The Atlantic Glider. Some final notes

[Lu Zuckerman]

Well the Mayday program dealing with the Atlantic Glider has been shown in Canada and the report made by skydriller on 27 September pretty much covers it. Some of the individuals that saw the program took offense to radio transmission language used by the pilots but I can only assume that with the research that went into the program they used tapes of radio transmissions and just scripted it for the pilot (actors). I may be wrong.

The depiction of the leak was not accurate but they could not gain access to a Trent-700 used by any airline so it seemed correct for non technical viewers

What I am about to say can be taken as rumor since this is a rumor network but I have it on good authority that it is true. This material was presented to the Mayday production team but it was after the production was already in the can so it was not used.

Skydriller indicated in his review that Airbus had blamed the pilots for what went wrong with this information coming from an AD written by Airbus Industrie but it has never been officially released. This AD wrote out in very specific language what actions must be taken by the pilots in the event of a severe fuel imbalance. It was broken down into different sections each dealing with a specific problem some reflecting leakage and others reflecting other problems. In every case before the pilots could take action they had to determine the location of the leak as the operation of the bypass valve would be different for each case. It was shown on the TV program that once the pilots suspected a leak they had to cabin crew try to see if they could detect a leak. They were unable to do so because even with flashlights they could not detect a leak at night. This same condition would exist in detecting a leak according to the unreleased AD. Airbus Industrie also modified the computer program to assist in the combating and detection of a severe leak.

Regarding the release of the official report, it has been complete for some time now. But the reason it has not been released is because the principals of the investigation are at each other’s throats relative to the language of the report and the assessment of blame for the actual leak. Each one is blaming the other. During the program an Air Transat manager indicated that in the exchange of parts mistakes were made and for that Air Transat received a very sever financial penalty. In the installation of the fuel tube the mechanic did not check for clearance between the fuel line and the hydraulic tube. Under normal conditions this critical clearance would be automatic if the lines were installed correctly. However, the fuel line was installed backwards and in doing so the spatial relationship between the two metal lines was compromised.

Herein lies the problem. During the design phase of any complex machine the Reliability engineer will create a checklist and submit it to engineering in order to vet their designs relative to Reliability, Maintainability, and Systems Safety. One of the key requirements of the checklist is to determine if it is possible to install a part backwards. On way to do it for a metal tube is to have different fittings at each end. Another aspect of the checklist is to determine if parts can contact each other and what means are taken to prevent this contact. It would appear that if such a checklist was created it was never adhered to.

On the A-330 it was determined that on those aircraft using the GE or P&W engines there was a possibility of tubing contacting and a very small fuel leak ensued. An AD was released that established a specific clearance between the offending tubes and instructions were provided as to how to both establish and maintain that critical dimension. Airbus obviously never made sure that a similar problem would not occur on the Rolls-Royce Trent 700 used on the A-330.

After the A-330 had made the landing it was inspected but it was not revealed as to what actually had transpired. A day or so later a rep from either Rolls Royce or Airbus Industrie showed up with a replacement for the damage fuel line. Nobody knew what had failed but the carrier of the replacement tube obviously knew that this part had failed and either Rolls Royce or Airbus had surmised what had transpired because they knew of the possibility of the leak occurring.

To top all of this off Air Transat took delivery of a brand new A-330 and when inspected it was found that at least one of the fuel tubes had been installed backwards.


:E :ooh:

[Descend to What Height?!?]

It was transmitted again last night in the UK on Chennel 5.

Good drama, but as has been said, much speculation and little fact.
At least for once, the narator did state what parts were based on facts, and what was speculation. :rolleyes: :rolleyes:

[Airbus Girl]

A good program but it didn't answer the main question - why did the pilots not wonder why there was such an imbalance and not add up the fuel at that time? I believe it was something like 30 minutes before they did another fuel check, by which point it was already late, but still the x-feed was kept open.

[Globaliser]

Does anyone know if/when the official report will be published?

[Flight Detent]

Yeah Airbus Girl,

And those nitwits at AB Industries STILL think they don't need a Flight Engineer!

------ even with up to 800 people aboard this new A380 Airelephant, they still think so - it will only take one accident to prove them wrong, and so little comparatively, to have a three man crew aboard.
And I mean a real Flight Engineer, not a 3rd pilot or a computer systems monitor!

Pure madness, with nobody watching the aircraft systems, and with so much at stake.

And please, don't respond with that "guff" (read rubbish) about how Flight Engineers are antiques, has beens, and the like, it's been proven many, many times that they are worth their weight in fuel and salary many times over.

I've been aboard enough long and shorthaul flights to know the difference, during my approx. 13,000 hours worth of experience, mainly on B727 and B747.

It's interesting to note, in my discussions with other crew, that most of the opposition to FEs comes from pilots who have never flown with one!

Cheers,
FD :hmm: :E :ouch:

[Engine overtemp]

And those nitwits at AB Industries STILL think they don't need a Flight Engineer!

Probably for the same reason that the "nitwits" at Boeing don't put one on their current aircraft!
:yuk:

[18greens]

I thought it was an interesting program, not entirely correct but given the informations the program makers had to go on not bad.

It made me wonder whether this situation is covered in the training. I bet it is now but was it then?

These are complex aircraft. Given the same situation and without the foresight of having watched the program how many pilots would have done the same?

[Airbus Girl]

I wondered that too, but its quite unusual to suddenly have a large fuel imbalance. Yes, it could have been a computer error, but even so, I still think I would have thought "fuel" looked at the fuel pages, and added up the total fuel on board.
I know its much easier with the hindsight, but surely this is what the Captain in particular is paid for? We don't have flight engineers on board, the pilots are meant to be doing his job - monitoring the systems. The fact they already had an abnormal oil indication on the same engine should have at least led them into some close checking and monitoring.
We often get an Air Bleed problem on departure, which is usually spurious, but will still check and double check, and then check on it again a bit later on. We don't assume its the same spurious reading.
Interesting that the pilots did not want to be interviewed for the programme.
It had some similarities to the crew who flew to Vienna with gear stuck down and didn't monitor the fuel they were using - again, only just made it to an airport. They had other options but it came down to the basics - monitoring.

[ATC Watcher]

Airbus girl,
A comment on your reference to the Vienna case, to be correct you shoud employ " he " instead of " they". The FO knew excactly what was going on apparently.:hmm: (and they just did NOT make it .)

Kiss,

[RAT 5]

Before this reverts to a re-hash of the Vienna thread:

About an F.E. A380. This is going to be more of a flying cruise liner than an aeroplane, if you believe all the guff. Gyms, showers, cinema's, kitchens not galleys etc. IMHO it's going to need a whole on-board maintenance crew. Any F.E. could elleviate his boredom in the caged cockpit by moonlighting as an on-board plumber, electrician and probably after-dinner speaker.

[BigGreenPleasureMachine]

It is interesting to note that Airbus are expecting airlines to carry a doctor on the A380. Seems strange that the health of the aircraft won't be catered for in the same fashion.

[Port Strobe]

Regarding the program broadcast in the UK the other night, it conveys the idea of what went wrong but does anyone else feel that series is way too over dramatic? When the report into the accident is finally released hopefully Blackbox will make a program about it, their programming is usually more informative I think.

BGPM, I wouldn't believe for one minute anything about doctors on board, chances of getting a doctor set up for a community of 800 people on the ground are zilch so who's going to pay for one in the air? The health of the aircraft is looked after, just in a different way from days gone by.

[javelin]

I taped it and watched it last night.

It could have been done better without a lot of trouble. If they had just got a bit more factual info that most of us have seen in the industry, it would have been better for people on our side of the fence.

I have flown that exact scenario in the sim - they gave us the leak, we detected and decided on an engine shutdown. Afterwards, we were let go at the same height/distance to an airfield. The first few minutes were hectic - The F/O had to work his buns off coming up with info as I was flying the aeroplane with minimal assistance other than back up nav and radar steers. After about 5 minutes, we could get together and discuss a plan, then work together as we got towards the airport. You only get slats, no flaps, clean speed is about 210kts, target threshold is 170, only accumulator brakes to stop.

In our case, it worked OK but then, it was in the sim !

Even allowing for that, all 3 of us ( inc the instructor) were buzzing and needed a beer afterwards.

A real curates egg - they screwed up to begin with because a simple fuel total check would have established a leak, after that though, they did a good job.

With some very careful extra work and correct info, it would make a good documentary, they nearly got there with this attempt - shame about the flames coming out of the engines........Please !

[Flight Detent]

Yeah, right Port Strobe,
Just like the crew that was responsible for the original screw-up!

Just like the crew that overran the 744 at Bangkok, after initiating a go-around, they changed their mind and decided to continue the approach, and forgot that they had inadvertantly cancelled their auto speedbrakes, they didn't deploy at touch, and nobody noticed until it was too late, incredible!

Just like the crew that lost control of the onboard fire on the Md-11 - nobody got serious with fire detection/extinguishing until it was too late, incredible!

Just like the crew that tail scrapped the 744 for over 300 meters on takeoff, then had stickshaker on liftoff and nobody moved any thrust lever from the reduced power setting, incredible X2! (and lucky)

So much overlooked, so often, so unnessessarily - incredible!

And you want me (and others) to be satisfied with flying with no FE in such a large aircraft. One thing is very certain, I will not be flying in the A380 until they install an FE position, so I guess that means I will never see the inside of one - no problem!

Cheers

FD :yuk:

[BigGreenPleasureMachine]

Port Strobe: the plan for carriage of doctors was suggested to me by the chief engineer of the A380 project, further than than that I cannot speculate.

As regards the health of the aircraft being monitored by computer, I see your point, but I feel one of the lessons from the Air Transat accident is that the computers cannot do the same job as an FE, especially if the commander doesn't trust them.

Regards, BGPM

[Andy_S]

"Just like the crew that lost control of the onboard fire on the Md-11 - nobody got serious with fire detection/extinguishing until it was too late, incredible!"

Is that really fair? They simply followed Swissair procedure for smoke in the cabin. I don't believe the crew were even aware there was a fire until it became uncontained.

[Flap 5]

Too many pilots don't use common sense. If you only ever did things 'by the book' then we would be out of business, computers could fly the aircraft.

Normally you would open the cross feed for a fuel imbalance, but if you check your fuel state and you clearly then have a fuel leak from the low fuel wing you would obviously keep the cross feed closed. That is also in the manual. So maybe we don't need pilots after all if they are not going to get passed the first line in the abnormal checklist.

[pprecious]

It is interesting to note that Airbus are expecting airlines to carry a doctor on the A380.

What is the anticipated time in the air that the A380 will have?

I can't get an emergency appointment with my doctor for days, let alone within hours.......

:rolleyes:

[Flight Detent]

Hi Andy_S,
That is exactly my point.........

FD

[broadreach]

Er, are we on a tangent or what?

[Lu Zuckerman]

Please excuse me if I use incorrect terminology. There are several ways to look at the situation. Here is one. First the pilots were presented with the high oil pressure and the low oil temperature. This must have caused some degree of confusion because they were never presented with this phenomenon in their training program. This may have introduced some concern that the computer was in error. Secondly, the A-330 fuel monitoring logic was such that the fuel level disparity was not provided to the pilots until a considerable amount of fuel was lost. Coupled to this the pilots were not monitoring the fuel pages that is until the disparity in level was indicated by the computer.

The pilot had in mind that there was a possible malfunction with the computer. The PNF ran several calculations indicating a substantial loss of fuel. Not knowing there was a leak the pilot opened the cross feed in accordance with the operating handbook. The pilot asked the flight attendant to check to see if there was a leak however it was dark and she could not verify that there was a leak. By this time it was too late. Although the pilot was confused (believing the computer was in error) all of his actions were in accordance with Airbus procedures.

Because of this Airbus changed the fuel monitoring logic and they prepared but never officially released an AD covering the actions to be taken in reference to several different leaks from different areas of the wing. This required visual verification by one of the crew. However if the leak occurred at night the leak could not be verified and the pilots were placed in the position of operating the cross feed at the wrong time placing the aircraft in jeopardy.

The basic cause of the problem can be traced to the engine manufacturer.

[innuendo]

"Although the pilot was confused (believing the computer was in error) all of his actions were in accordance with Airbus procedures."

Lu, is that the finding in the official report or your read of the incident?
I suspect that the engine manufacturer may not agree with your last sentence.

[NigelOnDraft]

LZ The basic cause of the problem can be traced to the engine manufacturer The basic cause of the fuel leak was, but the "basic cause of the (near) accident" was not.

How so? A fuel leak is a "planned for" emergency. Handled correctly, then a single failure e.g. leak, should not lead to loss of the aircraft (I know the aircraft was not lost, but that came down to luck of position and good flying etc.).

Think back to why Concorde was grounded. Once it became established that a single problem (tyre burst) led to loss of the aircraft, this meant the certification criteria was not met. A tyre burst is an "exepcted" (albeit undesirable) emergency, as is an Engine Failure. There needs to be redundancy to cope with these. Same with a Fuel Leak.

So the real "cause" of the drama here was something subsequent to the leak. Drills? indications? crew? There is little point in speculating. An inquiry has spent many months investigating this, and will at some stage publish. Leave it to them... The TV program made good watching for Joe Public, but leaves many questions unanswered* as to the exact series of events, drills, what fuel was where and when etc. Not surprising when the FC, airline and manufacturer did not contribute.

*e.g. Fuel leak was from RHS? X-feed was opened iaw imbalance drills... so LH Fuel Pumps supplying RH engine (were RH pumps turned off?). So why did RH Engine flameout first? Had fuel from LHS? I am not asking for answers to these now - I am sure the inquiry will do that. Just we do not know enough to praise or criticise the crew based on heresay - which is all that TV program was.

[spy]

The right engine flamed out first due to the location and severity of the leak. the left engine flamed out as the cross feed was left open with a major leak in progress these facts are undisputed. The question is why did the crew open and then leave the cross feed open? Why did they not discover the leak sooner?

[GMEDX]

Just interested to know what degree of fuel imbalance would have been controllable single engined if they had closed the cross feed?

[Lu Zuckerman]

To: innuendo and NigelOnDraft

What I was alluding to was the root cause of the problem could be traced to the engine manufacturer and that was the leak. In any complex design the engineers must create a checklist to identify both maintainability and reliability design related problems and try to eliminate them from the design. One of those items on the checklist is to eliminate any thing in the design that would allow a part to be installed backwards. In the case of the Trent engine the fuel tube was designed with the same connection device at both ends of the tube. This may have been done to cut the cost of the fuel tube however the engine manufacturer must in this case tell the mechanic about the ability to install the part backwards and also provide instruction on how to establish the necessary clearance between the fuel and hydraulic tube. This was not done. By reversing the fuel tube the clearance will be eliminated. In this case the brand new engine was delivered with several parts missing including the fuel tube. Parts were cannibalized from another engine (which is allowed) and installed on the new engine. Because of the lack of specific instructions the tube was inadvertently installed backwards.

Pratt & Whitney and General Electric suffered a similar leakage of fuel due to abrasion between two metal lines. They each issued an AD telling the mechanic how to install the tubes and how to establish a minimum clearance between the two lines. These ADs were issued at least a year before the Airbus A-330 incident so I can only assume that the engine manufacturer was aware of this potential problem and they took no action. It is my understanding that after the incident Air Transat took delivery of another A-330 and upon inspecting the engines they found that the hydraulic line and the fuel line were contacting each other setting this aircraft up for the same situation.


:E :E

[NigelOnDraft]

The right engine flamed out first due to the location and severity of the leak So Spy, you can confirm the Right Engine flamed out as soon as the leak occurred? So all heresay to date and the TV program are wrong in that there indications of problems, then imbalance warning, all occurring with 2 engines, sometime prior to the flameout of the Right Engine?

You seem categorical that the leak led immediately to the Right Engine flaming out...

LZ I appreciate that if RR had done things differently, then the incident would not have occurred. However, that is not really the issue. Any accident/incident is the result of a chain of events, and accident prevention is about breaking that chain. A fuel leak is not a preventable event - they can occur for a number of reasons, and are considered by certification / drills etc. My point is therefore that the major failing was not the leak. It was other elements...

[spy]

No one disputes the prime cause of this failure was the incorrect instalation of a part on the right engine. What beggers belief is this crew reacted to a fuel imbalance without first ensuring there was not a leak! I have the time line for the incident somwhere but can't recall exactly when the right engine failed. I have run this excercise many times in the simulator and there is never a problem getting the aircraft down on one engine if the situation is correctly handled, eg the crew check for a fuel leak before opening the fuel cross feed! With a leak from the engine the engine may well fail with fuel in the associated tank and continue to leak fuel depending on the location of the leak. One thing is certain if the fuel leak procedure is correctly followed the other engines fuel supply is protected.

The crew may not be entirley to blame for the incident but they were the last line of defence and are therefore not the heros some have portrayed, they were very lucky boys in my opinion. I am not advocating hanging them but this incident has highlighted a problem that others can learn from, somtimes you need to apply a little thought to ECAM drills and ensure you really know what the problem is.

GMEDX the A330 will fly on one engine with no fuel on the opposite side as will the A320/1 and A319.


:ok:

[RatherBeFlying]

Earlier threads discussed ECAM insufficiencies, including that the threshold for Fuel Imbalance annunciation was quite large -- sort of like the Oil Pressure light that's really a "you've lost your engine" light on many cars.

A slower leak may have given the crew enough time to carry out a remaining fuel calculation after running the checklist -- or should that have been done before the checklist:confused:

In any case, a properly designed ECAM would be keeping a running tally of remaining fuel against remaining distance and reserves and notifying the crew when margins are eroding. This is the kind of thing that computers are very good at and should be doing.

And yes, a manual fuel check should be done at the usual hourly interval -- even though it'll only catch slow/medium leaks. In this case, it looks like you'd have to be running a fuel check every 15 minutes or so:hmm:

[patrickal]

The fundamental issue here was the pilot's confusion over what was being reported to him by the plane's brains. I think it will be a long time before FBW aircraft and human pilots learn to live with each other without problems.

In the old days, a pilot (ususally) had an understanding of the mechanics, or physical elements, of the aircraft. The instrumentation was analog and the tactile feel was real. Today, with flat panel screens and computer genereated "feel", it is very easy for a pilot to fall out of the loop. On top of that is the fact that most people, pilots included, still have some level of scepticism when it comes to believing a computer. The result of this scetpicism is that, when the computer reports an event that seems to be really unbelievable, the pilot may spend an innordinate amount of time trying to disprove the computer rather than believe it right away. This scepticism is further fed by the fact that many "faults" can be eliminated by recycling circiut breakers, proving to the pilot that electronics are flaky and are not to be trusted. It is the Boeing and Airbus equivilent of the "blue screen of death" on your PC. We have been programmed to believe that a reboot fixes most problems.

Another element is the pilot's ability to understand programming logic as opposed to a mechanical function. It is one thing to understand how all of the fuel pumps and tanks interact. It is quite another to understand how the computer that controls the fuel system collects data, interprets the data, reports on the data, and acts upon the data. When faced with a problem that appears to make little sense, the pilot is forced to conceptualize what the computer is thinking. Unfortunately, pilots are not usually programmers. We now have a cyborg middleman between the pilot and the physical aircraft. Until the programmers develop a system that allows the cyborg and the human to think as one, these occasional "holes in the system" will continue to emerge. Let's hope that, as in this case, the human has the capacity to overcome the disconnect.

[arcniz]

The perceived complexity of computerized control systems often comes from the lack of access to clear functional descriptions of "how things work".

The whole technology of computing is barely 60 years old. Most of the programming concepts used in software design are less than 40 years out of the cradle. And the specific rules for a given system are often largely made up by the designers as they are going through the process.

Usually the best description of how the system works is the system itself! Unfortunately, proprietary interests combined with the lack of very effective intellectual property protection for software concepts used in small-volume production cause the design owners to intentionally obscure the exact nature of the processes by which values are determined and decisions are made. So they 'translate' the actual design into a simplified fictional design which appears in the public documentation and procedural manuals. Inevitably, errors in translation occur. And then misunderstandings follow. These errors can be expected to INCREASE over the design life of highly computerized aircraft families as incremental changes are made to systems based on intermediate documents or versions that convey incomplete understandings of the original system design concepts. This is the digital equivalent of metal fatigue.

Of course, undiscovered errors will occur in the original designs, as well. The identification and correction of these will depend on the rigor of analysis and testing during development, plus the trial-and-error realities of actual use.

Just as civil aviation authorities use a wide scope of sins to encompass the idea of 'pilot error', the aviation community should be a bit less respectful and a bit more critical of inadequately functional or simply dumb designs for computerized control algorithms and user interfaces. Embrace the concept of 'design error' as a correctable fault.

In the Air Transat case, the functionality of the Airbus fuel flow monitoring and alerting system was (and is) clearly less functional than similar systems that one can buy off-the-shelf and install in anything from a DC-3 to a Concorde. The lack of timely, precise, and meaningfull information about the vanishing life juices of that aircraft was the second designed-in trap (after the fuel line reversability) that led the pilots onto their nearly catastrophic dance with destiny.

Sure, criticize the pilots. But raise your standards for what is acceptable in aircraft systems. The flying community does not have to roll over just because A or B designs a system that is half-warm cr*p.

Insist on systems that work well and make sense.

Complain, on the record, when they don't.

Encourage exhaustive independent design review of the actual aircraft system designs at their most basic level of detail.

[Frangible]

Many wise words spoken on this event, but consider this, when looking at automation issues.

In the aftermath of this incident it was asked "why isn’t the calculation of fuel remaining versus fuel loaded compared against fuel expected to be consumed done by the gizmos"? Official answer from Toulouse was, "because we wanted to leave the pilots something to do". They had deliberately not automated this function, so they said. (This sits pretty oddly with their general philosophy hitherto.)

And now, apparently, in the wake of that incident, that function is now automated. Clearly some very muddled thinking going on here.

This is not to say that the pilots did, as the DGAC AD stated and Toulouse declares, mismanage the fuel. The leak was a big one, the guys spent a fair bit of time consulting base about the bizarre "oil temp low, oil press high" message. Then they idled that engine (instructed by Montreal to do so, rumours say, so no IFSD would get in the stats and put a crimp in their ETOPS). Not to prejudge the report findings but it is at least conceivable that they had monitored the fuel state recently and while chatting to Montreal, and then looking up "fuel imbalance" in the FCOM, the bulk of the loss had already taken place. By the time they got to the "don’t do this if fuel leak is suspected" what reason could they have for suspecting one?

However, somebody knows if they were heroes or goats. When power was cut after the second engine failed, the CVR will have stopped. So, whether or not they checked their fuel state in the last 30 minutes is not a mystery. It is, however, a secret. Three years, nearly, since the incident and no report! How is safety served by this?

[Lu Zuckerman]

To: Frangible

Three years, nearly, since the incident and no report! How is safety served by this?

From what I understand the report is complete but Air Transat is fighting its’ release until there is a more amicable distribution of blame meaning some of the blame rests with Airbus and Rolls Royce.

:E :E

[spy]

Time to dispel a few myths!

The leak detection process has not changed, you simply add the fuel used to the fuel on board and it should equal the fuel you started with, same as any other aeroplane. An additional indication may be increased fuel flow if the leak is down stream of the fuel metering unit. You will also see your arrival fuel decrease on the FMGC; this was always the case nothing has changed.

The only change to the procedures I am aware of post this incident is to further highlight the correct actions following a fuel imbalance. You were then and are now required to check there is not a leak before you open the fuel cross feed using the above method just as we did on the MD and Boeing aircraft! Using the KISS principle for leak detection seems a good idea to me!

There was a long standing blue bulletin that highlighted this procedure which has been incorporated into our SOP’s. This bulletin recommended a check (fuel used + fuel on board = fuel you started with) at least every 30 minutes and was effective at the time of this incident. This check takes just a few seconds even a 4 o’clock in the morning!

The TV program alluded to software changes to alert crews to a fuel leak; if there have been any its news to me.

The indications of a leak will be as follows and in this order:

1: A fuel imbalance ECAM drill
2: Fuel low level ECAM drill
3: Engine flame out.

The engine flame out may occur before the tank runs dry if the leak is from the engine depending where in the engine the leak is. If the fuel cross feed is opened then you will get fuel low level indication in the non-leaking tank and then another flame out, on the plus side at this stage you no longer have a fuel imbalance.

The oil pressure/temp problem was due to the location of the leak and the cooling effect of the leaking cold fuel. This would have confused the crew no doubt about that as there was no way for them to know this at the time but to be honest I feel this is a red herring as the crew clearly carried out the fuel imbalance drill but failed to establish if there was a leak before opening the cross feed. It has been suggested that the ECAM misled the crew due to prioritising and oil problem ahead of the imbalance drill, yet the crew clearly carried out the imbalance drill all be it incorrectly.

I would not claim the Airbus systems are perfect, far from it, you must always be aware of the system limitations especially when it comes to ECAM. However in this case I can find little excuse for the crew opening fuel cross feed and then leaving it open when logic was screaming fuel leak. This was not a failure of the system but of its operation following a mechanical failure brought on by poor maintenance procedures.

Bottom line, the crew failed to follow established procedures!Unless further evidence comes to light to account for their actions one has to lay a large amount of responsibility for the engines flaming out at their door.
:ok:

[arcniz]

Hey, SPY.....please KISS your ECAM.

Whether the crew followed procedures or not - a matter of some debate, it seems - they were not receiving sufficient meaningful information from the aircraft itself or from the ground maintenance backup pipeline to solve/ resolve the problem in time.

Dismissing the oil pressure/temperature indication is a bit facile. A review of all the great disasters and screwups in aviation history would show many where a similar 'red herring' provided both annoying distraction and the actual key to explanation of the problem.

If there had been a way for the crew to validate the correctness of the oil system (and fuel system) readings, through redundant independent sensors, or self-testing sensors, for example, then they could have taken the information seriously enough to change the outcome. The feature of ultrareliable and validatable sensors is not an unreasonable luxury in a big ETOPS twin.

Also, the aircraft systems 'could' have produced much more meaningful diagnostic analysis in real time with the sensor data available, or they could have provided the fuel path data itself.

With the Airbus systems philosophy, one cannot really have it both ways. This could be easily changed if the designers would thoughtfully (please) include a 'switch' allowing exactly that. The two-alternative diagnostic approach is:

Way 1 - relying on "processed" information provided by proprietary analytical methods and decision trees devised by the aircraft manufacturer. These systems advisories are touted as 'smart' and 'comprehensive' because they integrate a lot of higher-level understanding about the airframe and engines, but they often are woefully lacking in providing timely, useful information to the aircraft operators. The quality and reliability of the process data results are always suspect because the true nature of the calculation is unknown and unknowable.

Way 2 - relying on precise ACTUAL DATA, provided in near real-time, from the sensors and first-impression monitoring subsystems scattered about the aircraft. Analysis of the raw fuel-flow and pressure data on both sides of the xfeed would probably have permitted the crew to detect the dumping very quickly and thus to correct the crossfeed error. Certainly the availability of good raw data would have allowed some creative ad-hoc diagnostics on the flight deck.



I can find little excuse for the crew opening fuel cross feed and then leaving it open when logic was screaming fuel leak. This was not a failure of the system but of its operation following a mechanical failure brought on by poor maintenance procedures.

I fully agree. The aircraft's own well-informed logic system should have told them: "That is not improving matters. Turn off the crossfeed immediately."

[spy]

arcniz

With respect you appear to know little about the practical operation of the Airbus, that or you don’t really understand it! The aeroplane and system gave them all the information they needed to identify they had a major fuel leak. You have exactly the same level of accuracy and redundancy as any other type and then some regarding the fuel indication system. This incident in a 767 or 777 would have left the crew with the same level of information and verification of data validity.

At the end of the day they had no reason to doubt the data and every reason to treat it as correct. In six years on the aeroplane I have never had a reason to doubt the fuel system it does not lie, it is clear and easy to understand.

The Airbus is highly automated but it still requires a pilot, which means there are still some functions which require the use of the human brain. The 777 won’t tell you any more than the A330 when a leak occurs nor will the 767!

This crew opened the fuel cross feed with a major fuel leak in progress. They either failed to diagnose the fault or failed to follow procedures or both. What is certain is the data regarding their fuel state was clear and easy to understand. As I said in an earlier post I have run this procedure many times with crews in the simulator it should have been a strait forward problem to solve even with other distractions.

The crew got it wrong and no amount of Airbus bashing will change that fact. They had the same level of information that crews on other types have! Had this crew been in the simulator and handled this drill in the same way they would be facing retraining and a retest!

Again this is not a witch hunt but let’s not confuse the facts with half truths and myth! This incident resulted in the loss of both engines due in no small part to the crews handling of the systems, there are important lessons to be learnt, the system worked as advertised.
:ok:

[dusk2dawn]

This incident in a 767 or 777 would have left the crew with the same level of information and verification of data validity.
Wouldn't an otherwise in-trim (Boeing) aircraft developing a massive fuel imbalance be showing something on the yoke mounted aileron trim indicator ?

[arcniz]

The crew got it wrong and no amount of Airbus bashing will change that fact.

SPY: You speak well for your position, and you are much closer to the day-to-day of Airbus ops than I. The official record will speak to the facts of the incident.

That said, I do think the clarity of hindsight is often considerably different from that which is available in an unfolding situation. That is the context in which the systems did not serve them well, either because of training or stupidity or oversight or because the right information was not available in the right form at the right time.

My point is and was that there's still considerable room for improvement in functionality, scope, and quality of detail reported by production aircraft monitoring systems. And better guidance is needed in using the available data for serious diagnostic procedures. These things are not so hard to do. Airbus gets the heat only because this was an Airbus flight and because Airbus has done more pioneering in some aspects of the automated controls and related information displays. More power to 'em!

The bottom line in this case is, just as it has been since the first days of aviation, the pilot(s) have to fly the aircraft they're in, not any other.

[ROUND TUIT]

If the aircraft is so clever and can detect a cigarette at 50 yards why can it not work out that due to a higher than expected fuel,usage it is going to run out of fuel way before its destiantion i.e. in the middle of the Atlantic.
I thought the aircraft was there to protect you/warn you simply and unambiguously, not be the equivalent of The Times/Le Monde crossword!

[spy]

Roundtuit

It did, the information was very clear, you can lead a horse to water but you can't make it drink.


Dusktodawn

Good point, you would have had a very empty tank by that point. However, as the cross feed was open the aircraft was loosing fuel from both tanks so it is questionable if you would have noticed much. Still hard data is what you should be working from using control indications etc as a secondary input. Out of interest the crew could have looked at the control page and found the same information. Not sure about the 777 it is fly by wire after all but I assume it has a control display as well if the controls are not back driven!

arcniz

I understand where you are coming from (I spent 8 years in IT and system design) but really the information is there and the vast majority of crews would have landed in Lajes on one engine and we would not be having this conversation. I have only seen one crew make this error in the sim and they corrected their error before it was too late. The on board diagnostic maintenance system does allow you to check raw data from sensors and carries out BITE checks. Out of interest their engineers could have given them the codes required if they had asked.

[arcniz]

Spy

We can go-round some more on this when the official report is published. A problem with discussion in a substantially fact-free environment is that the same hypothetical oil keeps lubricating increasingly circular commentary.

On the surface of it, the misuse of crossfeed - for a long enough interval to sacrifice the critical fuel reserve - seems like a rookie oversight. Surely there is a very specific explanation for this - which we do not yet know as a matter of fact.

Other than for passing time in idle chatter, the interest in understanding the underlying failure of performance of the aggregate process is directed toward improving systems - whether mechanical or electronic or human - to lower the probability of a similar or analogous reoccurrence. Since the frequency of events like this is mercifully low, each one deserves a great deal of attention and introspection before the 'causes and effects' account is closed out.

Your explanation tends to focus on a presumed defect of skill or character or alertness on the part of the two flying crew members. While that may be correct, at some level, it is also true that all humans are prone to occasional excursions away from perfection in the conduct of their duties. That is the main reason we strive so hard to wrap multiple levels of systems redundancy around humans who are working in critical-path processes. Somewhere, somehow, one or more of those protective envelopes has failed dramatically here - with the drama heightened a bit by the cool and focussed way the crew handled and resolved the final mess they were in.

I find it particularly interesting to consider whether the 2-person ETOPS crew had adequate resources to identify and diagnose their problem in the time that was available. The facts seem to show they didn't. Your position, if I may presume to restate it, is that they "should have" been able to solve the problem with the means at hand. But one round in the chamber trumps ten on the shelf: the fact they did not resolve it as you suggest says prima facie they lacked some critical insight or datum at the moment of need.

Historically, pilots have had to work with a a chronic shortage of information about what is happening inside their aircraft, along their flight path, with weather, traffic, etc. Just quite recently the tables have turned so that vast amounts of information are available - in very current form. The connundrum has shifted in a span of decades from figuring out how to make up for missing data to figuring out what portion of a mountain of data to use and which to ignore. Perhaps this is a pivotal factor in the uninterrupted progress of Air Transat incident?

The extent to which the flying crew can also be maintenance technicians is controlled by the quality and fitness-to-task of the tools available and also by the mindset of the individuals. The perspectives of the decisive aircraft Commander versus the skill-rich and very time-sensitive Pilot versus the plodding but persistent diagnostic Technician are somewhat mutually incompatible in exactly the sort of circumstances that occurred. The pre-dawn hour and mid-ocean location provided a near worst-case scenario for access to ground-based backup resources, complicating matters further. In any what-if scenario one can cook up, the cycle probably could have been interrupted for a more favorable result if a highly-skilled and authoritative 3rd party or team could have gotten inside the process by radio and telemetry early in the situation.

What-ifs abound here. This incident was/is both symbolic and symptomatic of the transition from one era of aviation to another. It would be an opportunity wasted to write it off simply as a 1-dimensional bolix.

[patrickal]

Arcniz hit it on the head;

"The connundrum has shifted in a span of decades from figuring out how to make up for missing data to figuring out what portion of a mountain of data to use and which to ignore. Perhaps this is a pivotal factor in the uninterrupted progress of Air Transat incident?"

As someone who has spent 25+ years in the information technology industry, I can attest to the fact that this is precisely where computer technology is falling short, if not burying us. We are confronted with information overload at a growing rate. Email, voicemail, all of the warning beeps from your Ipod, PDA, VCR, DVD, microwave, HDTV, etc. Your PC and the wonderful world of Windows. We wind up staring at the device wondering what the heck it is thinking, and usually powering it off and on to fix it. The trouble is that when you do this in an aircraft, you are wasting precious time. The problem in this incident, IMHO, was either information that was not presented in a purely logical fashion, or there was not enough training (procedures)for the crew to decipher it.

Computer technology in aircraft does not have the luxury of time that its ground-based counterparts have. There can be no confusion factor. Confusion can only be eliminated in extremely accurate design and clear, conscise training. That responsability falls on both the manufacturer and the airlines.

[Big Tudor]

just to pick up on one of arcniz's points:
The extent to which the flying crew can also be maintenance technicians is controlled by the quality and fitness-to-task of the tools available and also by the mindset of the individuals.
Is technology leading us down a road of ignorance and blind faith in the software we all use day after day? It is not that long ago that even the most advanced machines in the world were controlled by levers and pullies. The average human being was brought up with a reasonable understanding of how things worked (pull this and that goes up technology). A large number of people (particularly men) took pride in the fact that they knew how the internal combustion engine worked and could strip and re-assemble one. A lot of this knowledge has been lost due to the fact that the car engine is no longer 'user maintenance friendly'. Who would consider changing their own brake pads these days? Not only are we becoming a service industry driven world, we are developing a service industry mentality, i.e. if it breaks buy a new one or get someone else to fix it. The days of people being able to fix things themselves would appear to be disappearing into history.
Whilst I would not question the piloting competancy of the crew, one wonders how knowledgeable they (and indeed many younger pilots) are of how and why the mechanics of their chariot function and interact.

[Flight Detent]

Here, Here BIG TUDOR,

I agree 100% with that.

It's evident in many ways about the place, but most obvious when complex machines are involved.

Say no more!

Cheers :confused:

[PFD]

The oil pressure/temp problem was due to the location of the leak and the cooling effect of the leaking cold fuel.

As a ground theory instructor, the first thing I thought of when I heard that was "It sounds like the fuel leak is cooling the oil" If it is a full flow system, then raising the viscosity of the oil will raise the oil pressure.

Maybe the 2 things, apparent low fuel level and low oil temperature should have started a thought process, but of course it will be dependent on systems knowledge, not flying skills.

No one in the program came up with the 'obvious' (to me) relationship.

Hopefully, you professional pilots here will have your memories jogged if something similar happens to you.

Automation dependency is one of the reasons Human Factors training is so important nowadays.

As was said in the program by one of the passengers "Do I think the pilot was a hero?, no. Do I think he was a bloody good pilot?, yes." ......and I would agree, if only on the unpowered landing skills.

[Frangible]

Spy's myth-dispelling most welcome, but I wonder about subtle differences in wording and whether the post Transat checklist fixed it. The Transat checklist appeared to say "don't open crossfeed if a leak is suspected" which is subtly different from (quoting from memory) "you a required to confirm there is no leak before opening the crossfeed". Maybe this is the hole they fell into, in that they felt (if they had been checking fuel state at 30-minute intervals) they had no reason to suspect a leak.

[middenview]

Just curious, and apologies if this has been discussed before, but would the crew have made a field with one engine running if the leak was detected earlier?

[spy]

On the grounds they got close enough to glide to the airfield I would say without doubt had the leak been detected earlier they would have landed on one engine.

However, here is the real question, would they have made it on a 180 minute flight plan at the ETP with minimum fuel required? Which ever way you look at this incident they were very lucky! A very nasty position to find yourself in over the Atlantic.

[patrickal]

For those of you who have been following this thread and commenting on the challenges of new technology, read this article on Avweb. It details the travails of a DC-10 crew struggling with intermittent failures.

http://www.avweb.com/news/columns/187705-1.html

[middenview]

"However, here is the real question, would they have made it on a 180 minute flight plan at the ETP with minimum fuel required? Which ever way you look at this incident they were very lucky! A very nasty position to find yourself in over the Atlantic."
This was what interested me - and making several assumptions as a non-ATPL - that they would have needed to dump fuel relatively quickly in any case to correct the imbalance (guessing that allowing a severe fuel imbalance to develop could be unrecoverable because fuel would only dump from the tanks at a maximum rate).

So, given early diagnosis, would they have had fuel enough to make any runway with power. And what does that say about ETOPS.

[spy]

The A330 can fly safely and land with one side empty!

You can’t dump fuel from only one side unless of course one side is already empty! You would never dump fuel to correct an imbalance anyway. Also not all A330's have fuel dump as the aircraft can be landed if needs must at max take-off weight.

The two situations that have always given me pause for thought have been a major fuel leak or fire over the Atlantic. Not that either of these problems would be any better in a three or four engined aeroplane, so this is not an ETOPS only problem!

From what I understand given the location of the leak, the leak would have stopped had the crew used the leak from engine QRH drill and they could then have used fuel from both wings. However, to be fair to the crew they had no way of knowing where the leak was from and it would have been a brave call to shut the engine down given they had not decided they even had a leak.

The point is had this leak occurred further from land we would now be talking about an accident not an incident.

[middenview]

The A330 can fly safely and land with one side empty!

One more round and I'll try and stick to the spectator and GA forums in future.

And I'm impressed. Is that special to the A330, or all big twins built that well?