Air Transat Flight 236

Date

24 August 2001

Phase of flight

Cruise

Location

Lajes Airport, Terceira Island, Azores, Portugal

Aircraft

Airbus A330-243

Registration

C-GITS

Operator

Air Transat

Flight

Air Transat 236 (TSC236)

Occupants

306

Fatalities

0No one was killed; 2 passengers were seriously injured, and 14 passengers and 2 cabin crew members slightly injured, during the evacuation

Investigating body

Gabinete de Prevenção e Investigação de Acidentes com Aeronaves (Aviation Accidents Prevention and Investigation Department, Portugal)

Final report

22/ACCID/GPIAA/2001

Report date

18 October 2004

Report title

Accident Investigation Final Report: All Engines-out Landing Due to Fuel Exhaustion, Air Transat, Airbus A330-243 marks C-GITS, Lajes, Azores, Portugal, 24 August 2001

On 24 August 2001 Air Transat flight TSC236, an Airbus A330-243 registered C-GITS, was crossing the Atlantic from Toronto to Lisbon with 13 crew members and 293 passengers when it began to lose fuel through a cracked fuel tube on its right engine. The crew took the first symptom for a fuel imbalance and opened the crossfeed, which sent fuel from the healthy left tanks to the leak. Both engines flamed out, and the captain glided the aircraft to a night landing at Lajes on Terceira Island in the Azores. No one was killed; two passengers were seriously injured in the evacuation.

Portugal's Gabinete de Prevenção e Investigação de Acidentes com Aeronaves (GPIAA) traced the leak to an engine change carried out a week earlier, in which parts of two different modification standards had been fitted side by side. It found that the crew never concluded that they had a fuel leak, and that not carrying out the FUEL LEAK procedure was the key factor in the fuel exhaustion.

The case is taught for its two halves: how a maintenance error and a misdiagnosis in the cockpit turned a leak into a double engine failure, and how a wide-body jet was flown for about 19 minutes without engine power to a safe landing. All times are UTC.

The flight

C-GITS, serial number 271, was built in 1999 and powered by two Rolls-Royce Trent 772B engines. It took off from Toronto at 00:52 with 46.9 tonnes of fuel according to its flight data recorder; the flight plan included 5.5 tonnes more than regulations required, carried for cost reasons and to cover rerouting on the North Atlantic tracks. Air Transat's approval allowed its A330s to fly up to 150 minutes, at 427 kt true airspeed, from an adequate aerodrome.

The captain, aged 48, had 16,800 hours, 796 of them on the A330, and was pilot flying. The first officer, aged 28, had 4,800 hours, 386 of them on type. Their training records showed no shortcomings. At Lajes the weather was good: wind 350° at 13 kt, visibility unlimited, and a few clouds at 2,400 ft.

The engine change

In mid-August metal particles were found twice in the oil system of the right engine, and Air Transat decided to replace it. Its own spare was unavailable, so it installed an engine lent by Rolls-Royce. The rear hydraulic pump taken from the old engine would not fit the replacement, because it interfered with the fuel pump inlet tube already installed. The replacement engine was in a configuration from before service bulletin RB.211-29-C625, and the removed one in the configuration after it.

The lead technician could not reach the service bulletins from the available terminals and followed verbal advice to fit only the rear fuel tube from the old engine. The result was a post-modification pump and fuel tube next to a pre-modification hydraulic tube. A clearance between the tubes was obtained by applying force, but once the hydraulic line was pressurised it returned to its natural position against the fuel tube. After 67.5 flight hours, the fuel tube failed in high-cycle fatigue, with a crack about 80 mm (3.0 in) long, and leaked at up to about 13 tonnes per hour.

The accident

The leak began at 04:38. At about 05:03, after crossing 30° West, the crew noticed unusual oil indications on the right engine: an oil temperature of 65 °C against 110 °C on the left engine, a higher oil pressure and a lower oil quantity. Rolls-Royce later showed that the high fuel flow through the fuel/oil heat exchanger, upstream of the leak, had cooled the oil. The readings were within limits, and the crew spent time with manuals and with the company's maintenance control centre trying to explain them.

In the cabin, the flight director had flight attendants look for vapour behind the wings with the cabin lights off; they saw nothing. The cabin was prepared for a ditching. After the second flameout the normal lighting failed and the emergency lighting came on, and about five minutes later the passenger oxygen masks dropped as cabin pressure was lost.

With both engines stopped, the ram air turbine powered the green hydraulic system and the emergency generator. The crew lost the flight management system and navigated with the Lajes VOR and radar ranges from Lajes Approach, which flashed the runway lights. Flight control protections were degraded, most spoilers and the electric pitch and rudder trim were lost, and there was no anti-skid braking. The aircraft reached a point about 8 miles from runway 33 at about 13,000 ft, so the captain flew a 360° turn to the left and then S-turns on final to lose height, lowering the slats and the landing gear.

The A330 crossed the threshold at about 200 kt, touched down hard, bounced, and touched down again well beyond the normal touchdown zone. The captain applied and held maximum braking, since the emergency accumulator allowed only limited brake applications, and the aircraft stopped 7,600 ft from the approach end of the 10,000 ft runway on locked, deflated wheels. Small fires around the left main gear were put out at once by the waiting fire crews. The evacuation took about 90 seconds; one exit, L3, opened only 20 to 25 cm.

The investigation

Maintenance: a single layer of defence

Neither the receipt of the loaned engine nor the planning of the engine change identified the difference in configuration, leaving the technicians as the only defence. Time pressure, the difficulty of reaching the service bulletin (a computer fault prevented access to the parts catalogue CD) and the apparent knowledge of the engine specialist who advised him led the lead technician to curtail his search. The post-installation checks did not specifically cover the pump, hydraulic tube and fuel tube, and the installation of the fuel line was not recorded in the log. The GPIAA also noted that the risk of forcing clearance between mixed-standard lines was not well known in the maintenance community.

Why the leak went unrecognised

From 04:38 to 05:33 the cockpit showed only subtle signs: fuel on board and the estimated fuel at destination falling, and a trim tank transfer memo that stayed on for 19 minutes. The final forward transfer of 3.2 tonnes from the trim tank into the right wing delayed the imbalance advisory by about 15 minutes and masked the loss. The GPIAA concluded that, given how subtle these indications were, and with the crew occupied by the oil readings, it was highly unlikely that they would become aware of the fuel anomaly in that period.

The imbalance advisory itself required no immediate action and displayed no procedure. The captain carried out the FUEL IMBALANCE procedure from memory, and so missed its caution note: if a leak is suspected, apply the FUEL LEAK procedure. A fuel leak was not monitored by the ECAM at all, so the FUEL LEAK procedure depended on the crew recognising the leak. Just after opening the crossfeed the crew saw that fuel on board was 7 tonnes lower than predicted, checked the fuel documents for errors, found none, and, with no ECAM warning, no other engine symptom and nothing seen from the cabin, came to suspect a computer malfunction. Neither pilot had ever met a fuel leak in operation or in training.

Workload was very high. The diversion had to be planned, and more than 10 minutes were spent on high-frequency radio calls with the maintenance control centre, while the ECAM actions for the low wing tank levels were not carried out. The crew considered the FUEL LEAK procedure during the diversion but discounted the LEAK NOT FROM ENGINE branch because it would require a descent. Had that procedure been started before 05:54, closing the crossfeed would have saved the left tank fuel.

The GPIAA calculated what would have happened from 05:45 under different actions:

In every case the aircraft would have reached Lajes with an engine running. Opening the crossfeed was what put the left tank fuel at risk.

The engines-out glide

The GPIAA found the crew's response to the engine failures and their checklists in line with the operating manual, and their work with the cabin crew and air traffic control "professional and highly effective". The captain, who had never been trained for a gliding approach, flew at night with few instruments and limited pitch authority; the GPIAA called his handling "remarkable" and found his decision to hold maximum braking justified. The first officer "provided full and effective support".

Recorders and cabin

Only two of the three recorder circuit breakers were pulled after landing, so 90 minutes of the cockpit voice recording were overwritten. The recorders had also lost power after the second flameout, so the last 19 minutes of the flight were not recorded. The GPIAA also found oxygen container doors that did not open, an oxygen regulator still fitted with its maintenance pin, and some life jackets of the wrong type.

Probable cause and contributing factors

The GPIAA's findings as to causes and contributing factors include:

• The replacement engine arrived in a configuration the operator had not met before, and neither engine receipt nor engine change planning identified the differences.
• The lead technician relied on verbal advice rather than the service bulletin, and the post-modification fuel tube was fitted with the pre-modification hydraulic tube. Their contact caused "the fracture of the fuel tube and the fuel leak, the initiating event that led to fuel exhaustion."
• The crew did not detect a fuel problem until the fuel advisory, and "did not correctly evaluate the situation before taking action."
• They "carried out the fuel imbalance procedure from memory, which resulted in the fuel from the left tanks being fed to the leak in the right engine."
• Despite other indications of a major fuel loss, the crew did not conclude that there was a leak: "not actioning the FUEL LEAK procedure was the key factor that led to the fuel exhaustion."

Among its findings as to risk, the GPIAA recorded that "The Captain's skill in conducting the engines-out glide to a successful landing averted a catastrophic accident and saved the lives of the passengers and crew."

Safety recommendations and what changed

Action followed quickly. Transport Canada suspended Air Transat's A330 ETOPS authority, audited the company, had Canadian operators inspect their A330s and, on 7 September 2001, issued an advisory circular on recognising fuel leaks. Airbus and Rolls-Royce required or recommended inspections of the clearance between fuel and hydraulic lines on Trent 700 engines, which the UK CAA made mandatory. Airbus released a service bulletin activating a FUEL FU/FOB DISCREPANCY caution, which alerts the crew when fuel on board plus fuel used differs from the initial fuel on board by more than 3,500 kg. France's DGAC recommended it and, by airworthiness directive, amended the A330 FUEL LEAK procedure from 23 November 2002. Air Transat added fuel leak scenarios to its training and standardised waypoint fuel checks.

The GPIAA's recommendations, AA/2004 to AL/2004, asked authorities to:

• mandate the fuel-used/fuel-on-board discrepancy caution on all A330s, and fuel loss alerts on similar Airbus types, and review fuel loss warnings on other types;
• ensure fuel leak information in manuals and checklists, and require fuel leak training for crews;
• review automatic fuel transfer systems so that abnormal transfers are detected, inhibited and annunciated to the crew;
• make fuel leak procedures a priority in major imbalances, and consider merging the Airbus FUEL IMBALANCE and FUEL LEAK procedures;
• give crews guidance on safeguarding recorders, and consider independent power for recorders;
• ensure that the configuration of major components is determined and compared before installation.

Lessons for pilots

A large imbalance may be a leak. The GPIAA noted that an imbalance of the 3-tonne size needed to trigger the A330's fuel advisory would only likely occur with a significant fuel leak. Before opening the crossfeed, compare fuel on board plus fuel used with the fuel at departure. See in-flight fuel management.

Read the procedure, including the notes. The FUEL IMBALANCE procedure contained the one line that pointed to the right answer, and it was lost by doing a read-and-do procedure from memory.

Test your explanation against every indication. The oil readings, the falling fuel and the premature trim tank transfer were all symptoms of one leak. When the crew's theory was a computer error, each new indication was explained away. A diagnosis that leaves symptoms unexplained is incomplete.

Plan the diversion with the worst case in mind. An ETOPS alternate within reach is the reason a twin can cross an ocean; see ETOPS. Each alternative the GPIAA examined, including leaving the imbalance alone, would still have brought the aircraft there with an engine running.

Know how to glide your aeroplane. Best glide speed gives the greatest distance; a slower speed nearer minimum sink keeps the aeroplane airborne longer but covers less ground. The captain, sure of reaching the runway, flew between the recommended glide speed and the stall warning speed, then used a 360° turn and S-turns to lose the surplus height, staying below 200 kt for gear extension and above the 140 kt minimum for ram air turbine operation. Expect reduced pitch authority, no electric trim and limited braking. See range, endurance and gliding.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.