France A332 near N'Djamena on Dec 31st 2020, fuel leak

Last Update: August 25, 2022 / 17:08:21 GMT/Zulu time

Bookmark this article

Photo of Air France F-GZCJ, Airbus A330-200 — Air France F-GZCJ, Airbus A330-200 (Photo credit: airlines470 / Flickr / License: CC by-sa)

Incident Facts

Date of incident
Dec 31, 2020

Classification
Incident

Cause
Fuel leak

Airline
Air France

Flight number
AF-736

Departure
Brazzaville, Republic of the Congo

Destination
Paris Charles de Gaulle, France

Aircraft Registration
F-GZCJ

Aircraft Type
Airbus A330-200

ICAO Type Designator
A332

An Air France Airbus A330-200, registration F-GZCJ performing flight AF-736 from Brazzaville (Congo) to Paris Charles de Gaulle (France) with 136 passengers and 11 crew, was enroute at FL380 about 190nm south of N'Ddjamena (Chad) when the crew detected a fuel leak at the #1 engine (CF6). The crew declared emergency and diverted to N'Djamena for a safe landing on runway 23 about 35 minutes later.

The occurrence was rated an incident and is being investigated by the French BEA.

On Aug 23rd 2022 the BEA released their final report in French only (English version to be expected in due time and summarized then) concluding the probable cause of the incident was (translation from French by AVH):

Although the leak was identified and located at the left hand engine, the crew decided to keep the engine running contrary to the FUEL LEAK procedure. The shutdown of the engine was only done during taxiing more than 80 minutes later. The purpose of shutting the engine down is not only to preserve fuel in the associated fuel tank, but also to prevent flow and distribution of fuel into potentially dangerous areas. The risk of fire was underestimated by the crew because it was not clearly indicated in the corresponding procedures or supplementary manuals.

The partial application of the FUEL procedure contributed to the degradation of the decision making process, notably ruling out closer alternate options and instead diverting to N'Djamena, where infrastructure and conditions were not optimal.

Contributing factors to the fuel leak were:

- design of flange
- intrinsic difficulties in assembling the flange
- difficulties in verifying the proper installation of the flange
- use of the old flange model, which made is possible to install the flange incorrectly resulting in the fuel leak

Contributing to the decrease of safety marging, in particular with respect to the risk of fire were:

- the partial execution of the FUEL LEAK procedure relating to the fuel management by the crew
- inadequate leadership and crew work skills, probably linked to excessive consensus building and possible group effect
- lack of mention of fire hazard in the manufacturer's documentation
- the selection of N'Djamena for diversion when other suitable airfields were closer to the route

Contributing to limiting the risk of fire were:

- the intervention of the second officer who reminded the crew in accordance with the FUEL LEAK procedure to not extend the thrust reverser even in idle thrust

Contributing to the safety of flight after landing

- the cabin preparation for a possible evacuation by the main purser

On Aug 25th 2022 the BEA released their English Final Report concluding:

Contributing factors

Although the leak was identified and then located in the left engine, the crew decided to keep this engine operating contrary to the requirements of the FUEL LEAK procedure. It was shut down while taxiing after the landing, i.e. more than 1 h and 20 min later. The purpose of shutting down the engine is to both conserve the fuel in the associated fuel tank and prevent the fuel from being dispersed into potentially dangerous areas. The fire hazard was underestimated by the crew in part because it was not clearly indicated in the corresponding procedure or in the supplementary manuals.

The crew’s partial application of the FUEL LEAK procedure contributed to degrading the decisionmaking process, in particular by excluding alternate options closer to the route, and resulted in the choice of a diversion to N'Djaména, where the infrastructure and the weather conditions were not optimal.

The following factors contributed to the occurrence of the fuel leak

- Design of the mounting flange.
- Intrinsic difficulties in assembling the mounting flange.
- Difficulties in checking that the mounting flange is correctly assembled.
- Use of a former mounting flange model, which made it possible to assemble the flange incorrectly and for a large leak to occur.

The following factors contributed to decreasing the flight’s safety margin, in particular with regard to the fire hazard

- Crew’s partial application of the FUEL LEAK procedure for the management of a fuel leak.
- Insufficient leadership and crew cooperation competency probably due to an excessive search for consensus and a possible group effect.
- No mention of the fire hazard in the manufacturer's documentation.
- Selection of N'Djamena airport for the diversion when other suitable airports were closer to the route.

The following factor contributed to limiting the fire hazard

- Intervention of the relief pilot who reminded the crew that, in accordance with the FUEL LEAK procedure, the thrust reversers should not be extended, even at idle speed.

The following factor contributed to the safety of the flight after the landing

- Chief purser preparing the cabin for a possible evacuation.

The BEA analysed:

At the beginning of the en-route phase at FL 380, during the first checks to be carried out at this stage of the flight, the captain noticed that they were short of 1.4 t of fuel, without any visible lateral imbalance between the tanks. He attributed this difference to the fuel transfers in progress, shared this information with the co-pilot and the relief pilot and then left the cockpit for his rest period, asking the two co-pilots to monitor the evolution of the fuel.

About 20 min after leaving the cockpit, he was called back by the co-pilots who suspected a leak on the left engine. The crew began to carry out the FUEL LEAK procedure. Although this procedure asks the crew to consider landing at the closest suitable airport22 and to shut down the engine with the leak, they decided to keep it operating and considered a diversion initially to Yaoundé and then to N'Djamena. Thereafter, the occurrence of the FUEL F.USED/FOB DISAGREE alerts and the FUEL IMBALANCE advisory message, which referred the crew to the FUEL LEAK procedure, did not lead to a change in the action plan. The crew continued to keep the left engine operating and kept N'Djamena as the alternate airport.

During the descent to N'Djamena, the controller informed them that ILS 05 was not in service, but that the RNP 05 approach was available. The relief pilot then consulted the NOTAMs, which confirmed that the ILS was unavailable and that the runway length was reduced by 390 m due to a displaced threshold on runway 05. After the relief pilot gave his opinion about the aiming point of the RNP 05 approach, the captain confirmed that this risked bringing them to the usual 05 threshold and not the displaced threshold and that it would be better to carry out the RNP 23 approach. This proposal was accepted.

The captain indicated that there might be a tailwind on final 23 and proposed to shut down the engine after landing. Discussions took place among the three crew members as to when exactly they considered shutting down the engine after landing. No joint decision was made at this stage.

The aeroplane landed 550 m after threshold 23 at a speed of 150 kt (VAPP+8). A few seconds later, the ROPS warning, BRAKE MAX BRAKING MAX BRAKING was triggered. The PF applied full braking on the brake pedals. The temperature of the brakes increased to more than 300°C. Fuel spilled onto the runway. Despite the crew’s initial debate, the decision was taken to turn around in the correct direction in the turnaround bay, with the left engine on the outside of the turn. More thrust (around 40% of N1) was then applied to engine 1, where the leak was located.

After the turnaround, the crew shut down engine 1. The aeroplane taxied to the parking area and engine 2 was shut down. A fire fighter started spraying water under engine 1. Once the aeroplane was made safe, the passengers disembarked.

On arrival, a comparison between the fuel used and the remaining fuel indicated a total fuel leak of 5.7 t for a flight time of 2 h 21 min.

Origin of in-flight fuel leak

During a scheduled maintenance operation in September 2020, the aeroplane’s two engines were removed. During the reassembly, the Primary Fuel Hose (PFH) shoulder was incorrectly positioned on the left engine, probably due to there being poor visibility and the difficulties with carrying out the assembly operations. The pressurization of the fuel system after the maintenance work did not identify any fuel leak, although the hose was not correctly aligned, probably because the O-ring and the torquing of the bolts ensured leaktightness.

No leaks were detected during the checkout flight, nor during the six following flights. During the occurrence flight, probably as a result of vibrations on the ground and in flight, the PFH shoulder moved in the bore of the mounting flange, which loosened the whole assembly and caused a fuel leak at this flange.

Following a previous leak at the PFH mounting flange, the HAECO maintenance centre had implemented training in 2016, drawing the attention of the maintenance personnel to the possibility of a misalignment (see Appendix 2). This one-off occurrence and training did not prevent the misalignment on F-GZCJ. The note in the engine manufacturer's documentation used for the flange assembly recommends ensuring that the PFH shoulder is fully seated on the pylon before tightening the bolts, to avoid distortion of the assembly. The lack of a clear methodology for checking for correct alignment, the lack of information about the possible consequences of a mounting flange misalignment, and the lack of clarity in the explanatory diagram referenced in the maintenance task probably limited the maintenance technicians’ awareness of the risk of an assembling error and the risk of leakage.

A new mounting flange design, with a smaller inner diameter was developed to limit the possibility of a mounting flange alignment error. As early as 2015, a special bulletin issued by Collins Aerospace, the mounting flange manufacturer informed operators of the availability of this new mounting flange model, while indicating that the former model could still be used, and this until stocks of the former model were depleted. No service bulletin from the engine manufacturer or aircraft manufacturer was issued with respect to this Collins Aerospace bulletin.

Since 2017, Collins Aerospace only offers the new model to its customers. Nonetheless, it is possible that the former mounting flange model will continue to be installed for several years, depending on maintenance shop stocks. The possibility of a leak at the PFH mounting flange still exists if operators use the former mounting flange design.

Not shutting down engine

The crew began to carry out the FUEL LEAK procedure after the captain returned to the cockpit.

Nevertheless, the engine shutdown was a stopping point in the processing of the failure. The captain immediately decided to keep the engine operating and, from that moment on, introduced a deviation from the procedure. The co-pilots who shared his opinion, in particular for the en-route phase, quickly agreed with his suggestion to keep the engine operating. Any questioning of the decision not to shut down the engine was therefore unlikely in the absence of new elements during this flight phase.

Several reasons may have influenced the crew's initial decision to delay the engine shutdown.

The first reason was probably their shared interpretation of the FUEL LEAK procedure. In their statements, the three pilots spontaneously indicated that the main objective of the engine shutdown en route was to conserve fuel quantities should it be required by the flight path, i.e. when flying over an ocean or desert.

During the event, fuel conservation was not considered necessary, as indicated by the captain’s words when he said that they had 12 t to 15 t, plus possibly the trim tank, and that they had enough time to reach N’Djamena. The engine shutdown thus seemed to lose its operational meaning.

Moreover, in this same context, the engine shutdown was perceived as necessary only to avoid an engine flame-out due to fuel starvation, which the captain gave as the main risk during the TEM briefing on the threats related to the approach.

This decision was probably reinforced by the observation of normal parameters, despite the technicians visually confirming the leak during the descent, as well as by the latitude left by the FUEL LEAK procedure to start up the engine again in the event of a wing tank leak.

The second reason was probably a form of shared apprehension about shutting down the engine in flight, especially at night, over the African continent, in a context of health restrictions and a curfew.

The pilots’ statements as well as their conversations seemed to confirm that shutting down the engine and diverting were consistently perceived as a threatening change of plan. The captain expressed this feeling several times when he said that if they shut down the engine, this would be the beginning of something big, that there was a risk of finding themselves with one engine operative and having to divert, and that flying on one engine was not a very comfortable situation.

In his statement, the co-pilot mentioned the existence of a psychological barrier to shutting down an engine in flight and the relief pilot said he was "relieved" by the captain's decision not to shut down the engine.

Thus, each time the decision to shut down the engine was mentioned, the arguments in favour of the initial decision - keeping the engine operating - were privileged:

- En route, shutting down the engine was only useful as an anticipatory measure (to prevent engine flame-out).
- It is not specified in the procedure that it has to be shut down.
- During the approach, shutting it down could lead to a go-around.
- And finally on the ground, the environment is hostile for turning around on a single engine.

It seemed that the engine shutdown was only justifiable insofar as it would prevent an engine flame-out due to fuel starvation, especially since the risk of an in-flight fire was not taken into account, as evidenced when one of the crew said that it did not seem to be specified in the checklist that it had to be shut down and there was no notion of a possibility of a fire.

In his statement, when asked about the management of a fire, the captain indicated that if a fire had broken out, the crew would have carried out the ENGINE FIRE procedure.

The analysis of the CVR showed that in the en-route phase, not one of the flight crew questioned the deviation from the FUEL LEAK procedure, in particular the shutting down of the engine.

It is possible that the expected behaviours, know how to deviate from procedures in consultation with the crew when safety requires it, and improvise when faced with the unforeseeable to obtain the safest result, mentioned in Part D of the Air France Operations Manual reflect a safety culture in part of the flight crew population which esteems crew behaviour capable of easily deviating from procedures. The wording of these expected behaviours is notably different from that in the European regulations and in particular in the Acceptable Means of Compliance (AMC) concerning Evidence Based Training. It is possible that these differences in wording in the Air France documents contribute to maintaining a form of tolerance with respect to deviations from procedures by certain crews.

Lastly, several factors could have also contributed to the observed deviation from the FUEL LEAK procedure:

- Format of documentation

The paper format of the QRH FUEL LEAK procedure may have contributed to the initial decision not being questioned. Indeed, the crew indicated in their interviews, that they considered the paper format to be “less mandatory” than the ECAM electronic format. In addition, the format with multiple sub-steps, required a certain analysis of the situation by the crew.

- Limitations of simulator training Since flight on one engine does not present any risk during simulator training, it does not allow crews to perceive their own degree of aversion to the risk of single-engine flight in real conditions.

Leadership and crew cooperation

It can be seen that the crew persevered in their initial decision, the risks associated with the chosen solution being underestimated while those associated with the alternative solution were given more weight.

At first sight, the decision appeared to be collective. However, listening to the CVR, and certain elements of the statements suggest a false consensus, especially during the approach and on the ground, and a possible group effect. During the preparation of the approach, the captain indicated to the co-pilot that the decision to shut down the engine was his, however he concluded the discussion by opting to keep the engine. During the descent, the captain asked whether there was any risk in keeping the engine operating, without giving the co-pilots the time to answer because he immediately replied to himself, saying that it was not specified in the check-list that it had to be shut down and that the possibility of a fire was not mentioned therein.

The captain’s propensity to express himself first, in a repetitive way, was not conducive to the copilots expressing their opinions and doubts, in particular in their proposal to shut down the engine just after landing and when they evoked the fire hazard.

The discussions thus appeared falsely open insofar as the captain often provided answers to his own questions without taking into account the suggestions made by the co-pilots.

For their part, apart from the use of the thrust reversers, the co-pilots did not manage to assert their point of view, in particular with respect to the fire hazard on the ground, nor did they succeed in getting the captain to take a position on when he considered shutting down the engine.

In this situation, which was considered threatening, the search for consensus within the group, and therefore the search to maintain group cohesion, prevailed over the objective evaluation of alternatives.

Although the QRH procedure must be applied with as a “read and do”, as for an ECAM procedure, it is possible that the paper format of the QRH procedure did not contribute to the decision being questioned. Indeed, an ECAM message may be more easily perceived as a request from an external actor - in this case the plane - thus offering an alternative to group thinking.

Fire hazard during occurrence

During the occurrence, a significant fire hazard existed, especially since the engine compartment in which the leak occurred is a hot area, where engine surfaces often exceed the spontaneous ignition temperature of the fuel.

The PFH mounting flange is located over a drain pan designed to collect any small leaks and drain them to the engine drain mast at the bottom of the nacelle. This drainage system is not sized for such a large fuel leak. As a result, it is very probable that the drain pan overflowed and that fuel was splashed onto the hot surfaces of the engine. If, in flight, the drain pan overflows, the fuel can be drained under the effect of the airflow through the rear of the nacelle. On the ground, the fuel is drained through pipes at the bottom of the nacelle.

The risk of fuel ignition depends on the rate of leakage, the air pressure and the ventilation flow in the area. These conditions vary depending on the flight phase. The risk of spontaneous ignition increases as the speed and/or altitude decrease. At the end of the flight, the pressure, temperature and ventilation conditions were conducive to the spontaneous ignition of the fuel.

Although it is difficult to formally demonstrate because the level of atomization of the fuel and the air flow in the engine, in particular on approach and on the ground could not be determined with precision, the most probable hypothesis according to the manufacturer, is that the substantial fuel flow and the restricted space of the nacelle resulted in a concentration of fuel which was too high to ignite.

This information was not known to the crew and was out of their hands.

Crew’s perception of fire hazard

In flight

During the en-route phase, the fire hazard was not considered by the crew. The pilots’ statements as well as the analysis of the CVR showed that several reasons were put forward to try to justify this point of view: the normality of the engine parameters; the fact that, as the fire had not declared itself immediately, the crew judged that it was unlikely that it would declare itself subsequently; the observation that the fuel was draining from under the engine and away from it, at a distance from the hot parts.

During the descent, the FUEL IMBALANCE advisory alert nevertheless caused the captain to ask whether there was any danger in keeping the engine operating, to which he himself replied by verbalising his interpretation of the FUEL LEAK procedure when he said that it was not specified in the check-list that it had to be shut down and there was no notion of a possibility of fire. The two co-pilots agreed with this statement. The crew then continuously adhered to the logic that the remaining quantities of fuel were such that the engine did not have to be shut down to reach the alternate airport.

The crew did not mention the risk of an in-flight fire during the descent and approach phases and did not consider that this risk was different from that of the en-route phase. The risk of fire during the go-around was not mentioned during the approach briefing.

On ground

The risk of an engine fire on the ground was clearly expressed by the co-pilot in descent, during the approach briefing.

The relief pilot suggested shutting down engine 1 before the turnaround. He also persevered in demanding compliance with the "REVERSERSERS DO NOT USE” line in the FUEL LEAK procedure, without however verbalising the fire hazard when the thrust reversers are used, which he was aware of. The clear knowledge of this risk, mentioned during the interview, encouraged him to persevere until he obtained the captain’s agreement.

Just after landing, the relief pilot again asked if the engine shutdown was being considered. The captain, for his part, preferred turning around in the turnaround bay with the left engine operating, which indicates that he perceived the risk as low.

The investigation showed a significant gap between the crew's perception of the risk of the fuel igniting and the real risk, when considering the internal route of the leak, and previous events, in particular during the approach and taxiing phases.

This event shows the difference between the individual perception of the risk, based on the professional experience of a crew, and the reality of the facts. The FUEL LEAK operational procedure reflects the manufacturer's in-depth risk analysis and the cumulative in-service experience of manufacturers and operators.

Decision process and diversion

When the captain left the cockpit for his rest period, although he had a doubt about the gauges, this effectively ruled out any possibility of a discussion about turning back to Brazzaville. Around 30 min then elapsed between the initial detection of the fuel leak and the start of the FUEL LEAK procedure with the full crew. While the captain was absent, the co-pilots had begun to assess the meteorological situation at the alternate airports they were considering (F in the FORDEC decision method).

The crew's discussions about the pertinence of the FUEL LEAK procedure and shutting down the engine then resulted in an additional decision time of 30 min.

The duration and structure of the crew's decision-making process contributed to a significant increase in flight time whereas the situation required them to consider landing at the closest suitable airport, as stipulated in the FUEL LEAK procedure (LAND ASAP line). During this phase, the Yaoundé airport was the closest to the flight path.

Furthermore, the FORDEC decision method was started although the failure had not been processed and the technical situation was not stabilized, disrupting the crew's situational awareness.

The insufficient collection of facts, which is the first action in this process, did not allow the crew to exhaustively assess the two diversion options of Yaoundé or N'Djamena.

- Yaoundé airport, which was the regulatory en route alternate airport in the flight plan, had greater operational safety margins than N'Djamena: the meteorological conditions were satisfactory, the approach could be made using an ILS on runway 19, the length of the runway was 3,402 m which did not give rise to any form of landing limitation. The crew considered that it was a disadvantage that none of the pilots knew this airport and that it was a 777 and not an A330 stopover.

- N'Djamena airport had a more restrictive runway, officially 2,410 m long, although the 390 m corresponding to the displaced threshold could be used in order to taxi to the end of the runway to turnaround when landing on runway 23. Moreover, the ILS and the PAPI of runway 05 were not in service.

At the time the decision was made, the aircraft had passed the point where it was at an equal flight time to Yaoundé and N'Djamena, and N'Djamena airport imposed itself as the only possible option.

The choice of the latter was then made without knowing the operational and technical conditions of N'Djamena airport. The crew's decision was mainly based on the fact that the pilots were familiar with this airport, and that they considered it safer because of the military presence on the other side of the runway. The crew thus placed themselves in a situation of having to deal with the facts when the descent had already begun.

The crew's only choice was that of the QFU (05 or 23) and the landing configuration.

However, both QFUs had operational risks:

- On runway 23, there were strong tailwind conditions until very short final, increasing the possibility of a go-around.

- On runway 05, the length of the runway would have been highly restrictive (landing at the displaced threshold). In addition, the crew anticipated difficulties related to the fact that the aiming point of the RNAV approach was at the "usual" threshold and not at the displaced threshold.

The crew therefore chose to land on runway 23, operationally the longest runway, but with a strong tailwind component. Although they were aware of and verbalized the tailwind on final, they chose the flaps 324 and not full flap configuration, in order to be ready for the possible loss of the engine before landing. The go-around was not "briefed": the crew did not verbalize their strategy in case of a go-around: select TOGA power for both engines or reduce engine 1 because of the leak and follow the single-engine flight profile.

The fire hazard study conducted in the scope of this occurrence indicated that this fire hazard in case of a go-around was very high, which the crew was not aware of.

It is possible that subject to a form of stress, in real operational conditions, the crew tried to simplify the decision-making process, by heading for a known airport considered more reassuring. In this way, they tried to simplify the tasks and limit their workload solely to the diversion, excluding the problems associated with single-engine flights.