Airbus A330 323 accident near Atlanta, Georgia, April 18, 2018

The NTSB's narrative final · quoted from the NTSB record

The Delta Air Lines flight had departed from Hartsfield-Jackson Atlanta International Airport (ATL), Atlanta, Georgia. When the airplane was at an altitude of 700 ft, the flight crew received continuous warnings of a right engine fire. According to the crew’s statements, the captain transferred control of the airplane to the first officer and performed the required electronic centralized aircraft monitor (ECAM) procedures, including discharging both fire extinguishing bottles. However, the fire reignited before landing, and aircraft rescue and firefighting crews needed to extinguish the fire. Because the fire was not extinguished or re-ignited quickly (uncontrolled), the airplane sustained substantial damage to the right pylon. However, the fire remained contained in the engine compartment between the engine, nacelle and pylon components and there was no fire propagation to the aircraft. The right engine throttle was moved to the idle position 51 seconds after the fire warning first appeared, and the right engine was shut down 1 minute 36 seconds later. According to flight crewmember statements, they followed the required ECAM procedures and associated checklists and ran the landing performance calculations in a thorough manner. The airplane landed at ATL about 26 minutes after takeoff. Postaccident simulator testing revealed that a crew could land the airplane about 12 minutes after takeoff. One reason to explain the airplane’s additional time in the air is that the captain might have questioned the validity of the initial fire warning; his postaccident statement mentioned that the initial fire warning disappeared for several seconds and then reappeared. DFDR data showed that the alert transiently disappeared for about 1 second. Unfortunately, the Cockpit Voice Recorder (CVR) was overwritten after the event and any discussion between crew members about the engine fire was unrecoverable. In addition, about 10 minutes into the flight, a FIRE DET 2 ECAM alert was triggered, but was not directly displayed to the crew at that time since it was a lower priority than already displayed messages. The alert was triggered by thermal damage to both fire detection loops that were exposed to a fire longer than the 5-minute fire resistant certification requirement. This fault resulted in the ECAM fire alert and associated local fire indications being cancelled; simultaneously, the LAND ASAP message changed from red to amber on the ECAM display, despite an ongoing fire. This might have lessened the crew’s concern about landing immediately. Also, the flight crew might have thought that the fire had been extinguished, especially since the cabin crew could not confirm if the engine was still on fire. At the time of the fire detection fault, the airplane was being flown on an extended downwind. A few minutes later, the flight crew made a 270° left turn to enter the right base leg, adding about 4 minutes to the flight likely so that the crew could run the less urgent ECAM items. However, Airbus’ ECAM system logic did not account for an engine fire detection fault that would be triggered while the fire warning is already active, resulting in the fire warning being extinguished. DAL (and four other US air carriers) had no simulator training scenarios involving engine fires in which the simulated fire continued to burn after the halon bottles were discharged and the fire indications deactivated. Training scenarios simulated a fire that was either extinguished by the halon bottles or continued with fire warning messages remaining illuminated or audible. Although the fire warning remained active after the halon was discharged during this accident, it did cancel out when the fire loops were damaged. Thus, because the accident flight crew had not been trained on an in-flight engine fire event in which the cockpit fire indications cease after a significant time but a fire remains, may have been another reason why the flight crew believed the fire had been extinguished. When the halon bottles were discharged, the active fire should have been extinguished, but if all the leaked combustible fluids had not been consumed or drained before bottle discharge and fuel and hydraulic fluid continued to enter the engine compartment, the fire could have reignited after the halon dissipated. According to flight data recorder data, when the right engine was shut down, the engine parameters decreased at a nominal rate. About 9 minutes after the shutdown, the right engine exhaust gas temperature (EGT) spiked from about 200ºC (392ºF) to about 600ºC (1,112ºF). The spike in the data occurred when the EGT signal came back online and the EGT thermocouples registered the heat transfer from the engine fire to the engine case. Even though the right engine was shut down, its EGT was higher than the operating left engine’s EGT for about 8.5 minutes, at which time the right engine EGT began to decrease. This evidence indicated that the fire burned for a prolonged period after both fire bottles were discharged and the fire shutoff valves (FSOV) were closed. In the days preceding the accident, the airplane had undergone maintenance twice to address reported fuel leaks. The first fuel leak was observed from the FM-13 hose interface at the pylon panel. The FM-13 hose and upper and lower seals were replaced with new parts to address the second fuel leak. During the on-scene investigation, the pylon fuel connections were examined, and the interior of the pylon underwent a borescope examination. No fluid leaks were observed. However, the lower flange of the rigid fuel pipe appeared deformed. The rigid fuel pipe flange deformation might have affected the seal at the interface of the rigid fuel pipe flange, the seal, and the FM-13 hose flange. An improper seal fitting may have allowed fuel to leak from the FM-13 hose to the rigid fuel pipe interface, enabling fuel to run down the right side of the engine and pool at the bottom of the nacelle. The diffuser, turbine, and exhaust cases temperatures were hot enough to ignite the fuel. At ignition, an over-pressurization occurred, which opened all four pressure relief doors on the thrust reverser inner fixed structure. Because the fire was not due to an internal engine failure, the key engine parameters would have remained nominal. The FM-13 hose fire sleeve that was removed the day before the accident flight was reported to be wet and shiny, indicating that the fire sleeve had been saturated with fuel. If the replacement FM-13 hose fire sleeve had been saturated with fuel, the hose would have been a concentrated fuel source. The FM-13 hose is rated as fireproof, indicating that it can withstand 15 minutes of fire exposure, but the presence of fuel both underneath and on the fire sleeve would likely have reduced the hose liner protection and accelerated the failure. After engine shutdown and the closure of the low-pressure shutoff valve in the pylon and the high-pressure shutoff valve at the engine fuel pump, the residual fuel in the FM-13 hose and other fuel/hydraulic hoses would have leaked into the engine compartment when the hoses were thermally breached. Engine fuel components would have provided an additional fuel source when those parts were thermally damaged. The engine diffuser and turbine case surfaces reach operating temperatures high enough to ignite both fuel and hydraulic fluid, but a flammable fluid leak will not necessarily immediately ignite when it contacts hot cases surfaces. Variables such as undercowl airflow, leak type, and airplane attitude are all factors. The extensive soot and dark discoloration at the 6:00 position and along the right side of the engine core were consistent with a fuel-rich fire. The right side of the engine had substantially more thermal damage and discoloration compared with the left side, and multiple fuel and hydraulic components, hoses, and lines on the right side of the engine were thermally damaged or consumed. The fuel and hydraulic hoses/lines connected to the pylon hydraulic interface panel exhibited thermal damage, and several were thermally severed at the panel connection. A substantial amount of charred material and residue had accumulated in the drip pan located beneath the pylon panel (which directs fluid leaks downward through the 6:00 drain mast and then overboard). The severity of the thermal damage at the pylon panel and the charred debris in the drip panel indicated that there was an intense sustained fire that was likely fed by fuel and/or hydraulic fluid originating from the pylon panel interface. Soot and discoloration patterns on the right side of the engine further support this scenario. The first fault message triggered during the event, came from a component located on the bottom part of the engine, and extensive damage to several components in that area could also suggest a fire initiation around the 6:00 position. The concentrated damage to the hose/line connections at the hydraulic interface panel was consistent with a fire in the drip pan beneath the panel. Debris accumulation, coking, or a blockage at the bottom of the pan might have prevented the drain system from working properly. The plumbing from the bottom of the pan to the 6 o'clock drain mast under the engine was not flow tested for obstructions during the on-scene examination because all debris had been cleaned out the pan during and/or after the boost pump leak check. However, photos of the pylon hydraulic interface panel drip pan immediately after landing at ATL shows it full of debris. Hydraulic fluid is more difficult to ignite than fuel due to a higher ignition temperature and fire-inhibiting properties. The analysis of fault messages related to the low level of hydraulic fluids during the event provided an estimated leak rate and the time at which the leak may have started. Evidence suggested that the yellow hydraulic leak occurred after engine shutdown. Specifically, the yellow hydraulic system low level caution annunciated between 10 minutes 11 seconds and 12 minutes 11 seconds after the fire pushbutton was pressed. This finding indicated that hydraulic fluid loss occurred well after the FSOVs were closed. After landing, both the yellow and green hydraulic reservoirs were low on the hydraulic service panel gauges and on the cockpit hydraulic system display. A failure to shutoff hydraulic fluid from entering the designated engine fire zone following FSOV closure resulted in a fire that continued to burn after both halon bottles had been discharged. The amount of hydraulic fluid was limited to what was contained in the reservoirs. The yellow hydraulic reservoir low level ECAM procedures required the crew to shutdown the yellow hydraulic system electric pump, which the accident crew did, rendering spoilers 4 and 6 inoperable during the final 9.5 minutes to the flight. A review of the A330-300/PW4168 system architecture identified an open yellow hydraulic system in-line case drain check valve as the most probable leak point. However, multiple bench tests showed that the green and yellow hydraulic system FSOVs and check valves functioned according to design. Thus, the most likely reason that the yellow hydraulic system in-line case drain check valve might have allowed hydraulic fluid to enter the designated engine fire zone was a foreign debris obstruction.

The complete narrative as the NTSB published it. The NTSB's docket holds the report as a PDF and any photographs, statements and other documents from the investigation.