Description

On 25 October 2021, the crew of a Boeing 737-800 (VH-VZT) being operated by Qantas Airways on a scheduled passenger service from Perth to Adelaide as QF 888 which was being used for First Officer line training, noted an information indication of wing tank fuel imbalance en-route in night VMC. After deciding that the cause was a fuel leak, they shut down the left engine, declared a ‘PAN’ and diverted to Kalgoorlie without further developments where an inspection found that there was no fuel leak and the fuel system was serviceable.

Investigation

An Investigation into the event was carried out by the Australian Transport Safety Bureau (ATSB). Relevant FDR data were available but corresponding CVR data had been overwritten. CCTV recordings at the time of the pre-flight refuelling were available as were a statement from the engineer overseeing the refuelling process.

It was noted that the Training Captain had a total of “almost 12,000” hours flying experience including 5,000 hours on various 737 type variants and was accompanied by a First Officer undergoing line training who had a total of “about 1,800” hours flying experience including “about 110” hours on type. He had originally joined Qantas as a Second Officer on the Boeing 787 and his subsequent 737 type rating training had been interrupted as a result of the consequences of the pandemic, most recently for a month before it recommenced about ten days prior to the event under investigation. The Captain had decided that the trainee First Officer would act as PF for the flight.

What Happened

The Captain was conducting the pre-flight inspection as the refuelling vehicle arrived at the aircraft and observed that there was extensive cold-soaked fuel frost (CSFF) on the lower surfaces of both wings which he then discussed with the licensed engineer overseeing preparations for the departure. Having established that the temperature of the fuel in both wing tanks was -4°C, it was agreed to delay refuelling to undertake a ground transfer of fuel from the two wing tanks to the centre tank. The engineer operated the appropriate switches on the external refuelling panel and instructed the flight crew to make appropriate selections on the flight deck fuel system panel. The First Officer “recalled” following these instructions supervised by the Captain but did not refer to the corresponding written procedures.

Fuel pump operating limitations limited the planned fuel transfer to one tonne of the 4.2 tonnes of fuel in the wings and having concluded that this transfer would not be enough to cause the frost to melt asked the crew to increase the total of 8.6 tonnes of (warmer) fuel they had requested for departure. Shortly after this request had been acknowledged and an additional one tonne had been added to the fuel uplift, the engineer reported seeing that “fuel was pumping out of the right tank faster than the left tank” and instructed the First Officer on the intercom to turn off the right main tank fuel pumps. Shortly after this, the engineer instructed the flight crew to also turn off the left main fuel pumps and close the crossfeed valve. The First Officer “did not recall” hearing the engineer advising completion of the fuel transfer.

The ‘Before Start’ Checklist required the crew to check that the fuel pumps were on and in view of the fact that the First Officer was undergoing line training, the Captain reported having scanned the overhead panel and recalled that although they had checked the fuel pump switches, they had not checked the position of the crossfeed selector or noticed the illuminated (but dimmed) blue light which indicated that the crossfeed valve was fully open. It was noted that this light is only brightly lit when the crossfeed valve is in transit and is unlit when it is fully closed. The Captain stated that “glare from the sun may have hindered their ability to notice the dimmed light”.

On completion of refuelling to the agreed 9.6 tonnes, the quantity of fuel in each wing tank was “approximately equal” and remained so as aircraft taxied for departure. The climb to the planned cruise altitude of FL 390 was completed after 20 minutes airborne and two minutes later, the “fuel” annunciator illuminated. This prompted both pilots to look at the overhead fuel system panel and, as they expected given that centre tank fuel had been used first, observed that both centre tank fuel pump low pressure lights were illuminated and both centre tank fuel pumps were switched off.

Although this was not noticed by the crew, recorded flight data indicated that at this point, the quantity of fuel remaining in the two wing tanks had begun to differ with most being drawn from the left fuel tank although fuel flow to each engine was similar. About 15 minutes after the centre tank pumps had been switched off, an ‘IMBAL’ fuel system imbalance alert (which is not associated with an audible indication or master caution) was illuminated on the central warning panel. This indicated that the difference in fuel remaining in the wing tanks has been “more than 453 kg for at least 60 seconds” - the actual difference written down by the crew, which was consistent with recorded flight data at the time, was 630 kg.

The pilots reported that the corresponding QRH Checklist for this indication was run and that they had noted that it included the remark that a fuel leak should be suspected if the total fuel remaining was less than expected or if an engine had excessive fuel flow. In either case, the Engine Fuel Leak Checklist should then be followed. The Captain stated that having seen the left wing tank fuel quantity diminishing at a high rate he had “thought that there must be a fuel leak [although he had] also confirmed around this time that other engine and fuel indications appeared normal”. Whilst neither criterion had been satisfied, the pilots nevertheless concluded that there was a fuel leak and commenced the engine fuel leak Checklist. This Checklist included an instruction to confirm that the crossfeed selector was closed (or close it) and Captain reported than when seeing that the crossfeed valve selector was set to ‘open’, he had and moved it to ‘closed’. Neither pilot was aware that flight with the crossfeed valve open would automatically lead to a progressive fuel imbalance whereas with it in the normal closed position, each engine would draw fuel only from the same-side wing tank.

A subsequent item in the Checklist stated that a fuel leak would then be confirmed if either: 

• fuel spray is observed from an engine or strut or
• based on recording the change in the indicated contents of each main tank for 30 minutes, the imbalance changes by 230kg within that time, i.e. an increase of 460 kg/hour.

The first possibility was eliminated when the SCCM was asked to look out of a rear cabin window for signs of a fuel leak and reported that they could not see any but the crew’s determination in respect of the second was ambivalent. The First Officer had recorded an increase in imbalance greater than 230 kg per 30 minutes although the two pilots’ recollections of when this was done differed significantly. FDR data indicated that the average imbalance rate had reached a minimum of around 225 kg/hour some five minutes after the IMBAL alert had appeared.

Aware of the risk of commencing the imminent and significant overwater section of their flight with an apparent fuel leak and the prospect of an engine shutdown, it was decided to divert and shut down the engine with the perceived fuel leak. An initial plan to return to Perth was announced to ATC just seven minutes after IMBAL alert had appeared but the plan was then changed to an en-route diversion to Kalgoorlie which was closer. A PAN call was made, descent from FL390 was commenced and the left engine was then shut down. FDR data showed that at this time, a total of 6,423 kg of fuel remained of which 3,701 kg were in the right wing tank. The APU was then started in accordance with the Engine Fuel Leak Checklist. FDR data showed that the fuel quantity in the left main tank had initially been steady but that thereafter, the fuel quantity in each wing tank had decreased at an almost equal rate (indicating that the crossfeed valve had been open during this period).

The aircraft landed at Kalgoorlie 50 minutes later and stopped on the runway with 5,357 kg of fuel remaining of which 3,225 kg was in the right wing tank. An inspection of the left engine by the Airport RFFS found nothing untoward and it was declared safe so the aircraft was then taxied to its allocated parking position and the passengers disembarked.

Appropriately qualified aircraft maintenance engineers then checked the status of the aircraft fuel system and determined that: 

• there were no fuel leaks or other relevant unserviceabilities
• when tested, the fuel used by both engines had been within normal limits
• the fuel quantities in each tank after landing met the criteria for a fuel imbalance alert to be annunciated.

Fuel quantity in each tank during the flight. [Reproduced from the Official Report]

The Training Captain could reasonably have been expected to be familiar with the content of the FCTM which for the fuel system was noted as including the following:

• One tank indicating abnormally low can be caused by a fuel leak, engine out or a crossfeed problem. With an engine out, if the totaliser and calculated values are tracking as expected, a fuel leak would not be suspected. A fuel pump with higher pressure and a faulty crossfeed valve can cause one tank to provide fuel to more than one engine, causing one tank to indicate low. In this case, the fact that total fuel should still match planned fuel, a fuel leak would not be suspected.
• Any time an unexpected fuel quantity indication, FMC fuel message, or imbalance condition is experienced, a fuel leak should be considered as a possible cause. Maintaining a fuel log and comparing actual fuel burn to the flight plan fuel burn can help the pilot recognise a fuel leak. 
• Some fuel-related checklists (for example, IMBAL) list reasons that a fuel leak should be suspected. This list is not exhaustive and, in all cases the Flight Crew should use their knowledge of the fuel system and current operating conditions to determine whether a fuel leak should be suspected.
• There is a common misconception among Flight Crews that the fuel crossfeed valve should be opened immediately after an in-flight engine shutdown to prevent fuel imbalance. This practice is contrary to Boeing recommended procedures and could aggravate a fuel imbalance. This practice is especially significant if an engine failure occurs and a fuel leak is present. Arbitrarily opening the crossfeed valve and starting fuel balancing procedures, without following the checklist, can result in pumping usable fuel overboard.

Why It Happened

Although there was no evidence that the remaining fuel was less than would be expected and there was no visible evidence of any leak, both pilots “formed a mental model that there was a fuel leak, originating with and/or reinforced by the rapid reduction of fuel in the left main tank”. They therefore followed the Engine Fuel Leak Checklist. Although this included an action to check that the crossfeed valve was closed, the Investigation was unable to conclusively determine whether, or at what time, this action had occurred.

However, until the left engine was shut down, more fuel was being used from the left tank than from the right tank. It was considered that the FDR indication of a reduction in the imbalance rated to about 225 kg/hour five minutes after the IMBAL alert had appeared could indicate that the crossfeed valve had been closed during all or part of this period. However, it was considered that “it was more likely than not open throughout this period” since fuel flow rates indicated that it was closed at about the same time the left engine was shut down before being reopened a few minutes later and remaining open for the rest of the flight. It was therefore concluded that either way, the action to close the crossfeed valve (and keep it closed) in the Fuel Leak Checklist “was not carried out correctly”. It was noted that “had there been an actual leak from the left engine fuel system, having the crossfeed valve open would have resulted in a greater loss of fuel than would otherwise have occurred”.

It was noted that only after closing the crossfeed valve were the fuel quantity and current time supposed to be recorded but the crew calculation of the imbalance rate of change used the fuel quantity that was recorded prior to commencing this checklist and therefore included a period of time during which the crossfeed valve was open. It was considered that the consequence of changing the order of the two checklist steps had not been recognised by the crew, possibly as the result of perceived time pressure of approaching the coastline, at night, with a suspected fuel leak. This ultimately resulted in an incorrect fuel balance and led to “a cautious and conservative but somewhat hasty decision to suspect a fuel leak [...] and ultimately an unnecessary engine shutdown”.

Four Contributing Factors were formally documented based on the Findings of the Investigation as follows:

• Under instruction from the engineer, the flight crew conducted steps to perform a ground transfer of fuel (to remove cold soaked fuel frost from the wings) without referring to the relevant procedures. Consequently, an error was made in not closing the fuel crossfeed valve before flight.
• During pre-flight checks, and later during the climb and level-off, the flight crew did not notice the crossfeed selector in the open position or the associated dimmed blue indicator light on the fuel panel.
• The Boeing 737 IMBAL (imbalance) Checklist did not provide sufficient guidance for a flight crew to identify an open crossfeed valve as being a potential reason for a fuel imbalance.
• Partly as a result of confirmation bias, stress and perceived time pressure, the flight crew abbreviated the relevant checklists. As a result, the flight crew’s calculation of the rate of fuel imbalance change was invalid and they misdiagnosed the fuel imbalance as being the result of a fuel leak, resulting in an unnecessary in flight engine shutdown.

In Conclusion, a Safety Message based on the Investigation Findings was as follows:

Checklists are designed to minimise performance variability under workload and stress, and thereby increase the likelihood that all required actions are successfully carried out. The importance of precision when following checklists, especially when under stress and time pressure, is highlighted by this occurrence.

The Final Report was released on 28 February 2024. 

Related Articles

• Aircraft Fuel Systems
• Checklists - Purpose and Use
• Emergency and Abnormal Checklist
• Fuel Leak and Confirmation Bias (OGHFA SE)
• In-Flight Fuel Imbalance Error (OGHFA SE)
• Confirmation Bias
• Stress
• Flight Crew Training Manual (FTCM)