 seconds elapsed between the start of the engine failure and the time of the spar valve closure, and Boeing estimated that about 97 gallons of fuel had spilled onto the runway during this time. FDR data also showed that 22 seconds elapsed between the time that the captain initially called for the engine fire checklist and the time of the spar valve closure. (Thirteen seconds had elapsed between the time that the captain repeated his call for the engine fire checklist and the time of the spar valve closure.) If the left engine had been shut down sooner, there would have been less fuel on the runway to feed the fire.

The flight crew informed the passengers and flight attendants to remain seated and await further instruction, which was consistent with the flight crew's training and procedures if an evacuation was not going to immediately occur. The cabin crew reinforced the flight crew's expectation by instructing passengers to remain seated. As part of the flight crew's evaluation of the situation, the relief pilot left the cockpit and entered the forward cabin so that he could look outside a window. Before the relief pilot returned, the CVR recorded the captain's statements indicating that the airplane should be evacuated. The relief pilot returned to the cockpit shortly afterward and informed the captain of the need to evacuate on the right side of the airplane because of the fire. The captain then commanded the evacuation, and a flight crewmember activated the evacuation alarm.

When the relief pilot went into the cabin to assess the situation outside of the airplane, a flight attendant told him that she had been trying to call the flight crew. The CVR recorded a sound similar to an interphone call from the cabin to the flight deck, but the flight crewmembers most likely did not answer the call because they were focused on securing the left engine and deciding whether to evacuate.

After the captain's evacuation command, the flight attendants assessed their areas and opened the doors that they deemed usable. Five of the eight door exits were initially blocked by flight attendants, which was appropriate given the hazards associated with the smoke, fire, and unusual attitude of two slides. A sixth door, which was initially opened, was blocked once a flight attendant saw flames on the runway, which was also appropriate. Although only two of the eight door exits were used throughout the evacuation, the passengers and crewmembers were able to evacuate before smoke and fire encroached the fuselage.

The captain commanded the evacuation (step three in the evacuation checklist) before calling for the evacuation checklist and performing the first two steps in the checklist. Step two of the evacuation checklist instructs the captain to shut down both engines. The left engine was shut down as part of the engine fire checklist, but the right engine continued operating for about 43 seconds after the captain's evacuation command. The unusual attitude of two slides (the 3R and 4R slides) resulted from the jet blast coming from the right engine while it was operating.

The captain did not use the QRH to read and do his evacuation checklist items. The right engine was shut down after the relief pilot noticed EICAS indications showing that the engine was still running. Also, the captain's call for the evacuation checklist occurred after the relief pilot stated that the checklist needed to be performed. (The first officer had stated, just before the relief pilot, "we haven't done the engine checklist," but he most likely meant the evacuation checklist.) Because the captain did not follow standard procedures, his call for the evacuation checklist and the shutdown of the right engine were delayed.

British Airways' engine fire checklist, which was based on the Boeing 777 engine fire checklist, did not differentiate between an engine fire occurring on the ground or during flight. The third step of the checklist instructed the flight crew to cut off the fuel control switch on the affected side to shut down that engine. However, for an engine fire on the ground, the checklist did not include a step to shut down the unaffected engine or indicate that some steps did not apply. If the engine fire checklist had specifically addressed fires during ground operations, the flight crew could have secured the right engine in a timelier manner and decided to evacuate sooner. In February 2018, as part of its final report on the American Airlines flight 383 investigation, the NTSB issued two related safety recommendations, A-18-6 and A-18-10, to address this issue.

The relief pilot relayed pertinent information to the captain and first officer as the emergency unfolded. The relief pilot pointed out the smoke to the flight crew and volunteered to assess the situation outside the airplane from a window in the cabin. After returning to the cabin and reporting his assessment, the relief pilot indicated that the airplane was still on fire on the left side, and the captain commanded the evacuation. The relief pilot also noticed that the right engine was still running and indicated that it needed to be shut down. Thus, the relief pilot played an important role in ensuring the safety of the airplane occupants.

During a group debriefing by the Air Accidents Investigation Branch, the flight attendants stated that some passengers evacuated with carry-on baggage; however, the flight attendants thought that carry-on baggage retrieval did not slow the evacuation. They thought that most passengers who retrieved baggage did so after the airplane came to a stop and before the evacuation was commanded and that the flight attendants' assertive commands limited further retrieval. The flight attendants at the two most-used exits (doors 1R and 4L) recalled seeing very little baggage at their exits, and neither cited carry-on baggage as a problem. However, the NTSB notes that the accident airplane was only 55% full.

Although not a factor in this evacuation, the NTSB remains concerned about the safety issues resulting from passengers evacuating with carry-on baggage, which could potentially slow the egress of passengers and block an exit during an emergency. The NTSB previously addressed carry-on baggage in a June 2000 safety study on evacuations of commercial airplanes and issued Safety Recommendation A-18-9 in February 2018 as part of its final report on the American Airlines flight 383 investigation.

Verbatim NTSB analysis and probable cause from the NTSB dataset