Crisis over the Atlantic: The near crash of Air Transat flight 236

On the 24th of August 2001, a fully loaded Airbus A330 on a transatlantic flight from Toronto to Lisbon ran out of fuel over the middle of the ocean, forcing the pilots to attempt a harrowing 121-kilometer glide to a remote island airfield. And yet, with no fuel, no engines, minimal braking power, and only a single chance to get it right, the pilots pulled off the seemingly impossible — they brought Air Transat flight 236 to a safe landing in the Azores, after what would prove to be the longest powerless glide ever accomplished in a commercial aircraft. For a few brief days, the pilots became extraordinary heroes; and the flight itself, the Miracle on the Hudson of its time. And then reality came crashing down.

Investigators would soon uncover a chain of decisions, both on the ground and in the air, which brought flight 236 to the brink of disaster. The story involved mismatched parts during an engine replacement; a massive fuel leak over the ocean in the middle of the night; and an inability on the part of the pilots to identify the problem — a lapse which led them to feed all their fuel straight into the leak until it was gone. The incident would ultimately reveal that pilots around the world were unprepared to deal with fuel leaks, and that the design of numerous airplanes, including the A330, actively hindered crews’ ability to respond. These discoveries would cast the miracle of flight 236 in a new light — but would also tangibly improve safety for passengers everywhere.

◊◊◊

Founded in 1986, Air Transat is the third largest airline in Canada, with over 30 aircraft and more than 60 destinations. The airline does not fly domestically, specializing instead in scheduled and charter flights from Canada to popular holiday destinations abroad, switching regularly between southern locales in winter and Europe during the summer. Although the airline previously operated some Boeing and Lockheed aircraft, today it has an all Airbus fleet.

Since the late 1990s, the star of Air Transat’s long haul fleet has been the Airbus A330, a long-range, wide body, twin-engine jet which first entered service in 1994. Equipped with the latest in fly-by-wire technology, flight envelope protections, and computerized flight monitoring systems, the plane was considered state-of-the-art, and by 2001 it had yet to experience a serious accident or incident in passenger service — a fatal crash during flight testing in 1994 notwithstanding.

It was one of these A330s which was scheduled to carry out a regular overnight flight from Toronto, Canada to Lisbon, Portugal, on the 23rd and 24th of August 2001. But the story of that flight begins not on the runway in Toronto, but at Air Transat’s maintenance base at Mirabel Airport in Montreal, approximately one week before the dramatic emergency in the Azores.

On August 17th, this same airplane, registration C-GITS, was taken in for maintenance after built-in sensors twice detected the presence of metal chips in the engine oil on the right engine. Chips in the oil typically appear when a component is experiencing abnormal wear, but after inspecting the engine, technicians were unable to locate the source of the issue. It was decided that the engine should be replaced with a spare, allowing the plane to remain in service while Air Transat’s maintenance department conducted a more in-depth examination.

Airlines normally keep spare engines on hand for precisely this sort of scenario, but the preceding summer Air Transat had found itself without one for its A330 fleet. As a result, Rolls Royce loaned the airline a spare Trent 772B-60 engine of the type used on the A330 and sent it to Mirabel from an overhaul facility in Hong Kong, where it arrived in July 2000. Because the engine was the only spare Trent 772B in North America at that time, it was kept secure and intact, ready for transfer to any airline that needed it on short notice. It just so happened that Air Transat would be the first to find itself in need.

The timeline for the replacement, established on August 17th, promised to be tight. Work commenced at midnight that same day, giving workers just 48 hours — all of Saturday the 18th and Sunday the 19th — to get the plane ready for its next scheduled flight on Monday the 20th. During those 48 hours, they would need to disconnect the original engine, gather all required parts, maneuver the replacement engine into position, hook up numerous systems, install all the accessories, test the functionality of the engine, and carry out an inspection. If any of these steps took longer than expected, the next flight might have to be delayed.

Everything initially went smoothly, as the original engine was removed and stripped of any accessories which would be needed to install the new engine. Per the standard arrangement, the loaner engine from Rolls Royce came with what is known as a “carry forward list” — a list of components to be retained by the airline in order to facilitate the installation of the engine. Between those components which were already on the airplane and those kept as spare parts, Air Transat was confident that they had all the items on the carry forward list, and the installation of the new engine proceeded as planned on Sunday morning.

One of the “carry forward” items not included with the engine itself was the rear hydraulic pump. The list indicated that the engine required a hydraulic pump with part number 946976, which was the same part installed on all of Air Transat’s A330s, so the technicians decided to simply use the hydraulic pump from the old engine. Or at least, that was the plan — in fact, when they attempted to install the pump on the new engine, they were puzzled to find that it didn’t fit. It was impossible to wedge it in place because several fuel feed pipes were trying to occupy the same space at the same time. In search of a solution to this mystifying development, the technicians dived into the Airbus Illustrated Parts Catalogue, where they quickly discovered the source of the problem.

◊◊◊

In 1999, Airbus received multiple reports of minor hydraulic fluid leakages at the rear hydraulic pumps on Airbus A330s with Trent 772B engines. In response to the reports, Airbus issued a non-mandatory service bulletin, or SB, providing operators with instructions for replacing the hydraulic pumps with any of three newer versions that would be less susceptible to leakage. Recognizing that the new hydraulic pumps had wider housings which would interfere with surrounding Rolls Royce-manufactured fuel lines, that company also issued a service bulletin calling for the replacement of the fuel lines with new versions that wouldn’t come into contact with the hydraulic pumps. Both service bulletins stated that if one was to be carried out, the other must performed as well.

Because they were not seen as safety critical and were not backed up by an airworthiness directive from any regulatory authority, the service bulletins were purely optional. However, most airlines, in practice, accomplish every service bulletin whether it is required or not, and so by the time Air Transat acquired its A330s, the aircraft had had both of these service bulletins already embodied.

The loaner engine, on the other hand, had a different history. While being overhauled in July 2000, the repair shop, known as Hong Kong Aero Engine Services Limited, or HAESL, planned to carry out the Rolls Royce service bulletin on this engine, but abandoned the plan after failing to acquire the necessary parts in a timely manner. The engine was thus sent to Air Transat without the Rolls Royce service bulletin having been embodied. Furthermore, HAESL was only required to inform Air Transat about optional SBs that it had completed, not those which were still outstanding. Therefore, in order to discover the discrepancy, Air Transat personnel would have had to cross check all 167 optional service bulletins listed in the engine’s history against those embodied on the rest of the company’s engines, which was not normally done because it would take too much time.

As a result, no one was aware that the loaner engine was different until the technicians consulted the parts catalogue and realized that the fuel pipes installed on the engine corresponded to the pre-SB configuration, making them incompatible with the post-SB hydraulic pump. In order to find out what parts were actually needed, the lead technician attempted to use a computer to read a CD containing the text of the service bulletins, but due to a network error, he was denied access. The Rolls Royce SBs were also listed in the Trent Illustrated Parts Catalogue, accessible from any computer at the facility, but he was apparently unaware of this, so he instead switched to plan B and called the Air Transat Maintenance Control Center for help.

Maintenance Control patched the lead technician through to the local expert on Trent engines, known as the Engine Controller. The Engine Controller readily recalled the relevant service bulletins, although he did not have copies on hand, and informed the lead technician that they would need to replace the fuel lines in the engine with post-SB versions, which could be taken from the engine that was being removed. The lead technician asked if they could use a pre-SB hydraulic pump instead, but the Engine Controller pointed out that every Trent 772 engine in Canada had already been modified except for this one, so it would be impossible to find a pre-mod hydraulic pump. The decision was therefore made to replace the fuel lines, effectively bringing the engine into compliance with the SBs. The fact that the technicians did not have access to the text of the SBs was briefly mentioned, but the issue was quickly subordinated to concerns about the timeline.

Shortly thereafter, the technicians replaced the pre-SB fuel lines with post-SB versions and installed the post-SB hydraulic pump. This time, it went in without too much trouble. But if they had looked at the text of the SB, they would have realized that they missed a step: they were also supposed to replace the hydraulic tube which attached to the pump.

Although it was possible to install the post-SB fuel lines and hydraulic pump with a pre-SB hydraulic tube, the tube would rest against one of the fuel lines at a point where it rounded a 90-degree bend close to the pump. Aware that the plane could not be dispatched unless there was clearance between the tubes, the technicians torqued a nut on the end of the hydraulic tube until it rose approximately 0.635 mm off the face of the fuel line. They did not appear to appreciate the fact that this clearance was insufficient for a flexible tube that would change shape when pumped full of pressurized hydraulic fluid.

After the last of the accessories were installed, the technicians carried out a successful runup, and an inspector verified the continuity of the engine controls. The exact part numbers of random hydraulic tubes and the clearances between them were not part of the normal inspection regime, and the tiny mistake went unnoticed. The paperwork was then signed, the aircraft was released for service, and the technicians went home late on Sunday night, pleased that they had accomplished the work on time.

◊◊◊

Four days later, on the night of August 23rd, the crew of Air Transat flight 236 reported for duty at Toronto Pearson International Airport in order to fly C-GITS over to Lisbon. In command was 48-year-old Captain Robert Piché, a larger-than-life figure who got his wings as a bush pilot in the hinterlands of northern Quebec. His unusual resume also included a stint as an aerial drug smuggler, which saw him serve 16 months in a US prison after he was caught using his plane to transport marijuana into the country. The conviction didn’t stop Air Transat from hiring him in 1995, however, and he was considered sufficiently “reformed” by 2000 that he was officially pardoned. That night, he was joined by a much less experienced First Officer, 28-year-old Dirk DeJager, who had 4,800 hours of flying time to Piché’s 16,800. The flight also featured a full complement of 11 flight attendants and 293 passengers, totaling 306 people on board.

After topping up the plane’s two wing tanks for a total fuel load of 46.9 metric tons — 5.5 tons more than required for the journey — Piché and DeJager performed an uneventful takeoff from Toronto, and flight 236 was airborne at 19:52 local time, 42 minutes behind schedule. The flight climbed progressively to its cruising altitude of 39,000 feet, heading east across the Maritime provinces of Canada, before proceeding out over the vast Atlantic Ocean that gave the airline its name.

For four hours, all seemed to be normal. Neither pilot could possibly have been aware that deep inside the right engine, the seeds of disaster sown days earlier by the maintenance team were about to bear fruit.

When hydraulic fluid first entered the line to the rear hydraulic pump on the right engine, it forced the line to straighten slightly, causing it to come into contact with the adjacent fuel line. As the engine vibrated during normal operations over the next several days, the hydraulic line began to wear away at the fuel line beneath it, reducing its thickness until it started to crack under the force of the highly pressurized fuel coursing inside. Finally, as flight 236 cruised above the Atlantic, the pipe fractured all the way through, and fuel started to spray out into the engine nacelle. In the Azorean island chain, the nearest inhabited land, the local time was 3:38 in the morning.

Initially, the leak stayed relatively small, burbling out at a rate of approximately 10 kilograms per minute. At 3:58, crossing 30˚ west longitude, the pilots carried out a routine fuel quantity check; despite the leak, they found the fuel on board to be consistent with the amount specified in the flight plan. About 200 kilograms had been lost at this point, hardly enough to notice.

However, as time passed and the crack widened, the rate of fuel loss began to increase. The right wing fuel pumps began to work overtime to compensate for the leak, ramping up the flow rate to ensure that the proper amount of fuel was reaching the engine. Still, the plane was not equipped with any sensors that could have revealed the problem, and the pilots remained blissfully unaware.

The first indication of a problem ended up coming from somewhere totally unexpected: the engine oil system. The engine oil and fuel systems interact in only one location, known as the Fuel-Oil Heat Exchanger, or FOHE, where hot oil flows around a series of small pipes containing cold fuel. This ingenious device helps cool the oil and warm up the fuel simultaneously by exchanging heat between them. But with the fuel leak located downstream of the FOHE, the flow rate through the exchanger greatly increased, which in turn resulted in greater than normal cooling of the engine oil. As the oil cooled, it increased in viscosity, resulting in higher oil pressure and slower cycling through the system, in turn causing the amount of oil in the reservoir to decrease.

Meanwhile, the pilots continued to work through their regular cruise checks, opening the “Engine” page on the main system display to examine the engine parameters. Sometime around 4:15, as they were perusing the indications, the pilots noticed something odd: the engine oil quantity was much lower on the right side than on the left. As they debated why this might be, they noticed more unusual indications, namely a low oil temperature and a high oil pressure. Neither value was outside the manufacturer’s specifications, but they were abnormal enough to raise some eyebrows. Searching for any information about what might cause such indications, the pilots rifled through the manual, but found nothing. Both low oil temperature and high oil pressure were unusual indications in their own right, occurring in flight only under very rare and specific circumstances, and for both to appear simultaneously was unheard of.

Baffled by the unexpected problem, the pilots radioed Air Transat’s maintenance department at 4:21 to see if the engineers there could provide answers. The discrepancies were by now quite large: the right engine oil quantity was 14.5 liters, its temperature was 65˚C, and the pressure was 150 psi, while these values on the left side were 18.2 L, 110˚C, and 80 psi respectively. Something was clearly wrong, but what? Nobody could say, and the engineers too were left scratching their heads.

All the while, the Airbus’s advanced automated systems were quietly trying to compensate for the fuel leak, without the knowledge of the pilots. With fuel leaving the right wing tank much faster than the left wing tank, a computer began automatically trying to restore a balance by transferring fuel forward to the right wing tank from a reserve tank in the tail, known as the trim tank. This tank is not normally controlled by the pilots; instead, computers move fuel into and out of the trim tank over the course of the flight in order to make adjustments to the plane’s center of gravity. However, fuel from the tank can also be used to correct an imbalance between the two wing tanks, which is what began to happen on board flight 236. As soon as this occurred, a green message appeared on the screen of the Electronic Centralized Aircraft Monitoring System, or ECAM, informing the pilots that fuel was being transferred out of the trim tank, something which would not normally occur until later in the flight. It was a subtle clue that something was wrong with the fuel system, but amid the struggle to understand the oil problem, nobody noticed.

At 4:30, the trim tank ran dry, and the message on the ECAM changed to indicate that the tank had been fully transferred. The computers were now no longer able to compensate for the excess fuel leaking out of the right wing, and over the next three minutes, the fuel level in the right wing tank started to drop rapidly relative to the left wing tank. The pilots were first made aware of the issue at 4:33, when a white advisory message appeared on the ECAM, warning of a fuel imbalance. The pilots immediately closed the engine page on the system display and brought up the fuel page instead. Sure enough, the right wing tank had less fuel in it than the left wing tank. The advisory message didn’t specify any procedures which the crew should follow, but Captain Piché had dealt with fuel imbalances many times during engine failure training, and he knew by heart what to do. Acting purely from memory, without even consulting the checklist, he opened the crossfeed valve, connecting the left and right wing tanks to one another, and shut off the right wing fuel pumps, allowing the left wing fuel pumps to force fuel through the crossfeed line. Fuel began to flow from the left wing tank into the right wing tank, swiftly rectifying the imbalance.

Piché had no idea that he had just made a massive error. Whereas the leak had until this point been draining only the right wing tank, it was now draining both. And with fuel now escaping through the hole at a rate of 13 tons per hour, it wouldn’t be long before they found themselves running out of fuel, 11 kilometers above the Atlantic and hundreds of kilometers from the nearest airport.

Up until this point, the pilots had been racking their brains for some explanation for their seemingly disconnected problems, and it seems that at some point they latched onto the only explanation they could think of: a computer error. The low oil temperature, high oil pressure, and fuel imbalance were all so anomalous that it was simplest to write them off as incorrect. The possibility of a fuel leak crossed their minds, but was dismissed — after all, they hadn’t received any warnings, there hadn’t been any collisions or unusual noises that could be associated with a serious failure of the fuel system, and their last fuel burn check at 3:58 showed that fuel quantities were normal.

But as they continued to monitor the fuel system, they couldn’t help but notice that the total amount of fuel in the tanks was dropping alarmingly. Nearly seven tons had already been lost by 4:33, and by 4:45, the flight management system showed that the fuel on board had dropped below the amount required to reach Lisbon. Although they still believed that the problem was more likely than not a computer error, the pilots weren’t fools, and at 4:48 they informed Oceanic Control on the island of Santa Maria that they were diverting to Lajes Air Base, a military airfield in the Portuguese Azores.

By this point there were only seven tons of fuel left on board, down from 11 when the pilots turned on the crossfeed on at 4:36. That was not a lot, considering that Terceira Island, home to Lajes Air Base, was over 300 kilometers away, and between the leak and the fuel used by the engines, they were churning through about 19 tons per hour.

Seeking to confirm whether they were actually losing fuel, the pilots instructed the cabin crew to look out the passenger windows for any sign of fuel coming from the wings or engines. But while a stream of fuel would have been obvious during the day, it was currently the middle of the night, and even with the cabin lights off it was impossible to see anything.

Up front, the pilots were still hoping against hope that the whole situation was a massive computer error, but if it wasn’t, they would be in major trouble if they didn’t take action. Fearing a possible fuel leak from the right side, at 4:54 they turned on the fuel pumps in the right wing tank instead of the left wing tank, causing the right wing tank to feed both engines. This once again isolated the fuel in the left wing tank from the leak, but five minutes later they switched the configuration back.

At 5:01, the lead flight attendant returned to the cockpit to report that no signs of a fuel leak had been observed. Captain Piché then informed her that they were diverting to Lajes Air Base due to low fuel, and that the cabin crew would need to prepare the passengers. But, the lead attendant asked, should they prepare for a landing or a ditching? Piché’s math suggested that they would probably make it even if they ran out of fuel, but he wasn’t going to take any chances. The passengers would need to be ready for a ditching on the open ocean.

In the cabin, the news of a possible imminent ditching was met with responses which varied from panic to desperation to religious fervor to steely resolve. The flight attendants did what they had to, explaining how to put on the life jackets and how to assume the brace positions in English, French, and Portuguese.

In the cockpit, the pilots aimed straight for Lajes and watched the indicated fuel quantity drop toward zero. The fuel in the right wing tank fell through one ton and continued until it was empty. At 5:13, the right engine, starved of fuel, sputtered and died, winding down with a pitiful whine. Unable to maintain 39,000 feet on one engine, the A330 began to descend.

Before long the left wing tank was running on empty too. At 5:15, only 600 kilograms remained, not enough to sustain the left engine for more than a few minutes. The pilots tried turning on the pumps to transfer fuel from the trim tank, but that was empty too. With grim reality having finally set in, First Officer DeJager declared an emergency at 5:23. Three more minutes passed, and then, at an altitude of 34,500 feet and at a distance of 121 kilometers from Lajes, the left engine flamed out as well. The lights flickered and then went out, plunging the cabin into darkness, and the roar of the engines faded away into a terrible silence, broken only by the faint cries of terrified passengers and the distant drone of the wind.

In the cockpit, the pilots’ many computerized displays all went dark, and the flight controls reverted to Direct Law, without any computer modification. The electric trim system, the autopilot, two of three hydraulic systems, most of the spoilers, some of the brakes, the thrust reversers, the pressurization control, and many more systems were all instantly rendered inoperative. Everything that remained was powered either by the emergency battery or the ram air turbine, or RAT — a small propeller which automatically deployed beneath the fuselage to power critical instruments and flight controls. With no fuel, there was no way to bring any of these systems back online. The pilots would have to glide all the way to Lajes Field in the pre-dawn darkness with nothing more than a handful of backup instruments, while straining to move the flight controls with limited hydraulics.

But even as passengers feared the worst, the math increasingly seemed to be working in the pilots’ favor. With a descent rate between 1,000 and 2,000 feet per minute and a speed of over 200 knots, they had enough time to reach Lajes Field, and then some — if anything, they had to worry about overshooting. But from an altitude of over 30,000 feet on a perfectly clear night, the lights of the Azores were already visible on the horizon, and all Captain Piché needed to do was aim for them.

For 19 minutes, flight 236 glided silently out of the sky, her pilots engaged in a continuous back-and-forth with air traffic control as they prepared to line up with the runway. In the passenger cabin, the loss of pressurized air caused the oxygen masks to drop as the plane descended through 17,000 feet, but the need for oxygen proved short-lived as the flight continued to descend. Coming in hot at eight miles out and still at 13,000 feet, Captain Piché now took the plane through a 360-degree loop to lose altitude; passengers saw the lights of Terceira Island appear through the blackness, only to disappear once more as the plane turned away. Piché maneuvered the plane back in line with the runway, dead ahead with its lights on bright, but they were still too high and fast. Knowing that he would have only one chance at an approach, he began to slew the plane hard from side to side, banking and yawing sharply to increase drag. The passengers held on for dear life as Piché carried them on a masterful carnival ride, using the full range of his limited controls to maneuver the stricken plane directly to the runway threshold.

And then, at 5:45 a.m., flight 236 streaked over the threshold and touched down on Lajes Field’s sole runway, traveling at a blistering speed of over 200 knots. The main gear touched down hard and the plane bounced back into the air; thinking quickly, Piché planted it back down again and slammed on the brakes. With no functioning anti-skid systems, the tires immediately slid and then burst, one after another; but Piché could not lift his foot, because the emergency braking system only had enough residual hydraulic pressure for one or two brake applications. Smoke streaming from its ruined landing gear, the plane skidded on its rims, sparks flying in every direction, for what seemed like an eternity, before it finally ground to a halt, upright and in one piece, 7,600 feet down the 10,000-foot runway.

Fire trucks immediately rushed to the airplane and doused its burning landing gear with foam, while the pilots ordered the cabin crew to begin an emergency evacuation. The flight attendants opened seven of the plane’s eight doors — the eighth suffered a malfunction — and all 293 passengers exited down the slides in an orderly manner. Sixteen people suffered minor injuries in the process, but they could hardly have cared — some passengers were in fact so relieved to have avoided a ditching that as soon as they were off the plane, they bent down and kissed the runway.

◊◊◊

News of the remarkable emergency landing of Air Transat flight 236 soon spread, and by the end of the morning, news agencies were already branding it a miracle. Captain Piché and First Officer DeJager were lauded as heroes; journalists hounded them for interviews and passengers praised their nerve and skill in breathless accounts on TV. But for investigators with Portugal’s Aviation Accidents Prevention and Investigation Department, or GPIAA, the first order of business was to keep an open mind. They, along with Canada’s Transportation Safety Board, had been tasked with finding the causes of the near disaster, and they would be expected to leave no stone unturned — even if some of those stones were the subject of public acclaim.

Their first order of duty was to inspect the plane itself. Although it was not quite a write-off, damage was heavy: the landing gear had been all but destroyed, and the touchdown was so violent that the fuselage had warped just behind the wings. But the most important piece of damage found by the investigators was a modest L-shaped crack, 80mm in length and 2.5mm wide, in an inlet fuel tube on engine #2. The crack had spread from an area where the fuel line and an adjacent hydraulic tube had been rubbing together, until it eventually split open, causing the fuel leak.

By reviewing documentation, examining the engine, and interviewing Air Transat maintenance personnel, the investigators established that the technicians performing the engine replacement on the weekend before the accident had left in place a hydraulic tube which was incompatible with the adjacent fuel lines. This in turn occurred because the engine was loaned to Air Transat without having been modified in accordance with the latest Rolls Royce service bulletins, and because the technicians, despite recognizing this fact when they could not install the hydraulic pump, finished the job without acquiring the actual text of the service bulletins, and without realizing that they were also supposed to have replaced the hydraulic tube, not just the fuel lines.

This sequence of events represented a breakdown in the service bulletin system, which is designed to clearly delineate between those modifications which are safety critical and those which are not. Neither the Airbus service bulletin about the hydraulic pump nor the Rolls Royce service bulletin about the fuel lines was safety critical on its own, but when the Air Transat technicians inadvertently mixed modified and unmodified parts, a safety risk was created where none previously existed.

Despite the possibility of such a risk arising, there was relatively little oversight of the implementation of non-mandatory service bulletins in the aviation industry. The Hong Kong-based company which last overhauled the engine was not required to carry out the latest optional SBs, nor was it required to keep documentation stating that it had not done so. Responsibility for ensuring that the engine was in compliance with the latest SB’s belonged to the operator which eventually installed it on an aircraft. At Air Transat, service bulletins were normally reviewed by the engineering department, but the particular SBs in question were unfamiliar to the company engineers because all of Air Transat’s A330s had already been modified by their previous owners; and furthermore, it was not standard practice to compare the full list of service bulletins on a loaner engine with those embodied on the airline’s other engines. The cumulative result of these procedural gaps was that any discrepancy in the modification status of a loaner engine was unlikely to be discovered until technicians were trying to install it on an airplane.

Once the discrepancy was discovered, time pressure may have caused the lead technician to conclude that the work could be finished without referencing the exact text of the service bulletins. Consequently, the technicians basically replaced those parts which they observed to be obstructing the installation of the hydraulic pump, rather than all the parts whose replacement was called for in the service bulletins. The pre-SB hydraulic tube was omitted because it appeared to fit beside the post-SB fuel line. Although it was predictable that the flexible hydraulic tube would press down onto the fuel line when pressurized, the technicians had not been trained on this property of flexible pipelines and did not predict it. Investigators felt that quality control experts, had they been present, might have been more skeptical, but none were on site, because Air Transat’s quality control personnel only worked Monday to Friday.

◊◊◊

All of these human, systemic, and mechanical errors led to the fuel leak, but that turned out to be only half the story. The other half, revealed through black box data and interviews with the pilots, would ultimately undermine the initial narrative of the accident by proving that even with the leak, the plane need not have run out of fuel.

From very early in the investigation, the GPIAA and TSB noted that the pilots of flight 236 never carried out any of the three possible fuel leak procedures, and in fact opened the crossfeed between the left and right tanks for 32 minutes, allowing several tons of fuel from the otherwise unaffected left wing tank to be lost via the leak in the right engine. Calculations showed that if the pilots had stopped crossfeeding and carried out the “Fuel Leak from Engine” procedure at 4:45, when they first made the decision to divert, they would have landed with 5,136 kilograms of fuel and two operational engines. The related “Fuel Leak from Tank” and “Fuel Leak Not Located” procedures would have been slightly less effective, but still would have allowed the plane to land with fuel in the left wing tank and one operational engine. Additionally, even if none of these procedures were performed, a similar result could have been obtained simply by never opening the crossfeed in the first place.

This revelation led investigators to examine the pilots’ minute-by-minute decision-making as the emergency unfolded.

Although the black box data showed that the leak started at 3:38, there would have been little indication of this fact until almost an hour later. The A330, like almost every other aircraft, did not have sensors capable of directly detecting a fuel leak and warning the crew via the ECAM. Instead, flight crews were expected to observe a fuel imbalance between the two wing tanks, and then refer to the “Fuel Imbalance” checklist. This checklist contained a note which read, “Caution: Do not apply this procedure if a fuel leak is suspected. Refer to fuel leak procedure.” Unless the fuel leak was directly visible to the crew, this was the only procedural pathway which would lead pilots to the fuel leak procedures. It did not, however, explain what indications should lead them to suspect a fuel leak in the first place.

In the actual event, the crew didn’t even get this far, because Captain Piché immediately performed the fuel imbalance checklist from memory, and thus never saw the caution note at all. This decision showed that a fuel leak was not on the pilots’ minds when the fuel imbalance advisory appeared at 4:33. Although in hindsight a leak is one of the most probable explanations for a large imbalance during an unexpected phase of flight, there were a number of reasons why the pilots might have failed to consider it, most of which were ultimately rooted in the perceived rarity of such a malfunction.

First of all, A330 pilots were generally taught that if a system malfunction occurred, they would be alerted to it via the ECAM. This may be true 99% of the time, but the network of sensors feeding the ECAM is not omniscient, and pilots should keep in mind that there are countless rarer malfunctions that may not be covered. From their interviews, it was apparent that the pilots expected an issue as serious as a major fuel leak to be indicated on the ECAM, and the absence of any warning was improperly taken as evidence against the existence of a leak.

Secondly, again because of their rarity, fuel leaks were not covered in training, and pilots were not taught what symptoms to look for or what procedures to carry out. The number of malfunction scenarios that can be covered in training is much lower than the number of conceivable malfunctions, so some must be left out, and fuel leaks happened to be among them. This would have left the pilots unprepared to recognize the symptoms, such as an unexpected fuel imbalance and an earlier-than-normal transfer of fuel out of the trim tank. (It should also be noted that the automatic transfer of fuel from the trim tank to the right wing tank delayed the activation of the fuel imbalance advisory by 15 minutes, resulting in more fuel loss before the pilots could discover the problem.)

With all of this in mind, wind back the clock a few minutes, and recall that the first indications of any abnormality were the simultaneous readings of low oil quantity, low oil temperature, and high oil pressure in the right engine, a combination of symptoms which was not covered in the manual and was unknown to Air Transat’s maintenance department. Because of the strangeness of the indications, combined with the fact that the engine appeared to be running normally, it was quite natural for the pilots to develop a suspicion that the fault lay with the computers that were processing the information.

This mindset had already begun to develop when the pilots received the totally unexpected and seemingly unrelated fuel imbalance advisory. Captain Piché’s almost casual decision to apply the fuel imbalance procedure from memory came from a belief that any response need only be precautionary. There was nothing dangerous about opening the crossfeed to transfer fuel from one tank to another, even if the warning of an imbalance was false, so there was nothing to be lost by doing it — or so he thought. Still, investigators felt that the pilots should have examined the indications more closely, perhaps discovering in the process that six tons of fuel were missing, before deciding what action to take.

The next opportunity came less than 10 minutes after opening the crossfeed, when the pilots observed that they had less fuel on board than expected, and that the total fuel quantity was decreasing at an unbelievable rate. This was the first truly strong evidence of a fuel leak, and yet the pilots did not treat it as such, and in fact they left the crossfeed open, feeding fuel straight into the leak, for another 20 minutes. So why did they not change their course of action when faced with these astonishing new indications?

In attempting to explain it, investigators turned to a cognitive phenomenon called framing bias. Framing bias is the human tendency, when faced with two negative choices, to choose a course of action with a low probability of a disastrous loss, over a course of action with a high probability of a moderate loss. In the case of flight 236, one course of action was to assume the existence of a fuel leak and take action to mitigate the loss of fuel. On the other hand, according to the principle of framing bias, it would be more tempting to assume that the indications were a computer glitch and that everything was fine, even though this would result in a worse outcome on the (perceived) off chance that there really was a leak. This choice may be conscious or unconscious, but in the case of flight 236 it would have been the latter.

Furthermore, once this frame or mindset was chosen, confirmation bias would have made the pilots more likely to consider evidence which supported their existing mindset, such as the absence of any ECAM warnings, the absence of any noise or impact that could be associated with a major malfunction, the failure of the flight attendants to detect any signs of leaking fuel, and what they perceived to be an unreasonably high rate of fuel loss.

As a result of all of these factors, the pilots did not accept that they were dealing with a real fuel leak until it was too late. By the time they were confronted with enough evidence to reset their mental model, they no longer had enough fuel to reach any airport, and there was little point performing a fuel leak procedure. In fact, the pilots themselves confirmed that they did not totally abandon the belief that a computer glitch could be responsible until the right engine flamed out at 5:13, while the latest point at which the application of any fuel leak procedure would have made any difference was 4:54.

Although there were reasons to question some of the pilots’ decisions, investigators noted that the behavior of Piché and DeJager on flight 236 was remarkably similar to some previous incidents involving fuel leaks. Perhaps most significantly, in 1997 an Air France Airbus A320 on a short domestic flight suffered a serious fuel leak, resulting in a fuel imbalance advisory. The crew of this flight also responded to the imbalance by opening the crossfeed, worsening the leak; and in another parallel to flight 236, crewmembers were unable to see the escaping fuel due to darkness. That flight ultimately landed at its destination with 900 kilograms of fuel remaining.

In fact, in two out of three cases of serious fuel leaks in the mid-1990s, the pilots could not determine that a fuel leak was occurring. In light of this finding, the French Bureau of Inquiry and Analysis, or BEA, published a report in 1997 which concluded that existing procedures did not adequately assist flight crews in detecting the presence of a leak. This report prompted Airbus to create the fuel imbalance checklist, as well as a new fuel leak checklist; however, the crew of flight 236 never referenced them. The issue in fact lay somewhat deeper, in the inability of pilots to recognize a need to refer to those checklists in the first place.

◊◊◊

The investigation had by this point identified wide-ranging deficiencies which left 306 people suspended above the Atlantic for 19 minutes aboard a plane with no working engines. But it would be up to others to ensure that these deficiencies were rectified.

One of the first actions taken by Transport Canada was to suspend Air Transat’s certificate to operate twin-engine aircraft far from any airport, forcing the airline to temporarily fly longer routes in order to stay close to land. The agency also published a number of materials intended to assist flight crews in identifying and mitigating fuel leaks, and ordered Air Transat to put its pilots through several additional training courses. Among the new training items provided by the airline was a fuel leak scenario, correcting the lack of knowledge which has influenced pilot decision-making in many fuel leak incidents. The airline also hired more maintenance and quality control personnel and launched an effort to improve its maintenance environment. Meanwhile, Airbus and the French Directorate General of Civil Aviation worked together to produce a recommended service bulletin modifying the Flight Warning Computers on A330 and A340 aircraft, allowing them to warn of possible fuel leaks by continuously comparing the planned fuel with the actual fuel on board. And finally, Rolls Royce issued a service bulletin asking operators to inspect their engines to ensure adequate clearances between fuel and hydraulic lines, which was made mandatory by an airworthiness directive from the Civil Aviation Authority of the United Kingdom.

Following the publication of the final report, some additional actions were taken, including the introduction of a new FAA regulation requiring airliners to warn the crew if the amount of fuel available falls below that required to reach the destination. Several airworthiness directives were also issued with the aim to improve the clarity and accessibility of fuel leak procedures.

◊◊◊

For Captain Piché, the revelation that the plane need not have run out of fuel was uncomfortable, but perhaps not surprising. He never attempted to argue with the findings, and in fact from the very beginning he had sought to discourage others from calling him a hero. His actions that day were human, but not superhuman; they were imperfect, but ultimately not disastrous. And once all the decisions had been made, and all that remained was to get the plane to the runway, Piché’s true talent — stick and rudder flying — was made apparent, as he executed a flawless dead stick landing on a tiny island in the middle of the ocean, at night, with the lives of 306 people in his hands. In the process, he set a record for the longest powerless glide in a commercial airliner — 121 kilometers — which still stands today. That feat earned him an Air Line Pilots Association Superior Airmanship Award, which is really all he could have asked for. So was Piché a hero? He would say no, but it’s up to us to decide. And in the end, there is no right answer. Accidents such as this are often born from a murky series of screw-ups, misunderstandings, and miscues that only becomes clear to us after the fact — and sometimes what matters most is that everyone walked away, regardless of who was to blame.https://amznewspaper.com/2023/08/02/crisis-over-the-atlantic-the-near-crash-of-air-transat-flight-236/?fbclid=IwAR3i8FNpHvIHDyDrdKLITHGqAuaQRc1c0B5Dt268EhFNvy3XOOzKwSIU-X8