Aviation Investigation Report A03P0332

An Air Canada Airbus A330-300 (registration C-GHKX, serial number 0412), operating as Flight ACA216, departed Vancouver International Airport, British Columbia, at 1423 Pacific standard time on a scheduled flight to Calgary, Alberta, with 6 crew members and 92 passengers on board. Shortly after take-off, the Vancouver tower informed the pilots that a substantial amount of smoke or vapour was coming from the number 2 engine. Although the pilots did not receive any abnormal engine indications or cockpit warnings, they declared an emergency and advised that they were returning to Vancouver.

After an uneventful landing, the pilots shut down the number 2 engine. Aircraft rescue and firefighting services, following the aircraft, advised the pilots that fuel was leaking from the engine but there was no sign of fire. Eventually, the aircraft was towed back to the terminal where the passengers were deplaned. There were no injuries or damage to the aircraft.

During a routine service check of C-GHKX the day before the occurrence, maintenance personnel found fuel leaking from the drain mast on the number 2 engine (Rolls-Royce RB211 TRENT 772B-60/16, serial number 41102). Further investigation showed that fuel was leaking from the air/oil heat exchanger. On the Airbus A330, engine oil is cooled by the air/oil heat exchanger. A torque motor automatically directs high-pressure fuel through a jet pipe to a piston that opens or closes an air valve to control oil temperature. The fuel leak exceeded the limits prescribed in the Airbus A330 troubleshooting manual (TSM). Maintenance entered the defect, including the corrective action required, into the aircraft maintenance logbook and removed the aircraft from service at approximately 1300 Pacific standard time.^{Footnote 1} The aircraft was then towed to an Air Canada hangar to replace the air/oil heat exchanger.

A notation was made, by mistake, on the maintenance office duty board, indicating that the aircraft required a fuel/oil heat exchanger replacement instead of the air/oil heat exchanger, as had been written in the aircraft logbook. Subsequently, a maintenance team of three licenced aircraft technicians, starting work at 2030, was assigned the task of replacing the fuel/oil heat exchanger.

Image

The technicians reviewed the air/oil heat exchanger defect in the logbook, noted the discrepancy with the duty board, and decided to check the fuel/oil heat exchanger first. It was decided that two of the technicians, one of whom was authorized by Air Canada with maintenance release authority for the Airbus A330 and the TRENT 700 engine, would troubleshoot the suspected leak. They disconnected a low-pressure (LP) inlet coupling to the fuel/oil heat exchanger (see Figure 1), and fuel sprayed from the disconnected line. Confirming that the fuel/oil heat exchanger was not the source of the leak, the technicians prepared to reconnect the LP fuel line and ordered replacement seal rings. Some time later, the inlet coupling was reattached to the fuel/oil heat exchanger and the three bolts were tightened to the correct torque. However, a retainer, a crucial component to the security of the coupling, was omitted. The technicians who removed the LP fuel line on the fuel/oil heat exchanger were unfamiliar with the style of coupling used and did not refer to the Airbus A330 TSM, nor did they refer to all relevant sections and pages of the aircraft maintenance manual (AMM) when removing or reinstalling the LP fuel line. In addition, the removal and reinstallation of the LP fuel line was not recorded on any maintenance documents, contrary to Air Canada's maintenance policy manual and Transport Canada regulations. Once the LP fuel line was reinstalled, the connection was inspected for leaks and security from an elevated platform in the hangar.

The two technicians resumed troubleshooting the fuel leak, this time using the Airbus A330 TSM, and determined that the source was the air/oil heat exchanger, as identified in the aircraft logbook. It was also noted during this troubleshooting sequence that the LP connection on the fuel/oil heat exchanger was not leaking fuel. They removed and replaced the defective air/oil heat exchanger. Referencing the A330 AMM, the technicians ran the engine at idle for six minutes. Once the engine run was complete, the connections were inspected for leaks from the ground. The air/oil heat exchanger may be inspected from the ground, but an inspection of the LP fuel-line connection on the fuel/oil heat exchanger requires the use of an elevated platform, as required by the A330 AMM. The A330 AMM also requires the use of a special developer on the reassembled components that aides in detecting fuel leaks. Neither an elevated platform nor a developer was used for the inspection of the fuel fittings and detection of leaks. No discrepancies with the LP fuel line connection or leaks were noted. All appropriate paperwork for the replacement of the air/oil heat exchanger and the subsequent engine runs was completed, and the aircraft was returned to service.

The following day, the aircraft departed for Calgary, Alberta, as Flight ACA216. The taxi and the take-off roll were normal. The departure was during daylight hours and in clear weather conditions, and pilots of another aircraft waiting to depart observed a fuel leak from ACA216 as a significant vapour trail (see Appendix A). The pilots of that departing aircraft informed the Vancouver tower of the vapour trail coming from the number 2 engine of ACA216, and, in turn, the Vancouver tower relayed this information to ACA216.

During the flight, the pilots received no abnormal engine performance indications or warnings from the electronic centralized aircraft monitoring (ECAM) system. The ECAM displays basic fuel data on the cruise page and will display detailed fuel information on demand. Later, the pilots determined that 3700 kg of fuel was used above the normal consumption rate. There was no sign of a fuel spill on the apron or on the taxiway leading to Runway 26L. However, a substantial amount of fuel was found at the threshold of Runway 26L, where ACA216 departed.

Transportation Safety Board of Canada (TSB) investigators and Air Canada maintenance personnel examined the engine and found that the LP inlet fuel line to the fuel/oil heat exchanger of the number 2 engine had detached. Although the fuel-line coupling appeared to be intact and the three bolts holding the coupling together were tight, the retainer was missing. The missing retainer was found further down the detached fuel line, obscured from view. The engine manufacturer, Rolls-Royce, indicated that it is possible, within the tolerance range of all the LP components, that the three bolts that hold the LP connection in place may not bottom out if the retainer is omitted. It is, therefore, possible to achieve torque of the proper value. In light of this scenario, the compression on the seal rings is possibly sufficient to prevent leakage at idle power. The flight data recorder (FDR) was removed from the aircraft and sent to Air Canada's maintenance facility in Dorval, Quebec, for downloading. The downloaded information was analysed by the TSB Engineering Laboratory.

Rolls-Royce indicates that pressure in the LP fuel line increases from 100 pounds per square inch (psi) at idle to approximately 190 psi at take-off power while the fuel flow rate increases from 685 kg per hour to 9000 kg per hour. Data from the FDR indicate that a fuel discrepancy began when engine power was increased for take-off. At take-off power, the fuel loss was calculated to be approximately 10 000 kg per hour, yet the engine continued to operate normally.

The TSB determined that incidents of engine fluid loss following maintenance activities have occurred in the past. Between 1999 and 2000, there were three incidents in three different aircraft where the incorrect assembly of fluid fittings was not discovered during the required engine idle runs. Information from one engine manufacturer indicates that idle power ground runs can only be expected to detect 80 per cent of all engine fluid leaks. A test flight or a ground run at higher power settings, to create conditions such as increased fuel/oil pressures and sustained vibration, would be required to detect the remaining 20 per cent of leaks. At least one airline company in Canada requires a high-power engine run as standard practice after a component replacement that could result in fluid leaks. This airline, however, operates aircraft with different engines than those on the occurrence aircraft. Also, the engine manufacturer does not require a high-power run-up after engine maintenance.

In August 2001, another Canadian-registered Airbus A330 made an emergency landing with both engines inoperative due to fuel exhaustion resulting from a severe fuel leak. As a result of the 2001 occurrence and a similar fuel leak in 1997 involving an Airbus A320, Airbus Industrie issued Service Bulletin (SB) A330-28-3080. This SB provides Airbus A330 operators with instructions on how to activate fuel-leak monitoring software. Once activated, this fuel-leak monitor will alert the flight crew to a discrepancy of more than 3500 kg between the initial fuel on board (FOB) and the total of the present FOB plus the fuel used (FU). When a discrepancy is detected, a single chime sounds and a FU/FOB warning is shown on the ECAM display. Compliance with this SB is recommended by Airbus but is not required by regulation. At the time of the occurrence, Air Canada had not implemented the SB on any of its Airbus A330 aircraft (see Safety Action Taken).

Because of the conflict in written tasks between the job board and the aircraft logbook, combined with the technicians not using the TSM to resolve the problem, the LP fuel line to the fuel/oil heat exchanger was unnecessarily disconnected. Once the LP fuel line was disconnected, the technicians did not refer to or follow all of the reinstallation procedures in the available AMM. During the time it took for the replacement seal rings to arrive, the retainer, which cannot be removed from the fuel line, slid down the fuel line and became obscured from view. The LP fuel-line coupling was then reassembled without the retainer in place.

During the required idle engine run, the fuel pressure and low fuel-flow rate, combined with minimal engine vibration, were insufficient to simulate in-flight conditions. Therefore, the LP fuel line did not detach from the fuel/oil heat exchanger, despite the missing retainer. After the idle engine run, the reconnected components were inspected for leaks, but none were found. The fuel/oil heat exchanger was inspected from the ground and not from an elevated position, as required by the Airbus AMM, where a thorough inspection could be completed. Also not used was a developer that would have made detecting fuel leaks easier. Given that the LP coupling can appear secure without the retainer in place, along with the technicians unfamiliarity with this particular fitting, it would have been difficult to detect whether the retainer was missing, even from an elevated position. The seal rings on the LP fuel line had been compressed sufficiently to prevent any leaks, rendering the developer, if it had been used, ineffective in detecting the missing retainer.

As the engine power levers were advanced for take-off, an increase in fuel pressure, flow rate, and, perhaps, engine vibration caused the LP fuel line to detach from the fuel/oil heat exchanger because the retainer was missing. The fuel leak resulted in a large vapour trail, noticeable to other aircraft crew and observers on the ground (see Appendix A). A high-power ground run performed after the maintenance work had been completed would have greatly increased the probability of detecting the incorrect installation.

The vapour trail was brought to the attention of the crew, and they took appropriate action. Without this alert, it could have taken some time for the pilots to detect that the fuel was disappearing, since there was no indication of a fuel problem from on-board equipment, and the differential fuel remaining may not have been noticed in a timely manner. Air Canada had not implemented Airbus SB A330-28-3080, which alerts pilots to a potential fuel leak once there is a loss of 3500 kg of fuel. Implementation of this SB would reduce the risk of fuel exhaustion, engine shutdown and fire. On this flight, a fuel loss totalling 3500 kg occurred in fewer than five minutes following departure.

The following TSB Engineering Laboratory report was completed:

• LP 132/2003 – FDR Analysis

Findings as to causes and contributing factors

1. Because of an incorrect entry on the maintenance office duty board and because technicians did not follow the TSM, they unnecessarily removed the LP fuel line from the fuel/oil heat exchanger.
2. Because the technicians were unfamiliar with the coupling, because the retainer was hidden from view, and because they did not refer to the AMM, the technicians did not properly reconnect the LP fuel line.
3. Upon the application of take-off power, the fuel pressure, the fuel flow rate, and engine vibration caused the fuel/oil heat exchanger LP fuel line to detach, causing a substantial fuel leak from the number 2 engine.

Findings as to risk

1. A high-power engine run was not performed by the operator (nor was one required by the engine manufacturer), which would have produced conditions similar to those that caused the LP fuel line to detach from the fuel/oil heat exchanger on take-off. A high-powered engine run could decrease the risk that a leak or mis-installed component would go undetected.
2. Correct inspection of the fuel/oil heat exchanger would require the use of an elevated platform both prior to and after the actual engine run-up. A proper inspection of the LP fuel line connection was not accomplished after the engine run-up, increasing the risk that a leak or mis-installed component would go undetected.
3. Air Canada had not implemented Airbus SB A330-28-3080. Implementing this SB would reduce the risk that a fuel leak could go undetected, leading to fuel exhaustion, engine failure, or fire.

Other findings

1. The removal and reinstallation of the fuel/oil heat exchanger LP fuel line was not documented, as required by Air Canada's maintenance policy manual and Transport Canada regulation.

Air Canada

On 16 December 2003, Air Canada issued an Airbus A330 Maintenance Alert to all Air Canada technicians endorsed on the Airbus A330, stating, in part, the following:

It is imperative that you always consult the appropriate Technical Publications, AMM/TSM, etc., especially in cases where you are not familiar with the aircraft, systems or engine and to follow the specified instructions for maintenance and/or troubleshooting. Furthermore, all work performed must be recorded in the appropriate records as required by both the Air Canada Control Manual and the Canadian Aviation Regulations.

In addition, Air Canada conducted an internal safety review of the circumstances surrounding this incident, including pro-active recommendations to prevent a recurrence. Since this occurrence, Air Canada has completed SB A330-28-3080 on approximately 50 per cent of the A330 fleet and has had plans to have all remaining A330 aircraft modified by the autumn of 2004.

Transportation Safety Board

On 03 March 2004, the TSB sent a Safety Advisory (A030025-1) to Transport Canada, indicating that it may wish to review current aviation maintenance practices and procedures regarding engine run-up procedures. Specifically, the advisory targeted maintenance practices and procedures following maintenance on fuel and oil systems, with the aim of ensuring that potential fluid leaks are detected. In systems where fluid pressures and flow rates change dramatically from idle to take-off power, the application of take-off power may be required to ensure the integrity of the system.

Transport Canada

Transport Canada responded to the Safety Advisory on 16 June 2004. A review of the procedures for fuel and oil leak test checks contained in various engine manufacturers' maintenance manuals^{Footnote 2} was carried out. The procedures were found to be sufficient, providing they were followed.

A review of the Service Difficulty Reports database was carried out on fuel and oil leaks, and it indicated that they were attributed to either poor maintenance practices or manufacturing modifications that were required to correct leak problems. It is important to note that none of the reported events would have benefited from a high-power engine run-up procedure.

Transport Canada is of the opinion that the industry-wide impact in imposing a task to run-up engines at takeoff power for detection of LP fuel and oil leak tests must be carefully considered, as there is insufficient data to support such a decision.

Documented statistics that engine idle power run-ups do not detect all leaks on LP fuel and oil systems during leak check tests are required to support a task change substantiation for take-off power run-ups.

Standard maintenance practices and human factors principles are also involved in this incident equation and may have been a contributing factor.

Given the information provided, it is Transport Canada's recommendation that the procedures as written in the Airbus A330 Aircraft Maintenance Manual are sufficient, and when followed would detect a leak at IDLE power run-up.

Transport Canada Civil Aviation is going to publish, in the Aviation Safety Maintainer, an article on the subject of fuel/oil leak engine test runs after maintenance.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 07 September 2004.

Appendix A - Visible Fuel Leak from Flight ACA216

Image

Image