| University of Bielefeld - Faculty of technology | |
|---|---|
|
Networks and distributed Systems
Research group of Prof. Peter B. Ladkin, Ph.D. |
|
| Back to Abstracts of References and Incidents | Back to Root |
This document is made available here with kind permission of H. Sogame.
PB84-910404
WASHINGTON, D.C. 20594
At 0856, on May 5, 1983, Eastern Air Lines, Inc., Flight 855, a Lockheed L-1011, N334EA, with 10 crewmembers and 162 passengers on board, departed Miami International Airport en route to Nassau, Bahamas. About 0915:15, while descending through 15,000 feet, the low oil pressure light on the No. 2 engine illuminated. The No. 2 engine was shut down, and the captain decided to return to Miami to land.
The airplane was cleared to Miami and began a climb to FL 200. While en route to Miami, the low oil pressure lights for engines Nos. 1 and 3 illuminated. At 0928:20, while at 16,000 feet, the No. 3 engine flamed out. At 0933:20, the No. 1 engine flamed out while the flightcrew was attempting to restart the No. 2 engine.
The airplane descended without power from about 13,000 feet to about 4,000 feet, at which time the No. 2 engine was restarted. The airplane made a one-engine landing at Miami International Airport at 0946. There were no injuries to the occupants.
The National Transportation Safety Board determines that the probable cause of the accident was the omission of all the O-ring seats on the master chip detector assemblies leading to the loss of lubrication and damage to the airplane's three engines as a result of the failure of mechanics to follow the established and proper procedures for the installation of master chip detectors in the engine lubrication system, the repeated failure of supervisory personnel to require mechanics to comply strictly with the prescribed installation procedures, and the failure of Eastern Air Lines management to assess adequately the significance of similar previous occurrences and to act effectively to institute corrective action.
Contributing to the cause of the accident was the failure of Federal Aviation Administration maintenance inspectors to assess the significance of the incidents involving master chip detectors and to take effective surveillance and enforcement measures to prevent the recurrence of the incidents.
On May 5, 1983, Eastern Air Lines, Inc., Flight 855, a Lockheed L-1011, N334EA, was a regularly scheduled passenger flight from Miami, Florida, to Nassau, New Providence Island, Bahamas. The flightcrew arrived well before the scheduled takeoff time and conducted all prescribed preflight activities. The captain recalled that the forecast weather conditions for the arrival at Nassau called for scattered rain showers.
At 0900, 1/ the weather conditions at Nassau were, in part: 500 feet scattered, 1,000 feetbroken, 7,000 feet overcast, visibility 4 miles with light rain and fog. Additionally, a frontal system extended north-northeast from extreme southern Florida and the Florida Keys. The weather conditions at Miami International Airport at 0900 were: ceiling 2,300 feet broken, visibility 7 miles, and no significant weather.
The flight engineer performed the "walk-around" inspection of the airplane. He stated that there were no indications of oil leaks from any of the engines. He also stated that there were no abnormal engine instrument readings during engine start or the taxi-to-takeoff.
At 0856, Flight 855 departed runway 27R at Miami International Airport with 162 passengers and a crew of 10 aboard. The flight was on an instrument flight rules (IFR) plan to Nassau with an estimated time en route of 37 minutes. At the time, the captain was sitting in the left cockpit seat, the check captain was sitting in the right cockpit seat, and the flight engineer was at his station at the engineer's panel.
The captain and the check captain stated that the takeoff and the initial climb to Flight Level (FL) 230 were uneventful. The flight engineer stated that he monitored the activities of the captain during takeoff and scanned the flight engineer's panel for abnormal indications; all engine instrument readings were normal. At 1,000 feet, 2/ the flight engineer turned back to his panel to regulate the cabin pressurization and the cabin cooling. The flight engineer stated that he also checked the electrical system and the engine instruments, and that, as the airplane passed through 1,500 feet, he called Eastern Air Lines at Miami to report the departure time. He then completed the climb checklist, called the Eastern Air Lines Miami Technical Center to establish contact with the flight dispatcher, and continued to scan the engine instruments. The flight engineer stated that from takeoff until the airplane was level at FL 230 the oil quantity gauges did not fluctuate, and that all three indicators were indicating about 18 quarts (full indication is 21 quarts).
About 0908:14, Flight 855 leveled at FL 230. About 0910, the flight was cleared to descend to 9,000 feet, and the captain began the descent. At 0911:17, the flight engineer contacted Nassau approach control and reported descending through FL 200, 70 miles from Nassau. Nassau approach control reported the weather as ceiling 1,000 feet broken and visibility 5 miles, ceilings to the east and south as 500 to 800 feet, and thunderstorms to the north. Nassau approach control informed Flight 855 that it was following a light twin-engine airplane which was about 30 miles ahead of it.
The flight engineer then prepared the landing card data for landing at Nassau and read the descent and in-range checklist in preparation for landing. He stated that he also received requests from the cabin attendants for routine items involving the passengers and the arrival at Nassau. The flight engineer stated that he did not scan his panel or the oil quantity or pressure gages for about 5 minutes because he was preparing the landing data information. During that time, he sat at a small desk in front of the engineer's panel. The oil pressure and quantity gages were at eye level.
As Flight 855 descended through 15,000 feet, the captain informed the flight engineer that the low oil pressure warning light was on for the No. 2 engine. The flight engineer stated that at this point he had finished the in range call and the landing data
card. He looked at the oil quantity and pressure gages and saw that Nos. 1 and 3 indicated about 15 quarts with the oil pressure in the "green" or acceptable range. However, the No. 2 engine indicated a quantity of 8 quarts, and the pressure was fluctuating between 15 psi and 25 psi. The flight engineer was not concerned with the quantity indications1 since he stated that he expected to see fluctuations of up to 3 quarts on either side of 18 quarts. However, he had never had an oil pressure problem with the L-1011. The flight engineer then advised the captain that the oil pressure on the No. 2 engine was fluctuating between 15 and 25 psi, that the minimum pressure required for, normal engine operation was 30 psi, and that the oil quantity gage for the engine was reading 8 quarts while the other two engines indicated about 15 quarts.
The captain ordered the flight engineer to shut down the No. 2 engine, and the captain started the auxiliary power unit (APU). At 0915:26, while at 12,300 feet, the captain requested a clearance back to Miami; the check captain concurred in the request. At the time, the airplane was about 50 miles from Nassau. The captain later stated that he elected to return to Miami rather than continue to Nassau because of the deteriorating weather conditions which had been reported at Nassau and which he had observed on airborne radar. Also, he anticipated some delay in landing at Nassau due to the nonradar environment and a light twin-engine airplane reported ahead of Flight 855, and he believed that he could land at Miami sooner than at Nassau.
At 0915:48, Flight 855 was cleared to make a 1800 turn and to maintain 12,000 feet. At 0918:11, Flight 855 contacted Miami Air Route Traffic Control Center (ARTCC), and at 0918:36, the flight was cleared to climb to FL 200. During this time the flight engineer completed the engine shutdown checklist and the secondary items on the emergency checklist. He said that these tasks required about 4 minutes to complete, so he was not constantly monitoring the indications on engines Nos. 1 and 3.
As the airplane climbed through 15,000 feet, the low oil pressure light for the No. 3 engine illuminated, followed by illumination of the light for the No. 1 engine. At that time, the oil quantity gages for all three engines read zero. At 0923:15, with the airplane level at 16,000 feet, Flight 855 informed Miami ARTCC of the engine gage readings but indicated that "we believe it to be faulty indications since the chance of all three engines having zero oil pressure and zero quantity ,is almost nil." The flight engineer then contacted the Miami Eastern Air Lines maintenance personnel to determine if there was a common electrical source which could affect the engine instruments. The captain stated that he assumed that the problem of low oil pressure and zero oil quantity for the three engines was a faulty indicator problem since the likelihood of simultaneous oil exhaustion in all three engines was "one in millions I would think." During this time, the Miami Technical Center called back to Flight 855 to say that the No. 2 AC bus was the common power source for the oil quantity instruments. The flight engineer checked the appropriate circuit breaker and found no discrepancies.
At 0928:20, the No. 3 engine failed. The airplane, which was about 80 miles from Miami, began a gradual descent. The flightcrew stated that they realized at this point that the indications of zero oil pressure and quantity were correct and were not the result of a gage problem.
At 0929:15, Miami ARTCC cleared Flight 855 to descend to any altitude required and to fly directly to Miami International Airport for a landing on runway 27L. The flight engineer called the senior flight attendant to the cockpit and instructed her to prepare the cabin for a ditching. The senior flight attendant, in turn, briefed the other flight attendants, who then began preditching preparations.
The flightcrew attempted to restart the No. 2 engine but was not successful; and at 0933:20, the No. 1 engine failed. The airplane was about 12,000 feet above the ocean. The rate of descent, which was about 600 feet per minute (fpm) with one engine operating, increased to about 1,600 fpm with no engines operating. The indicated airspeed remained about 225 knots throughout the descent. The APU provided hydraulic pressure and electrical power to the airplane after all engines stopped operating. As a result, the flightcrew had the ability to operate all the controls of the airplane despite the total loss of engine power.
At 0933:38, Flight 855 advised Miami ARTCC that no engines were operating; the airplane was about 55 miles from Miami. Shortly thereafter, the flight engineer announced over the public address system that a "ditching is imminent." The senior flight attendant assumed that the airplane was about to enter the water and instructed the passengers to assume the brace position.
Meanwhile, the Coast Guard and other potential rescue vessels were notified of the emergency by Miami ARTCC. The initial notification was made to Coast Guard District Headquarters at 0928:18. A Coast Guard Falconjet and a helicopter immediately departed the Coast Guard station at Opa Locka, Florida. At 0936, a helicopter and a C-130 airplane, both of which were already in flight from USCG Air Station, Clearwater, Florida, were diverted to assist Flight 855. Additionally, three more Coast Guard helicopters and another Falconjet were alerted and prepared to respond to the emergency. One Coast Guard cutter and five other patrol vessels were standing by at sea. An Air Force C-130 and a helicopter, both from Homestead Air Force Base, were alerted and were preparing to takeoff. All aircraft and surface vessels were alerted and either underway or preparing to get underway by 0944.
The captain attempted to restart the No. 2 engine for a second time but was unsuccessful. He then attempted to start the Nos. 3 and 1 engines, but again was unsuccessful; simultaneously, the flightcrew was proceeding through the ditching checklist. The captain then attempted a third time to start the No. 2 engine. At 0938:18, when the airplane was at 4,000 feet and with an indicated airspeed of about 250 knots, the No. 2 engine restarted. The airplane was about 22 miles from Miami. The descent was arrested at about 3,000 feet, and at 0940:20, a gradual climb was started to 3,900 feet. At 0943, Flight 855 leveled at 3,900 feet and began the final descent for landing at Miami International Airport. The passengers and flight attendants remained in the brace position until just before landing, when the captain announced that they would land at Miami. At 0946, the airplane landed.
Air traffic control reported to the captain after the airplane landed that smoke was emerging from the No. 1 engine. The captain discharged the fire bottles in the engine and the smoke stopped. He later discharged the firebottles in the No. 3 engine after smoke was reported to him by ground personnel. Because the airplane could not be taxied on the power generated by the No. 2 engine, it was towed to the gate and passengers deplaned normally at the terminal.
The accident occurred during the hours of daylight.
BACK TO TOP| Injuries | Crew | Passengers | Others |
| Fatal | 0 | 0 | 0 |
| Serious | 0 | 0 | 0 |
| Minor | 0 | 0 | 0 |
| None | 10 | 162 | 0 |
| Total | 10 | 162 | 0 |
The surface weather observations at Miami International Airport were, in part:
1.10 Aerodrome Information
Nassau International Airport is located 32 feet above mean sea level (m.s.l.) on New Providence Island, Bahamas. The landing area consists of three runways: 14/32, 9/27, and 5/23. Runway 14/32 is 11,000 feet long, by 150 feet wide, and runway 9/27 is 8,238 feet long by 150 feet wide. Runway 5/23 is 4,751 feet long and 150 feet wide. A VOR, 3/ which is located at the airport, is used as a navigation aid. The lowest landing minimum at Nassau International Airport is 1 mile visibility with a minimum descent altitude of 400 feet. There are no precision instrument approach procedures for the airport. The Nassau approach control is not a radar approach control facility.
Miami International Airport is located 10 feet above m.s.l. The landing area consists of three runways: runway 9L/27R is 10,502 by 200 feet; runway 9R/27L is 13,002
by 150 feet; and runway 12/30 is 9,601 by 150 feet. Each primary runway is served by a precision instrument approach procedure. The Miami approach control is a radar approach control facility.
The airplane was equipped with a Lockheed Model 209E digital flight data recorder (DFDR), Serial No. 1150, and a Fairchild A—100 cockpit voice recorder (CVR), serial No. 1553. The DFDR and CVR were removed from the airplane and taken to the Safety Board's Washington, D.C., laboratory for examination and read out. Neither recorder was damaged, and no discrepancies were noted in the examination of the recorders.
The quality of the CVR was good. However, because of the 30-minute storage limit, the recording began just after Flight 855 landed at Miami International Airport and covered the taxi and tow portions of the flight.
The DFDR, which records data for a period of 25 hours, was examined and found to be in good working order with the recording medium in place on all capstans, reels, and guides. The data graphs covered a 51-minute period ending with the landing at Miami International Airport. (See appendix E.)
| Landing Gear (If Ditching) | Up |
| Flaps | Full |
| Pitch Attitude (If Ditching) | 11deg. to 14deg. |
| Crew/Passengers | Braced for Landing |
The senior flight attendant attempted to find out the reason the airplane was returning to Miami. However, when she entered the cockpit she saw that the flightcrew was very busy, and the flight engineer motioned her to leave the cockpit. A short time later, she was called to the cockpit. When she opened the cockpit door, the flight engineer told her to "Prepare the cabin for ditching," and then he closed the door. She did not have the opportunity to ask about the emergency or the amount of time available to prepare the cabin. She called all the flight attendants forward and instructed them to prepare to ditch.
Once the flight attendants returned to their stations, the senior flight attendant used the public address system to instruct the passengers on donning their life vests. She said she assumed "that ditching was right now," so she wanted to have the passengers in their vests immediately. She recalled that she directed the passengers to reach under their seats to get the vests and then she gave them step-by-step instructions. The other flight attendants assisted passengers in donning vests and selected able bodied persons (ABP) who were briefed and positioned by the exits.
The senior flight attendant did not attempt to enter the cockpit again to determine how much time was available for ditching preparations. The next announcement from the flightcrew to come over the public address system was that ditching was imminent. The senior flight attendant said that she believed that the airplane was ready to land in the ocean and that she ordered the passengers and flight attendants to assume the brace position. 5/ The announcement that ditching was imminent was given while the airplane was at an altitude of 10,000 to 12,000 feet.
About 10 minutes later, the senior flight attendant became concerned about the length of time the passengers had been in the brace position. She looked out the window and saw the city of Miami. She then opened the cockpit door and the flight engineer told her to prepare for a normal landing. Simultaneously, the captain made the same announcement to the passengers.
The cockpit flightcrew did not inform the senior flight attendant of the amount of time available to prepare the cabin and passengers for ditching. Some flight attendants stated that they needed this information to schedule the time in which to perform their duties. Consequently, some flight attendants rushed through or cut short their preparations before the signal that ditching was imminent because they thought they were almost out of time. The senior flight attendant said that the cabin preparations were "very difficult" because they did not know the nature of the emergency or the time available before ditching.
The flight attendants cited the following observations:
Emotional State of Passengers.--
Generally the passengers were close to panic, especially after the flight engineer said that ditching was imminent. Some passengers screamed throughout the emergency. However, only a few passengers were unable to respond to instruction from the flight attendants; these passengers were assisted by other passengers and the flight attendants.
One flight attendant said that of the 15 persons in her section, 1 passenger was incapable of functioning and 3 or 4 others were close to uncontrolled panic because they were nonswimmers and had had problems with their life vests. However, all passengers were attended to by flight attendants, friends, or able bodied persons.
Life Vests.--
Some passengers had problems with retrieving/donning the life vests. Some passengers could not open the plastic packages in which the vests were stored. Many passenger had difficulty donning the life vests while seated with their lap belts fastened. Passengers were unable to pull down the back panel of the vest and, as a result, could not tighten the vests around their waists. Some flight attendants told passengers to unfasten their lap belts and to stand up if necessary to facilitate the donning of the life vests. Some flight attendants reported that they had to assist passengers into their life vests after the passengers had become "tangled" in the vests. At least two flight attendants stood on seats to again demonstrate donning of the life vest, a technique which passengers said was helpful. Flight attendants reported that in the sections with small children the children and their parents had difficulties with how to don the life vests, since most children put life vests on differently from adults. A child steps into a life vest, whereas an adult places the life vest over their heads.
The senior flight attendant instructed passengers over the public address system on how to don life vests and told them not to inflate the vests inside the cabin. Some passengers inflated the vests anyway.
Able Bodied Persons (ABP).--
Air Lines procedures require flight attendants to select and brief ABPs to assist with crowd control, doors, and slides. Some flight attendants reported that many male passengers turned down requests to assist the flight attendants. Some simply refused, while others declined after they heard what their duties would entail. Other passengers were not selected or refused to assist because they had drunk too much. Able bodied persons were assigned to all doors except one which was not manned because few passengers were seated in the section and there was a perceived lack of time to find another ABP.
Training.--
The flight attendants believed that Eastern's emergency training had been complete and had thoroughly prepared them for the emergency. They felt that they were in control of the situation at all times.
Relocation of Passengers
Once the ABPs were designated, they were located in the cabin near to the exits. No other passengers were relocated in the cabin. Flight attendants prepared to
open all of the exits but did not specifically tell passengers to use certain exits. Assignment of passengers to specific exits was not part of the Eastern Air Lines procedure.
Passengers reported that the routine predeparture briefing regarding oxygen masks, life vests, and other emergency procedures were given. However, they noted that they were not told that the life vests were folded and sealed in plastic containers. Many passengers stated that the flight attendants did a good job, preparing the passengers for the possible ditching. However, other passengers criticized the preditching preparations.
The Safety Board prepared a questionnaire concerning the emergency procedures and sent it to 139 passengers. Ninety-two persons completed and returned the questionnaire. Of the passengers who responded to the questionnaire, 81 recalled the preflight safety briefing and the original life vest donning demonstration. Seventy-seven passengers knew that the life vests were stowed under the seats; however, only 46 passengers had read the safety briefing card before takeoff.
Only 37 passengers recalled that the life vest donning demonstration was repeated during the emergency. Twenty-five passengers had problems locating the life vest stowage compartment and 29 passengers had difficulty removing the life vest package from the stowage compartment. Seventeen passengers had problems removing the life vest from the sealed plastic packages.
Sixty-three passengers indicated that they had some difficulty donning the life vests. One passenger said that he had trouble getting the vest over his head and pulling down the straps. Ultimately, a flight attendant pulled down the back flap for him; however, the passenger had to stand to put on the vest. Many passengers unbuckled their lapbelts and leaned forward to don their life vests. Although 57 passengers responded that they put on their life vests while seated with the lap belt fastened, 33 passengers did not. Eight passengers admitted to inflating the life vest; one passenger remarked that he did not want to wait until he was in the water before he found that the life vest would not inflate. Thirty-eight of the passengers said that a flight attendant instructed them to use a specific exit to evacuate the airplane. Sixty-nine passengers said they received direct assistance from a flight attendant or another passenger.
Of the 92 passengers who responded to the questionnaire, 4 were in first-class cabin A, 24 were in cabin B, 47 were in cabin C, and 11 were in cabin D. The locations of 6 passengers could not be determined from their questionnaires.
There was a small number of passengers in cabin A, and they were seated close to the flight attendant. As a result, eye contact was possible during the emergency briefing. Passengers in this cabin stated that instructions from the flight attendants were clear and professional.
Most passengers seated in cabin B believed that the flight attendants spent too much time briefing the ABPs. Many did not recall seeing flight attendants, and one passenger said the flight attendants "did not do much either to instruct or assist passengers." Most recalled receiving instructions over the public address system. Cabin B passengers also generally commented on the lack of information given on exit operation, the use of life rafts, and the confusing instructions about the brace position. One ABP said the flight attendant needed a manual, which she could not find, to explain the use of the life raft.
Passengers seated in cabin C had similar observations to those passengers in cabin B except that they noted that a male flight attendant stood on a seat to demonstrate how to don a life vest correctly. Passengers in cabin D said that the flight attendants appeared nervous, but gave clear and helpful instructions. Generally, passengers in cabin D were "very impressed" with the flight attendants, who were "very precise and well-informed about emergency procedures." Like passengers in the other cabin sections, many cabin D passengers needed direct assistance from the flight attendants and other passengers to don their life vests properly.
Many passengers felt neglected and uninformed. However, those who had received direct assistance from the flight attendants or otherwise had direct contact with flight attendants praised their professional manner. Many passengers stated that the flight attendants' lack of information about the emergency resulted in apprehension among the passengers and was the most difficult part of the emergency. Passengers cited inadequate responses to questions about postevacuation procedures and the expectations of whether the airplane would float or sink immediately.
Figure 2.-- RB-211 propulsion system general arrangement
and main rotating assemblies.
| Engine Component | Module No |
| LPC rotor (Fan) | 01 |
| IPC | 02 |
| Intermediate Module | 03 |
| High Pressure System | 04 |
| IPT & LPT Assemblies | 05 |
| External Gear Box | 06 |
| LPC Case | 07 |
| External Gearbox | Oil Tank | |
| Engine | (Quarts) | (Quarts) |
| No.1 | 4 | 1 |
| No.2 | 2 | 1 |
| No.3 | 3 | 2 |
Several components of the No. 3 engine were coated with a tacky oil film that had the appearance of freshly applied varnish. These components, which were located in the intermediate module, included: (1) the inner surface of the low pressure location bearing seal ring housing, (2) the front and rear face of the hydraulic seal fin and the rear of the seal ring land, (3) the low pressure location bearing assembly and its components, and (4) the internal walls of the intermediate-pressure compressor rear stubshaft and the front face of the oil weir (a small oil reservoir).
The intermediate pressure location bearing assembly and components were dry, severely overheated, and heavily discolored. A heavy buildup of fused ball material was found on the rolling surface of the intermediate pressure location bearing's inner race. The outer race rolling surface was filled completely with heavy deposits of fused ball material. Most of the bearing balls were reduced in size. The bearing balls retained their basic sphericity but were heavily discolored. Two balls had large flats which
complemented the deposited metal profile found on the inner and outer race rolling surfaces of the bearings. Both cage halves were heavily discolored and had fused metal deposits in all of the ball pockets; the silver plating was not severely discolored except where rubbing or ball or race material deposits were found.
The high pressure location bearing had seized and could not be rotated. Deposits of fused ball bearing material adhered to the rolling surfaces of the inner and outer races for the full 360º circumference.
The high pressure location bearing balls were severely overheated and were discolored. While most of the bearing balls generally retained some semblance of their original sphericity, all of the balls exhibited varying degrees of sliding and rotating flats which complimented the deposited metal profile found on the inner and outer races and cages. The configuration of the flats suggested that ball sliding had occurred on the cage halves and that rolling had occurred on the races.
The internal gearbox driven gear shaft, which was located in the internal gearbox assembly of the intermediate module, had moved radially outward making contact with the oil trough (baffle). One side of the baffle was broken. All driven gear shaft teeth were intact. The outer tips of the gear teeth were heavily smeared, and the gear had seized. Disassembly of the radial drive driven bevel gear housing assembly indicated that the ball bearing had seized and was heavily discolored. Flats were found on the bearing balls, and the cage was broken. The inner and outer roller bearings for the internal gearbox driven bevel gear were heavily discolored. Flats were generated on all of the rollers; the flats resulted from the rollers skidding without lubrication.
The high pressure compressor driving bevel gear of module 4 was locked solid due to the seizure of the high pressure location bearing. The gear teeth were all intact but were heavily smeared on the outer tips in a manner similar to the smaller corresponding driven gear teeth.
As a result of the loss of axial location of the high pressure location bearing and the radial location of the driven gears' ball bearings, the driving and driven gears moved outward. The engine then shut down because of a loss of gear mesh which disengaged the drive to the fuel pump.
No. 1 Engine
None of the components were covered with tacky oil as found in the No. 3 engine; however, some components located in the intermediate module were coated with a film of degraded oil. These components included the inner surface of the low pressure location bearing ring seal housing, the internal walls of the intermediate pressure compressor rear stubshaft, and the front face of the oil weir.
The intermediate pressure location bearing assembly was dry externally and noisy when it was rotated; however, it was easier to rotate than the No. 3 engine intermediate pressure location bearing. The internal components of the bearing were dry and discolored. Although all of the bearing balls retained their original sphericity and smooth surface texture, they were discolored and showed incipient rotational-type heat patterns over most of their rolling surfaces. The outer and inner race rolling surfaces retained their original shape and had a generally smooth surface texture. The inner and outer race ball tracks did not show any visual evidence of spalling. The bearing cage halves showed heat discoloration on the areas between the cage pockets, and the ball cage contact pattern was heavier than normal.
The high pressure location bearing assembly had seized and could not be rotated. The inner and outer races were dry and were severely overheated and discolored. Deposits of fused bearing ball material adhered to the rolling surfaces of the inner and outer races for the full 3600 circumference. The high pressure location bearing balls were severely overheated and were discolored. Most of the balls exhibited sliding and rotating flats and were irregularly shaped. The sliding flat patterns on the balls indicated that the balls were sliding on the forward land of the inner race and on the aft side of the ball track's outer race. All of the bearing cage pockets exhibited a fused metal buildup of ball material and were discolored. Lapping was also observed at the cage/inner race land area.
The internal gearbox driven gear shaft had moved radially outward making rotational contact with the oil baffle as in the No. 3 engine. This movement resulted in engine shutdown caused by the loss of the fuel pump drive. All of the remaining components of the internal gearbox assembly were in a condition similar to those found in the No. 3 engine, except that the oil baffle was intact and undamaged, and it exhibited a light rotational rub. Additionally, the radial drive driven bevel gear housing assembly ball bearing cage was not broken, and the inner and outer rollers of the roller bearings were not flattened.
No. 2 Engine
The results of the pre-repair test showed that all of the engine-measured parameters, including engine vibration levels, were within prescribed limits.
There was a slight amount of cage lapping on the high pressure location bearing between the cage bore and the inner race lands, and the silver plating was removed from the lapped area of the cage. The remaining location bearings and components were in normal condition.
The driven and driving bevel gears of the internal gearbox assembly were normally engaged and rotated freely. Disassembly of the radial drive driven bevel gear housing assembly showed that the ball bearings had surface heat discoloration on the outer race and on one-half of the bearing inner race and balls; however, the bearing's components retained their original shape and dimensions with the surface texture remaining smooth. The bearing cage had begun to make rubbing contact with the outer race lands, and the cage pockets were heavily scuffed. The rollers and the rolling surfaces of the inner roller bearing showed evidence of surface heat discoloration. The silver plating on the cage was intact and had normal color. Although the outer roller bearing was not discolored, it showed some cage lapping in the bore of the outer race.
1.17 Additional Information
1.17.1 Organization of Eastern Air Lines Line Maintenance
Table II depicts, in part, the organization of the Eastern Air Lines line maintenance department.
BACK TO TOP
The Eastern Air Line line maintenance department employs about 2,600 management and nonmanagement persons at 20 major line maintenance terminals in the continental United States. Line maintenance personnel perform various maintenance functions which are not classified as major or heavy maintenance, such as overhauls and extensive maintenance checks.
At the time of the accident, the Line Maintenance Manager at the Miami Maintenance Terminal, supervised three general foremen. Each general foreman supervises 2 or more foremen who, in turn, supervise lead mechanics and 30 to 32 airframe and powerplant (A&P) mechanics. The general foreman is responsible, in part, for the general supervision of maintenance activities; the assignment and the completion of the shift work load; the implementation of maintenance policy and procedures; and the training of mechanics.
Each foreman was responsible for distributing the work assignments to the mechanics before each shift. The mechanics, in turn, would complete the tasks and then sign the work cards or logbooks to certify the completion of the task. Work completed by an A&P mechanic was not required to be inspected unless a task was identified specifically as a task which required an inspector's signature; an inspector from the heavy maintenance section then would perform the inspection. Once the work assignments were completed, the A&P mechanics would return the work cards to the foreman.
Reports of Maintenance Status and Deficiencies--A maintenance conference call meeting is conducted each morning for the entire Eastern Air Lines maintenance system. Each maintenance manager, including managers of the major line maintenance terminals, and managers of other maintenance departments and representatives from propulsion engineering, aircraft engineering, and production control, participate in the meeting. Discussions during the meeting include the status of each individual airplane, which is out of service or which is scheduled to be out of service, with reasons for the out-of-service status, and the expected time of availability provided in detail. Requirements for parts, components, and special maintenance services are coordinated, and short term plans to support the maintenance program are established. Special items of interest and other information are also discussed. Managers of maintenance terminals relay significant information and maintenance requirements to terminal general foremen, who, in turn, brief foremen, lead mechanics, and mechanics on each shift.
Reliability Engineering Analysis and Planning (REAP) Programs -- The REAP program is a primary data analysis program used by the Eastern Air Lines maintenance department. Input to the program, which is administered by the Manager, Reliability Analysis-Operations Services, is obtained largely from reports of in-flight shutdowns, pilot reports, and reports of maintenance items causing delays and cancellations. However, problems, such as master chip detector problems which did not result in an engine shutdown or a delay/cancellation, are not entered in REAP. These incidents (missing master chip detector) would be reported at the morning maintenance conference call meeting. However, before May 1983, not all of this information was reported to the Flight Safety Department.
Reports within Eastern Air Lines and to the Federal Aviation Administration.--There are three reports which should contain information on master chip detector installation problems: the daily reports of all engine data prepared by the propulsion engineering department, the Mechanical Reliability Reports (MRR); and the Mechanical Interruption Reports (MIS).
The reports of engine performance are used for analysis of individual engines and to prepare MRR and MIS reports. Additionally, this data is the basis for the monthly Eastern Air Lines Fleet Reliability Report for the powerplant performance section. The fleet reliability report is published monthly, but the individual data is compiled and analyzed daily. The daily and monthly analyses included, in part, the number of in-flight shutdowns for each type of engine that month, as the monthly rate per 1,000 flying hours. The reason for each shutdown is included as a part of the report.
The data on RB211 master chip detector installation incidents which were entered in the REAP program would be analyzed by the L-1011 project engineer; the chief engineer, Rolls Royce engines; the director, quality assurance; and the chief engineer.
MRR and MIS reports are required by the FAA. Under 14 CFR 121.703, an MRR must be submitted when certain failures or defects occur in an aircraft. Under 14 CFR 121.705, an MIS report must be submitted when there is an interruption to a scheduled flight for known or suspected difficulties which are not required to be reported in the MRR. Master chip detector installation incidents which resulted in inflight shutdowns or unscheduled landings were reported to the FAA through MRR's and MIS's. Those incidents not reported by these means are included in the Eastern Air Lines Fleet Reliability Report, which also is sent to the FAA.
1.17.2 Master Chip Detector Assembly
A master magnetic chip detector (see figure 1) is positioned on the left hand side of the low pressure compressor case (see module 7, figure 2). A magnetic probe, which is part of the detector, protrudes into the oil line by opening a check valve and attracts small particles of metal which may be present in the line. Metal particles in the oil line indicate that internal components of the engine are in a state of distress and that an engine may fail if the defect is not corrected. Each master chip detector has two O-ring seals on the magnetic probe of the assembly. O-ring seals are placed on the master chip detector by stretching two seals over the magnetic probe end of the assembly and seating a seal in each of the two retaining grooves on the magnetic probe which prevents oil from leaking from the pressurized oil system once the master chip detector is inserted in the engine, and displaces the check valve.
If a master chip detector is inserted into the oil system without O-ring seals, an oil leak will begin as soon as the engine is started. Although no leak-rate tests were conducted, about 15 quarts leaked out of engines Nos. 1 and 3 in the accident airplane in about 33 to 37 minutes. If a master chip detector falls out or is inadvertently not installed, the check seal in the oil line closes and prevents a serious oil leak. However, a small amount of oil will continue to leak through the check valve as the engine is operated. After an engine without a master chip detector is operated for about 5 hours, the oil leakage will result in a low oil pressure warning light. Installation of a master chip detector without O-ring seals or with defective O-ring seals will open the check valve and result in an oil leak at an undetermined rate. However, if installed, both seals must be single O-ring seal is sufficient to seal the oil system. Oil which escapes around a master chip detector will leak out of the engine and seep out the oil drains in the engine cowl.
The inspection interval for master chip detectors in Rolls Royce RB211 engines was originally 250 flight-hours. However, in September 1981, the engine manufacturer recommended to all operators of RB211 engines that the inspection interval be reduced to a nominal 25 flight-hours. The recommendation was made following a meeting attended by Rolls Royce, RB211 operators, and the FAA to discuss problems that the RB211 was experiencing, some of which resulted in the in-flight failures of the RB211 engine. 6/ Before September 1981, Eastern Air Lines removed, inspected and replaced the master chip detector at each "A" check (about each 90 flight-hours). O-ring seals were replaced only if they were defective.
Since September 1981, master chip detectors have been removed and inspected by Eastern Air Lines at 22-flight-hour intervals when an airplane remains overnight at an Eastern Air Lines maintenance station which has the capability to perform the master chip detector check (Miami, Atlanta, New York, Boston, and Newark). If the airplane is not scheduled into one of these maintenance stations, inspection intervals can go as high as 40 flight-hours.
After a master chip detector is removed from an engine by the mechanic, it is examined by an Eastern Air Lines technical field representative who evaluates the amount of metal particles on the detector. The results are coded and recorded for each engine, and then the field technician cleans the metal particles from the detector and, in Miami, returns it to a cabinet in the foreman's office. If a substantial amount of metal particles is found, the detector is sent to the Eastern Air Lines' laboratory for analysis of the metal particles, and then it is returned to the supply system.
Eastern Air Lines states that only qualified A and P mechanics perform the master chip detector check. Eastern Air Lines Engineering Department estimated that more than 100,000 master chip detectors have been changed since October 1981. Since the master chip detector check is conducted so frequently, Eastern Air Lines estimated that each line maintenance mechanic involved in the accident had performed over 100 detector changes.
1.17.3 RB211 In-flight Shutdown Experience
The in-flight shutdown (IFSD) rate for RB211 engines is monitored daily and reported to the FAA monthly in the Eastern Air Lines Fleet Reliability Report. The following IFSD data shows RB211 engine performance as reported by Eastern Air Lines.
| 1981 | 1982 | 1983 | ||||
| Monthly | Monthly | Monthly | Monthly | Monthly | Monthly | |
| Number | Rate | Number | Rate | Number | Rate | |
| January | 4 | 0.17 | 12 | 0.62 | 11 | 0.66 |
| February | 4 | 0.2 | 12 | 0.69 | 5 | 0.34 |
| March | 6 | 0.3 | 13 | 0.67 | 5 | 0.31 |
| April | 2 | 0.1 | 4 | 0.21 | 8 | 0.47 |
| May | 4 | 0.22 | 13 | 0.69 | 8 | 0.53 |
| June | 2 | 0.1 | 8 | 0.44 | ||
| July | 3 | 0.14 | 8 | 0.4 | ||
| August | 3 | 0.15 | 8 | 0.43 | ||
| September | 10 | 0.54 | 5 | 0.29 | ||
| October | 18 | 0.95 | 10 | 0.55 | ||
| November | 16 | 0.88 | 12 | 0.68 | ||
| December | 11 | 0.57 | 18 | 1.02 |
As a result of two Eastern Air Line incidents of fan shaft failures (May 25, 1981 and September 22, 1981) and a similar Delta Airlines incident on August 10, 1981, flightcrews were told to immediately shut down RB211 engines at the first indication of engine vibration on the airborne vibration monitoring system (AVM). The AVM system continuously senses and indicates engine vibration levels and provides a visual warning of excessive vibration or an out-of-balance condition in the main rotating assemblies. On September 22, 1981, the Eastern Air Lines L-1011 Flight Manual pertaining to powerplant abnormal procedures was changed to require, in effect, immediate shutdown upon indication of engine vibrations. On October 5, 1981, an airworthiness directive was issued to address the problem.
The Eastern Air Lines, Director, Propulsion Engineering, stated that the engine shutdowns due to AVM indications were a primary concern of the propulsion engineering department personnel who were aware of engine shutdowns related to master chip detectors. However, they believed that the master chip detector related problems were due to improper implementation of valid procedures, and did not constitute an engineering problem.
The propulsion engineering director stated that Eastern Air Lines had conferred with counterparts at other airlines operating RB211 engines. He said that essentially all the airlines were using the same procedure as Eastern Air Lines but that they were not experiencing the same in-flight shutdown problems as Eastern Air Lines.
BACK TO TOP
Consequently, Eastern Air Lines concluded that the procedure to check master chip detectors was valid and that the master chip detector installation problems were the result of personnel errors.
1.17.4 Eastern Air Lines Maintenance Procedures
On May 4, 1983, N334EA arrived at Miami International Airport and was parked overnight at the Eastern Air Lines terminal. The general foreman on the night No. 3 shift was responsible for the completion of the scheduled work card tasks on N334EA, and to correct any logbook items. The work assignments for the logbook items and the scheduled work cards were made by a foreman. Work card 7204 was given to two mechanics to complete the master chip detector check. The procedure followed in the check was outlined in detail in Eastern Air Lines Routine Work Card 7204. (See figure 3.) As each step of the work card was completed, the assigned mechanic completing that work was supposed to sign off the procedure. However, in this case, where work was performed by two different mechanics, all work card requirements were signed off by the same mechanic and the work card was returned to the foreman. (See figure 3.)
Aside from initial New Employee Training, 7/ no other special training was given to mechanics by Eastern Air Lines on how to perform the tasks required by work card 7204. However, in December 1981 after three L-1011 airplanes experienced in-flight engine shutdowns due to loss of oil, Eastern Air Lines issued Special Training Procedures (STP) 49-81. The STP coincided with a revision of work card 7204 (see figure 3) and was intended to correct the line maintenance problem caused by the improper installation of master chip detectors. The new work card included a requirement for the mechanic to replace the O-ring seals on the master chip detectors and to motor the engines to check for leaks in the oil system. The motor check, which was required to check the oil system for leaks consisted of activating the starter for each engine for an unspecified period of time to pressurize the oil system and to move oil through the system. STP 49-81 states, in part:
Immediately after the May 5, 1983 accident, Eastern Air Lines changed the procedures set out in work card 7204 so that master chip detectors are no longer issued with O-rings installed. Instead, as of May 17, 1983, master chip detectors are issued with O-rings that are packaged separately and are attached to the master chip detector package. Additionally, mechanics are now required to motor each engine not less than 30 seconds and not more than 2 minutes to check for oil leaks.
1.17.5 Work Card 7204 Application to N334EA
Two A and P mechanics were assigned to N334EA to accomplish the requirements of work card 7204. About 0130 on May 5, 1983, one mechanic went to the cabinet in the foreman's office to pick up three master chip detectors to replace the t ree he planned to remove from the airplane; however, there were none in the cabinet. Both mechanics testified that they had always obtained the master chip detectors f om the foreman's office with the O-ring seals already installed. When the mechanic did not find any master chip detectors in the cabinet, he went to the stock room and drew three master chip detectors from supply. He stated that this was the first time he had ever drawn the detectors from supply. Each master chip detector was packaged in semi transparent sealed plastic with a serviceable parts tag attached to each package.
The mechanic gave one sealed plastic package to the other mechanic who was to replace the master chip detector on the No. 2 engine. He then went to replace detectors on engines Nos. 1 and 3. The division of the work card tasks was routine, since engines Nos. 1 and 3 could be serviced while standing on the ground. Engine No. 2 required a stand for the mechanic to reach the engine.
The mechanic who changed the detectors on engines Nos. 1 and 3 drove to the airplane on a tug with the master chip detectors still in the sealed plastic packages on the seat next to him. He used the headlights of the tug for lighting the oil service door on engine No. 1. (See figure 4.) He stated that he had worked the night shift for several months and that the working conditions were normal for him.
He first went to engine No. 1, and he had to placed his hand inside the oil service door 4 to 6 inches to reach the detector. He then removed the master chip detector from the engine. (See figure 5.) He stated that he could not simultaneously place his hand on the master chip detector and look at the detector, so he usually removed and replaced master chip detectors by feel. The mechanic said that he did not examine the replacement magnetic chip detectors to insure that the 0—ring seals were installed. He said he had assumed that they were installed because the sealed plastic package had a serviceable parts tag, and because previous master chip detectors he had installed always had had O-ring seals installed. He inserted the replacement master chip detector in the No. 1 engine and then proceeded to the No. 3 engine where he repeated the procedure. He stated that he could not feel any difference between a master chip detector with O-ring seals and one without O-ring seals once the detector was installed in the engine. He then waited for the other mechanic to replace the master chip detector on the No. 2 engine.
Click to show Figure (69KB JPG)
Figure 4. -- Oil service door and chip detector location, engine No. 1.
The mechanic who worked on the No. 2 engine first performed a walk-around inspection of N334EA. He said that the master chip detector he received from the other mechanic was in a semitransparent sealed plastic package which had a serviceable parts tag attached to it. The mechanic said that "when it has a 'serviceable tag' attached to the part, the part is ready to be placed into service. When we get other parts from stock rooms that require O-rings or kits, they always, most always, come in the same container as the part. So that you know that it is not on the part or that you need to place it with the part."
The mechanic used a lift truck which had been positioned by the airplane to lift himself up to the No. 2 engine. He opened the oil service door and went into the engine (see figure 6). A light was located inside the engine cowling; however, a flashlight was required to see the engine parts clearly. The master chip detector was located directly over his head, so with one hand he removed the old master chip detector and with a rag in his other hand he reached up to catch the dripping oil. He then installed the new detector which he had placed on a ledge in the cowling. The old detector, which had been
Click to show Figure (48KB JPG)
Figure 5. -- Mechanic's access to chip detector.
removed, was put in the plastic package. He did not inspect the replacement master chip detector for O-ring seals, even though he said it was his responsibility to insure that the master chip detector was configured properly before he inserted it in the engine.
The mechanic who replaced the master chip detectors on engines Nos. 1 and 3 went to the cockpit to motor the engines. The three engines were motored for about 10 seconds each, and then were inspected. There were no oil leaks observed at any of the master chip detectors. Work card 7204 and the logbook were signed off as the work having been completed. Eastern Air Lines had no specific procedure which told mechanics how long to motor an engine to detect leaks. The two mechanics who worked on N334EA said that they believed that 10 seconds per engine was a sufficient length of time to motor an RB211 engine.
The master chip detectors which had been replaced were returned to the technical field representative so he could inspect each detector for metal particles. After the inspection, one of the mechanics returned the three master chip detectors to the stock room instead of leaving the master chip detectors with the technical field representative.
The two mechanics who replaced the master chip detectors on N334EA made the following points in testimony given after the accident:
1.17.6 Interviews With Eastern Air Lines Maintenance Management Personnel
The Miami manager stated that since the May 5, 1983, accident Eastern Air Lines had changed the procedure for issuing master chip detectors and O-ring seals and had established minimum and maximum times for engine motoring. He said he was surprised that the night general foreman was unaware of the new procedures.
Director of Line Maintenance, Eastern Air Lines
General Foreman
The general foreman of the night shift said that he had been aware of several other incidents involving oil leaks resulting from either missing or defective O-ring seals, and/or master chip detectors which had fallen out in-flight. He had reviewed STP 49-81 and had discussed the content of the publication with the foremen. He assumed that all mechanics had been instructed by the foremen concerning STP 49-81.
He stated that work card 7204 required mechanics to replace the O-ring seals. However, when he was asked if he knew of any mechanic who routinely replaced O-ring seals on master chip detectors, he stated that he did not know of any. He also said that mechanics usually received master chip detectors with the O-ring seals already installed, but that he did not know who actually put the O-ring seals on the detectors. He also stated that it was unusual for a mechanic to draw master chip detectors from the stock room. He expected mechanics to motor an engine until the oil pressure peaked, but he did not have in mind a minimum time period needed to accomplish the motoring check. He was asked on May 16, 1983, if Eastern Air Lines had new procedures governing the installation of master chip detectors or for motoring engines; he was unaware of any new procedures.
Manager, Aircraft Maintenance, Miami Terminal
The Miami manager for aircraft maintenance supervises the three work shifts at the Eastern Air Lines Miami Terminal. His workforce consists of about 18 foremen and 140 mechanics. He is the direct supervisor of each of the general foremen on each of the three shifts. The Miami manager said that he had been aware of the incidents of oil leaks resulting from master chip detectors/O-ring seal problems. (See Section 1.17.8.) However, he had become aware of the number (12) of incidents only after the May 5, 1983, accident. He believed that since the 12 incidents were scattered over Eastern Air Line's system; most maintenance managers were not aware of the actual numbers. He stated that there had been no changes to the specific maintenance procedures required by work card 7204 between December 1981 and May 5, 1983. He also stated that he had had no conversation with any FAA representative concerning master chip detectors, O-ring seals, or Eastern Air Lines maintenance procedures relating to these matters until after the accident.
The Miami manager believed that the day shift had been replacing the O-ring seals on the master chip detectors, after which they had been putting them in the cabinet in the foreman's office. He said the two mechanics should not have returned the master chip detectors that had been removed from N334EA to the stockroom, and that the detectors should have been left with the field technical representative.
The Director of Line Maintenance stated that the procedure outlined on work card 7204 was the procedure approved by Eastern Air Lines. It was the responsibility of the mechanic performing the work required by card 7204 to replace the O-ring seals. He
was unable to explain why the two mechanics had never replaced the O-ring seals. Hespeculated that in the past the O-ring seals on the master chip detectors had been replaced by persons other than the mechanics doing the work on work card 7204 or that some master chip detectors were simply cleaned and reused without changing O-ring seals. However, he stressed that the only violation of Eastern Air Lines procedures in that case would occur if the mechanic failed to place new O-ring seals on a master chip detector before it was installed in the engine.
After the first incidents involving the improper installation of master chip detectors in September-November 1981, the Director of Line Maintenance met with the FAA principal maintenance inspector to resolve the problems. At that time, the FAA principal maintenance inspector advised him to take corrective measures, or the FAA would mandate a new procedure. As a result, in December 1981, work card 7204 was revised and a special training procedure was developed to explain how to implement the new work card.
The Director of Line Maintenance said he was aware of the numbers of incidents and of the circumstances of each of the incidents involving the improper installation of master chip detectors. He stated that each incident had been discussed at the maintenance conference-call meeting. He believed that each line maintenance manager was aware of the incidents and that the master chip detector installation problem was known throughout the Eastern Air Lines maintenance system. However, after each subsequent incident he had personally examined the work card procedures and had been satisfied that they were adequate. Additionally, each incident was investigated by maintenance supervisors at individual bases to determine the cause of the improper installation of the detector. Where appropriate, he insured that disciplinary action (letter of reprimand, retraining, suspension from work without pay) was taken against the maintenance personnel involved in the incident. He reaffirmed that the work card procedure was the appropriate method, but said that ultimately the individual mechanic was responsible to actually perform the work specified by the card. He stated that when a mechanic signs that a part has been placed on a component, and the part and component are identified by part numbers, he expects the work to be done properly. However, he admitted that the recent accident revealed that there was confusion on the implementation of work card 7204. Further, Eastern Air Lines had revised the procedures since May 5, 1983, to avert further confusion.
1.17.7 FAA Principal Maintenance Inspector
The FAA principal maintenance inspector (PMI) stated that maintenance surveillance of Eastern Air Lines was performed by himself and two or three assistant maintenance inspectors at Miami. FAA maintenance inspectors from other offices would also perform surveillance and forward reports to the principal inspector. The PMI monitored the quality of Eastern Air Lines maintenance through daily and weekly reports submitted to the FAA by the airline, by actual observation of work practices during all three shifts and through discussions with Eastern Air Lines maintenance management. Between October 1982 and May 1983, over 500 maintenance surveillance inspections of Eastern Air Lines were performed at Miami and at other Eastern Air Lines stations by FAA maintenance inspectors.
The FAA PMI received daily MRRs and MISs from Eastern Air Lines, as well as other reports from propulsion engineering and data from FAA logbook inspections. On a monthly basis, the FAA received the fleet reliability report, the REAP report, the Aircraft/Engine Utilization Report (FAA Form 8320-1), and several other sources of data for trend analysis. Items which are judged significant or which by are required by
regulation are written up as Service Difficult Reports (SDR) (FAA Form 8070-1). SDRs are sent to the FAA Flight Standards National Field Office and entered in the FAA SDR program. A weekly compilation of every SDR is sent to each FAA field office. There were no SDRs submitted on the Eastern Air Lines master chip detector installation incidents since those incidents were not required by regulation and were not judged significant by the FAA PML A review of the FAA SDR file produced three incidents related to master chip detectors in the air carrier fleet. The PMI stated that the SDR program was not a good tool to identify master chip detector incidents since very few incidents would be reported through the program. He said that a personnel-procedural situation as represented by the master chip detector installation problems is best observed and resolved by frequent contact with the airline and the mechanics.
The PMI stated that if the FAA identifies an issue which warrants unusual surveillance or distribution to other offices, a "Special Report on Significant Failures, Malfunctions and Defects" is prepared. The preparation of this report is based on the subjective judgment of the FAA inspector of what constitutes a major item affecting safety. The report is forwarded to all FAA FSDOs and GADOs. The principal maintenance inspector did not consider the master chip detector installation problem to be of sufficient magnitude to warrant the preparation of this report.
The FAA PMI stated that the FAA had been aware of every incident involving master chip detectors or O-ring seals. The incidents were reported weekly by Eastern Air Lines. After the September-November 1981 incidents, the FAA directed Eastern Air Lines to modify work card 7204. The Eastern Air Lines response was to revise the work card in December 1981. The work card procedure was approved by the FAA. The revised work card required the mechanic to replace the O-ring seals on every inspection, and to motor the engines to check for oil leaks. Eastern Air Lines supplemented the new work card with STP 49-81 to train mechanics on the procedures. Once the new work card was in use, FAA inspectors met in January 1982 with the maintenance managers from the vice president level to individual foremen to discuss the implementation of the new procedures. As a result of these actions, the FAA principal maintenance inspector said he was satisfied that the problem of missing O-ring seals had been corrected. The FAA considered the new work procedures adequate to address problems which resulted in missing or defective O-ring seals. However, after STP 49-81 was implemented and before this accident, eight incidents occurred in which O-rings were defective or master chip detectors were improperly installed. In each case, the FAA concluded that the individual mechanic and not Eastern Air Lines maintenance procedures was at fault. As a result, no additional revisions of the work card were required by the FAA. The FAA's surveillance of each incident consisted of evaluating Eastern Air Lines' investigation of the incident and insuring that the involved personnel were disciplined and retrained. The FAA PMI stated that he did not consider the problem with master chip detector and O-ring seal installations a major, systemic problem, and did not assign a special surveillance priority to it. He stated that, as a result of the May 5, 1983, accident, the FAA would continue to monitor the implementation of work card 7204 to insure that the problems with master chip detector and O-ring seal installations were solved by the new work card requirements which were imposed May 17, 1983. However, aside from instructing FAA inspectors to observe mechanics performing the tasks of the new work card when possible, he said he planned no different surveillance procedures.
Nevertheless, immediately after the May 5, 1983, accident, the Miami Flight Standards District Office initiated a program to observe the manner in which the Eastern Air Lines work cards were issued and the procedures fulfilled. Additional inspections were made of the maintenance station, and the hours of the inspections were varied to
monitor all shifts. The supply room stock of master chip detectors was inspected at each maintenance station where the master chip detector check was done. All detectors not packaged to meet the new work card requirements (without O-ring seals installed) were removed.
On June 9, 1983, the FAA started a special emphasis program of all air carriers in the Southern Region, including Eastern Air Lines, which was to run for 60 days, to determine the following:
| Station Completing | |||
| Date | Cause | Work Card 7204 | Failure |
| 9-2-81 | One engine shut down; | Miami | Master chip |
| "completed flight," | detector not | ||
| installed. | |||
| 11-9 -81 | One engine shut down; | Atlanta | O-ring seals |
| unscheduled landing. | missing. | ||
| 11-11-81 | One engine shut down; | Miami | O-ring seals |
| unscheduled landing. | missing. | ||
| 12-12-81 | One engine shut down; | JFK | Master chip de-- |
| unscheduled landing. | tector improperly | ||
| installed. | |||
| 1-14-82 | One engine shut down; | JFK | O-ring seals |
| unscheduled landing. | missing. | ||
| 1-14-82 | No engine shut down; | Atlanta | Master chip |
| "completed flight," | detector not | ||
| installed. | |||
| 3-24-82 | One engine shut down; | Boston | Master chip de-- |
| completed flight. | tector improperly | ||
| installed. | |||
| 8-19-82 | No engine shut down; | Miami | Master chip |
| completed flight. | detector missing. | ||
| 10-11-82 | No engine shut down; | Miami | O-ring seals |
| completed flight. | leaking. | ||
| 12-2-82 | One engine shut down; | Miami | O-ring seals |
| unscheduled landing. | deteriorated. | ||
| 12 -14-82 | One engine shut down; | Miami | O-ring seals |
| unscheduled landing. | damaged. | ||
| 3-7-83 | No engine shut down; | Miami | O-ring seals |
| unscheduled landing. | missing. | ||
| 5-5-83 | Three engines shut down; | Miami | O-ring seals |
| emergency landing. | missing on all | ||
| three master | |||
| chip detectors. |
Results of New Procedures. -- a result of the new measures, Eastern Air Lines has had no in-flight shutdowns of RB211 engines due to master chip detector installation problems since the measures were incorporated.
1.17.11 Flight Safety Department
The Flight Safety Department consists of the Manager, Flight Safety, and one project engineer. The manager, flight safety reports directly to the Vice President-Flight Operations and Safety.
The function of the flight safety department, in part, is to analyze the flight operations and maintenance functions of Eastern Air Lines and to identify safety problems. The safety problems are resolved in the department responsible for the particular area where the deficiency or trend was observed.
Using a computer, the flight safety department records daily operational and maintenance data which is used to identify trends. The retrieval programs permit data recall by individual airplane, airplane type, or by type of malfunction.
The responsibility for reviewing and entering the daily operational and maintenance data into the computer for trend analysis is assigned to the project engineer. Previously, this duty was performed by an analyst in the flight safety department. However, the analyst position and the department secretary position were eliminated in 1983, and the current staffing level of two persons was established. The manager, flight safety stated that while the department has the means to conduct trend and data analysis, the shortage of adequate personnel has limited his ability to establish a data bank and to do complete trend analysis. He said that since the May 5, 1983 accident, his department has been receiving all the daily maintenance and operational reports for entry into the data bank. The emphasis on trend analysis, along with the other duties of the flight safety department, has increased significantly the department's workload, but additional manpower resources to operate the data analysis program has not been provided.
1.17.12 Eastern Air Lines Training Mechanics
Supervisory Personnel
Foremen at Eastern Air Lines are promoted from the mechanic ranks. The initial training is a 1-day supervisory assessment center which is an introduction to management. The new foremen then attend a 1-week nontechnical management training course to prepare them for management.
Pilot training and Flight Attendant Training
Pilots and flight attendants do not train together. Each group covers various flight manual tasks during initial and recurrent training, with the training emphasis on individual or team responsibilities. There is no guidance for coordination between the flight deck crew and the flight attendants other than the coordination from following the applicable manuals, which are supposed to insure that each group will perform in a cohesive manner at all times.
Flight attendant training stresses actual "hands-on" operation of slides, doors, window exits, life vests, and liferafts during each recurrent training. Role playing sessions are included in recurrent training to demonstrate techniques to accomplish passenger briefings, emergency landing/ditching procedures, and other flight attendant duties.
1.17.13 Lockheed L-1011 Ditching Certification
The Lockheed L-1011 received its type certification dated February 1, 1965, based on compliance with the provisions of 14 CFR 25. Compliance with the optional ditching provisions in 14 CFR 25.801 also was established. The regulation states that it must be shown that under reasonably probable water conditions, the flotation time and the attitude of the airplane in the water (trim) will allow the occupants to leave the airplane and to enter liferafts. The regulation further states that compliance with the ditching provisions_ must be established by investigating the probable behavior of the airplane in water using model tests, or by comparing it with airplanes of similar configuration for which the ditching characteristics are known.
The L-1011 compliance with 14 CFR 25.801 was documented in Lockheed Report Number LR 23416, "L-1011 Ditching and Flotation Behavior." Compliance was based, in part, on data developed from previous studies, such as "Model Ditching Investigation of the Boeing 707 Jet Transport," performed by the National Advisory Committee for Aeronautics, in 1955.
The optimal ditching configuration for the L-1011 was found to be landing gear retracted, flaps at landing setting, and an attitude of 12º airplane nose up, which corresponds to an airspeed of about 1.1 times the stall speed of the airplane in this con figuration. Under these conditions, the wing engine supports, flaps, and horizontal stabilizer were expected to fail during every ditching. However, the fuselage was not expected to fail if the correct ditching configuration and procedures were followed. The center engine could separate during severe landing conditions, such as high rates of descent, with the undercarriage down, or it might be carried away if the horizontal stabilizer were lost.
The ditching study assumes a moderate sea state (3- to 5-foot waves) at ditching. Upon initial ditching, and before water has leaked into the pressurized areas
of the fuselage, the height of the door sills above the waterline would range from about 71 inches at the forward doors to about 19 inches at the aft doors, even with the airplane's center of gravity at the most aft limit. The waterline would reach the sill of the aft doors about 10 to 14 minutes after impact, as water leaked into cargo compartments and the galley.
The loss of any major structure aft of the aft pressure bulkhead would improve the final static flotation since the height of the aft doors above the waterline would increase. The loss of the center engine would raise the aft doors by about 5 inches (to about 24 inches above the waterline). The minimum time of flotation for evacuation of the airplane was conservatively estimated at 20 to 25 minutes, thus allowing sufficient time for the occupants to leave the airplane and to enter liferafts.
At 0930 on May 5, 1983, the sea state in the ocean east of Miami would have been classified as calm or smooth (waves 0 feet to 1 foot). 10/ The 8-knot wind reported at Miami International Airport equated to a "gentle breeze" (Beaufort No. .3) on the Beaufort Scale, 11/ and the observation at sea was 'large wavelets; crests beginning to break; scattered whitecaps." The water temperature was recorded at 79deg. at the west edge of the Gulfstream, and getting cooler to the east.
1.18 New Investigative Techniques
The captain and the check captain stated that the decision to return to Miami was influenced by the length of time required to land the airplane from its position about 50 miles west of Nassau. The weather report the flight engineer received from Nassau at 0912 indicated a 1,000-foot ceiling, with lower ceilings to the south and east, and thunderstorms to the north. Since the instrument approach to Nassau International Airport required navigating to the southeast of the airport, the captain could expect low-level flight in IFR conditions before landing. Additionally, since Nassau had no radar coverage, he could not be given radar vectors either around the traffic which had been reported ahead of him, or directly to the airport. The last two factors would have required additional low-level flight to complete the instrument approach at Nassau International Airport. On the other hand, the captain knew that he could make a straight-in, VFR approach at Miami. The captain said that after analyzing the options available, he determined that he would be able to land in less time by returning to Miami International Airport.
The Safety Board concludes that, given the information available, the captain made an appropriate decision. The captain's estimate that he could land sooner at Miami was probably correct in view of the weather conditions at Nassau. Additionally, the possibility of a missed approach existed at Nassau International Airport, while Miami weather insured a VFR landing. Finally, there was no urgent reason to attempt a two-engine nonprecision instrument approach when a less demanding VFR landing could be made in substantially the same or perhaps even a reduced timeframe.
The Safety Board examined the flightcrew's analysis of the meaning of the oil quantity and pressure gage indications. The shutdown of the No. 2 engine about 0915:15, after the indications of low oil pressure and quantity, was the proper decision. The Safety Board is concerned, however, that the flight engineer had not noted the declining gage indications, especially the oil pressure, before the low oil pressure light illuminated. As a result, the captain had to call the flight engineer's attention to the flight engineers panel, instead of the flight engineer observing the oil pressure and quantity indications first. The flight engineer was occupied with his proper duties preparing for the landing at Nassau. However, by his own admission, he had not scanned the engine gages for about 5 minutes before the No. 2 low oil pressure light came on. The primary duty of the flight engineer was to monitor the engine instruments--a responsibility which should be done continuously during a flight, and not in between other duties. Additionally, his work station was directly in front of the engine instruments, which were at eye level, so a standard scan of the gages could have been done easily.
Additionally, the Safety Board believes that it would have been unusual for the No. 2 engine to have indicated about 8 quarts of oil quantity at 0915 when there were indications of 15 quarts on engines Nos. 1 and 3. Only 8 minutes later, engines Nos. 1 and 3 indicated zero oil pressure and the low oil pressure lights had illuminated. These events indicate that either a rapid loss of oil from engines Nos. 1 and 3 occurred after engine No. 2 was shut down, or that there was actually less than 15 quarts of oil in engines Nos. 1 and 3 when the individual gages indicated 15 quarts. The normal fluctuations of the oil quantity gage, especially in climb and descent, may have given slightly erroneous readings to the flight engineer. However, since he said that the oil quantity gages vary up to 3 quarts, he should have been concerned that the quantity of the oil in the other engines could have been as low as 12 quarts at 0915.
Once the airplane had been cleared to return to Miami and to climb to FL 200, the flight engineer was again occupied with cockpit checklist activities. He said that in the 4 or 5 minutes after the No. 2 engine was shut down, he did not notice any declining indications on engines Nos. 1 and 3 until the low oil pressure lights again illuminated. The
Safety Board accepts the statement that he was occupied with the secondary items on the emergency checklist. However, once again the flight engineer allowed 4 or 5 minutes to pass without monitoring the engine instruments. As a result, the oil pressure and quantity gages on engines Nos. 1 and 3 declined to a marginal condition before the captain was advised of the situation.
After the flight engineer announced that the oil quantities on all three engines were zero, the flightcrew had 5 or 6 minutes to analyze and resolve the problem before the No. 3 engine flamed out at 0928:20. The initial conclusion of all three crewmembers was that they Were experiencing indicator problems with the oil pressure gages. The flightcrew's disbelief of the visual indications was because each crewmember considered the possibility of total simultaneous oil depletion on three engines as virtually nonexistent.
There were other reasons why the flightcrew would have examined the situation first as an instrumentation problem. First, as each stated, the likelihood of total simultaneous oil depletion was improbable, and had never occurred on any L-1011; second, all their previous experience would indicate a malfunction with the oil pressure and quantity indicators, since gage and indicator malfunctions are not uncommon events in commercial airplanes; and third, they were unaware of other incidents involving engine shutdowns due to master chip detector installation problems. Consequently, the flightcrew immediately contacted the Miami Technical Center to determine if a single power failure could cause indicator malfunctions. As the inquiry was made to the Technical Center, the flightcrew examined the engine and electrical systems in the cockpit.
>From a practical position, the analysis of the problem by the flightcrew was logical, and was what most pilots probably would have done if confronted by the same situation. Ideally, a pilot "should always believe his instruments." However, pilots must also analyze information to validate the meaning of the instruments. In this situation, logic said that the engine oil instruments were wrong, and that a less obvious, malfunction had occurred. As a result, the first cause of investigation was the electrical system, and the flightcrew proceeded in that analysis according to the proper procedure.
Also, the flightcrew's initial analysis was logical because there was little else that could have been done other than to troubleshoot the possible malfunctions. The airplane was commited to return to Miami when the problem was discovered. The climb was immediately stopped at 16,000 feet and the analysis of the facts was started. The only other course of action was to shut down the No. 3 engine when the low oil pressure light illuminated. However, that action would still not have resolved the zero oil quantity indication on the No. 1 engine.
Finally, the flightcrew's analysis of the problem was constrained by the timespan of the events. Only 5 or 6 minutes were available from the first recognition of the zero oil quantity until the No. 3 engine flamed out. The No. 3 engine flamed out just as they ascertained that there was no indicator problem, with the result that there was no time to take any other corrective action even if one had existed. Consequently, the Safety Board believes that the flightcrew's actions to identify and correct the problem were logical, especially when considering the time available to analyze the problem and the options available to them.
The decision to climb to FL200 en route to Miami was normal at the time the climb was started. The Safety Board considered the possibility that the selection of climb power to return to Miami may have contributed to an increased rate of oil loss during that
stage of the flight. The oil loss resulted in the flame out of both engines. It is possible that a landing at Nassau could have been made before engines No. 1 and 3 flamed out. However, because the actual oil-loss rate and the time needed to land at Nassau are not known, the Safety Board could not determine when the engines would have flamed out had the captain decided to land at Nassau International Airport, or had he elected not to climb to a higher altitude during the return flight to Miami.
2.3 The Accident
All the damage to the three engines was caused by the continued operation of the engines without adequate oil lubrication. The lack of oil lubrication in the engines was due to the leaking of oil resulting from the absence of O-ring seals in the retaining grooves of the master chip detector magnetic probes.
The heat-bearing material transfer and fusion damage to the high pressure bearing races and balls in the Nos. 1 and 3 engines caused the bearings to lose normal axial operational location, which resulted in the rearward displacement of the high pressure compressor rotor assembly and caused the gear teeth of the radial drive driven bevel gear shaft to "smear" with the gear teeth of the high pressure compressor drive bevel gear. The loss of engagement of gear teeth which followed disconnected the drive to the engine fuel pump and resulted in a loss of fuel flow. Consequently, the engines stopped operating because of a flame-out. Although the bearings were seized in the postaccident examination, they did not seize until the engines cooled and the molten bearings solidified. The physical condition of the location bearings of engines Nos. 1 and 3 indicated that they were almost in a molten condition caused by the heat generated by the lack of oil lubrication when the respective flame-outs occurred. The engine bearings also would have seized ultimately had the engines not flamed out. All damage to engines Nos. 1 and 3 was heat-related and caused by oil deprivation.
The No. 2 engine sustained some heat-associated damage, but it did not flame out because it was shut down early in the emergency. Heat damage was confined to discoloration of the radial drive driven bevel gear ball bearing and the roller bearing in the intermediate internal gearbox assembly. Further damage was avoided because the engine was shut down at the first indication of oil pressure/oil quantity problems. However, the engine would have failed for the same reasons the other engines failed had it been necessary to operate the No. 2 engine much longer than it was operated on Flight 855. The amount of oil remaining in the No. 2 engine was less than the amount which remained in engines Nos. 1 and 3, which had already flamed out. This fact indicates that the No. 2 engine was close to flame out when the airplane landed at 0946.
2.4 Maintenance Procedures
Eastern Air Lines Work Card 7204
The Safety Board concludes that a major element in the accident lies in the performance of maintenance procedures and supervision of the performance of maintenance procedures applicable to the master chip detector. Based on an examination of the task requirements and procedures set forth in work card 7204, the work card is easy to understand and concise in describing the steps required to remove and reinstall a master chip detector, and to inspect the installation of the master chip detector for oil leaks. Furthermore, if each step had been performed according to the work card and signed-off as the step was completed, the master chip detectors would not have been reinstalled in the engines without O-ring seals. It is obvious to the Safety Board that the work card required a mechanic to place new O-ring seals on each master chip detector before installing it on an engine.
Task No. 5, "motor the engine and check the chip detector for leaks" was not a very specific instruction. Although the task did not deal with the mechanic putting O-ring seals on the master chip detector, it was the final check on whether the entire task had been performed correctly. Specific guidance on how long an engine should be motored would have provided a valid check for a leak at the master chip detector. The mechanics involved in the accident believed that 10 seconds was sufficient to detect an oil leak, while the general foreman did not know how much time was required to produce a leak if the master chip detector was improperly installed. Furthermore, the mechanics and the general foreman were not aware of how far the oil had to travel to reach the point in the system where the master chip detector was located. As a result, the "guess" that 10 seconds was sufficient to check the system for oil leaks was arbitrary. After the accident, Eastern Air Lines raised the minimum time for a positive motoring check to 30 seconds after Eastern Air Lines tests indicated that a leak could be noted after motoring the engine for about 20 seconds. The failure to specify a minimum time for the motoring check when it was incorporated on work card 7204 was a maintenance procedure deficiency. Testimony by the mechanics and the manner in which engines were motored indicated that the motoring check requirement was not thoroughly planned before it was included on work card 7204. The Safety Board believes that the improperly installed master chip detectors would have been detected if the motoring check had been more accurately defined by Eastern Air Lines before the accident and followed by the mechanics who worked on N334EA.
The Mechanics
Both mechanics who replaced the master chip detector assemblies on N334EA acknowledged that they were responsible for insuring that the O-ring seals were in the proper grooves on the assembly before the assembly was installed on the engines. Both mechanics held A and P ratings, which should have signified a high degree of competency and responsibility. Their failure to complete correctly the relatively simple task of installing master chip detectors and their failure to follow approved work card 7204 procedures are indicative of unprofessional work habits.
The investigation of the accident revealed several factors which may have influenced the actions of the mechanics. The first factor was the frequency with which master chip detectors are changed and the ease in which the installation is completed. "Routineness" of any task can lead to unquestioning, nonattentive action and, in this accident, both mechanics demonstrated a lack of attention to the procedures and an unquestioning assumption that the detectors came with "O"-ring seals installed.
The second factor which may have influenced the actions of the mechanics was that master chip detectors had been drawn routinely with O-ring seals in place. Work card 7204 clearly states that the mechanic will place new O-ring seals on the detectors before installation of the master chip detectors in the engines. The mechanics stated that they understood this requirement of the work card, but stated that they thought the O-ring seals were being replaced by either the dayshift or the technical field representative. They believed, as a result, that they did not have to replace the O-ring seals. In fact, they each stated that they always had obtained master chip detectors with O-ring seals already in place from a container in the foreman's office. Conseauently, the assumption that the "O"-ring seals had been replaced was continuously reinforced each night that the mechanics were assigned work card 7204. The fact that they had received the master chip detectors from their supervisor's office probably added to their acceptance of the assumption. Because the work card requirement to replace the seals usually had not been a task they had actually performed, it became normal practice for the mechanics to sign it off as having been accomplished, when in fact the procedure usually was not done as part of the work card tasks.
The third factor which may have influenced the mechanic's actions was that master chip detectors drawn from the stockroom, rather than from the cabinet in the foreman's office, had serviceable tags attached to each detector. Therefore, each mechanic incorrectly assumed that the part was ready to install. Neither mechanic checked to see if there were O-ring seals on the master chip detector or in the plastic package, having again, made the assumption that someone had already replaced the seals.
Another factor involved in the accident was the lack of illumination at the engine work site and the procedure employed to install the master chip detector by feel through the access panel on engines Nos. 1 and 3. The limited illumination, while standard for the night shift, make it more difficult to detect the absence of O-ring seals without deliberate inspection of the master chip detector. Also, the lack of illumination in the maintenance area and the physical limitation imposed by installing the detector by feel could affect a mechanic's ability to detect the condition of a magnetic chip detector from the time it was removed from its semi-transparent package until it was installed in an engine.
The Safety Board believes that although the above factors might provide some rationale for the mechanics' actions, it does not excuse the mechanics' failures to adhere to the proper maintenance procedures. The mechanics were required to place O-ring seals on the detectors by work card 7204 and, as skilled and licensed mechanics, they should have inspected the detectors that they placed in the engine. Additionally, the work card was signed, signifying that new O-ring seals had been placed on the master chip detector when in fact they had not. As a result, the Safety Board concludes that the master chip dectectors were installed without O-ring seals because the mechanics failed to follow the required workcard procedures, and because they failed to perform their duties with the professional care expected of an A & P mechanic.
Eastern Air Lines Maintenance Supervision
The most significant supervisory shortcoming was the lack of quality control at the general foreman level; the general foreman should have detected and corrected the improper implementation of work card 7204. The general foreman stated that the mechanics were supposed to replace the O-ring seals. However, he also admitted that he did not know of any mechanics who had actually replaced the O-ring seals. He also did not know how the O-ring seals were installed on the master chip detectors except "that is the way they come from supply." These facts indicate that the general foreman was aware that the published procedure was not being followed scrupulously, yet took no steps to correct the situation or to discover why the procedural deviation was occurring.
The lack of procedural guidance for the motoring check on work card 7204 was a deficiency in Eastern Air Lines maintenance supervision. The fact that the mechanics and the general foreman had no clear idea concerning the time necessary to accomplish the motoring procedure point to the fact that the maintenance personnel were given insufficient guidance and training and subsequently did not know how to perform the check properly.
The Safety Board cannot understand why the general foreman failed to correct the master chip detector installation problem after he became aware of some of the earlier incidents involving missing or defective O-ring seals. He had written a memorandum on the subject 2 months before the accident, and should have insured that his foremen and mechanics were trained to perform work card 7204 properly.
On May 17, 1983, Eastern Air Lines issued a revised work card 7204. On the previous day, the general foreman, who was responsible to implement the workcard, stated that he was not aware that any new procedures were being developed. Moreover, the general foreman had not closely checked to see that the mechanics who worked on N334EA were given the training required by STP 49-81 regarding work card 7204, which they denied having received. The general foreman's response was that the material was posted and that all mechanics were expected to comply with the guidance. However, there was no supervisory followup to insure that mechanics and foremen were incorporating the training material into the work requirements. These facts indicate a lack of firstline maintenance supervision, poor communication between the general foreman and higher and lower levels within the Eastern Air Lines maintenance organization, and little management oversight of training. Use of binders and bulletin boards is not an effective means of controlling the dissemination of important work procedures, especially when there is no accountability system in place to enable supervisors to insure that all mechanics had seen the applicable training and procedural information.
Eastern Air Lines Maintenance Management
The Safety Board also concludes that maintenance management deficiencies existed beyond the first level of supervision. It was apparent from testimony by Eastern Air Lines managers that the problem involving master chip detector installations was known at all levels within the maintenance structure above the foreman and the mechanic levels. Additionally, maintenance managers were aware of the numbers of incidents as they occurred over the 20-month period. The concern with the problem was not limited to the line maintenance department, but was examined by personnel in the propulsion engineering department and in the reliability analysis service. All incidents were reported monthly in the fleet reliability report and to the FAA principal maintenance inspector. Consequently, the failure of Eastern Air Lines middle and upper management to take corrective measures on the issue was not the result of a lack of a proper reporting system. To the contrary, Eastern Air Lines had an adequate and timely system to detect and report maintenance items throughout the airline's system.
The Safety Board believes, however, that the maintenance management system was deficient in its ability to use the information at hand, to analyze a specific problem, and to arrive at a proper solution. Over a period of 20 months, 12 separate incidents involving O-ring seals and master chip detector installation problems were reported to the Director, Line Maintenance. Corrective measures were taken in December 1981 after the first three incidents; however, those measures were primarily in response to the installation of master chip detectors without O-ring seals. The nine additional incidents after December 1981 resulted in the same consequences as the first three -- in-flight engine shutdowns and unscheduled landings. These incidents all involved master chip detectors and loss of engine oil, but resulted, for the most part, from missing master chip detectors and defective O-rings. In every incident, Eastern Air Lines management investigated the circumstances and concluded that the problem was with the mechanics and not with the maintenance procedure. Consequently, no initiatives were taken by upper or middle management to either improve the procedure or to publicize the incidents to encourage mechanics to be more careful when installing master chip detectors. Instead, the incidents were addressed through individual disciplinary actions and training, which obviously did not resolve the problem. The other alternative would have been to change the work card procedures to conform to the manner in which the mechanics were actually performing the work. At least this revision would have established a uniform, approved procedure.
An examination of the in-flight engine shutdown data for the period starting in September 1981 indicates a large increase in RB211 shutdowns, most of which were due to false AVM indications. As a result, the incidents of engine shutdowns, because of master chip detector problems did not represent a significant number. However, the cumulative totals should have warned Eastern Air Line maintenance managers of a systemic problem rather than a series of unrelated mechanic discrepancies. Consequently, the Safety Board concludes that despite an adequate system to gather data in a timely manner, Eastern Air Lines failed to conduct a proper analysis of the master chip detector problem, and thus failed to take proper management corrective actions.
A second maintenance management shortcoming was the failure to communicate information concerning master chip detector installation problems. Although the various incidents were reported upward in the management structure, there appeared to be no flow of information back to the general foreman level. As the Director, Line Maintenance and the managers of the propulsion engineering department became aware of continuing master chip detector installation problems, an information bulletin or another STP would have been appropriate to alert foremen and mechanics. However, testimony by mechanics and the general foreman indicated that they were uninformed by the magnitude of the master chip detector installation problem. As a result, this installation continued to be a routine work item.
The significance of the lack of effective maintenance analysis and management is underscored by the fact that since May 5, 1983, no in-flight shutdowns of RB211 engines for master chip detector reasons have been reported. The various measures taken after the accident involving Flight 855 prove that it was possible to resolve the problem, and that the solution could be effective. Corrective action should have been implemented well before a wide-body jet experienced the flame-out/shutdown of all three engines.
The Safety Board believes that the safety analysis and trend identification function at Eastern Air Line would have been improved if the Flight Safety Department had been more actively involved in maintenance data analysis. Since May 5, 1983, the Flight Safety Department has been receiving all maintenance data and can now identify and track various trends. The existence of an independent office within an airline, which can cut across departmental lines to analyze data and trends, is important. The Flight Safety Department can examine data without becoming too close to the subject to be objective. Additionally, it can serve as a backup to the data analysis systems already established in the maintenance and flight departments. However, the Flight Safety Department should have the access to safety related data.
BACK TO TOP2.5 Federal Aviation Administration Surveillance
The FAA principal maintenance inspector and other FAA maintenance inspectors were aware of every master chip detector installation problem that Eastern Air Lines experienced between September 1981 and May 1983. The incidents were reported by Eastern Air Lines to the FAA, and were analyzed as part of the established surveillance program. The normal activities of the surveillance program included the review of maintenance reports and data, logbook analysis, and onsight observation of Eastern Air Lines maintenance activities. This information provided the FAA maintenance inspectors with the basis for analysis of the program and the means to identify unsafe maintenance trends.
However, the focus of the FAA surveillance activities was limited to the first incidents in which O-rings were not placed on master chip detectors. Once the new work card procedures were approved in December 1981, the FAA did not follow up to insure
that the new procedures were followed or that they were effective in eliminating the full scope of master chip detector installation problems. The fact that nine additional incidents, many involving in-flight shutdowns and unscheduled landings, occurred proves that the FAA did no systematic analysis of the continuing problem. Instead, the FAA maintenance inspectors addressed each incident as an individual, isolated event rather than a systemic deficiency, and relied on Eastern Air Lines to discipline and/or retrain the responsible mechanics. The Safety Board believes that the time involved and the numbers of incidents should have indicated to FAA inspectors that the solution to the recurring master chip detector installation problems required more than reiteration of existing procedures. The numbers of incidents should also have indicated that the maintenance problems with master chip detectors were not just "people" problems which could be attributed to human error or individual failures. The information available to FAA inspectors should have caused special surveillance and actual revision of the work procedures for master chip detectors along with a more forceful effort to require Eastern Air Lines maintenance management to give greater attention to the situation.
The three surveillance initiatives of the FAA toward Eastern Air Lines after Flight 855's accident should have been started to some degree well before May 5, 1983. The facts to justify a special surveillance program or a change of work card procedures were uncovered through normal FAA surveillance methods. However, the data was not analyzed by the FAA inspectors properly and they did not assign a proper priority to the problem which would have resulted in corrective measures.
Although renewed attention has been directed to the potential problems of master chip detectors as a result of this accident and the new procedures adopted for work card 7204 on May 17, 1983, the Safety Board urges the FAA to monitor closely the manner in which the new work card procedures are followed. Additionally, the FAA must become more attuned to the need for analysis of surveillance data to discover trends which indicate safety de ficiences.
The preditching instructions in the flight attendant's manual provided logical guidance to the flight attendants. However, corresponding instructions in 'the flightcrew's manual were not consistent with the flight attendant's manual. As a result, some cabin preparations were rushed because the flight attendants were unaware of the time available for ditching activities. The Safety Board believes that the flighterew's manual should be revised to include identical information as the flight attendant's manual so that the flightcrew provides the information needed by the flight attendants during an emergency. For example, the flightcrew manual should include a requirement to inform the flight attendants about the nature of the emergency, the time available for cabin preparation, and a distinct series of commands which would indicate when the brace position was to be taken. Such a revision would improve crew coordination and enhance dissemination of essential information to the flight attendants which would assist them in the performance of their duties. Specific crew coordination procedures to govern the interaction of flight and cabin crews are necessary, since pilots and flight attendants do not train together, and frequently are strangers. Consequently, instructions in their respective manuals are the foundation for coordinated work activities, and must insure smooth interaction during emergencies.
In general, the preparation of the cabin and the passengers for ditching was adequate. The passengers were briefed to various degrees on preparatory measures, life vests were donned, able bodied persons were selected and briefed, and the brace position was assumed by all persons. As a result, if the airplane had actually ditched, the Safety Board believes that the occupants would have been adequately prepared for the ditching.
Although several problems were perceived by the passengers, the highly emotional and anxious state of the passengers undoubtedly magnified their perception of these problems. The difficulties encountered in retrieving and donning the life vests certainly were complicated by the anxiety of the passengers and made this situation the singular most significant preditching problem.
In this accident, there were several minutes in which passengers could locate and don life vests. However, serious problems still were encountered by the passengers. This fact underscores the difficulties in using the life vests in situations where insufficient time exists to prepare for the emergency and to don life vests. The Safety Board has been concerned regarding the inadequacies of existing life vests on air carrier airplanes and, as a result, has issued safety recommendations 12/ urging the FAA to improve regulations which govern the use of life vests. In response to the Safety Board's recommendations, on January 3, 1983, the FAA issued Technical Standard Order (TSO) Cl3d Life Preservers (effective January 3, 1985) to address some of the problems with the current generation of life vest by establishing improved performance standards for new vests. However, the Safety Board remains concerned that the problems identified with the current life vests are not fully addressed and that the regulations do not establish a date after which all life vests in service must meet the new TSO standards.
The investigation indicated that at least eight persons inflated their life vests. Although an inflated life vest might provide a measure of confidence to a passenger it does cause evacuation problems. The most serious problem is that the passenger's vision is blocked downward and to the front, which would restrict one's ability to see during an evacuation. Other reasons for not inflating a life vest until outside the airplane are that the life vest punctures more easily, it makes movement more difficult, and it can affect the efficiency of the brace position.
Many passengers complained about not seeing flight attendants or receiving individual attention. However, most recalled hearing instructions being given over the public address system. As a result, the Safety Board believes that the passengers were given adequate guidance to prepare for the ditching. The recollection of many passengers that they did not receive individual attention or recall seeing the flight attendants was probably influenced by their anxiety. In fact, however, the total preparation of the cabin and the passengers appears to have been adequate for an actual ditching. While individual attention to each passenger is desirable, it would be impractical in the time usually available; in this case, the time available was not known, and the flight attendants concentrated on the passengers who were having the most obvious difficulty. It is not unlikely that some passengers who were probably prepared and briefed adequately for the emergency also needed the emotional comfort and reassurance which the flight attendants did not have time to provide.
The flight attendants spent considerable time briefing the able bodied persons. Although the time spent in briefing these persons probably varied from group to group, it was important that this task be done first and in a thorough manner for a successful evacuation and deployment of the life raft. Also, since the briefings of able bodied persons were done first, passengers initially may have felt neglected in favor of the able bodied persons. The Safety Board recognizes the important role of able bodied persons in a ditching emergency and believes that the time devoted to preparing them was proper, essential, and for the good of all occupants.
Although the airplane did not ditch into the ocean, the U.S. Coast Guard had responded to the emergency and was prepared to conduct an extensive rescue operation. The manner in which the Coast Guard and U.S. Air Force aircraft and surface vessels
responded was efficient and rapid, and would have provided critical assistance to the occupants of Flight 855 if the airplane had ditched. The initial response of the first Falconjet and helicopter from Opa Locka at 0928 would have insured at least two aircraft on scene as the airplane ditched, and additional assistance from surface vessels and other aircraft would have been on scene shortly thereafter.
The Safety Board is not able to determine how much time would actually have been available to evacuate the passengers and crew had the airplane ditched. The generally calm ocean surface condition would have aided the flightcrew in the actual touchdown. Assuming the ditching procedures and other conditions cited in the L-1011 certification tests were met, a post-ditching flotation time of 20 to 25 minutes was theoretically possible. However, ditching an airplane is obviously dangerous, and the numerous variables associated with the loads which could be imposed on the airplane make it difficult to accurately predict the outcome. As a result, damage could be sustained to the fuselage which could cause a nonsurvivable accident, or a short flotation time.
The National Transportation Safety Board determines that the probable cause of the accident was the omission of all the O-ring seals on the master chip detector assemblies leading to the loss of lubrication and damage to the airplane's three engines as a result of the failure of mechanics to follow the established and proper procedures for the installation of master chip detectors in the engine lubrication system, the repeated failure of supervisory personnel to require mechanics to comply strictly with the prescribed installation procedures, and the failure of Eastern Air Lines management to assess adequately the significance of similar previous occurrences and to act effectively to institute corrective action.
Contributing to the cause of the accident was the failure of Federal Aviation Administration maintenance inspectors to assess the significance of the incidents involving master chip detectors and to take effective surveillance and enforcement measures to prevent the recurrence of the incidents.
BACK TO TOPAs a result of its investigation, the Safety Board made the following recommendations to the Federal Aviation Administration:
BY THE NATIONAL TRANSPORTATION SAFETY BOARD
APPENDIXES
APPENDIX A
INVESTIGATION AND HEARING
1. Investigation
The Safety Board was notified of the accident about 0950 e.d.t., on May 5, 1983. An investigator-in-charge was assigned to the accident from the Board's Miami Field Office. An investigation team was dispatched from Washington, D.C. The following investigative groups were established: operations/air traffic control, human factors, human performance, airworthiness, powerplants, digital flight data recorder, and voice recorder.
Parties to the onscene investigation were the Federal Aviation Administration, Eastern Airlines, Inc., the Air Line Pilots Association, the Transportation Workers Union, the International Association of Machinists, and Rolls Royce.
2. Public Hearing Information
On May 16, 1983, a 2-day deposition proceeding was held in Miami, Florida. Testimony was received from 14 witnesses.
Captain Richard E. Boddy
Captain Richard E. Boddy, 58, holds Airline Transport Pilot Certificate
No. 221729 with an airplane multiengine land rating. He received a type rating in the L-1011 on February 14, 1983. His first class medical certificate was issued November 18, 1982. He had 12,045 hours of total flight time, of which 13 hours were flown in the Lockheed L-1011. He had been off duty for more than 24 hours before the flight.
Captain Steve C. Thompson
Captain Steve C. Thompson, 48, occupied the right seat in the cockpit. He was a supervisory check airman. He holds Airline Transport Pilot Certificate 1271445 with ratings for airplane single engine, and multiengine land. He has a type rating in the L-1011 airplane. His first class medical certificate was issued January 10, 1983. Captain Thompson had a total of 16,946 flying hours, of which 282 hours were flown in the L-1011. He had been off duty to 22 hours before the flight.
Second Officer Dudley H. Barnes
Second officer Dudley H. Barnes, 44, holds Flight Engineer Certificate No. 1868584 with a turbojet engine power airplane rating. He possesses a current second class medical certificate. Mr. Barnes had flown a total of 9,027 hours of which 2,666 hours were in the Lockhead L-1011. He had been off duty for 24 hours before the flight.
Senior Flight Attendant Shirley Alexiou
Senior Flight Attendant Shirley Alexiou has been employed by Eastern Air Lines as a flight attendant for 14 years. Her most recent recurrent training was in May 1982. She was scheduled for recurrent training in May 1983. She is qualified in the L-1011, DC-9, B-727, and A-300.
| Powerplants | |||
| Engine | No. 1 | No.2 | No. 3 |
| Serial | 10,058 | 10,338 | 10,221 |
| Time Since Installed | 171 | 1,154 | 836 |
| Time Since Restoratio | 171 | 1,154 | 836 |
| Cycles Since Restorat | 85 | 540 | 411 |
| Total Time | 21,893 | 19,306 | 21,299 |
| Total Cycles | 11,374 | 10,050 | 10,901 |
| Date Installed | April 11, 1983 | November 22, 1982 | December 29, 1982 |
