- Air Transat A330 Flight TSC236 at Terceira Airport, Azores
- Accident Overview
- Accident Board Findings
- Accident Board Recommendations
- Relevant Regulations / Policy / Background
- Prevailing Cultural / Organizational Factors
- Key Safety Issue(s)
- Safety Assumptions
- Resulting Safety Initiatives
- Airworthiness Directives (ADs) Issued
- Common Themes
- Related Accidents / Incidents
- Lessons Learned
- Air Transat A330 Flight TSC236 at Terceira Airport, Azores
History of Flight
Photo of Air Transat Airbus Model A330-243 on ramp
Photo copyright Pierre Lacombe - used with permission
On August 24, 2001, Air Transat Flight TSC236, an Airbus Model 330-243 aircraft, was on a scheduled flight from Toronto, Canada to Lisbon, Portugal. The flight departed Toronto at 00:52 Coordinated Universal Time (UTC). According to the flight crew, the flight and fuel consumption progressed normally through 04:57 UTC, when the airplane passed 30 degrees west longitude. Unknown to the crew, a fuel leak had developed in the right engine, beginning at 04:38 UTC. Air Transat operational procedures for extended range flight, such as was being conducted on this flight, required a fuel quantity check to be performed by the flight crew as the aircraft passed each 10 degrees of longitude. At the time of the 30° west position check, the fuel quantity was unremarkable, as it was within 200 kg (441 lbs.), or 1% of the planned fuel quantity at that point in the flight. Eighteen minutes after the fuel leak began, and just before reaching the 30° west position check at 04:56 UTC, the automatic center of gravity (CG) control function of the horizontal stabilizer Trim Tank Transfer System began a two-minute transfer of 300 kg (661 lbs.) of fuel from the horizontal stabilizer trim fuel tank to the left and right wing inner fuel tanks in order to maintain center of gravity within the aft CG target.
Electronic Centralized Aircraft Monitoring System (ECAM)
A few minutes later during the same 30° west position check, the crew noticed unusual engine oil indications on the Number 2 (right) engine. The crew selected the ENGINE page on the lower screen of the A330 Electronic Centralized Aircraft Monitoring System (ECAM) to verify the engine readings. While the flight crew was investigating the unusual engine oil indications, the Trim Tank Transfer System automatically began a second 19-minute forward transfer of the remaining 3,200 kg of stabilizer trim tank fuel to the left and right wing inner fuel tanks. This final fuel transfer, which was completed at 05:30 UTC, would not normally occur until late in the flight about 35 minutes from the destination airport. Because fuel was leaking from the right engine, the system automatically transferred more fuel to the right inner tank in order to maintain balance between the left and right inner fuel tank quantities.
A330 fuel tank arrangement
At 05:33 UTC, a fuel imbalance advisory message appeared on the upper ECAM screen, called the Engine Warning Display or E/WD, indicating a fuel quantity difference between the left and right inner wing fuel tanks of 3,000 kg. Normally, this message would have triggered an automatic display of the FUEL page on the lower ECAM system display (SD), which is a synoptic of the fuel system, including individual fuel tank quantities. The earlier manual selection of the ENGINE page on the SD inhibited the automatic display of the FUEL page. However, the flight crew deselected the ENGINE page a minute later and the FUEL page then was displayed. At this time, the crew became aware of the fuel imbalance between the left and right inner wing fuel tanks. The initial crew action was to address the fuel imbalance message by selecting the crossfeed valve OPEN and the right wing fuel pumps OFF in order to feed the right engine from the left wing tanks. The FUEL IMBALANCE procedure in the Quick Reference Handbook (QRH) contained a caution note that, if a fuel leak is suspected, the crew should instead refer to the FUEL LEAK procedure. According to the accident investigators, the Captain completed the fuel balancing procedure from memory without considering the caution note in the QRH procedure.
Shortly thereafter, the crew became aware that the fuel remaining on board was only 11,000 kg, or 8,500 kg below the expected amount of fuel at that point in the flight. According to the crew, both the imbalance and fuel quantity indications were unusual and unexplainable. It was further learned during the investigation that neither of the pilots had ever encountered a fuel leak, or an unexplained low fuel quantity either in training or in flight.
At 05:45, the fuel on board had reduced to below the minimum required to reach Lisbon, and the crew initiated a diversion to Lajes Airport on Terceira Island in the Azores. In attempts to resolve the sudden and unexplained reduction in the fuel quantity readings, the flight crew asked the cabin crew to visually check the wings and engines for a possible fuel leak. The visual check did not reveal any evidence of a fuel leak.
Time History of Fuel Quantity during Air Transat Flight TS236
Note change in rate in the decrease of fuel onboard as leak rate increased.
Photo of Air Transat Flight TSC236 after landing
Photo of Lajes Airport, Terceira Island in the Azores
Google Earth Photo
In reaction to a continued abnormally high rate of fuel consumption, the crew established fuel feed to both engines from right wing fuel tanks to counter the possibility that fuel loss was the result of a leak in the right wing tanks. At this time, fuel onboard was 4,800 kg, or 12,000 kg below the planned fuel quantity. At 05:58, a fuel right wing tank low level message displayed on the ECAM Engine Warning Display, which indicated that there was less than 1,640 kg of fuel in the tank for more than 60 seconds. During dialog with Air Transat Maintenance Control, the flight crew reported the fuel quantity to be 1,000 kg in the right tanks and 3,200 kg in the left tanks. Air Transat Maintenance Control asked if the fuel loss might be a leak in the left engine, so the captain momentarily reselected crossfeed from the left fuel tanks.
At 06:08, a fuel left and right wing tank low level message displayed on the E/WD, which indicated that the inner tanks in both wings contained less than 1640 kg for more than 60 seconds. The right engine flamed out five minutes later at 06:13.
At 06:23, the first officer declared "Mayday" with Santa Maria Oceanic Control and the left engine flamed out at 06:26 when the airplane was 65 nautical miles from Lajes. Control of the flight transferred to Lajes Approach Control. The aircraft arrived about 8 miles off the approach end of runway 33 at approximately 13,000 feet on a track of about 270°. The captain advised Lajes that he was conducting a left 360 degree turn in order to lose altitude. During the turn, the crew extended the leading-edge slats and landing gear for landing and conducted S-turns on the final approach to lose additional altitude. The aircraft crossed the threshold of runway 33 at about 200 knots, touching down hard 1,030 feet from the end of the runway, and bounced back in the air. A second touchdown occurred 2,800 feet from the approach end of the runway, and the crew applied maximum braking. The aircraft came to a stop 7,600 feet from the approach end of the 10,000 foot runway.
Left: Photo of Air Transat Flight TSC236 after landing. Right: Photo of main landing gear after landing.
Cause of Fuel Leak
Fuel tube chafing from incompatible hydraulic tube
Photo of removed fuel line showing crack
The accident investigators determined that the fuel leak leading to the fuel exhaustion and dual engine flameout on Air Transat TSC236 was caused by a crack in the right engine fuel line. The crack was approximately three inches long (80 mm) and was created by the fuel line rubbing against an adjacent hydraulic line. The rubbing was a result of an interference created by the use of mismatched fuel and hydraulic lines during replacement of the right engine on the accident airplane. The interference was caused by the incomplete incorporation of a Rolls-Royce service bulletin that detailed instructions for replacement of fuel and hydraulic tubes necessary for the installation of improved model hydraulic pumps. The engine maintenance shop tasked with the installation of the fuel and hydraulic tubes on the loaned engine did not complete the installation because of a parts shortage and Air Transat did not complete the service bulletin work prior to installing the new hydraulic pump on the engine as part of its installation on the accident airplane.
Hydraulic Pump Replacement
In reaction to several cases of hydraulic fluid leakage at the hydraulic pump or attached hydraulic lines, Airbus published an optional service bulletin offering a modified hydraulic pump. The service bulletin offered three physically similar and interchangeable models for new production airplanes, while two other models were available for modification and/or replacement by operators.
Because the pump was mounted on the engine, Rolls-Royce, the A330 engine manufacturer, issued two service bulletins, one for the installation of the modified hydraulic pump and the other detailing modifications to the engine build-up in order to accommodate the widened pump housing of the modified pump. The larger hydraulic pump housing created an interference between the hydraulic line and the adjacent engine fuel line. The engine build-up service bulletin replaced three fuel tubes and two hydraulic tubes for the front and rear hydraulic pumps in order to eliminate the interference.
The Rolls-Royce hydraulic pump replacement service bulletin clearly required the engine build-up service bulletin to be accomplished prior to, or concurrently with, the hydraulic pump replacement. The engine build-up service bulletin stated that it was essential that the fuel and hydraulic tubes be fitted as a set.
Replacement Engine Installation
Air Transat initiated an engine change on the accident airplane because of metal chips found on the original engine's master chip detector during a routine inspection. Air Transat's spare engine was not available for the replacement, so the airline used a Rolls-Royce loaned engine that had been previously positioned at the Air Transat facility. All of Air Transat's A330 airplanes were delivered in a post-mod configuration. The loaned replacement engine was a pre-mod hydraulic pump configuration. The maintenance facility that prepared the loaned engine for installation on an airplane was supposed to incorporate the engine build-up service bulletin so the newer modified hydraulic pumps could be used. However, the shop did not complete the bulletin because required parts were not available. Even though the required service bulletin had not been incorporated, the engine was transported to Air Transat with a Carry Forward List specifying that the new modified hydraulic pump part numbers were to be installed.
The engine change took place over a weekend and had fallen behind schedule due to the late arrival of a leased jacking pad. There was a commitment to complete the work by noon on Sunday for the next scheduled flight and to make space available for another use.
Accident aircraft hydraulic and fuel line installation
Interference between the hydraulic pump and the adjacent fuel tube was the first indication of a problem with the installation of the post-mod hydraulic pumps from the original engine on the pre-mod replacement engine. The lead technician attempted to access the engine build-up modification service bulletin from the airline computer network from three different workstations, but was denied access due to a computer malfunction. The Air Transat Maintenance Control Center (MCC) had stand-alone compact disks (CDs) of the Rolls-Royce service bulletins, but they were not used. According to the accident report, the lead maintenance technician did not consider the use of the stand-alone CDs because he was not aware of this capability in the MCC. The MCC technicians did not consider the use of the CDs because their role in providing technical assistance to maintenance crews was to locate resources, not to search for technical references.
Figure from Rolls-Royce engine build-up service bulletin showing routing of revised fuel line in vicinity of aft hydraulic pump
Although initially concerned about the difficulty of retrieving the required service bulletin, discussions between the lead maintenance technician and the Air Transat Trent engine controller were primarily devoted to the time required to complete the work because they were behind schedule. Without access to the applicable engine build-up service bulletin, the lead maintenance technician and the engine controller determined that the replacement engine fuel lines needed to be replaced, even though the service bulletin also specified replacement of the hydraulic lines. Effectively, the engine controller and the lead maintenance technician agreed to this course of action without further reference to the service bulletin. Because the engine controller was knowledgeable about the service bulletin and the background of the hydraulic pump modification, the lead maintenance technician felt confident that the planned fuel line replacement was the only remaining requirement to complete the hydraulic pump installation. The Rolls-Royce service representative, who was familiar with the hydraulic pump modifications, made himself available to the airline for assistance during the engine change, but was not consulted.
Both segments of the post-mod fuel tube assembly were taken from the removed engine and installed on the replacement engine. The different shape and routing of the new fuel line eliminated the interference that previously created difficulties installing the post-mod hydraulic pump. However, the pre-mod hydraulic tube received with the loaned engine was retained. The installing maintenance technician recalled the hydraulic line had the tendency to spring back when trying to achieve the required separation between it and the fuel line taken from the original engine. However, he stated that he could easily obtain the clearance by positioning and holding the hydraulic tube while tightening the B-nut to hold it in place. No other installation difficulties were reported. Considering the hydraulic system working pressure of 3,000 psi and the pump pulsation, the accident investigators considered it feasible that any clearance between the hydraulic and fuel lines at installation on the occurrence aircraft would have vanished once the flexible hydraulic line was pressurized. The installation of the post-mod hydraulic pump, the pre-mod hydraulic tube, and the post-mod fuel tube assembly resulted in a mismatch between the fuel and hydraulic tubes.
The company maintenance control manual required a quality control inspection of the documentation following an engine change. However, the manual did not specify the time when this is to be completed. There was no quality control representative on site during the engine change because it was a weekend. The company plan was to do the document verification when preparing the removed engine for shipment to the repair shop. The accident flight occurred before this quality control verification was completed.
The accident investigators were concerned about a lack of configuration control for optional non-mandatory service bulletins. Air Transat had received the loaned engine in an unexpected pre-engine build-up service bulletin configuration to which the airline had not previously been exposed, because all of its airplanes had been delivered in a post-mod configuration. The accident report states that documentation that came with the loaned engine had identified the incorrect hydraulic pump part numbers for this configuration, which may have masked the pre-mod configuration of the engine until near completion of the engine change. The accident investigators noted that there is no airworthiness requirement to review all non-mandatory service bulletins for applicability to a component prior to its installation on an aircraft.
Extended Operations (ETOPS)
Photo of Convair 240: Typical two-engine airplane in service when the original 60-minute operational rule was created in 1949
Photo copyright American Airlines via R. A. Scholefield - used with permission
Map of the world showing areas in white that can be reached in 60 minutes with one engine inoperative
Illustration of how ETOPS results in shorter, more direct flight.
Air Transat was operating under standards that were established to allow turbine engine powered airplanes with two engines to fly more than one hour flying time from a place to land anywhere along the route in still air with one engine inoperative. These types of operations were known as Extended Range Operations with Two-engine Airplanes, or ETOPS. Since the Air Transat accident, these standards have been codified into the regulations as Extended Operations, but are still known as ETOPS.
Since 1949, transport airplane operational regulations restricted two-engine airplanes from operating on a route more than 60 minutes from a suitable airport with one engine inoperative. The 60-minute diversion time requirement was developed in the era of piston engine powered airplanes. Engine failures on these airplanes were common, and multiple engines occasionally failed during the same flight on the four-engine airplanes typical of this era. The regulators of the time created the 60-minute maximum diversion distance requirement to limit the risk of losing the remaining engine following failure of the first.
The reliability of jet engines was a great improvement over that of piston engines right from the beginning of the jet age in the late 1950s and 1960s. The low performance of early turbine jet engines required the use of more than two engines in order to provide the thrust necessary for the size airplanes conducting operations on routes where twins would be limited by the 60-minute rule. However, as the performance of jets and later turbofan engines improved, airplane manufacturers were able to achieve the performance and range with two engines that previously required more than two engines with earlier generations of turbine engines. With the development of long-range two-engine powered airplanes such as the Boeing 767 and Airbus A310, industry began looking at ways to fully utilize the range capability that these airplanes offered. The 60-minute twin operating limit created a restriction on the utility of this new generation of airplanes because it limited available route opportunities for airlines and forced them to fly longer, more circuitous routes than three and four-engine airplanes they would be competing with.
In the 1980s, in response to industry requests to re-examine at the 60-minute twin operating requirement in light of the much higher turbine engine reliability, the FAA developed non-regulatory standards to allow authorizations to exceed the 60-minute diversion time limit under provisions of the existing rule for such deviations. Operations conducted under such authorizations became known as extended range operations with two-engine airplanes, or ETOPS. The original 60-minute twin operating limit grew in incremental steps from 120 minutes to 180 minutes, then to 207 minutes and higher. These ETOPS extensions in the operating limit allowed for greater route planning flexibility because enroute alternates are not always available at shorter diversion times.
The safety standards used to evaluate and approve airplanes for ETOPS have been predicated on meeting two fundamental objectives:
- Minimize causes of engine in-flight shutdowns and other sources of design related airplane diversions; and
- Protect the safety of diversions when they become necessary.
Map of the world showing expanded areas in white that can be reached in 120 minutes (left), and 180 minutes (right), with one engine inoperative
The first ETOPS flights under these safety standards began in 1985. Because the 60-minute twin operational limit originated from concerns about engine reliability on two-engine airplanes, the main focus of the regulators early on was on improving propulsion system reliability. The emphasis for ETOPS type design approval was on reducing causes of engine in-flight shutdowns. However, overall propulsion system reliability of the airplanes approved for ETOPS, as measured by engine in-flight shutdown rate, did not improve as expected during the first few years after ETOPS flights began. In response, the FAA defined a benchmark propulsion system reliability standard, based on a widely used in-service engine with the lowest in-flight shutdown rate. This benchmark engine in-flight shutdown rate, .02 per thousand engine hours, based on a twelve month rolling average, became the target for obtaining 180-minute ETOPS approval, and also created a strong incentive for both manufacturers and operators to more actively reduce the cause of in-flight shutdowns. Since the introduction of this propulsion system reliability standard, engine in-flight shutdown rates have reduced up to 10 times or more from that achieved before ETOPS began.
Chart showing Engine in-flight shutdown rate improvement since the beginning of the ETOPS era
Used with permission - Boeing
As propulsion system reliability improved, the FAA turned its attention to other airplane systems that are important to the safety of ETOPS in meeting the two ETOPS safety objectives; 1) preclude the need to conduct a diversion, and 2) protect the diversion when it becomes necessary. These include the airplane fuel system, the electrical power generation system, the airframe ice protection system, communication and navigation systems, cabin pressurization system, and environmental control system. The propulsion system and these other airplane systems important to ETOPS safety are called ETOPS Significant Systems. Propulsion system reliability on ETOPS airplanes has improved to a point where the probability of the loss of both engines on a two-engine airplane from independent causes is now considered to be an extremely improbable occurrence.
Having achieved a high level propulsion system reliability, the remaining risks to ETOPS safety now come from three main areas:
- Fuel Loss: This involves a single failure, such as occurred on the Air Transat flight that resulted in massive or total fuel exhaustion.
- Common Cause Failures: This involves a failure condition that affects more than one engine or ETOPS significant system. An example would be a maintenance error performed concurrently on both engines of a twin engine ETOPS airplane.
- Cascading Failures: This involves an initial failure followed by a subsequent failure that would not have otherwise occurred. An example is an engine failure followed by increased electrical or mechanical loading of the remaining engine, and its subsequent failure due to its higher loading.
According to the accident report, Air Transat was authorized for ETOPS with A330 aircraft on routes that did not contain points that were farther than 150 minutes from an adequate airport, at an A330 engine-inoperative diversion speed of 427 knots true air speed. Although Air Transat's operations specifications authorized flights up to a maximum of 150 minutes, the route from Toronto to Lisbon would have only required a 120-minute maximum diversion time.
The route of Air Transat Flight TSC236 from Toronto to Lisbon, only the middle of the flight over the central North Atlantic Ocean was farther than 60 minutes from either St. John's, Newfoundland or Lajes Airport on Terceira Island in the Azores.
Route of Air Transat Flight TSC236
As the flight progressed, the distance to the nearest planned diversion airport varied continuously along its route flying closer until reaching its closest point to the diversion airport and then flying farther away. These planned diversion airports on an ETOPS route are called ETOPS alternates. At some point, the distance to the next ETOPS alternate is the same as the distance to the previous one. This is called an equal-time point. After the equal-time point, the next ETOPS alternate became the nearest diversion airport. The first point in the flight that is more than 60 minutes from the nearest diversion airport at the approved airplane speed with one engine in-operative in still air with no wind is called the ETOPS entry point.
The orange circles in the Area of Operations diagram represent the distance the airplane could fly at the approved one-engine inoperative cruise speed of 427 knots in 60 minutes, or 427 nautical miles. The green circles represent the distance the airplane could fly under the same conditions in 120 minutes. The lightly shaded blue area depicts the ETOPS portion of the flight.
Although most of the events surrounding this accident occurred after the Air Transat flight exited the ETOPS portion of the flight, the risks associated with such a fuel leak are progressively greater as the distance from the nearest diversion airport becomes longer. This higher level of risk during the ETOPS portion of a flight makes quick identification and corrective action to stop a large fuel leak much more critical. The ETOPS safety regulations put in place after this accident are intended to identify such a fuel leak while there is time to take corrective action to stop the leak and safely divert to the nearest airport. Click on the link below to view an animation of the accident flight as it progressed along this route, and to view how the flight may have ended had this airplane had the low fuel alert which was developed, and issued, predominantly as a result of this accident.
Electronic Centralized Aircraft Monitoring (ECAM) System
The A330 is equipped with an Electronic Centralized Aircraft Monitoring (ECAM) system that monitors aircraft systems. If something abnormal is detected, the ECAM alerts the pilots and, for most abnormal conditions, provides a procedure to help handle the abnormality. The ECAM is made up of two displays: the Engine Warning Display (E/WD), and the System Display (SD). These ECAM displays provide normal and abnormal system information to the pilots.
The E/WD is divided into two main parts. The upper area is used for the main engine parameters, Fuel On Board (FOB), fuel flow and Slat/Flap position. Under normal conditions, the lower part of the E/WD is used to display MEMO's. If failures occur, Warning/Caution alerts are displayed in place of the memos, and the required crew action items (procedure) for the abnormal situation are depicted in blue below the associated alert.
ECAM Engine/Warning (Upper) Display
The System Display is used to display particular system information. Normally, the CRUISE page is displayed for the majority of the time that the aircraft is airborne; the Fuel On Board (FOB) quantity is displayed on the upper ECAM page. The SD can also be used to display synoptic diagrams of the aircraft systems, either manually selected by the crew, or automatically displayed for the ECAM system when a system anomaly is detected. The SD displays other permanent flight data such as gross weight and CG.
ECAM (Lower) System Display
Under normal conditions, the ECAM system provides the pilots with the information that they "Need to Know" for the particular phase of flight. For example, if a system parameter drifts out of normal range, the ECAM system generates a white ADVISORY (ADV) on the memo portion of the E/WD, and will advise the crew of this condition by automatically displaying the relevant system page on the SD. The affected parameter on the SD will pulse in green, because it is approaching, but still within limits. If, at the time that the ADV is generated, another system page is already manually selected and displayed on the SD, the relevant systems page called by the advisory is not displayed; however, a pulsing white ADV notice is displayed in the Memo area of the E/WD. Although immediate pilot action may not be required by all ADVISORY messages, crew monitoring of the system is required.
When a failure occurs, leading to a loss of redundancy or loss of a system that does not affect the safety of the flight, the ECAM system informs the crew by displaying an amber failure message on the E/WD, and displays the relevant system page on the SD. The affected parameter on the SD will be displayed in amber. A related FAULT light may be illuminated as well.
The accident investigators stated that a fuel leak is an abnormal condition that was not monitored by the ECAM system; consequently, an ECAM warning was not generated for these conditions. Instead, the A330 design philosophy expected that the flight crew's normal monitoring of the fuel system parameters would result in timely recognition that a fuel leak existed, or a loss is taking place. Once the crew recognized that a fuel leak existed, the fuel leak operational procedure was intended to mitigate the consequences of a fuel leak. In their analysis of the Air Transat accident, the accident investigators pointed out that during training and actual operations, flight crews were taught to trust the ECAM to provide the information needed for significant, abnormal or emergency situations. They were concerned that for this occurrence, the only alerting provided to the crew was a low level advisory ECAM message, which did not convey the seriousness of the high risk situation they were facing. The accident investigators also referred to a related occurrence on an Airbus A320 airplane that occurred in 1997 where, combined with this event, even qualified and trained crews can misidentify a fuel leak. Their conclusion was that clear unambiguous alerting to the crew, and guidance as to the handing of a fuel leak, is necessary to mitigate this risk.
FUEL SD page showing forward transfer of fuel
E/WD & Trim Tank Transferred Memo
Center of Gravity Management (Stabilizer Trim Tank)
A trim tank (fuel tank) is located in the Trimmable Horizontal Stabilizer (THS). The stabilizer trim tank transfer system is a fully automatic system that controls the center of gravity of the aircraft. When the aircraft is in cruise, the primary Fuel Control and Management Computer (FCMC) calculates the CG and compares the result to a target value that depends on the aircraft actual weight. From this calculation, the FCMC optimizes the CG by deciding to transfer fuel to or from the trim tank. There is normally only one aft transfer at the beginning of the flight. During the flight, there is a series of small forward transfers. If the actual CG is different from the target CG by more than 0.5% and the aircraft is above 25,500 feet, an appropriate transfer occurs. If an inner tank quantity drops below 4,000 kg, forward transfer also occurs to maintain the fuel in the inner tanks between 4,000 kg and 5,000 kg until the trim tank is empty. If during a forward transfer, the inner tanks are out of balance by more than 500 kg, the transfer is automatically stopped on the heaviest side until the fuel balance is achieved. A final forward transfer occurs when the time to destination is less than 35 minutes, when either set of wing tanks is below 4,000 kg, or when the aircraft descends through 24,500 feet. When fuel is being transferred, a "TRIM TANK XFR" message appears on the ECAM Memo screen; when the trim tank is empty, a "TRIM TANK XFRD" message appears on the ECAM Memo portion of the E/WD screen.
During the accident flight, the automatic forward transfer of fuel occurred significantly before it normally would have, due to the fuel loss in the right inner main fuel tank. Additionally, the system transferred more fuel to the lower right tank in order to balance the fuel quantity between the left and right inner main tanks. The table lists the sequence of stabilizer trim tank forward fuel transfers after the start of the fuel leak at 04:38 UTC. Click on this link to view an animation of the stabilizer trim tank operation.
|Time||Left tank||Trim tank||Right tank||Total FOB||Events|
|04:38||10,100||3,500||10,100||23,700||Start of fuel leak|
|04:57||9,264||3,200||8,936||21,400||Fifth forward transfer start|
|05:11:30||8,750||3,135||6,750||18,600||Final forward transfer start|
|05:31:00||8,000||0.0||5,000||13,000||Forward transfer complete|
The accident investigators determined that this automatic trim tank transfer and fuel balancing delayed generation of an ECAM advisory fuel imbalance message about 25 minutes and contributed to an unnoticed loss of 3,500 kg (7,718 lbs.) of fuel.
Aircraft Operational Factors
Standard Fuel Quantity Checks
The Air Transat Flight TSC236 flight crew was following A330 Flight Crew Operating Manual (FCOM) Standard Operating Procedures (SOPs) for checking fuel quantity and airplane systems status during the flight. These checks are carried out at each flight plan waypoint along the route. The SOPs indicate that when overflying a waypoint, the following should be checked:
- Track and distance to the next waypoint;
- Fuel on board and fuel prediction with flight planned fuel;
- Sum of fuel on board and fuel used consistency with the fuel on board at departure.
Photo of airplane with fuel streaming from the left engine nacelle
These SOP checkpoints on the accident flight were scheduled at various defined geographic points along the route, including the points in the route where the airplane crossed each 10 degrees of longitude. Thus, there were planned checks at 50 degrees West longitude, 40 degrees West, and 30 degrees West during the accident flight. The flight diverted just short of what would have been the 20 degree West checkpoint.
The time between the 50°W and 40°W SOP checks was 46 minutes. The time between the 40°W and 30°W checks was 49 minutes. At the time of the 30°W SOP check, the total fuel quantity onboard the airplane was within 1% of the planned fuel quantity. The crew initiated the diversion to Lajes 48 minutes after the 30°W check just before reaching 20°W longitude where the next planned SOP check would have occurred.
Unusual Engine Parameters
The flight crew's attention was diverted away from monitoring other aircraft systems and delayed awareness of their low fuel state by oil system parameter differences between the left and right engines.
|Oil Parameter||Left Engine||Right Engine (with fuel leak)|
|Quantity||18.2 liters||14.5 liters|
|Pressure||80 psi||150 psi|
These unusual engine oil readings were caused by the high fuel-flow rate through the right engine fuel/oil heat exchanger caused by the fuel leak downstream of this component. The high fuel flow rate would have had the following effects on these engine oil system parameters compared to the left engine:
- Lower Oil Quantity: Lower volume due to colder oil temperature
- Lower Oil temperature: More heat carried away by the higher rate of fuel flow
- Higher Oil pressure: Higher oil viscosity due to colder temperature
The flight crew did not recognize that a potential reason for the oil system readings they were observing could have been the result of a fuel leak.
Initial Recognition of Fuel Loss
The fuel leak started at 04:38 UTC, but the flight crew did not notice a fuel problem until 05:33, when the fuel imbalance advisory message was generated. During this period, several flight deck indications were evidence of the fuel loss.
- The fuel on board (FOB) was decreasing at an unusual rate; this information would have been displayed in the FOB figures on the upper ECAM E/WD display.
- The estimated fuel on board at destination (EFOB) was decreasing; this information was a function calculated by the Flight Management Computer and would have been displayed on the Multi-purpose Control and Display Unit (MCDU) located on the center console between the pilots.
- The full forward transfer of the fuel in the trim tank was premature given the fuel load on departure. A prolonged, 19-minute TRIM TANK XFR memo between 05:11 and 05:30 UTC, and then the TRIM TANK XFRD memo between 05:30 and 05:33 were flight deck indications of this transfer.
Photo of A330 Flight Deck
Photo copyright Glenn Stewart - used with permission
According to the crew, the following factors were taken into account to ascertain the problem of the unexplained low fuel quantity:
- Engine indications were reviewed to determine a source of the problem. No abnormal indication was found. Fuel-flow parameters and other engine indications were normal. – Note: The fuel flow indication was normal because the fuel leak was upstream of the fuel flow meter.
- There had been no other in-flight events or conditions that led them to the fuel loss.
- The cabin crew were asked to visually check outside the aircraft in the vicinity of the wings and engine for signs of a fuel leak, and none were observed due to darkness that prevailed during this time.
- From the time when the fuel imbalance ADV first appeared, the fuel quantity indications and fuel predictions for destination consistently showed an unbelievable fuel loss rate.
The crew stated that because there were no other signs of a fuel loss, other than the lower than expected quantity of fuel on board, and because there had been no other ECAM warnings or cautions, both pilots believed that the problem was a computer fault. They also stated that although they had used the term "fuel leak" on many occasions in their conversations during the occurrence, a logical link to considering the FUEL LEAK check and the possibility that the fuel leak existed did not occur to them until the indicated fuel quantity reached about 7,000 kg.
The accident investigators stated that the following factors probably contributed to this delayed recognition of the low fuel quantity problem:
- The only fuel check required by standard operation procedures during this timeframe was done at 04:58 as the aircraft crossed 30° West. At this time, the fuel quantity was unremarkable, because it was within 200 kg or 1% of the planned fuel quantity.
- The crew was then involved in position reporting, recording entries on the flight log, and checking of instrument indications.
- The unusual oil readings created a level of uncertainty in the flight crew.
- This uncertainty resulted in the crew becoming occupied in activities to resolve the ambiguities, including reviewing manuals and contacting the Air Transat Maintenance Control Center.
- The final forward transfer of the 3,200 kg of fuel from the trim tank into the right wing tank delayed the generation of the fuel ECAM advisory message by approximately 15 minutes.
Although the TRIM TANK XFR memo was premature given the stage of flight, the initial appearance of the memo would have been unremarkable, because it comes on routinely during flights. Also, given the crew was preoccupied with resolving the unusual oil readings, the accident investigators concluded that it is understandable why, during this time frame, the crew did not recognize the prolonged nature of the TRIM TANK XFR memo, the presence of the TRIM TANK XFRD memo, and the subtle changing of the FOB and EFOB figures.
From 04:38, the time that the fuel leak started, until 05:04, the time when the unusual oil indications were recognized, flight deck activity level was normal. However, resolving the unusual oil indications raised the activity level and drew the crew’s attention away from their routine monitoring of the other displays.
All of the fuel-related information and messages were provided in the form of text-type status messages and digital counter displays, none of which conveyed a sense of urgency that would cause the crew to abandon activities associated with resolving the oil reading anomalies, and none of which conveyed the critical nature of the fuel leak.
During this time, the automated trim tank transfer system caused the fuel to be loaded into the right wing to balance the fuel quantity of the left and right main tanks, delaying the generation of the fuel advisory message, masking the fuel leak problem from the crew. By the time the fuel imbalance advisory was generated at 05:33, fuel on board had reduced to 12,200 kg and 6,650 kg of fuel had been lost.
Feeding the Leak (Fuel Imbalance Procedure)
A fuel imbalance flight deck indication serves a dual purpose. In the vast majority of cases, it informs the crew of a difference in fuel consumption between the engines, and the crew follows the fuel balance checklist to balance the fuel quantity. The fuel imbalance advisory is also a primary indicator of a fuel leak. However, a fuel leak is a rare occurrence and without further investigation, a flight crew initially has no way of knowing whether the imbalance is due to differences in engine fuel consumption they have encountered numerous times, or from a fuel leak, which they have rarely encountered, if ever. In the case of the Air Transat A330, the following factors would have confirmed the crew’s perception that a fuel imbalance was a low-risk situation:
Air Transat A330 Fuel Imbalance Procedure from the accident report
- The condition was announced by a low level advisory message and not caution or warning alert.
- The Caution note in the FUEL IMBALANCE checklist, that the checklist should not be used if a fuel leak is suspected, was not prominent.
- The conditions that should be used to assess if a fuel leak exists were not located on the FUEL IMBALANCE checklist. They were in the FUEL LEAK checklist, which would not be consulted unless a fuel leak was already suspected.
- The exposure of A330 crews to fuel imbalance was mostly limited to situations that only required a monitoring of fuel balance, and not to situations that required an active response to a FUEL IMBALANCE advisory. This was because the magnitude of fuel imbalance (3,000 kg) that triggered the message made that an uncommon occurrence.
The Air Transat crew reacted to the fuel imbalance advisory message by completing the FUEL IMBALANCE procedure from memory. They did not consider the caution note instructing them to refer to the FUEL LEAK procedure prior to balancing fuel. They also started the fuel balancing before looking at the Fuel page on the ECAM Systems Display where they discovered that total fuel on board was significantly below planned quantity. This resulted in feeding the fuel leak in the right engine from fuel in the left wing tank, which otherwise would have been isolated from the leak by the crossfeed valve.
Fuel Leak Warning and Procedures
Although the fuel leak started at 04:38, the crew did not recognize the higher-than-normal rate of fuel quantity reduction until after they selected the Fuel page on the ECAM Systems Display at 05:34 in response to the fuel imbalance advisory message. By the time that the crew took their initial actions in response to the situation at 05:36, more than 7,000 kg of fuel had already been lost. The crew perceived the suddenness and the magnitude of the indicated fuel loss as not being believable and not linked to any explainable reason. They did not finally recognize they had a real fuel leak until 05:53
As demonstrated in this accident and other earlier fuel leak occurrences investigated by the accident investigators, the report states that flight crews have difficulty in assessing the seriousness of fuel leak situations due to the following:
- Lack of operational exposure to similar events that would confirm indications of a significant fuel loss.
- The absence of physical evidence of fuel leaking from the aircraft by visual inspection of the engine nacelles, or of abnormally high fuel flow indications.
- The lack of a direct system warning to alert the crew to the precise critical condition.
- The appearance of another system indication that diverts the crew’s attention to another more-easily understood situation of lower criticality.
- The lack of training covering conditions likely to cause fuel leaks and the procedures to be followed if a fuel leak is experienced.
A330 Fuel Leak Procedure from the accident report
At the time the crew initiated the diversion to Lajes at 05:45, they considered doing the fuel leak procedure, but they were still uncertain as to the validity of the fuel quantity indications and the precise nature of the problem. The crew further discounted doing the LEAK NOT FROM ENGINE or the LEAK NOT LOCATED procedure because doing so would require a descent to a lower altitude and would further degrade an already critical situation. The accident investigators concluded that had the Air Transat crew taken the actions required by the FUEL LEAK checklist when the fuel loss was first recognized at 05:53, the aircraft would not have run out of fuel before reaching Lajes.
The investigation into an Air France A320 fuel leak occurrence on August 24, 1997 resulted in a September 6, 1997 BEA recommendation to the French airworthiness authority to re-examine the adequacy of aircraft systems and procedures associated with fuel leaks. They also recommended an interim measure to notify all crews of the circumstances of the 1997 A320 fuel leak occurrence. In response to this recommendation, Airbus improved the A330 FUEL LEAK checklist, developed a FUEL IMBALANCE checklist, and notified the pilots. At the time of the Air Transat A330 accident, Airbus had not incorporated a leak-warning system in any A330 aircraft. Additionally, fuel leak training had not been incorporated into the Airbus A330 training program.
Automated Trim Tank Fuel Transfer
Although two green TRIM TANK XFR ECAM advisory messages would have been displayed in the memo section of the E/WD during the flight, these two memos would have been unremarkable, first because this type of message came on routinely during flights, and second because the message was a status type text message that neither conveyed urgency or required immediate action. In addition, the subtle addition of one text letter "D" from the TRIM TANK XFR to the TRIM TANK XFRD message is not a high-salience change and did not draw this crew's attention to the end of the fuel transfer.
Even the last TRIM TANK XFR message that lasted 19 minutes and the TRIM TANK XFRD message for the remainder of the flight did not alert the crew to an urgent situation, in part because they were occupied in higher priority cockpit tasks such as completing flight documentation, communicating, analyzing the unusual engine oil parameter anomalies, and then attempting to resolve the fuel imbalance and ambiguity of the fuel quantity.
Of importance is that the forward transfer caused the fuel in the trim tank to be loaded into the right wing, feeding the leak in the right engine and masking the fuel leak problem from the crew. This masking contributed to an unnoticed loss of 3,500 kg of fuel.
Flight Crew Uncertainty about Fuel Quantity
When the ECAM advisory message alerted the crew to the fuel imbalance, there was a large difference between the actual fuel system state and the crew’s understanding of it. Although there were other indications that the situation was more serious than a fuel imbalance, the crew initially reacted by doing the FUEL IMBALANCE procedure because that was the only anomaly exposed by the ECAM system. The crew followed the procedure from memory because the need to balance fuel due to normal differences in left and right engine fuel consumption is a fairly common occurrence on long-range flights.
Neither of the crewmembers had ever experienced a fuel imbalance of any magnitude during flying operations, nor been exposed to a fuel leak before during training or operations.
Once the EFOB at destination reduced below minimums, the Captain made an appropriate decision to divert to the ETOPS alternate of Lajes. However, because the crew took no action to stop the fuel leak, the rate of fuel loss at that time was so great that it was not possible to safely complete the diversion.
Fuel Onboard and Leak Rate During Flight
The investigators concluded that the crew was presented with an advisory message that did not require immediate action. The Flight Crew Operating Manual (FCOM) required the crew to refer to the Quick Reference Handbook (QRH) procedures before taking action. A caution note in the QRH FUEL IMBALANCE checklist procedure informs the crew to not apply this procedure if a fuel leak is suspected and to perform the FUEL LEAK procedure instead. Crew Resource Management (CRM) principles suggest that, before taking action in response to the fuel imbalance advisory message, the crew should have taken into account all available information about the fuel system. Such a review would have revealed that over 6,000 kg of fuel had been lost. The combination of the fuel-loss indications and the substance of the caution note in the FUEL IMBALANCE procedure should have led the crew to the FUEL LEAK procedure. The FUEL LEAK, LEAK FROM ENGINE procedure requires that the leaking engine be shut down; the FUEL LEAK NOT FROM ENGINE OR LEAK NOT LOCATED requires that the crossfeed must remain closed. Either of these actions would have conserved the fuel in the left wing tanks and allowed for a landing at Lajes with the left engine operating. Opening the crossfeed valve put the fuel in the left tank at risk, and made a serious fuel-leak situation even worse.
Further, the investigators believed that the lack of a clear unambiguous low fuel alert contributed to the flight crew's delayed awareness to a serious fuel loss, as did an automatic stabilizer trim tank transfer system that transferred more fuel to the tank with less fuel to balance fuel quantity, thus delaying the fuel imbalance advisory message. These factors shortened the amount of time available for the crew to take mitigating action before the fuel loss became critical. The rate of fuel consumption from both engines prior to the start of the fuel leak was approximately 5300 kg per hour. At the peak of the fuel leak, the leak rate was 13,800 kg per hour, or 2.6 times normal engine fuel consumption. For a high rate fuel loss such as occurred during the Air Transat flight, early awareness of the fuel loss is critical to having enough time for appropriate mitigating action to preserve sufficient fuel for a safe diversion.