After two years flying the KC-135A tanker, I believed every fuel panel in my future was going to be easy by comparison. That ended up being true. But that doesn’t mean fuel management has become risk free.
— James Albright
Updated:
2026-05-01
Did you hear the one about the two Gulfstream test pilots who were flying a Gulfstream G650 on its maiden flight and ended up landing with only 50 pounds of fuel in the tanks? I was in recurrent training when we got a fuel leak in one of the engines and had to shut the engine down. Our instructor was impressed that we didn’t hesitate. My sim parter, a Gulfstream test pilot, told us about the 50-pound landing. He said the pilots knew the leak was from an engine and new it would be a race to get the airplane on the ground but still refused to shut down the engine. He said he would never make that same mistake. I’ve had a few fuel leaks over the years, but only once from an engine. If the checklist says shut the engine down and you’ve got another, it seems like a no brainer. You have a brain, use it. Perhaps a few examples are in order.
1
Air Transat 236
Air Transat 236, (FAA public domain)
The case of Air Transat 236 reminds me of the old Air Force story of a fighter pilot on a cross-country trip who flames out his only engine at altitude and manages to land the airplane at an emergency field with not so much as a scratch. His commander says, “Nice job landing the airplane without a drop of fuel, lieutenant. Now explain to me the part about not having a drop of fuel.”
Date: August 24, 2001
Time: 0645 UTC
Type: Airbus A330-243
Operator: Air Transat
Registration: C-GITS
Fatalities: 0 / 13 crew, 0 / 306 passengers
Aircraft Fate: Repaired
Phase: En route
Airport (Departure): Toronto-Pearson International Airport, ON (CYYZ)
Crew Actions
On August 24, 2001, Air Transat Flight TSC236, an Airbus 330-243 aircraft, was on a scheduled flight from Toronto Lester B Pearson Airport, Ontario (CYYZ), Canada to Lisbon Airport (LPPT), Portugal with 13 crew and 293 passengers on board. The Captain was carrying out the pilot flying (PF) duties for this flight. TSC236 was planned to depart CYYZ at 00:10 UTC, with 47.9 metric tons of fuel, which included 5.5 tons over and above the fuel required by regulations for the planned flight; the actual take-off time was at 00:52 with a reported 46.9 tons of fuel on board. According to the crew, the flight progressed normally until after crossing 30° West and at 05:03 when they observed unusual engine oil indications on the Number 2 (right) engine (Rolls-Royce RB211 Trent 772B). The Engine Electronic Centralized Aircraft Monitoring System (ECAM) page was manually selected by the crew, and the oil indications were communicated by high-frequency (HF) radio to the dispatcher at the company's Maintenance Control Centre (MCC) at Mirabel Quebec, Canada.
Source: Portugal Accident Investigation Final Report, §1.1.1
The engine oil indications were the unusual combination of low oil temperature, low oil quantity, and high oil pressure. They assumed the issue was a computer indication problem, not an engine problem.
At approximately 05:33, an advisory ADV message was displayed on the Engine/Warning Display (EW/D). The crew noticed the ADV and deselected the ENGINE ECAM page. This action resulted in the Fuel ECAM page being displayed and the crew becoming aware of a fuel imbalance between the left and right inner-wing tanks. To correct the imbalance, the crew selected the cross-feed valve OPEN and the right-wing fuel pumps OFF in order to feed the right engine from the left-wing tanks.
Source: Portugal Accident Investigation Final Report, §1.1.1
The fuel logs had shown normal fuel burns during the first four hours of the flight; the last normal reading having taken place at 04:57.
The crew stated that, although indications of a lower-than-expected fuel quantity were recognized shortly after receiving the fuel imbalance ADV, they did not consider the FUEL LEAK procedure until later in the flight.
Source: Portugal Accident Investigation Final Report, §1.19.2.2
Pilots who grew up flying large aircraft with fuel pumps with inconsistent output were used to accomplishing fuel cross-feed procedures from memory. (We did it so often.) But pulling out the checklist might remind you of something you’ve forgotten (or never knew.) Two cardinal rules of transferring fuel between tanks should be (1) make sure the fuel imbalance isn't being caused by a leak so you can avoid "feeding the leak," and (2) confirm the fuel is getting to where it should be going. In this case, the fuel leak was in the engine itself, and the cross-feed was indeed feeding the leak.
Shortly thereafter, the crew became aware that the fuel remaining on board was only 11 tons, or 8.5 tons below the expected amount of fuel. According to the crew, both the imbalance and fuel quantity indications were unusual and unexplainable. Neither of the pilots had ever encountered a fuel leak or an unexplained low fuel quantity either in training or in flight.
Source: Portugal Accident Investigation Final Report, §1.19.3.3.
In my view, missing this much fuel should telegraph to the pilots they had a problem. Even if they rationalize that it is an indication problem, further investigation is needed. It took them nearly an hour more to come to this realization.
Aftermath
At 05:45, the fuel on board had reduced to below the minimum required fuel on board to reach Lisbon, and the crew initiated the diversion to Lajes Airport (LPLA) on Terceira Island in the Azores. By 05:48, the crew advised Santa Maria Oceanic air traffic control that the flight was diverting due to a fuel shortage; the fuel on board had reduced to 7.0 tons. In attempts to resolve the sudden and unexplained reduction in the fuel quantity readings, the crew asked the cabin crew to visually check the wings and engines for a possible fuel leak: the visual check did not reveal any evidence of a fuel leak.
At 05:54, in reaction to the continued abnormally high rate of reduction in the fuel-on-board quantity reading, the crew selected the right-wing fuel pumps to ON and the left-wing pumps to OFF. These selections established cross feed of the fuel in the right wing tanks to both engines. According to the crew, the cross feed from the right tank was established to use up the fuel from the right wing and to counter the possibility that the fuel loss was the result of a leak in the right wing tanks.
Source: Portugal Accident Investigation Final Report, §1.1.1
This did not have the desired effect, since the right engine continued to consume fuel and, more importantly, spew the fuel overboard as it had been doing. The correct action would have been to shut the engine down.
The crew stated that because there were no other signs of a fuel loss, other than the lower than expected quantity of fuel on board, and because there had been no other ECAM warnings or cautions both pilots believed that the problem was a computer fault. They also stated that although they had used the term "fuel leak" on many occasions during the occurrence, a logical link to considering the FUEL LEAK check and the possibility that the fuel leak existed did not occur until the aircraft indicated fuel quantity was about 7 tons.
Source: Portugal Accident Investigation Final Report, §1.19.3.5
If the problem was indeed with the computers, no fuel transfer would have been needed and they could have verified the imbalance with lateral trim requirements.
At 06:13, when the aircraft was at FL 390 and 150 miles from Lajes, the right engine flamed out. The crew notified Santa Maria control that the engine had flamed out and that the flight was descending. At 06:15, the crew reported to air traffic control that the fuel on board had reduced to 600 kilograms. At 06:23, the First Officer declared a "Mayday" with Santa Maria Oceanic Control, and at 06:26, when the aircraft was 65 nautical miles from the Lajes airport and at an altitude of about FL 345, the left engine flamed out. The ALL ENG FLAME OUT procedure was completed by the crew and an engines-out descent profile was flown towards Lajes.
At 06:31, the flight was transferred to Lajes Approach Control. Assisted by radar vectors and flashing of the runway lights, the aircraft arrived about 8 miles off the approach end of runway 33 at approximately 13,000 feet on a track of about 270°. The Captain advised Lajes that he was conducting a left 360-degree turn in order to lose altitude. During the turn, the aircraft was configured with leading-edge slats out and landing gear down for the landing. S-turns were conducted on final to lose additional altitude.
At 06:45, the aircraft crossed the threshold of runway 33 at about 200 knots, touched down hard 1,030 feet down the runway, and bounced back into the air. The second touchdown was at 2 800 feet from the approach end of the runway, and maximum braking was applied. The aircraft came to a stop 7,600 feet from the approach end of the 10,000-foot runway. After the aircraft came to a stop, small fires started in the area of the left main-gear wheels, but these fires were immediately extinguished by the crash rescue response vehicles that were in position for the landing. The Captain ordered an emergency evacuation. Fourteen passengers and two cabin-crew members received minor injuries, and two persons received serious injuries during the emergency evacuation. The aircraft suffered structural damage to the fuselage and to the main landing gear.
Source: Portugal Accident Investigation Final Report, §1.1.1
Investigation
Right engine fuel and hydraulic lines, [Portugal Accident Investigation Final Report, §1.6.3.]
Investigators determined that when Air Transat replaced the aircraft’s right engine 7 days prior to the accident flight, the engine they used was of an “unexpected pre-SB configuration to which the operator had not previously been exposed.” [Portugal Accident Investigation Final Report, §3.1]
The engine change, which commenced at midnight on 17 August 2001, proceeded normally up to the point when it was discovered that the rear hydraulic pump (P/N: 974800), taken from the removed engine, could not be fitted onto the replacement engine due to an interference with the high pressure fuel pump inlet tube (P/N: FK12446) already on the engine.
A search through the Airbus Illustrated Parts Catalogue (IPC) revealed the existence of a Service Bulletin (SB) RB.211-29-C625. It was then realized that the loaned engine, last certified by Hong Kong Aero Engine Services Limited, was in a pre-SB configuration, and the engine being replaced was in a post-SB configuration. The technician leading the engine change could not access the SB's from the available computer terminals, and accepted advice from the maintenance-engineering department that only the rear, fuel tube from the engine being replaced needed to be used. According to the technicians, a clearance between the fuel and the adjacent hydraulic tube was obtained.
Source: Portugal Accident Investigation Final Report, §1.1.3
Later investigation revealed "scratches and scores were directionally aligned and that they would have been caused by repeated contact from a blunt instrument, such as a screwdriver being inserted between the tubes in order to force clearance between them.
Source: Portugal Accident Investigation Final Report, §1.16.2
The flight crew did not detect that a fuel problem existed until the Fuel ADV advisory was displayed and the fuel imbalance was noted on the Fuel ECAM page.
The crew did not correctly evaluate the situation before taking action.
The flight crew did not recognize that a fuel leak situation existed and carried out the fuel imbalance procedure from memory, which resulted in the fuel from the left tanks being fed to the leak in the right engine.
Conducting the FUEL IMBALANCE procedure by memory negated the defence of the Caution note in the FUEL IMBALANCE checklist that may have caused the crew to consider timely actioning of the FUEL LEAK procedure.
Although there were a number of other indications that a significant fuel loss was occurring, the crew did not conclude that a fuel leak situation existed – not actioning the FUEL LEAK procedure was the key factor that led to the fuel exhaustion.
Source: Portugal Accident Investigation Final Report, §3.1
fuel_balance_procedure_final_report_figure_7.jpg)
A330 Fuel Imbalance Procedure, [Portugal Accident Investigation Final Report, figure 7]
Updated procedure (From revised A330 QRH)
I think the caution warning of a fuel leak in the version of the QRH the pilots were using was adequate, if only they had used it! The revised QRH even provides a common sense formula.
Lessons
As obvious as it may seem, the revised A330 QRH gives us a formula to determine if we have a fuel leak: The fuel on board plus the fuel used should add up to being close to the fuel on departure. The ambiguity, however, is where do you determine the fuel used? If your Flight Management System simply reports what has happened from fuel flow, that might not work. I suggest you simply compare the predicted fuel on board from your flight plan against the actual fuel on board.
As aircraft become increasingly automated and computer-driven, it is all too easy to explain the unexplainable by dismissing the computers. That makes it all the more vital to hold your conclusions to the same skepticism as you are tempted to do with the computers.
Even the simplest procedures on complicated airplanes hold complications of their own. You may have the button presses and switchology memorized for things like a simple fuel transfer, but having the discipline to consult the book so you can do it, “by the book,” can save you from becoming a no-notice glider pilot.
2
TAM Airlines 3804
The Fokker 100, operated by TAM Airlines, departed Sao Paulo-Guarulhos International Airport with a crew of five and 24 passengers. During cruise at FL 350, the “FUEL FILTER” and “FUEL PRESSURE LOW” warning lights on the right engine illuminated. [CENIPA Final Report, para. I.]
Date: August 30, 2002
Time: 1050 Local
Type: Fokker 100
Operator: TAM Airlines
Registration: PT-MQH
Fatalities: 0 / 29 occupants
Aircraft Fate: Destroyed
Phase: En route
Airport (Departure): Sao Paulo-Guarulhos International Airport, Brazil (SBGR)
Crew Actions
According to the Centro de Investigacao e Prevencao de Acidentes Aeronauticos (CENIPA) investigation:
j. the crew executed the procedures prescribed in the QRH for both malfunctions;
k. it was not clear to the crew what type of malfunction had occurred;
l. a few minutes later, a “Fuel Asymmetry” warning occurred, indicating fuel imbalance between the wings;
m. after the imbalance warning, the crew identified that a fuel leak was occurring;
n. there were no emergency procedures in the QRH for an in-flight fuel leak;
o. after evaluating meteorological conditions, the crew chose to proceed to Araçatuba aerodrome;
Source: RF026/CENIPA/2005, para. V.1
I have a copy of the Fokker 100 AOM that was in use at the time, but not the QRH. The AOM does not have procedures for the FUEL FILTER and FUEL PRESSURE LOW warnings, but I think we can take the CENIPA report for its word that the crew accomplished the procedures. As for the FUEL ASYMMETRY warning, there is an AOM procedure which incredibly does not warn of the possibility of a fuel leak or the need to shut down an engine if the leak is coming from the engine.
Fuel Management Abnormal Procedure (Fokker 100 AOM, p. 4.06.01
Aftermath
p. descent from FL350 was initiated; with the aircraft leveled at 1,639 ft and 18 NM from Araçatuba, the engines flamed out;
q. a forced landing was performed in an open area 16 NM from Araçatuba, in the municipality of Birigui;
y. during landing, the aircraft struck and killed a cow and broke a barbed-wire fence;
z. after the aircraft came to a complete stop, the crew carried out evacuation procedures;
aa. four passengers sustained minor injuries; the others and the crew were uninjured; and
bb. the aircraft sustained damage.
Source: RF026/CENIPA/2005, para. V.1
Investigation
Investigators discovered that the line connecting from the right engine’s low-pressure fuel to the fuel flow meter and then to the high-pressure fuel pump was disconnected at the high-pressure fuel pump. The metal retainer of the tube had worn the inner shoulder of the retaining plate, which secured the tube to the high-pressure fuel pump. Macroscopic inspection showed wear on both the fuel tube and the retaining ring of the retaining plate. There was visible wear around the entire contact surface of both components. Investigators surmised that the tube was not properly secured at both ends. They believe the wear was a flight-hours-dependent function, not a flight-cycle-dependent one. [RF026/CENIPA/2005, para. 3.
Investigators found that “maintenance services were considered adequate and periodic.” [RF026/CENIPA/2005, para. V.1]
I question the report’s finding that there was nothing wrong with maintenance services. If the fuel lines can wear as they discovered, either the lines as installed need to be altered or inspection intervals need to be increased.
Lessons
The primary takeaway from this incident has more to do with “professional pilot sense” than it does with fuel systems or abnormal procedures. If you are a professional pilot, you should be aware of as much of the world of aviation as you can, with special emphasis on anything that is even remotely similar to the aircraft and operations you fly. These Fokker 100 pilots didn’t have a fuel imbalance procedure that warned them to consider the possibility of fuel exhaustion because of a fuel leak in an engine. But had they been aware of the Air Transat fuel exhaustion from a year earlier, they might have been better prepared to deal with their incident. Of course they didn’t have that opportunity, since the Air Transat report didn’t come out until nearly three years after the incident. But you do have that opportunity, now two decades later.
3
British Airways 762
British Airways 762 evacuation,(AAR 1/2015, figure 20)
When you fly for a nation’s “flag carrier,” it is nice to know the government has your back. Okay, perhaps that’s going a step too far. British Airways is not officially designated as the UK’s flag carrier, but they do fly the UK flag (the Union Jack) on their aircraft, and they evolved from state-linked airlines (BOAC and BEA). But the government’s official Aircraft Accident Report (AAR) Summary gives the pilots here a complete pass:
During takeoff from Runway 27L at London Heathrow Airport, the fan cowl doors from both engines detached from the aircraft, damaging the airframe and a number of aircraft systems. The flight crew elected to return to Heathrow and on the approach to land on Runway 27R, leaking fuel from a damaged fuel pipe on the right engine ignited and an external fire developed. The left engine continued to operate satisfactorily throughout the flight. The right engine was shut down promptly, reducing the intensity of the fire, and the aircraft landed safely.
Source: AAR 1/2015, p. 1
As we shall see, the word “promptly” is subject to a very loose definition. The timing could have been catastrophic. If you dig into the report, you see the captain made up his mind early that he wouldn’t shut down the engine, even as directed by the emergency procedure. I must acknowledge that these pilots brought the airplane back safely and there were no fatalities. But, as always, we are here to learn so we can do better.
Date: May 24, 2013
Time: 0716 UTC
Type: Airbus A319-131
Operator: British Airways Plc
Registration: G-EUOE
Fatalities: 0 / 5 crew, 0 / 75 passengers
Aircraft Fate: Damaged but returned to duty
Phase: Takeoff
Airport (Departure): London Heathrow Airport (EGLL), United Kingdom
This was the aircraft’s first flight of the day following scheduled overnight maintenance which required opening of the fan cowl doors on both engines. The pilots reviewed the aircraft technical log together; the commander then began preparing the flight deck, while the copilot carried out the aircraft external walk-around checks. The copilot observed nothing unusual during his external checks. [AAR 1/2015, para 1.1.1]
The airline’s operation staff was taking a sequence of photos for a training video and captured the unlatched outboard cowl door on the right engine just prior to the flight:
G-EUOE right engine, outboard fan cowl door, showing gap with nose cowl (AAR 1/2015, figure 1)
The aircraft took off at 0716 UTC with the copilot acting as Pilot Flying (PF) and the commander as Pilot Monitoring (PM). During the takeoff roll, some passengers witnessed the fan cowl doors on both engines opening and being forcefully detached from the engines. [AAR 1/2015, para. 1.1.2]
The Senior Cabin Crew Member (SCCM) attempted to call the flight deck, but since they were still below 1,000 ft. AGL, the captain decided to concentrate on his duties as PM. [AAR 1/2015, para. 1.1.3]
Crew Actions
As the aircraft climbed through the acceleration altitude of 1,100 ft, Autopilot 2 was engaged and the copilot moved the thrust levers to the CLIMB detent. One second later the autothrust disengaged and the master caution activated. The flaps were retracted as the aircraft accelerated to the target climb speed of 250 kt. After confirming that both engines appeared to be operating satisfactorily, the crew continued climbing the aircraft on the SID track to the first cleared altitude of 6,000 ft. The copilot reported to the commander that he could see damage to the leading edge of the right wing. [AAR 1/2015, para. 1.1.3]
The Electronic Centralised Aircraft Monitor (ECAM) displayed an ENG 2 EPR fault and the commander noted the No 2 (right) Engine Pressure Ratio (EPR) gauge was blank. He followed the ECAM actions. Four seconds later the master caution sounded again, with the ECAM indicating a yellow hydraulic system loss. (The yellow system is primarily a backup for the primary “green” system and provides for alternate brakes, nosewheel steering, and some flight controls.) The commander turned off the Power Transfer Unit (PTU), in accordance with procedures, and the flight crew began reviewing the situation. [AAR 1/2015, para. 1.1.4]
At 0720:20 hrs, after being transferred to the Departure radar frequency, the commander declared a PAN (urgency) to ATC, reporting that the aircraft had an engine problem and had lost a hydraulic system. He requested radar vectors and informed ATC that the aircraft would be returning to Heathrow. [AAR 1/2015, para. 1.1.4]
As the pilots started to apply the operator’s decision-making aid T-DODAR,[A mnemonic for Time, Diagnose, Options, Decide, Assign, Review] the ECAM fuel imbalance alert activated. The copilot immediately identified this as a probable fuel leak; ten seconds later the commander requested vectors to the ILS for 27R. [AAR 1/2015, para. 1.1.4]
Aftermath
0729:28 hrs, an ECAM fuel imbalance warning occurred. [AAR 1/2015, para. 1.11.2.4]
The QRH fuel leak procedure required the right engine to be shut down and, given the location of the damaged fuel pipe, this would have isolated the fuel leak, preventing the fire. The commander, however, decided that shutting down the right engine would have exposed the aircraft to an unacceptable risk, as the condition and degree of damage to the left engine was unknown and there was no certainty of its continued operation. The commander had the authority to override the SOPs and, regardless of the outcome, his reasoning was valid.
Source: AAR 1/2015, para. 2.6.5
I’m not sure the commander’s decision was valid given there “was no certainty” of the left engine’s continued operation. There was also no certainty of the aircraft’s continued ability to remain in flight given the fuel leak and damage to the right wing as reported by the first officer. They waited an additional ten minutes from the time they were aware of the fuel leak until the fire warning.
0739:27 hrs, an ECAM ENG 2 FIRE warning occurred, and the crew shut down the right engine. [AAR 1/2015, para. 1.11.2.5]
0743:51 hrs, the aircraft landed and was brought to a stop. [AAR 1/2015, para. 1.11.2.7.3]
Investigation
Investigators looked into why the maintenance team opened the cowl doors prior to flight, how they forgot to latch them closed, and how the first officer missed them during his preflight inspection. These are important points, but my focus is on the dangers of delaying the engine shutdown after discovering the fuel leak and to do that, I need to cover how the engine fire began.
The manner in which the fan cowls released from the engines during aircraft rotation varied between the two engines. Both cowls on the left engine failed across their full width, just below the hinge line. This resulted in them releasing from the pylon cleanly, without causing additional damage to the engine. The cowls on the right engine also failed just below the hinge line but the inboard cowl broke into a number of sections. One of the larger pieces rotated backwards and upwards in the airflow around the engine and became lodged on the fan case. A smaller section of cowl, incorporating the aerodynamic strake, had also initially rotated upwards in the airflow, before rotating downwards with some force, causing the strake to puncture the FMU spill return pipe, creating a fuel leak.
Source: AAR 1/2015, para. 2.2
Investigation revealed that at 0718:09 hrs, a fuel leak began at an average rate of 61 kg/min and then increased to an average of 127 kg/min. [AAR 1/2015, para. 1.11.2.4]
Investigators believe the right engine cowl damaged the P2/T2 probe heat and that arcing occurred between the power supply loom and pylon forward fairing. The temperature within the arc was well above the auto-ignition temperatures for Jet A1 fuel. [AAR 1/2015, para. 2.2.]
At time 0729:28 hrs, nearly eleven and a half minutes after the leak started, the flight crew were alerted to a fuel imbalance when a total of 1,500 kg of fuel had leaked overboard, the quantity required to generate the ECAM fuel imbalance warning. [AAR 1/2015, para. 1.11.2.4]
G-EUOE flight routing and timeline, [AAR 1/2015, figure 15]
Had the leaking fuel not ignited, or had the fuel leak been isolated sooner, there would have been no fire and the event would have been relatively benign. However, an external fire broke out on the right engine when the aircraft was already established on approach to land back at Heathrow. The immediate risk posed by the fire, at such a late stage, meant that a landing at Heathrow was the safest option.
Source: AAR 1/2015, para. 2.6.4
“Had the leaking fuel not ignited . . . there would have been no fire.” That is not the lesson to learn here.
Lessons
As captains, we do have the authority to overrule Standard Operating Procedures. In the heat of battle, it is easy to believe you have all the pertinent information and your judgement is sound. But is that really true? Consider that the SOPs were devised given the knowledge of the manufacturer and the experiences of all who came before you. There is no doubt shutting down one of two engines is a big decision. But keeping a suspect engine running also carries risks. As I’ve said many times before: do things for a reason, and make it a good reason.
4
Air France 736
I’ve had to face shutting an engine down while in flight a number of times and several times when I wasn’t the Pilot in Command (PIC), I faced a brick wall who refused to shut down the engine despite the clear and present danger of leaving the engine running and the unambiguous direction of the manuals. In each case I got my way and in one of those the PIC received a safety award for shutting down an engine about to explode on us.
Shutting an engine down when you only have two can be traumatic, I get it. There may be times when your PIC judgement has to overrule the books. But if you are saying you know better than the manufacturer and everyone who came before you, you are out on a limb. This is especially true when history is against you too. Unlike the earlier A330 case of Air Transat 236, this crew had unambiguous guidance in their manuals and nearly twenty years of extra history on the airframe. And yet they risked becoming a no-engine aircraft because they feared being a single-engine aircraft.
Date: December 31, 2020
Time: 2335
Type: Airbus A330-200
Operator: Air France
Registration: F-GZCJ
Fatalities: 0 / 147 occupants
Aircraft Fate: None
Phase: En route
Airport (Departure): Brazzaville-Maya Maya Airport (FCBB)
Airport (Planned Arrival): Paris-Charles de Gaulle Airport (LFPG)
Airport (Actual Arrival): N’Djamena International Airport, Chad (FTTJ)
The crew took off at 21:13 from Brazzaville airport, Republic of Congo bound for Paris-Charles de Gaulle. The total quantity of fuel on board was 45.5 tons. The crew consisted of a captain, a copilot, a relief pilot and eight cabin crew. On take-off, the captain was the PM, the copilot was the PF, and the relief pilot was in the cockpit observer seat. The take-off and climb were carried out without incident. [BEA 2021-0001, para. 1.1]
Flight path (BEA 2021-0001, figure 1)
Thirty-five minutes after taking off, once level at FL380, the captain observed that they were lacking 1.4 tons of fuel without this creating a visible lateral imbalance between the fuel tanks. He shared this information with the copilots and left the cockpit for his rest period a few minutes later, asking the two copilots to monitor the fuel. Around twenty minutes later, the copilots called him back, saying they were lacking around 2.1 tons of fuel with a difference in weight of about 400 kg between the two inner tanks. This pointed to a possible leak on the left side, the engine 1 side. [BEA 2021-0001, para. 1.1]
The Crew
The captain joined Air France in 2002 after a career as a military pilot, had a total of 12,399 flight hours of which 3,852 were in type. The copilot joined Air France in 2016 after a career as a military pilot, had a total of 5,656 flight hours of which 550 were in type. The relief pilot joined Air France in 2016 after a career as a miliary pilot, had a total of 4,800 flight hours of which 803 were in type.
All three pilots received FUEL LEAK training, but only the captain received it in the A330. The copilot and relief pilot received this training in the A320.
Crew Actions
At 2214, the crew started the FUEL LEAK procedure in the QRH, which indicated a diversion must be considered and to shut down the engine. [BEA 2021-0001, para. 1.1]
A330 Fuel Leak Procedure, [BEA 2021-0001, figure 5]
At 22:16, the captain hesitated about shutting down the engine, indicating that if they did, this would be the beginning of “something big.” The captain postponed shutting down the engine for the time required to re-evaluate the actual quantity of fuel that had been lost.
Source: BEA 2021-0001, para. 1.1
The crew discussed the possibility of continuing to Paris and then the advisability of two nearby divert airports. The captain indicated he would like to keep the left engine running until they were down to 5 tons of fuel because he didn’t want the engine to flameout spontaneously. [BEA 2021-0001, para. 1.1]
The FUEL F. USED/FOB DISAGREE alert appeared on the Electronic Centralized Aircraft Monitoring (ECAM) display at 22:48. This alert refers the crew to the FUEL LEAK procedure. The captain deleted the ECAM page, and in the absence of a “STATUS” indication, considered that the alert had been processed. The relief pilot then asked that they agree on the moment when the engine would be shut down. The captain indicated that he preferred keeping the engine in operation for as long as there was fuel available.
Source: BEA 2021-0001, para. 1.1
Throughout the incident, the captain’s only concern seemed to be keeping the engine running until remaining fuel gave him no other options. At no point did the crew consider that the fuel being sent from the engine posed a fire hazard if it were to contact the hot section of the engine, that the fuel leak rate could spontaneously increase and that such an increase could make their diversion plans impossible.
At 23:07, one of the technicians [onboard the flight, in the cabin] informed the crew that there was now a visible streak under the cowling of the engine 1 exhaust nozzle. The captain indicated that this information did not change their action plan and asked for the approach briefing to be started.
Source: BEA 2021-0001, para. 1.1
The crew briefed the approach using the Threat and Error Management (TEM) method. The copilot said his assessment of the threat was a fire breaking out on the ground. The captain replied that the first threat was that they would have to shut down the engine before touchdown but said “the decision as to when to shut down the engine was the copilot’s.” The captain followed that, however, saying they would keep the engine in operation as the remaining quantity of fuel was sufficient to avoid a flame-out. [BEA 2021-0001, para. 1.1]
At 23:18, the FUEL IMBALANCE advisory alert was activated, referring the crew to the FUEL LEAK procedure which involves shutting down the engine concerned. The captain questioned the danger of keeping the engine operative and concluded that it was not specified in the check-list that it had to be shut down and that there was no notion of a possibility of a fire.
Source: BEA 2021-0001, para. 1.1
The relief pilot appeared to question this and then backed down: “specifying that he thought that shutting down the engine was not a bad idea but that it was a good idea to keep it running for the time being because they were in the air and there was no emergency. [BEA 2021-0001, para. 1.1]
Aftermath
The crew briefed that fuel leak procedure specified that reverse thrust could not be used. The landing was on a runway that had 2,410 m. (7,900 ft.) available. The crew monitored a tailwind which moderated to “less than 10 kt.” The copilot landed long, 550 m. (1,800 ft.) beyond the threshold.
Seven seconds after wheel touchdown, the visual and aural warning, BRAKE MAX BRAKING MAX BRAKING was activated and in accordance with the briefing, the thrust reversers were not used. The PF applied full braking on the brake pedals. The temperature of the brakes increased and the BRAKES HOT alert was activated. During the landing run, fuel spilled onto the runway. The relief pilot asked if the engine shutdown was being considered. The captain replied that the engine would be shut down after the turnaround so that it could be carried out in the correct direction in the turnaround bay, with the left engine on the outside of the turn. During the turn, more thrust (around 40% of N1) was then applied to engine 1, the location of the leak.
Source: BEA 2021-0001, para. 1.1
Finally, after making the turnaround, the crew shut down the engine.
Investigation
Engine fuel supply (BEA 2021-0001, figure 3)
As the aircraft taxied, maintenance technicians spotted a “large fuel leak” in line with the drain mast underneath the engine. The source of the fuel leak was found to be the Primary Fuel Hose (PFH). While both ends of the PFH were safety wired, neither was sufficiently torqued and fuel was ejected from both sides of the hose when pressurized. The aircraft had flown seven times since the PFH would have been worked on. [BEA 2021-0001, para. 1.16.1]
During the occurrence, a significant fire hazard existed, especially since the engine compartment in which the leak occurred is a hot area, where engine surfaces often exceed the spontaneous ignition temperature of the fuel.
Source: BEA 2021-0001, para. 2.5
I don’t think the captain ever considered the fuel leak procedure as anything more than a matter of losing fuel:
He indicated that the decision to shut down an engine falls under his prerogative as captain. He differentiated an ECAM checklist from a QRH checklist. In the case of an ECAM, if the procedure is suspended, the ECAM continues to exist, which is not the case with a QRH procedure. He specified that if the FUEL LEAK procedure had been presented on the ECAM, he thought that he would have shut down the engine.
Source: BEA 2021-0001, para. 1.18.1
In my view, the BEA report went out of its way to excuse the pilots. The report acknowledges that the captain didn’t follow the QRH direction to shut down the engine and that the risk of fire was genuine. Still:
The fire risk is not explicitly mentioned in the Airbus’s FCTM for the A330. It is in the FCTM of other manufacturers of aircraft in the Air France fleet including the B777/B787: “There are two reasons for the shutdown. The first is to close the spar valve, which stops the leak. This prevents the loss of fuel which could result in a low fuel state. The second reason is that the fire potential is increased when fuel is leaking around the engine. The risk of fire increases further when the thrust reverser is used during landing. The thrust reverser significantly changes the flow of air around the engine which can disperse fuel over a wider area.”
Soruce: BEA 2021-0001, para. 1.6.6.2
I think the captain’s nonchalance about the fire risk telegraphed to the copilot that this really wasn’t such a big deal, hence the copilot’s long landing. The crew was saved, I think, by the airplane’s ROPS:
Runway Overrun Warning - Runway Overrun Prevention System (ROW - ROPS)
The ROW - ROPS is designed to prevent runway excursions on landing. The system compares the required landing distance, taking into account the actual weight and configuration of the aeroplane with the landing distance available and alerts the crew if the stop distance margin is less than 15% by means of:
- An in-flight RUNWAY TOO SHORT warning which is both visual and oral to incite the crew to consider a go-around.
- A ground MAX BRAKING MAX REVERSE warning which is both visual and oral to incite the crew to increase the braking input.
On the wheels of F-GZCJ touching down at 23:34:27, the ROPS warning, BRAKE MAX BRAKING MAX BRAKING was heard two times on the CVR. Two seconds later, the copilot manually braked more than 2/3 full deflection for 20 s until reaching maximum braking, deactivating the automatic braking which was engaged.
Source: BEA 2021-0001, para. 1.6.7
The report does a good job pointing out a problem with the captain’s leadership style assuring the engine would not be shut down until after landing:
At first sight, the decision appeared to be collective. However, listening to the CVR, and certain elements of the statements suggest a false consensus, especially during the approach and on the ground, and a possible group effect. During the preparation of the approach, the captain indicated to the copilot that the decision to shut down the engine was his, however he concluded the discussion by opting to keep the engine. During the descent, the captain asked whether there was any risk in keeping the engine operating, without giving the copilots the time to answer because he immediately replied to himself, saying that it was not specified in the checklist that it had to be shut down and that the possibility of a fire was not mentioned therein.
The captain’s propensity to express himself first, in a repetitive way, was not conducive to the copilots expressing their opinions and doubts, in particular in their proposal to shut down the engine just after landing and when they evoked the fire hazard.
The discussions thus appeared falsely open insofar as the captain often provided answers to his own questions without taking into account the suggestions made by the copilots.
For their part, apart from the use of the thrust reversers, the copilots did not manage to assert their point of view, in particular with respect to the fire hazard on the ground, nor did they succeed in getting the captain to take a position on when he considered shutting down the engine.
In this situation, which was considered threatening, the search for consensus within the group, and therefore the search to maintain group cohesion, prevailed over the objective evaluation of alternatives.
Source: BEA 2021-0001, para. 2.4
Lessons
The captain expressed an opinion that procedures on the ECAM had to be followed and those in the QRH were subject to his prerogative as captain. “This decision thus created a notable fire hazard and led to a substantial reduction in the flight’s safety margin, the fire having been avoided by chance.” [BEA 2021-0001, para. 5]
I don’t think any of us want to doom our fates to chance and the lessons are painfully obvious. First, while you as captain do have the final say on what procedures you end up following in an emergency procedure, be careful when placing your expertise and experience over those who designed and built the aircraft, as well as all those who came before you. Second, part of your education as a pilot includes all those aircraft accidents and incidents that preceded you. Knowing that a fuel leak has caused multiple high altitude glider incidents, inflight fires, and ground fires, should weigh heavily on anyone considering a fuel imbalance or fuel leak.
References
(Source material)
CENIPA Final Report, PT-MQH, Fokker 100, 30 Ago 2002, Centro de Investigacao e Prevencao de Acidentes Aeronauticos, RF026/CENIPA/2005.
Fokker 100 Aircraft Operating Manual, Issue 003, Jan 05/01.
Incident to the Airbus A330-200 registered F-GZCJ operated by Air France on 31 December 2020 en route, FL 380 (Chad), Bueau d’Enquètes et d’ Analyses pour la sécuritè civile, 2021-0001.
Portugal Accident Investigation Final Report, All Engines-out Landing Due to Fuel Exhaustion, Air Transat, Airbus A330-243 marks C-GITS, Lajes, Azores, Portugal, 24 August 2001.
Report on the accident to Airbus A319-131, G-EUOE, London Heathrow Airport, 24 May 2013, Aircraft Accident Report AAR 1/2015.