Barely 10 minutes into the departure from Toronto Pearson International Airport (CYYZ) on December 20, 2016, El Al Flight 30 experienced an engine failure during its initial climbout at approximately 13,000 feet. The B-767-300 was en route to Tel Aviv’s Ben Gurion Airport (LLBG) with 224 passengers and crew on board—a scheduled 10-hour flight.
Although the flight crew event had a successful conclusion, circumstances in the cockpit could have resulted in a different outcome. Why?
If you're not already a subscriber, what are you waiting for? Subscribe today to get the issue as soon as it is released in either Print or Digital formats.
Subscribe Now
The short answer is checklist procedure challenges. Having spent 12 years flying the B-767/757 as a captain, I find it to be a fascinating story in cockpit management—some good, some bad. For as much as airline pilots train for engine emergencies, it would seem that this mostly experienced crew had some missteps. Indeed, any one of us could have made similar errors.
The crew was augmented with two captains and two first officers. The No. 1 captain was designated the “captain in command,” with the No. 2 captain designated as the “extra captain.” The first officers were designated simply as “FO [No.] 1 and FO [No.] 2.” Both copilots were in their early 30s and relatively new with the airline but had approximately 3,000 hours of total time.
The No. 1 captain was 60 with 18,700 hours total time, 19 years with the airline, and 9,840 hours in a B-767. The Hebrew translation of the incident report seems to indicate that the captain in command was also a check airman. The No. 2 captain was 50 years old with 19,700 hours total time, 17 years with the airline, and 3,500 hours in a B-767.
Although the No. 1 captain performed the takeoff from CYYZ with the No. 1 FO, it was the extra captain that was in the left seat at the time of engine failure. That brings us to the first faux pas. Apparently, at 10,000 feet, the designated end of the sterile period, the No. 1 and No. 2 captain swapped seats despite airline policy of waiting until cruise flight. Why? My guess is that the command captain wanted a head start on his rest break.
Perhaps El Al’s protocol is different from my former airline when it comes to a four-pilot augmented crew. On my airline’s 13-hour JFK-to-Tokyo flights, for example, the crew consisted of one captain and three first officers that rotated breaks and duty time—two first officers together and one first officer and the captain together. All pilots would be in the cockpit for takeoffs and landings, with the captain always in the left seat.
- READ MORE: Not Everyone Can Become an Airline Pilot
In any case, before El Al’s No. 1 captain had an opportunity to exit the cockpit, a loud noise was heard originating from the right side of the airplane. The noise was accompanied by a pronounced yaw and roll at about 13,200 feet in the climb. Engine indications were of rapidly decreasing N1 rpm, N2 rpm, and oil pressure, notwithstanding an increase in EGT. Neither the fire warning light nor the electronic fire bell activated.
Captain No. 2, now seated in the left seat, commanded FO No. 1 to initiate the “engine fire/severe damage” checklist-memory items first. The checklist essentially identifies the failed engine, disconnects autothrottle control, and with a pull of the fire handle, shuts down fuel, hydraulics, electrical, and bleed air. Pulling the fire handle also arms the halon bottle but doesn’t discharge the retardant.
Captain No. 1, who had remained in the cockpit, instructed FO No. 1 not to continue with the checklist item that would have discharged the retardant because no fire alarms had activated. That said, because FO No. 1 had mistakenly left his mic switch in the interphone mode, a conversation between flight attendants in the cabin was heard regarding a possible fire. Without the checklist fully completed, the No. 2 captain again swapped seats with the captain in command, an action that is puzzling in the middle of an emergency.
The captain in command reassessed the situation, believing the engine had not experienced severe damage but instead more likely exhibited symptoms at least similar to a compressor stall condition. A stall occurs when a momentary disruption of air occurs in the compressor section as a result of bird ingestion, worn or overly dirty fan blades, aggressive power application, or rapid changes in airspeed or altitude.
Most of my colleagues would scratch their heads on this interpretation, but the No. 1 captain was actually correct in his assessment based on the fact that none of the following three parameters were met for the engine fire/severe damage checklist: engine fire warning, continuous airframe vibrations accompanied by abnormal engine indications, and engine separation.
To confirm no fire existed, captain No. 2 sent FO No. 2 into the cabin to investigate. No fire or any abnormal engine appearance was identified. Execution of the engine surge/stallchecklist was initiated as per captain No. 1’s instruction. Captain No. 1 rationalized the initial report of fire as the result of a compressor stall, which often produces a spectacular flame behind the engine that is momentary. Although the other crewmembers resisted to a degree, they acquiesced.
Spoiler alert: The PW 4000 series engines have been notorious for developing structural problems in the fan blades. In this circumstance, a stage 5 high-pressure compressor blade separated as a result of a fracture at its root, causing extreme internal damage to almost all parts of the engine. Unbeknownst to the crew, the engine fire/severe damage checklist was more applicable.
Unfortunately, the change of strategy was managed in an unorthodox manner. Captain No. 1 instructed FO No. 1 to initiate fuel dumping without reference to the checklist—an appropriate plan but not really necessary. Like most airliners, the B-767 can structurally withstand an overweight landing, even up to takeoff weight. It’s the go-around performance that is in jeopardy at higher weights, especially with an engine inoperative.
With fuel dumping in progress the engine surge/stall checklist was initiated but without reading the conditions that apply, which may have alerted the crew to the zero indication of the N2 rpm, meaning the engine may have suffered damage. This checklist leads to a decision tree of continuing with the engine shutdown or an attempt to restart. Captain No. 1 actually elected to perform a restart procedure, which required the resetting of the fire handle—an action that is not normal once activated. Two restarts were attempted, both unsuccessful.
In addition to a nonstandard PA announcement of “two minutes to landing” initiated by FO No. 1, which created uncertainty among the flight attendants for a possible evacuation, the crew also failed to pull the cockpit voice recorder (CVR) and digital flight data recorder (DFDR) circuit breakers at completion of the parking checklist. The error caused the continuous loop CVR recording to be overwritten at the time of engine failure.
Despite these missteps, the flight arrived back to CYYZ safely. Were crew resource management (CRM) skills utilized, or were the other crewmembers intimidated by captain No. 1, acquiescing rather than asserting their difference in opinion? Transcripts actually point to both.
Even with procedural ambiguities and the bending of airline protocol, the captain in command exercised leadership skills that terminated in a successful outcome. Regardless, it would seem that a serious review in checklist protocol and crew management is in order.
This column first appeared in the August Issue 961 of the FLYING print edition.
