Case Study

Final Case Study- Aircraft Jet Engine Systems

 
Final Case Study on Aircraft Jet Engine System
This report will focus on the system of commercial aircraft jet engines, providing a complete analysis of it from a systems safety standpoint. It is a complex system, with thousand of parts required and has many moving components to generate thrust required for a commercial jet for different phases of flight such as take-off, cruise and landing. A preliminary hazard list (PHL) is shown below in Table 1, which is then expanded upon with a preliminary hazard analysis (PHA) shown in Table 2. Two of the items within the PHA is further analyzed using the Fault Tree Analysis (FTA) and the Operating and Support Hazard Analysis (O&SHA) tool.
Preliminary Hazard List
The preliminary hazard list (PHL) is listed below in Table 1 below for the preliminary identification of existing potential sources of hazards and mishaps in the system of the aircraft engine (Ericson, 2015). This is typically carried out at the conceptual design phase and serves to highlight the hazards that are inherent in the system that should be accounted for in the system design, such as hardware safety barriers and emergency procedures surrounding these hazards. These hazards are then further analyzed in the preliminary hazard analysis starting from this initial list.
The first two hazards listed are regarding fan blade out occurrence, where a fan blade at the front of the engine can detach while engine is running which can result in two different hazards. Firstly, the fan blade gets sucked into the engine, contained within the nacelle and causes internal engine damage, resulting in the engine unable to function. Secondly, the fan blade detachment is not contained by the nacelle and the loose debris can damage the engine and aircraft body in an unpredictable manner, potentially risking lives of those onboard the aircraft.
External factors such as bird strike during flight could also be a hazard, with birds being ingested into the engine if the paths of the fowls and aircraft cross. This results in damage to the engine inlet sections of the fan and possibly inlet guide vanes and could stop the engine from working. Fuel leak can occur in within the engine, where the fuel used for combustion process is flowing at unknown locations and flow rate, possible causing engine fire which would damage the aircraft and engine.
Additional weather factors would affect engine functions, such as flying through volcano ash and thunderstorm. In PHL-5, volcanic ash released into the atmosphere could coat the engine and force it to shutdown unexpectedly, causing the engine to stop working and forcing a glide landing. Thunderstorm can have the same hazard effect as the engine can have a flame out while the aircraft flies through a heavy thunderstorm.
Oil leak can occur within the engine if piping sections within the aircraft containing cooling oil for example fracture, causing a potential engine fire in flight. Engine component failure such as compressor disks within the embedded sections of the engine could also result in uncontained engine failure as engine nacelles are not designed for such containment of large rotational energy release. This could also result in engine and aircraft damage and possibly loss of lives. Lastly, external foreign object debris (FOD) could also be ingested into the engine on the ground and result in damage to the engine and functionality.
Table 1
Preliminary Hazard List
Preliminary Hazard List
System Hazard Source Type: Hardware
No. Hazard Source Item Hazard Hazard Effects Comments
PHL-1 Fan blade out Fan blade gets sucked into engine Engine stops working
PHL-2 Fan blade out Uncontained fan blade out; engine cowl doesn’t keep blade in. Engine and aircraft damage; loss of lives
PHL-3 Bird-strike into engines Engine failure after bird-strike damage to fan and inlet guide vanes Engine stops working
PHL-4 Fuel leak Fuel leaking into engine -causing engine fire Engine and aircraft damage
PHL-5 Weather Volcano ash causing engine to shut down No working engine – glide/ditch
PHL-6 Weather Thunderstorm engine flame out No working engine – glide/ditch
PHL-7 Stub pipe Fatigue fracture – oil leak Engine fire
PHL-8 Compressor Disk Compressor disk failure Uncontained engine failure. Engine and aircraft damage; loss of lives
PHL-9 Foreign Object Debris Ingested into aircraft engine Engine damage
Preliminary Hazard Analysis
Following the hazards listed in the PHL table above, the preliminary hazard analysis (PHA) is carried out and detailed in Table 2 below. The initial mishap risk index (IMRI) and final mishap risk index (FMRI) are based off Figure 1 below on both severity and probability of occurrence. This can then be translated into a risk level that can be referred from Figure 2 below, placing risk at levels of high, serious, medium, low or eliminated if possible (DoD, 2012).

Figure 1: Mishap Risk Index recommended from MIL-STD-882. Reprinted from Preliminary Hazard Analysis, by Ericson, C. A. (2015), retrieved from Hazard Analysis Techniques for System Safety (pp. 125-144), John Wiley & Sons, Incorporated

Figure 2: Risk Analysis Matrix. Reprinted from MIL-STD-882E, by Department of Defense, 2012, retrieved from System Safety: https://www.system-safety.org/Documents/MIL-STD-882E.pdf
The first two hazards are related to a fan blade breaking off due to fatigue fracture when engine is spinning at high rounds per minute (RPM) revolutions, with PHA-1 having the fan blade sucked into the engine and contained, while PHA-2 highlights the risk if the debris is not contained by the engine housing. In the first instance, the worst effect is the engine is damaged and not functioning, causing a loss of thrust in flight. To counter this, tighter inspection and quality control procedures should be utilized in detecting fatigue cracks, so that these are caught before an engine is used in flight. This would drop the probability from occasional to remote, with a remaining severity of 1-catastrophic, reducing the overall risk from high 1C to a serious risk 1D. In PHA-2, an uncontained engine failure would cause damage to the engine and the aircraft and could cause rapid decompression and loss of lives either by direct impact of debris or indirectly due to aircraft damage. In addition to improve detection of fatigue cracks like in PHA-1, the design of the fan cowling section of the nacelle could be reinforced based on simulations of critical fan blade impact locations. This should ensure structural integrity of the fan cowl structure not be compromised in the event of a fan blade-out. This would similarly drop the probability from occasional to remote, with the same severity catastrophic if it occurs, dropping the overall risk from high to serious according to Figure 2. PHA-2 will be further analyzed in the later section of this report.
The third hazard of engine failure after a bird-strike could occur during take-off and climbing phase of the aircraft, causing damage to the engine components past the initial fan-blade sections such as inlet and outlet guide vanes and engine cowling structure which could shut down the engine. A follow-up action could be to ensure bird-strikes are contained within the engine, to prevent a hazard like PHA-2, as well as research into improving wildlife management in the vicinity of airports. These should reduce the risk from C-occasional to D-remote, retaining a severity of 1-Catastrophic during occurrence. This drops the risk from high to serious.
PHA-4 regarding fuel leak occurring could result from cracks in the fuel pipeline. Two effects can occur from a fuel leak, the first scenario of lower severity-critical of insufficient fuel to divert to an emergency airfield could occur. The second scenario where an engine fire occurs of a critical severity could cause damage to the engine, loss of engine and fire damage to parts of the aircraft, placing passengers in danger. To counter the occurrence of fuel leak, periodic inspections of fuel pipelines should be enforced and use of a combustible gas detector be used instead of relying on a technician’s sense of smell to detect fuel odor. Based on the worse-case scenario of the fire, and if recommended actions taken, the overall probability will drop from occasional to remote, dropping the risk from high to serious. PHA-4 will be further analyzed in the later sections of this report.
The fifth hazard of weather effects on the engine could occur from engine flying through volcanic ash, which would form a glass coating inside the engine and causes an engine shutdown, possibly all engines of the aircraft, resulting in loss of thrust. A recommended action to counter this risk would be to ensure available information about ash clouds on flight paths are distributed to aircraft flying these paths and diversions flight paths are planned and adopted. This would drop the severity from catastrophic to critical, and probability from remote to improbable, dropping the overall risk from serious to medium. Another weather-related hazard PHA-6 highlights the possibility of an engine flameout when flying through a thunderstorm, also resulting in loss of thrust. In this instance, the use of backup battery pack to restart the engine is critical. Hence a recommended action would be to ensure maintenance processes check the functionality of the backup battery pack. Further actions would be to improve training procedures for pilot to understand weather radar images and maintain a higher engine power in the event of a severe precipitation to avoid a flameout scenario. These actions would drop the severity from catastrophic to critical, and a probability from occasional to remote, reducing the risk from high to serious. The probability of thunderstorms is generally higher than volcanic eruptions, hence the higher probability comparatively.
Another hazard could be a leak of bearing lubricating oil due to fracture of the oil pipeline within the engine. This could result in failure of engine parts if insufficient lubrication is achieved and cause a failure of a turbine disc for example which could then result in uncontained engine debris. This in turn can lead to an engine shutdown and damage to aircraft parts such as wings, control surfaces and fuselage. This risk could be reduced if the processes are improved, such a record keeping of manufacturing measurements and check of features, and if necessary, re-design the structure to prevent lubrication oil leak. This would reduce the probability of occurrence from occasional to remote, with severity remaining at catastrophic if it occurs, reducing the overall risk from high to serious.
The next hazard PHA-8 highlights a possible compressor disk failure due to undetected cracks. The release of high rotational energy could result in uncontained engine failure, with debris penetrating the aircraft fuselage after damage of engine and wing structure. To reduce this hazard, improved maintenance procedures could be implemented to ensure irregularities can be detected more easily. Multiple inspections for crack propagation can also be carried out to reduce the risk of missing detections. This would reduce the probability of the risk from occurring from occasional to remote, with a catastrophic severity unchanged, reducing the overall risk from high to serious.
The last hazard PHA-9 regarding FOD can occur when undetected FOD is present on the ground in the path of an aircraft. Engine damage could be caused in the ingestion of these and possibly causing an engine shutdown. This could happen in the critical phase of an aircraft taking off hence being assigned the severity of catastrophic. A recommended follow up action is to ensure regular FOD inspection is carried out. Airport ground staff should also be trained to ensure good habits of clearing debris immediately when spotted and not to leave debris around when carrying out their tasks. This would drop the probability of the risk from occasional to remote, dropping the risk from high to serious.

Table 2
Preliminary Hazard Analysis
System: Aircraft Turbojet Engine
Subsystem/Function: Hardware hazards in operation Preliminary Hazard Analysis Analyst: S.S. Teng
Date:3 March 2020
No. Hazard Causes Effects Mode IMRI Recommended Action FMRI Comments Status
PHA-1 Fan blade gets sucked into engine Fatigue fracture of fan blade, breaking out when spinning at high RPM Blade will be engulfed by engine, causing damage and loss of thrust Take-off / cruise mode 1C Tighter inspection and quality control procedures in detecting fatigue cracks 1D
PHA-2 Uncontained fan blade out; engine cowl doesn’t keep blade in. Fatigue fracture of fan blade, breaking out when spinning at high RPM; Cowling did not contain fan blade. Debris damaged the aircraft fuselage, causing rapid decompression and possibly loss of lives. Take-off climbing to cruise altitude 1C Redesign of fan cowling based on critical fan blade impact location(s), ensure the structural integrity of the fan cowl
after a fan-blade-out event 1D
PHA-3 Engine failure after bird-strike Plane struck a flock of large birds after take-off. Engine damage and shut down. Inlet guide vanes and outlet guide vanes could be damaged or shear off; damage to spinner and inlet lip of engine cowling Take-off climbing 1C Engine designed to contain bird-strike. Contained engine failure. Research into improved wildlife management 1D
PHA-4 Fuel leaking into engine Crack in the engine’s main fuel oil heat exchanger (MFOHE) Insufficient fuel to divert to emergency landing airport.
Engine fire. Heat damage to engine core,
portions of engine cowlings, wing area directly behind and outboard. Cruise condition 1C Need
to periodically inspect the internal components of the MFOHE; use of combustible gas detector as the preferred means of fuel detection during engine oil servicing instead of
relying on maintenance personnel’s sense of smell to detect fuel odor. 1D
PHA-5 Volcano ash causing engine to shut down Ash turning into a glass coating inside the engines that could fool the engine temperature sensors and led to shutdown of engines Engine shut down – loss of thrust Cruise condition 1D Make available information about the ash cloud to all personnel involved. Plan diversion 2E
PHA-6 Thunderstorm engine flame out Entered thunderstorm with heavy rain and hail Possibility that no power due to inability to restart engine. – Glide to ditch landing Cruise/Descent 1C Improve maintenance process to ensure backup battery pack is functional. Improve training procedures to understand weather radar images. Maintain a higher engine power level in moderate to severe precipitation to avoid flameout. 2D
PHA-7 Fatigue fracture oil stub pipe Fatigue fracture could result from manufacturing processes. Bearing lubricating oil leak could cuase oil fire and engine failure- turbine disc failure. Debris from uncontained engine failure damaging wing, flight controls and landing gear Take off 1C Improve record keeping of measurements relating to oil-feed stub pipe. Include feature checks and risk assessment during the design and manufacture of new structures. 1D
PHA-8 Compressor disk failure Engine compressor hub crack. Debris penetrating fuselage Takeoff/ In-flight 1C Improved maintenance procedures to detect irregularities, make independent determinations. Multiple inspections for crack propagation tests. 1D
PHA-9 FOD ingested into aircraft engine Undetected FOD on ground in the path of the travelling aircraft ingested into the engine when engine is operational Engine might be damaged from these FOD and may not be able to function safely. Taxiing/ Take-off/ Landing 1C Ensure regular FOD inspection is carried out. Airport ground staff should also carry out practice of clearing debris sighted immediately, and not to leave debris when carrying out tasks 1D

Fault Tree Analysis for PHA-2
A deeper dive into PHA-2 is carried out here using Fault Tree Analysis (FTA) method to break down the event of an uncontained engine failure. This has mostly been based on the accident of Southwest Flight 1380 in Philadelphia Pennsylvania on April 17, 2018 (NTSB, 2019). The FTA of such a hazard is constructed in Figure 3 below. A fault tree is a graphical model typically used to show the cause-effect relationship in the lead up to an undesired event (Ericson, 2015). As the analysis is based on an actual accident, it can be said to be a reactive application due to using the method after the incident has occurred, however this can be referenced as a proactive application to prevent further incidents from occurring due to similar faults (Ericson, 2015).
The FTA starts with the top event, which is the uncontained engine failure, with three contributing factors. These contributing factors are a pre-existing defect, the flight environment and management actions that are connected by an ‘AND’ gate that requires all three to occur for the hazard to occur.
A pre-existing defect could be a fatigue crack on the fan-blade. This can occur after many flight cycles and is typically checked using fluorescent penetrant inspection (FPI) during overhaul inspections with additional visual inspections. Even though the fan blade out in the incident did undergo FPI testing, the fatigue crack was not detected and the fatigue occurred at a low cycle due to higher than normal stresses (NTSB, 2019). This was the basic event that caused in the incident, as without a fatigue crack in the fan-blade, a fan blade-out incident would not have occurred. A second pre-existing defect was that the nacelle was not well designed for containing fan blade out. This was found to be caused by the fan cowling structure design and insufficient impact analysis in an ‘AND’ gate, a combination of both factors. This was largely due to weaknesses in the radial restraint point that was not previously discovered, and the earlier success of fan blade-out containment certification tests allowed designers to assume the impact analysis was complete (NTSB, 2019). Such incidents are typically where the unknown unknowns are discovered, and changes to future design carried out with this consideration in mind.
The second contributing factor to the top event is the flight environment the aircraft engine was operating in. This is shown to be in an ‘OR’ gate of the rounds per minute (RPM) evolution of the engine and fan, or the vibrations that occurred during this phase of flight that contributed to the crack propagating and leading to a fan blade-out.

Figure 3: Fault Tree Analysis (FTA) of Uncontained Engine Failure.
Lastly, the third branch of contributing factor is the management aspect of the engine design process between airplane and engine manufacturers. There were gaps between the collaboration in identifying critical impact points, loads, effects of fan blade out and a common method of analysis (NTSB, 2019). This is carried out individually by the separate manufacturers but increased collaboration to identify critical zones would help in preventing future uncontained engine failures.
Some recommendations include incorporating additional requirement of carrying out eddy current inspection during fan blade overhaul and ultrasonic inspection at blade relubrication as additional tests in detecting blade fatigue cracks and removing cracked blades before cracks reach a critical size (NTSB, 2019). A redesign of the engine cowl structure should also be done to ensure structural integrity during the event of a fan blade-out (NTSB, 2019). Increased enforcement of collaboration between engine and aircraft manufacturers to revisit the prediction of fan blade-out impacts should be carried out in response to the operating conditions of the engine inlet, cowl the airplane’s operating environment (NTSB, 2019). These processes should be re-evaluated periodically about every 4 years as a rough estimate to incorporate new technology and other non-catastrophic incidents that may have occurred even within the designed operating environment, such that the unknown unknowns are less with the increase in operational life of the designed engine.
O&SHA for PHA-4
An O&SHA will be carried out for hazard PHA-4 of engine fuel leak into the aircraft engine. The O&SHA method identifies procedures that are hazardous, failure in human operation, design conditions that could lead to detrimental situations and hazardous conditions when operating tasks are carried out (Ericson, 2015). This analysis is also based on an engine fuel leak accident on Singapore Airlines Flight 368 (SQ 368) that occurred on June 27, 2016 as an example of tasks that lead to an engine fire. The O&SHA method is detailed in Table 3 below, highlighting six primary tasks in the operation where an engine fuel leak occurred in flight. The risk indexes of IMRI and FMRI also refer to Figure 1 above used in the earlier PHA.
The first task examined is the pilots performing the emergency checklist when the Engine Indicating and Crew Alerting System (EICAS) display showed low levels of fuel in the right engine but with oil pressure and temperatures were in the normal operating range (TSIB, 2017). The hazard lies in the pilots completing a fuel disagree checklist but not ‘fuel leak’ checklist two hours later after many consults with the flight engineer via satellite communication, believing that the calculated fuel quantity was inaccurate after multiple adjustments in engine power settings. Additionally, there were no checklists provided for the flight crew for fuel leak check when engines are operating at different power settings (TSIB, 2017). This resulted in an inability for flight crew to diagnose a fuel leak. A recommended action to prevent a similar risk from occurring is that airlines should ensure through additional periodic training that pilots should perform the appropriate and required checklists for emergency and abnormal situations. The aircraft manufacturer should also add the a fuel leak check for engines operating under different power setting and not prematurely strike that out as a possible scenario, leaving pilots with no guidance in such situations (TSIB, 2017). This should reduce the probability of a misdiagnosis of a fuel leak situation from occasional to remote, with a severity of critical if the aircraft had sufficient fuel to divert back to the departing airport, bringing the risk down from serious to medium according to Figure 2.
The second task OHA-2 is the flight crew’s verification of the EICAS display. The cause was due to lack of an appropriate manual procedures addressing low engine oil quantity situation (TSIB, 2017). This resulted in the leak of the main fuel oil heat exchanger (MFOHE) going undetected for the remainder of the remaining flight (TSIB, 2017). A recommended action to counter this hazard would be to get the engine manufacturer to develop an algorithm for a fuel leak of such a scenario, utilizing parameters of temperature, pressure and quantity to alert the operating flight crew although such a scenario was not considered previously (TSIB, 2017). This will also allow for an early diagnosis of an anomaly and appropriate actions carried out accordingly to prevent exacerbating a fuel leak situation. The probability of a fuel leak misdiagnosis will drop from occasional to remote, with a remaining severity of critical if there is sufficient fuel to divert to an airfield safely, bringing the risk down from serious to medium.
The third task that contributed to the incident is the manner of inspecting for a fuel leak in pre-flight procedures. A maintenance crew would typically carry this out via ‘sniff check’ and in the case of SQ 368, was unable to detect the presence of fuel odour, allowing the fuel leak to be undetected in preparation for flight. A recommended action would be to improve this fuel detection method in adopting a combustible gas detector which would be more sensitive than a persons’ nose and subjected to less variability. This would reduce the occurrence of fuel leak undetected from a probability of occasional to remote, with the severity at critical due to again the reserve quantity of fuel if diversion to an airport is possible, bringing down the risk from serious to medium.
The fourth contributing task was the inspection of the faulty component MHOFE sent out in a service bulletin (SB) (TSIB, 2017). The critical level of the SB was of a fairly low level due to low occurrences of prior MHOFE leakage, simply requiring to wait till the next engine maintenance check (TSIB, 2017). If an engine like in the incident of SQ 368 had just gone through its regular maintenance before a non-serious SB issued, the faulty component in question such as a MHOFE would go undetected and contributed to a fuel leak occurrence in flight. The recommended follow-up action would be regulators such as the Federal Aviation Administration (FAA) to review its processes in classifying the seriousness of a SB, to ensure corrective actions “can be implemented more expeditiously” (TSIB, 2017, p. 34) to prevent unsafe conditions from reoccurring. As this analysis is done reactively, another recommendation would be to evaluate the need for periodic internal inspections for critical components like the MFOHE for fuel pipeline to ensure leakages do not occur at a different location. This would again reduce the probability from occasional to remote, with a severity of critical if the fuel leak does not impede the aircraft from reaching a designated landing area and situation is not aggravated. This brings down the risk from serious to medium.
The fifth task in this analysis is the reversing of thrust on both engines by flight crew upon landing. This resulted in an engine fire occurring after landing when a fuel leak is not detected and fire was ignited due to temperature increase and reduced airflow in this procedure (TSIB, 2017). This is a hazard if fuel leak goes undetected for further flight operations as well. To prevent this hazard, an earlier recommended action for diagnosis of fuel leak can be applied here, to alert the operator and ensure appropriate alternative actions can be carried out to prevent ignition of fire such as alternative landing procedures to minimize the possibility of a fire upon landing (TSIB, 2017). This would reduce the probability of the hazard of engine fire from occasional to remote and reducing the severity from catastrophic of a fire occurring to critical, dropping the risk down two levels from high to medium.
The final task of evacuating an aircraft in the event of a fuel leak, would be the flight crew not utilizing resources in evaluating the situation before evacuation is ordered. Using the incident of SQ368, the pilots were under great stress at this point and solely relied on the fire commander as the sole source of information without utilizing resources such as onboard taxiing camera, cabin crew in the different locations of the aircraft or checking through a cockpit window on ground to assess the external engine fire situation (TSIB, 2017). The recommended action would be to utilize these other resources, but due to the stressful situation, this may not happen and relying on the fire commander as the sole source as to when and where to evacuate is the right thing to do in the situation of engine fire on ground. Hence this is a rare instance where there is no change in probability and severity of the risk due to the stressful situation, and the current actions that the flight crew in the example case of SQ368 were correct and did not exacerbate the situation. The risk of the evacuation relying on the fire commander remains at medium but is necessary to highlight here as a reminder to flight crews to use resources available to improve the situational assessment in similar stressful situations.

Table 3
Operating and Support Hazard Analysis (O&SHA) Worksheet of Engine Fuel Leak into Aircraft Engine
System: Aircraft Jet Engine GE90
Operation: Engine fuel leak Operating and Support Hazard Analysis Analyst: SS Teng
Date: 4th March 2020
Task Hazard No. Hazard Causes Effects IMRI Recommended Action FMRI Comments Status
Pilots performing emergency check list OHA-1 Fuel leak – where pilot only completed ‘fuel disagree’ checklist but not ‘fuel leak’. -Did not believe calculated fuel quantity was accurate due to changes in engine power setting and diversion from planned path
-No procedures for pilots to follow to perform a fuel leak check with the engines in different
power settings. Were not able to diagnose a fuel leak earlier on. 2C Airline should ensure pilots able to correctly perform the
actions called for in the emergency and non-normal checklists. To include periodic refresher training on the requirements of the
checklists that are used infrequently.
-Aircraft manufacturer to evaluate need for fuel leak check under different power settings 2D Open
Verifying EICAS display OHA-2 Fuel leak Pilots unable to find an appropriate procedure that addressed the low engine oil quantity
situation. MFOHE fuel leak situation not detected. 2C Development of algorithm for MFOHE fuel leak situation in flight using parameters of temperature, pressure and quantity, to alert operator. This will minimize possibility of a fire following landing. 2D Closed
Pre-flight inspection of fuel leak OHA-3 Fuel leak into engine Maintenance crew inspected for fuel leak via a ‘sniff check’, but unable to detect presence of fuel Fuel leak undetected prior to flight 2C Advisable to adopt a combustible gas detector which could be more sensitive than a person’s nose for fuel odor detection. 2D Open
Service bulletin to inspect MHOFE/ faulty component OHA-4 Possible repeatability of MFOHE/ faulty component leakage SB requiring MFOHE/faulty component to be removed from the engine at next engine maintenance check, but particular engine had just undergone a check prior to SB being issued. Faulty MFOHE/component not detected, hence fuel leak occurred in flight 2C -Manufacturer to evaluate the need to periodically inspect the internal components of MFOHE/other critical components.
-FAA to review its airworthiness control system to ensure that
corrective actions can be implemented expeditiously to prevent the recurrence of unsafe conditions. 2D Open
Reverse thrust on both engines upon landing OHA-5 Engine fire Airflow over the core exhaust nozzle reduced significantly; accumulation fuel and increasing temperature to ignition point. Ignited fire propagated due to fuel leak. 1C Development of algorithm for MFOHE/ faulty components fuel leak situation in flight using parameters of temperature, pressure and quantity, to alert operator. This will minimize possibility of a fire following landing. 2D Closed
Evacuation of aircraft after engine fire OHA-6 Slow evacuation could trap passengers unnecessarily on board Flight crew waited and depended on the fire commander as their sole source for evacuation Held off evacuation but had information to block evacuation on fireside. 3C -Flight crew could have consulted cabin crew who have alternate view.
-Alternative view through cockpit escape window
-Used taxiing camera system 3C Open

References
DoD. (2012). MIL-STD-882E. Department of Defense (DoD). Retrieved from System Safety: https://www.system-safety.org/Documents/MIL-STD-882E.pdf
Ericson, C. A. (2015). Hazard Analysis Techniques for System Safety. John Wiley & Sons, Incorporated.
NTSB. (2019, November 19). Left Engine Failure and Subsequent Depressurization Southwest Airlines Flight 1380 Boeing 737-7H4, N772SW; Philadelphia, Pennsylvania. Retrieved from National Transportation Safety Board: https://ntsb.gov/investigations/AccidentReports/Reports/AAR1903.pdf
TSIB. (2017, February 27). B777-300ER, REGISTRATION 9V-SWB. Retrieved from Ministry of Transport; Transport Safety Investigation Bureau (TSIB): https://www.mot.gov.sg/uploadedFiles/Ministry_of_Transport/Content_Blocks/About_MOT/Air_Transport/AAIB/B773ER%20(9V-SWB)%20Engine%20Fire%2027%20Jun%2016%20Final%20Report.pdf