Description

On 31 December 2020 , the crew of an Airbus A330-200 (F-GZCJ) being operated by Air France on a scheduled night international passenger flight from Brazzaville to Paris CDG with augmented crew in unspecified flight conditions identified a significant fuel leak during a routine top-of-climb fuel check. The applicable emergency procedure to shut down the affected engine and land as soon as possible was ignored. Instead the flight was continued on track for over 90 minutes before eventually diverting to N’Djaména where it was found that almost 6 tonnes of fuel had been lost. The aircraft was undamaged and the 147 occupants were not injured. The leak was sourced to a mis-fitted main fuel hose at the engine/pylon interface.  

Investigation

After being informed of the event the following day, the French Civil Aviation Accident Investigation Agency (the BEA) decided that the State of Occurrence was Chad and invited the authorities there to delegate the Serious Incident Investigation to the BEA. The Chadian Ministry of Civil Aviation and National Meteorology accepted this invitation on 12 January 2021. Relevant CVR and FDR data was successfully downloaded although in respect of the CVR only after some difficulty arising from an internal fault in the unit which was subsequently repaired by the OEM.

The 54 year-old Captain had a total of 12,399 hours flying experience of which 3,852 hours were on type with 1,077 of those hours as Captain. He had joined Air France in 2002 after initial experience as a military pilot followed by four years as a Boeing 737 Captain at the Air France low cost subsidiary Transavia. The 53 year-old First Officer, who was acting as PF for the investigated flight, had a total of 5,656 hours flying experience of which 550 hours were on type. He had joined Air France four years previously after a career initially as a military pilot and then as an engineer. The 54 year-old Relief First Officer had a total of 4,800 hour flying experience of which 803 hours were on type and had also joined Air France four years earlier, in his case also after a career as a military pilot but then as a flight simulator instructor at Airbus including for the A330.  

What Happened

The flight departed Brazzaville with the First Officer as PF and the Relief Pilot occupying a supernumerary crew seat on the flight deck. Two of the passengers were Air France maintenance technicians qualified to work on the A330. Everything was normal until the top of climb was reached 35 minutes after takeoff and the aircraft had been levelled at FL380. A routine fuel check by the Captain found that 1,400 kg of fuel was missing without this creating any visible imbalance between the fuel tanks. He attributed this to fuel transfers from the inner wing tanks to the trim tank which were in progress and after discussing this situation with the two First Officers, he left the fight deck for a rest period. Before doing so, he asked them to monitor the fuel contents indications.

Around twenty minutes after the Captain had begun his rest period, he was called back to the flight deck at which point the quantity of missing fuel had increased to around 2,100 kg with a difference in between the two inner tanks of about 400 kg which suggested the possibility of a leak on the left side. 

With the aircraft approximately 250 nm east of Yaoundé (Cameroon) to the left of track and approximately 520 nm south of N’Djamena (Chad) - see position 3 in the first illustration below - the crew began the QRH ‘FUEL LEAK’ procedure (see the second illustration below) which indicated that a diversion must be considered as soon as possible and started by instructing the crew to shut down the engine associated with the fuel tank from which fuel is missing in order to check if this is where the leak is originating from. However, having hesitated about shutting down the engine indicating that to so would be “the beginning of something big” the Captain “postponed shutting down the engine for the time required to re-evaluate the actual quantity of fuel that had been lost”. Whilst the Relief Pilot and the maintenance technicians on board “tried to confirm the fuel leak by visually observing the left engine" (which was not successful) the other two pilots obtained the weather for N’Djamena, Libreville (Gabon) and Yaoundé airports and “considered diverting to Yaoundé”. The option of returning to Brazzaville was not considered.

The ground track of the flight with key points annotated. [Reproduced from the Official Report]

A FORDEC review was carried out with the Captain indicating that factually, there was a fuel leak, but noting “that they had quite a lot of fuel and could fly some time even on one engine” and adding that the risk was finding themselves with one engine operative and having to divert. The debate about the advisability of diverting continued to Yaoundé which was the closest option and the Captain stated that the FORDEC review was “not finished” and pointed out that they had enough time to fly to N’Djamena with 12,000kg - 15000kg of fuel left “plus possibly the trim tank”. He then restated his reluctance to shut down the engine, saying that “flying on one engine was not a very comfortable situation”. 

The Captain then spoke with the operator’s OCC and said that “due to a fuel leak, the crew were hesitating between a diversion to either Yaoundé or N’Djaména and suggested that N’Djaména was perhaps more suitable from an operational perspective” and during this exchange, the First Officer “also expressed his preference for N’Djamena”. The OCC then passed the call to a “sector manager” who subsequently confirmed that there was “no problem” with an N’Djamena diversion.

On completing this call, the Captain referred to the uncompleted ‘FUEL LEAK’ procedure and told the other two pilots that “in any case they would have to divert as they had now lost too much fuel to consider continuing to Paris”. He then briefed the SCCM about the intended diversion and advised that “it was not necessary to prepare the cabin as the situation was under control and that the crew would try to keep both engines operative up to landing”. He proposed to the to First Officers that the left engine should be kept running for as long as possible with shutting it down only being considered when fuel remaining in the associated fuel tank was “close to five tonnes in order to avoid the engine flaming out spontaneously”.

The A330 QRH FUEL LEAK PROCEDURE. [Reproduced from the Official Report]

The Captain “completed the FORDEC review” and confirmed with them the decision to divert to N’Djamena. He then made a ‘MAYDAY’ call to ATC and advised the flight’s intention to divert to N’Djaména - the aircraft was at this time at position 4 on the ground track illustration.

Five minutes later, an ECAM ‘FUEL F. USED/FOB DISAGREE’ alert was annunciated (position 5 on the ground track illustration). This alert refers the crew to the FUEL LEAK procedure which had been ignored and the Captain deleted the message and in the absence of a ‘STATUS’ indication reported having “considered that the alert had been processed”. The Relief First Officer then asked that they agree on when the left engine would be shut down and the Captain responded by repeating his view that the engine should remain in “for as long as there was fuel available”. 

The crew then calculated the landing performance for an ILS approach to runway 05 at N’Djamena and the Relief First Officer reminded the operating crew that the thrust reversers must not be used. However, ATC subsequently advised that the 05 ILS was out of service so the crew modified the FMS route to make an RNP approach to the same runway. The Relief First Officer then checked the N’Djamena NOTAMs and having noted the ILS outage saw that the runway 05 threshold was temporarily displaced by 390 metres reducing the LDA to 2410 metres although this was still sufficient. However, he then explained that the RNP 05 approach “risked bringing them to the usual 05 threshold and not the displaced threshold and that it would be better to carry out the RNP 23 approach” which was agreed. It was noted that the reduced LDA was also applicable to runway 23 as the area prior to the displaced threshold was only available for taxiing access to and from the military apron due to WIP on and close to the runway. The Captain indicated that there was the possibility of a tailwind during a 23 approach and discussed taxiing in after landing, saying that the left engine would only be shut down once clear of the runway. However, no discussion of landing performance for this runway appears to have occurred despite the fact that a tailwind component rather than a headwind component would now apply. The aerodrome diagram is shown below.

The N’Djamena LIDO aerodrome chart [Reproduced from the Official Report] 

One of the Technicians on board then called to advise that there was now “a visible streak under the cowling of the left exhaust nozzle”. The Captain indicated that this did not change their plan and he called for the approach briefing to be started. Once it was complete, the crew conducted TEM review of threats associated with the approach. The First Officer opined that he viewed the main threat as being a fire breaking out on the ground. The Captain responded that if the left engine was shut down before touchdown, the threat would be having to fly a single engine holding pattern in the event of a go-around. He then  indicated that the decision as to when to shut down the engine was for the PF First Officer and that “he could also shut down the engine before beginning the final approach” but then concluded by repeating they would keep the engine in operation as the remaining quantity of fuel was sufficient to avoid a flame-out. The Relief First Officer again reminded the other two that the thrust reversers must not be used and the First Officer stated that he “would like to be reminded of this at the time of landing” and the Captain added that in the worst case, reverse idle could be used.

Shortly after this (position 7 on the ground track illustration), a ‘FUEL IMBALANCE’ alert, which again referred the crew to the ignored ‘FUEL LEAK’ procedure was annunciated. The Captain reacted to this by questioning whether there was any danger of keeping the engine operative and “concluded that it was not specified in the FUEL LEAK procedure that it had to be shut down” adding that “there was no possibility of a fire”. Although this statement was factually incorrect, it was not directly challenged although the Relief First Officer did then say that “he thought that shutting down the engine was not a bad idea but that it was a good idea to keep it running for the time being because they were in the air and there was no emergency”. When the Captain then announced his intention to shut down the engine after completing the landing roll before turning round at the end of the runway, the Relief First Officer said that this risked spilling fuel on the runway. The Captain then stated whether to shut down the engine before or after turning round “would depend on the information provided by the fire fighters”. The Captain mentioned the risk of hot brakes close to the fuel in case of excessive braking due to the relatively short length of the landing runway and asked the First Officer to “modulate the braking”. 

Having been cleared for the RNP 23 approach, the aircraft was established on finals by 3,000 feet QNH and configured for landing. As the approach was continued, the crew were aware that although the METAR was only giving a mean wind of 8 knots from 340°, information accompanying the N’Djamena charts stated that in the winter period, there was a risk of “a strong wind even at very low levels, with a risk of a strong tailwind on runway 23”. The Captain “mentioned a tailwind of up to 32 knots and referred to the possibility of a go around” but in the end, the maximum sensed tailwind component was 28 knots at 610 feet agl and when the AP was disconnected at 500 feet agl, the sensed tailwind component had reduced to 21 knots with the Captain subsequently recorded saying that it was “now less than 10 knots”. 

Touchdown occurred 550 metres past the runway threshold 23 at a speed of VAPP+8. Seven seconds after touchdown a ROPS ‘BRAKE MAX BRAKING MAX BRAKING’ Warning occurred indicating an overrun even though it did not take account of temporary reductions in LDA. In accordance with the briefing, the thrust reversers were not used and the PFs full manual braking then led to the ‘BRAKES HOT’ Alert following which the brake temperatures reached 600°C. During the whole of the landing roll, leaking fuel spilled onto the runway. The Relief First Officer asked if the left engine shutdown was being considered and the Captain responded that this would be done during the 180° turn at the end of the runway when the aircraft left engine was on the outside of the turn. FDR data then showed that around 40% N1 thrust was set on the left engine as the aircraft was turned. 

The TWR controller informed the crew that the airport RFFS personnel positioned near the runway had not seen any signs of fuel on it although at the time “substantial quantities” had been running out of the drain mast and nacelle under the engine. Having taxied the aircraft to its assigned parking position, the crew remained concerned about the still-high brake temperatures given the existence of a fuel leak. The right engine was then shut down ten minutes after the left and after the RFFS personnel had sprayed water under the left engine and assessed the situation as safe, passenger disembarkation began..

A comparison of the fuel used and remaining fuel was made and showed that 5,300 kg of fuel had been lost in flight and a further 400 kg was then lost on the ground until the right engine had been shutdown in the parking area.  

Why It Happened 

Airworthiness

An inspection of the left engine quickly “identified a substantial leak in line with the mounting flange of the left engine primary fuel hose". This hose transfers fuel from the wing fuel tanks to the engine and its mounting flange forms the interface between the pylon and the engine which is split whenever an engine is removed. This hose was found to have a play of 3 to 5 mm when it was handled after the occurrence. The four nuts were all safe-tied but two of them were not sufficiently torqued and as a consequence, pressurised fuel supplied to the engine was being ejected from both sides of the hose inside the engine cowlings.

The aircraft had been parked out of use for a significant period earlier in the year and had been subject to a corresponding comprehensive inspection to prepare it for a return to service. This work, which was completed on 30 September 2020, had been subcontracted to a third-party MRO and had included the removal and reinstallation of both engines which required disassembly and reassembly of the main fuel hose mounting flange.   

It was confirmed that no leak had been observed at this interface during checks carried out at the completion of the return-to-service work, including when the fuel system had been pressurised. Although the aircraft was ferried to France on release from the MRO, it was found that it did not then fly again until five days prior to the flight under investigation. It had then made six uneventful flights and an examination of FDR data found no evidence of a fuel leak during any of them. 

It was found that the fuel supply connection involved was widely considered “difficult” to assemble and that although evidence was found which suggested that the four bolts securing the connection had been correctly torqued after the engine had been returned to the wing in September, it was clear that there was a history of problems in correctly seating the fuel hose mounting flange on the pylon before tightening the bolts which secure it there. It was already widely known that if the four securing bolts were tightened on an incorrectly seated flange then a leak could subsequently develop when vibrations in service and under more pressure than a post maintenance ground run creates.

In respect of a fire hazard arising from a fuel leak at this location, it was found that the risk of spontaneous ignition is maximised by a combination of a relatively high air pressure and a relatively low ventilation flow. The former occurs on or close to the ground and the latter occurs at low aircraft speed on approach, on the ground or during a go-around. However, Airbus indicated that “the high fuel saturation of the air in the engine zone probably prevented a fire from breaking out during the approach or on the ground”.

It was found that a new and improved fuel hose mounting flange which reduced the chances of an inadvertent mounting flange positioning error had been notified as available by the OEM through a 2015 ‘Special Bulletin’ although it was indicated that stocks of the former model could be used until depleted. No SB on this redesigned part was issued by the OEM or the engine manufacturer GE even though failure to change to the new flange design would leave operators exposed to an avoidable fuel leak risk.

The Flight Crew Response

The complete failure of the crew to make a timely diversion and follow a vitally important Emergency Checklist which required engine shutdown and a landing as soon as possible was an extremely serious breach of well stated procedures aimed at both preventing fuel exhaustion and minimising the risk of in flight or on ground fire fed by a large and continuing supply of fuel. A significant difference was noted to exist between the Air France and EASA documentation on compliance with and deviation from operating procedures, both normal and emergency:

The Air France documentation states: “Know how to deviate from procedures in consultation with the crew when safety requires it. Deviate from the procedure for safety reasons”.

The European documentation states: “Follow SOPs unless a higher degree of safety dictates an appropriate deviation”.

The apparent view of the Captain of the aircraft involved that unnecessarily extending the duration of a flight in which a fuel leak of unknown origin is identified and doing so because of a personal belief that stopping the fuel leak and making a single engine diversion as per established procedures is a greater risk cannot be justified when measured against the European guidance but depending on the degree to which a meaningful ‘safety culture’ existed in Air France at the time, might be assumed by individuals to be acceptable.

The Investigation also made another relevant comparison between the wording of comparable European and Air France documentation in that while the European documentation recommends that the pilot “adapts when faced with situations where no guidance or procedure exists”, the Air France documentation in their OM Part ‘D’ recommended that “the pilot improvises when faced with the unforeseeable to obtain the safest result”.

Finally, in terms of flight crew co-operation as defined by the expected behaviour of Captains versus that of pilots under their command, the distinction between the two in the Air France OM Part ‘A’ was such as to imply predominantly assistance and support to Captains with more junior pilots only tentatively expressing any doubts “in a spirit of responsible cooperation”. It was noted that “such a distinction between the Captain and Co-Pilot is not envisaged in the European documentation”. Given the significant contributions of the Relief First Officer during the investigated emergency, it was noted that “the role of a Relief Pilot was not defined in Air France documentation”.  It was considered notable that “not one of the flight crew questioned the deviation from the FUEL LEAK procedure” in particular the failure to shut down the engine and the failure to land as soon as possible. 

The Investigation noted that the French State Agencies overseeing the operation of aircraft for commercial air transport, the Civil Aviation Safety Directorate (DSAC) and the Flight Control Organisation (OCV), which perform in-flight and on-ground checks to ensure that the applicable regulations and procedures are complied with including those covering training, ratings and medical fitness of flight and cabin crew had been contacted and had told the BEA that their own findings “were consistent with the observations in this report”.

The Conclusions of the Investigation in relation to its findings included the following:

• The purpose of shutting down an engine when a fuel leak is identified is both to conserve the fuel in the associated fuel tank and prevent the fuel from being dispersed into potentially dangerous areas. The fire hazard was underestimated by the crew in part because it was not clearly indicated in the corresponding procedure or in the supplementary manuals. 
• The crew’s partial application of the ‘FUEL LEAK’ procedure contributed to a degraded decision making process, in particular by excluding alternate options closer to the route and resulted in the choice of a diversion to N'Djaména where the infrastructure and the weather conditions were not optimal.

Four Contributory Factors to the occurrence of the left engine fuel leak at the point where the primary engine fuel supply hose was attached to the pylon were identified as follows:

• The design of the mounting flange.
• Intrinsic difficulties in assembling the mounting flange. 
• Difficulties in checking that the mounting flange was correctly assembled.
• The use of a former mounting flange model, which made it possible to assemble the flange incorrectly and for a large leak to occur.

Four Contributory Factors to the flights reduced safety in particular with regard to the fire hazard pylon were identified as follows:

• The crew’s partial application of the FUEL LEAK procedure for the management of a fuel leak. 
• Insufficient leadership and crew cooperation competency probably due to an excessive search for consensus and a possible group effect.
• No mention of the fire hazard in the manufacturer's documentation.
• Selection of N'Djamena airport for the diversion when other suitable airports were closer to the route.

One Contributory Factor which limited the fire hazard was identified as the intervention of the Relief Pilot who reminded the operating crew that, in accordance with the FUEL LEAK procedure, the thrust reversers should not be extended, even at idle speed.

One Contributory Factor which contributed to the safety of the flight after the landing was the Chief Purser preparing the cabin for a possible evacuation on their own initiative.

Safety Recommendation Context

The primary concern raised by this Investigation concerned the context in which intentional but unjustified non-compliance of the flight crew with operational procedures, both emergency and normal, had occurred and especially in the former case a decision to intentionally ignore the FUEL LEAK procedure which thereby “created a notable fire hazard and led to a substantial reduction in the flight’s safety margin, the fire having been avoided by chance”. 

This event was noted to have been only one of a number involving Air France-operated flights where “the crews concerned have not, intentionally or otherwise complied with safety related procedures”. Whilst it was accepted that “rare technical or operational situations” may require a crew to operate outside of procedures when there is a clear safety imperative to do so, none of the Air France procedural non compliance events investigated were in that category and all involved a reduction in safety margins without the crew appearing to recognise this. 

It was suspected that these occurrences indicated that “there is a certain culture among some Air France crews which encourages a propensity to underestimate the extent to which strict compliance with procedures contributes to safety”. The BEA therefore considered that “Air France should put compliance with procedures back in the centre of the company's safety culture”.

Consequently, one Safety Recommendation was made as follows:

Whereas:

• the recurrence of investigations concerning Air France occurrences recently carried out by the BEA, show an adaptation of procedures or even a deliberate violation of these leading to a reduction of safety margins,
• just culture does not accept repeated intentional deviations, serious negligence and deliberate breaches,
• deviations from procedures detected in flight or by means of OFDM may require strong general and individual actions,
• the (French) Aviation Safety Regulator told the BEA that its flight checks had given rise to comparable findings, 
• Air France told the BEA that its flight analysis protocol was being revised with the aim of reinforcing the individualised monitoring of crews,
• Air France decided to carry out a transversal LOSA audit from the autumn of 2022:

Air France should continue, and if necessary extend, the internal actions undertaken in order to make its safety culture evolve towards a stricter application of in-flight procedures. This could be based on a general action plan which could include the following topics:

• The individual identification and management of deviations from in-flight procedures, in the scope of OFDM and within a just culture framework;
• Providing pilots with tools to replay and analyse their flights and promoting the use of these tools; 
• Changes to the Operations Manual to limit deviations from procedures to exceptional circumstances in which the available procedures cannot be applied or are clearly not appropriate; 
• The involvement of management, instructors and flight crews in the construction of these cultural changes. [Recommendation FRAN 2022-011]  

The Final Report was initially published in the definitive French language on 23 August 2022 and this was followed on 25 August 2022 by an English Language translation. 

Related Articles

• Fuel - In-Flight Management (Abnormal Operations)
• Aircraft Fuel Systems
• Threat and Error Management (TEM) in Flight Operations
• Emergency Checklist
• Standard Operating Procedures
• Decision Making
• Leadership
• Crew Resource Management (CRM)
• Safety Culture