The Atlantic Glider. Some final notes
Iconoclast
Thread Starter
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
To err is human especially if you don't believe your instruments.
Please excuse me if I use incorrect terminology. There are several ways to look at the situation. Here is one. First the pilots were presented with the high oil pressure and the low oil temperature. This must have caused some degree of confusion because they were never presented with this phenomenon in their training program. This may have introduced some concern that the computer was in error. Secondly, the A-330 fuel monitoring logic was such that the fuel level disparity was not provided to the pilots until a considerable amount of fuel was lost. Coupled to this the pilots were not monitoring the fuel pages that is until the disparity in level was indicated by the computer.
The pilot had in mind that there was a possible malfunction with the computer. The PNF ran several calculations indicating a substantial loss of fuel. Not knowing there was a leak the pilot opened the cross feed in accordance with the operating handbook. The pilot asked the flight attendant to check to see if there was a leak however it was dark and she could not verify that there was a leak. By this time it was too late. Although the pilot was confused (believing the computer was in error) all of his actions were in accordance with Airbus procedures.
Because of this Airbus changed the fuel monitoring logic and they prepared but never officially released an AD covering the actions to be taken in reference to several different leaks from different areas of the wing. This required visual verification by one of the crew. However if the leak occurred at night the leak could not be verified and the pilots were placed in the position of operating the cross feed at the wrong time placing the aircraft in jeopardy.
The basic cause of the problem can be traced to the engine manufacturer.
The pilot had in mind that there was a possible malfunction with the computer. The PNF ran several calculations indicating a substantial loss of fuel. Not knowing there was a leak the pilot opened the cross feed in accordance with the operating handbook. The pilot asked the flight attendant to check to see if there was a leak however it was dark and she could not verify that there was a leak. By this time it was too late. Although the pilot was confused (believing the computer was in error) all of his actions were in accordance with Airbus procedures.
Because of this Airbus changed the fuel monitoring logic and they prepared but never officially released an AD covering the actions to be taken in reference to several different leaks from different areas of the wing. This required visual verification by one of the crew. However if the leak occurred at night the leak could not be verified and the pilots were placed in the position of operating the cross feed at the wrong time placing the aircraft in jeopardy.
The basic cause of the problem can be traced to the engine manufacturer.
"Although the pilot was confused (believing the computer was in error) all of his actions were in accordance with Airbus procedures."
Lu, is that the finding in the official report or your read of the incident?
I suspect that the engine manufacturer may not agree with your last sentence.
Lu, is that the finding in the official report or your read of the incident?
I suspect that the engine manufacturer may not agree with your last sentence.
Join Date: Jan 2001
Location: UK
Posts: 2,044
Likes: 0
Received 0 Likes
on
0 Posts
LZ
The basic cause of the fuel leak was, but the "basic cause of the (near) accident" was not.
How so? A fuel leak is a "planned for" emergency. Handled correctly, then a single failure e.g. leak, should not lead to loss of the aircraft (I know the aircraft was not lost, but that came down to luck of position and good flying etc.).
Think back to why Concorde was grounded. Once it became established that a single problem (tyre burst) led to loss of the aircraft, this meant the certification criteria was not met. A tyre burst is an "exepcted" (albeit undesirable) emergency, as is an Engine Failure. There needs to be redundancy to cope with these. Same with a Fuel Leak.
So the real "cause" of the drama here was something subsequent to the leak. Drills? indications? crew? There is little point in speculating. An inquiry has spent many months investigating this, and will at some stage publish. Leave it to them... The TV program made good watching for Joe Public, but leaves many questions unanswered* as to the exact series of events, drills, what fuel was where and when etc. Not surprising when the FC, airline and manufacturer did not contribute.
*e.g. Fuel leak was from RHS? X-feed was opened iaw imbalance drills... so LH Fuel Pumps supplying RH engine (were RH pumps turned off?). So why did RH Engine flameout first? Had fuel from LHS? I am not asking for answers to these now - I am sure the inquiry will do that. Just we do not know enough to praise or criticise the crew based on heresay - which is all that TV program was.
The basic cause of the problem can be traced to the engine manufacturer
How so? A fuel leak is a "planned for" emergency. Handled correctly, then a single failure e.g. leak, should not lead to loss of the aircraft (I know the aircraft was not lost, but that came down to luck of position and good flying etc.).
Think back to why Concorde was grounded. Once it became established that a single problem (tyre burst) led to loss of the aircraft, this meant the certification criteria was not met. A tyre burst is an "exepcted" (albeit undesirable) emergency, as is an Engine Failure. There needs to be redundancy to cope with these. Same with a Fuel Leak.
So the real "cause" of the drama here was something subsequent to the leak. Drills? indications? crew? There is little point in speculating. An inquiry has spent many months investigating this, and will at some stage publish. Leave it to them... The TV program made good watching for Joe Public, but leaves many questions unanswered* as to the exact series of events, drills, what fuel was where and when etc. Not surprising when the FC, airline and manufacturer did not contribute.
*e.g. Fuel leak was from RHS? X-feed was opened iaw imbalance drills... so LH Fuel Pumps supplying RH engine (were RH pumps turned off?). So why did RH Engine flameout first? Had fuel from LHS? I am not asking for answers to these now - I am sure the inquiry will do that. Just we do not know enough to praise or criticise the crew based on heresay - which is all that TV program was.
Join Date: Nov 2003
Location: UK
Posts: 109
Likes: 0
Received 0 Likes
on
0 Posts
The right engine flamed out first due to the location and severity of the leak. the left engine flamed out as the cross feed was left open with a major leak in progress these facts are undisputed. The question is why did the crew open and then leave the cross feed open? Why did they not discover the leak sooner?
Iconoclast
Thread Starter
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
Let me explain.
To: innuendo and NigelOnDraft
What I was alluding to was the root cause of the problem could be traced to the engine manufacturer and that was the leak. In any complex design the engineers must create a checklist to identify both maintainability and reliability design related problems and try to eliminate them from the design. One of those items on the checklist is to eliminate any thing in the design that would allow a part to be installed backwards. In the case of the Trent engine the fuel tube was designed with the same connection device at both ends of the tube. This may have been done to cut the cost of the fuel tube however the engine manufacturer must in this case tell the mechanic about the ability to install the part backwards and also provide instruction on how to establish the necessary clearance between the fuel and hydraulic tube. This was not done. By reversing the fuel tube the clearance will be eliminated. In this case the brand new engine was delivered with several parts missing including the fuel tube. Parts were cannibalized from another engine (which is allowed) and installed on the new engine. Because of the lack of specific instructions the tube was inadvertently installed backwards.
Pratt & Whitney and General Electric suffered a similar leakage of fuel due to abrasion between two metal lines. They each issued an AD telling the mechanic how to install the tubes and how to establish a minimum clearance between the two lines. These ADs were issued at least a year before the Airbus A-330 incident so I can only assume that the engine manufacturer was aware of this potential problem and they took no action. It is my understanding that after the incident Air Transat took delivery of another A-330 and upon inspecting the engines they found that the hydraulic line and the fuel line were contacting each other setting this aircraft up for the same situation.
What I was alluding to was the root cause of the problem could be traced to the engine manufacturer and that was the leak. In any complex design the engineers must create a checklist to identify both maintainability and reliability design related problems and try to eliminate them from the design. One of those items on the checklist is to eliminate any thing in the design that would allow a part to be installed backwards. In the case of the Trent engine the fuel tube was designed with the same connection device at both ends of the tube. This may have been done to cut the cost of the fuel tube however the engine manufacturer must in this case tell the mechanic about the ability to install the part backwards and also provide instruction on how to establish the necessary clearance between the fuel and hydraulic tube. This was not done. By reversing the fuel tube the clearance will be eliminated. In this case the brand new engine was delivered with several parts missing including the fuel tube. Parts were cannibalized from another engine (which is allowed) and installed on the new engine. Because of the lack of specific instructions the tube was inadvertently installed backwards.
Pratt & Whitney and General Electric suffered a similar leakage of fuel due to abrasion between two metal lines. They each issued an AD telling the mechanic how to install the tubes and how to establish a minimum clearance between the two lines. These ADs were issued at least a year before the Airbus A-330 incident so I can only assume that the engine manufacturer was aware of this potential problem and they took no action. It is my understanding that after the incident Air Transat took delivery of another A-330 and upon inspecting the engines they found that the hydraulic line and the fuel line were contacting each other setting this aircraft up for the same situation.
Join Date: Jan 2001
Location: UK
Posts: 2,044
Likes: 0
Received 0 Likes
on
0 Posts
The right engine flamed out first due to the location and severity of the leak
You seem categorical that the leak led immediately to the Right Engine flaming out...
LZ I appreciate that if RR had done things differently, then the incident would not have occurred. However, that is not really the issue. Any accident/incident is the result of a chain of events, and accident prevention is about breaking that chain. A fuel leak is not a preventable event - they can occur for a number of reasons, and are considered by certification / drills etc. My point is therefore that the major failing was not the leak. It was other elements...
Join Date: Nov 2003
Location: UK
Posts: 109
Likes: 0
Received 0 Likes
on
0 Posts
No one disputes the prime cause of this failure was the incorrect instalation of a part on the right engine. What beggers belief is this crew reacted to a fuel imbalance without first ensuring there was not a leak! I have the time line for the incident somwhere but can't recall exactly when the right engine failed. I have run this excercise many times in the simulator and there is never a problem getting the aircraft down on one engine if the situation is correctly handled, eg the crew check for a fuel leak before opening the fuel cross feed! With a leak from the engine the engine may well fail with fuel in the associated tank and continue to leak fuel depending on the location of the leak. One thing is certain if the fuel leak procedure is correctly followed the other engines fuel supply is protected.
The crew may not be entirley to blame for the incident but they were the last line of defence and are therefore not the heros some have portrayed, they were very lucky boys in my opinion. I am not advocating hanging them but this incident has highlighted a problem that others can learn from, somtimes you need to apply a little thought to ECAM drills and ensure you really know what the problem is.
GMEDX the A330 will fly on one engine with no fuel on the opposite side as will the A320/1 and A319.
The crew may not be entirley to blame for the incident but they were the last line of defence and are therefore not the heros some have portrayed, they were very lucky boys in my opinion. I am not advocating hanging them but this incident has highlighted a problem that others can learn from, somtimes you need to apply a little thought to ECAM drills and ensure you really know what the problem is.
GMEDX the A330 will fly on one engine with no fuel on the opposite side as will the A320/1 and A319.
Magnitude of Leak
Earlier threads discussed ECAM insufficiencies, including that the threshold for Fuel Imbalance annunciation was quite large -- sort of like the Oil Pressure light that's really a "you've lost your engine" light on many cars.
A slower leak may have given the crew enough time to carry out a remaining fuel calculation after running the checklist -- or should that have been done before the checklist
In any case, a properly designed ECAM would be keeping a running tally of remaining fuel against remaining distance and reserves and notifying the crew when margins are eroding. This is the kind of thing that computers are very good at and should be doing.
And yes, a manual fuel check should be done at the usual hourly interval -- even though it'll only catch slow/medium leaks. In this case, it looks like you'd have to be running a fuel check every 15 minutes or so
A slower leak may have given the crew enough time to carry out a remaining fuel calculation after running the checklist -- or should that have been done before the checklist
In any case, a properly designed ECAM would be keeping a running tally of remaining fuel against remaining distance and reserves and notifying the crew when margins are eroding. This is the kind of thing that computers are very good at and should be doing.
And yes, a manual fuel check should be done at the usual hourly interval -- even though it'll only catch slow/medium leaks. In this case, it looks like you'd have to be running a fuel check every 15 minutes or so
Join Date: Nov 2000
Location: Montgomery, NY, USA
Posts: 137
Likes: 0
Received 0 Likes
on
0 Posts
The fundamental issue here was the pilot's confusion over what was being reported to him by the plane's brains. I think it will be a long time before FBW aircraft and human pilots learn to live with each other without problems.
In the old days, a pilot (ususally) had an understanding of the mechanics, or physical elements, of the aircraft. The instrumentation was analog and the tactile feel was real. Today, with flat panel screens and computer genereated "feel", it is very easy for a pilot to fall out of the loop. On top of that is the fact that most people, pilots included, still have some level of scepticism when it comes to believing a computer. The result of this scetpicism is that, when the computer reports an event that seems to be really unbelievable, the pilot may spend an innordinate amount of time trying to disprove the computer rather than believe it right away. This scepticism is further fed by the fact that many "faults" can be eliminated by recycling circiut breakers, proving to the pilot that electronics are flaky and are not to be trusted. It is the Boeing and Airbus equivilent of the "blue screen of death" on your PC. We have been programmed to believe that a reboot fixes most problems.
Another element is the pilot's ability to understand programming logic as opposed to a mechanical function. It is one thing to understand how all of the fuel pumps and tanks interact. It is quite another to understand how the computer that controls the fuel system collects data, interprets the data, reports on the data, and acts upon the data. When faced with a problem that appears to make little sense, the pilot is forced to conceptualize what the computer is thinking. Unfortunately, pilots are not usually programmers. We now have a cyborg middleman between the pilot and the physical aircraft. Until the programmers develop a system that allows the cyborg and the human to think as one, these occasional "holes in the system" will continue to emerge. Let's hope that, as in this case, the human has the capacity to overcome the disconnect.
In the old days, a pilot (ususally) had an understanding of the mechanics, or physical elements, of the aircraft. The instrumentation was analog and the tactile feel was real. Today, with flat panel screens and computer genereated "feel", it is very easy for a pilot to fall out of the loop. On top of that is the fact that most people, pilots included, still have some level of scepticism when it comes to believing a computer. The result of this scetpicism is that, when the computer reports an event that seems to be really unbelievable, the pilot may spend an innordinate amount of time trying to disprove the computer rather than believe it right away. This scepticism is further fed by the fact that many "faults" can be eliminated by recycling circiut breakers, proving to the pilot that electronics are flaky and are not to be trusted. It is the Boeing and Airbus equivilent of the "blue screen of death" on your PC. We have been programmed to believe that a reboot fixes most problems.
Another element is the pilot's ability to understand programming logic as opposed to a mechanical function. It is one thing to understand how all of the fuel pumps and tanks interact. It is quite another to understand how the computer that controls the fuel system collects data, interprets the data, reports on the data, and acts upon the data. When faced with a problem that appears to make little sense, the pilot is forced to conceptualize what the computer is thinking. Unfortunately, pilots are not usually programmers. We now have a cyborg middleman between the pilot and the physical aircraft. Until the programmers develop a system that allows the cyborg and the human to think as one, these occasional "holes in the system" will continue to emerge. Let's hope that, as in this case, the human has the capacity to overcome the disconnect.
Join Date: Sep 2001
Location: 38N
Posts: 356
Likes: 0
Received 0 Likes
on
0 Posts
The perceived complexity of computerized control systems often comes from the lack of access to clear functional descriptions of "how things work".
The whole technology of computing is barely 60 years old. Most of the programming concepts used in software design are less than 40 years out of the cradle. And the specific rules for a given system are often largely made up by the designers as they are going through the process.
Usually the best description of how the system works is the system itself! Unfortunately, proprietary interests combined with the lack of very effective intellectual property protection for software concepts used in small-volume production cause the design owners to intentionally obscure the exact nature of the processes by which values are determined and decisions are made. So they 'translate' the actual design into a simplified fictional design which appears in the public documentation and procedural manuals. Inevitably, errors in translation occur. And then misunderstandings follow. These errors can be expected to INCREASE over the design life of highly computerized aircraft families as incremental changes are made to systems based on intermediate documents or versions that convey incomplete understandings of the original system design concepts. This is the digital equivalent of metal fatigue.
Of course, undiscovered errors will occur in the original designs, as well. The identification and correction of these will depend on the rigor of analysis and testing during development, plus the trial-and-error realities of actual use.
Just as civil aviation authorities use a wide scope of sins to encompass the idea of 'pilot error', the aviation community should be a bit less respectful and a bit more critical of inadequately functional or simply dumb designs for computerized control algorithms and user interfaces. Embrace the concept of 'design error' as a correctable fault.
In the Air Transat case, the functionality of the Airbus fuel flow monitoring and alerting system was (and is) clearly less functional than similar systems that one can buy off-the-shelf and install in anything from a DC-3 to a Concorde. The lack of timely, precise, and meaningfull information about the vanishing life juices of that aircraft was the second designed-in trap (after the fuel line reversability) that led the pilots onto their nearly catastrophic dance with destiny.
Sure, criticize the pilots. But raise your standards for what is acceptable in aircraft systems. The flying community does not have to roll over just because A or B designs a system that is half-warm cr*p.
Insist on systems that work well and make sense.
Complain, on the record, when they don't.
Encourage exhaustive independent design review of the actual aircraft system designs at their most basic level of detail.
The whole technology of computing is barely 60 years old. Most of the programming concepts used in software design are less than 40 years out of the cradle. And the specific rules for a given system are often largely made up by the designers as they are going through the process.
Usually the best description of how the system works is the system itself! Unfortunately, proprietary interests combined with the lack of very effective intellectual property protection for software concepts used in small-volume production cause the design owners to intentionally obscure the exact nature of the processes by which values are determined and decisions are made. So they 'translate' the actual design into a simplified fictional design which appears in the public documentation and procedural manuals. Inevitably, errors in translation occur. And then misunderstandings follow. These errors can be expected to INCREASE over the design life of highly computerized aircraft families as incremental changes are made to systems based on intermediate documents or versions that convey incomplete understandings of the original system design concepts. This is the digital equivalent of metal fatigue.
Of course, undiscovered errors will occur in the original designs, as well. The identification and correction of these will depend on the rigor of analysis and testing during development, plus the trial-and-error realities of actual use.
Just as civil aviation authorities use a wide scope of sins to encompass the idea of 'pilot error', the aviation community should be a bit less respectful and a bit more critical of inadequately functional or simply dumb designs for computerized control algorithms and user interfaces. Embrace the concept of 'design error' as a correctable fault.
In the Air Transat case, the functionality of the Airbus fuel flow monitoring and alerting system was (and is) clearly less functional than similar systems that one can buy off-the-shelf and install in anything from a DC-3 to a Concorde. The lack of timely, precise, and meaningfull information about the vanishing life juices of that aircraft was the second designed-in trap (after the fuel line reversability) that led the pilots onto their nearly catastrophic dance with destiny.
Sure, criticize the pilots. But raise your standards for what is acceptable in aircraft systems. The flying community does not have to roll over just because A or B designs a system that is half-warm cr*p.
Insist on systems that work well and make sense.
Complain, on the record, when they don't.
Encourage exhaustive independent design review of the actual aircraft system designs at their most basic level of detail.
Join Date: Dec 2001
Location: London
Posts: 186
Likes: 0
Received 0 Likes
on
0 Posts
Many wise words spoken on this event, but consider this, when looking at automation issues.
In the aftermath of this incident it was asked "why isn’t the calculation of fuel remaining versus fuel loaded compared against fuel expected to be consumed done by the gizmos"? Official answer from Toulouse was, "because we wanted to leave the pilots something to do". They had deliberately not automated this function, so they said. (This sits pretty oddly with their general philosophy hitherto.)
And now, apparently, in the wake of that incident, that function is now automated. Clearly some very muddled thinking going on here.
This is not to say that the pilots did, as the DGAC AD stated and Toulouse declares, mismanage the fuel. The leak was a big one, the guys spent a fair bit of time consulting base about the bizarre "oil temp low, oil press high" message. Then they idled that engine (instructed by Montreal to do so, rumours say, so no IFSD would get in the stats and put a crimp in their ETOPS). Not to prejudge the report findings but it is at least conceivable that they had monitored the fuel state recently and while chatting to Montreal, and then looking up "fuel imbalance" in the FCOM, the bulk of the loss had already taken place. By the time they got to the "don’t do this if fuel leak is suspected" what reason could they have for suspecting one?
However, somebody knows if they were heroes or goats. When power was cut after the second engine failed, the CVR will have stopped. So, whether or not they checked their fuel state in the last 30 minutes is not a mystery. It is, however, a secret. Three years, nearly, since the incident and no report! How is safety served by this?
In the aftermath of this incident it was asked "why isn’t the calculation of fuel remaining versus fuel loaded compared against fuel expected to be consumed done by the gizmos"? Official answer from Toulouse was, "because we wanted to leave the pilots something to do". They had deliberately not automated this function, so they said. (This sits pretty oddly with their general philosophy hitherto.)
And now, apparently, in the wake of that incident, that function is now automated. Clearly some very muddled thinking going on here.
This is not to say that the pilots did, as the DGAC AD stated and Toulouse declares, mismanage the fuel. The leak was a big one, the guys spent a fair bit of time consulting base about the bizarre "oil temp low, oil press high" message. Then they idled that engine (instructed by Montreal to do so, rumours say, so no IFSD would get in the stats and put a crimp in their ETOPS). Not to prejudge the report findings but it is at least conceivable that they had monitored the fuel state recently and while chatting to Montreal, and then looking up "fuel imbalance" in the FCOM, the bulk of the loss had already taken place. By the time they got to the "don’t do this if fuel leak is suspected" what reason could they have for suspecting one?
However, somebody knows if they were heroes or goats. When power was cut after the second engine failed, the CVR will have stopped. So, whether or not they checked their fuel state in the last 30 minutes is not a mystery. It is, however, a secret. Three years, nearly, since the incident and no report! How is safety served by this?
Iconoclast
Thread Starter
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
Don't hold your breath.
To: Frangible
From what I understand the report is complete but Air Transat is fighting its’ release until there is a more amicable distribution of blame meaning some of the blame rests with Airbus and Rolls Royce.
Three years, nearly, since the incident and no report! How is safety served by this?
Join Date: Nov 2003
Location: UK
Posts: 109
Likes: 0
Received 0 Likes
on
0 Posts
Time to dispel a few myths!
The leak detection process has not changed, you simply add the fuel used to the fuel on board and it should equal the fuel you started with, same as any other aeroplane. An additional indication may be increased fuel flow if the leak is down stream of the fuel metering unit. You will also see your arrival fuel decrease on the FMGC; this was always the case nothing has changed.
The only change to the procedures I am aware of post this incident is to further highlight the correct actions following a fuel imbalance. You were then and are now required to check there is not a leak before you open the fuel cross feed using the above method just as we did on the MD and Boeing aircraft! Using the KISS principle for leak detection seems a good idea to me!
There was a long standing blue bulletin that highlighted this procedure which has been incorporated into our SOP’s. This bulletin recommended a check (fuel used + fuel on board = fuel you started with) at least every 30 minutes and was effective at the time of this incident. This check takes just a few seconds even a 4 o’clock in the morning!
The TV program alluded to software changes to alert crews to a fuel leak; if there have been any its news to me.
The indications of a leak will be as follows and in this order:
1: A fuel imbalance ECAM drill
2: Fuel low level ECAM drill
3: Engine flame out.
The engine flame out may occur before the tank runs dry if the leak is from the engine depending where in the engine the leak is. If the fuel cross feed is opened then you will get fuel low level indication in the non-leaking tank and then another flame out, on the plus side at this stage you no longer have a fuel imbalance.
The oil pressure/temp problem was due to the location of the leak and the cooling effect of the leaking cold fuel. This would have confused the crew no doubt about that as there was no way for them to know this at the time but to be honest I feel this is a red herring as the crew clearly carried out the fuel imbalance drill but failed to establish if there was a leak before opening the cross feed. It has been suggested that the ECAM misled the crew due to prioritising and oil problem ahead of the imbalance drill, yet the crew clearly carried out the imbalance drill all be it incorrectly.
I would not claim the Airbus systems are perfect, far from it, you must always be aware of the system limitations especially when it comes to ECAM. However in this case I can find little excuse for the crew opening fuel cross feed and then leaving it open when logic was screaming fuel leak. This was not a failure of the system but of its operation following a mechanical failure brought on by poor maintenance procedures.
Bottom line, the crew failed to follow established procedures!Unless further evidence comes to light to account for their actions one has to lay a large amount of responsibility for the engines flaming out at their door.
The leak detection process has not changed, you simply add the fuel used to the fuel on board and it should equal the fuel you started with, same as any other aeroplane. An additional indication may be increased fuel flow if the leak is down stream of the fuel metering unit. You will also see your arrival fuel decrease on the FMGC; this was always the case nothing has changed.
The only change to the procedures I am aware of post this incident is to further highlight the correct actions following a fuel imbalance. You were then and are now required to check there is not a leak before you open the fuel cross feed using the above method just as we did on the MD and Boeing aircraft! Using the KISS principle for leak detection seems a good idea to me!
There was a long standing blue bulletin that highlighted this procedure which has been incorporated into our SOP’s. This bulletin recommended a check (fuel used + fuel on board = fuel you started with) at least every 30 minutes and was effective at the time of this incident. This check takes just a few seconds even a 4 o’clock in the morning!
The TV program alluded to software changes to alert crews to a fuel leak; if there have been any its news to me.
The indications of a leak will be as follows and in this order:
1: A fuel imbalance ECAM drill
2: Fuel low level ECAM drill
3: Engine flame out.
The engine flame out may occur before the tank runs dry if the leak is from the engine depending where in the engine the leak is. If the fuel cross feed is opened then you will get fuel low level indication in the non-leaking tank and then another flame out, on the plus side at this stage you no longer have a fuel imbalance.
The oil pressure/temp problem was due to the location of the leak and the cooling effect of the leaking cold fuel. This would have confused the crew no doubt about that as there was no way for them to know this at the time but to be honest I feel this is a red herring as the crew clearly carried out the fuel imbalance drill but failed to establish if there was a leak before opening the cross feed. It has been suggested that the ECAM misled the crew due to prioritising and oil problem ahead of the imbalance drill, yet the crew clearly carried out the imbalance drill all be it incorrectly.
I would not claim the Airbus systems are perfect, far from it, you must always be aware of the system limitations especially when it comes to ECAM. However in this case I can find little excuse for the crew opening fuel cross feed and then leaving it open when logic was screaming fuel leak. This was not a failure of the system but of its operation following a mechanical failure brought on by poor maintenance procedures.
Bottom line, the crew failed to follow established procedures!Unless further evidence comes to light to account for their actions one has to lay a large amount of responsibility for the engines flaming out at their door.
Last edited by spy; 15th Jul 2004 at 16:25.
Join Date: Sep 2001
Location: 38N
Posts: 356
Likes: 0
Received 0 Likes
on
0 Posts
Hey, SPY.....please KISS your ECAM.
Whether the crew followed procedures or not - a matter of some debate, it seems - they were not receiving sufficient meaningful information from the aircraft itself or from the ground maintenance backup pipeline to solve/ resolve the problem in time.
Dismissing the oil pressure/temperature indication is a bit facile. A review of all the great disasters and screwups in aviation history would show many where a similar 'red herring' provided both annoying distraction and the actual key to explanation of the problem.
If there had been a way for the crew to validate the correctness of the oil system (and fuel system) readings, through redundant independent sensors, or self-testing sensors, for example, then they could have taken the information seriously enough to change the outcome. The feature of ultrareliable and validatable sensors is not an unreasonable luxury in a big ETOPS twin.
Also, the aircraft systems 'could' have produced much more meaningful diagnostic analysis in real time with the sensor data available, or they could have provided the fuel path data itself.
With the Airbus systems philosophy, one cannot really have it both ways. This could be easily changed if the designers would thoughtfully (please) include a 'switch' allowing exactly that. The two-alternative diagnostic approach is:
Way 1 - relying on "processed" information provided by proprietary analytical methods and decision trees devised by the aircraft manufacturer. These systems advisories are touted as 'smart' and 'comprehensive' because they integrate a lot of higher-level understanding about the airframe and engines, but they often are woefully lacking in providing timely, useful information to the aircraft operators. The quality and reliability of the process data results are always suspect because the true nature of the calculation is unknown and unknowable.
Way 2 - relying on precise ACTUAL DATA, provided in near real-time, from the sensors and first-impression monitoring subsystems scattered about the aircraft. Analysis of the raw fuel-flow and pressure data on both sides of the xfeed would probably have permitted the crew to detect the dumping very quickly and thus to correct the crossfeed error. Certainly the availability of good raw data would have allowed some creative ad-hoc diagnostics on the flight deck.
I fully agree. The aircraft's own well-informed logic system should have told them: "That is not improving matters. Turn off the crossfeed immediately."
Whether the crew followed procedures or not - a matter of some debate, it seems - they were not receiving sufficient meaningful information from the aircraft itself or from the ground maintenance backup pipeline to solve/ resolve the problem in time.
Dismissing the oil pressure/temperature indication is a bit facile. A review of all the great disasters and screwups in aviation history would show many where a similar 'red herring' provided both annoying distraction and the actual key to explanation of the problem.
If there had been a way for the crew to validate the correctness of the oil system (and fuel system) readings, through redundant independent sensors, or self-testing sensors, for example, then they could have taken the information seriously enough to change the outcome. The feature of ultrareliable and validatable sensors is not an unreasonable luxury in a big ETOPS twin.
Also, the aircraft systems 'could' have produced much more meaningful diagnostic analysis in real time with the sensor data available, or they could have provided the fuel path data itself.
With the Airbus systems philosophy, one cannot really have it both ways. This could be easily changed if the designers would thoughtfully (please) include a 'switch' allowing exactly that. The two-alternative diagnostic approach is:
Way 1 - relying on "processed" information provided by proprietary analytical methods and decision trees devised by the aircraft manufacturer. These systems advisories are touted as 'smart' and 'comprehensive' because they integrate a lot of higher-level understanding about the airframe and engines, but they often are woefully lacking in providing timely, useful information to the aircraft operators. The quality and reliability of the process data results are always suspect because the true nature of the calculation is unknown and unknowable.
Way 2 - relying on precise ACTUAL DATA, provided in near real-time, from the sensors and first-impression monitoring subsystems scattered about the aircraft. Analysis of the raw fuel-flow and pressure data on both sides of the xfeed would probably have permitted the crew to detect the dumping very quickly and thus to correct the crossfeed error. Certainly the availability of good raw data would have allowed some creative ad-hoc diagnostics on the flight deck.
I can find little excuse for the crew opening fuel cross feed and then leaving it open when logic was screaming fuel leak. This was not a failure of the system but of its operation following a mechanical failure brought on by poor maintenance procedures.
Join Date: Nov 2003
Location: UK
Posts: 109
Likes: 0
Received 0 Likes
on
0 Posts
arcniz
With respect you appear to know little about the practical operation of the Airbus, that or you don’t really understand it! The aeroplane and system gave them all the information they needed to identify they had a major fuel leak. You have exactly the same level of accuracy and redundancy as any other type and then some regarding the fuel indication system. This incident in a 767 or 777 would have left the crew with the same level of information and verification of data validity.
At the end of the day they had no reason to doubt the data and every reason to treat it as correct. In six years on the aeroplane I have never had a reason to doubt the fuel system it does not lie, it is clear and easy to understand.
The Airbus is highly automated but it still requires a pilot, which means there are still some functions which require the use of the human brain. The 777 won’t tell you any more than the A330 when a leak occurs nor will the 767!
This crew opened the fuel cross feed with a major fuel leak in progress. They either failed to diagnose the fault or failed to follow procedures or both. What is certain is the data regarding their fuel state was clear and easy to understand. As I said in an earlier post I have run this procedure many times with crews in the simulator it should have been a strait forward problem to solve even with other distractions.
The crew got it wrong and no amount of Airbus bashing will change that fact. They had the same level of information that crews on other types have! Had this crew been in the simulator and handled this drill in the same way they would be facing retraining and a retest!
Again this is not a witch hunt but let’s not confuse the facts with half truths and myth! This incident resulted in the loss of both engines due in no small part to the crews handling of the systems, there are important lessons to be learnt, the system worked as advertised.
With respect you appear to know little about the practical operation of the Airbus, that or you don’t really understand it! The aeroplane and system gave them all the information they needed to identify they had a major fuel leak. You have exactly the same level of accuracy and redundancy as any other type and then some regarding the fuel indication system. This incident in a 767 or 777 would have left the crew with the same level of information and verification of data validity.
At the end of the day they had no reason to doubt the data and every reason to treat it as correct. In six years on the aeroplane I have never had a reason to doubt the fuel system it does not lie, it is clear and easy to understand.
The Airbus is highly automated but it still requires a pilot, which means there are still some functions which require the use of the human brain. The 777 won’t tell you any more than the A330 when a leak occurs nor will the 767!
This crew opened the fuel cross feed with a major fuel leak in progress. They either failed to diagnose the fault or failed to follow procedures or both. What is certain is the data regarding their fuel state was clear and easy to understand. As I said in an earlier post I have run this procedure many times with crews in the simulator it should have been a strait forward problem to solve even with other distractions.
The crew got it wrong and no amount of Airbus bashing will change that fact. They had the same level of information that crews on other types have! Had this crew been in the simulator and handled this drill in the same way they would be facing retraining and a retest!
Again this is not a witch hunt but let’s not confuse the facts with half truths and myth! This incident resulted in the loss of both engines due in no small part to the crews handling of the systems, there are important lessons to be learnt, the system worked as advertised.
Transparency International
This incident in a 767 or 777 would have left the crew with the same level of information and verification of data validity.
Join Date: Sep 2001
Location: 38N
Posts: 356
Likes: 0
Received 0 Likes
on
0 Posts
The crew got it wrong and no amount of Airbus bashing will change that fact.
That said, I do think the clarity of hindsight is often considerably different from that which is available in an unfolding situation. That is the context in which the systems did not serve them well, either because of training or stupidity or oversight or because the right information was not available in the right form at the right time.
My point is and was that there's still considerable room for improvement in functionality, scope, and quality of detail reported by production aircraft monitoring systems. And better guidance is needed in using the available data for serious diagnostic procedures. These things are not so hard to do. Airbus gets the heat only because this was an Airbus flight and because Airbus has done more pioneering in some aspects of the automated controls and related information displays. More power to 'em!
The bottom line in this case is, just as it has been since the first days of aviation, the pilot(s) have to fly the aircraft they're in, not any other.
Join Date: Jul 2004
Location: HOMESVILLE
Posts: 5
Likes: 0
Received 0 Likes
on
0 Posts
If the aircraft is so clever and can detect a cigarette at 50 yards why can it not work out that due to a higher than expected fuel,usage it is going to run out of fuel way before its destiantion i.e. in the middle of the Atlantic.
I thought the aircraft was there to protect you/warn you simply and unambiguously, not be the equivalent of The Times/Le Monde crossword!
I thought the aircraft was there to protect you/warn you simply and unambiguously, not be the equivalent of The Times/Le Monde crossword!
Join Date: Nov 2003
Location: UK
Posts: 109
Likes: 0
Received 0 Likes
on
0 Posts
Roundtuit
It did, the information was very clear, you can lead a horse to water but you can't make it drink.
Dusktodawn
Good point, you would have had a very empty tank by that point. However, as the cross feed was open the aircraft was loosing fuel from both tanks so it is questionable if you would have noticed much. Still hard data is what you should be working from using control indications etc as a secondary input. Out of interest the crew could have looked at the control page and found the same information. Not sure about the 777 it is fly by wire after all but I assume it has a control display as well if the controls are not back driven!
arcniz
I understand where you are coming from (I spent 8 years in IT and system design) but really the information is there and the vast majority of crews would have landed in Lajes on one engine and we would not be having this conversation. I have only seen one crew make this error in the sim and they corrected their error before it was too late. The on board diagnostic maintenance system does allow you to check raw data from sensors and carries out BITE checks. Out of interest their engineers could have given them the codes required if they had asked.
It did, the information was very clear, you can lead a horse to water but you can't make it drink.
Dusktodawn
Good point, you would have had a very empty tank by that point. However, as the cross feed was open the aircraft was loosing fuel from both tanks so it is questionable if you would have noticed much. Still hard data is what you should be working from using control indications etc as a secondary input. Out of interest the crew could have looked at the control page and found the same information. Not sure about the 777 it is fly by wire after all but I assume it has a control display as well if the controls are not back driven!
arcniz
I understand where you are coming from (I spent 8 years in IT and system design) but really the information is there and the vast majority of crews would have landed in Lajes on one engine and we would not be having this conversation. I have only seen one crew make this error in the sim and they corrected their error before it was too late. The on board diagnostic maintenance system does allow you to check raw data from sensors and carries out BITE checks. Out of interest their engineers could have given them the codes required if they had asked.
Last edited by spy; 18th Jul 2004 at 12:20.