Aviation Investigation Report A95H0015

Canadian Airlines International Flight 17 was on a scheduled flight from Vancouver International Airport to Taipei, Taiwan. On board were 4 flight crew, 8 cabin crew, 2 interpreters, and 243 passengers. During the take-off on runway 26 and approximately two seconds after the V1 call, the crew heard a loud bang and felt an airframe shudder and considerable vibration, later attributed to an engine stall. The captain called for and initiated a rejected take-off. The aircraft could not be stopped on the runway, and the nose-wheel gear collapsed as the aircraft rolled through the soft ground beyond the end of the runway. The aircraft came to rest in a nose-down attitude approximately 400 feet off the declared end of the runway. Six passengers were slightly injured during the emergency evacuation of the aircraft.

The Board determined that engine number 1 lost power at a critical point in the take-off and that the rejected take-off was initiated at a point and speed where there was insufficient runway remaining to stop the aircraft on the runway. Contributing to this occurrence were the misidentification of the cause of the loud bang and the lack of knowledge regarding the characteristics of engine compressor stalls. Contributing to the engine power loss was a delay between the collection and analysis of the engine monitoring data.

1.1 History of the Flight

Canadian Airlines International (CAI) ^{Footnote 1} Flight 17, a DC-10-30ER, with 4 flight crew, 8 cabin crew, 2 interpreters, and 243 passengers on board, was scheduled to depart Vancouver at 1200 Pacific daylight saving time (PDT)^{Footnote 2} on 19 October 1995 for a direct flight to Taipei, Taiwan. The departure was delayed approximately 75 minutes because of a mechanical fault on the number 2 engine thrust reverser. The fault could not be rectified, and the aircraft was dispatched with the thrust reverser disabled.

The captain did a rolling take-off. The aircraft was aligned with the runway centre line, and the power levers were positioned to the take-off power range by 80 knots; "Thrust set" was called by the second officer as the aircraft accelerated to 95 knots. The first officer called V1 (critical engine failure recognition speed) at 164 knots, and approximately two seconds later, there was a loud and startling bang, followed by an airframe shudder and considerable vibration. The captain called for a reject and retarded the power levers. The first officer advised the tower that Flight 17 was rejecting the take-off, and the second officer manually deployed the spoilers, which activated the wheel auto-brakes as the aircraft reached a peak speed of 175 knots.

When it became apparent that the aircraft would not stop on the runway, the captain steered the aircraft to the right to avoid hitting the approach lights. The aircraft was travelling at approximately 40 knots as it went off the end of the runway. As the aircraft rolled through the soft ground, the nose-wheel gear collapsed. The aircraft came to rest in a nose-down attitude approximately 400 feet off the declared end of the runway, or 255 feet past the end of the paved area off the end of the runway. Immediately after the aircraft came to a stop, the in-charge flight attendant entered the cockpit and requested instructions. The augmenting first officer told him that there would probably be an evacuation, but to give them a minute. The captain then directed the cockpit crew to initiate the evacuation checklist, and he ordered the evacuation over the public address system. Six passengers were slightly injured during the evacuation. There was major damage to the aircraft in the area of the nose-wheel collapse.

1.2 Injuries to Persons

Six of the passengers were transported to a local hospital for examination. All six had incurred minor injuries as a result of descending the emergency slides.

1.3 Damage to Aircraft

As soon as the nose wheels ran off the end of the paved surface, they began to dig into the soft ground, placing aft force on the gear support structure. Approximately 100 feet off the end of the runway, there was a buried power cable, and ground above the cable was harder than the surrounding soil. Surveying data and photographs indicate that the wheels were pushed up in the area of this buried cable, which would have placed additional stresses on the gear. The failure of the nose gear occurred at the attachment point for the gear's forward bracing. As the gear was pulled aft, the structure inside the nose wheel well was torn out. The nose gear was pushed into the airframe, aft of the gear well, when the airframe came down on top of the gear. The failure of the nose gear was a result of overload, and no signs of previous fatigue were noted. The cowlings of the wing-mounted engines were damaged when they contacted the ground after the nose gear collapsed.

1.4 Other Damage

Two runway-end lights were reportedly broken by the aircraft's wheels. Some damage to the surrounding ground was caused by the aircraft during the overrun, and later by the heavy equipment used to extricate the aircraft from the overrun area.

1.5 Personnel Information

1.5.1 Flight Crew - General

1.5.1.1 Captain

The captain joined Canadian Pacific Airlines on 05 July 1965 and was initially employed as a first officer on Douglas DC3 aircraft. He subsequently transferred to CAI when it was formed in 1988. He has flown a variety of aircraft, including the B727, DC3, DC8, B747 and DC-10. He attained captain status on the DC-10 in January 1987, and, since that time, he has accumulated 3,816 hours as captain on the DC-10.

At the time of the occurrence, the captain held an Airline Transport Pilot Licence (ATPL), endorsed for the DC-10, and a Group 1 instrument rating. He also held a Category 1 medical. The occurrence flight was his first flight during the month of October. The captain successfully completed his last line check on 19 February 1995, and his last recurrent training on 15 September 1995. Both these flights were assessed as being very well flown and managed.

1.5.1.2 First Officer

The first officer joined Canadian Pacific Airlines on 14 June 1973 as a first officer on DC3 aircraft and subsequently on DC8s. He also transferred to CAI, where he has attained 1,668 and 4,118 hours on the DC-10 as second and first officer respectively.

The first officer held an ATPL, endorsed for the DC-10, and a Group 1 instrument rating. He held a Category 1 medical.

The first officer successfully completed his last line check on 25 February 1995, and his last combined pilot proficiency check and instrument rating renewal flight on 26 June 1995. Both these flights were assessed as being "well flown."

1.5.1.3 Second Officer

The second officer joined Canadian Pacific Airlines on 17 August 1979, and subsequently transferred to CAI; he successfully completed conversion as a second officer on the DC-10 aircraft in 1985. In September 1994, he successfully completed an upgrade to and received an endorsement as first officer on the DC-10. However, due to scheduling changes, his recent flying was as second officer on the DC-10. He has flown 5,430 hours on the DC-10.

At the time of the occurrence, the second officer held a senior commercial pilot licence endorsed for second officer on the DC-10; he also held a Category 1 medical. The second officer completed his most recent recurring training on 29 May 1995; during this session, he was assessed as having done "excellent work" and as performing to "high standard."

1.5.1.4 Augmenting First Officer

For its long-haul flights, CAI augments its DC-10 flight crew with one more qualified first officer to meet the regulatory requirement for exceptions to extend the maximum flight duty time beyond 15 hours^{Footnote 3}. The airline's contract with its pilots requires that an augmenting first officer be assigned when flight-duty time will be over 14 hours. On these flights, the augmenting first officer is responsible for preparing the take-off data card, and for providing any additional help to the crew as requested by the individual crew members or as directed by the captain.

The augmenting first officer for this flight was a qualified DC-10 first officer, who held a current ATPL and a Group 1 instrument rating. He had a total of 11,736 flying hours, and, at the time of the occurrence, he had accumulated 5,774 hours on type, of which 4,362 were as first officer. The augmenting first officer successfully completed his last line check on 22 September 1995; he was rated as having done "very nice work."

At the time of the occurrence, the augmenting first officer was occupying the observer seat.

1.5.2 Cabin Crew - General

The cabin crew included eight flight attendants, one of whom was the customer service director (CSD), who was in charge of the cabin crew under the operational command of the captain. According to Canadian Air Navigation Orders, a minimum of seven flight attendants was required for this flight.

Company records indicate that all the flight attendants had successfully completed their annual recurrent training within the preceding 12 months, and that they were qualified and certified for the flight. At the time of the occurrence, the flight attendants were each seated in a jump-seat at their assigned aircraft door.

In accordance with CAI policy, a Chinese-language-qualified flight attendant was part of the cabin crew complement. She was seated at Door 3L.

On flights such as this one to Taipei, CAI, although not required to do so by regulation, provides the services of two interpreters, whose sole function is to provide translation services for passengers and cabin crew. The two interpreters were seated facing the flight attendant at Door 3L.

1.6 Aircraft Information

1.6.1 Aircraft Information - General

The aircraft maintenance records indicated that the aircraft had been maintained in accordance with the company's Maintenance Control Manual and applicable airworthiness standards.

For the occurrence flight, the aircraft was being operated with two minimum equipment list (MEL) item limitations:

1. MEL Item 36-04 Pneumatic Pressure Regulator Valve:
   Because the pneumatic pressure regulator valve on engine number 3 would not shut off when so selected, the valve had been locked in the "OFF" position; and
2. MEL Item 78-01 Thrust Reverser/Fan Reverser:
   Because the thrust reverser on the number 2 engine would not stow properly after landing on the previous flight, the thrust reverser had been locked out.

The dispatch of the aircraft with these two unserviceable items was permitted by CAI's Transport Canada (TC) approved DC-10 MEL. The MEL did not direct any operational limitation conditions for either of these items.

1.6.2 Aircraft Wheels and Brakes

The aircraft was equipped with an auto-brake system (ABS). During a rejected take-off, the ABS is activated when the ground spoilers are deployed manually by the crew, or when the ground spoilers are deployed automatically as the result of the power levers being retarded and the thrust reversers being selected. The ABS system deactivates if the brake pedals are depressed. The aircraft's antiskid system is designed to enable maximum braking effectiveness by allowing approximately five per cent skidding while ensuring that the wheels do not lock.

The flight data recorder (FDR)^{Footnote 4} indicated that the wheel brakes were applied by the ABS, which was activated when the spoilers were selected by the second officer. FDR data further indicated that full brake pressure was maintained by the ABS until the aircraft came to a stop.

All of the brake units were dismantled and examined by representatives of the TSB, the aircraft manufacturer, and the company. Most of the brake wear-pins were missing because the brakes were worn beyond the normal tolerances as a result of the heavy braking during the rejected take-off. Each brake segment did contain remnants of brake material, which indicates that none of the wheel brakes wore out completely during the rejected take-off manoeuvre. There were no signs of hydraulic fluid leakage from the brake pistons or cylinders.

The eight main-gear tires did not have any flat spots. The entire circumference of each tire showed signs of some heat and wear. The eight main wheels on the left and right bogies were found deflated as a result of the fuse plugs being melted. Fire department personnel who were on scene after the accident heard the fuse plugs blowing.

The two centre-gear tires were not worn as much as the rest, which is normal because the centre wheels do not carry as much weight as the main-gear tires. The centre-gear tires remained inflated until the valve cores were removed by recovery personnel at the accident site.

The runway had six clear, continuous lines of rubber from the point that the rejected take-off began to the point where the aircraft left the runway, indicating that each tire was skidding to some degree. The lack of any flat spots worn on the tires indicates that the wheels did not lock up at any time.

1.6.3 Aircraft Engines

1.6.3.1 Aircraft Engines - General

The aircraft was equipped with General Electric CF6-50C2B engines. The engine maintenance records indicated that the three engines installed on the aircraft had been maintained in accordance with the manufacturer's recommendations and as specified in the CAI CF6-50 Engine Specification Manual. All relevant Airworthiness Directives and Service Bulletins had been incorporated into the maintenance schedule, and test records were complete. Engine performance monitoring was conducted in accordance with CAI's TC-approved Maintenance Control Manual and met the manufacturer's recommended program.

Engine data on the FDR indicated the following: engines number 2 (S/N 517762) and number 3 (S/N 517925) operated normally during the take-off; engine number 1 (S/N 517955) experienced a significant power loss as the aircraft reached 170 knots; and the thrust reversers on engines number 1 and number 3 were selected and deployed^{Footnote 5}. When the thrust reverser levers were retarded, engine number 3 speed increased and normal reverse thrust was produced; however, engine number 1 speed remained low, and no significant reverse thrust was generated by this engine.

1.6.3.2 Engine Number 1 - General Condition

FDR data indicated that during the initial portion of the take-off roll, engine number 1 operated normally. As the aircraft reached 129 knots, there was a slight increase in vibration level for about 12 seconds. At approximately 170 knots, there was a spike in the vibration data coincident with the start of a rapid decrease in engine speed from 112 per cent engine fan speed (N1) to below 40 per cent N1. The FDR also indicates that about 2.0 seconds before this power loss, the exhaust gas temperature (EGT) on engine number 1 started increasing. At the time of the power loss, the EGT reached about 960 degrees, subsequently peaking at 1,064 degrees five seconds later, just after the power levers were retarded.

Following the occurrence, an external visual inspection of engine number 1 did not reveal any anomalies; however, a borescopic inspection of the engine revealed significant damage to the high-pressure compressor section of the engine. The engine was removed from the aircraft, disassembled, and subjected to a detailed examination.

The fan and booster blades were all intact and showed no signs of damage, except for light streaking attributed to earth ingestion during the overrun. All actuators, lever arms, and unison rings of the high-pressure compressor were intact and showed no signs of distortion. The variable-guide-vane lever arms were found to be intact, undistorted, and properly assembled. The pins and bushing showed no signs of excessive wear. The actuators were removed and found to be free of leaks. The feedback cables were pull tested and were within the manufacturer's limits. The combustor condition was normal with no signs of mechanical damage. All fuel nozzles were intact. There were no liner deformations or disruptions of airflow.

The high-pressure turbine module showed no signs of impact damage. The first-stage nozzle and a sector of about six stage-1 blades were sooted. The stage-1 blades showed thermal distress with missing blade tips. The stage-2 blades were in good condition. The low-pressure turbine module showed no signs of mechanical damage. The turbine midframe liner was intact and not deformed. There were no signs of any flow-path anomalies.

A sniff test was made on the oil, and no fuel in the oil was detected. The filters and master chip detector were inspected and found to be free of notable debris. The gear train was intact, and neither the fuel pump nor the main engine control (MEC) splines showed unusual wear. No anomalies were identified with the compressor-inlet temperature sensor. The MEC unit, which was tested by the manufacturer (Woodward Governor Company), was found to be serviceable.

1.6.3.3 Engine Number 1 - High-Pressure Compressor Damage

A visual inspection confirmed that there was no significant damage to the blades of stages 1 and 2 of the compressor. The first notable blade damage was in stage 3 blades, mostly on the trailing edges. Stage 4 contained one blade that separated about 30 per cent from the tip. The remaining stages of the compressor rotor showed nicks, tears, and tip damage caused by hard-body impacts. The rotor lands exhibited light rubs through 90 to 180 degrees of the rotor circumference. The degree of damage diminished toward the aft stages of the high pressure compressor, and final stages 12 through 14 showed light to moderate leading-edge and trailing-edge blade damage in the forms of nicks, tears, and missing fragments caused by hard-body impacts. A close visual examination of the set of stage 3 blades revealed that several blades showed streaks from airflow patterns around nicks in the leading edges, indicating a certain degree of engine operation after the nicks had occurred.

The damaged blades from the high-pressure compressor were removed from the engine and underwent a metallurgical examination at the TSB Engineering Branch^{Footnote 6}. It was determined that there was fatigue damage to high-pressure compressor blades from stage 3 on. For all but one of the blades exhibiting fatigue fractures, the fracture origins were at the leading edge or trailing edges, and were associated with mechanical damage to that area of the blade. The origin of the fracture to one stage 3 blade (number 31), however, was at mid-chord. Blade 31 was also found to be bent, which may explain the location of the fracture origin. The material of the fractured blades satisfied the manufacturer's requirements as regards the chemistry and microstructure. Laboratory examination of the physical evidence did not yield sufficient information to pinpoint the cause of the fatigue cracking nor to estimate the crack propagation rates. The fatigue portions of the fractures were tarnished, discoloured or oxidized, especially in the higher stage blades where the air temperature progressively increases. The Engineering Branch Report indicated that some fatigue cracks predated the occurrence event.

1.6.3.4 CF6-50 Engine History

Occurrence data bases were reviewed for incidents involving the CF6-50 engine, concentrating on stalls, power loss, compressor failures, and foreign object damage events. General Electric records indicate that there are over 2,100 CF6-50 engines now in service installed on DC-10s, A300s, and B747s. Stall testing during the development of the CF6-50 engine has shown the engine to be stall tolerant.

Between 1972 and 1995, there were approximately 300 take-off power events involving stalls or power loss. About 30 per cent of the events were related to high pressure compressor blade damage. The remainder of the events were a result of sensor, variable geometry, or downstream components problems. About 10 per cent of the events resulted in rejected take-offs. The number of bird-ingestion events is in excess of 2,400, and non-bird foreign object damage (FOD) events, approximately 500. Records also indicate that there have been about 400 FOD events that resulted in only high-pressure compressor blade damage.

According to the manufacturer, there were no previous events documented involving the fatigue failure characteristics and the mid-chord fatigue-origin location noted on blade 31.

1.6.3.5 General Electric Engine Trend Monitoring Program

An engine condition monitoring program was developed by General Electric to track engine health, with the aim of providing an opportunity for early fault detection. General Electric promulgates the guidelines for engine parameter trend monitoring in its Operations Engineering Bulletin 15 and Customer Service Rep Tips 373. Adherence to General Electric trend-monitoring guidelines is not mandatory, and General Electric advises each operator to establish its own reporting and analysis procedures, and alert levels for parameter shifts. General Electric does not specify urgency or how much time should be taken to complete the analysis of the trend data.

The following table represents guidelines on parameter trend analysis as specified by General Electric Rep Tips 373:

General Electric Rep Tips 373 states that a rise in EGT accompanied by a rise in fuel flow and engine core speed (N2) can be an indication of high-pressure compressor damage.

1.6.3.6 Trend Monitoring of Engine Number 1

CAI adopted General Electric's engine monitoring program and integrated it into the operation of the DC-10 fleet by monitoring cruise data. Generally, readings are taken and entered on an "Instrument Readings DC-10" form by the flight crews every three hours, or once per flight for shorter flights. When the aircraft lands at a base that has access to the CAI/AMR (American Airlines Corporation) mainframe computer in Tulsa, Oklahoma, the data from the completed forms are entered into the computer. Once every 24 hours, the mainframe computer processes the data using the General Electric Aircraft Data Engine Performance Trending (ADEPT) computer program. The output from ADEPT is then sent to CAI's computers in Vancouver, where it is analyzed by the power plant maintenance group. At CAI, it takes somewhere between two and a half to four days from the time the readings are taken in the aircraft until the results are analyzed and can be acted upon.

The number 1 engine monitoring records^{Footnote 7} produced by ADEPT on 19 October 1995, the morning of the occurrence, were based on data up to and including flights on 16 October 1995. This printout indicated that, starting on 14 October 1995, the number 1 engine EGT had drifted upward by 9 degrees toward the baseline over the last three entries. Records indicate that a similar drift was experienced around 25 September 1995; however, on that occasion, the EGT subsequently dropped back to normal. Consequently, the increase in EGT recorded in this 19 October 1995 printout was viewed at CAI as normal variation or scatter.

The data for 17 and 18 October 1995, analyzed after the occurrence, indicated that the upward trend of the EGT on engine number 1 had reached 27 degrees, and that the high EGT was accompanied by increases in fuel flow and engine core speed (N2). For this magnitude of shift in engine parameters, General Electric recommends an immediate borescopic inspection of the high-pressure compressor and low-pressure turbine. In addition, CAI's DC-10 Flyaway Manual specifies a borescopic inspection of the high-pressure compressor in the event of abnormal EGT and engineering performance trend increase.

Discussions with the engineering and maintenance personnel at CAI revealed that engine trend monitoring has been used since the mid 1980s and has been instrumental in identifying engine problems. Prior to this occurrence, CAI had not correlated a trend shift with an impending engine failure.

1.6.3.7 Engine Number 1 Exhaust Gas Temperature Gauge

The engine EGT gauges on the DC-10 incorporate a temperature pointer that records the peak EGT experienced by the engine, and an amber temperature-advisory light, which illuminates to warn the crew when the EGT exceeds 940-960 degrees Celsius.

The EGT indicator for the number 1 engine was removed from the aircraft and tested. The temperature indicator and light were found to function within the tolerances of the test parameters, and the peak EGT pointer was found at an extremely high position, off the temperature scale. The FDR recorded that EGT peaked momentarily at 1,064 degrees about three seconds after the reject call.

It is concluded that the number 1 engine EGT gauge in the cockpit had been functioning properly. During the take-off, the gauge did momentarily indicate a very high reading, and the amber light should have illuminated about the time of the loud bang. None of the flight crew members saw the temperature-advisory light illuminate.

1.6.3.8 Engine Failure Lights

The DC-10 cockpit is equipped with two amber "Engine Fail" lights, one on the glare shield in front of each pilot. The system is armed on the take-off roll once the N1 speeds of all the engines go beyond 85 per cent. The engine-fail lights will illuminate when the system detects an 11 per cent difference between any of the engines' N1 speeds. The ground-sensing relay on the nose gear disables the engine-failure detector system in flight, or at any time the oleo strut is extended enough to deactivate the switch. Detector logic prevents the engine-fail lights from illuminating during reverse thrust operation.

FDR data indicate that, on the take-off roll, at the time that the number 1 engine speed decayed more than 11 per cent below the speed of the other engines, there was an abrupt, backwards movement of the control column, and a momentary, nose-up pitch of 1.4 degrees. At this time, the ground-sensing system changed to the air mode for about two seconds, which would have de-armed the engine-fail light system. The engine-fail lights may have illuminated for up to approximately one second. The crew does not recall seeing an engine-fail light illuminate during the occurrence.

During simulator flights conducted by TSB investigators to examine factors of the occurrence, it was noted that the engine-fail light was not very compelling.

1.6.4 Aircraft Systems

1.6.4.1 Emergency Evacuation Horn

Each of CAI's DC-10 aircraft is equipped with an emergency evacuation warning audio signal, which can be activated from the cockpit or from the flight attendant control panel at door 2L to order an evacuation. When used, the system activates a flashing "EVAC" light on the flight attendant panel and causes a high-pitched beeping sound to be produced from devices at door 1L at the front of the cabin and door 4L at the rear of the cabin.

During this occurrence, the warning system was activated by the first officer just prior to the captain's order over the public address system to evacuate. However, the warning signal was not recognized by some flight attendants, reportedly because of the signal's low volume and its unfamiliar sound.

The evacuation system was examined and the signal devices were found to be functional. Decibel readings were taken on the occurrence aircraft, on another CAI DC-10, and on the company's B767 and A320 evacuation training doors. The volume of the evacuation signal on the occurrence aircraft exceeded the manufacturer's specifications as well as the volume on the company DC-10 and on the training doors.

1.6.4.2 Aircraft Forward Door Operation

One flight attendant indicated that, when the evacuation was ordered, door 1L failed to open on the first attempt, but opened properly on the second attempt.

The door is normally opened by an electric motor activated when a button is pressed. For emergency opening, a handle is moved, which first moves a latch out of the way and then fires a nitrogen bottle that drives a motor to open the door. The door and fittings were examined to the degree possible, and no defects that could impede the proper operation of the door were identified. The door could not be functionally tested by investigators because repairs to the forward nose section of the aircraft precluded the use of electrical power on the aircraft. However, the door was subsequently checked by CAI, and it reportedly operated normally.

Company maintenance practices require that an emergency door opening be carried out on one door and slide on each airplane each year. Door 1R was activated in September 1995 and it operated normally.

1.6.4.3 Evacuation Slide/Raft Cover

The post-occurrence review of the exit doors used during the aircraft evacuation revealed that the Emergency Evacuation Slide/Raft Cover (Part number AWD 7446-245) at the bottom of doors 1L and 1R did not retract properly into the overhead area, but hung down into the exit door openings. The hinge torsion springs on these covers were weak and were unable to close the covers after the evacuation slides deployed. These covers, when closed, are held in position by a magnetic latch.

An inspection by CAI discovered similar problems on its other DC-10 aircraft, and the information regarding the weak springs was forwarded to McDonnell Douglas.

In March 1995, as a result of a similar problem on the MD-11 doors, McDonnell Douglas had issued Service Bulletin 25-148, which mandated the replacement of these hinge springs with more powerful springs. When issued, this service bulletin did not apply to the DC-10 aircraft. The problem with the hinge springs on the DC-10 had not been detected by CAI or McDonnell Douglas prior to this occurrence.

1.7 Meteorological Information

At 1324, when CAI Flight 17 received taxi instructions, the altimeter was reported to be 30.25 inches; two minutes later, the wind was reported to be 240 degrees magnetic at 2 knots. A meteorological observation taken at 2040Z, eight minutes after the accident, reported the following conditions: sky conditions 8,000 feet scattered, 15,000 feet scattered, 25,000 feet thin broken; visibility 30 miles; temperature 12.3 degrees Celsius; dew point 7.4 degrees; and wind 270 degrees True at 3 knots. The altimeter setting was 30.22 inches.

1.8 Communications

The Vancouver Airport Tower Controller cleared CAI Flight 17 for take-off at 1330, and the next communication was the call from the first officer at 1332 advising the tower that Flight 17 was rejecting the take-off. Ten seconds later, the first officer advised the tower that Canadian 17 was going off the end of the runway.

On hearing the call for the reject, the Tower Controller looked up and saw that the aircraft was at about the intersection of the two runways. Because the aircraft appeared to be moving too quickly to be able to stop on the available runway, he activated the crash alarm.

Approximately 13 seconds after the aircraft came to a stop, the first officer advised that the aircraft had suffered major structural damage, and the tower advised that the response vehicles were on the way. Thirty-one seconds after the first officer acknowledged the tower's response, the captain called the tower and asked if there was any sign of fire around the aircraft. The tower responded that there was only smoke and dust visible.

1.9 Aerodrome Information

Field elevation for the Vancouver International Airport is nine feet above sea level. Runway 26, used by the occurrence aircraft, is an asphalt/concrete runway, which is 11,000 feet long and 200 feet wide; runway slope is negligible. There is a 145-foot-long paved area off the end of the runway. The runway's declared distance for take-off run available (TORA) and the accelerate stop distance available (ASDA) is 11,000 feet. The take-off distance available (TODA), which includes a clearway, is 12,000 feet. The runway is not grooved. At the time of the occurrence, runway 26 was bare and dry.

Friction testing, conducted on runway 08/26 on 24 August 1995, recorded a runway-average Grip Tester Friction Number of 63. Rubber removal from the runway was carried out on 22 September 1995. On 30 November, friction testing recorded a runway-average Grip Tester Friction Number of 71. Transport Canada guidelines for runway maintenance indicate that remedial action should be programmed for a runway when its overall average (unadjusted Grip Numbers) falls below 48.

The aircraft used taxiway "N" to enter the runway; the left edge of the taxiway is approximately coincident with the start of the declared runway.

The aircraft left distinct wheel marks on the runway in the form of rubber deposits as a result of braking during the rejected take-off. The first marks of the main wheel tires started at 7,694 feet from the threshold of runway 26 (3,306 feet from the end of the runway). The centre main gear produced marks commencing about 36 feet further along the runway. The skid marks displayed the alternating nature of antiskid cycling.

The survey showed a maximum aircraft excursion left of the runway centre line of 28 feet when the aircraft was 1,232 feet from the end of the declared runway. Thereafter, the tire marks indicated that the aircraft crossed the centre line of the runway, from left to right, at 600 feet from the end of the runway. The right main wheel went off the right side of the runway asphalt surface when the aircraft was 41 feet from the end of the runway. The aircraft came to rest with the main wheels 315 feet past the end of the declared runway, the nose of the aircraft 420 feet past the end of the runway, and the right bogie 161 feet to the right of the extended runway centre line.

The depths of the wheel ruts in the unpaved surface past the end of the runway varied from 0.2 to 1.1 feet for the left main bogie wheels and 0.1 to 1.2 feet for the right bogie.

1.10 Flight Recorders

1.10.1 Cockpit Voice Recorder

The CVR was a Loral model number 93A100-30, serial number 15659. There was no damage or wear to the CVR. The CVR recorded the pilot, co-pilot, flight engineer, and cockpit area microphone (CAM) audio channels on a 30-minute continuous loop^{Footnote 8}. Hot microphones were not used; therefore, internal communications between the crew were recorded on the CAM channel only. Despite the lack of hot microphones, most of the internal communications were discernible.

The only problem with the CVR playback was that the radio channels contained some residual data from previous flights, which made it difficult to recover the audio from the occurrence flight. Under normal CVR operation, previously recorded audio is erased as new information is recorded. An inspection of the CVR at CAI after the occurrence revealed that there was a fault in the erase circuitry, which had disabled the erase function.

The loud bang heard by the crew and other witnesses was not evident on the CVR. The only unusual sounds recorded occurred two seconds after the V1 call, when the first of a series of 21 "thuds" was heard. A loud bang would certainly contain significant frequency components well within the CVR bandwidth (200-5,000 hertz). The lack of a pronounced loud bang on the CVR was likely the result of the wave transmitted through the aircraft structure causing the automatic gain control on the CVR to squelch the structure-borne signal, thereby masking the slower-travelling airborne sound. The series of thuds was considered similar to the sound of repeated compressor stalls.

1.10.2 Flight Data Recorder

The FDR was a Sundstrand Universal Digital Flight Data Recorder, model number 980-4100-AXUN, serial number 5314. A visual inspection of the unit revealed no indications of damage or wear. The FDR was read out using the TSB's Recovery, Analysis and Presentation System (RAPS). The FDR tape had been recently installed on the aircraft and contained 19 hours of data. The previous FDR tape was recovered and used to extract engine performance data.

1.10.3 Flight Profile Analysis

An empirical aircraft performance analysis was carried out to develop an accurate time-distance profile of the rejected take-off. Recorded longitudinal acceleration was used as the basis for developing an accurate time-distance history. The profile analysis was validated using the CVR data and runway survey information.

The aircraft's position on the runway at the time of the engine power loss was determined by analyzing the FDR data, which showed a slight loss in longitudinal g acceleration as the aircraft reached 170 knots and had consumed 6,750 feet of runway. The loss in acceleration was coincident with the first "thud" sound on the CVR. At the same time, the N1 for engine number 1 began to decay, and a 15-degree right rudder input was recorded, along with a slight amount of right aileron.

1.11 Medical Information

There was no evidence that incapacitation or physiological factors affected the crew's performance. All aircrew were in possession of valid medical categories.

1.12 Fire

Small grease-type fires occurred around the hot wheels some time after the evacuation and were extinguished by fire-fighters.

1.13 Survival Aspects

1.13.1 Airport Emergency Response

The Emergency Planning Coordinator of the Vancouver International Airport Authority conducts table-top exercises about once every two weeks to ensure that agencies that respond to aircraft occurrences are prepared. In addition, the Vancouver International Airport Authority conducts a major simulation of an aircraft accident on a yearly basis.

1.13.1.1 Emergency Rescue Services

The fire-fighters from the Richmond Fire Rescue unit, stationed at Fire Hall Number 8 at the airport, heard a loud bang from the aircraft as it was taking off. Immediately following the bang, the crash alarm was sounded and the fire hall bay doors were opened. By the time that the dispatch order was given from the Richmond Fire Department, the firemen were aboard their equipment and leaving for the site. A total of nine fire/rescue vehicles responded to the occurrence.

Three foam trucks and a utility vehicle arrived at the site within a minute of dispatch. When these fire-fighters arrived at the aircraft, the doors of the aircraft were still closed. Shortly thereafter, all the doors opened at once, and the passengers evacuated in an orderly fashion. Because there were no immediate signs of fire, the fire-fighters concentrated on assisting passengers and monitoring the aircraft brakes.

The small grease-type fires that ignited around the hot wheels were quickly extinguished with foam. Foam was also applied under the aircraft as a precaution in case of a possible fuel spill. Because the only dry chemical truck was on maintenance and not available, two portable 350-pound dry chemical units were brought to the site from the ramp.

The first ambulance from BC Ambulance Services arrived at the airport's south gate within five minutes of the occurrence and was on scene two minutes later. A triage area was set up, injured passengers were cared for, and blankets were provided to other passengers. A total of 26 ambulances responded to the occurrence. Six passengers with minor injuries were transported to hospital.

1.13.1.2 Passenger Transportation from the Site

The control of the air-side of the airport is the responsibility of the Vancouver International Airport Authority. The air carrier is responsible for arranging the transportation of uninjured passengers and crew back to the terminal area. For this occurrence, CAI requested buses from a local contractor. By 1410, the first of four buses was through the airport south gate, arriving at the accident site at 1417, or 45 minutes after the evacuation. By 1438, all the passengers were on board buses en route to the terminal.

Weather was not a significant factor; however, because the aircraft cabin had been very warm prior to departure, the passengers and crew were lightly clad, and the 45-minute wait for the buses to arrive was uncomfortable.

1.13.2 Aircraft Evacuation Issues

1.13.2.1 Crew Preparedness Issues

According to the Canadian Airlines Flight Attendant Manual, a rejected take-off is an abnormal situation for which flight attendants are advised to maintain a high alert awareness of their surroundings. They are advised to remain seated with their seat-belts and shoulder harnesses securely fastened while the aircraft is still moving. Once the aircraft has stopped or turned off the runway, they are to remain seated and assess conditions, while awaiting the captain's instructions. If they notice an emergency situation developing at that time, they are to assess the situation further, getting out of their seats only if necessary. If, in their estimation, the situation is an emergency, they are to advise the flight deck immediately.

According to the DC-10 Flight Crew Manual procedures for passenger evacuation following a rejected take-off, if time is available, the captain calls the CSD to the flight deck and provides the CSD with pertinent information and instructions to await the evacuation command. The captain then carries out a series of 10 "After Stopping" items, of which the eighth is initiation of the evacuation. To initiate an evacuation, the captain announces "Evacuate, Evacuate" via the public address system, and the first officer moves the Evacuation Command switch to the ON position when the captain makes the evacuation announcement. The checklist implies that the evacuation signal would begin to sound at the same time as, or slightly after, the captain makes his announcement. The sequencing of the evacuation announcement and activation of the evacuation signal system as specified in the Flight Crew Manual differs from that described in Section 5, "Abnormal and Emergency Procedures," of the Flight Attendant Manual. According to this manual, the flight crew signals the cabin crew to evacuate via the public address announcement "Evacuate, Evacuate," after which the crew activates the evacuation signal system.

In accordance with Section 6 of the Flight Attendant Manual, flight attendants are required "to conduct an evacuation when signalled to do so by the flight crew or by the evacuation signal system." All flight crew members assist with the evacuation as required.

Flight crews and cabin crews train and practise evacuation procedures in simulators annually; some of this evacuation training is done together in a cabin simulator. Practical evacuation training for cabin crews is done using a training door in the generic cabin simulator; this training is supplemented by exit-operation drills on actual doors of aircraft on which they are qualified. When the flight attendants who were on the occurrence flight trained on evacuation procedures, the company's DC-10 door trainer was not equipped with an evacuation signal device. At the time of the occurrence, CAI had already planned to install the signal device on its DC-10 training door; the signal-device installation has since been completed.

The "Evacuate, Evacuate" command is always used during training as the prime cue to initiate the evacuation; the evacuation signal, which is not installed on all training doors, is not always used. As well, the evacuation signal is never used in training as the sole cue to initiate the evacuation.

1.13.2.2 Passenger Preparedness Issues

The pre-flight passenger safety briefing is normally given on CAI flights in both English and French. To accommodate the majority of the passengers on this flight, the CSD directed that the briefing be given first in English, then in Mandarin, followed by French.

1.13.2.3 Aircraft Evacuation Decision Making

The cabin crew all described hearing a very loud bang, followed by a series of bangs, sensing the aircraft shuddering and decelerating, and feeling the collapse of the nose-wheel gear as the aircraft came to a stop. On stopping, the CSD reported to the cockpit for instructions and was told by the augmenting first officer that they would probably be evacuating, but to give them a minute. The captain then called for the evacuation checklist to be initiated by the crew in the cockpit.

Prior to ordering the evacuation, the captain, to determine if it would be safe to use all the slides, asked the first officer to contact the tower to determine if there was any sign of fire. The first officer tried twice, but could not contact the tower using audio panel 2 on his side of the cockpit; so, the captain tried audio panel 1, and successfully made contact with the tower. When the first officer tried to contact the tower, the emergency power switch had already been turned on. With this electrical power configuration, only audio panel 1, on the captain's side of the cockpit, is powered. A review of the Flight Crew Operating Manual and Training Manual indicates that these manuals do not contain information on theunavailability of audio panel 2 when on emergency power. The company was not aware of this communications limitation.

The captain's "Evacuate, Evacuate" command was made approximately one minute after the aircraft came to a stop.

1.13.2.4 Passenger and Crew Evacuation

The cabin crew reported that during the rejected take-off procedure the passengers quietly remained in their seats, watching the flight attendants and waiting for instructions. Other than a ceiling panel over door 1L dropping down because of an unfastened connector, and some spilled milk in a galley, the cabin area remained secure and intact. Some of the flight attendants gestured to the passengers to remain seated, and the interpreters were used to make announcements for the passengers to remain seated with their seat-belts fastened.

Upon hearing the captain's command, the flight attendants began the evacuation. Other than minor problems with door 1L, all doors opened smoothly and the slides inflated automatically. Because the nose-gear had collapsed, the aircraft was in a considerable nose-down attitude; nevertheless, all slides touched the ground. The slope of the slides at doors 1L/R was shallow, and halfway down the slides, passengers had to get up from their sitting position and walk to the bottom of the slide. There was some slump in the slides at doors 2L/R, but this condition did not impede the evacuation from these exits. At doors 3L/R, the configuration and attitude of the slides were normal. The slides in the rear of the aircraft at doors 4L/R were on a steep angle, and although the slide down these slides was fast, the flight attendants reported that the landing at the end of the slide was fine.

Although the flight attendants shouted out the required evacuation commands in English, they all reported that their tone and hand gestures were more effective than the actual words, given that Mandarin was the language of the majority of the passengers on board the flight. They stated that the evacuation was smooth and that the passengers followed their orders and gestures. One of the flight attendants noted that, at first, passengers in her section rushed to the door; however, after she instructed them to slow down, they proceeded in an orderly manner. The flight attendants reported that the flow at all the doors was fairly continuous and orderly.

The evacuation, which took between one and two minutes, was reported to be orderly. There were only minor anomalies with the evacuation. At door 2R, there was a slight build-up of passengers at the bottom of the slide, which necessitated holding the flow back until it cleared. This may have been because many of the passengers who evacuated from door 2R were elderly people who experienced difficulty getting up from the bottom of the slide. At doors 3L/R, the passengers had to walk out on the wing for about eight feet to slide down the inclined portion of the slide from the edge of the wing, which slightly slowed the flow at these doors. Even though the slides at doors 4L/R were on a steep angle, there was little hesitancy to slide down the slides.

Many of the passengers attempted to take luggage with them. For the most part, the flight attendants removed luggage from exiting passengers; however, in order to not unnecessarily slow down the evacuation, some passengers were allowed to egress with small hand luggage. There were no indications that the carrying of luggage impeded the evacuation.

Prior to exiting the aircraft, the captain, first officer, and second officer went through the passenger cabin to ensure that all the passengers and cabin crew had evacuated the aircraft.

1.14 Operations and Training Information

1.14.1 Pre-flight Planning Issues

1.14.1.1 Take-off Performance Calculations

Since 05 November 1994, CAI has been using American Airlines Corporation's (AMR) SABRE computer system to support its flight operations. One element of SABRE is the Take-off Performance System (TPS), which is used for calculating take-off performance based on the airport and runway conditions, weather, and aircraft loading. As well, the TPS provides the flight crews with the operational parameters for the take-off, including engine power settings, flap settings, the critical engine failure recognition speed (V1), rotation speed (VR), take-off safety speed (V2), and flap/slat retraction speeds.

The TPS considers three types of engine power settings for a DC-10 take-off: STANDARD power, MAX (C2) power, and BLACK (C2B) power. The TPS always uses the lowest power possible for any given take-off. The TPS will not provide C2B power setting figures if it calculates that a lower power setting is sufficient for a particular take-off.

The TPS calculated that C2 power using improved-performance^{Footnote 9} was required for the take-off, with the following operational parameters: engine speed of 110.4 N1, flap setting of 16 degrees, V1 of 164 knots, VR of 175 knots, V2 of 187 knots, flap-retraction speed of 203 knots, and slat-retraction speed of 255 knots. This information was entered on the take-off data card, and the speeds were set on the airspeed bugs.

The captain, knowing that one of the thrust reversers was not available, and assessing that a take-off using C2B power would provide additional runway for stopping the aircraft in the event of a rejected take-off, requested CAI's flight operations to provide him with the operational parameters for a C2B-power take-off. However, because the TPS had calculated that the lower C2 power setting was sufficient for the take-off conditions, the TPS program could not provide the C2B power parameters. In order to get C2B power performance parameters, the crew referred to the Canadian Airlines DC-10-30 OD43J Performance Manual and calculated that the take-off parameters were the same as for C2 power, except that the C2B-power V1 would be 167 knots, versus the 164 knots calculated by TPS for C2 power. The Take-off Data Card was amended to show the C2B power setting of 112 per cent; however, the C2B-power V1 of 167 knots was not set on the airspeed indicator bugs or the take-off data card.

1.14.1.2 Aircraft Load Control

Attached to the TPS are the preliminary load planning system (LPS) weight and balance calculations and load information. Factors considered by the LPS for weight and balance include the aircraft empty operational weight (EOW)^{Footnote 10} and weights for passengers, baggage, freight, and fuel; additional factors considered for take-off performance and maximum allowable take-off weight limit include the ambient weather conditions and the runway to be used. The final ramp load is planned to be the maximum allowable take-off weight plus the fuel to be used for taxiing from the ramp to the runway. The maximum design ramp weight for the aircraft was 593,000 pounds, and the maximum brake-release take-off weight was 590,000 pounds.

As part of the initial briefing, the crew of Flight 17 was provided with the initial (1112 PDT) TPS information for the planned flight. The passenger weight, on the weight and balance data attached to the TPS, was based on an anticipated load of 250 passengers. A trip sheet produced by the LPS at 1106 indicated a cargo weight of 20,956 pounds broken down as follows: the baggage weight was 11,504 pounds, based on the 328 passenger bags checked at an average bag weight of 35 pounds^{Footnote 11} plus the actual weight of some mail bags; the freight weight was based on actual weights. The ramp fuel weight was the flight planning system (FPS) calculation of the fuel required for the planned flight. The taxi fuel was the planned taxi fuel based on a fuel burn rate of 75 pounds per minute and the planned taxi time of 30 minutes, which was based on the aircraft's gate position, runway in use, and the traffic flow pattern anticipated at the Vancouver airport for the planned take-off time.

The amount of fuel to be loaded on the aircraft is based on the FPS calculation of the fuel required for the flight minus the fuel on board the aircraft prior to the refuelling. When the crew arrives in the aircraft, a final check of the fuel on board the aircraft is done by the second officer using the fuel gauges in the cockpit. The total of the fuel gauges for the individual tanks, as recorded by the second officer, was 248,400 pounds; the fuel totaliser gauge reading was recorded as 248,800 pounds. When the final fuel load was passed to the Operations Agent at about 1200 for input into the LPS, the FPS-planned fuel figure of 247,300 was provided, instead of the figure of 248,400 pounds, which was the total of the individual fuel tank gauges. The captain was aware that the lower fuel figure had been passed; he did not consider it to be a problem because, at the briefing, he had noticed that the planned aircraft weight was 1,400 pounds below the maximum allowable weight.

The final weight and balance calculation generated by LPS at 1223 indicated that the passenger count was 242, the passenger weight was 39,446 pounds, the passenger baggage (291 bags) weight was 10,189 pounds, and the freight weight was 12,879 pounds. This same information was included in the 1240 Final Load Closeout that was received by the second officer. The aircraft EOW also had been adjusted for variances from the standard DC-10-30 crew complement and the addition of one additional cargo pallet. The passenger weight had been adjusted to reflect the actual recorded passenger count. The increase of the planned take-off weight was included in the Load Closeout Message and was forwarded to the crew via ACARS at 1240. The captain stated that he was not aware of the increased planned take-off weight.

After the occurrence, the cargo and passenger baggage was weighed by CAI. Company records indicate that there were 314 passenger bags weighing 10,838 pounds^{Footnote 12}. Because of the nose-down attitude of the aircraft following the occurrence, not all the cargo could be off loaded at the time that the weighing took place; the freight that was off loaded and weighed was 11,230 pounds. The remaining freight was off loaded when the aircraft was recovered from the accident site, but inadvertently was not weighed^{Footnote 13}.

There were three notable discrepancies in the Load Closeout: the ramp fuel weight was 1,096 pounds lower than the total fuel weight as recorded from the aircraft's fuel tank gauges by the second officer; company records could not explain the additional 23 passenger bags on the aircraft and the resulting 805-pound weight discrepancy; and there were 243 passengers on board as compared to the 242 recorded in the aircraft load documentation.

Another factor affecting the take-off weight of the aircraft was the difference between the planned taxi time of 30 minutes and the actual taxi time of 14 minutes. This 16-minute difference in time would have resulted in a reduction in taxi fuel-burn of 1,200 pounds. The captain was aware of the implications of the reduced taxi time; however, he assessed that, based on the 1812 TPS planned take-off weight (PTOW) figure of 588,600 pounds, the reduced fuel burn would not put the aircraft over the design maximum take-off weight. Based on the TPS final Load Closeout figures and the discrepancies noted in the ramp fuel weight, passenger baggage weight, the additional passenger, and the reduced taxi fuel burn, the occurrence aircraft could have been up to 951 pounds over maximum ramp weight and 2,901 pounds over the maximum design take-off weight.

1.14.2 Rejected Take-off Decision Making

1.14.2.1 Certification Criteria

The DC-10-30 was type-certified in accordance with United States Federal Aviation Regulations (FARs). Part of this certification is the requirement for the manufacturer to demonstrate to the Federal Aviation Administration (FAA) the performance data that are included in the FAA-approved Airplane Flight Manual (AFM).

One element of this performance data is the engine-out accelerate-stop distance, which is based on the engine-failure recognition speed (V1). In the context of a field-length-limited take-off, V1 is the maximum speed at which the rejected take-off manoeuvre can be initiated and the airplane stopped within the remaining field length. Specifically, the definition of V1 in the FARs considers that the engine-failure must be recognized^{Footnote 14} and the pilot's initial stopping action to reject the take-off must be taken by V1. If this pilot stopping action is initiated at a speed higher than the field-length-limited V1, insufficient runway will remain to stop the aircraft on the runway.

Another aspect of this certification performance is the engine-out accelerate-go criteria, which also references V1 speed. In this scenario, V1 is the earliest point from which an engine-out take-off can be continued safely.

The Canadian Airlines DC-10 Flight Crew Operating Manual (FCOM) defines V1 as follows:

Decision Speed, V1 - The speed at which, after an engine failure has been recognized during the takeoff, the pilot decides whether to abort or continue the takeoff. V1 is actually the engine fail speed plus a recognition increment which corresponds to a time delay of one second. A further 3 seconds is allowed until full braking with spoiler actuation is attained.

1.14.2.2 Rejected Take-off Training Issues

In 1989, in reaction to a number of take-off accidents resulting from improper rejected take-off decisions and procedures, a joint FAA/industry team studied what actions might be taken to increase take-off safety. The team studied approximately 3,000 rejected take-offs that occurred between 1959 and 1990. The findings of this team were published by the FAA in April 1993 in a publication entitled Takeoff Safety Training Aid and in a flight crew briefing video entitled Rejected Takeoff and the Go/No Go Decision. In June 1993, CAI's Director of Flight Training and Development provided all company pilots with a publication entitled Pilot Guide to Takeoff Safety , which contained Chapter 2 of the FAA training aid. The training video was also shown during some pilot recurrent training sessions. These training aids emphasize the need to adhere to the V1 decision-making concept and highlight the inevitability of an overrun if a rejected take-off is initiated after V1. In its discussion of rejected take-off situations, the Takeoff Safety Training Aid states that a take-off should not be rejected once the aircraft has passed V1 unless the pilot has reason to conclude that the airplane is unsafe to fly. As well, the study concluded that in most overrun accidents, the pilots, using visual cues, did not accurately assess the amount of runway remaining or the aircraft's ability to stop.

The FAA/industry analysis of the 74 rejected take-off occurrences that resulted in overruns indicates that a number of these rejected take-offs involved crew uncertainty about the ability of the airplane to fly, as well as unidentifiable loud bangs, vibrations, and other characteristics, that later were assessed to be indications of engine stall or engine failure.

Another study^{Footnote 15} into occurrences involving benign engine malfunctions and inappropriate crew responses indicates that the majority of these engine-plus-crew-error events^{Footnote 16} involved engine malfunctions that generated loud noise. Seventy per cent of this type of event occurred near to ground and/or at high engine power during phases of flight such as take-off, go-around, or climb. The study further states that the effect of time compression associated with these phases of flight appears to be a significant factor that affects crew action following the engine problem. The time needed to process and integrate the auditory, tactile, and visual symptoms of engine malfunctions in a time-constrained environment may be so difficult that it leads to inappropriate flight crew response. Another factor cited was the fact that, because of the high reliability of today's turbine engines, many flight crews will complete their whole career without experiencing an engine failure; consequently, training programs and simulators must provide flight crews with the knowledge to positively recognize an engine-failure condition. The Boeing study concludes that lack of positive recognition of the engine event appeared to be the most significant factor contributing to inappropriate crew actions.

Training on rejected take-off scenarios is conducted by CAI pilots during annual recurrent simulator flying training. The training is designed to provide the crew experience in decision making before and after V1. The training is also designed so that the scenario events will be adequately clear to facilitate an objective evaluation of the crew's performance. The training scenarios ensure that there are adequate cues to clearly portray the nature of the emergency. CAI DC-10 simulator training includes heavy-weight take-offs with aircraft weights between 560,000 and 580,000 pounds.

During simulator sessions, engine failures are normally signalled by one or more of the following symptoms: a pronounced yaw, an engine fail light, engine instrument indications, and an announcement of the nature of the emergency by the first or second officer. Compressor stalls are simulated by a series of muffled thumps.

There is no information regarding the characteristics of engine stalls or surges in either the aircraft manufacturer's or engine manufacturer's manuals, nor is there any information on this issue in CAI's operations manual, standard operating procedures, or training manuals. Although there is no direct reference in operational manuals to the inevitability of an overrun if a rejected take-off is initiated above the V1 speed in a field-length-limited situation, discussions on this issue are covered in a company 1988 Flight Operations Circular contained in the policy section of the DC-10 FCOM, and in the Pilot's Guide to Takeoff Safety provided to DC-10 pilots in 1993.

1.14.2.3 Decision Making on Flight 17

Although the crew, using C2B power charts, had manually calculated 167 knots as the V1, the airspeed bugs and the take-off data card reflected the TPS-calculated V1 speed of 164 knots, and the FDR/CVR data indicated that the first officer did call V1 as the aircraft accelerated through 164 knots. The captain believed correctly that by using the higher C2B power he would have more runway available to conduct a rejected take-off if one became necessary. He also believed that he would have some time after the 164-knot V1 call to make a reject decision.

FDR/CVR analysis indicated that the loud bang occurred 2.2 seconds after the V1 call. The captain called the reject 1.3 seconds later. His first action to reject the take-off, retarding the power levers, occurred at 4.3 seconds after the V1 call and as the aircraft was accelerating through 172 knots. The auto-brake system activated 6.1 seconds after V1 as the result of the second officer manually deploying the spoilers. The thrust reversers were selected 3.5 seconds after the power levers were retarded, and the reverse levers were pulled into reverse 11.1 seconds after the V1 call.

The captain's decision to reject was based on the fact that he did not recognize the initial sound and subsequent thumping noises, and that, because he thought the bang could have been a bomb, he had concerns about the integrity of the aircraft and its ability to fly. Also, the captain stated that, based on the rejected take-off provisions in the DC-10 Flight Manual and on a fatal DC8 accident that he had witnessed, he had developed a mental rule to not take an aircraft into the air if he suspected that there was aircraft structural failure.

The captain indicated that the time delay between retarding the power levers and selecting reverse thrust was, in part, due to an expletive expressed by another crew member, which interrupted his thought process.

The FDR data showed that, when the captain made his decision to reject the take-off, the number 1 engine EGT was above 950 degrees and the N1 speed had decayed to below 85 per cent. None of the crew members noticed anything unusual about the engine operation during the take-off roll, including the second officer, whose prime duty is to watch the engine instruments. The crew reported being extremely startled by the suddenness and intensity of the loud bang, and none of the crew members recognized the sound or its origin. Because the number 1 engine was still operating in the idle range when the aircraft came to a stop, the crew were not aware that there had been a power loss on that engine until this fact was discovered on the FDR data.

1.15 Organizational and Management Information

1.15.1 Regulatory Overview - General

The last national audit of CAI was accomplished between 21 September and 23 October 1992. The conclusions of this audit were that the company systems were sufficiently responsive and capable of initiating necessary or desirable program changes to meet regulatory requirements, and that the quality of aircraft condition and on-time performance was directly attributable to CAI's system-wide commitment to program quality.

The audit noted that CAI's maintenance and engineering organization operated in a professional manner and strived to achieve a high quality standard. It was noted that the aircraft were well maintained and MEL deferrals were held to a low level. Although no formal, national audit has taken place since then, CAI has a system in place for internal maintenance audits. These audits are ongoing and TC does send an observer during some of these audits. Although some problems are always uncovered during these audits, regional TC airworthiness officials expressed no concern about CAI's maintenance operation.

1.15.2 Maintenance Management Issues

Because of financial pressures on the airline, all sections of the airline had been examining their operations and finding ways to reduce costs. In the maintenance department, a 30 per cent decrease in budget has required centralizing many of the maintenance functions and reducing staff and middle-management levels. However, the dispatch reliability and use of the MEL have remained relatively constant. The mechanical scheduled reliability of the DC-10 fleet at CAI was just over 92 per cent in 1989 and had been steadily improving to 96 per cent in 1994. The number of open MEL items per day per aircraft was approximately 0.5 in 1990, 0.3 in 1991, 0.3 in 1992, 0.2 in 1993, and 0.6 in 1994.

1.16 Aircraft Performance Issues

1.16.1 Aircraft Performance Issues - General

A detailed examination of aircraft and systems certification criteria and of documented performance data was carried out to evaluate the performance of the aircraft and its systems during the occurrence. These were then compared with the accident scene evidence, CVR/FDR data, theoretical performance studies by the manufacturer, and simulator flights.

1.16.2 Acceleration to V1 (164 knots)

The DC-10 Flight Study Guide produced by the manufacturer describes the rolling take-off as the most desirable take-off method because it expedites traffic flow, realizes fuel economies, and provides greater comfort. The guide states that both the static and rolling techniques provide essentially the same take-off distance. CAI's DC-10 FCOM recommends that, when conditions permit, crews use a rolling take-off for reasons of passenger comfort, fuel economy, and aircraft performance.

The aircraft was cleared for take-off as it was rolling towards the runway, via a 45-degree-angle taxiway. Based on the FDR data, the aircraft's groundspeed was calculated to be approximately 15-17 knots as the aircraft entered the runway, and the power levers were advanced rapidly to the take-off power setting of 112 per cent N1.

The manufacturer indicated that there is no performance difference between a rolling and static take-off; however, neither the manufacturer's performance program nor the simulator sessions could provide data upon which to evaluate the performance of the occurrence aircraft in this phase of the take-off. Analysis of the FDR data indicated that the aircraft, using a rolling take-off, reached 164 knots at a point 6,200 feet from the button of runway 26. The manufacturer's calculation was that a static take-off should have taken 6,227 feet. In addition, the actual acceleration performance curve, as shown in Figure 2, closely matches that of the predicted performance for an aircraft weighing 590,000 pounds.

1.16.3 Acceleration From V1 to Reject Initiation

Following the V1 call, the aircraft continued to accelerate at 0.16 g until the aircraft reached 170 knots, at which time the acceleration decreased by approximately 30 per cent to 0.11 g. By this time, the aircraft was 6,750 feet from the start of the runway, and was at the point at which the CVR recorded the thudding sounds and the FDR recorded the sudden drop in N1 speed on engine number 1.

The memory checklist items for rejected take-off procedure are described in CAI's DC-10 FCOM as follows:

1. Captain commands "REJECT."
2. Captain retards throttles to idle, immediately selects full reverse thrust and observes or applies maximum antiskid braking.
3. F/O monitors airspeed, applies slight forward pressure on the control column, and maintains wings level. The S/O announces the status of reverse thrust, verifies that auto spoilers have activated, and monitors engine instruments. S/O extends manual ground spoilers if required.
4. Captain maintains directional control. Captain moves reverser levers to reverse idle detent, then to forward idle position when safe stop is assured.
5. F/O advises tower of rejected take-off and requests assistance, if required.

CAI's DC-10 standard operating procedures provide additional guidance on spoiler deployment during a rejected take-off. Specifically, when the captain calls "REJECT," the second officer is to monitor auto spoiler deployment; if the spoilers do not deploy automatically, the second officer is to call "NO SPOILERS" and, without further command, to pull the spoiler handle full aft and up.

On the occurrence flight, the captain called the reject 1.3 seconds after the power loss, and initiated reject action 0.8 seconds later by retarding the power levers to idle as the aircraft was accelerating through 172 knots, 7,300 feet along the runway^{Footnote 17}. The second officer, noting that lights indicating that the thrust reversers were deploying had not come on, called "No reverse" and immediately moved the spoiler handle back. As a result, the spoilers were deployed and the auto-brake system activated. At this point, the aircraft had accelerated to 175 knots and was 7,850 feet from the start of the runway, and 3,150 feet from the end of the runway.

1.16.4 Deceleration Performance

Activation of the ABS and spoilers resulted in an initial deceleration rate of 0.46 g. A peak deceleration rate of 0.47 g occurred when reverse thrust power was applied as the aircraft was decelerating through 140 knots, 1,850 feet from the end of the runway.

As the aircraft slowed down, there was a gradual loss of deceleration due to the decreasing aerodynamic drag and the reduced effectiveness of the brakes as they heated up from use. As indicated in Figure 2, the occurrence aircraft's performance was slightly better than the deceleration performance predicted by the manufacturer for a 590,000-pound aircraft.

The aircraft went off the end of the runway at 43 knots. The manufacturer's data indicate that a deceleration from 43 knots to a stop on a paved runway surface would have taken approximately 400 feet.

1.16.5 Accelerate/Stop Performance Summary

The following chart summarizes the acceleration performance comparisons:

The theoretical performance figures do not take into account the line-up distance. According to the manufacturer, the minimum distance would be 0.8 of one aircraft length for a 90-degree entry to the runway; for the DC-10, this would be 146 feet.

The manufacturer's prediction of the accelerate-stop distance for a DC-10-30ER at 592,000 pounds was 34 feet more than the distance predicted for a 590,000-pound maximum take-off weight.

1.16.6 Accelerate-Go Performance

FDR/CVR data indicated that the engine power loss occurred at a speed of 170 knots, when the aircraft was 6,750 feet from the start of the runway and 4,250 from the end of the runway. This point of power loss was 550 feet beyond the point that V1 was called, and about 275 feet beyond the point that the aircraft accelerated through C2B power V1 speed of 167 knots. When engine number 1 lost power, engines 2 and 3 were still producing take-off thrust. Because there were no other factors that would have adversely affected the aircraft's performance, the DC-10-30ER certification data indicate that, at the time of the engine failure, the aircraft would have been able to continue the take-off and get airborne safely with only two engines operating.

1.16.7 Take-off Performance Below Sea Level Calculations

During the review of the take-off performance calculations for the flight, it was noted that the TPS incorrectly calculated the effect of below sea level pressures on engine performance. The manufacturer confirmed that the engine thrust curves indicated less thrust output for operations at below-sea-level pressure altitudes; whereas the TPS program calculated that performance increased as pressure altitude decreased below sea level.

The CAI DC-10 FCOM and the OD43J Performance Manual also do not incorporate a performance-reduction correction for operations at below-sea-level pressure altitudes.

1.16.8 Auto-brake System Certification and Performance

When the DC-10 was initially certified, it was not equipped with an ABS. However, the DC-10 was later equipped with an ABS following the airline industry's study of overrun occurrences, which indicated that crews did not optimally use the manual brakes. In particular, investigations into many of these occurrences determined that the pilots did not maintain maximum brake pressure or that they released brake pressure before the stop on the runway was assured.

The ABS on the DC-10 provides the means for automatic brake application during take-off or landing. The ABS take-off mode is armed, in part, by selecting "T.O." on the AUTO BRAKE deceleration selector. The ABS take-off mode is activated during a rejected take-off when the spoilers are deployed and the throttle angle is less than 15 degrees. Automatic activation of the spoiler handle occurs when the thrust reversers are deployed; alternatively, the spoilers can be deployed manually by pulling the spoiler handle back. Once automatic brakes are applied, reversion to manual braking will occur when the brake pedals are depressed beyond approximately 40 per cent of pedal travel.

The DC-10 FCOM states than an ABS malfunction will cause the system to automatically disarm and to illuminate the AUTO BRAKE light and the MASTER CAUTION light. The aircraft manufacturer has indicated that it is possible to have failures in the system that will not result in the warning features outlined in the FCOM. Although the manufacturer recognizes that a properly functioning ABS will provide more consistent braking than manual braking, it also acknowledges that there will be a slightly slower brake initiation time with the ABS. Also, there are potential risks associated with crews performing the multiple actions required to automatically deploy the ground spoilers and/or reacting to an ABS failure. Although the manufacturer does not specifically recommend the use of ABS for rejected take-offs for these reasons, a Douglas publication, Rejected Takeoffs - A Refresh Look, which is contained in the DC-10 FCOM, states that "Low workload and positive deployment of the ground spoilers with associated immediate application of full anti-skid braking gives the ABS some very significant advantages in successfully accomplishing the RTO [rejected take-off] manoeuvre."

The FAA-approved DC-10 Flight Crew Operating Manual, Volume II, states that, for a rejected take-off, the pilot flying "simultaneously retards the throttles and applies maximum braking." Section IV of the FAA-approved Aircraft Flight Manual states that "throttles should be retarded to idle at engine failure recognition while simultaneously applying maximum braking (full pedal deflection)." Although these sections of the Flight Crew Operating Manual and Aircraft Flight Manual are silent on the use of ABS for rejected take-offs, Appendix XXIII to Section III of the Aircraft Flight Manual does include the cockpit selections to prepare the ABS for take-off, "if automatic braking is desired in the event of a rejected take-off."

In the CAI TC-approved DC-10 FCOM, rejected take-off procedures put priority on the use of auto-brakes. The taxi check requires that the ABS be armed for all take-offs. When a take-off is rejected, the captain is to observe that full automatic braking is applied or apply maximum braking, and, if the automatic braking system malfunctions, the captain is to apply maximum antiskid braking (full pedal deflection) until the aircraft stops. Crews are also trained to use ABS during rejected take-offs.

On the occurrence flight, the ABS began applying pressure 1.8 seconds after the captain pulled the power levers back to idle. This activation of the ABS was the direct result of the second officer manually deploying the spoilers when he noted that the thrust reversers had not been selected. The thrust reversers were not deployed until 3.5 seconds after the power levers were retarded. The brake pedals were not used by the crew during the rejected take-off.

The FDR data indicate that the distance travelled from the point that the captain retarded the power levers at 172 knots to the point that the aircraft was decelerating through 172 knots was about 800 feet. Based on a predicted 3.1-second crew reaction time, as determined during the DC-10 certification process, the crew reaction plateau should have been 900 feet.

1.16.9 Effect of Thrust Reversers

The DC-10 FCOM provides information on the amount of reverse thrust generated by each engine. This table indicates the pounds of reverse thrust for engine N1 speeds of 90 per cent. The manufacturer determined that, for the occurrence aircraft and the conditions at the time of the accident, and from a V1 of 164 knots, the reverser on engine 3 would have shortened the aircraft's stopping distance by 131 feet. Had the thrust reverser on engine number 2 been in use, it would have shortened the stopping distance by an additional 134 feet.

1.17 Wet Runway Rejected Take-off Considerations

1.17.1 Wet Runway Requirement - General

Although a wet runway was not a factor in this occurrence, the investigation into the performance issues noted that weather records indicate that wet runways are the norm at Vancouver on 21 days during the month of October. The take-off performance data charts for the DC-10, however, do not include provisions for the adverse effect of wet runways on the accelerate/stopping distances. Although there are provisions for take-offs on contaminated runways, these standards only apply to snow, slush, and ice covered runways, and runways with standing water or pooling in excess of 0.25 inches. For landings, provisions in the DC-10 operating manual require that dry-runway landing distances be increased by 15 per cent when the runway is wet. However, neither the FAA nor TC certification requirements or regulations appropriate to the DC-10 require that wet runways be taken into account for take-off operations.

Other certification agencies, such as the United Kingdom Civil Aviation Authority (CAA), require that aircraft manufacturers provide performance data for take-offs on wet runways. The CAA also requires that operators certified in the United Kingdom take into account wet runways. To meet these CAA requirements, McDonnell Douglas produced a chart, labelled "Wet Runway RTO Stopping Distance Increment," showing the wet runway adjustments for the DC-10-30. This chart is premised on the use of two engines in thrust reverse^{Footnote 22}.

CAI, in common with most carriers in North America, does not have any procedures to compensate for the reduced braking action that would occur as a result of a rejected take-off on a wet runway surface. To date, the aviation industry and regulatory authorities have not been able to resolve this issue for North American certified aircraft. Calculations using the McDonnell Douglas wet runway chart indicate that, had the runway been wet, Flight 17 would have required an additional 880 feet to stop.

1.17.1.1 Past Occurrences and Safety Action in Canada

As a result of the investigation into the 20 July 1987 B737-200 rejected take-off accident (take-off was rejected below V1) at Wabush, Quebec, the Canadian Aviation Safety Board (CASB), on 28 September 1987, recommended that:

The Department of Transport revise air carrier procedures involving wet runway take-off operations, in order to provide a margin of safety comparable to that for dry runway operations;

(CASB 87-45)

and that

The Department of Transport require air carriers to improve flight crew knowledge of the effects of wet runways on take-off performance and the means available to flight crews to provide a margin of safety comparable to that for dry runways.

(CASB 87-46)

Transport Canada responded to the recommendations by indicating that performance data for wet runways are limited and by stating that:

Transport Canada will request the Transport Development Centre to initiate a research project to investigate the effects of wet runways on aircraft performance.

The CASB, in a 15 March 1988 letter to TC, agreed that a research project was a sound long-term measure for the prevention of wet runway RTO accidents, but expressed regrets that the Transport Canada response was limited to a study.

A study entitled Aircraft Take-off Performance and Risks for Wet and Contaminated Runways in Canada was conducted by Sypher Mueller International Inc. for the Transport Development Centre. Among the conclusions of the 1991 report are the following:

The accelerate-stop distance is increased by approximately 15% on wet runways, 50% on snow, 75% on water deeper than 3 mm and 100% on ice covered runways; and

The combination of contaminated runway and critical event such as engine failure near V1 pose threats to safety under current regulations.

The report also recommended that a Phase II of the study be undertaken, which would investigate contaminated runway performance and determine the operational problems and costs of implementing new regulations ("countermeasures"). There is no indication that a Phase II took place.

The Moshansky Commission of Inquiry into the Air Ontario Crash at Dryden, Ontario, made the following recommendations related to wet runway operations:

Transport Canada require that aircraft flight manuals and related aircraft operating manuals contain approved guidance material for supplementary operating procedures, including performance information for operating on wet and contaminated runways;

(MCR 43)

and

Transport Canada, in cooperation with aircraft manufacturers and operators, expedite the search for a technically accurate means of defining runway surface conditions and their effects on runway performance.

(MCR 44)

In July 1995, in its final response to the Moshansky Commission of Inquiry, Transport Canada presented its planned implementation measures. Regarding MCR 43 and MCR 44, the implementation measures include the following:

To participate actively with manufacturers, operators, and other civil aviation authorities in the international fora, with a view to achieving international harmonization of international standards;

To amend Canadian Aviation Regulations to require, for turbo-jet aircraft, that operations manuals contain performance information for operating on wet and contaminated runways;

To form a government industry working group, under the Canadian Aviation Regulation Advisory Council, to develop the associated standards;

To have the Transport Canada Aviation's Standing Committee on Operations Under Icing Conditions carefully review the research and development plan regarding operations on wet and contaminated runways in order to identify research priorities and to make funding recommendations; and

Prior to the full implementation of the above, to use Air Carrier Advisory Circulars to communicate the significant information contained in the Sypher Mueller report.

Section 525.1581 (g) of the Canadian Airworthiness Standards was modified on 30 December 1993 to state, "The Aeroplane Flight Manual shall contain information in the form of approved guidance material for supplementary operating procedures and performance information for operating on wet and contaminated runways." With the introduction of the new Canadian Air Regulations, the operators will be required to use this guidance material. However, the Airworthiness Standards in Section 525.1581 (g) will only apply to newly certified aircraft types and not to aircraft like the DC-10.

1.17.1.2 Past Foreign Occurrences and Safety Action

The United States National Transportation Safety Board (NTSB) has conducted considerable investigative work on contaminated runway issues. In 1982, as a result of several serious overrun accidents, the following recommendations were issued to the FAA:

Amend 14 CFR 25.107, 25.111 and 25.113 to require that manufacturers of transport category airplanes provide sufficient data for operators to determine the lowest decision speed (V1) for airplane take-off weight, ambient conditions, and departure runway length which will comply with existing take-off criteria in the event of an engine power loss at or after reaching V1.

(NTSB A-82-163)

Amend 14 CFR 121.189 and 14 CFR 135.379 to require that operators of turbine engine-powered, large transport category airplanes provide flight crews with data from which the lowest V1 speed complying with specified take-off criteria can be determined.

(NTSB A-82-164)

The NTSB conducted a special study (SIR-90/01) which reviewed accidents and incidents involving runway overruns following high-speed rejected take-offs. As a result of this review, the NTSB, on 04 April 1990, issued a series of recommendations to the FAA, A-90-40 to A-90-48. These recommendations, in part, addressed such items as the definition of V1, the accuracy of take-off information provided to operators and their crews, factors which adversely affect stopping distance, and policies related to operations from contaminated runways.

Action by the FAA and industry has continued in the nearly six years since the issuance of the NTSB recommendations, the latest of which was a Notice of Proposed Rulemaking (NPRM) 93-8, which would amend current standards (14 CFR Parts 1, 25, 91, 121 and 135) to, in part, take into account the effect of wet runways on take-off performance. According to NPRM 93-8, this action is being taken to improve the current standards, reduce the impact of the standards on the competitiveness of new versus derivative airplanes without adversely affecting safety, and harmonize with the proposed standards for the European Joint Aviation Requirements (JAR).

Nevertheless, NPRM 93-8 also states that the revised standards would not be applied retroactively either to airplanes currently in use or to airplanes of existing approved designs that will be manufactured in the future. JAR requirements will be applied to aircraft currently in use.

2.1 General

The information gathered during the investigation indicates that the aircraft was maintained in accordance with manufacturer's specifications and applicable regulations. Other than the problems with the number 1 engine and the disabled thrust reverser on engine number 2, the aircraft systems operated as designed, and did not contribute to the overrun or adversely affect the evacuation of the aircraft. In particular, the wheels, tires, brakes, spoilers, and antiskid systems performed according to specifications.

The runway surface was dry, and, based on the results of surface friction testing and the tire marks on the runway, the braking action on the day of the occurrence was ideal. As well, the aircraft's performance during the acceleration to the point of engine power loss and the deceleration following this event closely matched the manufacturer's theoretical predictions.

Although the unavailability of audio panel 2 resulted in a short delay in the captain's ordering of the evacuation, and although some cabin crew members did not recognize the evacuation tone, the evacuation of the aircraft went well. The cabin crew reacted to the rejected take-off and subsequent evacuation in accordance with the established procedures. Language differences did not present a problem during the evacuation or thereafter.

The response to the occurrence by emergency response services, airport authorities, and company personnel was well coordinated and timely, largely due to the continued preparation and practice for this type of event by all those involved. There was, however, some delay in transporting the passengers from the occurrence site.

This analysis will concentrate on the technical and management issues affecting the engine power loss, and those operational factors affecting the flight and crew decision making.

2.2 Engine Number 1 Loss of Power

The power loss on the number 1 engine was sudden and occurred without being recognized by the flight crew. The rising internal engine temperature and uncommanded decrease in N1 speed, accompanied by the loud bang and a number of thuds, are indicative of a series of engine stalls. The inability of the number 1 engine to increase in speed in response to the selection of reverse thrust indicates that the stall never cleared itself, or that damage to the compressor was such that proper airflow through the engine could not be re-established.

It was not possible to determine which compressor blade broke first. It was also not possible to determine whether the compressor stall initiated the compressor blade failures, or whether a blade failure initiated the events leading to the stall. The propagation rate of the fatigue fractures on the blades also could not be determined. Nevertheless, the gradual increase in EGT and fuel flow on engine number 1 since 14 October 1995, and the stained and tarnished appearance of some fatigue fracture surfaces of the compressor blades indicate that the damage to the compressor had built up gradually, and that, on the day of the occurrence, the combination of the compressor condition and the demand for power during the take-off created the conditions that resulted in the compressor stall.

There were no signs of foreign object damage to the fan blades or the blades of stage 1 and stage 2 of the high-pressure compressor section. The fatigue fractures of the high-pressure compressor blades originating from the blade edges suggest that the damage to these blades, in stages 3 through 12, was secondary. Although the cause of the measurable deformation of blade 31 and the initiating mechanism to its cracking could not be determined, foreign object damage cannot be ruled out.

2.3 Engine Number 1 Trend Monitoring

CAI's trend monitoring program for its DC-10 engines met the specifications of General Electric's guidelines. These guidelines, in allowing each operator to establish its own procedures, did not specify how much time should be taken to complete the analysis of the trend data. The procedures used by CAI were not fast enough to have the information on the previous day's flight available for analysis by the power plant engineering group before the occurrence aircraft took off.

Had CAI's maintenance personnel known that the trend of the EGT of engine number 1 had reached 27 degrees and that there was a corresponding upward trend on the fuel flow and engine core speed (N2), a borescopic inspection of the engine probably would have been done. An inspection would most likely have discovered the damage to the high-pressure compressor section, so that appropriate maintenance could have been performed prior to the flight.

2.4 Rejected Take-off Decision Making

2.4.1 Influences on the Decision to Reject

The captain's decision to reject the take-off was based on his perception of the circumstances. The influences that could have shaped his understanding of the situation were his training and experience, his perceptions as to flexibility provided by the use of C2B power, and the available visual and aural cues. In addition, the wording contained in the CAI DC-10 FCOM, that a "further 3 seconds is allowed until full braking with spoiler actuation is attained," may be ambiguous in that it implies that some time beyond V1 is available for the pilot reaction. The limited published information regarding the inevitability of an overrun when a take-off is rejected beyond the V1 speed could also lead to this adverse consequence not being considered in the decision to reject.

The captain's understanding was that an engine failure would not be an adequate reason to initiate a rejected take-off after V1. In this case, however, prior to making his reject decision, he did not see or perceive indications, or hear advice from his crew, that an engine failure had occurred. Also, the loud bang was neither similar to any compressor stall symptom that he knew about, nor similar to sounds that he had heard in training or experienced during actual flying.

All the members of the flight crew reported that the sound was unlike anything they had heard before. Not only was the bang very loud, but it was difficult to specify its point of origin. None of the crew saw the engine fail light illuminate^{Footnote 23}, nor did they notice the drop in N1. The only cue the captain received to indicate that the take-off was no longer normal was the loud bang, followed by a series of thuds and vibrations. Because the situation did not match any of the captain's previous training or actual flying experience, he was required to respond instantly to the situation by drawing on whatever knowledge or other experience he had.

When the captain heard the loud bang, he immediately thought of a bomb. The only procedural guidance available for this circumstance was that a rejected take-off after V1 could be initiated when "the captain believes that the aircraft has suffered catastrophic failure and will not fly." According to the captain, his action was probably also influenced by the fatal DC8 occurrence that he had witnessed and which resulted in his mental rule of thumb that if structural failure were suspected, he would not take the aircraft into the air.

When the captain decided to reject the take-off, it was his correct belief that, because they were using C2B power figures, the aircraft would have reached the 164-knot V1 earlier, and that there would be additional runway available for the reject. Based on this fact and his visual impression of the runway available, he was confident that the aircraft would be able to stop on the runway.

2.4.2 Engine Malfunction Recognition

Although the flight crew members were all very experienced pilots and had taken simulator and ground training throughout their careers, they did not recognize the loud bang produced by the stall on engine number 1 for what it was probably for the following reasons:

1. None of the flight crew members had ever experienced such a compressor stall;
2. There is no information in operational and training manuals or in other guidance material on the symptoms of large-fan engine stalls; and,
3. Current simulator training and ground training do not provide this knowledge.

Additionally, the engine instruments and warning systems were not compelling enough in this situation for the crews to recognize the initial engine stall or the resulting engine failure.

2.5 Performance Issues

2.5.1 Performance - General

The distance used for the aircraft to accelerate to 164 knots was the same as predicted by the manufacturer's data for a static take-off; consequently, the rolling take-off procedure was not a factor in this occurrence. Also, up to the time of the power loss on engine number 1, the aircraft's overall performance was normal for a 590,000-pound DC-10-30ER. Based on the assessed aircraft position on the runway at the time of the power loss, the reaction time of the crew, and the actual deceleration performance of the aircraft, the aircraft's deceleration performance was also normal. The significant differences in overall accelerate/stop distance from the C2B-power certification data were the following: the additional 533 feet covered from the C2B-power 167-knot V1 point to the point of initial crew action to reject at 172 knots; and the additional 210 feet required to brake the aircraft from 172 knots to 167 knots. Based on the speed at which the aircraft went off the end of the runway, an additional 400 feet would have been required to bring the aircraft to a stop on a hard runway surface. The availability of a number 2 engine thrust reverser could have reduced the stopping distance by 134 feet.

2.5.2 Use of Auto-brakes

The elapsed time from the moment the captain started to retard the power levers to the point that the ABS system applied full brake pressure was 1.8 seconds. Had the crew relied on the ABS being activated by thrust reverser selection, which occurred approximately 3.5 seconds after the power levers were retarded, the aircraft would have run off the end of the runway at a speed in excess of 80 knots, instead of at 40 knots. The captain allowed the ABS to bring the aircraft to a stop with maximum braking being applied and maintained throughout the rejected take-off.

Although the current DC-10 Abnormal Procedures do not call for immediate manual activation of the spoilers, the second officer's actions to do so, in accordance with CAI standard operating procedures, greatly reduced the amount of overrun.

The CAI procedure to use ABS during a rejected take-off, as contained in its TC-approved DC-10 FCOM, may be viewed as being in conflict with the manufacturer's recommendation to use manual brakes, as contained in the FAA-approved Flight Crew Operating Manual.

Although a manual braking procedure could have resulted in braking being applied quicker, evidence from previous occurrences indicates that it is unlikely that maximum, continuous brake pressure would have been maintained until the aircraft stopped.

The FDR data indicate that the crew reaction plateau for this occurrence was somewhat better (shorter) than the theoretical 3.1-second, 900-foot plateau. Also, the FDR data indicate that the use of ABS during the deceleration resulted in deceleration performance that slightly exceeded the manufacturer's predicted performance.

2.6 Aircraft Load Control Factors

The integrity of the overall control of the weight and balance of an aircraft relies on everyone involved in the process adhering to the established procedures. The fuel load, passenger count, and baggage count discrepancies noted on this flight may suggest a lack of appreciation by those persons involved of the critical nature of their role in the overall integrity of the load control system. The cumulative total of the loading discrepancies noted on this flight was approximately 2,000 pounds. Although the captain may have been unaware that the weight of the aircraft on the final load closeout was only 117 pounds short of the maximum brake-release weight, he was aware that there were at least 1,000 more pounds of fuel loaded on the aircraft. Therefore, he should have been aware that the reduced taxi fuel burn would result in the aircraft take-off weight being in excess of the 590,000-pound limit.

Although the performance degradation caused by an additional 3,000 pounds to an aircraft like the DC-10-30 at maximum gross weight can be viewed as negligible, the load-control discrepancies noted for this flight probably resulted in the aircraft being over its maximum design ramp weight and its maximum design take-off weight.

2.7 Evacuation Signal System

The evacuation signal on the occurrence aircraft was examined and found to be functioning in accordance with the manufacturer's specifications and at the volume of the signals on the other company DC-10 aircraft and crew training doors. The Flight Attendant Manual states that "Flight attendants are required to conduct an evacuation when signalled to do so by the flight deck or by the evacuation signal system." However, training evacuations have not been initiated based solely on the evacuation signal.

There may also be an anomaly between the sequencing of the evacuation command and signal as described in the Flight Attendants' Manual and the sequence outlined in the DC-10 Flight Crew Manual. Specifically, the Abnormal Standard Operating Procedures of the Flight Crew Manual state that the signal is to be activated when, or at the same time as, the captain gives the command to evacuate; the Flight Attendants' Manual, however, states that the evacuation signal will follow the captain's command.

When the evacuation signal sounded, it was not immediately recognized by some of the flight attendants due to the perceived low volume of the signal. This perception probably was the result of three factors:

1. The DC-10 door trainer was not equipped with an evacuation signal; therefore, the flight attendants would have had no experience with the evacuation signal system on the DC-10 or exposure to its sound in training;
2. The evacuation signal came before the captain's command to evacuate, which differed from the expectations of the flight attendants; and
3. Evacuation training is never done using the evacuation signal system alone.

To optimize individuals' performance, training conditions should be highly similar to actual on-board conditions. In this occurrence, because the flight attendants had not been exposed to the evacuation signal system on the DC-10 in training, and because they had not been trained to evacuate an aircraft in response to the evacuation signal system alone, the sounding of the signal before the announcement from the captain caused momentary indecision and was not recognized as a signal to evacuate.

2.8 Evacuation Slide/Raft Cover

Although not considered a factor in this occurrence, the extension of the evacuation slide/raft covers down into the exit door openings would have obscured the vision and path for taller people, which could have slowed the flow of persons using the exit to evacuate the aircraft. Had these covers been pushed closed, they would been held in the closed position by the magnetic latches.

CAI's detection of similar problems on its other DC-10 aircraft indicates that the problem of weak spring hinges could be a DC-10 fleet problem.

2.9 Wet Runway Considerations

Although a wet runway was not a factor in this occurrence, wet runways are the norm at Vancouver on more than 60 per cent of the days during the month of October. Had the runway been wet, the runway overrun would have been significantly longer and the adverse consequences of the overrun much greater.

Based on the McDonnell Douglas DC-10-30 Wet Runway RTO Stopping Distance Increment, currently in use in the United Kingdom, the aircraft would have required an additional 880 feet to stop on a wet runway. Based on the actual distance used by the aircraft to accelerate to 164 knots (6,200 feet) using C2B power, the theoretical crew reaction and deceleration distance (4,152 feet), and the wet runway factor, the aircraft would not have been able to stop on a wet 11,000-foot runway, even if the rejected take-off were to have been initiated at the 164-knot V1 point.

Past TSB and NTSB recommendations to establish regulations requiring that reduced braking effectiveness on wet runways be taken into consideration when calculating accelerate/stop take-off distances have not resulted in effective safety action. Even if the planned rule-making by the FAA as a result of NPRM 93-8 is implemented, the requirement to take into account wet runway conditions when calculating accelerate/stop distances will not be retroactive and will not apply to CAI's fleet of DC-10s.

1. The flight crew were qualified and licensed for the flight.
2. The cabin crew were qualified and certified for the flight.
3. Records indicate that the aircraft had been maintained in accordance with the company's Maintenance Control Manual and applicable airworthiness standards.
4. The TPS incorrectly calculates the effect of below sea level pressure altitude on aircraft climb performance.
5. The loud, startling bang occurred 2.2 seconds after the V1 call as the aircraft accelerated through 170 knots.
6. The loud bang was a sound unlike anything the flight crew had heard before in training or in flying.
7. The captain called for the reject and started to retard the power levers as the aircraft accelerated through 172 knots.
8. The captain's decision to reject was based on the fact that he did not recognize the initial sound and subsequent thumping noises, and that, because he thought the loud bang could have been a bomb, he had concerns about the integrity of the aircraft and its ability to fly.
9. The wording contained in the CAI DC-10 FCOM, that a "further 3 seconds is allowed until full braking with spoiler actuation is attained," may be ambiguous in that it implies that some time beyond V1 is available for the pilot's initial reaction.
10. The rising internal engine temperature, the uncommanded decrease in N1 speed, the loud bang, and the thuds are indicative of a series of engine stalls.
11. None of the flight crew noticed an indication of engine failure, or realized that there had been a power loss on engine number 1 until after the FDR data was made available.
12. The rolling take-off did not add to the runway distance required for the acceleration to V1.
13. The CAI procedure to use ABS during a rejected take-off differs from the manufacturer's recommendation to use manual brakes. The use of ABS did not add to the theoretical distance required for the rejected take-off.
14. The acceleration and deceleration performance of the aircraft closely matched the predicted performance of a DC-10-30ER weighing 590,000 pounds.
15. According to the manufacturer's data, the use of the thrust reverser on engine number 2, had it been available, could have reduced the distance required to stop by 134 feet.
16. The aircraft's auto-brake system, brakes, antiskid system, and tires functioned properly throughout the rejected take-off.
17. The runway surface was dry and braking action was ideal.
18. A number of blades in the high-pressure compressor of engine number 1, from stage 3 on, exhibited signs of fatigue cracks. Some cracks predated the occurrence engine stall event.
19. Engine number 1, stage 3, blade 31 was found to be bent, and the fatigue crack on this blade originated at mid-chord. Although the cause of the deformation of blade 31 and the initiating mechanism to its cracking could not be determined, foreign object damage cannot be ruled out.
20. The physical evidence did not yield sufficient information to determine the cause of the fatigue cracking nor to estimate the crack propagation rates.
21. CAI's trend monitoring of its DC-10 engines indicated that there was a problem with engine number 1, but the process used to analyze the trend data was not timely enough to result in the required maintenance action being taken before the flight.
22. The manufacturer's trend monitoring guidelines do not specify urgency or how much time should be taken to complete the analysis of the trend data.
23. The final fuel load that was passed to the Operations Agent for input into the TPS was 1,100 pounds below the total of the readings of the fuel tank gauges.
24. Based on the LPS final Load Closeout figures and the discrepancies noted in the ramp fuel weight, passenger baggage weight, and the taxi fuel burn, the occurrence aircraft could have been up to 951 pounds over maximum ramp weight and 2,901 pounds over the maximum design take-off weight.
25. The emergency response to the occurrence was well coordinated and timely because of the continued preparation and practice for this type of event by all those involved.
26. The Flight Crew Operating Manual and the Training Manual do not contain information on the unavailability of audio panel 2 when the aircraft emergency power switch is ON. The company was not aware of this communications limitation.
27. Uncertainty by some flight attendants regarding the evacuation signal can probably be attributed to lack of exposure to the signal on the DC-10, and the fact that the signal and the captain's command were heard in the opposite order in training.
28. The weak spring hinges on the evacuation slide/raft covers could be a DC-10 fleet problem.
29. The first buses to arrive at the accident scene to transport the passengers from the accident site did not arrive until 45 minutes after the evacuation.
30. CAI, in common with other carriers in North America, does not have any procedures to compensate for the reduced braking action that would occur as a result of a rejected take-off on a wet runway surface, nor is there a regulatory requirement to have such procedures.
31. Calculations using the McDonnell Douglas Wet Runway RTO Stopping Distance Increment chart for the DC-10 indicate that, had the runway been wet, the aircraft would have required an additional 880 feet to stop.
32. Based on the actual distance used by the aircraft to accelerate to 164 knots (6,200 feet) using C2B power, the theoretical crew reaction and deceleration distance (4,152 feet), and the wet runway RTO stopping distance increment, the aircraft would not have been able to stop on a wet 11,000-foot runway, even if the rejected take-off were to have been initiated at the 164-knot V1 point.
33. Past TSB and NTSB recommendations to establish regulations requiring that reduced braking effectiveness on wet runways be taken into consideration when calculating accelerate/stop take-off distances have not resulted in effective safety action.

3.1 Causes and contributing factors

Engine number 1 lost power at a critical point in the take-off and the rejected take-off was initiated at a point and speed where there was insufficient runway remaining to stop the aircraft on the runway. Contributing to this occurrence were the misidentification of the cause of the loud bang and the lack of knowledge regarding the characteristics of engine compressor stalls. Contributing to the engine power loss was a delay between the collection and analysis of the engine monitoring data.

4.1 Action Taken

4.1.1 Engine Monitoring

Since the occurrence, CAI has taken steps to enhance the timeliness of its processing of engine trend monitoring data. In March 1996, CAI completed a program, begun before the occurrence, of equipping all of its DC-10 aircraft with an Aircraft Communications and Reporting System (ACARS), which can relay the flight data to ground stations. An interface program will be installed to acquire the airborne data and to feed this data through a ground-based personal-computer ADEPT program at CAI. The new procedures will require flight crews, using ACARS, to transmit engine readings to the ground station at the time that they are recorded. This new system will provide a near real-time acquisition, processing, and evaluation of the engine trend monitoring data.

Following the accident, the TSB forwarded a Safety Advisory to Transport Canada (TC) suggesting that other users of engine trend monitoring systems be advised of the safety benefits associated with timely analysis of engine data. TC subsequently published an article regarding jet engine fault monitoring in its Maintainer newsletter and is planning a similar article for the Feedback newsletter.

4.1.2 Evacuation Slide/Raft Cover Hinge Springs

Following the discovery of the problem with the hinge springs, CAI conducted a special inspection of the slide/raft covers on all its DC-10 aircraft, and found similar problems. As a result, CAI has begun retrofitting its DC-10 aircraft with larger hinge springs as recommended in McDonnell Douglas MD-11 Service Bulletin 25-148.

TC has sent a letter to the Federal Aviation Administration (FAA), requesting that the FAA urge McDonnell Douglas to address the problem of the DC-10 chute/raft cover hinge springs through action similar to that recommended in Service Bulletin 25-148 for the MD-11.

The FAA and McDonnell Douglas agreed with this course of action, and Service Bulletin DC10-25-367, applicable to DC-10 chute/raft cover hinge springs, has been issued by McDonnell Douglas.

4.1.3 Take-off Performance System Changes

American Airlines Corporation (AMR) has stated that software changes are being developed to correct the Take-off Performance System (TPS) program errors in calculating engine thrust when pressure altitudes are below sea level. AMR is also amending the TPS program to make it possible for crews to obtain performance data for power settings other than the TPS selected settings.

The TSB is investigating occurrences in which errors in ground-based aviation related software adversely affected safety. The adequacy of current quality assurance methods for such software is being examined.

4.1.4 Passenger Recovery

The Vancouver International Airport Authority reports that, in response to the delays in recovering the passengers of Flight 17 from the accident site, the Airport Duty Manager Incident Call Out/Checklist has been revised. The checklist for the Airport Duty Manager in the Emergency Operations Centre now reflects the need to call the Vancouver International Airport Authority Ground Transportation Department to acquire immediate bus transportation. Buses will be requested from the Airport Authority's fleet of shuttle buses normally used for transportation to and from public and employee parking lots. Using the Airport Authority shuttle buses is meant to complement the efforts of the individual air carriers, who remain responsible for transporting the passengers from the accident site to the terminal building.

4.1.5 Spoiler Extension During Rejected Take-offs

As a result of CAI's assessment of the potential delay resulting from relying on the selection of thrust reversers to deploy the spoilers to activate the auto-brake system, CAI has redrafted its DC-10 Flight Crew Operating Manual (FCOM) rejected take-off checklist to indicate that the second officer "deploys the spoilers without command." CAI's DC-10 Standard Operating Procedures on rejected take-offs have also been amended to direct the second officer "as soon as the throttles are closed to pull the spoiler handle full aft and up without command."

4.1.6 MEL Changes

As a result of CAI's assessment of the potential adverse effect of a disabled thrust reverser on a high-weight rejected take-off, CAI redrafted its DC-10 MEL Item 78-01 Thrust Reverser/Fan Reverser. TC has approved CAI's MEL amendment which specifies that the dispatch of DC-10-30 aircraft within 20,000 pounds of its runway-limit weight or above 572,000 pounds with a thrust reverser disabled will require the concurrence of the captain and chief pilot and their favourable assessment of the take-off conditions and environment.

4.1.7 Communications Limitations

CAI amended its DC-10 FCOM and crew training program to include information about the unavailability of audio panel 2 when the aircraft emergency power switch is ON.

The TSB sent a Safety Advisory to TC suggesting that they liaise with McDonnell Douglas and the FAA concerning dissemination of information regarding the communication limitations associated with the use of emergency power on the DC-10.

4.1.8 Definition of V1 in DC-10 FCOM

The wording in the CAI DC-10 FCOM may be ambiguous in that it implies that some time beyond V1 is available before the pilot needs to initiate the rejected take-off. Given the potential for pilots to misconstrue the definition of V1 in the FCOM, and given the potential for adverse consequences as a result of rejecting a take-off after V1 (in a field-length-limited context), the TSB forwarded a Safety Advisory to CAI. The Advisory suggested that CAI might wish to amend the definition of V1 in the DC-10 FCOM and review the V1 definition in other pilot reference materials, including those for other CAI aircraft.

4.2 Action Required

4.2.1 Engine Malfunction Recognition

The captain did not recognize the loud bang as a symptom of a high bypass ratio engine compressor stall and thought that the noise might have been caused by a bomb. Consequently, he decided to reject the take-off even though the speed was above V1. Although the flight crew members were all very experienced pilots and had taken simulator and ground training throughout their careers, they had not been trained to recognize a loud bang as a symptom of a high bypass ratio engine compressor stall, and none of the crew members noticed the cockpit indications of power loss.

Rejecting a take-off at a speed above V1 during a field-length-limited take-off places an aircraft at more risk than continuing the take-off, and should not be attempted unless the pilot has reason to conclude that the airplane is unsafe or unable to fly. The FAA's Takeoff Safety Training Aid states that "in order to eliminate unnecessary RTOs, the crew must differentiate between situations that are detrimental to a safe take-off, and those that are not." Also, a Boeing report entitled Engine Plus Crew Error Events indicates that positive recognition and correct identification of engine malfunctions appear to be significant contributors to the outcome of engine-plus-crew-error events. If pilots do not consider a loud bang as a symptom of a possible compressor stall, they may assume that the noise was caused by a bomb (a much less likely event) and unnecessarily reject the take-off.

Crew errors are often associated with engine failures that create loud noises. The Boeing report indicates that the majority of engine-plus-crew-error events involved engine malfunctions that generated loud noise. The report further indicated that the number of such events involving high bypass powered aircraft had steadily increased over the last five years covered by the study.

Few resources are available to flight crews to aid in the quick identification of engine failure conditions. Neither engine manufacturers nor aircraft manufacturers have specific information available on the characteristics of high bypass ratio engine compressor stalls. The Boeing report observes that there is currently no flight crew training for positive recognition and correct identification of engine failure conditions; the noises, vibration, and other "cues" of real engine failures are not simulated in the vast majority of flight crew training simulators. In light of the risks associated with unnecessary rejected take-offs, the Board recommends that:

4.3 Safety Concern

4.3.1 Wet Runway Considerations

Despite the various recommendations, studies, and working groups pertaining to wet runway take-offs over the last 10 years, there is still no requirement for manufacturers to provide approved performance data for aircraft taking off on wet runways, other than for newly certified aircraft. Furthermore, there is no requirement for operators to take into account such data when calculating aircraft take-off performance. Although TC is pursuing these issues, corrective action does not appear to be imminent.

In light of previous recommendations on this subject and in recognition of TC's current related activities, the TSB does not plan to make new safety recommendations on this deficiency at this time. Nevertheless, the Board remains concerned that fare-paying passengers continue to be placed at risk when field-length-limited take-offs are conducted without taking into account reduced braking effectiveness on wet runways.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson Benoît Bouchard, and members Maurice Harquail and W.A. Tadros, authorized the release of this report on 09 October 1996.

Appendix A— Number 1 Engine ADEPT Printout

Appendix B— List of Supporting Reports

The following TSB Engineering Branch Reports were completed:

• LP 163/95 HP Compressor Failure; and
• LP 154/95 Flight Recorder Report.

These reports are available upon request from the Transportation Safety Board of Canada.

Appendix C— Glossary

ABS

auto-brake system

ACARS

Aircraft Communications and Reporting System

ADEPT

Aircraft Data Engine Performance Trending

AFM

Airplane Flight Manual

AMR

American Airlines Corporation

ASDA

accelerate stop distance available

ATPL

Airline Transport Pilot Licence

C2 CF6-50

maximum take-off power

C2B CF6-50

improved performance take-off power

CAA

United Kingdom Civil Aviation Authority

CAI

Canadian Airlines International

CAM

cockpit area microphone

CASB

Canadian Aviation Safety Board

CFR

Code of Federal Regulation (US)

CSD

customer service director

CVR

cockpit voice recorder

EGT

exhaust gas temperature

EOW

empty operational weight

FAA

Federal Aviation Administration

FAR

Federal Aviation Regulation

FCOM

Flight Crew Operating Manual

FDR

flight data recorder

F/O

First Officer

FOD

foreign object damage

FPS

flight planning system

g G

load factor

JAR

European Joint Aviation Requirements

kts

knots (nautical miles per hour)

LPS

load planning system

MEC

main engine control

MEL

minimum equipment list

mm

millimetre(s)

N1

engine fan speed

N2

engine core speed

NPRM

Notice of Proposed Rulemaking

NTSB

National Transportation Safety Board

PDT

Pacific daylight saving time

PTOW

planned take-off weight

RTO

rejected take-off

SABRE

AMR flight support computer system

S/CPL

Senior Commercial Pilot Licence

S/O

Second Officer

TC

Transport Canada

TODA

take-off distance available

TORA

take-off run available

TPS

Take-off Performance System

TSB

Transportation Safety Board of Canada

VEF

engine-failure speed

V1

Critical Engine Failure Recognition SpeedV1

V2

Take-off Safety Speed

VR

Rotation Speed

ZFW

Zero Fuel Weight