FAA and EASA are being urged to mandate a 10-year-old Honeywell service bulletin (SB) that U.K. Air Accidents Investigation Branch (AAIB) investigators believe would have prevented a cabin-smoke event that led to a chaotic evacuation of an American Airlines A330 at London Heathrow Airport in June 2016.
The incident was caused when the A330-300's auxiliary power unit (APU) load compressor bearing was "compromised" by metallic debris in its shared oil system. That caused the load compressor carbon seal to fail, which allowed hot oil to enter the bleed-air supply system. Smoke then began to enter the cabin, triggering an evacuation.
The aircraft, carrying registration no. N276AY and manufactured in 2001, was dispatched with an inoperative APU generator, per the minimum equipment list. The dispatch process included a check of the generator's condition using the maintenance computer, which "did not reveal any anomalies," AAIB wrote in its report on the incident.
"Examination of the APU after the event revealed considerable metallic debris in the shared oil system," AAIB explained. "This debris eventually caused the load compressor carbon seal to fail, allowing hot oil to enter the bleed air supply to the cabin and causing smoke in the cabin."
The A330 APU has a single oil system that provides lubrication and cooling to various components, including the load compressor and generator. The system includes pressure and scavenge pumps, as well as two oil filters with bypass features that permit oil circulation to continue should either filter become blocked, AAIB explained.
Investigators determined that "the quantity of debris overwhelmed the filtering capacity of the system, causing the bypass to operate and allow debris to move into other areas of the oil system, such as other bearings and seals," AAIB wrote. "This debris eventually caused a failure of the load compressor carbon seal."
The A330's Honeywell APU includes several auto-shutdown modes, including low oil pressure, high oil temperature and detection of metal chips. A November 2007 Honeywell SB (GTCP331-49-793610) recommended installation of an additional system that monitors filter performance and automatically shuts the system down when oil contamination is detected.
"The system detects lubrication system contamination by sensing differential pressure across each of the two oil filters," AAIB wrote. "If an impending filter bypass is detected, an auto-shutdown of the APU is initiated, preventing further damage and reducing the likelihood of smoke entering the cabin."
The optional system was not installed on N276AY.
AAIB in its report recommends that both FAA and EASA mandate the service bulletin.
Airbus has made changes to the A330 Master Minimum Equipment List related to dispatching an aircraft with an inoperative APU generator. The revised list incorporates a physical check of the APU oil system for APU generator debris.
The A330 was preparing for departure when the incident occurred. There were 291 people onboard, including 12 crew members and two ground staff. Confusion onboard led the cabin crew to order an evacuation. The pilots believed they isolated the smoke source and at one point called for the passengers to remain seated. The smoke's thickness in the cabin convinced the pilots and cabin crew to continue the evacuation, and the occupants disembarked using a jet bridge and two aft emergency slides.
The AAIB report makes a series of recommendations related to evacuation protocol, including communication between the cabin crew and the flightdeck, and the specifics of managing an emergency at the gate. American has integrated a video of the incident into its pilot human factors recurrent training program.