There is no doubt that fatal airline accidents, especially those involving maintenance, have decreased significantly over the last two decades.
That’s a good thing for three reasons: (1) Less people are killed; (2) Increased public confidence in aviation maintenance, and (3) the resources that were once tied up in the messy aftermath fatal accidents can now be applied to no-injury events that, but for the grace of God, and the redundancy of our aviation system, could have been catastrophic.
Nowadays, the biggest bang for the investigation buck can be found with deep-dives into the circumstances of no-injury airline incidents in order to cull out lessons learned to prevent potentially deadly crashes.
Case in point: American Airlines flight 1400 — a McDonnell Douglas MD-82 that experienced an in-flight engine fire after takeoff from Lambert-St. Louis International Airport (STL), Missouri, on September 28, 2007. Fortunately, the flight crew conducted a successful emergency landing, and the 2 pilots, 3 flight attendants, and 138 passengers deplaned safely on the runway. No one was hurt, other than the left engine that suffered the fire. I was working at the NTSB at the time but was not involved in this investigation.
Regardless, I was proud to be a part of an agency that would commit investigator resources on an event that did not garner much public attention but was likely chock full of concerns about the operation of a large scheduled airline.
Engine Problems
The crew and passengers of flight 1400 were ready to go at the gate but attempts to start the left engine failed. The pilots called for a mechanic to help. A few minutes later, a mechanic instructed the captain to initiate the manual engine-start sequence by holding the engine-start switch while the maintenance personnel outside manually opened the left engine’s air turbine starter valve (ATSV). The engine started and the flight was on its way. As the airplane climbed through an altitude of about 500 feet above the ground, the cockpit Engine Fire warning bell rang out.
“Fire! Left Engine!” called the first officer, as captured on the cockpit voice recorder (CVR). The captain immediately turned back to STL as the first officer declared an emergency. The airplane began to experience electrical problems resulting in the loss of the captain’s primary flight and navigation displays. Attempts to start the auxiliary power unit (APU) for backup electrical power were not successful. The nose landing gear would not retract. Everything was going to hell in a hand basket (see graphics A-C, above).
The crew abandoned the approach and elected to go around. As flight 1400 flew past the tower, the controller radioed “there is quite a bit of black soot on that engine…the fire was real.” The crew manually lowered the nose gear, lined up again for landing, touched down safely on the runway and came to a stop. Airport firefighters arrived immediately and reported that the engine was still on fire! They put it out quickly and the passengers deplaned safely.
The Investigation
The NTSB did not immediately launch a full go-team. Instead, they “staked down” the damaged airplane by sending a field investigator to St. Louis from one of the NTSB regional offices that I managed. The next day, a “mini go-team” consisting of an investigator-in-charge (IIC) and three specialists in Operations, Powerplants and Maintenance Records arrived in St. Louis.
The wounded MD-82 was equipped with a Pratt & Whitney JT8D engine start system with a pneumatic air turbine starter to convert compressed air into rotational power sufficient to accelerate the engine to start. At the time of the accident, the established inspection interval for the ASTV was inadequate. The system includes an ATSV equipped with an air filter, an engine-start switch, and a pneumatic line (See graphic D page 40). The ATSV was an electrically controlled and pneumatically operated butterfly-type valve. If the electric start does not work, mechanics can utilize a lever arm with a manual override button. The ATSV filter comprises an inner screen consisting of a coarse stainless steel filter and an outer screen consisting of a finer stainless steel mesh (see graphic E). The ATSV filter comprises an inner screen consisting of a coarse stainless steel filter and an outer screen consisting of a finer stainless steel mesh (see graphic F page 40).
The ATSV air filter assembly components were removed from the burnt engine (see graphic G page 41) and examined by NTSB. The filter element was found fractured near the fitting braze joint and much of the filter element material was missing.
The remaining material was found adhered to the inner wall of the filter housing. Examination of the manual override button and ball valve housing revealed that the override button was buckled in an S-shape on the end of the pin closest to the ball valve and that the pin end was deformed with a concave indentation, as if someone had tried to use a pry bar on it.
At the time, the airline’s MD-80 Maintenance Procedures Manual contained one approved manual engine-start procedure, which stated that maintenance personnel must open the ATSV using an approved, specialized wrench to turn the wrenching flats on the upper end of the butterfly valve shaft and request that the flight crew activate the engine-start switch. During post-accident interviews, mechanics complained that the approved procedure was “very time consuming” and could take about 20 to 40 minutes to perform because the required wrench was not part of the standard tool kit. So, they usually chose to use a “prying device” to reach, depress and hold down the ATSV’s manual override button, which is accessed through a small panel located on the forward lower cowl door.
Investigators surmised that the ASTV filter element disintegrated, allowing the end cap to become free, which blocked the air flow and caused the engine no-start condition. Damage to the override button from a pry bar resulted in the uncommanded opening of the ATSV during the high-power engine conditions at the beginning of the takeoff roll and caused the air turbine starter to freewheel until it sustained a catastrophic internal failure. The open ATSV and resulting failed air turbine starter allowed a hotter than typical airstream to flow into the engine nacelle area and likely provided the ignition source for the in-flight fire.
Maintenance Records
Tell a Tale
During the 12-day period preceding the accident, the left engine ATSV was deferred and/or replaced a total of six times without resolving the engine no-start condition on the accident airplane. Over that time, the airline’s technical services personnel, who were assigned to review and act on alert items reported by line maintenance, issued three “Action to be Taken” notices in response to the alerts, indicating that they were aware of the repeated engine start failures and ATSV changes — but these actions failed to address the systemic issue. Instead of forbidding additional ATSV replacements until maintenance could properly troubleshoot and correct the problem, the airline continued to allow the airplane to be dispatched with deferrals against the left engine start system.
About four months after the STL engine fire, another uncommanded ATSV-open event occurred with an American Airlines MD-82 in in Salt Lake City. The airline removed the ATSV filter from the airplane and sent seven more serviceable filters to the NTSB for evaluation. Three of the seven filters revealed evidence of the onset of fatigue in the filter elements’ outer mesh. In addition, the airline sent 15 more serviceable ATSV filters to the filter manufacturer for inspection — five had damaged mesh and required replacement.
The NTSB determined that the early-stage fatigue fractures within the outer mesh were too small to be seen by the naked eye or when using 7-power magnification as recommended in the ASTV component maintenance manual (CMM). In addition, investigators found that the approved test method did not adequately detect early-stage fatigue cracks in the filter. The NTSB concluded that the inspection criteria for the ATSV-air filter were inadequate to detect early-stage fatigue fractures of the outer mesh of the filter element and that, because of the filter design, the inner mesh of the filter element could not be inspected for evidence of fatigue (see graphic H above).
In addition to the pry bar use, investigators also learned that airline maintenance personnel did not clean the accident ATSV filter in accordance with its C-check cleaning procedures and, therefore, missed an opportunity to identify and replace the damaged filter. The filter element disintegrated, allowing the end cap to become free, which blocked the air flow and caused the engine no-start condition.
Adding insult to injury, the NTSB discovered that the pilots failed to properly allocate tasks during the emergency, including checklist execution and radio communications, and this adversely affected their ability to conduct essential cockpit tasks.
Continuing Analysis and Surveillance System (CASS)
The FAA provides guidance to operators regarding Continuing Analysis and Surveillance System (CASS) programs in Advisory Circular (AC) 120-79, “Developing and Implementing a Continuing Analysis and Surveillance System.” CASS is a risk management system required for commercial air carriers (per FAR 121.373 and Part 135.431) that comprises a continuous cycle of surveillance, investigation, analysis, and corrective action. The system provides a structured process of collecting and evaluating information to identify factors that could lead to an accident.
American Airlines had a CASS system, but it obviously was not robust enough to alert the company to recognize the recurring failed engine starts, ATSV replacements, and MEL deferments as a possible serious problem that needed to be systemically addressed. The NTSB stated that the unresolved ASTV maintenance problems were not adequately addressed through daily conference calls with maintenance and engineering staff conducted as part of the airline’s CASS program.
In addition, a CASS program is meant to ensure that an airline is following its inspection and maintenance procedures, but the investigation found that the airline was not complying with several maintenance program requirements including the use of approved manual engine-start procedures and appropriate tools to perform ATSV filter cleaning procedures during C-checks, and to correctly document the work accomplished on the accident airplane.
The Probable Cause and Words of Wisdom from NTSB
During the Board Meeting to close out this investigation, the NTSB determined that the probable cause was “maintenance personnel’s use of an inappropriate manual engine-start procedure, which led to the uncommanded opening of the left engine air turbine starter valve, and a subsequent left engine fire, which was prolonged by the flight crew’s interruption of an emergency checklist to perform nonessential tasks.” The Board also stated: “Contributing to the accident were deficiencies in American Airlines’ Continuing Analysis and Surveillance System (CASS) program.”
The Board issued eight safety recommendations to the FAA, including one to establish an interval for servicing an engine component and another to evaluate the history of air start-related malfunctions in MD-80 airplanes. The Board also recommended that the airline evaluate and correct deficiencies in its CASS program.
“The airline’s own internal maintenance system…failed to do what it was designed to do,” said then-Chairman Mark Rosenker. “And that allowed this sequence of events to get rolling… Following the appropriate maintenance procedures would have gone a long way toward preventing this mishap.”
Board Member Kitty Higgins added her own view: “It seems to me it was a series of people taking short cuts that accumulated on this particular day into what could have been much more catastrophic.”