National Transportation Safety Board
Aviation Accident Final Report
Las Vegas, NV
Date & Time:
09/08/2015, 1613 PDT
BOEING COMPANY BOEING 777-236
Uncontained engine failure
1 Serious, 19 Minor, 150 None
Flight Conducted Under:
Part 129: Foreign
A British Airways Boeing 777-236ER, powered by two General Electric (GE) GE90-85BG11 turbofan engines, had started its takeoff ground roll at McCarran International Airport, Las Vegas, Nevada. During the takeoff roll, the cockpit voice recorder (CVR) recorded a "bang" sound. Immediately afterward, the airplane veered to the left. and the CVR recorded the engine indicating and crew alerting system (EICAS) aural annunciation "engine fail." The captain moved the thrust reverser levers to their idle positions and began the rejected takeoff maneuver.
The airplane's airspeed at the time of the rejected takeoff maneuver was about 77 knots. According to the British Airways B777 Flight Crew Operations Manual Quick Reference Handbook (QRH), the decision to reject a takeoff must be made in time to start the maneuver by the takeoff decision speed, which was 149 knots for the flight. The start of the rejected takeoff maneuver occurred 2 seconds after the "bang" sound, and the airplane came to a stop 13 seconds after the rejected takeoff maneuver began. Thus, the captain made a timely decision to reject the takeoff and performed the maneuver in accordance with company training and procedures.
The uncontained left engine failure resulted from a fatigue crack in the high-pressure compressor (HPC) stage 8 disk. The fatigue crack started on the aft face of the disk web and progressed through the web and in the circumferential direction. The fracture region had an intergranular appearance near the aft face of the web and a transgranular appearance farther away from the initiation site. The transgranular area exhibited striations consistent with low-cycle fatigue crack growth. GE considered worst-case conditions (highest stresses and temperatures and minimum material properties) in predicting the low-cycle fatigue crack initiation lifetime at the stage 8 disk aft web faced and found that it had a low-cycle fatigue initiation life of about 29,800 cycles. (A fatigue facture can be divided into an initiation phase and a propagation phase. During the initiation phase, the material structure is changing due to the cyclic loads, but no cracks have formed. Eventually a crack forms and begins to grow, indicating the onset of the propagation phase. FAA Advisory Circular 33.70-01 uses the concept of detectable crack initiation, which is the size of a crack that can be detected using a nondestructive inspection method, to demarcate the transition from initiation to propagation.)
The HPC stage 8-10 spool had accumulated 11,459 total cycles and the low-cycle fatigue crack had propagated over approximately 5,400 of those cycles, the balance was the number of cycles for crack initiation, approximately 6,000 cycles. Thus, GE's predicted crack initiation life (low-cycle fatigue life) at the aft web face was approximately five times greater than the estimated crack initiation life at the aft web face of the accident disk.
During its metallurgical examination of the event HPC stage 8-10 spool, it was observed that the aft surface of the stage 8 disk outer web had lower-than-expected shot peen coverage. GE's examination of other similar spools also found reduced shot peen coverage on the aft surface of the stage 8 disk web. When GE's estimates low-cycle fatigue life, the calculations do not account for the benefits of shot peening. As a result, GE determined that the lower-than-expected shot peen coverage on the aft surface of the stage 8 disk could not account for the fatigue crack initiation and eventual fracture of the spool.
Evidence indicated that the crack initiated by an environmentally assisted failure mode. With the sustained-peak low-cycle fatigue failure mode, a cyclic stress profile with an extended hold time, combined with an oxidizing atmosphere and elevated temperature, leads to oxidation of grain boundaries, which become brittle and eventually crack along an intergranular path. A cyclic stress profile with an extended hold time occurred during each takeoff, when the engines were at full power, and during operations, when the stage 8 disk would have been under a sustained load. A metallographic cross-section through the crack initiation area revealed an oxide layer on the fracture surface, including its intergranular region, demonstrating an oxidizing atmosphere. Elevated temperatures occurred whenever the engine was operating; the highest temperatures occurred during takeoff. Thus, the crack initiated by the sustained-peak low-cycle fatigue failure mode.
GE was unable to determine why a crack initiated via sustained-peak low-cycle fatigue in the disk web. GE has not previously experienced environmental cracking under the operational conditions to which the stage 8 disk web was subjected and GE's postaccident inspections of additional HPC stage 8-10 spools did not find any cracks in any other disk webs. Further inspection of the accident stage 8 disk did not find additional cracks in the web (other than secondary cracks in the immediate area of the crack that led to the disk failure).
The disk web was not an area that required routine inspections, so the crack on the accident disk went undetected. Federal Aviation Administration Advisory Circular 33.70-1, "Guidance Material for Aircraft Engine Life-Limited Parts Requirements," stated that the surface length of a crack that can be detected using a nondestructive inspection method is 0.03 inch. During maintenance in September 2008, when the HPC was removed from the engine and disassembled, exposing the stage 8-10 spool, the surface crack length would have been about 0.05 inch. Thus, if the disk web had been required to be inspected during this maintenance, the crack should have been detectable. By the time of the June 2014 maintenance, during which the HPC was removed from the engine but was not disassembled, the length of the surface crack would have increased to about 0.19 inch. After the accident, GE implemented inspection procedures at the piece-part, rotor, module, and engine levels to detect disk web cracks.
While the airplane was decelerating to a stop, the fire warning bell sounded. When the airplane came to stop, the captain called for the engine fire checklist. The third item on the checklist was to move the fuel control switch on the affected side (in this case, the left side) to the cutoff position, which shuts down the respective engine. The spar valve terminates fuel flow to an engine after it is shut down. Flight data recorder (FDR) data showed that about 28 seconds elapsed between the start of the engine failure and the time of the spar valve closure, and Boeing estimated that about 97 gallons of fuel had spilled onto the runway during this time. FDR data also showed that 22 seconds elapsed between the time that the captain initially called for the engine fire checklist and the time of the spar valve closure. (Thirteen seconds had elapsed between the time that the captain repeated his call for the engine fire checklist and the time of the spar valve closure.) If the left engine had been shut down sooner, there would have been less fuel on the runway to feed the fire.
The flight crew informed the passengers and flight attendants to remain seated and await further instruction, which was consistent with the flight crew's training and procedures if an evacuation was not going to immediately occur. The cabin crew reinforced the flight crew's expectation by instructing passengers to remain seated. As part of the flight crew's evaluation of the situation, the relief pilot left the cockpit and entered the forward cabin so that he could look outside a window. Before the relief pilot returned, the CVR recorded the captain's statements indicating that the airplane should be evacuated. The relief pilot returned to the cockpit shortly afterward and informed the captain of the need to evacuate on the right side of the airplane because of the fire. The captain then commanded the evacuation, and a flight crewmember activated the evacuation alarm.
When the relief pilot went into the cabin to assess the situation outside of the airplane, a flight attendant told him that she had been trying to call the flight crew. The CVR recorded a sound similar to an interphone call from the cabin to the flight deck, but the flight crewmembers most likely did not answer the call because they were focused on securing the left engine and deciding whether to evacuate.
After the captain's evacuation command, the flight attendants assessed their areas and opened the doors that they deemed usable. Five of the eight door exits were initially blocked by flight attendants, which was appropriate given the hazards associated with the smoke, fire, and unusual attitude of two slides. A sixth door, which was initially opened, was blocked once a flight attendant saw flames on the runway, which was also appropriate. Although only two of the eight door exits were used throughout the evacuation, the passengers and crewmembers were able to evacuate before smoke and fire encroached the fuselage.
The captain commanded the evacuation (step three in the evacuation checklist) before calling for the evacuation checklist and performing the first two steps in the checklist. Step two of the evacuation checklist instructs the captain to shut down both engines. The left engine was shut down as part of the engine fire checklist, but the right engine continued operating for about 43 seconds after the captain's evacuation command. The unusual attitude of two slides (the 3R and 4R slides) resulted from the jet blast coming from the right engine while it was operating.
The captain did not use the QRH to read and do his evacuation checklist items. The right engine was shut down after the relief pilot noticed EICAS indications showing that the engine was still running. Also, the captain's call for the evacuation checklist occurred after the relief pilot stated that the checklist needed to be performed. (The first officer had stated, just before the relief pilot, "we haven't done the engine checklist," but he most likely meant the evacuation checklist.) Because the captain did not follow standard procedures, his call for the evacuation checklist and the shutdown of the right engine were delayed.
British Airways' engine fire checklist, which was based on the Boeing 777 engine fire checklist, did not differentiate between an engine fire occurring on the ground or during flight. The third step of the checklist instructed the flight crew to cut off the fuel control switch on the affected side to shut down that engine. However, for an engine fire on the ground, the checklist did not include a step to shut down the unaffected engine or indicate that some steps did not apply. If the engine fire checklist had specifically addressed fires during ground operations, the flight crew could have secured the right engine in a timelier manner and decided to evacuate sooner. In February 2018, as part of its final report on the American Airlines flight 383 investigation, the NTSB issued two related safety recommendations, A-18-6 and A-18-10, to address this issue.
The relief pilot relayed pertinent information to the captain and first officer as the emergency unfolded. The relief pilot pointed out the smoke to the flight crew and volunteered to assess the situation outside the airplane from a window in the cabin. After returning to the cabin and reporting his assessment, the relief pilot indicated that the airplane was still on fire on the left side, and the captain commanded the evacuation. The relief pilot also noticed that the right engine was still running and indicated that it needed to be shut down. Thus, the relief pilot played an important role in ensuring the safety of the airplane occupants.
During a group debriefing by the Air Accidents Investigation Branch, the flight attendants stated that some passengers evacuated with carry-on baggage; however, the flight attendants thought that carry-on baggage retrieval did not slow the evacuation. They thought that most passengers who retrieved baggage did so after the airplane came to a stop and before the evacuation was commanded and that the flight attendants' assertive commands limited further retrieval. The flight attendants at the two most-used exits (doors 1R and 4L) recalled seeing very little baggage at their exits, and neither cited carry-on baggage as a problem. However, the NTSB notes that the accident airplane was only 55% full.
Although not a factor in this evacuation, the NTSB remains concerned about the safety issues resulting from passengers evacuating with carry-on baggage, which could potentially slow the egress of passengers and block an exit during an emergency. The NTSB previously addressed carry-on baggage in a June 2000 safety study on evacuations of commercial airplanes and issued Safety Recommendation A-18-9 in February 2018 as part of its final report on the American Airlines flight 383 investigation.
The National Transportation Safety Board determines the probable cause(s) of this accident to be:
The failure of the left engine high-pressure compressor (HPC) stage 8-10 spool, which caused the main fuel supply line to become detached from the engine main fuel pump and release fuel, resulting in a fire on the left side of the airplane. The HPC stage 8-10 spool failed due to a sustained-peak low-cycle fatigue crack that initiated in the web of the stage 8 disk; the cause of the crack initiation could not be identified by physical inspection and stress and lifing analysis. Contributing to this accident was the lack of inspection procedures for the stage 8 disk web.
Compressor section - Failure (Cause)
Compressor section - Fatigue/wear/corrosion (Cause)
Compressor section - Not inspected (Factor)
HISTORY OF FLIGHT
On September 8, 2015, about 1613 Pacific daylight time, British Airways flight 2276, a Boeing 777-236ER, G-VIIO, powered by two General Electric (GE) GE90-85BG11 turbofan engines, had started its takeoff ground roll on runway 7L at McCarran International Airport (LAS), Las Vegas, Nevada, when an uncontained engine failure in the No. 1 (left) engine and subsequent fire occurred. The flight crew aborted the takeoff, stopped the airplane on the runway, and evacuated the airplane. The fire was extinguished by aircraft rescue and firefighting (ARFF) personnel after the evacuation ended. The 157 passengers and 13 crewmembers evacuated on the runway via emergency slide/rafts; during the evacuation, 1 cabin crewmember sustained a serious injury, and 19 passengers sustained minor injuries. The airplane was substantially damaged from the fire. The flight was operating under the provisions of 14 Code of Federal Regulations Part 129 from LAS to London Gatwick International Airport (LGW), Horley, England.
Preflight activities were uneventful, and the airplane departed the gate at 1555, 10 minutes ahead of the scheduled 1605 departure. The captain was the pilot flying, and the first officer was the pilot monitoring. A relief pilot was also in the cockpit; he was sitting in the jumpseat, which was behind and between the two pilot seats. The captain taxied the airplane to runway 7L for an intersection takeoff at taxiway A8, which was about 2,662 ft from the runway 7L threshold.
The flight data recorder (FDR) showed that the airplane turned onto the runway heading at 1612:30. The captain advanced the engines to takeoff power 6 seconds later, and the engine N1 (low-pressure compressor), the longitudinal acceleration, and the ground speed increased, consistent with the start of the takeoff roll, at 1612:42. The cockpit voice recorder (CVR) recorded the sound of a "bang" at 1612:51.5, which was followed during the next 2 seconds by a sound similar to an engine spooling down, the engine indicating and crew alerting system (EICAS) aural annunciation "engine fail," and the captain's "stop" callout. During postaccident interviews, the first officer and the relief pilot stated that they heard a "thud" and a "bang," respectively, just before the airplane reached 80 knots, at which time the airplane veered to the left. The FDR showed that, at 1612:53, the left and right master warning lights illuminated (which occurred about the same time as the engine fail warning) and that the thrust levers (as indicated by the left and right throttle lever angle parameters) were moved to idle; 1 second later, the airplane began decelerating from about 77 knots, which was the peak airspeed achieved. The takeoff decision speed (V1) for the flight was 149 knots.
At 1612:58, the CVR recorded a sound similar to the fire warning bell, which lasted for 1.8 seconds, and the FDR showed that the left engine fire warning had illuminated. At that time, the captain stated, "tell [air traffic control (ATC)] we're stopping"; the first officer made this notification at 1613:05. During a postaccident interview, the first officer stated that, as the captain applied wheel braking, he noticed that the thrust levers began moving forward, so he disconnected the autothrottle. (Before reaching 80 knots, the Boeing 777 autothrottles attempt to set takeoff power if the thrust levers are retarded with the autothrottles still engaged.) The captain also reported that he did not use maximum braking because he initially thought that a tire had burst, and the first officer stated that he did not select reverse thrust and deploy the ground spoilers during the rejected takeoff (both pilot monitoring responsibilities) because he was "distracted by the thrust lever increasing."
FDR data showed that the airplane came to a stop at 1613:07 (15.5 seconds after the CVR recorded the sound of the bang); at that time, the CVR recorded the captain's second call for the engine fire checklist, which the first officer acknowledged. (The captain had previously called for the engine fire checklist at 1612:58, when he was also instructing the first officer to notify ATC that the airplane would be stopping on the runway.) At 1613:12, the relief pilot asked if he should make an announcement to the passengers and cabin crew; the captain agreed and indicated that they should "stay there where they are." At 1613:19, the relief pilot used the public address (PA) system to instruct the passengers and cabin crew to "please remain in your seats and await further instructions." About 1 second later, the captain contacted ATC, stating "mayday mayday" and "request fire services," and the tower controller responded that fire services were on the way.
The first officer performed the engine fire checklist memory items. FDR data showed that he moved the left fuel control switch to the cutoff position (1613:20) and pulled and rotated the left fire switch to its stop to discharge the first of two fire extinguisher bottles (1613:27). The engine fire checklist called for the second bottle to be discharged 30 seconds later if the FIRE ENG message still appeared. The first officer selected the electronic checklist on the multifunction display in the cockpit to use the 30-second timer to determine when to discharge the second bottle. At 1613:42, the FDR recorded the second fire extinguisher bottle being discharged (15 seconds after the first bottle), and the CVR recorded the first officer stating, "fire's now gone out." (FDR data show that the left engine fire warning light went out close to the time that the second fire extinguisher bottle was activated.) During a postaccident interview, the first officer stated that he activated the second fire extinguisher bottle earlier than indicated in the checklist because of the need to evacuate.
At 1613:47, the relief pilot asked if he should look outside a window, and the captain agreed. During a postaccident interview, the relief pilot stated that he queried the captain because he (the relief pilot) had seen a "large shadow" outside and above the fuselage. After leaving the flight deck and looking outside a cabin window, the relief pilot observed black smoke with an orange glow and the cabin window glass becoming "crazed." (According to Federal Aviation Administration [FAA] Advisory Circular 25.775-1, "Windows and Windshields," dated January 17, 2003, "crazing is a network of fine cracks that extend over the surface" and is "induced by…exposure to organic fluids and vapors.") The relief pilot told a cabin crewmember to get ready to evacuate and, after returning to the flight deck, stated (at 1615:50), "doesn't look good to me." Also at that time, the CVR recorded a sound similar to the interphone (a call from the cabin to the flight deck), which was not answered.
At 1614:03, the CVR recorded a flight attendant's announcement (over the PA system) that the passengers should remain seated. About 4 seconds later, the captain stated, "I think there's too much fire. I think we've got to get out," which was followed by the first officer's statement, "well [the fire light] says it's gone out," and the captain's statement, "no, we've got to evacuate." At 1614:23.2, the captain announced, over the PA system, "this is an emergency. This is the captain. Evacuate. Evacuate," which occurred 31.7 seconds after the CVR recorded the bang sound. About 4 seconds later, the first officer told the tower controller, "we are evacuating on the runway. We have a fire," and the controller acknowledged this information. The CVR recorded a sound similar to the evacuation alarm at 1614:29, which sounded for 33 seconds. . At 1614:35, the CVR recorded background sounds from the cabin that were consistent with an evacuation, which continued until the end of the recording (at 1615:36). At 1614:42, the captain made a PA announcement to evacuate on the right side of the airplane.
At 1615:03, the relief pilot asked if both engines were shut down. After the first officer stated no, the relief pilot indicated that the right engine needed to be shut down. (During a postaccident interview, the relief pilot stated that he noticed the right engine EICAS indications.) The FDR recorded the right engine shutdown at 1615:06 after the first officer moved the right engine fuel control switch to the fuel cutoff position. According to FDR data, the right engine continued to operate for 43 seconds after the captain commanded the evacuation and about 2 minutes after the airplane came to a stop.
The relief pilot then indicated that the evacuation checklist needed to be performed, and the captain called for the checklist at 1615:13. During a postaccident interview, the captain stated that he did not use the British Airways B777 Flight Crew Operations Manual (FCOM) Quick Reference Handbook (QRH) to "read and do" his evacuation checklist items and instead attempted to perform the checklist items from memory, but he missed the second step, which was to ensure that both engines were shut down. The CVR recorded the first officer performing the steps on the QRH evacuation checklist, one of which was to open the outflow valves (using toggle switches on the cockpit overhead panel) to depressurize the airplane for the evacuation. The first officer stated that he spent between 15 and 20 seconds attempting to open the outflow valves, and FDR data showed that the valves remained in the automatic position, which sets pressurization to a predetermined level. (According to the QRH evacuation checklist, the outflow valves should have been moved to the manual position, which allows a flight crew to control pressurization.)
About the same time as the right engine was shut down, the forward cargo bay fire warning light had illuminated. (FDR data showed that the forward cargo smoke warning became active at 1615:04.) The fire bell sounded in the cockpit for about 2 seconds starting at 1615:22. The captain reported, during a postaccident interview, that he noticed the forward cargo bay fire warning light and armed the cargo fire switch, but he was not certain if he discharged the cargo fire extinguisher bottles because other things were going on during that time, including the other two pilots preparing to exit the airplane. (During a postaccident examination of the airplane, three of the five cargo fire extinguisher bottles were found discharged.)
All occupants, including one lap child, and the flight and cabin crewmembers evacuated the airplane through the 1L, 1R, or 4L door slides. (The flight attendants estimated that only five passengers evacuated using the 1L door slide, which was subsequently blocked due to fire.) The National Transportation Safety Board (NTSB) obtained videos that showed that the evacuation was completed about 2 minutes 32 seconds after the captain's initial command to evacuate (1614:23).
ARFF vehicles were dispatched to the scene after the captain requested fire services (1613:19), and the videos showed that the first vehicle arrived on scene about 1 minute 59 seconds later (1615:18). The fire was likely extinguished by 1617:44, about 2 minutes 26 seconds after the first ARFF vehicle arrived on scene and about 4 minutes 52 seconds after the left engine failure.
According to airport personnel, video evidence, and FDR data, the left engine failure occurred about 1,030 feet from the runway 7L intersection with taxiway A8 (the takeoff location), and the airplane came to a full stop about 897 feet from the engine failure location. Skid marks on the runway surface, from both main landing gear assemblies, started about 700 ft before the airplane's final position on the runway. Postaccident examination of the airplane found that the fire had substantially damaged the left engine, the inboard left wing, and a portion of the left and right fuselage. A postaccident examination of the cockpit found that the left and right throttle lever angles were in their idle position and the thrust reverser levers were stowed; the left and right fuel control switches were in their cutoff position; the left engine fire handle was in the pulled position and rotated toward the No. 2 fire bottle position; and the guard on the evacuation command switch was raised and in the ON position.
The captain, age 63, held an airline transport pilot license issued by the European Aviation Safety Agency (EASA) on July 23, 2013; his initial United Kingdom airline transport pilot license was issued on July 8, 1997. The captain received a type rating for the Boeing 777 on April 14, 1999, and he also held type ratings for the Boeing 747-100 through -300, 747-400, and 787; McDonnell Douglas DC-10; and Lockheed L-1011. The captain held a United Kingdom Civil Aviation Authority (CAA) class I medical certificate, dated April 28, 2015, with the limitation that he must have available corrective spectacles (glasses) and carry a spare pair of glasses. The captain stated, during a postaccident interview, that he was not wearing his glasses at the time of the accident because he could see the cockpit instruments and the environment outside the airplane without them. The captain added that his spectacles were "intended for close vision."
The captain began work for British Airways in August 1973. He estimated that he had accumulated about 30,000 hours of total flight time. Documentation that British Airways provided showed that the captain had accumulated about 12,000 hours on the Boeing 777 and about 15,000 hours as pilot-in-command. He had flown 220, 80, and 15 hours during the previous 90, 30, and 7 days, respectively. The captain's last line check occurred on July 9, 2014, and his last recurrent simulator training occurred on March 23, 2015. The captain stated that he had previously flown with the first officer but not the relief pilot.
According to CAA records, the captain had no previous accidents, incidents, or enforcement actions and had no record of training failures. The captain stated he had not previously experienced an engine fire in his career, except during simulator training, and that he had performed a rejected takeoff during a flight only once (due to an instrument failure) before the accident. Also, until the accident, he had not conducted an evacuation during a flight.
The captain stated that he was off duty on September 5 and 6, 2015. (British Airways records showed that he had flown a 4-day trip from September 1 to 4.) He went to sleep about 2230Z and awoke about 0630Z. (Z stands for Zulu and indicates Universal Time Coordinated [UTC]; at the time of the accident, Pacific daylight time was 7 hours behind UTC.) On September 7, he reported for duty at LGW at 0845Z and flew to LAS as a positioning (nonflying) crewmember. After arriving in LAS on September 7, he took a walk and joined the relief pilot about 1800 for a meal. He went to sleep about 2100 and awoke on September 8 about 0400. He did not sleep again during the day but rested in his hotel room until 1430, when he had to leave for the airport. The captain stated that he experienced an "8-hour" time change in the 24 hours before the accident and felt "out of phase" with his body clock; he also stated that he felt "alright" overall and that he was "okay, but not as good as [he] could have been."
The First Officer
The first officer, age 30, held an airline transport pilot license issued by EASA on August 6, 2010, and he received a type rating for the Boeing 777 on January 11, 2011. The first officer also held a type rating for the Boeing 787 and Airbus A320. He held a CAA class I medical certificate, dated March 11, 2015, with no restrictions.
The first officer began work for British Airways in January 2006. Documentation that British Airways provided indicated that the first officer had accumulated about 6,400 hours of total flight time, 3,100 hours of which were in the Boeing 777. He had flown 220, 80, and 19 hours during the previous 90, 30, and 7 days, respectively. The first officer's last line check occurred on December 8, 2014, and his last recurrent simulator training occurred on September 2, 2015. According to CAA records, the first officer had no previous accidents, incidents, or enforcement actions and had no record of training failures.
The first officer was off duty for a 3-day period beginning September 4, 2015. On September 5, he went to sleep about 2300Z and awoke on September 6 about 0900Z. He traveled as a passenger from his home in Dublin, Ireland, to LGW and stayed at a hotel near the airport that night. The time that the first officer went to sleep on September 6 and awoke on September 7 are not known. He reported for duty on September 7 about 0945Z and was a required crewmember for the flight to LAS, which departed about 1100Z and arrived about 1400. Afterward, he went to his hotel room and the hotel pool and went to sleep at 1830. On September 8, he awoke at 0300 and slept again from 0900 to 1130. He stated that he was alert and awake when he reported for duty.
The Relief Pilot
The relief pilot, age 45, held an airline transport pilot license issued by EASA on July 23, 2013; his initial United Kingdom airline transport pilot license was issued on July 9, 2004. The relief pilot received a type rating for the Boeing 777 on December 29, 2001, and he also held type ratings for the Boeing 747-100 through -300 and 787, Hawker Siddeley HS125, and Lockheed L-1011. He held a CAA class I medical certificate, dated June 12, 2015, with a limitation to fly as, or with, a copilot. According to the relief pilot, he was assigned to the flight (because of its duration) to provide relief to the other flight crewmembers, provide extra monitoring, and act as a safety pilot.
The relief pilot began work for British Airways in November 1997. He estimated that he had accumulated about 14,000 hours of total flight time, 10,000 hours of which were in the Boeing 777. At the time of the accident, he was a first officer for the company. The relief pilot's last line check occurred on January 18, 2014, and his last recurrent simulator training occurred on June 20, 2015. He stated that he had no previous accidents, incidents, or enforcement actions and had no record of training failures.
The relief pilot stated that he was off duty for 2 days beginning on September 5, 2015. On September 7, he was a positioning (nonflying) crewmember on the flight from LGW to LAS. Afterward, he had a light meal, read, and went to bed. He awoke early on September 8 and got about 3 additional hours of rest, including 1 hour of sleep, in the afternoon before leaving for the airport about 1430. He stated that he expected to get the first rest break (using a business or first-class seat) and sleep for about 3 hours while en route to London. The relief pilot also stated that "he remained on English time" and felt alert and rested when he reported for duty.
The Flight Attendants
The flight was operated with 10 flight attendants. Nine of the 10 flight attendants completed recurrent training between November 2014 and August 2015; the remaining flight attendant, who was hired in January 2015, completed initial new hire training at that time.
The accident airplane, a Boeing 777-236ER, British registration G-VIIO, serial number 29320, had a manufacture date of November 1998 and was delivered to British Airways in January 1999. The airplane had accumulated 85,442 total flight hours and 12,835 total flight cycles at the time of the accident. After the accident, the airplane was repaired, and it was put back in service in March 2016.
The airplane was equipped with two GE90-85BG11 turbofan engines. At the time of the accident, the left engine had accumulated 66,801 total hours and 9,992 total cycles, and the right engine had accumulated 72,001 total hours and 10,637 total cycles. The left engine, engine serial number (ESN) 900-294, had a manufacture date of June 28, 1999, and was installed on the accident airplane on January 10, 2015. At the time of the accident, the engine had accumulated 3,645 hours and 503 cycles since its last shop visit, which occurred during June and July 2014 at GE Aviation's facility in Wales, United Kingdom.
The GE90-85BG11 is a dual-spool rotor, axial-flow, high-bypass turbofan engine that has a single-stage fan; a 3-stage low-pressure compressor driven by a 6-stage low-pressure turbine; an annular combustor; and a 10-stage high-pressure compressor (HPC) driven by a 2-stage high-pressure turbine. The HPC stage 8-10 spool installed on the accident engine comprised two separate forgings that were joined together using an inertia weld process. The forward section of the spool comprised the forward rabbeted flange, the forward seal teeth, and the stage 8 disk. The aft section of the spool comprised the middle and aft seal teeth, the stage 9 and 10 disks, and the rear drive arm. The forward and rear sections were inertia welded just aft of the stage 8 blade circumferential dovetail slot and forward of the middle seal teeth.
According to British Airways and GE maintenance records, the accident engine HPC stage 8-10 spool, part number 1694M80G04, was delivered to British Airways in April 1997 installed in another engine (ESN 900-121). The last piece-part inspection of the HPC occurred in September 2008, at which time the spool had accumulated 47,499 total hours and 7,516 total cycles. GE's Wales maintenance facility performed a fluorescent penetrant inspection (FPI) of the entire spool. The FPI examined critical areas, including disk bores, bolt holes, dovetail slots, flanges, inertia welds, and interstage seal teeth. As part of the FPI, the stage 8-10 spool underwent a general visual inspection for cracks; if a crack was found (except on the interstage seal teeth), the part had to be replaced. GE also performed an eddy current inspection (ECI) of the inertia welds. The FPI and ECI found no anomalies related to the circumstances of this accident. None of the work performed was related to the stage 8 disk web.
The FPI and ECI satisfied the intent of FAA Airworthiness Directive (AD) 2002-04-11 (effective April 8, 2002), which was referenced in the maintenance records. The AD required inspections for GE90-series engines, at the piece-part level, of selected critical life-limited rotating parts to prevent the failure of engine parts, which could result in an uncontained engine failure and damage to the airplane. According to the AD, during a piece-part inspection, "the part is considered completely disassembled when accomplished in accordance with the disassembly instructions in the manufacturer's engine manual." The AD also stated that a piece-part inspection occurs when "the part has accumulated more than 100 cycles in service since the last piece-part opportunity inspection, provided that the part was not damaged or related to the cause for its removal from the engine."
Afterward, the HPC stage 8-10 spool was installed in ESN 900-294 in March 2009, and ESN 900-294 was installed in another British Airways airplane (G-VIIK) in July 2009. ESN 900-294 was removed from G-VIIK in June 2014 and was shipped to GE's Wales maintenance facility. During the shop visit, the HPC was not disassembled, so the stage 8-10 spool was not exposed. The HPC assembly was reinstalled in ESN 900-294, and the engine was installed on the accident airplane (G-VIIO) in January 2015.
At the time of the accident, the HPC stage 8-10 spool had accumulated 74,170 total hours, 11,459 total cycles, 26,671 hours since the last piece-part inspection, and 3,943 cycles since the last piece-part inspection. According to the GE90 engine manual, the life limit (also referred to as the low-cycle fatigue life) for the HPC stage 8-10 spool with the same part number as the accident spool was 16,600 cycles, which was based on the area of the spool with the least amount of fatigue life (the stage 8 disk-to-forward rabbeted flange transition radius).
Postaccident Engine Observations
After the accident, airport personnel walked along runway 7L and the grassy areas on both sides of the runway to recover any engine and/or airplane debris. One piece of metallic debris was found on the right runway edge line near the 1,000-ft threshold marker. No other metallic debris was found until about the 3,000-ft mark, where most of the collected metallic debris was located. The debris included pieces of cowling, HPC stator vane segments, HPC blade dovetails and platforms, and several pieces of the HPC stage 8-10 spool. Between the 3,000-ft mark and the location where the airplane stopped (about the 4,500-ft mark), only soft material, consistent with honeycomb- and cowling-type material, was found. Afterward, a group comprised of GE, Boeing, British Airways, and NTSB investigators walked along the airport search area and recovered (1) two pieces consistent with the HPC stage 8-10 spool and seal teeth at the southeast corner of the taxiway A7 and runway 7L intersection and (2) an HPC stage 8 blade platform at the center of taxiway A7, just north of runway 7R. No parts were recovered during a search off the airport property.
On-scene examination of the left engine revealed that the HPC aft extension case was breached from about the 11:30 to the 5:00 position (58 inches circumferentially), exposing the internal HPC parts. The examination also found that the HPC stage 8-10 spool separated aft of the middle seal teeth between the stage 8 and 9 disks and that the stage 8 disk separated below the circumferential blade slot, as shown in figure 1. Other noteworthy damage included the following:
Figure 1: GE90 engine cross-section with the locations of the HPC stage 8-10 spool separation and stage 8 disk separation.
Disassembly of the engine was performed at GE's facility in Evendale, Ohio. The HPC aft extension case was cut to access the HPC stage 8-10 spool. The HPC stage 8 disk was fully detached from the stage 7 and 9 disks and was fractured about 200° circumferentially at the transition radius of the web to the blade circumferential dovetail slot rim. About 37 inches of the dovetail slot rim remained attached to the stage 8 disk. The impeller tube assembly was fractured and detached from the front side of the stage 8 disk, and the impeller tubes were fractured, splayed open, or mostly intact. Most, but not all, of the stage 8 disk forward rabbeted flange had fractured from the stage 8 disk and remained attached to the stage 7 disk. The rear drive arm of the HPC stage 8-10 spool was fractured and had fully separated near the compressor discharge pressure seal land.
LAS, located about 5 miles south of downtown Las Vegas, had four runways. According to the FAA Airport Facility Directory, runway 7L was 14,512 ft long and 150 ft wide. The directory also indicated that the runway 7L surface, made of asphalt/porous friction course, was in good condition. The available runway length from the runway's intersection with taxiway A8 was 11,850 ft. At the time of the accident, British Airways was using navigational chart information that showed the runway length for LAS in meters instead of feet.
The airplane was equipped with an Allied Signal 6022 solid-state CVR, serial number 9698. The CVR records the last 30 minutes of digital audio from the captain's, first officer's, and observer's audio panels and 120 minutes of digital audio from a mixed crew audio panel and the cockpit area microphone. All of the channels contained excellent-quality audio information except for the mixed crew audio panel, which contained good-quality audio information. The CVR did not sustain any heat or structural damage, and the audio information was extracted normally. A transcript was prepared for the final 8 minutes 24 seconds of the recording. The transcript, which begins at 1607:12 and ends at 1615:36, includes the events surrounding the engine failure and the evacuation.
The airplane was equipped with an Allied Signal solid-state FDR, serial number 2556. The recorder was in good condition, and the data were extracted normally. About 27 hours of operational data were retained on the recording medium, including about 20 minutes of data from the accident flight, from 1556:00 to 1615:20 (right engine start to left engine shutdown).
The airplane was also equipped with a Penny and Giles quick access recorder (QAR), serial number 855003-001. The QAR is a stand-alone data recording system (independent of the FDR) that is designed to be used and modified by an airplane operator as a part of its maintenance and trend monitoring programs. The QAR recorded many of the same parameters that the FDR recorded, although some of those parameters were recorded at a different sampling rate. The QAR also recorded some parameters that the FDR did not record, including parameters that allowed the NTSB to determine the left engine's status before the failure and the performance of the airplane during the rejected takeoff. The QAR was in good condition, and the data were extracted normally. The QAR contained data from the airplane's previous flight and about 20 minutes of data from the accident flight.
Thermal damage on the exterior of the airplane was concentrated along its midsection, from the left engine to the right side of the fuselage. On the left engine, the cowling was thermally damaged from the 4:00 to 12:00 positions (as viewed from the front of the engine). The thermal damage between the 6:00 and 12:00 positions (the inboard side of the left engine, as shown in figure 2) caused the composite cowling to delaminate and the aluminum leading edge of the cowling to partially melt along the 7:00 to 8:00 positions. The interior of the left engine had soot on some surfaces but no significant thermal degradation to the components.
Figure 2. Inboard side of left engine
The left wing sustained thermal damage in the area between the left engine and the fuselage. No evidence indicated engine debris impacting or penetrating the left wing structure. The top and bottom wing surfaces that were outboard of the strut did not exhibit any damage from the fire.
The left-side fuselage skin exhibited thermal damage (missing and charred paint) from just aft of the 2L door to just past the wing leading edge, and the center of this thermally damaged area exhibited buckling and cracks in the skin, the longest of which was about 12 inches. The cracks in the skin coincided with the area of most severe thermal damage to the wall panels in the interior of the airplane. There were 13 thermally crazed windows on the fuselage that extended from the 2L door to about mid-span of the wing, as shown in figure 3.
Figure 3. Thermally damaged fuselage skin and thermally crazed windows
The wing-to-body fairings on the left side of the airplane exhibited widespread delamination and blistering. The skin on the composite fairing at the wing/fuselage interface was completely delaminated, and the skin aft of the interface for the underwing and overwing fairings was blistered. The composite panels near the wing-to-body junction were thermally damaged and delaminated. The wing-to-body fairing panels on the right side of the airplane also sustained thermal damage and exhibited delamination but to a lesser degree than that on the left side.
Soot appeared on the right-side fuselage above the wing-to-body fairing, as shown in figure 4. Buckling that created a tactile waviness to the aluminum skin was found in the area. Two of the windows above this area exhibited thermal crazing.
Figure 4. Soot and thermal damage to the right-side fuselage
Thermal damage to the interior cabin was confined to the wall panels at the location of seat 11A, as shown in figure 5. The thermal damage consisted of blistering and charring on the wall panels; no soot was observed on any adjacent surfaces. The damage was consistent with thermal decomposition and charring and not flaming combustion on the inboard surfaces of the damaged panels.
Figure 5. Cabin interior at seat row 11
The cargo compartment and cargo liners showed no evidence of soot or thermal damage. The cargo liners were opened in the area corresponding to the external fire damage. Examination of this area found insulation that was discolored or charred and film that was melted, was burned, or had shrunk.
As previously stated, the main engine fuel feed line was found detached from the engine. Each engine fuel feed line is equipped with a rear spar-mounted shutoff valve, also referred to as the spar valve, to terminate fuel flow to an engine at normal engine shutdown or during an emergency engine shutdown. The left main spar valve's position indicator (on the rear spar of the wing) showed that the spar valve was in the closed position, which was consistent with the left fuel control switch in its cutoff position. According to FDR data, 27.9 seconds elapsed between the start of the engine failure and the time of the spar valve closure. A Boeing analysis found that about 97 gallons of fuel would have spilled onto the runway during this time. There was no evidence of fuel leaking before the engine uncontainment.
The accident airplane was configured with two aisles and 283 passenger seats. The airplane had eight floor-level door exits: four doors (1L, 2L, 3L, and 4L) on the left side of the airplane and four doors (1R, 2R, 3R, and 4R) on the right side of the airplane. Each door was equipped with an evacuation slide/raft.
According to the cabin crewmembers' written statements and a review of the cabin crew's recorded accident debriefing (provided by the United Kingdom's Air Accidents Investigation Branch), the following activity occurred in the cabin after the engine failure:
Flight attendants (F/A) 1 and 9 were located at the 1L aft- and forward-facing jumpseats, respectively, and F/A 5 was located at the 1R aft-facing jumpseat. F/A 1 (the cabin manager) saw nothing unusual in the cabin or outside the 1L door after the airplane came to a stop. She reported that, when the relief pilot entered the cabin to assess the situation, he had difficulty moving through the left aisle because some passengers were out of their seats. She made a PA announcement to instruct passengers to remain seated. F/A 5 reported that multiple passengers were standing in the back of the cabin despite the flight crew's announcement to remain seated. She noted thick, black smoke outside the 1R door when the relief pilot entered the cabin.
Following the evacuation command from the captain, F/As 1 and 9 reported that they assessed the conditions outside the 1L door and decided that it was safe to open. F/A 1 stated that the door opened easily. She used the commands "wait, wait, slide inflating" followed by "unfasten seatbelts, come this way." After five passengers had evacuated through the 1L door, F/A 9 noted flames on the runway, so both flight attendants immediately began redirecting passengers to the 1R door. At the 1R door, F/A 5 commanded "unfasten your seatbelt and come this way" while assessing the outside conditions. Although she saw thick black smoke outside, she knew that passengers near the 2R door were being redirected to the 1R door, and passengers were shouting loudly for her to open the door. She asked F/A 1 whether there was a hazard on the left side of the airplane, and F/A 1 confirmed that a hazard existed. F/A 5 reassessed the 1R door and did not see any flames, so she opened the door and pulled the slide/raft's manual inflation handle. She reported being "pushed" by a passenger and thus had to "quickly" grab the assist handle by the door and block it because the slide/raft was still inflating. Once the slide/raft was fully inflated, she began evacuating passengers. F/A 5 recalled seeing passengers with carry-on bags when she was outside the airplane but did not recall seeing passengers evacuating with bags at her assigned exit.
F/A 2 was located at the 2L aft-facing jumpseat, and F/A 6 was located at the 2R forward-facing jumpseat. F/A 2 heard the flight crew's announcement to remain seated and await further instructions, but she immediately saw smoke billowing from the left engine. Passengers began to shout, "we need to get off," but she noted a second PA announcement to remain seated. She then saw flames coming from the left engine and picked up the interphone to notify the flight crew; at that point, the relief pilot arrived at the 2L door. She notified him of visible fire and stated that he looked out the window and said, "we need to evacuate." After the relief pilot returned to the cockpit, passengers continued to shout at her to open the exit. F/A 2 blocked the 2L door and redirected passengers to the 1R door. F/A 6 heard the flight crew's announcement to remain seated and await further instructions but noted that some passengers in her area were out of their seats. She could not see anything outside of the 2R door because of the smoke. F/A 6 blocked the 2R door and redirected passengers to the 1R door.
F/A 3 was located at the 3L aft-facing jumpseat, F/A 10 was located at the center jumpseat (near the 3L door), and F/A 7 was located at the 3R aft-facing jumpseat. F/A 3 saw no hazards outside when the airplane came to a stop. She reported that passengers immediately got out of their seats, and, in response to the flight crew's announcement, she stood up to instruct passengers to remain seated. She then looked out the 3L door again and saw "orange flames and thick black smoke." F/A 10 told her that he saw flames as well.
F/A 3 was about to initiate an evacuation via a button at her communications panel when the flight crew commanded the evacuation over the PA system. She blocked the 3L door and redirected passengers to the 3R, 4L, and 4R doors. F/A 10 knew that the 3L door should not be opened, so he redirected passengers to the back of the airplane. He saw one passenger stumble and fall in the aisle and reported that other passengers "walked over her." He helped the passenger get up and told her to continue to the exit, which she did. He reported that passengers were moving "fairly quickly." F/A 7 stated that she initially saw "fumes" outside the 3R door but no hazards and opened the door. She stated that the door was "a bit hard" to open and that a passenger had assisted her. She reported that the slide deployed and inflated correctly but was not in a usable attitude, so she redirected passengers to the 4L door.
F/A 4 (the purser) was located at the 4L forward-facing jumpseat, and F/A 8 was located at the 4R forward-facing jumpseat. F/A 4 saw debris "flying past" the window as the airplane decelerated. Once the airplane stopped, he saw a "tiny strip of fire on the runway." He reported that passengers immediately got up out of their seats (before the flight crew's PA announcement to remain seated), so he got out of his jumpseat, walked four or five rows into the cabin, and instructed the passengers to sit down. F/A 8 saw a "small amount" of smoke, which dissipated quickly.
F/A 4 reported that the 4L door opened easily and that, after he grabbed the assist handle and pulled the manual slide inflation handle, passengers were directly behind him. He commanded "wait, wait, slide inflating" and began evacuating passengers once the slide was inflated. He reported that passengers "just kept coming and coming." He recalled that one passenger stopped to take off her shoes and was pushed down the slide. He further recalled that passengers did not have much baggage with them while evacuating from his assigned exit. F/A 8 opened the 4R door and determined that the slide, once deployed and inflated, was not in a usable attitude because it was "twisted in stature, almost being whipped around by the wind, and was a high distance off the ground." She blocked the exit and redirected passengers to the 4L door.
Multiple videos of the evacuation were obtained by the NTSB. One video, which was taken by an individual in the airport terminal, began at 1614:16, before the start of the evacuation. Another video, which was taken by a passenger from a Southwest Airlines airplane that was holding on a taxiway, began at 1614:42, after the start of the evacuation. The videos were synchronized using a common event recorded by both cameras: the initial application of agent by the first-arriving ARFF vehicle. The events observed on the videos were then placed on a common timeline with CVR and FDR events by correlating the sounds within the cabin of the initiation of the evacuation and the observations of the airplane doors opening and the slides deploying and inflating. Significant events surrounding the evacuation are as follows: (Times based on the video observations are approximations.)
The 1R and 4L doors were the only doors used during the entire evacuation. As previously stated, five passengers evacuated from the 1L door, but then the door was blocked due to flames on the runway; the 2L, 2R, and 3L doors were unusable due to fire; and the 3R and 4R doors were unusable because the slides, once deployed, were in an unusual attitude. The three flight crewmembers and five of the flight attendants reported that they evacuated through the 1R door, and the other five flight attendants reported that they evacuated through the 4L door.
LAS had one fire station that housed three Clark County Fire Department ARFF vehicles. The station was located about 0.4 mile from the accident site (runway 7L near the intersection with taxiway A6).
Video evidence showed that the first ARFF vehicle arrived on scene at 1615:18, about 1 minute 59 seconds after the captain requested fire services (1613:19). This vehicle was positioned near the left wing and immediately began discharging extinguishing agent from the bumper and roof turrets onto the fire. A second ARFF vehicle arrived on scene 34 seconds later (1615:52) and was initially positioned to the right of the airplane's nose "to protect passengers exiting from both sides of the aircraft." The vehicle discharged extinguishing agent from its high-reach extendable turret, which initially reached only the area near the 1R door and slide/raft.
A third ARFF vehicle arrived near the 1L slide/raft and the airplane's nose at 1616:05 and assisted in extinguishing the fire by 1617:44, about 2 minutes 26 seconds after the first vehicle arrived on scene.
British Airways reported that 19 passengers sustained minor injuries and 1 flight attendant received a serious injury during the evacuation. F/A 1 reported that the 1R slide was wet and slippery from the extinguishing agent. She fell upon reaching the end of the slide/raft and fractured her left radius (forearm). She also suffered a compression fracture of the first lumbar vertebra in her back.
The NTSB Materials Laboratory in Washington, DC, examined engine fragments that were recovered on the runway or removed from the engine during the postaccident examination. Most of these fragments originated from the forward seal teeth, the stage 8 disk rim, or the middle seal teeth. Additional engine fragments originated from the forward flange. About 4 ft of the disk rim (of a total rim length of about 7 ft) was identified.
The fracture surfaces of the fragments were examined to determine where the engine failure initiated. The web of one of the stage 8 disk rim fragments had a feature, located about 0.90 inch inboard of the blade slot bottom at the thinnest (about 0.12 inch) part of the web, that indicated the presence of a tinted/discolored flat fracture region. This region was about 0.63 inch wide in the circumferential direction and extended from the aft face of the web to within 0.004 inch of the forward face of the web. The orientation of the fracture region was consistent with a crack initiating on the aft face of the web, and the tinted appearance was consistent with high-temperature oxidation of the fracture surface. Figure 6 shows the underside of the disk rim and the location of the crack. The flat fracture region transitioned to a 45°-inclined tinted/discolored region that was consistent with cyclic tensile loading. The region with cyclic tensile loading extended circumferentially from both sides of the flat fracture region over a total length of about 1.7 inches, after which the appearance of the fracture surface was consistent with tensile overstress.
Figure 6. Location of crack in HPC stage 8 disk web
Examination of the flat fracture region using a scanning electron microscope (SEM) showed that the region had an intergranular appearance near the crack initiation site (the aft face of the web) and a transgranular appearance farther away from the initiation site. (The disk material, made from a nickel-based superalloy, had an internal structure that consisted of microscopic crystals called grains. The planar intersection of two grains is called a grain boundary. Cracks that follow grain boundaries are intergranular and cracks that cut across grains are transgranular.) The transgranular regions exhibited striations (linear features on a fatigue fracture surface that indicate how far a crack advanced with each stress cycle) consistent with low-cycle fatigue crack growth. (In airplane engines, low-cycle fatigue is associated with one striation per flight cycle.) Figure 7 shows an image of the underside of the HPC stage 8 disk rim at the location shown in figure 6.
Figure 7. Optical image of underside of HPC stage 8 disk rim
SEM images from the aft wall to the forward wall of the web were used to measure striation spacing as the crack progressed in low-cycle fatigue. Striation density measurement data were used to calculate the estimated number of flight cycles that elapsed in the low-cycle fatigue region beyond the point of detectable crack initiation, which is the size of a crack that can be detected using a nondestructive inspection method. FAA Advisory Circular 33.70-1, "Guidance Material for Aircraft Engine Life-Limited Parts Requirements," stated that this crack size has a depth of 0.015 inch and a surface length of 0.030 inch. The NTSB assumed that one striation correlated with one flight cycle and that the forces during takeoff, when the stresses on the web would be at their highest, were advancing the crack. The calculation showed that the crack progressed by low-cycle fatigue for about 5,400 cycles beyond the point of detectable crack initiation. (This cycle count did not include those cycles that accumulated in the transgranular region up to the 0.015-inch crack depth.)
After the examination at the NTSB's Materials Laboratory, the HPC stage 8 fragments were brought to GE's facility in Evendale, Ohio, where the rest of the stage 8 disk was removed during the engine disassembly, for further evaluation. The NTSB oversaw and participated in this examination. The entire HPC stage 8 disk rim and web appeared to be accounted for when all the recovered disk parts were assembled.
The results of the examination at GE were consistent with the NTSB's findings. Metallurgical examination determined that the stage 8-10 spool fracture resulted from a crack that initiated in the web aft face of the stage 8 disk. SEM examination of the stage 8 disk found that the crack initially propagated with intergranular features with local variation, which was consistent with hold-time, high alternating stress, low-cycle fatigue (also referred to as sustained-peak low-cycle fatigue). Sustained-peak low-cycle fatigue is an environmentally assisted failure mode in which a cyclic stress profile with an extended hold time, combined with an oxidizing atmosphere and elevated temperature, leads to oxidation of grain boundaries, which become brittle and eventually crack along an intergranular path. The examination also found that the crack transitioned to transgranular, striated areas that decreased in density as the crack progressed through the web thickness, which was consistent with low-cycle fatigue.
GE's striation density measurements though the transgranular region of the accident stage 8 disk determined that the low-cycle fatigue cycle count was between about 5,000 and 5,700 cycles. As previously stated, at the time of the accident, the HPC stage 8-10 spool had accumulated 11,459 cycles since new and 3,943 cycles since last inspection. The last inspection did not require the aft face of the stage 8 disk web to be inspected.
It was determined that (1) no microstructural anomalies were found near the fracture origin; (2) the grain structure and material hardness, composition, and geometry conformed with alloy specifications, and no "detrimental species" were found at the grain boundaries that could predispose the material to crack in the intergranular region; and (3) multiple secondary cracks existed within 0.016 inch radially of the fatigue region, but no microstructural anomalies were found at the secondary crack locations. It was also noted that the shot peening appearance on the forward web face was more pronounced than on the aft web face toward the disk rim. (Shot peening is a process used to create a surface layer of residual compressive stress that is intended to delay the onset of fatigue crack initiation.) Residual stress measurements taken on both the forward and aft web faces of the accident disk and two comparison disks (which were of a "similar vintage" and had similar peening features) found that the forward web faces exhibited a residual stress profile consistent with a well-peened surface, whereas the aft web faces exhibited a profile consistent with little to no peening.
ORGANIZATIONAL AND MANAGEMENT INFORMATION
The British Airways B777 FCOM QRH provided the following guidance on non-normal checklist operation:
Rejected Takeoff Procedures
The rejected takeoff procedure, dated December 2014, was a non-normal maneuver. The British Airways B777 FCOM QRH stated that "the decision to reject the takeoff must be made in time to start the maneuver by V1. The Captain shall call 'STOP' if the takeoff is to be rejected." The QRH also stated that, if "STOP" is called, the pilot flying should "immediately start the rejected takeoff maneuver" and that the captain or the first officer was required to call "STOP" if a fire, a fire warning, or an engine failure occurred. (The first officer was authorized to call "STOP" for these emergencies.)
The British Airways Operations Manual A, section 8.28.11.d, "Emergencies on the Runway," dated May 2015, stated the following:
After a rejected take-off or an emergency landing the aircraft should normally be brought to a halt on the runway and the emergency evaluated quickly before taxying clear. Stopping the aircraft expeditiously is of prime importance. If required, an evacuation must be initiated promptly. If not required, the Commander will make the announcement:
'Passengers and Crew remain seated and await further instructions.'
Engine Fire Checklist
The engine fire checklist in the British Airways B777 FCOM QRH, dated June 2012, contained the following five memory items for a fire detected in an engine:
Engine fire switch
(affected side)……………...…Rotate to the stop and hold for 1 second
If after 30 seconds, the FIRE ENG message stays shown:
Engine fire switch
(affected side)……………Rotate to the other stop and hold for 1 second
The engine fire checklists did not differentiate between an engine fire in flight or an engine fire while the airplane was on the ground. The remaining six steps of the engine fire checklist applied only to airplanes that were in flight.
The British Airways B777 FCOM QRH, dated June 2012, stated the following regarding an emergency evacuation: "The Captain will decide if an evacuation is necessary. Whenever an evacuation is required, the Evacuation Checklist must be used. The aircraft will be brought to a halt and the parking brake will be set." The QRH also stated, "all other checklists will be stopped. The Evacuation Checklist is independent of other non-normal checklists."
The evacuation checklist procedure, dated June 2013, was provided on the back cover of the QRH. The checklist detailed the responsibilities of each pilot if an evacuation was needed, which were as follows:
1. PARKING BRAKE.……………………………….……………………...…..Set
2. FUEL CONTROL SWITCHES (both).……………………………......CUTOFF
3. PA………………………………………………………. "This is an Emergency.
Evacuate, Evacuate (Hazard at ___)"
4. EVAC COMMAND switch……………………………….………….………ON
5. Notify ATC/Ground crew of evacuation.
1. OUTFLOW VALVE switches (both).…………………………………...…MAN
2. OUTFLOW VALVE MANUAL
switches (both) …………………………………………………...Hold in OPEN
until the outflow
valve indications show fully
open to depressurize the airplane
3. Engine fire switches (both)………….…………………………………..…PULL
Warning! Do not pull the ENGINE FIRE switches before the FUEL CONTROL switches are in the CUTOFF position.
4. APU fire switch…………………….……………………….…Override and Pull
5. If an engine or APU fire warning occurs:
Related fire switch………………………….……………Rotate to the stop
And hold for 1 second
Flight Crew Training
The British Airways 777/787 Flight Crew Training Manual stated the following about the rejected takeoff maneuver:
The RTO [rejected takeoff] maneuver is initiated during the takeoff roll to expeditiously stop the airplane on the runway. The PM [pilot monitoring] should closely monitor essential instruments during the takeoff roll and immediately announce abnormalities, such as 'ENGINE FIRE', 'ENGINE FAILURE', or any adverse condition significantly affecting safety of flight. The decision to reject the takeoff must be made before V1 speed.
Note: If the decision is made to reject the takeoff, the flight crew should accomplish the rejected takeoff non-normal maneuver as described in the Maneuvers Chapter of the QRH.
The training manual stated the following regarding evacuations: "If an evacuation is planned and time permits, a thorough briefing and preparation of the crew and passengers improves the chances of a successful evacuation. Flight deck preparations should include a review of pertinent checklists and any other actions to be accomplished." The manual also stated the following:
Notify cabin crew of possible adverse conditions at the affected exits. The availability of various exits may differ for each situation. Crewmembers must make the decision as to which exits are usable for the circumstances.
For unplanned evacuations, the captain needs to analyze the situation carefully before initiating an evacuation order. Quick actions in a calm and methodical manner improve the chances of a successful evacuation.
Flight Attendant Evacuation Procedures and Training
Excerpts from British Airways instructor notes for initial flight attendant training stated the following:
Once the aircraft has come to a halt the Captain will assess the situation. If an immediate evacuation is not required, the Captain will make the announcement
'Passengers and crew remain seated and await further instructions.'
This call is intended to signal to the cabin that the situation has been/is being assessed and that the Flight Crew believes that there is no immediate threat to the aircraft.
The note excerpts also stated that the captain would order an evacuation by making the PA announcement "This is an Emergency, Evacuate, Evacuate," which would be followed by the evacuation alarm. The note excerpts further indicated that the captain's PA announcement might also warn about hazards outside the airplane and that "the Cabin Crew must still check the area outside."
Section 3.5.2 of the British Airways Operating Manual – Part B, "Initial Evacuation Procedures," warned flight attendants to "only open exits not affected by fire or other hazard." The section also instructed flight attendants, once an airplane has come to a complete stop and an evacuation announcement has been made, to state "unfasten your seat belt – come this way"; check that there is no hazard or fire outside an assigned door and that the door is prepared for emergency use; open the door and operate the manual slide inflation device; state "wait, wait slide inflating"; and direct passengers through the door.
Excerpts from the 2015/2016 British Airways instructor notes supporting recurrent flight attendant training stated that, if an exit was unusable, flight attendants were expected to "block the door and redirect passengers to the nearest usable exit" and "remain aware of evacuation progress in adjacent cabin areas and at other usable exits and direct (or redirect) customers as necessary to maintain equal flow to each exit." The note excerpts also indicated that the circumstances under which flight attendants should start redirecting passengers included fire and external hazards.
Figure 8 brings together CVR transcript information (in blue), FDR data (in red), and video evidence (in green) from this accident into a detailed timeline of events that occurred after the left engine failure. The times for each event have been rounded to the closest second. The figure shows that the captain commanded the evacuation about 1 minute 16 seconds after the airplane came to a stop; the evacuation ended about 3 minutes 48 seconds after the airplane came to a stop and about 2 minutes 32 seconds after the evacuation was commanded; and the fire was extinguished about 4 minutes 37 seconds after the airplane came to a stop and about 3 minutes 21 seconds after the evacuation was commanded.
Figure 8: Accident timeline
GE Postaccident Actions
According to the GE engine procedures that were in place at the time of the accident, an FPI of the entire HPC stage 8-10 spool was performed at the piece-part level, but there were no procedures for inspecting the disk web. Also, no specific spool inspections occurred at the rotor level (blades still installed), module level (core module separated from the fan hub module and the low-pressure turbine module), and engine level. After the accident, GE developed and incorporated into the GE90 engine manual comprehensive nondestructive inspections for the HPC stage 8-10 spool web at the piece-part level as well as the rotor, module, and engine levels.
The published life limit for the HPC stage 8-10 spool was 16,600 cycles, with the limiting feature being the stage 8 disk-to-forward rabbeted flange transition radius. GE performed stress and lifing analysis on the event spool using standard LCF curves for minimum/average material thickness and properties at the engine's rating; this included all the Material Review Board dimensions ('oil canning'), British Airways specific operational mission (taxing time, takeoff thrust rating, shutdown, core speeds and temperatures, ambient takeoff temperature, etc.), and shutdown stresses, etc. Based on the analysis, the fracture location on the event spool had a calculated LCF life about 1.5 times greater than the event spool limiting feature at the minimum material properties and about 9 times at the average material properties. Based on the striation count analysis that the NTSB and GE performed, the crack initiated at roughly 6,000 CSN which is 5 times less than the predicted value for the failure location under the worst conditions. Further analysis could not close the gap between the predicted LCF crack initiation and the estimated actual event crack initiation.
GE issued three service bulletins (SB), two of which resulted in FAA ADs, to inspect all GE90 HPC stage 8-10 spools with same part number as the accident spool (1694M80G04) as well as spools with different part numbers (1844M90G01 and 1844M90G02). On November 24, 2015, GE issued SB 72-1145, "One-Time On-Wing Ultrasonic Inspection of the Stage 8 Web of the Stage 8-10 Spool." The SB recommended that operators perform this inspection on affected HPC stage 8-10 spools that had the same part number as the accident spool and needed to be inspected as soon as possible (based on their manufacturing history, cycles accumulated, and other data that were available at the time). On January 12, 2016, the FAA issued AD 2015-27-01 based on the information in SB 72-1145. The AD required operators to perform an ECI or ultrasonic inspection of affected HPC stage 8-10 spools according to the timeframe listed in the SB and remove from service those parts that failed the inspection.
On February 12, 2016, GE issued SB 72-1146, which indicated that a one-time on-wing ultrasonic inspection of the stage 8 web needed to be performed on all HPC stage 8-10 spools with the same part number as the accident spool that were not covered by SB 72-1145. On June 10, 2016, GE superseded SB 72-1146 with SB 72-1151, which expanded the inspection population to include HPC stage 8-10 spools with a different part number than the accident spool. SB 72-1151 also recommended a repetitive inspection within every 500 cycles until an ECI was performed instead of a one-time on-wing ultrasonic inspection. On June 24, 2016, the FAA issued AD 2016-13-05, which required an ultrasonic inspection or ECI of the stage 8 aft web upper face between 8,000 and 9,000 cycles since new or within 500 cycles in service after the effective date of the AD (July 29, 2016), whichever occurred later.
In addition, due to the shot peening irregularity found on the event part (and the examination of two similar spools that found the same irregularity), GE issued SB 72-1149, "HPC Stage 8-10 Spool Web and Spacer Arm Shotpeen Repair," on March 29, 2016, to provide a one-time shot peen repair for all GE90 stage 8-10 spools to address possible shot peening inconsistencies. (According to GE, this repair was not incorporated into the engine manual because the repair was to be conducted one time only.) Also, GE modified the print drawing for HPC stage 8-10 spools in production to include a check of the shot peen intensity in the outer web areas. This change became effective in February 2016.
Related Safety Recommendations
On February 6, 2018, the NTSB issued Safety Recommendations A-18-6 and -10 to the FAA and Boeing, respectively, regarding the need for separate checklists for engine fires on the ground and during flight. These recommendations resulted from the NTSB's investigation of the October 28, 2016, accident involving American Airlines flight 383, a Boeing 767-323, which experienced an uncontained right engine failure and subsequent fire at Chicago O'Hare International Airport, Chicago, Illinois (DCA17FA021). The NTSB recommended that the FAA do the following: "when approving the operating procedures of a 14 Code of Federal Regulations Part 121 air carrier, require operators to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation" (A-18-6). The NTSB also recommended that Boeing "work with operators as required to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation" (A-18-10).
History of Flight
Uncontained engine failure (Defining event)
Other Aircraft Rating(s):
Second Pilot Present:
Class 1 With Waivers/Limitations
Last FAA Medical Exam:
Last Flight Review or Equivalent:
30000 hours (Total, all aircraft), 12000 hours (Total, this make and model), 15000 hours (Pilot In Command, all aircraft), 220 hours (Last 90 days, all aircraft), 80 hours (Last 30 days, all aircraft)
Other Aircraft Rating(s):
Second Pilot Present:
Class 1 Without Waivers/Limitations
Last FAA Medical Exam:
Last Flight Review or Equivalent:
6400 hours (Total, all aircraft), 3100 hours (Total, this make and model), 257 hours (Last 90 days, all aircraft), 92 hours (Last 30 days, all aircraft), 0 hours (Last 24 hours, all aircraft)
Aircraft and Owner/Operator Information
BOEING 777-236 236
Year of Manufacture:
Landing Gear Type:
Retractable - Tricycle
Date/Type of Last Inspection:
Certified Max Gross Wt.:
Time Since Last Inspection:
2 Turbo Fan
Airframe Total Time:
85442 Hours at time of accident
C126 installed, not activated
BRITISH AIRWAYS PLC
BRITISH AIRWAYS PLC
Operating Certificate(s) Held:
Foreign Air Carrier (129)
Meteorological Information and Flight Plan
Conditions at Accident Site:
Condition of Light:
Observation Facility, Elevation:
Distance from Accident Site:
Direction from Accident Site:
Lowest Cloud Condition:
6 knots /
Turbulence Type Forecast/Actual:
Turbulence Severity Forecast/Actual:
39°C / 5°C
Precipitation and Obscuration:
Las Vegas, NV (KLAS)
Type of Flight Plan Filed:
London, Gatwick, FN (EGKK)
Type of Clearance:
Type of Airspace:
Las Vegas, McCarran Internatio (KLAS)
Runway Surface Type:
Runway Surface Condition:
14512 ft / 150 ft
Wreckage and Impact Information
1 Serious, 12 None
19 Minor, 138 None
1 Serious, 19 Minor, 150 None
36.083056, -115.151389 (est)
Investigator In Charge (IIC):
Effie Lorenda Ward
Additional Participating Persons:
Robert Hendrickson; FAA
Brett Martelle; Boeing
Les McVey; GE
Andrew Robinson; AAIB
The NTSB traveled to the scene of this accident.