Event DCA18LA163

Factual narrative

HISTORY OF FLIGHTOn April 18, 2018, about 1809 eastern daylight time, Delta Air Lines (DAL) flight 30, an Airbus A330-300, N806NW, experienced a right engine fire during initial climb from Hartsfield-Jackson International Airport (ATL), Atlanta, Georgia. The flight crew received a right engine fire electronic centralized aircraft monitor (ECAM) indication when the airplane was at an altitude of about 700 ft above ground level (agl), declared an emergency, shut down the right engine, discharged both fire bottles, and initiated a turn back to ATL. During the return to ATL, the fire warning indication cleared, and the crew made an uneventful overweight single-engine landing. No passengers or crewmembers were injured. The airplane sustained substantial damage to its right engine pylon. The flight was operated under Title 14 Code of Federal Regulations Part 121 as a regularly scheduled flight from ATL to London Heathrow International Airport, London, England. The captain, first officer, line check pilot, and relief first officer all provided postaccident statements. (The cockpit voice recorder had been overwritten, and the crew was not interviewed.) The relief first officer stated that he had conducted an exterior walk-around inspection of the airplane before departure and noted nothing unusual or abnormal. The captain was the pilot flying at the time of the engine fire. He was receiving a 6-month line check at the time of the event. The flight departed from runway 26L. The captain stated that, when the airplane was between 500 and 1,000 ft agl, the flight crew received the ECAM warning “ENG 2 FIRE” and the associated visual (red lights: Master Warning, Fire Pushbutton and Engine Master Lever) and aural (continuous repetitive chime) cockpit indications, which included a red “LAND ASAP.” The captain also stated that, during the first minute of the ECAM messages, all the non-normal messages disappeared for about 2 to 3 seconds, and then the engine fire alert and associated visual and aural indications reappeared. The captain transferred control of the airplane to the first officer, performed the ECAM procedures, and discharged both fire extinguishing bottles. The relief first officer contacted air traffic control (ATC) to declare an emergency and coordinate the airplane’s return to ATL, and he aided the captain in performing the ECAM action items. Flight data recorder (FDR) data showed that the right engine thrust lever went to idle at 1810:13 and was shut down at 1811:49 and that engine parameters, including exhaust gas temperature, spooled down at a nominal rate. According to the captain, the fire indication remained “on for some time” after both fire bottles were discharged, and the right engine was shut down. While the flight was being vectored by ATC for the approach, the first officer transferred control of the airplane back to the captain, and the first officer resumed the duties of the pilot monitoring. According to the line check pilot’s statement, when the captain transferred control of the airplane to the first officer, the line check pilot changed his role to a regular flight crewmember to assist the crew. While the captain and the first officer completed the ECAM checklist, he coordinated communication with the cabin crew and supported the captain with the checklist actions. After the checklist was completed, he contacted the purser about the nature of the problem and stated that the airplane would be returning to ATL and that the cabin crew should prepare the cabin for landing. In addition, he made an announcement to the passengers, advising them that the airplane had engine trouble, the flight would be returning to ATL and stopping on the runway, and emergency vehicles would be approaching the airplane so that emergency personnel could inspect the airplane. The fire warning remained illuminated for more than 10 minutes. The fire warning was replaced with the ENG 2 FIRE DET FAULT caution, which indicated the fire detection capability was lost. Also, the red LAND ASAP indication changed to amber. At the time of the fire detection fault, the airplane was being flown on an extended downwind. A few minutes later, the flight made a 270° left turn to enter the right base leg. According to FDR data, at 1820:30, the right engine exhaust gas temperature spiked from about 200ºC (392ºF) to about 600ºC (1,112ºF). Air traffic control voice recordings and radar data indicated that, about 1831, one of the pilots contacted the tower controller, who cleared the airplane to land on runway 27R. About 1 minute later, the tower controller advised the flight crew that the right engine appeared to still be smoking; the timing correlated to the airplane’s position on an approximate 5-mile final. Radar data indicated that the airplane touched down about 1834. During the landing rollout, the flight crew queried the controller if a fire could still be seen on the right engine; the controller responded, “affirmative.” After landing, the autobrake remained engaged until the airplane had decelerated to about 40 knots. The captain stopped the airplane about 7,800 ft from the approach end of the runway. The flight crew informed airport rescue and firefighting (ARFF) via the tower frequency that there was an indication of hot brakes in addition to the engine fire. ARFF crews met the airplane on the runway and observed smoke and flames emanating from the right engine. ARFF sprayed the engine with fire-retardant foam and extinguished the fire. Afterward, the flight crew shut down the left engine, the airplane was towed to the gate, and the passengers disembarked via the jet bridge. PERSONNEL INFORMATIONSpecific training related to this event that the pilots accomplished was the following: Captain—engines and auxiliary power unit (APU), November 2, 2017. First officer—engines and APU, April 22, 2017; systems review for Airbus A330 engines and APU, September 9, 2017. Line check pilot—engines and APU, June 22, 2015; systems review for Airbus A330 engines and APU, September 1, 2017. Relief first officer—engine and APU, May 30, 2016; systems review for Airbus A330 engines and APU, October 3, 2017. Additional information about training appears in the Organizational and Management Information section of this report. AIRCRAFT INFORMATIONThe airplane was powered by two Pratt & Whitney PW4168A engines and was configured with 2 pilot seats, 2 cockpit observer seats, 12 flight attendant seats, and 293 passenger seats. The right engine had about 49,723 hours and 6,515 cycles since new and about 25,009 hours and 3,170 cycles since overhaul in Singapore in November 2012. The engine was installed on the accident airplane the next month. The A330’s fire indication system consisted of indications for the left and right engines. Each system comprised two detection loops that sensed a fire and/or overheat conditions. When the system sensors detected a high temperature, it would trigger an ECAM warning “ENG 1 (2) FIRE” and the Master Warning light illuminate the FIRE pushbutton light located on the center overhead panel and activate a continuous repetitive chime (except during take-off between V1 and lift-off +15 seconds). The fire loops were fire-resistant (not fireproof) and had a 5-minute certification requirement to function as designed. For a fire with a duration of more than the 5-minute certification requirement, the loops could be destroyed and fail to operate as intended. If a component in each loop fails, a FIRE DET FAULT caution would appear on the ECAM display to indicate that the system is no longer able to detect a fire. If the fire loops were to fail, DAL’s A330 operations manual required flight crews to monitor engine parameters more closely than normal for signs of fire and/or over-temperature. Airbus’ software for the ECAM was designed to provide stacking of messages in order of priority. Specifically, the software identifies the most important message and places it at the top of all the ECAM messages, and each subsequent message follows in order of importance. The system was also designed to stack all red warning messages on top of amber caution messages. The A330 has three closed-loop hydraulic systems. The blue hydraulic system is for the left engine, the yellow system is for the right engine, and the green system is for both engines, thereby providing hydraulic system redundancy. The hydraulic system operating pressure is regulated to 3,000 psi, and the reservoir tanks are pressurized to 70 psi. FDR data showed that the flight crew received a YELLOW HYDRAULIC RESERVOIR LOW LEVEL warning about 14 minutes after the ENG2 FIRE warning. The A330 was designed to isolate the engine from the wing/airframe in the event of a fire. The ECAM procedure instructs flight crews to pull back on the throttles to the idle position for the affected engine, and turn off the engine. When the engine master switch is selected off, the fuel low-pressure shutoff valve (SOV) in the pylon and the high-pressure SOV at the engine fuel pump both close, cutting off fuel flow to the engine. The crews were then instructed to press the engine fire button in the cockpit, which sends a signal to close the green and yellow hydraulic fire shutoff valves (FSOV) near the pylon. The hydraulic pressure (return) lines from the hydraulic engine-driven pumps (EDP) and the EDP case drain lines have inline one-way check valves that prevent hydraulic fluid from flowing back to the engine after passing through the check valve. The thrust reverser doors are attached to the engine pylon structure. The thrust reverser doors include an internal fixed structure that has two pressure relief doors on each side. The pressure relief doors were designed to prevent over-pressurization of the core compartment. The handbook instructed flight crews to discharge agent 1 (fire bottle No. 1) 10 seconds after the engine fire button was pressed to allow time for the FSOVs to close and for the undercowl airflow to subside as the engine rapidly spooled down. An explosive squib charge then punctures the fire bottle diaphragm, and pressurized halon is ducted through nozzles into the engine core compartment/fire zone. If the fire ECAM warning remains active 30 seconds after the first fire bottle was discharged, the crews were instructed to discharge agent 2 (fire bottle No. 2). DAL aviation maintenance technicians at Amsterdam Airport Schiphol (AMS), Schiphol, Netherlands, provided written statements that summarized the maintenance actions performed on the airplane on April 15, 2018 (3 days before the accident flight). The technicians noticed that fuel was puddling on the ground under the right engine drain mast during predeparture checks. The cowls were opened, and fuel was observed dripping from the main fuel supply hose (FM-13) to the pylon hydraulic interface panel connection, which are shown in figure 1. Figure 1. Pylon hydraulic interface panel connections (left) and hardware from the accident engine (right) (Source: left figure is from Pratt and Whitney’s “Hydraulic Interface Panel” part drawing). Note: The red circles show where dripping was first observed. The blue arrow shows the FM-13 hose. The FM-13 hose upper flange seal was replaced, and a right engine motor leak test was performed. No fuel leaks were observed during the leak test or subsequent postmaintenance/predeparture checks, and the airplane was returned to service. On April 17, 2018 (2 days and 2 flights later), maintenance crews at Amsterdam Airport Schiphol again observed fuel puddling under the right engine drain mast during predeparture checks. The technicians performed a visual inspection of the engine and reported that the FM-13 hose fire sleeve appeared wet and shiny and that the fire sleeve silicone exterior surface was torn. A leak check was performed, and which showed that fuel appeared to leak from the tear in the fire sleeve. The FM-13 hose and upper and lower seals were removed and replaced with new parts. No leaks were observed during post-maintenance/predeparture checks, and the airplane was returned to service. The accident engine fire occurred three flights later. AIRPORT INFORMATIONThe airplane was powered by two Pratt & Whitney PW4168A engines and was configured with 2 pilot seats, 2 cockpit observer seats, 12 flight attendant seats, and 293 passenger seats. The right engine had about 49,723 hours and 6,515 cycles since new and about 25,009 hours and 3,170 cycles since overhaul in Singapore in November 2012. The engine was installed on the accident airplane the next month. The A330’s fire indication system consisted of indications for the left and right engines. Each system comprised two detection loops that sensed a fire and/or overheat conditions. When the system sensors detected a high temperature, it would trigger an ECAM warning “ENG 1 (2) FIRE” and the Master Warning light illuminate the FIRE pushbutton light located on the center overhead panel and activate a continuous repetitive chime (except during take-off between V1 and lift-off +15 seconds). The fire loops were fire-resistant (not fireproof) and had a 5-minute certification requirement to function as designed. For a fire with a duration of more than the 5-minute certification requirement, the loops could be destroyed and fail to operate as intended. If a component in each loop fails, a FIRE DET FAULT caution would appear on the ECAM display to indicate that the system is no longer able to detect a fire. If the fire loops were to fail, DAL’s A330 operations manual required flight crews to monitor engine parameters more closely than normal for signs of fire and/or over-temperature. Airbus’ software for the ECAM was designed to provide stacking of messages in order of priority. Specifically, the software identifies the most important message and places it at the top of all the ECAM messages, and each subsequent message follows in order of importance. The system was also designed to stack all red warning messages on top of amber caution messages. The A330 has three closed-loop hydraulic systems. The blue hydraulic system is for the left engine, the yellow system is for the right engine, and the green system is for both engines, thereby providing hydraulic system redundancy. The hydraulic system operating pressure is regulated to 3,000 psi, and the reservoir tanks are pressurized to 70 psi. FDR data showed that the flight crew received a YELLOW HYDRAULIC RESERVOIR LOW LEVEL warning about 14 minutes after the ENG2 FIRE warning. The A330 was designed to isolate the engine from the wing/airframe in the event of a fire. The ECAM procedure instructs flight crews to pull back on the throttles to the idle position for the affected engine, and turn off the engine. When the engine master switch is selected off, the fuel low-pressure shutoff valve (SOV) in the pylon and the high-pressure SOV at the engine fuel pump both close, cutting off fuel flow to the engine. The crews were then instructed to press the engine fire button in the cockpit, which sends a signal to close the green and yellow hydraulic fire shutoff valves (FSOV) near the pylon. The hydraulic pressure (return) lines from the hydraulic engine-driven pumps (EDP) and the EDP case drain lines have inline one-way check valves that prevent hydraulic fluid from flowing back to the engine after passing through the check valve. The thrust reverser doors are attached to the engine pylon structure. The thrust reverser doors include an internal fixed structure that has two pressure relief doors on each side. The pressure relief doors were designed to prevent over-pressurization of the core compartment. The handbook instructed flight crews to discharge agent 1 (fire bottle No. 1) 10 seconds after the engine fire button was pressed to allow time for the FSOVs to close and for the undercowl airflow to subside as the engine rapidly spooled down. An explosive squib charge then punctures the fire bottle diaphragm, and pressurized halon is ducted through nozzles into the engine core compartment/fire zone. If the fire ECAM warning remains active 30 seconds after the first fire bottle was discharged, the crews were instructed to discharge agent 2 (fire bottle No. 2). DAL aviation maintenance technicians at Amsterdam Airport Schiphol (AMS), Schiphol, Netherlands, provided written statements that summarized the maintenance actions performed on the airplane on April 15, 2018 (3 days before the accident flight). The technicians noticed that fuel was puddling on the ground under the right engine drain mast during predeparture checks. The cowls were opened, and fuel was observed dripping from the main fuel supply hose (FM-13) to the pylon hydraulic interface panel connection, which are shown in figure 1. Figure 1. Pylon hydraulic interface panel connections (left) and hardware from the accident engine (right) (Source: left figure is from Pratt and Whitney’s “Hydraulic Interface Panel” part drawing). Note: The red circles show where dripping was first observed. The blue arrow shows the FM-13 hose. The FM-13 hose upper flange seal was replaced, and a right engine motor leak test was performed. No fuel leaks were observed during the leak test or subsequent postmaintenance/predeparture checks, and the airplane was returned to service. On April 17, 2018 (2 days and 2 flights later), maintenance crews at Amsterdam Airport Schiphol again observed fuel puddling under the right engine drain mast during predeparture checks. The technicians performed a visual inspection of the engine and reported that the FM-13 hose fire sleeve appeared wet and shiny and that the fire sleeve silicone exterior surface was torn. A leak check was performed, and which showed that fuel appeared to leak from the tear in the fire sleeve. The FM-13 hose and upper and lower seals were removed and replaced with new parts. No leaks were observed during post-maintenance/predeparture checks, and the airplane was returned to service. The accident engine fire occurred three flights later. WRECKAGE AND IMPACT INFORMATIONRight Engine The fire was isolated to the right engine, nacelle, and pylon and did not propagate to the airplane. The right engine had extensive thermal damage and sooting concentrated on its right side along the length of the engine core. Multiple pressure fuel components, including the fuel flow transmitter and fuel flow divider valve, were partially consumed by fire. The yellow hydraulic pump was fractured into two pieces, and the yellow hydraulic system case drain filter housing was fragmented and partially consumed. The bottom of the engine (6:00 position), including the accessory gearbox and integrated drive generator, were heavily sooted and coated in oily residue. A section of the turbine case cooling manifold was partially consumed between the 2:00 and 3:00 positions (aft looking forward). When the turbine case cooling line was removed, a piece of resolidified metal slag was found adhered to the low-pressure turbine (LPT) case, and hairline cracks were visible around the slag. The LPT case was shipped to the manufacturer, which determined that the metal slag was not from an engine internal component and that the case cracks and deformation were consistent with thermal distress (around 2400 degrees F/1300 degrees C). A leak check of the fuel manifold/fuel nozzles was performed to check for cracks at these locations. The fuel manifolds and fuel nozzle welds were cleaned, shop air was ported into the fuel flow divider, and leak detection fluid was sprayed on all manifold/nozzle surfaces around the engine. No leaks were detected. The full length of the integrated drive generator cable showed no evidence of localized burns that could be attributed to an electrical arc. The right engine pylon structure remained intact, but all lower pylon surfaces were discolored and sooted. The forward (green) hydraulic suction line, rear (yellow) hydraulic suction line, and forward (green) hydraulic case drain line were separated from the outboard side of the pylon hydraulic interface panel. The hose liners were either partially or completely consumed and were no longer capable of carrying fluid. The drip pan was discolored, sooted, and filled with charred debris, consistent with a fire in the pan at some point during the accident sequence. A borescope examination of the interior of the lower pylon structure found no evidence of fluid accumulation or coking residue. After the hydraulic and fuel hoses/lines from the bottom of the pylon were removed, a borescope probe was inserted into each opening to check the condition of the rigid pipes that feed from the pylon to the wing. Discoloration and coking were found in the hydraulic lines, but the main fuel supply pipe was in good condition. A visual inspection found that the pylon outer bulkhead was bowed. Hardness checks were performed on the pylon to determine if it could be repaired. The hardness measurements were below the minimum specification for multiple locations, so the entire pylon assembly had to be removed and replaced. FM-13 Hose Examination of the rigid fuel pipe, hydraulic interface panel, and FM-13 hose by the Airbus Materials Laboratory in Bremen, Germany, found that the FM-13 hose and rigid fuel pipe flange faces were deformed, the rigid fuel pipe was mounted on the wrong side of the hydraulic interface panel, and the radial offset due to the improper rigid fuel pipe installation was about 6.27 mm. According to an FM-13 hose drawing, the hose had an installation offset tolerance of ±17 mm. The rigid fuel pipe lower flange that mates to the FM-13 hose upper flange at the pylon interface panel was installed on the outboard (engine) side of the pylon hydraulic interface panel rather than on the inboard (pylon) side, as shown in figure 2. Figure 2.: FM-13 hose to rigid fuel pipe connection (Source: Airbus). Note: The Airbus A330-300 installation drawing appears on the left; the accident configuration appears on the right. To determine whether additional stress might have been placed on the rigid fuel pipe due to installation position, fluorescent penetrant and eddy current inspections were performed. These inspections did not identify any cracks in the pipe. When a straight-edge ruler was placed against the inboard side of the lower rigid fuel pipe flange, deformation was visible at all four corners. At the time of the first fuel leak, the FM-13 hose upper flange connection had been in place since December 2012, when the right engine was replaced. Maintenance records for the accident airplane were reviewed, and no evidence indicated that the rigid fuel pipe was disconnected from either the pylon or hydraulic interface panel between 2004 (when the airplane was delivered new from Airbus) to the accident flight. However, markings on the FM13 flange suggest successive correct and incorrect mountings of the FM13 interface since delivery. The FM-13 hose removed in AMS (during maintenance before the accident) and the accident FM-13 hose were shipped to the manufacturer in Fort Worth, Texas, for visual examination and pressure testing. A new seal® was used during the pressure tests because the elastomer on accident seal was thermally consumed and the seals that were removed in AMS were discarded. The AMS FM-13 hose removed in AMS was tested beyond its operational pressure, and no fuel leaks were detected. The fire sleeve was removed, and no damage was visible on the metal braid along the length of the hose. The FM-13 hose removed in AMS was bolted to the accident rigid fuel pipe flange and torqued in accordance with aircraft maintenance manual (AMM) procedures. The FM-13 hose was hung from a ladder to simulate the installation orientation on the airplane engine. No leaks were observed during multiple pressure cycles. The accident FM-13 hose was disassembled to separate the upper flange/hose nipple from the metal braid, and a steel plate was welded to the end of the nipple to create a watertight sealing surface. A plate was joined via brazing to the cut end of the rigid fuel pipe. The upper FM-13 flange and the opposing rigid fuel pipe flange were connected, and attaching hardware was torqued in accordance with the aircraft maintenance manual procedures. No leaks were observed during multiple pressure cycles. Green and Yellow Hydraulic Systems The green and yellow hydraulic system FSOVs and check valves, which isolate the engine when the master engine switch is selected off and the fire pushbutton is pressed, were functionally tested and examined. The fuel LPSOV was cycled open and closed during a boost pump check in the DAL TechOps maintenance hangar (during the on-scene portion of the investigation) and worked properly. The yellow and green hydraulic FSOVs were shipped to the manufacturer in Germany, where an acceptance test procedure and disassembly was completed. The yellow and green FSOVs both exceeded minimum specifications, and no internal anomalies were observed. The green and yellow hydraulic check valves were examined in the DAL TechOps maintenance hangar . The yellow hydraulic pressure check valve was pressurized to 61 psi for about 3 minutes to perform a low-pressure leak check, and a leak rate of four drops per minute was recorded. No other check valve anomalies were observed during pressure testing. The check valves were later sent to Airbus for additional testing, and the findings were consistent with the previous ones. The yellow engine-driven hydraulic pump, which was found fractured into two pieces, was shipped to the manufacturer in the United Kingdom for disassembly and materials analysis. The analysis concluded that the engine-driven pump was exposed to fire until the aluminum housing material failed. The engine-driven pump impeller was fractured into multiple pieces, which was also to the result of thermal exposure. No evidence indicated an internal failure before fire exposure. Engine Fire Extinguishing System The fire detection unit was shipped to the manufacturer for examination and testing. The testing determined that the unit functioned properly. The right engine halon fire bottles were weighed, and the recorded weight matched the empty bottle weight on the bottle label. The left and right engine halon bottles were confirmed to be part of the same manufacturing lot. The left engine fire bottles were removed and shipped to the manufacturer in California. The halon quality of each bottle was tested, and all parameters met specifications except for water content, which was 9 and 10 parts per million above the upper limit. According to the manufacturer, the high water content would not have affected fire bottle extinguishing capability.   TESTS AND RESEARCHPostaccident simulator testing was conducted with two DAL A330-qualified management pilots. A test scenario that the simulator pilots conducted was the accident flight. The simulation flight, from the beginning of the takeoff roll to the landing on the runway, was about 12 minutes. The simulator pilots noted that the accident crew did not fully run the landing performance calculations because the crew was familiar with ATL and would thus know that the landing runway was one of the longest in the southeast United States and would provide ample stopping distance for the landing. Multiple bench tests showed that the green and yellow hydraulic system FSOVs and check valves functioned according to design. A review of the A330-300/PW4168 system architecture identified, as the most probable leak point, an open yellow hydraulic system in-line case drain check valve. As a result, additional testing was conducted. Preliminary high-temperature hydraulic testing was performed at Airbus’ Hydraulics Laboratory, but testing at the fire temperature levels that occurred during the accident was not performed due to the risk of hydraulic fluid ignition and hazardous fumes. The Airbus Materials Laboratory then examined the yellow case drain check valve and found several small foreign deposits that had adhered to the inner wall of the valve. Energy-dispersive x-ray spectroscopy found that the composition of the foreign particles was consistent with stainless steel and aluminum. A new hydraulic case drain filter assembly was examined and tested to determine the filter’s material composition. The results showed that multiple parts of the filter were made from stainless steel. ORGANIZATIONAL AND MANAGEMENT INFORMATIONDocumentation that DAL provided indicated that pilots conducted engine fire checklists during several training events. The initial qualification syllabus, dated March 1, 2016, showed that pilots received this training for the A330 aircraft during ground school, computer-based training, and simulator training. The A330 flight crew continuing qualification training that occurred from January 2017 to December 2019 consisted of 64 requirements, including “Perform Fire Protection System Operations,” “Demonstrate Workload Management Skills,” “Demonstrate Situational Awareness Skills,” “Demonstrate Decision Making Skills,” and “Demonstrate Threat and Error Management Skills.” The continuing qualification curriculum from January 2014 to December 2016 also contained those five requirements. The accident flight crew would have participated in at least one of those training events. Additionally, according to information that DAL provided, during the continuing qualification training cycle between October 2017 and June 2018, flight crews were presented with a special-purpose operational training event for involving an engine fire that could not be extinguished; a similar event occurred during a DAL flight in 2016. The first officers on the accident flight might have had that training. (The completion of this was not tracked since it was considered a time-permitting training event.) A review of training syllabuses at DAL and four other US air carriers found no simulator training scenarios in which a simulated fire continued to burn and the fire indications were deactivated. Most of the operators simulated fire warning messages. The scenarios simulated a fire to the point at which the fire bottles would discharge and extinguish the fire or to the point at which the fire bottles, after being discharged, failed to extinguish the simulated fire but the fire warning message remained illuminated with the associated aural alert. According to a DAL representative, the following policy was provided to line check pilots about conducting a line check when an emergency occurs: Our guidance to line check pilots (LCP) is that during Line Checks the LCP is an independent observer. And this should be part of the Line Check briefing. If conditions deteriorate to the point that the safety of the flight is in jeopardy, and with the captains (PIC) direction/concurrence, the LCP can lend any assistance as directed. Status of the completion of the Line Check will be determined in coordination with the chief line check pilot (CLCP). As a result of the investigation, DAL updated its flight crew training manuals. DAL is creating a mandatory training module for the A330 initial qualification and continuing qualification training that will include a briefing of this event and a simulator session. The briefing will highlight the operation of the fire warning system and lack of warning if a fire remained unextinguished and will focus on ECAM priority and the need for an immediate landing. DAL is also modifying line check pilot guidance to emphasize when a line check should be stopped during an emergency so that the line check pilot can transition from evaluating a flight crewmember to assisting the flight crew. As a result of this investigation, Airbus updated the A330 integrated parts catalog (IPC) to clarify the installation position of the rigid fuel pipe flange against the hydraulic interface panel and updated its aircraft maintenance manual to warn maintenance personnel, when working on engines near fuel, hydraulic, and bleed lines, to be aware of the risk of flammable fluid leaks and subsequent fire if those lines are disturbed. The Delta Air Lines flight had departed from Hartsfield-Jackson Atlanta International Airport (ATL), Atlanta, Georgia. When the airplane was at an altitude of 700 ft, the flight crew received continuous warnings of a right engine fire. According to the crew’s statements, the captain transferred control of the airplane to the first officer and performed the required electronic centralized aircraft monitor (ECAM) procedures, including discharging both fire extinguishing bottles. However, the fire reignited before landing, and aircraft rescue and firefighting crews needed to extinguish the fire. Because the fire was not extinguished or re-ignited quickly (uncontrolled), the airplane sustained substantial damage to the right pylon. However, the fire remained contained in the engine compartment between the engine, nacelle and pylon components and there was no fire propagation to the aircraft. The right engine throttle was moved to the idle position 51 seconds after the fire warning first appeared, and the right engine was shut down 1 minute 36 seconds later. According to flight crewmember statements, they followed the required ECAM procedures and associated checklists and ran the landing performance calculations in a thorough manner. The airplane landed at ATL about 26 minutes after takeoff. Postaccident simulator testing revealed that a crew could land the airplane about 12 minutes after takeoff. One reason to explain the airplane’s additional time in the air is that the captain might have questioned the validity of the initial fire warning; his postaccident statement mentioned that the initial fire warning disappeared for several seconds and then reappeared. DFDR data showed that the alert transiently disappeared for about 1 second. Unfortunately, the Cockpit Voice Recorder (CVR) was overwritten after the event and any discussion between crew members about the engine fire was unrecoverable. In addition, about 10 minutes into the flight, a FIRE DET 2 ECAM alert was triggered, but was not directly displayed to the crew at that time since it was a lower priority than already displayed messages. The alert was triggered by thermal damage to both fire detection loops that were exposed to a fire longer than the 5-minute fire resistant certification requirement. This fault resulted in the ECAM fire alert and associated local fire indications being cancelled; simultaneously, the LAND ASAP message changed from red to amber on the ECAM display, despite an ongoing fire. This might have lessened the crew’s concern about landing immediately. Also, the flight crew might have thought that the fire had been extinguished, especially since the cabin crew could not confirm if the engine was still on fire. At the time of the fire detection fault, the airplane was being flown on an extended downwind. A few minutes later, the flight crew made a 270° left turn to enter the right base leg, adding about 4 minutes to the flight likely so that the crew could run the less urgent ECAM items. However, Airbus’ ECAM system logic did not account for an engine fire detection fault that would be triggered while the fire warning is already active, resulting in the fire warning being extinguished. DAL (and four other US air carriers) had no simulator training scenarios involving engine fires in which the simulated fire continued to burn after the halon bottles were discharged and the fire indications deactivated. Training scenarios simulated a fire that was either extinguished by the halon bottles or continued with fire warning messages remaining illuminated or audible. Although the fire warning remained active after the halon was discharged during this accident, it did cancel out when the fire loops were damaged. Thus, because the accident flight crew had not been trained on an in-flight engine fire event in which the cockpit fire indications cease after a significant time but a fire remains, may have been another reason why the flight crew believed the fire had been extinguished. When the halon bottles were discharged, the active fire should have been extinguished, but if all the leaked combustible fluids had not been consumed or drained before bottle discharge and fuel and hydraulic fluid continued to enter the engine compartment, the fire could have reignited after the halon dissipated. According to flight data recorder data, when the right engine was shut down, the engine parameters decreased at a nominal rate. About 9 minutes after the shutdown, the right engine exhaust gas temperature (EGT) spiked from about 200ºC (392ºF) to about 600ºC (1,112ºF). The spike in the data occurred when the EGT signal came back online and the EGT thermocouples registered the heat transfer from the engine fire to the engine case. Even though the right engine was shut down, its EGT was higher than the operating left engine’s EGT for about 8.5 minutes, at which time the right engine EGT began to decrease. This evidence indicated that the fire burned for a prolonged period after both fire bottles were discharged and the fire shutoff valves (FSOV) were closed. In the days preceding the accident, the airplane had undergone maintenance twice to address reported fuel leaks. The first fuel leak was observed from the FM-13 hose interface at the pylon panel. The FM-13 hose and upper and lower seals were replaced with new parts to address the second fuel leak. During the on-scene investigation, the pylon fuel connections were examined, and the interior of the pylon underwent a borescope examination. No fluid leaks were observed. However, the lower flange of the rigid fuel pipe appeared deformed. The rigid fuel pipe flange deformation might have affected the seal at the interface of the rigid fuel pipe flange, the seal, and the FM-13 hose flange. An improper seal fitting may have allowed fuel to leak from the FM-13 hose to the rigid fuel pipe interface, enabling fuel to run down the right side of the engine and pool at the bottom of the nacelle. The diffuser, turbine, and exhaust cases temperatures were hot enough to ignite the fuel. At ignition, an over-pressurization occurred, which opened all four pressure relief doors on the thrust reverser inner fixed structure. Because the fire was not due to an internal engine failure, the key engine parameters would have remained nominal. The FM-13 hose fire sleeve that was removed the day before the accident flight was reported to be wet and shiny, indicating that the fire sleeve had been saturated with fuel. If the replacement FM-13 hose fire sleeve had been saturated with fuel, the hose would have been a concentrated fuel source. The FM-13 hose is rated as fireproof, indicating that it can withstand 15 minutes of fire exposure, but the presence of fuel both underneath and on the fire sleeve would likely have reduced the hose liner protection and accelerated the failure. After engine shutdown and the closure of the low-pressure shutoff valve in the pylon and the high-pressure shutoff valve at the engine fuel pump, the residual fuel in the FM-13 hose and other fuel/hydraulic hoses would have leaked into the engine compartment when the hoses were thermally breached. Engine fuel components would have provided an additional fuel source when those parts were thermally damaged. The engine diffuser and turbine case surfaces reach operating temperatures high enough to ignite both fuel and hydraulic fluid, but a flammable fluid leak will not necessarily immediately ignite when it contacts hot cases surfaces. Variables such as undercowl airflow, leak type, and airplane attitude are all factors. The extensive soot and dark discoloration at the 6:00 position and along the right side of the engine core were consistent with a fuel-rich fire. The right side of the engine had substantially more thermal damage and discoloration compared with the left side, and multiple fuel and hydraulic components, hoses, and lines on the right side of the engine were thermally damaged or consumed. The fuel and hydraulic hoses/lines connected to the pylon hydraulic interface panel exhibited thermal damage, and several were thermally severed at the panel connection. A substantial amount of charred material and residue had accumulated in the drip pan located beneath the pylon panel (which directs fluid leaks downward through the 6:00 drain mast and then overboard). The severity of the thermal damage at the pylon panel and the charred debris in the drip panel indicated that there was an intense sustained fire that was likely fed by fuel and/or hydraulic fluid originating from the pylon panel interface. Soot and discoloration patterns on the right side of the engine further support this scenario. The first fault message triggered during the event, came from a component located on the bottom part of the engine, and extensive damage to several components in that area could also suggest a fire initiation around the 6:00 position. The concentrated damage to the hose/line connections at the hydraulic interface panel was consistent with a fire in the drip pan beneath the panel. Debris accumulation, coking, or a blockage at the bottom of the pan might have prevented the drain system from working properly. The plumbing from the bottom of the pan to the 6 o'clock drain mast under the engine was not flow tested for obstructions during the on-scene examination because all debris had been cleaned out the pan during and/or after the boost pump leak check. However, photos of the pylon hydraulic interface panel drip pan immediately after landing at ATL shows it full of debris. Hydraulic fluid is more difficult to ignite than fuel due to a higher ignition temperature and fire-inhibiting properties. The analysis of fault messages related to the low level of hydraulic fluids during the event provided an estimated leak rate and the time at which the leak may have started. Evidence suggested that the yellow hydraulic leak occurred after engine shutdown. Specifically, the yellow hydraulic system low level caution annunciated between 10 minutes 11 seconds and 12 minutes 11 seconds after the fire pushbutton was pressed. This finding indicated that hydraulic fluid loss occurred well after the FSOVs were closed. After landing, both the yellow and green hydraulic reservoirs were low on the hydraulic service panel gauges and on the cockpit hydraulic system display. A failure to shutoff hydraulic fluid from entering the designated engine fire zone following FSOV closure resulted in a fire that continued to burn after both halon bottles had been discharged. The amount of hydraulic fluid was limited to what was contained in the reservoirs. The yellow hydraulic reservoir low level ECAM procedures required the crew to shutdown the yellow hydraulic system electric pump, which the accident crew did, rendering spoilers 4 and 6 inoperable during the final 9.5 minutes to the flight. A review of the A330-300/PW4168 system architecture identified an open yellow hydraulic system in-line case drain check valve as the most probable leak point. However, multiple bench tests showed that the green and yellow hydraulic system FSOVs and check valves functioned according to design. Thus, the most likely reason that the yellow hydraulic system in-line case drain check valve might have allowed hydraulic fluid to enter the designated engine fire zone was a foreign debris obstruction. Source: NTSB Aviation Accident Database Retrieved: 2026-02-12

NTSB Findings

Hierarchical cause / factor breakdown from the FAA bulk avdata database. Each finding tagged C (Cause) or F (Factor).

• — Aircraft-Aircraft power plant-Engine fuel and control-Eng fuel sys wiring-Failure
• — Aircraft-Aircraft power plant-Engine fuel and control-Eng fuel sys wiring-Design
• — Aircraft-Aircraft power plant-Engine indicating system-Engine indication sys wiring-Damaged/degraded
• — Environmental issues-Task environment-Pressures/demands-Personal pressure-Decision related to condition
• — Organizational issues-Development-Manufacture/production-Document/info production-Manufacturer