El Al B789 near Goa on Nov 1st 2021, suspected fuel leak

Last Update: June 28, 2022 / 18:33:12 GMT/Zulu time

Bookmark this article

Photo of El Al 4X-EDA, Boeing 787-9 Dreamliner — El Al 4X-EDA, Boeing 787-9 Dreamliner (Photo credit: Anna Zvereva / Flickr / License: CC by-sa)

Incident Facts

Date of incident
Nov 1, 2021

Classification
Incident

Cause
Suspected fuel leak

Airline
El Al

Flight number
LY-82

Departure
Bangkok, Thailand

Destination
Tel Aviv, Israel

Aircraft Registration
4X-EDA

Aircraft Type
Boeing 787-9 Dreamliner

ICAO Type Designator
B789

An El Al Boeing 787-9, registration 4X-EDA performing flight LY-82 from Bangkok (Thailand) to Tel Aviv (Israel), was enroute at FL340 about 130nm southwest of Goa (India) when the crew began to suspect a fuel leak, shut the affected engine (Trent 1000) down, turned around and diverted to Goa for a safe landing about 40 minutes later.

The passengers were taken to hotels after a PCR test as required by India's regulations.

The aircraft is still on the ground in Goa 18 hours after landing.

In June 2022 the Israeli Accidents and Incidents Aviation Investigation (AIAI) released their final report in Hebrew only (and on Jun 28th 2022 the English version) concluding the probable causes were:

The incident, which was initiated by "Fuel Migration", for a reason that was not fully clarified, from the Center Tank to the RH Main Tank, and from there to the RH Surge Tank, and spilled outboard the aircraft, that lead to the wrong Engine shutdown and to an emergency landing. The crew did not diagnose the situation, and acted as much as it could, according to the NNC, in accordance with the messages received. The NNC did not respond to this type of malfunction, and as a result, the crew concluded that there was a fuel leak on the left side of the aircraft, turned off the Left Engine, and made a deviation to make an emergency landing in the lane subfield, even though the engine was operating normally and there was no leak on the left side.

The incident occurred following a combination of an "abnormal" fault, which their nature was unknown to the operator and its flight crew, that did not appear in the training publications, hence, is not learned and practiced, and apparently as a result, the flight crew misunderstood the source of the fault and misidentified it, while using the 3 checklists:
(“Fuel Imbalance", "Fuel Disagree", " Fuel Leak"), which gave only a partial answer to understanding the situation and contributed to misleading the crew, which led to a logical but wrong diagnosis and to shutting down the engine on the side where there was no leakage (shut down of wrong engine). It is highly doubtful whether under similar circumstances, another operator's crew would have acted differently.

A fuel system discrepancy characterized by inadvertent fuel migration from the Center Tank to the RH Main Tank, and from it to the RH Surge Tank ending in spillage overboard, has happened in the past on B787 aircraft, in 3 known, documented cases. No failed component was found in those cases and hence, the manufacturer (Boeing) has diagnosed it as an FOD problem. In this occurrence as well, the fuel system was inspected comprehensively, according to the AMM and additional instructions by the manufacturer (Boeing), but there were no findings indicating a failed component.
It is highly probable that there is a Latent Defect in the fuel system, which might cause fuel migration from Center Tank to a wing Main Tank. This latent defect can be, among others, in one of the valves or in the fuel system logic.

The company's policy for handling faults has gone a long way. The policy began with a method of locating, analyzing, and making a personal decision by the PIC, (not necessarily according to orderly and uniform process), and evolved to strict adherence to acting according to the checklist (with an emphasis on introduction of ECL), which reduces flexibility in analysis, understanding, searching for the correct way to handle faults (Analyze), and the captain's discretion. This policy only partially complies with the manufacturer's policy, as set out in the Introduction to NNC as well as in the FCTM.

The company's policy of adhering to the checklist and acting only in accordance with what is written in it, did not meet the reality test and in two cases a deviation from it (action contrary to the checklist) was made by the crew:
- After an attempt to balance fuel, that failed due to the operation of a Center Tank O/J pumps, returning the switches to their original positions, i.e., closing the Crossfeed valve and stopping the Main Tank Boost pumps (See paragraph 2.9.6).
- Determining that the Scavenge pump activation has disrupted the check of the source of the fuel leak, and therefore the leak is from the LH wing/engine (See paragraph 2.7).
The crew that acted contrary to the Checklist, after exercising discretion, subsequently received the operator's backing.
The contradiction in the operator's policy, which on the one hand defines absolute adherence to the checklist, and on the other hand responded (retrospectively), the actions of the team that included actions in violation of the checklist, leads to an unclear situation between allowed and forbidden.
The crew's concern of analyzing and inaccurate understanding of the malfunction, when a Fuel Imbalance message appeared, and the inability to balance the fuel, contributed to the difficulty in determining the correct course of action, combined with checklist(s) that did not address the fault.

In this complex event, no in-depth analysis of the situation was carried out and no complete and accurate identification of the fault was carried out prior to beginning to act upon (execution of the checklist). It is highly likely that the lack of analysis was due, among other things, to the concept of instruction, study and training by the operator, in which the pilots are encouraged to adhere to the checklist items, especially in aircraft with an EICAS system that "pops up" the ECL and ostensibly eliminates the need to delve into what is behind it.
Balance was not maintained between strict adherence to the checklist versus acting according to the publications and procedures, which guide to perform an analysis before dealing with the fault and determining the course of action.

The parts of the policy, which handle the Analyze phase, is missing from the operator's OM-A. This phase did not include examining all the data, alerts, and signs of a malfunction, and determining the course of action, before deciding to address it. The operator's policy should be adapted and be practiced in simulator training in order to improve the handling of malfunctions on scheduled flights.
A good example of post-fault analysis, in accordance management policy, is described in OM-A paragraph 8.3.20.1, detailing he use of forded, which is practiced and implemented by the operator.

In the operator publications (OM-A), the handling policy of faults in general, and especially the handling of "abnormal" faults in particular, including the use of the Synoptic display, is not clearly defined in a way that will guide and support the crew to use all information sources available.

A lack of knowledge and gaps has been identified at the operator, regarding the understanding of the fuel system, which is complex and has unique characteristics, including a variety of possibilities for malfunctions and for resolving them. These topics were only partially covered in instruction, training and simulator practice. It is important to narrow these gaps of knowledge.

The method for monitoring in-flight fuel consumption in the operator's publications, is not defined properly, and might lead to a late detection of a fuel leak, due to relying on the Calculated parameter only, without examining the Totalizer data in comparing it to the flight plan.

ECL learning and training gap was identified. there is no capability for self-practice (off airplane devices, such as procedures trainer with computerized emulation of the cockpit, which enables operating ECL procedures), in order to enhance flight crews' confidence in the ECL tool.

The operator has a procedure for storing recorded data in the event of an accident and/or incident. The procedure was not implemented in this incident, and as a result important safety information was not available to the investigation team. There were previous events in which recordings have been "deleted".

The three checklists ("Fuel Imbalance", "Fuel Disagree", "Fuel leak") are not worded optimally, and might lead flight crews to erroneous actions due to the incompatibility to event such as the one in this investigation.

As per the "Fuel Leak" checklist, it is impossible to detect the leak source when the rate is less than 15 kg/minute or lower.

Activation of the Scavenge pumps when fuel quantity in the Main Tank is relatively high is highly likely to impair the fuel leak test.

The NNC Introduction's wording dealing with combined malfunctions and/or multiple system failures where the checklist is not fully compatible, might also be applicable to a single malfunction in a single system (as was the case in the subject event).

The manufacturer's FCTM policy for using the Synoptic display, where it describes "unusual" cases of unclear discrepancy and incompatible checklist, is not providing optimal guidance for using it as a tool for gathering additional information (see Appendix 7).

The flight crew was licensed and qualified to perform a flight in accordance with the law and the regulations.

The maintenance records indicate that the aircraft was airworthy and maintained in accordance with the operator's regulations and procedures.

Weight and balance of the aircraft were within the limits and as required

EICAS Advisory messages, such as "Fuel Imbalance" and "Fuel Disagree" are not monitored in the AHM communication.

The Totalizer information is not monitored by the OCC Flight Watch system, and thus it is difficult to track fuel status and get warnings on a potential leak and/or abnormal fuel consumption.

Communication between the flight crew, OCC and MCC in the subject event was partial. Effective communication may support understanding and analyzing of discrepancies in general, and of "unusual" discrepancies in particular.