History of Flight

On August 24, 2001, Air Transat Flight TSC236, an Airbus Model 330-243 aircraft, was on a scheduled flight from Toronto, Canada to Lisbon, Portugal. The flight departed Toronto at 00:52 Coordinated Universal Time (UTC). According to the flight crew, the flight and fuel consumption progressed normally through 04:57 UTC, when the airplane passed 30 degrees west longitude. Unknown to the crew, a fuel leak had developed in the right engine, beginning at 04:38 UTC. Air Transat operational procedures for extended range flight, such as was being conducted on this flight, required a fuel quantity check to be performed by the flight crew as the aircraft passed each 10 degrees of longitude. At the time of the 30° west position check, the fuel quantity was unremarkable, as it was within 200 kg (441 lbs.), or 1% of the planned fuel quantity at that point in the flight. Eighteen minutes after the fuel leak began, and just before reaching the 30° west position check at 04:56 UTC, the automatic center of gravity (CG) control function of the horizontal stabilizer Trim Tank Transfer System began a two-minute transfer of 300 kg (661 lbs.) of fuel from the horizontal stabilizer trim fuel tank to the left and right wing inner fuel tanks in order to maintain center of gravity within the aft CG target.

A few minutes later during the same 30° west position check, the crew noticed unusual engine oil indications on the Number 2 (right) engine. The crew selected the ENGINE page on the lower screen of the A330 Electronic Centralized Aircraft Monitoring System (ECAM) to verify the engine readings. While the flight crew was investigating the unusual engine oil indications, the Trim Tank Transfer System automatically began a second 19-minute forward transfer of the remaining 3,200 kg of stabilizer trim tank fuel to the left and right wing inner fuel tanks. This final fuel transfer, which was completed at 05:30 UTC, would not normally occur until late in the flight about 35 minutes from the destination airport. Because fuel was leaking from the right engine, the system automatically transferred more fuel to the right inner tank in order to maintain balance between the left and right inner fuel tank quantities.

At 05:33 UTC, a fuel imbalance advisory message appeared on the upper ECAM screen, called the Engine Warning Display or E/WD, indicating a fuel quantity difference between the left and right inner wing fuel tanks of 3,000 kg. Normally, this message would have triggered an automatic display of the FUEL page on the lower ECAM system display (SD), which is a synoptic of the fuel system, including individual fuel tank quantities. The earlier manual selection of the ENGINE page on the SD inhibited the automatic display of the FUEL page. However, the flight crew deselected the ENGINE page a minute later and the FUEL page then was displayed. At this time, the crew became aware of the fuel imbalance between the left and right inner wing fuel tanks. The initial crew action was to address the fuel imbalance message by selecting the crossfeed valve OPEN and the right wing fuel pumps OFF in order to feed the right engine from the left wing tanks. The FUEL IMBALANCE procedure in the Quick Reference Handbook (QRH) contained a caution note that, if a fuel leak is suspected, the crew should instead refer to the FUEL LEAK procedure. According to the accident investigators, the Captain completed the fuel balancing procedure from memory without considering the caution note in the QRH procedure.

Shortly thereafter, the crew became aware that the fuel remaining on board was only 11,000 kg, or 8,500 kg below the expected amount of fuel at that point in the flight. According to the crew, both the imbalance and fuel quantity indications were unusual and unexplainable. It was further learned during the investigation that neither of the pilots had ever encountered a fuel leak, or an unexplained low fuel quantity either in training or in flight.

At 05:45, the fuel on board had reduced to below the minimum required to reach Lisbon, and the crew initiated a diversion to Lajes Airport on Terceira Island in the Azores. In attempts to resolve the sudden and unexplained reduction in the fuel quantity readings, the flight crew asked the cabin crew to visually check the wings and engines for a possible fuel leak. The visual check did not reveal any evidence of a fuel leak.

 

 

In reaction to a continued abnormally high rate of fuel consumption, the crew established fuel feed to both engines from right wing fuel tanks to counter the possibility that fuel loss was the result of a leak in the right wing tanks. At this time, fuel onboard was 4,800 kg, or 12,000 kg below the planned fuel quantity. At 05:58, a fuel right wing tank low level message displayed on the ECAM Engine Warning Display, which indicated that there was less than 1,640 kg of fuel in the tank for more than 60 seconds. During dialog with Air Transat Maintenance Control, the flight crew reported the fuel quantity to be 1,000 kg in the right tanks and 3,200 kg in the left tanks. Air Transat Maintenance Control asked if the fuel loss might be a leak in the left engine, so the captain momentarily reselected crossfeed from the left fuel tanks.

At 06:08, a fuel left, and right-wing tank low level message displayed on the E/WD, which indicated that the inner tanks in both wings contained less than 1640 kg for more than 60 seconds. The right engine flamed out five minutes later at 06:13.

At 06:23, the first officer declared "Mayday" with Santa Maria Oceanic Control and the left engine flamed out at 06:26 when the airplane was 65 nautical miles from Lajes. Control of the flight transferred to Lajes Approach Control. The aircraft arrived about 8 miles off the approach end of runway 33 at approximately 13,000 feet on a track of about 270°. The captain advised Lajes that he was conducting a left 360 degree turn in order to lose altitude. During the turn, the crew extended the leading-edge slats and landing gear for landing and conducted S-turns on the final approach to lose additional altitude. The aircraft crossed the threshold of runway 33 at about 200 knots, touching down hard 1,030 feet from the end of the runway, and bounced back in the air. A second touchdown occurred 2,800 feet from the approach end of the runway, and the crew applied maximum braking. The aircraft came to a stop 7,600 feet from the approach end of the 10,000-foot runway.

 

 

 

Cause of Fuel Leak

Fuel tube chafing from incompatible hydraulic tube

The accident investigators determined that the fuel leak leading to the fuel exhaustion and dual engine flameout on Air Transat TSC236 was caused by a crack in the right engine fuel line. The crack was approximately three inches long (80 mm) and was created by the fuel line rubbing against an adjacent hydraulic line. The rubbing was a result of an interference created by the use of mismatched fuel and hydraulic lines during replacement of the right engine on the accident airplane. The interference was caused by the incomplete incorporation of a Rolls-Royce service bulletin that detailed instructions for replacement of fuel and hydraulic tubes necessary for the installation of improved model hydraulic pumps. The engine maintenance shop tasked with the installation of the fuel and hydraulic tubes on the loaned engine did not complete the installation because of a parts shortage and Air Transat did not complete the service bulletin work prior to installing the new hydraulic pump on the engine as part of its installation on the accident airplane.

Hydraulic Pump Replacement

In reaction to several cases of hydraulic fluid leakage at the hydraulic pump or attached hydraulic lines, Airbus published an optional service bulletin offering a modified hydraulic pump. The service bulletin offered three physically similar and interchangeable models for new production airplanes, while two other models were available for modification and/or replacement by operators.

Because the pump was mounted on the engine, Rolls-Royce, the A330 engine manufacturer, issued two service bulletins, one for the installation of the modified hydraulic pump and the other detailing modifications to the engine build-up in order to accommodate the widened pump housing of the modified pump. The larger hydraulic pump housing created an interference between the hydraulic line and the adjacent engine fuel line. The engine build-up service bulletin replaced three fuel tubes and two hydraulic tubes for the front and rear hydraulic pumps in order to eliminate the interference.

The Rolls-Royce hydraulic pump replacement service bulletin clearly required the engine build-up service bulletin to be accomplished prior to, or concurrently with, the hydraulic pump replacement. The engine build-up service bulletin stated that it was essential that the fuel and hydraulic tubes be fitted as a set.

Replacement Engine Installation

Air Transat initiated an engine change on the accident airplane because of metal chips found on the original engine's master chip detector during a routine inspection. Air Transat's spare engine was not available for the replacement, so the airline used a Rolls-Royce loaned engine that had been previously positioned at the Air Transat facility. All of Air Transat's A330 airplanes were delivered in a post-mod configuration. The loaned replacement engine was a pre-mod hydraulic pump configuration. The maintenance facility that prepared the loaned engine for installation on an airplane was supposed to incorporate the engine build-up service bulletin so the newer modified hydraulic pumps could be used. However, the shop did not complete the bulletin because required parts were not available. Even though the required service bulletin had not been incorporated, the engine was transported to Air Transat with a Carry Forward List specifying that the new modified hydraulic pump part numbers were to be installed.

The engine change took place over a weekend and had fallen behind schedule due to the late arrival of a leased jacking pad. There was a commitment to complete the work by noon on Sunday for the next scheduled flight and to make space available for another use.

 

 

Interference between the hydraulic pump and the adjacent fuel tube was the first indication of a problem with the installation of the post-mod hydraulic pumps from the original engine on the pre-mod replacement engine. The lead technician attempted to access the engine build-up modification service bulletin from the airline computer network from three different workstations, but was denied access due to a computer malfunction. The Air Transat Maintenance Control Center (MCC) had stand-alone compact disks (CDs) of the Rolls-Royce service bulletins, but they were not used. According to the accident report, the lead maintenance technician did not consider the use of the stand-alone CDs because he was not aware of this capability in the MCC. The MCC technicians did not consider the use of the CDs because their role in providing technical assistance to maintenance crews was to locate resources, not to search for technical references.

Although initially concerned about the difficulty of retrieving the required service bulletin, discussions between the lead maintenance technician and the Air Transat Trent engine controller were primarily devoted to the time required to complete the work because they were behind schedule. Without access to the applicable engine build-up service bulletin, the lead maintenance technician and the engine controller determined that the replacement engine fuel lines needed to be replaced, even though the service bulletin also specified replacement of the hydraulic lines. Effectively, the engine controller and the lead maintenance technician agreed to this course of action without further reference to the service bulletin. Because the engine controller was knowledgeable about the service bulletin and the background of the hydraulic pump modification, the lead maintenance technician felt confident that the planned fuel line replacement was the only remaining requirement to complete the hydraulic pump installation. The Rolls-Royce service representative, who was familiar with the hydraulic pump modifications, made himself available to the airline for assistance during the engine change, but was not consulted.

Both segments of the post-mod fuel tube assembly were taken from the removed engine and installed on the replacement engine. The different shape and routing of the new fuel line eliminated the interference that previously created difficulties installing the post-mod hydraulic pump. However, the pre-mod hydraulic tube received with the loaned engine was retained. The installing maintenance technician recalled the hydraulic line had the tendency to spring back when trying to achieve the required separation between it and the fuel line taken from the original engine. However, he stated that he could easily obtain the clearance by positioning and holding the hydraulic tube while tightening the B-nut to hold it in place. No other installation difficulties were reported. Considering the hydraulic system working pressure of 3,000 psi and the pump pulsation, the accident investigators considered it feasible that any clearance between the hydraulic and fuel lines at installation on the occurrence aircraft would have vanished once the flexible hydraulic line was pressurized. The installation of the post-mod hydraulic pump, the pre-mod hydraulic tube, and the post-mod fuel tube assembly resulted in a mismatch between the fuel and hydraulic tubes.

The company maintenance control manual required a quality control inspection of the documentation following an engine change. However, the manual did not specify the time when this is to be completed. There was no quality control representative on site during the engine change because it was a weekend. The company plan was to do the document verification when preparing the removed engine for shipment to the repair shop. The accident flight occurred before this quality control verification was completed.

Configuration Control

The accident investigators were concerned about a lack of configuration control for optional non-mandatory service bulletins. Air Transat had received the loaned engine in an unexpected pre-engine build-up service bulletin configuration to which the airline had not previously been exposed, because all of its airplanes had been delivered in a post-mod configuration. The accident report states that documentation that came with the loaned engine had identified the incorrect hydraulic pump part numbers for this configuration, which may have masked the pre-mod configuration of the engine until near completion of the engine change. The accident investigators noted that there is no airworthiness requirement to review all non-mandatory service bulletins for applicability to a component prior to its installation on an aircraft.

Extended Operations (ETOPS)

Air Transat was operating under standards that were established to allow turbine engine powered airplanes with two engines to fly more than one hour flying time from a place to land anywhere along the route in still air with one engine inoperative. These types of operations were known as Extended Range Operations with Two-engine Airplanes, or ETOPS. Since the Air Transat accident, these standards have been codified into the regulations as Extended Operations but are still known as ETOPS.

Since 1949, transport airplane operational regulations restricted two-engine airplanes from operating on a route more than 60 minutes from a suitable airport with one engine inoperative. The 60-minute diversion time requirement was developed in the era of piston engine powered airplanes. Engine failures on these airplanes were common, and multiple engines occasionally failed during the same flight on the four-engine airplanes typical of this era. The regulators of the time created the 60-minute maximum diversion distance requirement to limit the risk of losing the remaining engine following failure of the first.

The reliability of jet engines was a great improvement over that of piston engines right from the beginning of the jet age in the late 1950s and 1960s. The low performance of early turbine jet engines required the use of more than two engines in order to provide the thrust necessary for the size airplanes conducting operations on routes where twins would be limited by the 60-minute rule. However, as the performance of jets and later turbofan engines improved, airplane manufacturers were able to achieve the performance and range with two engines that previously required more than two engines with earlier generations of turbine engines. With the development of long-range two-engine powered airplanes such as the Boeing 767 and Airbus A310, industry began looking at ways to fully utilize the range capability that these airplanes offered. The 60-minute twin operating limit created a restriction on the utility of this new generation of airplanes because it limited available route opportunities for airlines and forced them to fly longer, more circuitous routes than three and four-engine airplanes they would be competing with.

In the 1980s, in response to industry requests to re-examine at the 60-minute twin operating requirement in light of the much higher turbine engine reliability, the FAA developed non-regulatory standards to allow authorizations to exceed the 60-minute diversion time limit under provisions of the existing rule for such deviations. Operations conducted under such authorizations became known as extended range operations with two-engine airplanes, or ETOPS. The original 60-minute twin operating limit grew in incremental steps from 120 minutes to 180 minutes, then to 207 minutes and higher. These ETOPS extensions in the operating limit allowed for greater route planning flexibility because enroute alternates are not always available at shorter diversion times.

The safety standards used to evaluate and approve airplanes for ETOPS have been predicated on meeting two fundamental objectives:

• Minimize causes of engine in-flight shutdowns and other sources of design related airplane diversions; and
• Protect the safety of diversions when they become necessary.

 

 

The first ETOPS flights under these safety standards began in 1985. Because the 60-minute twin operational limit originated from concerns about engine reliability on two-engine airplanes, the main focus of the regulators early on was on improving propulsion system reliability. The emphasis for ETOPS type design approval was on reducing causes of engine in-flight shutdowns. However, overall propulsion system reliability of the airplanes approved for ETOPS, as measured by engine in-flight shutdown rate, did not improve as expected during the first few years after ETOPS flights began. In response, the FAA defined a benchmark propulsion system reliability standard, based on a widely used in-service engine with the lowest in-flight shutdown rate. This benchmark engine in-flight shutdown rate, .02 per thousand engine hours, based on a twelve-month rolling average, became the target for obtaining 180-minute ETOPS approval, and also created a strong incentive for both manufacturers and operators to more actively reduce the cause of in-flight shutdowns. Since the introduction of this propulsion system reliability standard, engine in-flight shutdown rates have reduced up to 10 times or more from that achieved before ETOPS began.

As propulsion system reliability improved, the FAA turned its attention to other airplane systems that are important to the safety of ETOPS in meeting the two ETOPS safety objectives; 1) preclude the need to conduct a diversion, and 2) protect the diversion when it becomes necessary. These include the airplane fuel system, the electrical power generation system, the airframe ice protection system, communication and navigation systems, cabin pressurization system, and environmental control system. The propulsion system and these other airplane systems important to ETOPS safety are called ETOPS Significant Systems. Propulsion system reliability on ETOPS airplanes has improved to a point where the probability of the loss of both engines on a two-engine airplane from independent causes is now considered to be an extremely improbable occurrence.

Having achieved a high-level propulsion system reliability, the remaining risks to ETOPS safety now come from three main areas:

1. Fuel Loss: This involves a single failure, such as occurred on the Air Transat flight that resulted in massive or total fuel exhaustion.
2. Common Cause Failures: This involves a failure condition that affects more than one engine or ETOPS significant system. An example would be a maintenance error performed concurrently on both engines of a twin engine ETOPS airplane.
3. Cascading Failures: This involves an initial failure followed by a subsequent failure that would not have otherwise occurred. An example is an engine failure followed by increased electrical or mechanical loading of the remaining engine, and its subsequent failure due to its higher loading.

According to the accident report, Air Transat was authorized for ETOPS with A330 aircraft on routes that did not contain points that were farther than 150 minutes from an adequate airport, at an A330 engine-inoperative diversion speed of 427 knots true air speed. Although Air Transat's operations specifications authorized flights up to a maximum of 150 minutes, the route from Toronto to Lisbon would have only required a 120-minute maximum diversion time.

The route of Air Transat Flight TSC236 from Toronto to Lisbon, only the middle of the flight over the central North Atlantic Ocean was farther than 60 minutes from either St. John's, Newfoundland or Lajes Airport on Terceira Island in the Azores. 

 

 

As the flight progressed, the distance to the nearest planned diversion airport varied continuously along its route flying closer until reaching its closest point to the diversion airport and then flying farther away. These planned diversion airports on an ETOPS route are called ETOPS alternates. At some point, the distance to the next ETOPS alternate is the same as the distance to the previous one. This is called an equal-time point. After the equal-time point, the next ETOPS alternate became the nearest diversion airport. The first point in the flight that is more than 60 minutes from the nearest diversion airport at the approved airplane speed with one engine in-operative in still air with no wind is called the ETOPS entry point.

The orange circles in the Area of Operations diagram represent the distance the airplane could fly at the approved one-engine inoperative cruise speed of 427 knots in 60 minutes, or 427 nautical miles. The green circles represent the distance the airplane could fly under the same conditions in 120 minutes. The lightly shaded blue area depicts the ETOPS portion of the flight.

Although most of the events surrounding this accident occurred after the Air Transat flight exited the ETOPS portion of the flight, the risks associated with such a fuel leak are progressively greater as the distance from the nearest diversion airport becomes longer. This higher level of risk during the ETOPS portion of a flight makes quick identification and corrective action to stop a large fuel leak much more critical. The ETOPS safety regulations put in place after this accident are intended to identify such a fuel leak while there is time to take corrective action to stop the leak and safely divert to the nearest airport. Click on the link below to view an animation of the accident flight as it progressed along this route, and to view how the flight may have ended had this airplane had the low fuel alert which was developed, and issued, predominantly as a result of this accident.

View AirTransat A330 ETOPS Flight Path Animation below:

 

 

Electronic Centralized Aircraft Monitoring (ECAM) System

The A330 is equipped with an Electronic Centralized Aircraft Monitoring (ECAM) system that monitors aircraft systems. If something abnormal is detected, the ECAM alerts the pilots and, for most abnormal conditions, provides a procedure to help handle the abnormality. The ECAM is made up of two displays: the Engine Warning Display (E/WD), and the System Display (SD). These ECAM displays provide normal and abnormal system information to the pilots.

The E/WD is divided into two main parts. The upper area is used for the main engine parameters, Fuel On Board (FOB), fuel flow and Slat/Flap position. Under normal conditions, the lower part of the E/WD is used to display MEMO's. If failures occur, Warning/Caution alerts are displayed in place of the memos, and the required crew action items (procedure) for the abnormal situation are depicted in blue below the associated alert.

 

 

The System Display is used to display particular system information. Normally, the CRUISE page is displayed for the majority of the time that the aircraft is airborne; the Fuel On Board (FOB) quantity is displayed on the upper ECAM page. The SD can also be used to display synoptic diagrams of the aircraft systems, either manually selected by the crew, or automatically displayed for the ECAM system when a system anomaly is detected. The SD displays other permanent flight data such as gross weight and CG.

 

 

Under normal conditions, the ECAM system provides the pilots with the information that they "Need to Know" for the particular phase of flight. For example, if a system parameter drifts out of normal range, the ECAM system generates a white ADVISORY (ADV) on the memo portion of the E/WD, and will advise the crew of this condition by automatically displaying the relevant system page on the SD. The affected parameter on the SD will pulse in green, because it is approaching, but still within limits. If, at the time that the ADV is generated, another system page is already manually selected and displayed on the SD, the relevant systems page called by the advisory is not displayed; however, a pulsing white ADV notice is displayed in the Memo area of the E/WD. Although immediate pilot action may not be required by all ADVISORY messages, crew monitoring of the system is required.

When a failure occurs, leading to a loss of redundancy or loss of a system that does not affect the safety of the flight, the ECAM system informs the crew by displaying an amber failure message on the E/WD, and displays the relevant system page on the SD. The affected parameter on the SD will be displayed in amber. A related FAULT light may be illuminated as well.

The accident investigators stated that a fuel leak is an abnormal condition that was not monitored by the ECAM system; consequently, an ECAM warning was not generated for these conditions. Instead, the A330 design philosophy expected that the flight crew's normal monitoring of the fuel system parameters would result in timely recognition that a fuel leak existed, or a loss is taking place. Once the crew recognized that a fuel leak existed, the fuel leak operational procedure was intended to mitigate the consequences of a fuel leak. In their analysis of the Air Transat accident, the accident investigators pointed out that during training and actual operations, flight crews were taught to trust the ECAM to provide the information needed for significant, abnormal or emergency situations. They were concerned that for this occurrence, the only alerting provided to the crew was a low level advisory ECAM message, which did not convey the seriousness of the high-risk situation they were facing. The accident investigators also referred to a related occurrence on an Airbus A320 airplane that occurred in 1997 where, combined with this event, even qualified and trained crews can misidentify a fuel leak. Their conclusion was that clear unambiguous alerting to the crew, and guidance as to the handing of a fuel leak, is necessary to mitigate this risk.

Center of Gravity Management (Stabilizer Trim Tank) 

A trim tank (fuel tank) is located in the Trimmable Horizontal Stabilizer (THS). The stabilizer trim tank transfer system is a fully automatic system that controls the center of gravity of the aircraft. When the aircraft is in cruise, the primary Fuel Control and Management Computer (FCMC) calculates the CG and compares the result to a target value that depends on the aircraft actual weight. From this calculation, the FCMC optimizes the CG by deciding to transfer fuel to or from the trim tank. There is normally only one aft transfer at the beginning of the flight. During the flight, there is a series of small forward transfers. If the actual CG is different from the target CG by more than 0.5% and the aircraft is above 25,500 feet, an appropriate transfer occurs. If an inner tank quantity drops below 4,000 kg, forward transfer also occurs to maintain the fuel in the inner tanks between 4,000 kg and 5,000 kg until the trim tank is empty. If during a forward transfer, the inner tanks are out of balance by more than 500 kg, the transfer is automatically stopped on the heaviest side until the fuel balance is achieved. A final forward transfer occurs when the time to destination is less than 35 minutes, when either set of wing tanks is below 4,000 kg, or when the aircraft descends through 24,500 feet. When fuel is being transferred, a "TRIM TANK XFR" message appears on the ECAM Memo screen; when the trim tank is empty, a "TRIM TANK XFRD" message appears on the ECAM Memo portion of the E/WD screen.

During the accident flight, the automatic forward transfer of fuel occurred significantly before it normally would have, due to the fuel loss in the right inner main fuel tank. Additionally, the system transferred more fuel to the lower right tank in order to balance the fuel quantity between the left and right inner main tanks. The table lists the sequence of stabilizer trim tank forward fuel transfers after the start of the fuel leak at 04:38 UTC. Click on this link to view an animation of the stabilizer trim tank operation.

View AirTransat Fuel Transfer Animation below.

 

 

 

 

 

 

 

Table showing the trim tank forward fuel transfers during the accident flight

Time	Left tank	Trim tank	Right tank	Total FOB	Events
04:38	10,100	3,500	10,100	23,700	Start of fuel leak
04:57	9,264	3,200	8,936	21,400	Fifth forward transfer start
05:11:30	8,750	3,135	6,750	18,600	Final forward transfer start
05:31:00	8,000	0.0	5,000	13,000	Forward transfer complete
05:36:30	7,750	0.0	3,650	11,400	Crossfeed open

The accident investigators determined that this automatic trim tank transfer and fuel balancing delayed generation of an ECAM advisory fuel imbalance message about 25 minutes and contributed to an unnoticed loss of 3,500 kg (7,718 lbs.) of fuel.

Aircraft Operational Factors

Standard Fuel Quantity Checks

The Air Transat Flight TSC236 flight crew was following A330 Flight Crew Operating Manual (FCOM) Standard Operating Procedures (SOPs) for checking fuel quantity and airplane systems status during the flight. These checks are carried out at each flight plan waypoint along the route. The SOPs indicate that when overflying a waypoint, the following should be checked:

• Track and distance to the next waypoint.
• Fuel on board and fuel prediction with flight planned fuel.
• Sum of fuel on board and fuel used consistency with the fuel on board at departure.

These SOP checkpoints on the accident flight were scheduled at various defined geographic points along the route, including the points in the route where the airplane crossed each 10 degrees of longitude. Thus, there were planned checks at 50 degrees West longitude, 40 degrees West, and 30 degrees West during the accident flight. The flight diverted just short of what would have been the 20-degree West checkpoint.

The time between the 50°W and 40°W SOP checks was 46 minutes. The time between the 40°W and 30°W checks was 49 minutes. At the time of the 30°W SOP check, the total fuel quantity onboard the airplane was within 1% of the planned fuel quantity. The crew initiated the diversion to Lajes 48 minutes after the 30°W check just before reaching 20°W longitude where the next planned SOP check would have occurred.

 

Unusual Engine Parameters

The flight crew's attention was diverted away from monitoring other aircraft systems and delayed awareness of their low fuel state by oil system parameter differences between the left and right engines.

Oil system parameter differences between the left and right engines

Oil Parameter	Left Engine	Right Engine (with fuel leak)
Quantity	18.2 liters	14.5 liters
Temperature	110° C	65°C
Pressure	80 psi	150 psi

These unusual engine oil readings were caused by the high fuel-flow rate through the right engine fuel/oil heat exchanger caused by the fuel leak downstream of this component. The high fuel flow rate would have had the following effects on these engine oil system parameters compared to the left engine:

• Lower Oil Quantity:  Lower volume due to colder oil temperature
• Lower Oil temperature:  More heat carried away by the higher rate of fuel flow
• Higher Oil pressure:  Higher oil viscosity due to colder temperature

The flight crew did not recognize that a potential reason for the oil system readings they were observing could have been the result of a fuel leak.

Initial Recognition of Fuel Loss

The fuel leak started at 04:38 UTC, but the flight crew did not notice a fuel problem until 05:33, when the fuel imbalance advisory message was generated. During this period, several flight deck indications were evidence of the fuel loss.

• The fuel on board (FOB) was decreasing at an unusual rate; this information would have been displayed in the FOB figures on the upper ECAM E/WD display.
• The estimated fuel on board at destination (EFOB) was decreasing; this information was a function calculated by the Flight Management Computer and would have been displayed on the Multi-purpose Control and Display Unit (MCDU) located on the center console between the pilots.
• The full forward transfer of the fuel in the trim tank was premature given the fuel load on departure. A prolonged, 19-minute TRIM TANK XFR memo between 05:11 and 05:30 UTC, and then the TRIM TANK XFRD memo between 05:30 and 05:33 were flight deck indications of this transfer.

According to the crew, the following factors were taken into account to ascertain the problem of the unexplained low fuel quantity:

• Engine indications were reviewed to determine a source of the problem.  No abnormal indication was found.  Fuel-flow parameters and other engine indications were normal. – Note: The fuel flow indication was normal because the fuel leak was upstream of the fuel flow meter.
• There had been no other in-flight events or conditions that led them to the fuel loss.
• The cabin crew were asked to visually check outside the aircraft in the vicinity of the wings and engine for signs of a fuel leak, and none were observed due to darkness that prevailed during this time.
• From the time when the fuel imbalance ADV first appeared, the fuel quantity indications and fuel predictions for destination consistently showed an unbelievable fuel loss rate.

The crew stated that because there were no other signs of a fuel loss, other than the lower-than-expected quantity of fuel on board, and because there had been no other ECAM warnings or cautions, both pilots believed that the problem was a computer fault.  They also stated that although they had used the term "fuel leak" on many occasions in their conversations during the occurrence, a logical link to considering the FUEL LEAK check and the possibility that the fuel leak existed did not occur to them until the indicated fuel quantity reached about 7,000 kg.

The accident investigators stated that the following factors probably contributed to this delayed recognition of the low fuel quantity problem:

• The only fuel check required by standard operation procedures during this timeframe was done at 04:58 as the aircraft crossed 30° West. At this time, the fuel quantity was unremarkable, because it was within 200 kg or 1% of the planned fuel quantity.
• The crew was then involved in position reporting, recording entries on the flight log, and checking of instrument indications.
• The unusual oil readings created a level of uncertainty in the flight crew.
• This uncertainty resulted in the crew becoming occupied in activities to resolve the ambiguities, including reviewing manuals and contacting the Air Transat Maintenance Control Center.
• The final forward transfer of the 3,200 kg of fuel from the trim tank into the right-wing tank delayed the generation of the fuel ECAM advisory message by approximately 15 minutes.

Although the TRIM TANK XFR memo was premature given the stage of flight, the initial appearance of the memo would have been unremarkable, because it comes on routinely during flights.  Also, given the crew was preoccupied with resolving the unusual oil readings, the accident investigators concluded that it is understandable why, during this time frame, the crew did not recognize the prolonged nature of the TRIM TANK XFR memo, the presence of the TRIM TANK XFRD memo, and the subtle changing of the FOB and EFOB figures.

From 04:38, the time that the fuel leak started, until 05:04, the time when the unusual oil indications were recognized, flight deck activity level was normal. However, resolving the unusual oil indications raised the activity level and drew the crew’s attention away from their routine monitoring of the other displays.

All of the fuel-related information and messages were provided in the form of text-type status messages and digital counter displays, none of which conveyed a sense of urgency that would cause the crew to abandon activities associated with resolving the oil reading anomalies, and none of which conveyed the critical nature of the fuel leak.

During this time, the automated trim tank transfer system caused the fuel to be loaded into the right wing to balance the fuel quantity of the left and right main tanks, delaying the generation of the fuel advisory message, masking the fuel leak problem from the crew. By the time the fuel imbalance advisory was generated at 05:33, fuel on board had reduced to 12,200 kg and 6,650 kg of fuel had been lost.

Feeding the Leak (Fuel Imbalance Procedure)

A fuel imbalance flight deck indication serves a dual purpose. In the vast majority of cases, it informs the crew of a difference in fuel consumption between the engines, and the crew follows the fuel balance checklist to balance the fuel quantity.  The fuel imbalance advisory is also a primary indicator of a fuel leak.  However, a fuel leak is a rare occurrence and without further investigation, a flight crew initially has no way of knowing whether the imbalance is due to differences in engine fuel consumption they have encountered numerous times, or from a fuel leak, which they have rarely encountered, if ever.  In the case of the Air Transat A330, the following factors would have confirmed the crew’s perception that a fuel imbalance was a low-risk situation:

• The condition was announced by a low-level advisory message and not caution or warning alert.
• The Caution note in the FUEL IMBALANCE checklist, that the checklist should not be used if a fuel leak is suspected, was not prominent.
• The conditions that should be used to assess if a fuel leak exists were not located on the FUEL IMBALANCE checklist.  They were in the FUEL LEAK checklist, which would not be consulted unless a fuel leak was already suspected.
• The exposure of A330 crews to fuel imbalance was mostly limited to situations that only required a monitoring of fuel balance, and not to situations that required an active response to a FUEL IMBALANCE advisory.  This was because the magnitude of fuel imbalance (3,000 kg) that triggered the message made that an uncommon occurrence.

The Air Transat crew reacted to the fuel imbalance advisory message by completing the FUEL IMBALANCE procedure from memory.  They did not consider the caution note instructing them to refer to the FUEL LEAK procedure prior to balancing fuel.  They also started the fuel balancing before looking at the Fuel page on the ECAM Systems Display where they discovered that total fuel on board was significantly below planned quantity.  This resulted in feeding the fuel leak in the right engine from fuel in the left-wing tank, which otherwise would have been isolated from the leak by the crossfeed valve.

Fuel Leak Warning and Procedures

Although the fuel leak started at 04:38, the crew did not recognize the higher-than-normal rate of fuel quantity reduction until after they selected the Fuel page on the ECAM Systems Display at 05:34 in response to the fuel imbalance advisory message.  By the time that the crew took their initial actions in response to the situation at 05:36, more than 7,000 kg of fuel had already been lost. The crew perceived the suddenness and the magnitude of the indicated fuel loss as not being believable and not linked to any explainable reason.  They did not finally recognize they had a real fuel leak until 05:53

As demonstrated in this accident and other earlier fuel leak occurrences investigated by the accident investigators, the report states that flight crews have difficulty in assessing the seriousness of fuel leak situations due to the following:

• Lack of operational exposure to similar events that would confirm indications of a significant fuel loss.
• The absence of physical evidence of fuel leaking from the aircraft by visual inspection of the engine nacelles, or of abnormally high fuel flow indications.
• The lack of a direct system warning to alert the crew to the precise critical condition.
• The appearance of another system indication that diverts the crew’s attention to another more-easily understood situation of lower criticality.
• The lack of training covering conditions likely to cause fuel leaks and the procedures to be followed if a fuel leak is experienced.

At the time the crew initiated the diversion to Lajes at 05:45, they considered doing the fuel leak procedure, but they were still uncertain as to the validity of the fuel quantity indications and the precise nature of the problem.  The crew further discounted doing the LEAK NOT FROM ENGINE or the LEAK NOT LOCATED procedure because doing so would require a descent to a lower altitude and would further degrade an already critical situation.  The accident investigators concluded that had the Air Transat crew taken the actions required by the FUEL LEAK checklist when the fuel loss was first recognized at 05:53, the aircraft would not have run out of fuel before reaching Lajes.

The investigation into an Air France A320 fuel leak occurrence on August 24, 1997, resulted in a September 6, 1997, BEA recommendation to the French airworthiness authority to re-examine the adequacy of aircraft systems and procedures associated with fuel leaks.  They also recommended an interim measure to notify all crews of the circumstances of the 1997 A320 fuel leak occurrence. In response to this recommendation, Airbus improved the A330 FUEL LEAK checklist, developed a FUEL IMBALANCE checklist, and notified the pilots.  At the time of the Air Transat A330 accident, Airbus had not incorporated a leak-warning system in any A330 aircraft.  Additionally, fuel leak training had not been incorporated into the Airbus A330 training program.

Automated Trim Tank Fuel Transfer

Although two green TRIM TANK XFR ECAM advisory messages would have been displayed in the memo section of the E/WD during the flight, these two memos would have been unremarkable, first because this type of message came on routinely during flights, and second because the message was a status type text message that neither conveyed urgency nor required immediate action.  In addition, the subtle addition of one text letter "D" from the TRIM TANK XFR to the TRIM TANK XFRD message is not a high salience change and did not draw this crew's attention to the end of the fuel transfer.

Even the last TRIM TANK XFR message that lasted 19 minutes and the TRIM TANK XFRD message for the remainder of the flight did not alert the crew to an urgent situation, in part because they were occupied in higher priority cockpit tasks such as completing flight documentation, communicating, analyzing the unusual engine oil parameter anomalies, and then attempting to resolve the fuel imbalance and ambiguity of the fuel quantity.

Of importance is that the forward transfer caused the fuel in the trim tank to be loaded into the right wing, feeding the leak in the right engine and masking the fuel leak problem from the crew.  This masking contributed to an unnoticed loss of 3,500 kg of fuel.

Flight Crew Uncertainty about Fuel Quantity

When the ECAM advisory message alerted the crew to the fuel imbalance, there was a large difference between the actual fuel system state and the crew’s understanding of it.  Although there were other indications that the situation was more serious than a fuel imbalance, the crew initially reacted by doing the FUEL IMBALANCE procedure because that was the only anomaly exposed by the ECAM system. The crew followed the procedure from memory because the need to balance fuel due to normal differences in left and right engine fuel consumption is a fairly common occurrence on long-range flights.

Neither of the crewmembers had ever experienced a fuel imbalance of any magnitude during flying operations, nor been exposed to a fuel leak before during training or operations.

Once the EFOB at destination reduced below minimums, the Captain made an appropriate decision to divert to the ETOPS alternate of Lajes.  However, because the crew took no action to stop the fuel leak, the rate of fuel loss at that time was so great that it was not possible to safely complete the diversion.

Summary

The investigators concluded that the crew was presented with an advisory message that did not require immediate action. The Flight Crew Operating Manual (FCOM) required the crew to refer to the Quick Reference Handbook (QRH) procedures before taking action.  A caution note in the QRH FUEL IMBALANCE checklist procedure informs the crew to not apply this procedure if a fuel leak is suspected and to perform the FUEL LEAK procedure instead.  Crew Resource Management (CRM) principles suggest that, before taking action in response to the fuel imbalance advisory message, the crew should have taken into account all available information about the fuel system.  Such a review would have revealed that over 6,000 kg of fuel had been lost. The combination of the fuel-loss indications and the substance of the caution note in the FUEL IMBALANCE procedure should have led the crew to the FUEL LEAK procedure. The FUEL LEAK, LEAK FROM ENGINE procedure requires that the leaking engine be shut down; the FUEL LEAK NOT FROM ENGINE OR LEAK NOT LOCATED requires that the crossfeed must remain closed. Either of these actions would have conserved the fuel in the left-wing tanks and allowed for a landing at Lajes with the left engine operating.  Opening the crossfeed valve put the fuel in the left tank at risk and made a serious fuel-leak situation even worse.

Further, the investigators believed that the lack of a clear unambiguous low fuel alert contributed to the flight crew's delayed awareness to a serious fuel loss, as did an automatic stabilizer trim tank transfer system that transferred more fuel to the tank with less fuel to balance fuel quantity, thus delaying the fuel imbalance advisory message.  These factors shortened the amount of time available for the crew to take mitigating action before the fuel loss became critical.  The rate of fuel consumption from both engines prior to the start of the fuel leak was approximately 5300 kg per hour.  At the peak of the fuel leak, the leak rate was 13,800 kg per hour, or 2.6 times normal engine fuel consumption. For a high-rate fuel loss such as occurred during the Air Transat flight, early awareness of the fuel loss is critical to having enough time for appropriate mitigating action to preserve sufficient fuel for a safe diversion.

 

Back to top

The final accident report issued by the Portuguese accident investigation authority did not identify a specific probable cause of the Air Transat Flight TSC236 accident. It did identify 12 findings as to causes and contributing factors, 18 findings as to risk, and 7 other findings. A summary of the significant findings from each category follows:

Findings as to Causes and Contributing Factors

Cause of the Fuel Leak

• The replacement engine was received in an unexpected pre-service bulletin configuration to which the operator had not previously been exposed.
• Neither the engine-receipt nor the engine-change planning process identified the differences in configuration between the engine being removed and the engine being installed.
• The lead technician relied on verbal advice during the engine change procedure rather than acquiring the relevant service bulletin, which was necessary to properly complete the installation.
• Although a clearance between the fuel tube and hydraulic tube was achieved during installation by applying some force, the pressurization of the hydraulic line during operation forced the hydraulic tube back to its natural position and eliminated the clearance.

Detecting the Fuel Leak

• The flight crew did not detect that a fuel problem existed until the fuel imbalance advisory message was displayed and the fuel imbalance was noted on the Fuel ECAM page.
• The crew did not correctly evaluate the situation before taking action.
• The flight crew carried out the fuel imbalance procedure from memory, which resulted in fuel from the left tanks being fed to the leak in the right engine.
• Conducting the fuel imbalance procedure by memory resulted in the crew not seeing the Caution note in the fuel imbalance checklist that may have led them to considering the fuel leak procedure in a timely manner.
• Although there were a number of other indications that a significant fuel loss was occurring, the crew did not conclude that a fuel leak situation existed. Not conducting the fuel leak procedure was the key factor that led to the fuel exhaustion.

Findings as to Risk

Engine Change

• The carry forward items list that accompanied the replacement engine listed a post modification hydraulic pump model, whereas the pre-mod fuel and hydraulic tubes installed on the engine required a pre-mod hydraulic pump.
• The post-installation quality control checks following the engine change did not specifically require checking the installation of the hydraulic pump, hydraulic tube and the fuel tube.
• In the absence of a requirement to conduct a pre-installation, service bulletin completion check, there is a risk that incompatible components may be installed on aircraft and not be detected by existing maintenance planning processes.

Fuel Leak Indications

• The final forward transfer of the 3,200 kg of fuel in the trim tank resulted in this fuel feeding the leak in the right engine and delaying the annunciation of the fuel imbalance advisory message by 15 minutes.
• There was not a clear, unambiguous indication or warning that a critical fuel leak existed.
• The seriousness of a fuel imbalance caused by a fuel leak is undermined by the fact that such a situation only results in an advisory message, which does not require immediate flight crew action.

Operational Factors

• The flight crew had never experienced a fuel leak during operations or training, which contributed to their not being able to conclude that a fuel leak existed.
• The lack of training in the flight deck indications associated with a fuel leak resulted in this crew not being adequately prepared for the situation when encountered on the occurrence flight.
• The Captain's skill in conducting the engines-out glide to a successful landing averted a catastrophic accident and saved the lives of the passengers and crew.

Other Findings

• The unusual oil parameters on the right engine were the result of the high fuel-flow rate through the fuel/oil heat exchanger after the leak commenced.
• The risk associated with the application of force while installing mixed-construction lines is not well known in the maintenance community and is not covered in the training of maintenance technicians.

The complete list of the accident report findings may be read by clicking on the following link: Accident Report Findings

The complete accident report may be read by clicking on the following link: Air Transat A330 Final Report

 

Back to top

The accident report contained 12 safety recommendations in the following areas:

Fuel Leak Detection and Warning

• Mandate a Fuel Used/Fuel Onboard discrepancy Caution alert for all A330 aircraft, and
• Mandate the incorporation of a fuel loss alert for other Airbus aircraft with similar fuel system design
• Review adequacy of aircraft indication and warning systems and procedures to

1. Detect fuel-used/fuel-loss discrepancy situations
2. Provide clear indications as to the causes of these situations
3. Provide alerts commensurate with the criticality of a fuel loss situation

Fuel Leak Training

• Review flight crew operating manuals and checklist procedures for fuel leaks
• Review flight crew training programs for diagnosing and correcting fuel leaks
• Amend regulations to require crew training on fuel leaks

Automated Fuel Transfers

• Ensure systems are able to detect abnormal fuel transfers

Significant Fuel Imbalances

• Review adequacy of aircraft indication and warning systems, and abnormal procedures to ensure fuel leak is considered in situations of significant fuel imbalances

Safeguarding Recorders

• Review adequacy of regulations, standards, and aircraft manuals for safeguarding cockpit voice recordings following an occurrence

Recorder Power Sources

• Airworthiness agencies to consider independent power supplies for voice and data recorders

Major Component Change Planning

• Ensure adequate maintenance processes exist to detect major aircraft configuration differences
• Review adequacy of standards for identifying the configuration and modification status of major components of similar part numbers to ensure that differences can be easily identified.

The complete details of the accident report safety recommendations may be read by clicking on the following link: Accident Report Safety Recommendations

 

Back to top

The Direction Generale de l'Aviation Civile (DGAC) of France originally type certificated the Airbus Model A330-200 series airplanes under its type certificate number DGAC-F TC 184. The FAA validated this product under U.S. Type Certificate Number A46NM. Effective September 28, 2003, the European Aviation Safety Agency (EASA) began oversight of this product on behalf of DGAC. The Airbus Model A330-243 involved in the Air Transat accident was certified by the DGAC on January 11, 1999.

The relevant regulations applied to the A330 fuel system and flight deck displays for the European type certificate were contained in Joint Aviation Regulations (JAR) 25 through Change 12. In addition, the Joint Aviation Authorities (JAA) issued special condition P-2 for the trim fuel tank.

The JAA stabilizer trim tank special condition addressed issues that were not particularly pertinent to the Air Transat fuel exhaustion accident, such as bird strike damage, damage to the fuel transfer line in the pressurized compartment, unusable fuel, and fuel gravity transfer with loss of normal electrical power. Paragraph 7 of the special condition required the airplane to be fitted with an independent aft CG position warning which provides the flight crew with visual and aural warning whenever CG position exceeds aft certified limits. It also defined system requirements for nuisance warnings in the normal flight envelope and CG safety margins within the operating limits. Since the stabilizer trim tank CG control system worked normally during the accident flight, this aft CG warning was not a factor. Paragraph 11 of the special condition required instructions in the airplane flight manual for proper use of the stabilizer trim tank transfer system and procedures to be applied in case of system failures. 

The following regulations applied to the display of warning, caution, and advisory information.

JAR 25.1305(a)(2)

The following are required powerplant instruments:

(a) for all airplanes.

(2) A fuel quantity indicator for each tank.

JAR 25.1309(c):

Warning information must be provided to alert the crew to unsafe system operating conditions, and to enable them to take appropriate corrective action. Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors which could create additional hazards.

JAR 25.1322 Warning, caution, and advisory lights:

If warning, caution, or advisory lights are installed in the cockpit, they must, unless otherwise approved by the Authority, be -

(a) Red, for warning lights (lights indicated a hazard which may require immediate corrective action);

(b) Amber for caution lights (lights indicating the possible need for future corrective action);

(c) Green, for safe operation lights; and

(d) Any other color, including white, for lights not described in sub-paragraphs (a) to (c) of this paragraph, provided the color differs sufficiently from the colors prescribed in subparagraphs (a) to (c) of this paragraph to avoid possible confusion.

These regulations assume that the means for providing the warning information required by JAR 25.1309(c) will be "lights". As such, the requirements of JAR 25.1322 do not fit an airplane such as the A330, for which this information is provided by an integrated display system (ECAM). The JAA and FAA used the guidance and methods of compliance contained in FAA Advisory Circular 25-11 "Transport Category Airplane Electronic Display Systems" to certify the A330 ECAM system.

 

Back to top

Maintenance supervisors at Air Transat did not review service bulletins having an optional or recommended compliance. Such service bulletins were reviewed by Air Transat Engineering. The result was that while maintenance crews may have been aware of specific service bulletins, they were not part of the decision for incorporation of those service bulletins. Neither the hydraulic pump installation nor the engine build-up service bulletins were reviewed by Engineering because all of Air Transat's A330 airplanes had been delivered with the post-mod configuration. The airline did not consider the possibility of a replacement engine might be installed on one of those airplanes that had not yet been modified. As such, they did not have a process for reviewing and tracking the incorporation status of relevant service bulletins on their airplanes for non-mandatory service bulletins.

Although electronic copies of these service bulletins were available from other sources at the facility where the engine change occurred, the lead maintenance technician was not aware of these other sources. The Maintenance Control Center technician, who was aware of the other sources, did not tell him. The Maintenance Control Center technician's role was to locate resources for the maintenance technicians, and not to provide technical assistance in searching for technical references. Also, even though a Rolls-Royce company representative very familiar with the hydraulic pump modification offered his assistance to the Maintenance Control Center technician to attend the on-site engine change, his offer was not taken. Although both the Maintenance Control Center technician and the lead maintenance technician were concerned about the inability to access the service bulletins from the company computer network, the time pressure to complete the engine change seemed to play a role in moving ahead without copies of these service bulletins. The Maintenance Control Center technician did have knowledge of the engine build-up service bulletin and the background behind it, and this knowledge gave comfort to the lead maintenance technician in the decision to go forward without consulting the service bulletin.

Making a decision on a modification that affects the safety of an airplane based on only partial knowledge of the modification requirements with no process within the airline to review and track such non-mandatory modifications contributed to the interference between the fuel and hydraulic lines that led to the right engine fuel leak.

 

Back to top

Fuel Leak

• An undetected, high rate, fuel leak.
• Flight crews performing procedures from memory rather than following checklist

Automation

• Highly automated airplane systems (ECAM, fuel transfer) that contributed to the delay in the crew recognizing the fuel leak.

Standard Operating Procedure Checks 

• Standard Operating Procedural checks involving comparison of onboard fuel to predicted fuel at specified route waypoints were unable to detect large volume fuel leaks

Configuration Control

• Configuration control of components prior to their installation for compatibility with the service bulletin configuration of the aircraft
• Not properly completing and validating incorporation of non-mandatory service bulletins

 

Back to top

Fuel Leak Detection

• Standard operating procedure (SOP) fuel quantity checks will detect fuel loss before it becomes critical. At the time of the 30°W SOP check, the total fuel quantity onboard the airplane was within 1% of the planned fuel quantity at point in the flight.

Automation

• The stabilizer trim tank transfer system automatic center of gravity control would not create an unsafe operating condition. It was not envisioned that a fuel leak would result in automatically transferring more fuel to the tank with the fuel leak to balance fuel and thus, delaying flight crew awareness of the fuel leak.

Configuration Control

• The compatibility of components would be achieved by application of installation service bulletins. The configuration of the engines installed on the Air Transat A330 was a later configuration and had previously incorporated hydraulic pump modifications. The loaned engine, however, had been supplied with an earlier version of the hydraulic pump installation that was not compatible with existing airplane hydraulic lines, leading to interference with adjacent fuel lines, and fuel line cracking, resulting in the fuel leak.

 

Back to top

Air France A320 Fuel Leak Occurrence

On August 24, 1997, an Air France A320, F-GHQH, was on a passenger flight from Orly, France, to Lorient, France. The aircraft took off from Orly with 8,500 kg of fuel onboard, which was 2,100 kg over the fuel load required for the trip. As the aircraft approached the planned cruising altitude, the crew received a fuel advisory message indicating that there was a 1,500 kg fuel imbalance between the left and right wings distributed as follows:

Outer Tank Left	Inner Tank Left	Inner Tank Right	Outer Tank Right	TOTAL
680 kg	1420 kg	3030 kg	690 kg	5820 kg

The Quick Reference Handbook (QRH) procedure for fuel imbalance called for opening the fuel crossfeed valve to balance the fuel quantity. Specifically, the crew opened the crossfeed valve and selected the left-wing tank fuel boost pumps OFF. The crew also noted that the fuel-on-board was significantly less than expected. The crew considered the following reasons for the lower-than-expected fuel quantity:

• An anomaly at the re-fueling coupling resulting in a fuel loading error.
• A possible erroneous fuel indication, (the crew was aware of a number of such previous incidents).
• Incorrect fuel load; or
• A fuel leak.

The Captain asked a deadheading company pilot, who was previously qualified on the A-320, to examine the wings for signs of a fuel leak. Because it was nighttime, the inspection was done with the cabin lights turned off and with the aid of a flashlight. This pilot saw no signs of a fuel leak.

After fuel balancing, the left-wing tank fuel boost pumps were selected ON and the crossfeed valve was selected to OFF. A descent was initiated, and the fuel load was as follows: 

Outer Tank Left	Inner Tank Left	Inner Tank Right	Outer Tank Right	TOTAL
0 kg	1160 kg	1120 kg	0 kg	2280 kg

There was subsequent fuel warning of L WING TK LO LVL. In accordance with the ECAM procedure, the crew initially opened the crossfeed valve. However, believing this action to be not appropriate for the situation, the crew turned the crossfeed valve OFF after about 90 seconds.

Four minutes later, the fuel load was, as follows:

Outer Tank Left	Inner Tank Left	Inner Tank Right	Outer Tank Right	TOTAL
0 kg	580 kg	1080 kg	0 kg	1660 kg

At 20:12 hours, the left engine flamed out, and at 20:19 hours the aircraft landed at its destination with approximately 900 kg of fuel on board.

Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA), the French accident investigation authority, conducted an investigation into this occurrence.

BEA’s preliminary analysis of this occurrence and two other serious, fuel-leak occurrences determined that the involved crews could not determine that there was a fuel leak in two of the occurrences, and on the third occurrence, the origin of the fuel loss. (The first occurred in 1995 involving an Airbus A310 aircraft.  The other occurred on an A340 aircraft and was reported to the Accidents Investigation Branch of the United Kingdom.)  Also, the existing checklists were inadequate to effectively determine that a leak existed, and without this precise identification, the existing procedures could lead to inappropriate actions.

Consequently, on September 8, 1997, the BEA recommended that:

A study be immediately conducted into procedures to address this type of event, and that, in the interim, all crews should be immediately informed of the circumstances of the three fuel leak incidents.

In the BEA final report issued in August 2002, BEA further recommended that this incident and other similar occurrences revealed the critical nature of fuel leaks and deficiencies related to the identification of such leaks.
Consequently, the BEA recommended that:

• DGAC ensure that basic training programs and recurrent training conducted on aircraft take into account the identification and interpretation of all indications of fuel-system failures, and the appropriate actions to be taken.
• Airline operators review their instructions and procedures relating to the fuel systems to ensure that they are adequate for fuel leak situations.
• Airbus studies a system that would alert crews, at an appropriate level, in terms of displays and warnings, of abnormal reduction in the quantity of fuel on board aircraft and define appropriate procedures for such situations.

In response to these recommendations, Airbus took the following actions:

• Airbus fleet abnormal procedures were amended to include a FUEL IMBALANCE checklist, including a Caution that the procedure should not be done if a fuel leak is suspected.
• A FUEL LEAK checklist was added to the Flight Crew Operating Manual (FCOM) Abnormal Procedures, including notes on how fuel leaks could be detected.
• The abnormal procedure for left- and right-wing tank low fuel level was amended to include a Caution that this procedure should not be used if a fuel leak is suspected.
• The Airbus fleet FCOM Standard Operating Procedures were amended to include in the FLIGHT PROGRESS CHECK a requirement to check that the sum of the fuel on board and fuel used is consistent with the fuel on board on departure.  Crews were directed to suspect a fuel leak if the sum is unusually smaller than the fuel on board.

Virgin Airways A340 Fuel Leak Occurrence

On 13 June 1997, a Virgin Airways A340 was on a flight from London to Tokyo. After 1 hour and twenty minutes of flight, the crew discovered a large difference in fuel quantity between the right and left wings. Over a 15-minute period, the crew monitored the situation and did a visual inspection. All engine parameters were reported to be normal. The crew concluded that a fuel leak existed based on the difference of fuel quantity between both wings and the fact that there was a disagreement between the fuel remaining on board and the fuel quantity expected based on the fuel used by the engines. The crew could not determine whether the leak was from the tank or an engine. The crew turned back toward London, and in accordance with the QRH procedures descended the aircraft to the gravity-feed altitude of 20 000 feet and all fuel boost pumps were turned off. On landing, a significant amount of fuel was observed on the runway. The total fuel lost during the flight was 20,000 kg. Post occurrence examination of the aircraft found a fuel leak on the fuel filter on one of the left engines. The flight crew performed the fuel leak procedure in accordance with the published QRH.

A United Kingdom Air Accidents Investigation Branch investigation into this occurrence was not conducted and a report was not published on this occurrence. Reportedly, the only safety deficiencies associated with this occurrence were related to a known technical fuel filter installation fault.

Other Fuel Leak Events

The Air Transat accident report stated that there had been at least 25 in-flight fuel-leak events since 1994. Although some of these events were minor in nature, a number were significant in that they led to a loss of fuel that resulted in a serious incident, such as an engine fire or a loss of fuel that resulted in a diversion or emergency situation.

Because the fuel leaks were clearly attributable to technical faults, few of the events were investigated and even fewer were analyzed to determine operational factors that may have increased the seriousness of the event.

Prior to the Air Transat A330 occurrence, there had not been another recorded occurrence that involved total fuel exhaustion due to a fuel leak, although there had been a number of cases of significant fuel loss, some of which would have been mitigated by following the manufacturer's recommended procedures.

 

Back to top

This accident underscored the risks associated with undetected fuel leaks to aircraft operating on long range overwater routes. At the time of the accident, rulemaking associated with safety standards for all extended operations, regardless of the number of engines installed, was already underway. As a result of this work, the low fuel alerting requirements for two, three, and four-engine aircraft were included into a new Appendix K to 14 CFR part 25, Extended Operations (ETOPS). Low fuel alerting requirements are contained in - Section K25.1.4(a)(3) of Appendix K to 14 CFR part 25, Amendment 120:

"An alert must be displayed to the flight crew when the quantity of fuel available to the engines falls below the level required to fly to the destination. The alert must be given when there is enough fuel remaining to safely complete a diversion. This alert must account for abnormal fuel management or transfer between tanks, and possible loss of fuel. This paragraph does not apply to airplanes with a required flight engineer."
The complete text of Appendix K to 14 CFR part 25 is available at the following link: Appendix K

EASA developed similar standards, which are contained in: EASA low fuel warning requirements - Section CS 25.1305(a)(2) of Certification Specifications CS-25, Amendment 12, for basic transport airplane type certification.

 

Back to top

The French airworthiness authority DGAC issued Airworthiness Directive 2002-548(B) on November 13, 2002, Fuel Leak Procedure, which is applicable to AIRBUS A-330 aircraft. The AD amends the A-330 FUEL LEAK procedure. This AD became effective on November 23, 2002.

The FAA issued AD 2006-02-01, effective February 3, 2006, requiring new airplane flight manual procedures to follow in the event of a fuel leak for Airbus Model A330 and A340 aircraft. The full text of AD 2006-02-01 may be read at the following link: AD 2006-02-01

The revised Fuel Imbalance and Fuel Leak procedures mandated by this AD may be read at the following link: A330 AFM Revised Procedures

 

Back to top

Airplane Life Cycle:

• Design / Manufacturing
• Operational
• Maintenance / Repair / Alteration

---

Accident Threat Categories:

• Crew Resource Management
• Flight Deck Layout / Avionics Confusion
• Fuel Exhaustion
• Lack of System Isolation / Segregation

---

Groupings:

• Automation

---

Accident Common Themes:

• Organizational Lapses
• Human Error
• Flawed Assumptions
• Pre-existing Failures
• Unintended Effects

 

Back to top

Organizational Lapses

Because of parts availability, the engine rework of a spare lease pool engine was not completed per the applicable engine service bulletin before the engine was sent to Air Transat by the engine shop. Air Transat did not have a process to ensure completion of the unfinished engine service bulletin before the engine was installed on the airplane. Mismatched fuel and hydraulic lines during replacement of the right engine created interference between the two lines resulting in fuel line cracking. The accident investigators noted that there are no regulatory requirements to review non-mandatory service bulletins for required interacting service bulletin modifications.

Human Error

The Air Transat Maintenance Control Center technician and the lead maintenance technician decided to proceed with the engine change without first obtaining and consulting a service bulletin to ensure proper completion of a modification required for installation of the engine on the aircraft. They both acknowledged concern about not being able to access the service bulletin from the company computer network but decided on a course of action without the service bulletin. This course of action was not in accordance with the service bulletin and resulted in interference between fuel and hydraulic lines and a subsequent fuel line crack.

The flight crew did not follow the correct procedure for a fuel imbalance indication, which requires that they first determine if there is a fuel leak before opening the crossfeed valve to balance fuel. The flight crew opened the crossfeed valve from memory without consulting the checklist.

Flawed Assumptions

There was an implicit assumption that standard operating procedures fuel quantity monitoring during cruise would detect all but the most critical fuel leaks. It was also assumed that the fuel leak procedures for detected fuel loss, combined with flight deck indications and associated procedures for abnormal fuel system and engine failures, would provide appropriate corrective action to stop the fuel loss and allow a safe diversion and landing. The Air Transat accident showed that standard cruise fuel quantity monitoring is not sufficient for high-rate fuel leaks. This accident also showed the criticality of quickly detecting such leaks and stopping the loss of fuel in order to complete a safe diversion and landing.

Unintended Effects

Forward fuel transfer from the stabilizer trim tank that balanced fuel in the main fuel tank feeding the leaking right engine masked the fuel leak for about 25 minutes and contributed to an unnoticed loss of 3,500 kg (7,718 lbs.) of fuel.  Flight crew confusion over flight deck indications, with an initial assumption that lower than expected fuel quantities were a result of a fuel quantity indicating error, and automatic fuel transfer of fuel from the stabilizer trim tank resulted in delayed awareness of a critical fuel loss.

Preexisting Failures

A fuel leak developed following an engine change that was accomplished using a leased engine that was not properly configured relative to the hydraulic pump a fuel leak developed.  The leak was the result of interference between hydraulic and fuel lines and developed over the early portions of the accident flight, progressing to the point that fuel loss made it impossible to reach the planned destination.

 

Back to top

Numerous fuel exhaustion accidents and incidents have occurred on transport category airplanes caused by errors in fuel loading, fuel leaks, or by flight crew errors in managing fuel during flight.

Fuel Leaks

TAM Flight 3804, August 30, 2002 - Fokker 100

The flight departed São Paulo, Brazil for a flight to Campo Grande. At cruising altitude, "FUEL FILTER" and "FUEL LOW PRESS" messages appeared for the number 2 engine. Subsequently, a fuel imbalance between the main fuel tanks developed. Fuel loss appeared to be rapid, so the crew decided to divert to Aracatuba. Both engines flamed out due to fuel exhaustion when the aircraft was 16 miles from the airport. An emergency landing was conducted in a farm field. The cause of the fuel loss was attributed to a fuel line failure, resulting in a fuel leak.

Improper Fuel Loading

Air Canada Flight 143, July 23, 1983, Boeing 767-200

 

 

The flight was destined for Edmonton, Alberta, having originated in Montreal, Quebec, with a planned stop in Ottawa. While in Ottawa a problem was discovered with an inoperative Fuel Quantity Indicating System (FQIS). Prior to departure from Ottawa, an error was made when calculating the fuel load using an alternate tank quantity measurement employing the onboard fuel measurement sticks. The error resulted in the airplane departing Ottawa with a significantly deficient fuel quantity. While in cruise at 41000 feet, the first signs of fuel exhaustion (low fuel pressure on the left engine) became apparent, and a descent was initiated for a planned diversion into Winnipeg. After initiating the descent from 41000 feet, the left engine failed, followed by the failure of the right engine as the airplane descended through 35000 feet. Unable to reach the diversion airport of Winnipeg, an emergency landing was conducted at an abandoned airstrip in Gimli, Manitoba. The Captain, an experienced glider pilot, and former Royal Canadian Air Force (RCAF) pilot, was familiar with the airport at Gimli, having been stationed there during his RCAF career. At the time of this incident, the airport had been converted to an auto sports complex and the emergency landing was conducted during race activities.

Improper Fuel Management

United Airlines Flight 173, December 28, 1978, McDonnell Douglas DC-8

On December 28, 1978 a McDonnell Douglas DC-8-61 turbofan powered airplane operated by United Airlines and registered as N8082U, crashed into a wooded suburban area while on approach to Portland International Airport, Portland, Oregon.

Upon approach to Portland International Airport, the aircraft experienced a landing gear malfunction indication and could not determine if the landing gear had been safely extended. The flight crew elected to hold at 5,000 feet to troubleshoot the landing gear anomaly, and prepare the aircraft for an emergency landing. With one exception, about 38 minutes into the hold, little was said concerning the amount of fuel onboard and what was needed to complete the approach to the airport. Approximately one hour after beginning the hold, and during the approach to the airport, the aircraft ran out of fuel and crashed approximately six miles northeast of the airport.

Of the 189 people onboard the aircraft, ten were killed and 23 were seriously injured.

See accident module

Avianca Airlines Flight 52, January 25, 1990, Boeing 707

Avianca Airlines Flight 052, a Boeing 707-321B, was a scheduled international flight from Bogota, Colombia, to John F. Kennedy (JFK) International Airport, New York. Poor weather conditions in the Northeast of the US led to the flight being put into holding three times for a total of 1 hour and 17 minutes. During the third hold period the flight crew reported that the airplane could not hold longer than 5 minutes, as it was running out of fuel, and that it could not reach its alternate airport, Boston-Logan International. Subsequently, the flight crew executed a missed approach to JFK. While trying to return to the airport, the airplane had a loss of power to all four engines and crashed in a wooded residential area in Cove Neck, Long Island, New York. approximately 16 miles from the airport.

The crash was determined to be the result of fuel exhaustion brought about by poor flight crew planning and communication both with air traffic control, and among the flight crew. There were 158 passengers and crew on board. 65 of the 149 passengers, and 8 of the 9 crew were killed.

See accident module

 

Back to top

Technical Related Lessons

A large, undetected fuel leak poses a substantial risk to safety of flight, especially on long range flight routes. (Threat Category:  Fuel Exhaustion)

• As the flight progressed, and between fuel quantity checks at planned flight waypoints, a massive fuel leak developed on the right engine. Investigators concluded that an automated system which continuously monitors available fuel would have allowed the crew to determine that fuel was being consumed at a higher than planned rate and may have allowed an earlier decision to divert to an alternate airport and avoid fuel exhaustion.

Common Theme Related Lessons

There are some effects of highly automated systems that can mask other system failures, originating from independent sources, that may pose an ongoing threat to flight safety. (Common Theme:  Unintended Effects)

• Forward fuel transfer from the stabilizer trim tank, that balanced fuel in the main fuel tank feeding the leaking right engine masked the fuel leak for about 25 minutes and contributed to an unnoticed loss of 3,500 kg (7,718 lbs.) of fuel. The investigators noted that a clear, unambiguous alert of a critical low fuel condition would have provided crew awareness sufficiently early to allow corrective action and avoid fuel exhaustion. Flight crew confusion over flight deck indications, with an initial assumption that lower than expected fuel quantities were a result of a fuel quantity indicating error, and automatic fuel transfer of fuel from the stabilizer trim tank resulted in delayed awareness of a critical fuel loss.

 

Back to top