Description

On 24 August 2001, an Airbus A330-200 being operated by Air Transat on a passenger flight from Toronto to Lisbon experienced abnormal engine indications during the cruise in Visual Meteorological Conditions (VMC) at night which the crew eventually realised were indicative of insufficient fuel remaining to reach the planned destination. A diversion to Lajes Air Force base in the Azores was successfully completed despite the onset of complete fuel exhaustion when the aircraft was still a considerable distance from the runway. A landing was made after 19 minutes with neither engine functioning and just 5 minutes after the beginning of official daylight. It resulted in deflation of most of the tyres but the aircraft came to a stop on the runway with some resultant structural damage to the fuselage and damage to the main landing gear. The emergency evacuation of the 306 occupants ordered by the aircraft commander resulted in two persons sustaining serious injuries and sixteen others sustaining minor injuries.

Investigation

An Investigation was carried out by the Portuguese Office of Accident Investigation, the GPIAA. All but the last nineteen minutes of Flight Data Recorder (FDR) data (when the electrical power status was too low to power the FDR) was available to assist the Investigation. However 90 minutes of the 2 hour Cockpit Voice Recorder (CVR) recording was found upon downloading to have been overwritten when electrical power was restored to the aircraft after the arrival at Lajes.

The history of the investigated event was reconstructed from the available evidence. It was found that that aircraft commander had been the designated PF and that the aircraft had departed Toronto with 5.5 tonnes more fuel than the minimum fuel required.

The flight crew stated that until after crossing 30º West, all had proceeded normally but soon after this, they had noticed abnormal engine oil indications on the right hand (No 2) engine. The oil indications taken from the Electronic Centralized Aircraft Monitor (ECAM) display had been passed by HF radio to the Operator’s Maintenance Control Centre (MCC). Half an hour later, annunciation of an ECAM Advisory of ‘Fuel Imbalance’ presented the crew with their first awareness of a fuel problem. To correct lower fuel contents in the right wing tanks than in the left wing tanks, the crew selected the cross feed valve OPEN and the right-wing fuel pumps OFF.

Fifteen minutes later, the remaining fuel dropped below the minimum required to reach the planned destination and the crew initiated the diversion to Lajes Airport on Terceira Island in the Azores, advising ATC of this “due to fuel shortage” three minutes later. Soon after this, the crossfeed flow was reversed, an action which the crew advised had been “to use up the fuel from the right wing and to counter the possibility that the fuel loss was the result of a leak in the right wing tanks”. The Company MCC was then contacted again on HF, advising the inexplicable low fuel quantity readings - at this time, fuel on board was 4.8 tonnes rather than expected 16.8 tonnes and the crew advised that “they could not determine what the problem was, that the fuel indication was continuing to reduce and that the apparent fuel leak was happening in the right-wing inner tanks”.

When the aircraft was at FL390 and 150 miles from Lajes, the right engine flamed out. The crew notified Santa Maria Oceanic Control of this and that the flight was descending. Ten minutes later, a MAYDAY was declared to ATC and three minutes after this, with the aircraft now 65 nm from Lajes passing approximately FL345, the left engine flamed out. The ‘ALL ENG FLAME OUT’ Quick Reference Handbook (QRH) drill was completed and the descent on track continued. After transfer to Lajes APP still in VMC, radar vectors and flashing of the runway lights were used to guide the aircraft.

It arrived about 8 miles off the approach end of runway 33 at approximately FL130 on a westerly track and the Captain advised ATC that he was making a left hand 360° turn to lose height during which the leading-edge slats and landing gear were deployed. Once on final, S-turns were made in order to lose excess altitude and the aircraft crossed the runway 33 threshold at about 200 knots, made a firm touchdown in the TDZ and bounced before a final touchdown some 850 metres from the beginning of the 3050 metre long runway. Maximum braking was applied and the aircraft came to a stop just under 750 metres before the end of the runway. Some small fires started in the vicinity of the left main landing gear assembly but they were immediately extinguished by Rescue and Fire Fighting Services vehicles which were already in position. The Captain ordered an emergency evacuation during which two passengers sustained serious injuries and fourteen others and two of the cabin crew sustained minor injuries.

The Investigation determined that the Cause of the double-engine flameout had been fuel exhaustion, which had resulted from a fuel leak developing in the right engine following inappropriate use of mismatched fuel and hydraulic lines during the installation of the engine hydraulic pump during an engine change prior to the flight. The fact that fuel exhaustion followed was found to be the direct result of the crew not performing the QRH/ECAM ‘FUEL LEAK’ procedure that was specifically designed by the manufacturer to reduce the consequences of any in-flight fuel leak.

Once all the available facts had been documented, the Investigation therefore focused on the following two areas:

• Why the aircraft maintenance organisation did not detect the mismatch in engine configurations prior to beginning the engine change; then why, once the configuration difference was detected during the engine change, the installation of the hydraulic pump and hydraulic and fuel lines was not completed in accordance with manufacturer’s specifications;
• Why a qualified flight crew trained in accordance with approved training programs, while attempting to analyse the situation and taking actions in reaction to the situation, did not take the actions prescribed by the manufacturer to mitigate the consequences of a fuel leak situation, and (instead) took action that exacerbated the situation.

The Maintenance Error

It was found that the replacement of the right (No, 2) engine on the aircraft had been achieved using an engine with a pre-modification hydraulic tube assembly which was incompatible with a post-modification fuel tube with the result that, in subsequent flight, the fuel tube had fractured after contact with the hydraulic line causing the fuel leak to begin. It was found that when the spare (loan) engine had arrived at Air Transat’s premises at Montreal on 1 August 2001, it had been processed in accordance with the applicable procedures. These involved only an inventory check (which did not include any review of SB modification status) and verification that any parts on the “Carry Forward Items List” were available. It was found that “all the A330 engines in use at the company were in the post-SB configuration and the company personnel had never been involved with pre-SB configured engines”. It was also noted that the physical appearance of the pre-SB and post-SB hydraulic pump configurations were similar and no difference would be visible during a cursory inspection such as that conducted at engine receipt and that the part number of the hydraulic pump fitted was incorrectly identified as a post-SB one with the same Part Number as those installed on other Company A330s.

The short notice of the plan to use the loan engine to replace one of those on the accident aircraft meant that job cards generated by maintenance planning were those associated with a normal engine change and this ensured that “the responsibility to detect the incompatibility between the hydraulic pump and the fuel and hydraulic lines was deferred to the technicians doing the engine change”.

Once the installation of the loan engine was in progress, interference was noticed between the hydraulic pump and the fuel tube. At this stage, it was realised that the difficulty with the hydraulic pump installation could be related to the differing SB status but upon encountering problems in looking into this, the lead technician involved sought engineering guidance via maintenance control but this did not resolve the issue and when he contacted the Engine Controller, the latter’s “knowledge of the SB and its background comforted the lead technician into feeling that the Engine Controller had a good grasp of the problem at hand” led to acceptance of their inappropriate (and unsubstantiated by documentation) guidance.

It appeared that “adequate clearance between the fuel and hydraulic lines” had been achieved during installation of the hydraulic pump line “by applying some force to position the line and holding the line while applying torque to the (securing) nut".

The Investigation noted that although it was not unusual to position a line to achieve clearances in this manner, if clamping is not used then there is a tendency for a flexible line to straighten when pressurised in operation, which was particularly critical when there is a 90º bend in the tube adjacent to a securing nut as in this case. It was considered that “the risk associated with the application of force while installing mixed construction lines is not well known in the maintenance community” and noted that it was “not covered in the training of maintenance technicians”.

In this case, it was apparent that “pressurisation of the hydraulic line would have been sufficient to cause the hydraulic line to move back to its natural position and come in contact with the fuel line” causing chafing and the eventual failure of the fuel line in flight.

The failure of both Quality Control and Quality Assurance processes to function effectively as a defence against improper maintenance practices was noted, as was the absence of any airworthiness requirement to review all SB’s on a component prior to its installation and checking for compatibility.

The Operational Failure

The Investigation determined that the prelude - and to some extent crew distraction - caused by the abnormal engine oil indications which initially attracted the attention of the flight crew had been the consequence of a high rate of fuel-flow through the fuel/oil heat exchanger. The suddenness of these changes and the fact that there were no abnormal procedures or information for a combination of abnormal but individually within-limits high oil pressure, low oil quantity and low oil temperature had engendered “a level of uncertainty” in the flight deck which the Company MCC had been unable to explain. With these unusual the oil parameters within their individually-specified operating limits, no diversion to an ETOPS alternate was required on that account by any extant regulation or procedure.

It was established that the fuel leak had begun almost two hours before the eventual emergency landing had occurred but noted that a fuel problem had not been noticed by the crew until 55 minutes later when an ECAM Fuel Advisory Message stating that a Fuel Imbalance existed was generated. By this time, the fuel on board had dropped to just over 12 tonnes after 6.65 tonnes of fuel had been lost. It was noted that there would have been a number of indications on the flight deck that there was a fuel-loss problem during this 55 minute period including:

• the FOB figures on the Engine Warning Display (EWD) page which would have shown that fuel on board was decreasing at an abnormal rate.
• The estimate of the expected quantity of fuel expected to be on board on arrival at destination displayed on the MCDU was decreasing markedly.
• The transfer forward of the fuel in the trim tank to the wing tanks which occurred during the period would have resulted in the display of “TRIM TANK XFR” for almost 20 minutes followed by the message “TRIM TANK XFRD” for three minutes. Such indications were premature given the fuel on board on departure of almost 47 tonnes, although it was accepted that they “would have been unremarkable” because they are routinely seen during transatlantic flights.

The Investigation considered that other factors were also likely to have contributed to the failure of the flight to detect a low fuel quantity problem until the imbalance annunciation:

• The only fuel check required under SOPs was carried out at a time when the fuel remaining was very similar to that planned/expected.
• The awareness of unusual oil readings “created a level of uncertainty” which led to the flight crew becoming pre-occupied in action to resolve the ambiguities, including reviewing on board documentation and contacting the Maintenance Control Centre by HF radio.
• The transfer of fuel from the trim tank already referred to included transfer into the right wing tank which masked the fuel leak and delayed the generation of the fuel imbalance advisory message by approximately 15 minutes.

The Investigation considered that the fact that this flight crew had missed all of these ‘early warning signs’ of a fuel leak “highlights the limitations of the warning and alert system in this kind of situation” primarily in the failure of the available indications to convey any sense of urgency or indicate the critical nature of the fuel leak.

Once the crew had become aware of fuel imbalance, they cancelled the display of the engine page in order to view the fuel page but because of the nature of the advisory message this ECAM page did not automatically display a checklist procedure and it was necessary to first review the fuel system indications presented. The crew noted the flashing displays associated with the right wing tank and then, three minutes after the fuel imbalance advisory had been displayed, they initiated, by memory and without reference to the QRH, the fuel balancing procedure by opening the crossfeed valve and turning off the right wing tank pumps. At this stage, total fuel on board was 11 tonnes and 7.3 tonnes had already been lost. The effect of opening the crossfeed valve was that fuel from the left wing tanks was fed to the leak in the right engine. The QRH caution included prominently in the FUEL IMBALANCE drill stated that, in the event that a fuel leak was suspected, the FUEL LEAK drill should be followed.

Soon after opening the crossfeed, the crew became aware of the significance of fuel loss and the consequent effect on estimated fuel on board (EFOB) at the planned destination. The response of the crew to this situation was to seek to resolve the discrepancy by reviewing fuel loading, flight planning documents and flight records for errors - none were found – and review engine and fuel system indications and displays to see if there were other indications of a problem with the engines, fuel flow or fuel system - none were found. Once the destination EFOB had reduced below that required, the Captain made the appropriate decision to divert to the nominated ETOPS alternate of Lajes.

At the time the diversion was commenced, fuel on board had reduced to 8.7 tonnes with 9.3 tonnes of fuel having been lost and the fuel leak continuing at a rate of 13 tonnes/hour. The crew stated that whilst they were setting up the diversion, they had considered following the QRH Fuel Leak drill but had not done so because “they were still uncertain as to the validity of the fuel quantity indications and the precise nature of the problem”. Nine minutes into the diversion, the Captain reconfigured the crossfeed to “right to left instead of left to right” which conserved the remaining fuel for use by the left engine. As the diversion continued, the crew began over 10 minutes of HF communication with the Company Maintenance Control Centre but no useful result was obtained. Soon afterwards, the right engine flamed out with less than 1 tonne of fuel remaining.

It was concluded that on the evidence available “the crew’s reaction to the engine failures and actioning of the required checklist procedures were in accordance with procedures specified in the FCOM” and that overall “the performance of cockpit duties, interface with cabin crew, and communications with air traffic were professional and highly effective”.

It was further concluded that:

“The Captain’s handling of the aircraft during the engines-out descent and landing was remarkable given the facts that the situation was stressful, it was night time, there were few instruments available, pitch control was limited, and he had never received training for this type of flight profile. The Captain’s decision to apply and maintain maximum braking on the second touchdown was justified based on the facts that the aircraft speed was well above the recommended speed when crossing the threshold, and that, following the initial bounce, the aircraft touched down significantly beyond the normal touchdown zone. The First Officer provided full and effective support to the Captain during the engines-out glide and successful landing”.

It was established that neither pilot had any previous experience of a significant fuel imbalance during flying operations nor been exposed to a fuel leak situation in either actual operations or during training. However, the Investigation observed that, if either of the key actions in the ‘FUEL LEAK’ drills - for a leak from an engine (shut that engine down) or for a fuel leak not from an engine or a leak not located (do not open the crossfeed) had been followed in response to the ‘FUEL IMBALANCE’ advisory or at any time up to 9 minutes after the diversion had been initiated, fuel in the left wing tanks would have been sufficient to reach Lajes with the left engine still operating.

It was recognised that notwithstanding clear indications that there had been a massive loss of fuel, the crew had not come to such a conclusion. The Investigation considered that a number of factors supported their inaccurate mental model of the situation:

• The combination of the suddenness and the magnitude of the indicated fuel loss were such that it could not be linked to any explainable reason.
• The earlier (perceived) problem with the oil indications had established a level of uncertainty.
• There was no ECAM warning or caution message indicating a severe problem.
• No other indication of an engine problem was discovered.
• Some information, such as the cabin crew confirming that there were no visible signs of a leak, countered the possibility of a leak.

As the situation had developed, it was noted that the crew, realising that the situation was deteriorating, had concluded that a computer malfunction would account for the ‘ambiguous’ fuel indications and their lack of training for or experience of a fuel leak meant that they had nothing to counter the basis for their hypothesis.

Since the actions of the flight crew had clearly not been appropriate to the circumstances and more appropriate ones, even at quite a late stage in the developing sequence of events, could have avoided complete fuel exhaustion and the (nevertheless well handled) challenges this presented, the Investigation considered the nature of crew decision-making and concluded that it was likely that in the investigated case, three factors had been influential in it:

• Framing Bias: the crew initially considered but elected not to carry out the fuel leak procedure;
• Confirmation Bias: once they decided that the source of the abnormal indications was probably a computer malfunction, the crew did not modify this view through to the end of the CVR recording by which time the second (left hand) engine had flamed out;
• Realignment of the Mental Model: the crew did not carry out the fuel leak procedure later in the flight even though they claimed to have identified the possibility.

The Investigation also noted that the automation management strategy prevalent in the A330, often described as “management by exception”, was inherently vulnerable to the creation of “automation surprises”. It was considered that in this event such a surprise had occurred when the automated fuel transfer process was no longer able to maintain the right wing fuel tank contents at the prescribed minimum level and had therefore shed the task to the flight crew and communicated this through the “Fuel Imbalance” ECAM Advisory Message.

It was noted that both pilots had previously flown the Lockheed 1011 TriStar for the Air Transat, and had converted to the A330 only a relatively short time before the accident. The Captain had completed his training for the A330 just over a year earlier and the First Officer had done so eight months earlier.

The Investigation examined previous fuel leak occurrences and noted that, since such leaks had been usually attributable to technical faults, few had been independently investigated as ‘Serious Incidents’ and even fewer had been analysed to review operational factors which might have increased their seriousness. It was observed that “although some regulatory agencies now require that AFMs include procedures that will enable flight crews to identify fuel system leaks and procedures for crews to follow to prevent further fuel loss” there were still a number of commercial aircraft operating without such guidance.

The Emergency Evacuation

The Investigation was advised that the emergency evacuation had been completed in approximately 90 seconds with the active involvement of all 11 cabin crew. It was attempted using all emergency exits and their slides with all except those at exit L3 functioning normally. The L3 door failed to open properly and the exit was not used. The only other problems noted with the evacuation from the cabin were as follows:

• Some passengers were reluctant to leave the aircraft and had to be “aggressively encouraged” to do so
• Many passengers attempted to leave with their carry-on baggage; and
• Two passengers with disabilities required assistance to reach / get onto evacuation slides.

Safety Action taken during the course of the Investigation by a number of agencies involved was noted. It included actions by Transport Canada, Air Transat, the DGAC France, Airbus, Rolls Royce and the UK CAA.

Subject areas which it was considered by the Investigation still needed attention were:

• fuel leak detection and warning and fuel leak training for pilots
• the design of automatic fuel transfer systems,
• the acquisition and subsequent safeguarding of recorded flight data for investigation purposes and
• the maintenance planning of major component changes.

Each of these was therefore made the subject of one or more of 12 Safety Recommendations issued at the conclusion of the Investigation as follows:

• that the Direction Genérale de l’Aviation Civile of France mandate the implementation of the FUEL FU/FOB DISCREPANCY Caution alert for all A-330 aircraft and mandate the incorporation of a fuel loss alert for other Airbus aircraft with similar fuel system design. [AA/2004]

• that the Civil Aviation Authorities of other transport aircraft category manufacturing states, such as Canada, United States of America, and United Kingdom, as well as the European Aviation Safety Authority should review:

- the adequacy of aircraft indications and warning systems and procedures to detect fuel-used/fuel-loss discrepancy situations;

- the capability of these systems to provide clear indications as to the causes of these situations;

- the capability of these systems to provide alerts at a level commensurate with the criticality of a fuel-loss situation. [AB/2004]

• that the Direction Genérale de l’Aviation Civile of France, Transport Canada, Civil Aviation Authority of the United Kingdom, the Joint Aviation Authority, European Aviation Safety Authority, and the Civil Aviation Authorities of other States should:

- review flight crew operating manuals and checklist procedures to ensure that they contain adequate information related to fuel leak situations;

- review flight crew training programs to ensure that they adequately prepare crews to diagnose and take appropriate actions to mitigate the consequences of fuel leak events;

- amend regulations and standards to require crew training on fuel leak events. [AC/2004]

• that, as an interim safety measure, All Civil Aviation Authorities promulgate the circumstances of this fuel leak event to all air operators, aircraft manufacturers and flight crew training organisations. [AD/2004]

• that the Direction Genérale de l’Aviation Civile of France, in consultation with Airbus should review the automated fuel-transfer systems on Airbus aircraft to ensure that the systems are able to detect abnormal fuel transfers, that systems exist and procedures are in place to inhibit abnormal transfers, and that the crews are notified, at an appropriate warning level, of abnormal fuel transfers. [AE/2004]

• that the Direction Genérale de l’Aviation Civile of France and EASA should:

- review Airbus aircraft indication and warning systems and abnormal procedures to ensure that, in situations of major fuel imbalances, actioning of appropriate fuel leak procedures becomes a priority for flight crews;

- consider merging the Airbus FUEL IMBALANCE and FUEL LEAK checklist procedures into one procedure, containing, at the top of the procedure, the conditions that would suggest the presence of a fuel leak. [AF/2004]

• that the Civil Aviation Authorities of other aircraft manufacturing states, such as Canada, United States of America, and United Kingdom, as well as the European Aviation Safety Authority should review the adequacy of the fuel indications and warning systems, as well as procedures associated with fuel imbalance situations to ensure that the possibility of a fuel leak is adequately considered. [AG/2004]

• that Transport Canada and Direction Genérale de l’Aviation Civile of France and EASA should review the adequacy of applicable regulations, standards and aircraft manuals to ensure that necessary information and guidance is made available to the crews to properly safeguard on-board recordings following an occurrence. [AH/2004]

• that the Civil Aviation Authorities of other states, as well as the European Aviation Safety Authority should review the adequacy of their regulations related to the safeguarding of on-board aircraft recordings. [AI/2004]

• that the European Organisation for Civil Aviation Equipment, ICAO, all Civil Aviation Authorities and Safety Investigation Authorities should take into account the circumstances of this particular occurrence in their deliberations on the requirements for independent power supplies for on-board aircraft recordings. [AJ/2004]

• that Transport Canada, and Direction Genérale de l’Aviation Civile of France, and the Civil Aviation Authority of the United Kingdom, as well as the EASA and Civil Aviation Authorities of other States responsible for the manufacture of aircraft and major-components should review applicable airworthiness regulations and standards, as well as aircraft, engines and component maintenance manuals, to ensure that adequate defences exist in the pre-installation maintenance planning process to detect major configuration differences and to establish the required support resources for technicians responsible for the work. [AK/2004]

• that Transport Canada, Direction Genérale de l’Aviation Civile of France, and the Civil Aviation Authority of the United Kingdom, as well as the European Aviation Safety Authority and civil aviation authorities of other states, in conjunction with aircraft and major component manufacturers should review the adequacy of the current standards for identifying the configuration and modification status of major components to ensure that differences between major components of similar part numbers can be easily identified. [AL/2004]

The Final Report was completed on 17 September 2004 and published on 18 October 2004

Further Reading

• Flame Out
• Interruption or Distraction
• Extended Range Twin Engine Operation (ETOPS)
• ETOPS Diversion at Night (OGHFA SE)
• Situational Awareness
• Continuation Bias
• ATC Expectation Bias
• Information Processing,
• Crew Resource Management
• Maintenance Error
• Airworthiness - The System