Lessons learned from British Midland Flight 92, Boeing B-737-400, January 8, 1989

Shutting down the wrong engine. Deficiencies in flight crew training, standard operating procedures deviations, and poor CRM identified.

G-OBME1
Photo excerpted from B3A webpage 

British Midland Flight 92, Boeing B-737-400. Location: Kegworth, United Kingdom. Date: January 8, 1989 (Note from the blogger: I’m just sharing, all credits to the authors. Excerpted from  FAA’s Lessons Learned From Transport Airplane Accidents)

Approximately 13 minutes after takeoff from London’s Heathrow Airport, on a flight planned to Belfast, Ireland, the outer portion of a fan blade on the number one engine failed as the airplane was climbing through 28,000 feet. The fan blade failure resulted in high levels of airframe vibration, a series of compressor stalls in the left engine, fluctuation of the left engine parameters, and smoke and fumes in the flight deck. The flight crew, believing that the right engine had failed, reduced thrust on that engine, and subsequently shut it down. The airframe vibration ceased as soon as thrust was reduced on the right engine, reinforcing the crew’s identification as the right engine having been the engine that had failed.

The crew initiated a diversion to East Midlands Airport, which progressed normally until, at 2.4 nautical miles from the runway, a fire warning, and abrupt thrust loss occurred on the left engine. Attempts to restart the right engine were unsuccessful and the airplane crashed approximately one-half mile short of the airport. Thirty-nine passengers died in the accident, and eight others died later due to their injuries. Of the other 79 occupants, 74 suffered serious injury.

Accident Overview

History of Flight

British Midlands Airways (BMA) Ltd Flight 92 departed London Heathrow Airport en route to Belfast International Airport at 1952 hours local time, with eight crew members and 118 passengers. The airplane was a Boeing Model 737 Series 400 (737-400), equipped with two CFM56-3C turbofan engines.

About 13 minutes into the flight, as the aircraft was climbing through 28,300 feet, a fan blade failed in the left engine, resulting in severe vibration and a series of engine stalls and surges. An outer portion of a fan blade had failed and separated, causing severe damage to the entire fan section. The fan blade failure was the result of a blade vibratory instability, referred to as blade flutter, which initiated in the engine fan blade at a specific combination of high thrust and flight conditions.

The aircraft immediately experienced a high level of airframe vibration which was felt in the flight deck by the crew and in the cabin by the flight attendants and passengers. The crew also smelled fire and air conditioning smoke in the flight deck. No visual or aural alerts accompanied the failure.

According to the accident report, the passengers and flight attendants also reported the smell of smoke in the cabin. Some described the smell of burning ‘rubber’, ‘oil’, and ‘hot metal’. Two flight attendants in the rear cabin reported that they briefly saw light colored smoke. Those two, and another flight attendant reported seeing evidence of fire from the left engine. Many passengers also saw signs of fire from this engine. They described it as ‘fire’, ‘torching,’ or ‘sparks’. The flight attendants did not relay information to the flight crew regarding the cabin smoke or vibration until requested by the captain about two minutes after the fan blade failure.

As a result of the fan blade failure, the left engine began operating erratically. The automatic throttle (auto-throttle) system was at this point still engaged and active, commanding the engine to maintain the target thrust that had been set for the climb. The flight data recorder (FDR) indicated fluctuations in the left engine parameters. The FDR also indicated that the right engine continued stable operation. The fan speed (N1) for the left engine fluctuated and indicated a lower value than the right engine. Exhaust gas temperature (EGT) for the left engine was about 100ºC higher than the right engine EGT, with an eventual peak difference of about 125ºC. Fuel flow for the left engine dropped and fluctuated. The airborne vibration monitor (AVM) for the left engine indicated five units, the maximum indication on the gauge. While the right engine AVM was less than one unit and stable.

About eight seconds after the fan blade failure, the captain took control of the aircraft and disengaged the autopilot. During the investigation, he stated that he had looked at the engine displays but did not gain any indication of the source of the problem. Just prior to the captain assuming control of the airplane, the first officer had stated, “We got a fire,” though there were no overheat or fire indications or alarms at that time.

The captain later stated that he had relied on his knowledge of the aircraft air conditioning system (ACS) and the first officer’s assessment of the engine instruments as means to diagnose the problem. He stated that he thought the smoke and fumes were coming forward from the passenger cabin to the flight deck. He also assumed most of the air in the cabin was supplied by the right engine. Thus, he determined the problem was with the right engine. The accident report stated that this reasoning would have been applicable to other early airplanes he had flown. However, the Boeing 737-400 ACS has a portion of conditioned air for the passenger cabin whose source is the left engine. Further, both on Boeing 737 Series 300 and 400 airplanes, the ACS feeds conditioned air from the left engine directly to the flight deck. The investigation concluded that the most likely reason for the captain’s assumption regarding the right engine was the result of the first officer’s response to his query about which engine was experiencing a problem. The first officer’s reply, “It’s the lef…it’s the right one,” reinforced his original assessment regarding the right engine. Believing the first officer had examined the engine instruments and positively identified the problem engine, the captain provisionally accepted the first officer’s assessment. The captain then responded by saying, “Okay, throttle it back.” This order was given about 19 seconds after the failure.

Photo of 737 Flight Deck indicating Engine Instruments
Photo of 737 Flight Deck indicating Engine Instruments View Large

The autothrottle was disengaged in order for the first officer to manually reduce thrust on the right engine. Within two seconds of the thrust reduction on the right engine, the left engine fan speed stabilized at a level 3% below its previous stable value, and the EGT stabilized at about 50ºC above the previous stable value. However, the left engine fuel flow was still behaving erratically and continued to drop. The AVM continued to show a vibration value of five units. It was noted in the accident report that “the captain later stated that the action of closing the right engine throttle reduced the smell and the visual signs of smoke and that he remembered no continuation of the vibration after the right throttle was closed.”

The first officer advised London Air Traffic Control (LATC) of their emergency 28 seconds after the failure as the airplane was climbing through approximately 30,000 feet.

According to the accident report, 43 seconds after the fan blade failure, the captain ordered the first officer to, “Shut it down,” without specifically identifying which engine, leaving the first officer to decide and choose which engine to shut down. Since the first officer had assumed earlier that the problem was with the right engine, he proceeded to shut it down. However, the execution was delayed when the captain said, “Seems to be running alright now. Let’s just see if it comes in.” The first officer told the captain that he was about to start the ‘Engine Failure and Shutdown Checklist,’ but stated at the same time, “Seems we have stabilized. We’ve still got the smoke.”

Engine Instruments
Engine Instruments View Large

There were a number of attempts to complete the checklist, some interrupted by communications with air traffic control and with BMA company radio. However, at two minutes and seven seconds after the failure, the right engine was shut down and the auxiliary power unit (APU) was started. At the time of the right engine shut down, the left engine EGT indicated a gradually decreasing temperature and the rotor speeds and fuel flow had stabilized. The left engine AVM continued to display a level of five units.

According to the investigation, shutting down the right engine convinced the captain that his action had been correct because the smell and smoke in the flight deck cleared immediately. The FDR indicated that an initial thrust reduction on the left engine occurred approximately three minutes and ten seconds after the failure. Power was further reduced about one minute later. The left engine then continued to operate with no adverse indications other than the continuing indicated high levels of vibration and increased fuel flow. The high level of vibration continued for about another three minutes and then gradually decreased to between two and three units on the AVM indicator. The captain later stated that he believed the emergency situation had been successfully concluded and that the left engine was operating normally. His conclusion was based on the apparent stability of the engine indications.

After the right engine was shut down, the captain announced to the passengers that there was trouble with the right engine. He stated that the engine had produced some smoke in the cabin, that the engine had been shut down, and that they could expect to land at East Midlands Airport in about ten minutes. The flight attendants who had seen signs of fire on the left engine later stated that they did not hear the captain’s reference to the right engine. However, many passengers who had seen the fire from the left engine heard, and were puzzled by, the captain’s reference to the right engine. Some passengers were still aware of a continuing vibration. The accident report noted that this discrepancy and continued vibration were not brought to the attention of the crew. However, it was noted that, by the time the captain made the announcement, the smell of smoke in the cabin had dissipated.

Photo of wreckage on embankment
Photo of wreckage on embankment

Following the shutdown of the right engine, flight crew workload remained high. The captain did not re-engage the autopilot, and he flew the aircraft manually for the rest of the flight. The first officer engaged in radio communications, obtaining details of weather at East Midlands Airport (EMA) and unsuccessfully attempted to program the flight management system to indicate EMA as the destination airport.

Seven minutes and 23 seconds after the failure, the captain attempted to review the situation. He asked the first officer, “Now what indications did we actually get (it) just rapid vibrations in the airplane, smoke…” The last situation assessment by the crew had been attempted approximately two minutes after the failure, as they began the ‘Engine Failure and Shutdown Checklist.’ However, that activity had been suspended and was not reinitiated. The renewed attempt at assessing the situation was interrupted by ATC communications: heading changes, descent clearance, and instruction to change radio frequency to EMA approach control.

Photo of Crash Site showing Proximity to Runway
Photo of Crash Site showing Proximity to Runway View Large
Photo of Crash Site
Photo of Crash Site View Large

Following the radio frequency change, the first officer began the one-engine inoperative descent and approach checklist. This checklist was interrupted with radio calls from the EMA approach controller asking the captain to make a test call to the aerodrome fire service. The captain made the call but received no response. The approach checklist was finally completed as the aircraft was descending through 6,500 feet and 15 nautical miles from EMA.

At 13 nm from touchdown, and descending through 3,000 feet, power was increased on the left engine to level the aircraft. The vibration level increased to the indicator maximum level of five units. At the time, the aircraft was still within the starter assist in-flight restart envelope. The landing gear was lowered when the aircraft was above 2,000 feet and 5.3 nautical miles from touchdown, and at a speed of approximately 175 knots. As the aircraft reached 2.4 nautical miles from touchdown, at an altitude of about 1,000 feet, power from the left engine abruptly decreased. The aircraft had slowed to about 150 knots and flaps were set at 15º.

The captain ordered the first officer to restart the right engine, and he opened the fuel valve in an attempt to obtain a windmill relight. However, the aircraft was now at the low-speed boundary of the starter assist in-flight restart envelope, too slow to achieve a successful windmill relight. The crew informed air traffic that they were having difficulties restarting the right engine. During the start attempts, a fire warning occurred on the left engine. The aircraft was drifting below the glide slope, and the captain raised the nose of the aircraft to extend the glide. The ground proximity warning system (GPWS) sounded, followed by a stall warning.

The aircraft crashed with a last known airspeed of 115 knots. It came to rest after breaking into three sections on the western embankment of the M1 motorway, 900 meters (0.56 miles.) from the threshold of EMA runway 27. Seventy-four occupants were seriously injured and five others suffered minor injuries. There was a total of 47 fatalities. An animation of the flight path is available at the following link: (Flight Path Animation)

CFM56-3 Turbofan Engine

The GE/SNECMA CFM56-3 engine is a high-bypass, dual-rotor, axial-flow turbofan engine, and is rated for a range of 18,500 to 22,000 pounds of thrust, depending on its installation on the Boeing 737-300, -400, or -500 aircraft. The engine rotors are designed with a five-bearing support configuration with a two-sump lubricating system. The engine features a four-stage integrated fan and the low-pressure compressor driven by a four-stage low-pressure turbine as well as a nine-stage high-pressure compressor driven by a single-stage high-pressure turbine. The compressor uses a variable bleed valve and variable stator vane system for airflow control. The CFM56-3 uses an annular combustion chamber and a fan mounted accessory drive system.

The fan consists of 38 titanium alloy fan blades. The blades are 14.5 inches long with a dovetail attachment feature and an interlocking mid-span shroud. The shroud provides for added blade assembly stiffness. Each blade is held in place by a blade retainer and spacer.

Fan Blade Failure

Diagram of CFM56-3 Engine Fan Blade
Diagram of CFM56-3 Engine Fan Blade

 

Photo of Failed Section of Fan Blade
Photo of Failed Section of Fan Blade

Post-accident investigation determined that the fan blade failure was the result of an aeroelastic vibratory instability caused by a coupled torsional-flexural transient non-synchronous oscillation. It was learned that this instability could occur when the airstream over the fan blade reaches a certain critical velocity. In one of the precipitating events in this accident, this instability caused the excitation of a fan blade to increase exponentially, causing high-cycle fatigue failure of the blade in a short period of time. Testing revealed that in order for this mode to occur, the engine needed to be at a full-power setting, in a high angle of attack attitude, and above an altitude of 27,000 feet. At these higher power levels, the fan blades would be susceptible to a transient non-synchronous vibration during the higher altitude portions of the climb and during the cruise. A nick or dent on the leading edge of the blade would form a “stress riser” and may enhance the possibility of crack initiation, propagation, and blade failure due to high-cycle fatigue. An animation describing this process is available at the following link: (Fan Blade Failure)

737-400 Engine Indicating System (EIS)

Photo of 737-400 cockpit
Photo of 737-400 cockpit (C) Zulfachri Harahap – used with permission View Larger
The EIS is a solid state modular unit providing displays of both primary and secondary engine parameters. The primary display consists of fan speed (N1), exhaust gas temperature (EGT), core rotor speed (N2), and fuel flow (FF) for both engines. The display consists of both an analog and digital display by using light-emitting diodes, both to provide an indicator “needle,” and numerical indications of rotor speeds to mimic the behavior of electromechanical instruments.

The secondary display consists of analog-only displays of engine oil pressure, engine oil temperature, engine vibration, and A and B system hydraulic pressures. The displays use “pointers” similar to the primary displays, but do not include numerical displays and are smaller than the primary instruments.

Both sets of displays contain sensors to vary display brightness depending on flight deck lighting conditions so that displays remain legible in all lighting conditions from bright, direct sunlight, to darkness. For night operations, the display brightness can also be controlled by the crew. With the exception of engine vibration, all parameters are derived directly from sensors located on the engines. Engine vibration is provided by sensors located on each engine and is then processed by the vibration monitoring system before being passed to the EIS.

Airborne Vibration Monitoring System (AVM)

The AVM system provides continuous vibration monitoring as well as the display of the engine vibration levels via the secondary displays on the EIS. Information is also recorded on the flight data recorder. The AVM module only displays values up to five units on the EIS scale. Vibration values above this maximum value are displayed and recorded as five units. There is no additional indication or alert if vibration levels exceed five units.

Two vibration sensors are mounted on each engine: one on the front bearing support and another on the turbine rear frame. The AVM also uses both low- and high-pressure spools to track vibration signals and filter out any vibrations that are not associated with either N1 or N2 speeds. Although vibration signals from both engine sensors are transmitted to the AVM, only those signals from the forward-bearing support are displayed to the crew on the flight deck indicators. The higher value of low-pressure or high-pressure shaft vibration will be displayed to the crew.

AVM Indicators on EIS Secondary Displays
AVM Indicators on EIS Secondary Displays  

In-flight Engine Starting

Following an in-flight failure or shutdown of an undamaged engine, any transport airplane is required to have the capability to restart an engine in flight. There are typically two means by which to restart an engine: a windmill restart and a starter-assisted start.

Windmill Start

A windmill start uses airflow through the engine, by virtue of sufficient airspeed, to rotate the engine and supply the necessary rotational energy to initiate the start sequence. During a windmill start, following energizing of the electronic ignitors (similar to spark plugs in an automobile engine), the start sequence is initiated by simply turning on the fuel. The ignitors will cause the fuel to ignite and the engine will accelerate toward idle, relying on the rotational energy provided by airflow through the engine to aid in the initial engine acceleration.

Starter-assist Start

A starter-assist start, relative to the process employed, is similar to starting on the ground when the airplane is parked. The process requires a source of air pressure to rotate the engine. Starter air is provided either by bleed air from another engine or an APU. Once bleed air flow is established, the flight deck start switch is turned on, providing airflow to the engine being started, and thereby beginning engine rotation and acceleration to a speed sufficient to support airflow through the combustion chambers. Once the engine has reached a sufficient rotational speed (indicated by N1 or N2), fuel is turned on, ignition occurs, and the engine accelerates to idle.

During airplane certification testing, the engine relight-envelopes are established. Flight tests are conducted to verify the accuracy and reliability of both portions of the restart envelope and to validate the restart procedures for any particular airplane. Start procedures and specifics, such as required rotational speeds prior to initiation of fuel flow, may vary for engines from different manufacturers. Depending on the engine, in-flight starts may take as long as three minutes.

In this accident, the investigators determined that when the first officer was attempting to restart the right engine, which earlier had been shut down in error, the airplane was at a low airspeed, near the low-speed boundary of the starter assist envelope. Though the APU had been started earlier, the first officer was attempting a windmill start, which, due to the low airspeed, would not have been successful. The investigation also determined that due to the time required to restart the engine, and the remaining time before impact, a starter assist start would also have been unsuccessful.

Illustration of impact sequence
Illustration of impact sequence
Inappropriate Crew Response to Malfunctions

British Midlands flight 92 experienced a failure condition which should not have resulted in a catastrophic outcome.  The fan blade failure, while resulting in substantial engine damage, did not pose a structural or controllability threat to the airplane. However, the inappropriate response by the flight crew, in shutting down the healthy engine, placed the aircraft in a hazardous condition which was not recognized until it was too late to restart the engine.  The circumstances of a benign, or low-hazard condition, followed by an inappropriate crew response has led to a number of accidents.  Faulty landing gear indicator lights, tire failures during takeoff, misleading avionics indications, sudden in-flight upset encounters, and other singular events have, when accompanied by an inappropriate flight crew response, occasionally resulted in a catastrophic outcome.

 

An example of a turbofan engine after a fan blade failure
An example of a turbofan engine after a fan blade failure
Cabin Interior and Seat Condition

The investigation of British Midlands flight 92 found that the majority of seats in the center and tail sections remained attached to the floor although some had structural failures. The seats in sections just forward and aft of the wing were extensively damaged due to the failure of the floor sections.  All protection by the seats was lost when the floor collapsed since this resulted in the passengers and crew being unrestrained and subject to injury from secondary impacts.

Photo of damaged forward cabin with missing floor
Forward fuselage area. Note that the floor has failed. Photo from the accident investigation.

16g Seat Rule History and British Midlands Flight 92

The seats on the aircraft are known as 9g static load seats certified to 14 CFR 25.561.  This was the standard in place at the time the airplane received FAA type certification in 1988.  The more stringent 16g dynamic load seat rule (14 CFR 25.562) was put in place in 1986 after the British Midlands Boeing 737 airplane was already in service with the airline.  The 16g seat rule did not require existing airplanes, or their derivatives such the British Midlands Boeing 737-400, to be upgraded to meet the new standard.

Photos of damaged seat from British Midlands Flight 092 accident investigation
Left: Example seat from forward cabin. Note the seat legs have failed and are missing. Right: Example seats from cabin center section. Note the seats are still attached but the aft seat has a failed front spar (cross beam). Photos from the accident investigation.

The British Midlands Flight 92 accident in 1989 was not the accident that led directly to the 16g-seat rule but it was one of many that demonstrated that 9g seats do not provide adequate protection to passengers or crew in a survivable crash. Evidence of poor seat performance during the Flight 92 crash sequence includes:

  1. Seat tracks and seat spars fractured allowing seats to collapse or break loose from the airplane floor resulting in severe passenger injuries and fatalities.
  2. Seat (and seat track) failures led to injuries and impeded the ability of passengers and crew to evacuate the airplane.
  3. Passengers sustained severe head injuries, lumbar spine, hip and leg fractures while seated in seats still attached to the floor structure.

Prevailing Cultural / Organizational Factors

The accident report stated that it was apparent that the flight crew did not assimilate the indications on both vibration indicators. The report concludes that this may have been a result of their general experience and the experience of other flight crews of early generation engine vibration indicators, who viewed the engine vibration indicating systems as inaccurate and of inferior performance. The investigation concluded that if the crew had consulted the vibration indications, the failed engine could have been correctly identified and the accident could have perhaps been avoided.

Further, when British Midlands took delivery of their first EIS equipped aircraft, a one-day training course was provided to highlight the differences between EIS equipped aircraft and those not so equipped. An EIS-equipped training simulator was not available, so the investigation concluded that the first time a flight crew was likely to see abnormal indications on an EIS would have been in flight in an aircraft with a failing engine.

Finally, the accident report stated that the performance of a flight crew in an emergency situation is largely a product of their training. In the simulator, the majority, if not all, engine problems result from the shutdown of the problem engine. This reinforces the idea that all in-flight situations involving anomalous engine behavior should also result in an engine shutdown. The investigation concluded that it was not surprising that, since an engine shutdown was a normally trained and practiced event, that shutting down an engine, in this case, was a result.

Safety Assumptions

  • A failed engine would be properly identified, and if an engine shutdown became necessary, the correct engine would be shut down.
  • Emergency checklists would be properly and fully accomplished.
  • The CFM engine would be free of harmful vibrations throughout the engine operating envelope.
  • 9g static seats will adequately protect the passengers and crew in a survivable crash up to the point of fuselage break up.

Key Safety Issue(s)

  • The flight crew misidentified the failed engine, resulting in the shutdown of a properly functioning engine.
  • The flight crew did not complete the applicable emergency checklists.
  • The fan blade flutter condition caused an in-flight blade failure.
  • During the survivable crash event, the seats did not protect the passengers or crew adequately.

Accident Board Findings

The Air Accidents Investigation Branch of the Civil Aviation Authority (AAIB) issued 51 findings addressing the airplane, the flight deck and cabin crews, each engine, airplane systems, ground impact, and accident survivability.

1. Conclusions
(a) Findings

The aircraft
1 The aircraft had a valid certificate of airworthiness in the transport category (passenger)
and had been maintained in accordance with an approved schedule.

The flight deck crew
2. The flight deck crew were properly licensed and rested to undertake the flight.
3. The flight deck crew experienced moderate to severe engine induced vibration and shuddering, accompanied by smoke and/or smell of fire, as the aircraft climbed through FL283. This combination of symptoms was outside their training or experience and they responded urgently by disengaging the autothrottles and throttling back the No 2 engine, which was running satisfactorily.
4. After the autothrottle was disengaged, and whilst the No 2 eng inc was running down, the No 1 engine recovered from the compressor stalls and began to settle at a slightly lower fan speed. This reduced the shuddering apparent on the flight deck, convincing the commander that they had correctly identified the No 2 engine as the source of the
problem.
5. The first officer informed the emergency to ATC, indicating that they had an engine fire and intended to shut an engine down, although there had been no fire warning from the engine fire detection system.
6. Whilst the commander’s decision to divert to East Midlands Airport to land with the minimum of the delay was correct, he thereby incurred a high cockpit workload which precluded any effective review of the emergency or the actions he had taken.
7. The flight crew did not assimilate the readings on the engine instruments before they
decided to throttle-back the No 2 engine. After throttling back the No 2 engine, they did
not assimilate the maximum vibration indication apparent on the No 1 engine before they
shut down the No 2 engine 2 minutes 7 seconds after the onset of vibration, and 5 nm
south of EMA. The aircraft checklist gave separate drills for high vibration and for
smoke but contained no drill for a combination of both.
8. The commander remained unaware of the blue sparks and flames which had issued from the No I engine during the period of heavy vibration and which had been observed by many passengers and the three aft cabin crew.
9. During the descent, the No 1 engine continued to run apparently normally, although with higher than normal levels of vibration.
10. Flight crew workload during the descent remained high as they informed their company at EMA of their problem and intentions, responded to ATC height and heading instructions, obtained weather information for EMA and the first officer attempted to reprogramme the flight management system to display the landing pattern for EMA. Some 7 1/2 minutes after the initial problem, the commander attempted to review the initial engine symptoms, but this was cut short by further ATC heading and descent information and instructions to change to the EMA ATC radio frequency.
11. Fifteen minutes after the engine problem occurred and some 4 minutes 40 seconds before ground impact, the commander increased power on the No 1 engine as the aircraft
descended towards 3000 feet amsl and closed with the center line of the instrument landing system. At this point, the indicated vibration on the No 1 engine again rose to its maximum value of 5 units but did not attract the attention of either pilot.
12. Fifty-three seconds before ground impact, when the aircraft was 900 feet agl and 2.4 nm from the runway with landing gear down and 15° flaps selected, there was an abrupt
decrease in power from the No I engine.
13. The commander immediately called for the first officer to relight the No 2 engine. The attempted restart was not successful, probably because there was insufficient bleed air pressure from the No 1 engine, pressure air from the APU was not connected and the bleed air crossfeed valve was closed. Even if pressure air had been available it is unlikely that power could have been obtained from the No 2 engine before the aircraft hit the ground.
14. The training of the pilots met CAA requirements. However, no flight simulator training had been given, or had been required, on the recognition of engine failure on the
electronic engine instrument system or on decision-making techniques in the event of failures not covered by standard procedures.
15. The change from hybrid electro-mechanical instruments to LED displays for engine indications has reduced conspicuity, particularly in respect of the engine vibration
indicators. No additional vibration alerting system was fitted that could have highlighted to the pilots which of the two engines was vibrating excessively.

The Cabin Crew
16. All members of the cabin crew were properly trained to undertake the flight.
17. Although the cabin crew immediately became aware of heavy vibration at the onset of the emergency and three aft cabin crew saw flames emanating from the No 1 engine, this information was not communicated to the pilots.
18. During the descent, the cabin crew carried out their emergency drills, checking that all passengers had their lap belts fastened and stowing all loose carry-on luggage in the overhead bins.

No 1 (Left) Engine
19. The No 1 engine suffered fatigue of one of its fan blades which caused detachment of the blade outer panel. This led to a series of compressor stalls, over a period of 22 seconds, until the engine autothrottle was disengaged.
20. The severe mechanical imbalance which arose because of the outer panel separation led to blade tip rubbing, particularly on the fan and booster sections abradable seals, which caused smoke and the smell of burning to be passed into the air conditioning system.
21. About 3 seconds after the autothrottle was disengaged, and whilst the No 2 engine was
running down, the No I engine began to stabilize. However, its indicated vibration
remained at maximum for at least 3 minutes until this engine was throttled back for the
descent.
22. The evidence indicated that the timing of the sudden recovery of the No 1 engine from the compressor stalling was related to the autothrottle disengagement at a point when it had demanded a lower throttle lever angle than that required for rated climb, thereby allowing this engine to achieve stabilized running at a slightly lower speed.
23. During the descent, the No 1 engine responded apparently normally at the idle/low throttle settings used, although its indicated vibration remained higher than normal.
24. Fifty-three seconds before ground impact, the No 1 engine abruptly lost thrust as a result of extensive secondary fan damage. This was accompanied by compressor stalling, heavy buffeting and the emission of pulsating flames. This damage was probably
initiated by fan ingestion of the blade section released by the initial failure, which was considered to have partially penetrated, and temporarily lodged within, the acoustic lining panels of the intake casing before having been shaken free during the period of high vibration following the increase in power on the final approach to land. Sections of fan blades were found below this point of the final approach, including two small fragments which were determined to be remnants of the blade section which detached initially.
25. The No 1 engine fire warning, which occurred on the flight deck 36 seconds before ground impact, was initiated by a secondary fire which occurred on the outboard exterior of the engine fan casing. It was concluded that the prolonged period of running under conditions of excessive vibration had loosened fuel/oil system unions and seals on the exterior of the fan casing and that the inlet duct had probably been damaged sufficiently, by fan blade debris, to allow ignition of atomized fuel/oil sprays by titanium ‘sparks’ and/or intake flame.
26. This short duration in-flight fire on the No 1 engine was followed by a localized ground fire associated with this engine, which was successfully extinguished by the East
Midland Airport Fire Service.
27. The fan blade fatigue fracture initiated as a result of exposure of the blade to a vibratory stress level greater than that for which it was designed, due to the existence of a fan system vibratory mode, induced under conditions of high corrected fan speed at altitude, which was not detected by engine certification testing.

No 2 (right) engine
28. The No 2 engine was running normally when it was throttled back to flight idle, and then shut down.
29. This engine showed no evidence of power at impact, consistent with the evidence from the flight data recorder.
30. Detailed strip inspection of this engine showed it to have been fully serviceable before ground impact.

Systems
31. The No 2 (right) engine vibration reports which appeared in the aircraft Technical Log during December 1988 but had been correctly addressed by ground technicians.
32. There were no malfunctions of the major airframe systems which contributed to this
accident.
33. No evidence was found of any cross-connection or similar obvious wiring errors
associated with either the engine instrument system (EIS) or the fire detection system.
34. The EIS fitted to the aircraft was serviceable at impact and tests indicated that it should have displayed those primary engine parameters recorded on the FDR, with close fidelity.
35. The airborne vibration monitoring system (AVM) was serviceable at impact. Tests showed that the system was capable of tracking vibration caused by the massive fan imbalance and of outputting its maximum value approximately 2 seconds after the start of the vibration.
36. Flight crew reports concerning the response of the AYM system during the two other cases of fan blade fracture on CFM56-3C engines which occurred subsequent to this accident supported the behavior described above. Two cases of bird impact which
resulted in fan damage generated crew reports of late indication on vibration gauges, although vibration was clearly felt by the flight crew. This was the result of the nonlinear sensitivity of this type of engine to small imbalances with changes of fan speed in the take-off and climb thrust range.
37. The engine fire and overheat detection system contained a fault which could have
rendered it incapable of providing warning of a fire in either engine. However, the CYR
evidence indicated that it did, in fact, provide a warning of the fire in the No I engine 36
seconds before impact.

Impact with the ground
38. The aircraft suffered two distinct impacts with the ground, the first just before the eastern embankment of the M1 motorway and the second on the western edge of the northbound M1 carriageway, at the base of the western embankment.
39. The first impact was at an airspeed of 113 knots CAS, with a rate of descent of between 8.5 feet/sec and 16 feet/sec. The pitch attitude was 13° nose up.
40. The second and major impact occurred at a speed of between 80 and 100 knots, at an angle of approximately 16° below the horizontal and with the aircraft at a pitch attitude of between 9° and 14° nose down. The associated peak deceleration was of the order of 22
to 28g, predominantly longitudinal.
41. In the second impact, the forward fuselage separated from the overwing section of the fuselage and the tail section buckled over, and to the right of, that section of the fuselage just aft of the wing.
42. The incidence of passenger fatality was highest where the floor had collapsed in the
forward section of the passenger cabin and in the area just aft of the wing. The cabin
floor and the passenger seating remained almost entirely intact within the overwing and tail sections.
43. There was no major post impact fire, largely because the main landing gear legs and the engines separated from the wing without rupturing the wing fuel tanks. The separation of the landing gear legs was in accordance with their design. In the case of the engines, however, the separations occurred within the engine pylons themselves, leaving the fuse pin bolts intact

Survivability
44. Of the 8 crew and 118 passengers on board, all crew members survived but 39 passengers died from impact injuries at the scene and a further 8 passengers died later in hospital. A further 74 occupants were seriously injured.
45. The decelerations generated in the second impact were greater than those specified in the Airworthiness Requirements to which the airframe and furnishings were designed and certificated. They were, however, within the physiological tolerance of a typical passenger.
46. Passenger survivability was improved due to the passenger seats being of a design with impact tolerance in advance of the current regulatory requirements. This was most evident in the overwing and tail sections of the cabin, where the floor had remained intact.
47. There is considerable potential for improving the survivability of passengers in this type of impact by improving the structural integrity of the cabin floor so as to retain the seats in their relative positions and by detail design improvements to the seats themselves.
48. There is a need for a structured program of research into alternative seating
configurations, with particular emphasis on the provision of effective upper torso
restraint or aft-facing seats.
49. The injuries to the mother and child in seat 3F highlighted the advantages of infants being placed in child seats rather than in a loop-type supplementary belt.
50. Although the overhead stowage bins met the appropriate Airworthiness Requirements for static loading, all but one of the 30 bins fell from their attachments, which did not withstand the dynamic loading conditions in this accident.
51. Some of the doors on the overhead stowage bins opened during the last seconds of flight, demonstrating the need for some form of improved latching of the doors.

The AAIB cited the accident cause as:

“The cause of the accident was that the operating crew shut down engine No 2 after a fan blade had fractured on the No 1 engine. This engine subsequently suffered a major thrust loss due to secondary fan damage after power had been increased during final approach to land.”

The following factors contributed to the incorrect response of the flight crew:

  1. The combination of heavy engine vibration, noise, shuddering and an associated smell of fire were outside their training and experience.
  2. They reacted to the initial engine problem prematurely and in a way that was contrary to their training.
  3. They did not assimilate the indications on the engine instrument display before they throttled back the No 2 engine.
  4. As the No 2 engine was throttled back, the noise and shuddering associated with the surging of the No 1 engine ceased, persuading them that they had correctly identified the defective engine.
  5. They were not informed of the flames which had emanated from the No 1 engine and which had been observed by many on board, including three cabin attendants in the aft cabin.

Resulting Safety Initiatives

No specific regulatory changes were identified as a result of this accident. However, two major safety areas were influenced by the British Midlands Flight 92 accident:

  • Seat Structural Integrity
  • Inappropriate Crew Response to Malfunctions

G-OBME 2

Photo(C) AirTeamImages, took from a Pinterest account

Excerpted from  FAA’s Lessons Learned From Transport Airplane Accidents:British Midland 737 Flight 92 at Kegworth.

Additional reference: Department of Transport, Air Accidents Investigation Branch of the Civil Aviation Authority (AAIB). Aircraft  Accident Report  4/90, Report on the accident to Boeing 737-400 G-OBME near Kegworth, Leicestershire on 8 January 1989.

Further reading on this blog:

  1. Shutting down the wrong engine
  2. TransAsia Airways Flight GE235 accident Final Report
  3. Learning from the past: American Eagle Flight 3379, uncontrolled collision with terrain. Morrisville, North Carolina December 13th, 1994

********************

Posts in this blog:

Human Factors in Aviation

Accidents/Incidents investigation

Follow me on facebook Living Safely with Human Error  and twitter@dralaurita. Lots of Human Factors information updated almost every day.

 

16 thoughts on “Lessons learned from British Midland Flight 92, Boeing B-737-400, January 8, 1989

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s