Aviation Investigation Report A08Q0082

The Air Canada Airbus A330-343 (registration C-GFAH, serial number 0279), operating as ACA418, departed Toronto/Lester B. Pearson International Airport, Ontario, at 1622 Eastern Daylight Time en route to Montréal/Pierre Elliott Trudeau International Airport, Quebec, with 228 passengers and 10 crew members on board. During the flight, several fuel pump low-pressure warnings appeared and the affected pumps were switched off as per the appropriate published procedure. While in descent into Montréal, low-pressure warnings appeared on the remaining functioning fuel pumps; they were switched off and the engines continued to operate normally with gravity fuel feeding. During the level-off at 11 000 feet above sea level, the left engine (Rolls Royce, RB211 TRENT 772B-60) incurred a rollback below idle, generating an engine stall followed by an engine fail message on the electronic centralized aircraft monitor. All fuel pumps were switched back on and the left engine regained power shortly thereafter. An emergency was declared and the aircraft landed without further incident.

1.1 Flight Crew Information

The flight crew was certified and qualified for the flight in accordance with existing regulations. The captain had accumulated a total of 15 882 hours of flying experience, including 669 hours on the Airbus A330 and A340 of which 335 were as captain. He was occupying the left seat and was the pilot not flying. The first officer was occupying the right seat and was the pilot flying. The first officer had accumulated a total of approximately 14 370 hours of flying experience of which 807 hours were as first officer on the A330 and A340.

1.2 Weather Information

The departure weather in Toronto at 1600^{Footnote 1} indicated that the winds were from the west at 15 knots, a visibility of 15 statute miles, a few clouds at 3500 feet above ground level (agl) and a ceiling at 7000 feet agl. The temperature was 11°C and the dew point was −6°C. The destination weather in Montréal at 1600 indicated that the winds were from the west at 11 to 17 knots, a visibility of 15 statute miles and a ceiling at 6000 feet agl. The temperature was 8°C and the dew point was −6°C.

The forecast outside air temperature at the top of climb, flight level (FL) 350, was −57°C, and −46°C eleven minutes later at the top of descent point. Therefore, the average cruise outside air temperature was -51.5°C or 2.7°C above the international standard atmosphere (ISA) temperature of -54.3°C.

1.3 Pre-Flight Information

The aircraft arrived in Toronto from Vancouver International Airport, British Columbia, at 1436 and was prepared for the next scheduled departure of 1600 to Montréal. During this preparation, the right integrated drive generator was found to be inoperative and the aircraft was dispatched under section 24-22-01 of the A330 minimum equipment list (MEL). One of the conditions for dispatch under MEL 24-22-01 is that the auxiliary power unit (APU) generator operates normally and is used throughout the flight. Furthermore, the APU fuel consumption must be taken into account when the fuel required for the flight is calculated. The APU consumes approximately 200 kilograms per hour (kg/h) on the ground and 65 kg/h in flight.

Air Canada uses a flight planning system,^{Footnote 2} which among other functions, performs the fuel calculations for the flight. The computer flight plan was prepared in accordance with the flight operations manual (FOM) fuel policy,^{Footnote 3} taking into account an additional 300 kg of fuel for APU use throughout the entire flight.

Based on the forecast passenger load, the planned take-off weight was 160 500 kg, and the flight was planned at FL350 without a destination alternate in accordance with the FOM.^{Footnote 4} The AFPAC fuel calculation for the planned 51-minute flight was as follows:

The fuel to destination (BURN) is the fuel required for the flight, based on the route to be flown. The fuel in tank (FIT) is the fuel reserve required by regulation at destination.

When dispatching without a destination alternate (ALTN), the FIT is calculated from the landing runway threshold. It includes the missed approach fuel and 30 minutes' hold at 1500 feet above sea level (asl) at 15°C.

Regardless of conditions, a minimum of 10 minutes of flight is always carried as contingency fuel (CF).^{Footnote 5} Contingency fuel was calculated at 700 kg.

Additional fuel is above and beyond the minimum requirements, based on the assessment of the dispatcher or the crew, to cover operational needs. The Automated Flight Planning at Air Canada (AFPAC) fuel calculations included 1000 kg of air traffic control (ATC) fuel and 300 kg of deviation (DEV) fuel to meet the MEL requirement for APU operation during the entire flight.

The aircraft is equipped with 5 fuel tanks (see Figure 1); two inner and outer wing tanks, and one trim tank in the horizontal stabilizer. A total of 4563 litres (3874 kg) of Jet A1 fuel was uploaded in Toronto and the total fuel was distributed as follows: 450 kg in each of the left and right outer tanks, 4500 kg in each of the left and right inner tanks and no fuel in the trim tank. The total fuel on board (FOB) at the time of departure was 9900 kg.

Image

1.4 Aircraft Information

The aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. However, the fuel tank water draining had not been performed in accordance with the Maintenance Planning Document.

1.4.1 A330 Fuel System

Each inner tank is equipped with 3 electric fuel pumps-two main and one standby. Inner tank levels are maintained between 3500 and 4000 kg through outer tank transfer valves that automatically cycle to allow gravity fuel transfer from the outer tanks. A collector cell located in each inner tank has a capacity of approximately 1150 kg. It provides a fuel reservoir for both main fuel pumps and ensures negative load factor protection to feed the engines. The collector cell is kept full as long as one main pump operates. A jet pump is activated by motive fuel flow from any main pump to draw fuel from the inner tank to maintain the collector cell full. Interruption of both main pumps stops the action of the jet pump and the corresponding collector cell fuel starts draining back into the inner tank until its contents equalize with the inner tank level. The equalization process may take up to 45 minutes, depending on inner tank quantity.

Three pressure switches (part number HTE69000-1) are co-located on the rear spar of each wing and sense the fuel pressure from each pump using separate sensing lines (see Figure 2). The switches trigger a low-pressure warning if the delivery pressure of the corresponding pump falls below 6 psi. The main fuel pumps operate continuously, while the standby pumps located outboard of the collector cell operate only when a main pump low-pressure is sensed. A non-return valve (NRV) is installed in each pump's outlet port to prevent reverse flow of fuel through the inoperative pump.

Image

Any one of the 6 pumps can supply both engines with the crossfeed valve^{Footnote 6} open. Should all 6 wing fuel pumps become inoperative, the fuel is fed by gravity to the engine-driven low-pressure and high-pressure pumps.

1.4.2 Fuel Quantity Indications

The electronic centralized aircraft monitor (ECAM) fuel page displays the fuel used, the fuel temperature, the total fuel on board, as well as the fuel quantity in each separate fuel tank (see Figure 3). The fuel quantity of the inner tank collector cell is also displayed, and is included in the inner tank quantity indication.

Image

Six pictograms representing the fuel pumps show a straight vertical green line when the pump is running and a cross line when the pump is not running. Abnormal pump behaviour is indicated in amber. The left or right wing tank low-level warning is triggered when the fuel quantity in the wing is between 1640 kg and 2700 kg, depending on the aircraft pitch attitude.^{Footnote 7}

1.4.3 Fuel System Controls

The main and standby fuel pumps are activated by push-button controls (see Figure 4) that are normally in the pushed-in position with no lights illuminated, in accordance with Airbus' dark panel philosophy. The fault light in the push-button illuminates when the delivery pressure drops below 6 psi and the OFF light illuminates when the pump is turned off.

Image

1.5 History of the Flight

The aircraft took off from Toronto at 1622. The initial climb was uneventful. Seven minutes into the flight, a right fuel standby pump low-pressure message appeared briefly on the ECAM^{Footnote 8} then disappeared.

At 1632, while passing approximately FL250, the right number two main fuel pump low-pressure warning appeared and the right standby fuel pump came online automatically. The crew switched off the right number two main fuel pump in accordance with the displayed ECAM procedure.^{Footnote 9} One minute later, the right number one main fuel pump low-pressure warning was generated and was also switched off as per ECAM procedure.^{Footnote 10} At that time, the left main fuel pump fault lights flickered and a fuel check was performed by the crew confirming that a fuel leak was not the cause of the multiple fuel low-pressure indications. The fuel on board was observed to be approximately 2900 kg in each left and right inner tank.

FL350 was reached at 1637 and the crew switched the right main fuel pumps back on to verify if they would function in a lower-pitch attitude than during the climb, but the low-pressure indications remained. At this time, the company anticipated low fuel ECAM (ALFE) procedure (see Appendix A) was carried out since the fuel on board was already below 7000 kg, and the company dispatch was advised of the ECAM fuel warnings and indications.

At 1639, a trim tank fuel pump low pressure was detected confirming that the trim tank was empty. One minute later, both the left number one and number two main fuel pump low-pressure warnings were generated and both pumps were switched off as per the displayed ECAM procedure,^{Footnote 11} leaving only one standby fuel pump operating in each left and right inner tank. The crew advised the company dispatch of the increasing fuel problem; a diversion was considered and later rejected due to the proximity of the destination airport.

At 1646, the descent was commenced and the crew switched all the fuel pumps back on to verify again if they would function in a lower-pitch attitude, but the low-pressure indications remained.

At 1654, while descending through approximately FL200, the gravity fuel feeding procedure was carried out as a precautionary measure in case one of the remaining standby fuel pumps failed. It could not be determined if the crossfeed valve was closed at this point. However, the crossfeed valve was to be closed once below the gravity feed ceiling (see subsection 1.7.2).

At 1657, as the aircraft was descending through approximately 16 000 feet asl, low-pressure warnings on both the left and right standby pumps were generated. A low-pressure warning of the last remaining pump in a wing results in a low-pressure warning of wing pumps; therefore, the ECAM displayed low-pressure procedures of both left and right wing pumps.^{Footnote 12} The procedure, which requires the opening of the fuel crossfeed valve and switching the remaining fuel pumps off, was performed by the crew, resulting in gravity fuel feeding to the engines.

Company dispatch was advised of the additional failures and a request was made to air traffic control (ATC) to level off at 11 000 feet asl, remain at high speed and stay close to the destination airport while on radar vectors, but an emergency was not declared.

At 1700, the aircraft levelled at 11 000 feet asl and the autothrust commanded an engine spool-up to maintain the current speed. As both engines reached approximately 65% N1,^{Footnote 13} the left-engine fuel flow decreased rapidly, causing a reduction in N1 to below flight idle, resulting in an engine stall warning on the ECAM.^{Footnote 14} Shortly thereafter, an engine fail warning was generated and the appropriate ECAM procedure^{Footnote 15} was displayed.

An emergency was declared with ATC, the autopilot was disengaged, the thrust levers brought to the maximum continuous thrust detent, and all the fuel pumps were switched back on. The left engine N1 remained below idle approximately 30 seconds before accelerating to the same thrust setting as the right engine; approximately 85% N1. Although all the fuel pumps were switched on and the engine regained thrust, the fuel pump indications on the ECAM remained amber, thereby still indicating a fault condition. The total fuel on board at that moment was approximately 5000 kg.

During the approach, the thrust was manually increased to verify engine response, and the engine acceleration was normal. The aircraft landed at 1712. While taxiing, the ECAM fuel system page was observed and several of the fuel pump indications appeared in green or normal condition. No fuel leak was observed by the ground personnel on arrival at the gate and the ECAM total fuel on board was 4500 kg. This corresponds to the estimated arrival fuel calculated by the AFPAC.

1.6 Post-Flight Activities

The digital flight data recorder (DFDR) was downloaded by the operator and the file was subsequently obtained by the TSB from the operator's secure website. The DFDR data did not include the position of the crossfeed valve.

According to the company FOM procedures,^{Footnote 16} the cockpit voice recorder (CVR) circuit breaker is to be pulled after gate arrival on flights where an accident or incident has occurred. Furthermore, the location of the appropriate circuit breaker is provided for each aircraft type. However, the CVR circuit breaker was not pulled at the termination of the event flight.

The A330 CVR automatically stops recording on the ground, 5 minutes after the second engine shutdown.^{Footnote 17} However, the recording starts again on the ground during the first 5 minutes after the aircraft electric network is energized, and also after the first engine start. The CVR was not removed after the flight; it was overwritten when an engine run-up was later performed, then again when the test flight was conducted, resulting in the loss of information for the TSB investigation.

According to the TSB Regulations, "The owner, operator, and any crew member are responsible for the preservation of any evidence relevant to a reportable incident."^{Footnote 18} Following this event, the aircraft was inspected, repaired, refuelled, test-flown and returned to service without coordination with the TSB.

A measurement of the fuel remaining was performed using the aircraft manual magnetic indicators. Initial dripping results indicated a total fuel quantity of 3600 kg, while the second results indicated 3800 kg. However, once the fuel level equalized throughout the inner tank, results showed 4500 kg.

The water draining procedure was performed and 4.5 litres of water were found in each inner tank. However, this quantity is considered normal by Airbus. The Air Canada Aircraft Maintenance Planning Document requires that the water draining procedure be carried out at each service check (7-day interval). If this is not practical, the draining could be deferred, but the intent was not to go beyond the next service check. The last water draining procedure was performed on 04 April 2008, or 26 days before the event.

Analysis of fuel samples taken from all 6 fuel pressure switch sensing lines revealed the presence of suspended particles. Free water droplets were also visible in both standby pump samples.

During the post-flight maintenance run-up, a leak was noted from the dry drains tube of the left fuel metering unit (FMU). Even though not significant to the event, the leak was found to be outside acceptable limits. During the run-up, all fuel pumps were found to be operating normally. As a precautionary measure, both left and right high-pressure engine-driven fuel pumps were replaced. When tested, both pumps output volume and pressure met their normal performance parameters. At disassembly of the left pump, signs of cavitations were noted. This can occur when air is introduced into the pump.

As part of the troubleshooting effort, the left and right FMU, fuel control and monitoring computers (FCMC) and engine electronic controls (EEC) were replaced. All the components were sent to the part manufacturers or authorized repair facility for testing, and were found to meet their respective performance specifications. Additionally, the checks and tests carried out in accordance with the maintenance manual on the fuel system components did not reveal any anomalies. Furthermore, all 6 fuel pressure switches and wing fuel pumps were found to perform normally and remained on the aircraft.

In accordance with Airbus specified recommendations, a test flight was performed on 04 May 2008 to verify the proper operation of the fuel system in flight. The tests included gravity fuel feeding operations, which was found to function normally. However, the inner tank fuel quantity was higher than on the occurrence flight. The aircraft was returned to service on 05 May 2008.

Airbus later suggested additional checks that included entry and inspection of both inner tanks. This inspection performed on 04 June 2008 confirmed the correct position of the fuel lines, connections and components, free movement of the valves and their proper sealing, and a check of the water drain holes for blockage. All components were found to be normal.

On 17 June 2008, Airbus further suggested the replacement of the NRVs on the jet pump side of the fuel canister inside both collector cells. These components were replaced as recommended. At that time, the aircraft had flown 611 hours and performed 85 cycles since the occurrence flight, with no reports of abnormal fuel indications.

1.7 Abnormal Procedures

The ECAM provides audio warnings for failures and conditions requiring crew action or attention. It also automatically analyses the aircraft system failures and produces the appropriate procedure on the upper ECAM display, with the affected system schematic on the lower ECAM display.

1.7.1 Anticipated Low Fuel ECAM (ALFE)

The ALFE procedure was initially developed by Air Canada for the A340 with no technical objection from Airbus. It was later adapted for the A330 with the approval of Transport Canada. Its use is suggested when the aircraft is expected to land with less than 7000 kg of fuel on board, which was the case for this occurrence. The procedure is to be performed during the descent preparation or while in a hold, with the objective of reducing the distractions caused by the possible ECAM fuel low-level (FUEL LO LVL) warnings during the approach and landing. This company procedure anticipates items to be carried out in the fuel left or right wing tank low-level (FUEL L (R) WING TK LO LVL) procedure by, among other actions, opening the fuel crossfeed ahead of time. However, this is in conflict with the gravity fuel feeding procedure, which requires the crossfeed to be closed once below the gravity feeding ceiling.

1.7.2 Gravity Fuel Feeding

When all 3 fuel pumps are inoperative in one inner tank, the fuel can still be accessed by the gravity fuel feeding procedure (see Appendix B). The procedure requires selecting the ignition switch to IGN for the engine relight attempt should a rollback occur. The gravity fuel feeding ceiling is then determined, and when the aircraft is below the gravity feeding ceiling, the crossfeed is closed. If the flight time from take-off is less than 30 minutes, the gravity fuel feeding ceiling is 15 000 feet asl and 20 000 feet asl if the flight time from take-off is more than 30 minutes. No minimum fuel quantity limitations are published for gravity fuel feeding operations.

Electrical failures^{Footnote 19} will remove electrical power to the fuel pumps resulting in gravity fuel feeding. Also, while operating in emergency electrical configuration using the RAT,^{Footnote 20} as speed is reduced,^{Footnote 21} the last remaining fuel pump will be automatically shut off to shed electrical load, leading to gravity fuel feeding. Additionally, some of the electrical malfunctions require the use of the land recovery push-button to restore items necessary for landing. However, when the land recovery button is pushed, power is removed from all fuel pumps, resulting in gravity fuel feeding to the engines.

1.7.3 Engine Stall Procedure

If an engine stall occurs, it is automatically detected by the FADEC^{Footnote 22} and the fuel/air ratio is automatically decreased until the stall disappears. The procedure displayed on the upper ECAM requires reducing the appropriate thrust lever to idle and checking the engine parameters. During this flight, the engine fail message replaced the engine stall message on the ECAM before the crew had time to read the procedure.

1.7.4 Engine Fail Procedure

The engine fail procedure^{Footnote 23} displayed on the ECAM requires the selection of the ignition switch to IGN to confirm the immediate relight attempt by the FADEC and the reduction of the appropriate thrust lever to the idle position. When the engine fail procedure appears on the ECAM, thrust is normally increased on the operating engine and control of the aircraft is assured before executing any of the checklist items. By the time the crew assessed the ECAM warning, increased thrust on the operating engine, switched all the fuel pumps back on and declared an emergency with ATC, the engine regained thrust and the ECAM procedure disappeared.

1.7.5 A330 Minimum Equipment List (MEL)

The A330 MEL allows for dispatch with one main pump inoperative,^{Footnote 24} leaving one main pump and one standby pump operating in the affected wing. Other system failures of the A330 electrical system, such as a single bus failure,^{Footnote 25} will result in a similar condition.

1.7.6 Fuel Pump Pressure Switches

Several in-service reports of false fuel pump low-pressure indications on the A300 and A310 series aircraft led Airbus to issue Service Information Letter (SIL) 28-059 dated 18 December 1996. This SIL outlines a modification to the taping location of the fuel pressure sensing line in an attempt to resolve the erroneous pressure signals that were believed to be caused by water freezing in the sensing line. Airbus identified the freezing of the pressure switch part number HTE69000-1 as the cause of the erroneous pressure indications. The SIL recommended the replacement of the pressure switches part number HTE69000-1 with either pressure switches FRH100002A or part number 587-00501-000 on aircraft having experienced pump low-pressure reports. The SIL recommendation did not lead to the incorporation of the improved pressure switches on the A330 assembly line. The event aircraft was manufactured after SIL 28-59, in 1999, and delivered with the pressure switches part number HTE69000-1.

According to Airbus, a very little amount of water can be sufficient, when expanding as a result of freezing, to push the diaphragm inside the switch and create a spurious indication. Water originating from the sensing line could freeze on the internal side of the diaphragm and would maintain the normal pump pressure signal. Therefore, a low-pressure signal would not be generated if the pump was to fail. However, moisture freezing and expanding in the vented area of the pressure switch could act upon the other side of the diaphragm and result in an erroneous low-pressure signal. Although spurious low-pressure warnings were reported in the past (including some multiple warnings), there have been no cases of all main pump low-pressure signals occurring simultaneously.

Airbus issued SIL 28-082 dated 21 June 2006 to provide a quick reference regarding the interchangeability of the original pressure switches part number HTE69000-1 with the new pressure switches.^{Footnote 26} This SIL was revised on 03 March 2008, 7 weeks before the event, to update the interchangeability of the pressure switches and advise operators that one of the new pressure switches had now been certified for installation on the A330 and A340 aircraft. These changes were introduced on the production of the A330 and A340 aircraft from serial number 0916 onward. Following the event, Airbus suggested that the aircraft be configured with the latest pressure switch (FRH100002A). This could only be completed several months after the incident, the improved model being on back order.

1.8 A330 Inner Fuel Tank Modeling

Given the wing dihedral angle, the fuel pumps are located on a different water line ^{Footnote 27} or Z axis (see Figure 5). On the A330, the reference water line is located above the fuel tank; the references provided are negative. Two low-level sensors are located at tank heights of -2055 mm and -2081 mm. The highest low-level sensor is located 92 mm below the standby pump inlet port located at -1963 mm.

Image

During gravity fuel feeding, fuel flows through each main and standby pump inlet ports to the engine-driven low-pressure and high-pressure fuel pumps. The inlet ports of the main pumps number one and number two are located respectively 126 mm and 195 mm below the standby pump inlet port. The suction created by the engine-driven pumps while gravity fuel feeding will eventually draw air into the fuel line when the fuel level approaches the standby pump inlet port.

The theoretical standby pump fuel starvation occurs when the fuel quantity in the inner tank outside the collector cell is 1000 kg. A whirlpool can form above a pump inlet port allowing air to be aspirated into the fuel line above the theoretical starvation level. The height of this whirlpool changes with the rate of flow through a pump inlet port.

1.9 Rolls Royce Analysis

Analysis of the engine rundown event by the engine manufacturer (Rolls Royce) indicated that fuel flow did not follow engine demand, resulting in fuel starvation. However, delivery of fuel remained above light-up minimum, keeping the combustor at least partly lit, thereby allowing prompt recovery of thrust when proper delivery of fuel was restored when the main pumps were switched back on.

1.10 Airbus Flight Test Findings

In an attempt to reproduce the abnormal fuel system indications of the event flight, Airbus conducted a test flight using a new production aircraft. The fuel level in the left tank was reduced to simulate the fuel quantities of the event flight. The left main fuel pumps were then switched off and engine fuel feeding continued normally using the standby fuel pump only.

Twenty-four minutes after turning the left main fuel pumps off, the standby pump low-pressure warning came on and the standby pump was switched off as per the ECAM procedure, and gravity fuel feeding began as on the event flight. At that time, the fuel quantity was 2150 kg for the left inner tank out of which 550 kg was in the collector tank. Therefore, 1600 kg (2150 minus 550) of fuel was in the inner tank section outside the collector cell when the standby pump low-pressure warning occurred.

Fourteen minutes later, the engine became unstable (decrease of EGT^{Footnote 28}). The main pumps were switched back on and engine operation returned to normal. At that time, the inner tank fuel quantity was 1330 kg of which 170 kg was in the collector cell, leaving 1160 kg in the inner tank section outside the collector cell.

During the test flight, the engine instability occurred with a fuel quantity above the theoretical starvation level (1000 kg) as a result of the whirlpool created around the standby pump inlet port.

Airbus estimates that 45 minutes are required for the fuel level in the collector cell to equalize with the remainder of the fuel in the inner tank outside the collector cell when both main fuel pumps are switched off.

The Airbus test flight demonstrated that the inner tank collector cell decreased from 1150 kg to 550 kg in 24 minutes when both main fuel pumps were switched off, resulting in an average collector cell depletion rate of 25 kg per minute at those fuel quantities.

The flight was dispatched in accordance with the company-established fuel policies and the aircraft carried more than the minimum fuel required by existing regulation. Fuel pump low-pressure warnings resulted in displayed ECAM procedures that may have been inappropriate for the actual conditions. Additionally, the A330 fuel system design appears to encompass a gravity fuel feeding vulnerability at low fuel quantities that had not yet been identified, resulting in air ingestion into the fuel feed line to the engine, which led to the engine rollback below idle. The initial crew actions were based on established company as well as Airbus procedures. However, adequate fuel supply to the engine was regained when the crew acted outside of established procedures by switching all fuel pumps back on. Therefore, the analysis of this event will focus on the A330 fuel system components, configuration and procedures available to the crew.

During the event flight, there were no electrical malfunctions that may have affected the fuel system. Post-flight examination of the fuel pumps indicated that they operated normally and when the aircraft returned to service, there were no further reports of pump low-pressure warnings. Therefore, the investigation focussed on the fuel pressure switches to explain the multiple low-pressure indications.

2.1 Fuel Pump Pressure Switches

Several in-service reports of false fuel pump low-pressure indications had led Airbus to issue two SILs—one in 1996 and one in 2006 (revised 7 weeks before this event). However, these SILs did not recommend the retrofitting of in-service aircraft with the new switches unless erroneous fuel pressure indications were encountered.

The fuel tanks had not been drained for 26 days contrary to prescribed water draining every 7 days. The suspended water particles or droplets found in the pressure switch sensing lines, if frozen, would have pushed on the internal side of the diaphragm,resulting in an erroneous normal pressure indication. However, moisture freezing and expanding in the vented area of the pressure switch could act upon the other side of the diaphragm, resulting in an erroneous low-pressure signal.

Since multiple low-pressure warnings were generated, it is believed that these were erroneously generated by the freezing in the vented area of the pressure switches. Therefore, water in the sensing line side of the pressure switches cannot be considered contributory to the low-pressure warnings.

The 2 standby and 4 main pump pressure switches are co-located, thus exposed to the same environmental conditions, yet only the main pump switches seemingly generated erroneous low-pressure warnings, all within 7 minutes. No abnormal signal was transmitted by the standby pump pressure switches when they were automatically switched on as a result of the main pump low-pressure warnings. The left and right standby pumps operated 17 and 25 minutes respectively before the appearance of low-pressure warnings. At that time, the aircraft was descending through 16 000 feet asl into warmer air with an inner tank fuel quantity of 2500 kg. This is close to the Airbus flight test value of 2150 kg considering the differences between the test and event flight conditions and aircraft. Therefore, the standby pump fuel pressure switches functioned normally.

2.2 Standby Pump Inlet Port

The Airbus modeling of the inner tank at 0.5° nose up and wings level establishes that the standby pump inlet port will be uncovered with a fuel quantity outside the collector cell of 1000 kg. Gravity flow of the fuel to the engine passes through the two main and the standby pump inlet ports in each wing via interconnected tubing. Theoretically, this flow of fuel to the engine should not be interrupted when the standby pump inlet port, located 195 mm above the lowest main pump, is exposed to air. The head pressure acting above the main pumps should continue to provide a positive flow of fuel through the main pump inlet ports until the lowest one becomes exposed to air, at a fuel quantity of approximately 288 kg (see Figure 5).

When only the standby pump is operating, however, the pump pressure closes the NRV of both main pumps and all the engine fuel flows through that standby pump inlet port, thereby producing a deeper whirlpool. Therefore, air is being introduced through the standby pump inlet port earlier than during gravity fuel feeding operations.

During the Airbus test flight, with the main pumps off, the standby pump low-pressure warning occurred with a fuel quantity in the inner tank outside the collector cell of approximately 1600 kg, which is significantly above the Airbus modeling value of 1000 kg. Since the collector cell remains full at 1150 kg as long as one main pump operates, the low-pressure warning could occur with a total inner tank quantity as high as 2750 kg should this one remaining main pump be switched off or fail.

2.3 Gravity Fuel Feeding

During gravity fuel feeding, the fuel is aspirated by the engine-driven fuel pumps through all 3 pump inlet ports instead of only through the one standby inlet port. This results in a lower fuel flow rate through the standby pump inlet port, thereby reducing the depth of the whirlpool, and air is no longer introduced into the fuel line. However, when the fuel level outside the collector cell reaches the standby pump inlet port, air is again aspirated into the fuel line, resulting in engine instability or rollback. During the Airbus test flight, this air ingestion occurred 14 minutes after gravity fuel feeding commenced, causing engine instability with a fuel quantity outside the collector cell of 1160 kg, slightly above the Airbus modeling value of 1000 kg.

2.4 Occurrence Flight

During the occurrence flight, fuel quantity outside the collector cell at the time of the engine rollback could not be computed precisely because the main pumps were switched back on at various times by the crew for troubleshooting. Since the main pumps were operating when the crew switched them on, the main pump output flow activated the jet pump and transferred fuel back into the collector cell. This transfer reduced the fuel outside the collector cell that was available to the standby pump. However, it was established that the inner tank fuel quantity was slightly above 2500 kg when the standby low-pressure warning occurred during the event flight versus the 2150 kg during the Airbus test flight. Had the collector cell been completely full at the time (1150 kg), the fuel quantity outside the collector cell would have been 1350 kg (2500 minus 1150). Due to the collector cell depletion rate of approximately 25 kg per minute, when the main pumps were off, it can be concluded that the collector cell was below 1150 kg. Consequently, the fuel outside the collector cell was above 1350 kg compared to 1160 kg on the test flight. This can be explained by the known differences between the test flight conditions and the event flight such as engine-driven pump efficiency and standby pump NRV opening threshold of the new aircraft used during the test flight versus the older event aircraft.

Furthermore, the change in pitch during level-off, combined with the higher engine demand to maintain the selected speed during the event flight, likely contributed to the creation of a deeper whirlpool around the standby pump inlet port. This may also explain why the engine rollback occurred only 4 minutes after the standby pump low-pressure warning on the event flight instead of the 14 minutes observed during the Airbus test flight.

Although both left and right standby low-pressure warnings occurred simultaneously during the occurrence flight, only the left engine rolled back. The left main pumps were switched off 7 minutes after the right main pumps, resulting in the left inner tank collector cell remaining full 7 more minutes than the right side. Using the left collector cell depletion rate and the APU fuel consumption from the left inner tank, it can be determined that the left inner tank quantity was lower than the right inner tank, explaining the rollback of the left engine, while the right engine continued to run.

2.5 ALFE Procedure

During the event flight, the company ALFE procedure was performed. The premature opening of the fuel crossfeed likely did not exacerbate the fuel feed problems, since the next procedure performed by the crew was the gravity fuel feeding procedure, which requires the closing of the fuel crossfeed. Shortly thereafter, the ECAM displayed both left and right FUEL WING PUMPS LO PR procedure, which also requires the opening of the fuel crossfeed. Therefore, the crossfeed was likely open by the time the engine rollback occurred.

The ALFE procedure was intended as a proactive measure to avoid crew distractions caused by ECAM activation and the associated procedures during approach and landings with fuel quantities below 7000 kg. However, it introduced a new risk by directing the crew to prematurely open the fuel crossfeed while some Airbus ECAM procedures specifically require the fuel crossfeed to be closed.^{Footnote 29} These differing instructions as to the position of the crossfeed valve could lead to confusion and distraction, followed by inappropriate actions by the crew.

2.6 Fuel System Vulnerability

The current A330 fuel system design with the standby pump inlet port located at the highest level allows air ingestion at fuel quantities up to 2750 kg when the main pumps are inoperative. With the 2 low fuel sensors located below the standby pump inlet port, the ECAM did not generate a fuel low-level warning on either the test flight or the occurrence flight. Therefore, the crew does not receive advance warning of imminent engine failure due to air ingestion into the fuel line when the main fuel pumps are not operating.

The MEL allows for dispatch with a main pump inoperative leaving one main pump and one standby pump operating. However, the MEL does not take into account the possible air ingestion at fuel quantities below 2750 kg. Other system failures of the A330 electrical system, such as a single bus failure,^{Footnote 30} would result in flight with a single inner tank main pump operating, reproducing the above MEL condition, leading to the same level of vulnerability.

The probability of multiple unrelated failures leading to gravity fuel feeding with low fuel quantity allowing air ingestion could be considered remote. However, some electrical malfunctions, as well as the selection of the land recovery push-button, lead to gravity fuel feeding without any fuel system malfunction. Therefore, procedures that require the use of the land recovery at a fuel quantity below 2500 kg per inner tank would result in a possible engine failure as was experienced during the event flight.

None of the published documentation at the time of the event illustrated this vulnerability of the fuel system at low fuel quantities. It is crucial that crew members have clear and advance understanding of this vulnerability, since it could affect operational decisions to divert earlier into a flight. This documentation must also provide a clear explanation to the crew as to the relationship between the operation of the main pumps and the fuel level inside the collector cell. Flight crews could then confirm main pump operation by noting the fuel quantity increase to 1150 kg in the collector cell.

In typical aircraft systems, a component referred to as “standby” brings the connotation of a backup element or system. In the A330 fuel system, the standby pump designation falls short of this expectation at low fuel quantities. While the main pumps can, via the jet pump, extract all the fuel down to the last 8.3 kg (see Figure 5), the standby pump can become starved at fuel quantities up to 2750 kg. Furthermore, during gravity fuel feeding, the standby pump inlet port allowed air ingestion at a fuel quantity just below 2500 kg during the event flight. If the system was designed differently, with the standby pump installed inside the collector cell and at the same level as the main pumps, fuel starvation would occur at approximately 462 kg (see Figure 5), when the highest main pump inlet port becomes uncovered. In that case, a crew would receive a low fuel warning before fuel starvation.

The investigation established that the main pump low-pressure warnings were most likely erroneous and that the standby low-pressure warnings generated during the event flight were authentic. Furthermore, it is likely that the right engine rollback/failure was imminent had the crew not switched all the fuel pumps back on.

3.1 Findings as to Causes and Contributing Factors

1. The main fuel pump low-pressure warnings were erroneously generated by the possible freezing of fuel pressure switches. The result was that normally operating fuel pumps were switched off as per the displayed electronic centralized aircraft monitor (ECAM) procedure.
2. Standby pump low pressure occurred due to air ingestion into the pump inlet port at fuel quantities slightly above 2500 kg. This may occur with a fuel quantity up to 2750 kg in an inner tank when the main fuel pumps are inoperative.
3. The A330 fuel system design results in air ingestion through the standby fuel pump inlet port during gravity fuel feeding operations with inner tank fuel quantities below 2500 kg. As a consequence, the left engine rollback occurred.

3.2 Findings as to Risk

1. The position of the fuel low-level sensors below the standby pump inlet port will result in standby pump starvation before ECAM fuel low-level activation when the main fuel pumps are inoperative. Therefore, a crew may be unaware of an imminent engine failure due to air ingestion into the fuel line with fuel quantities below 2750 kg.
2. The current A330 documentation does not alert crews of the fuel system vulnerabilities at low fuel quantities. Therefore, under certain failure conditions, crew actions that initiate gravity fuel feeding operations may result in an engine failure.
3. The company anticipated low fuel ECAM (ALFE) procedure contains items that may be in conflict with Airbus recommended procedures. Therefore, crews may be confused and omit critical items from the Airbus recommended procedures, thereby increasing the risk of fuel starvation.
4. Dispatch under minimum equipment list (MEL) with one main fuel pump inoperative will expose the flight to a risk of fuel starvation when the inner tank fuel quantity falls below 2500 kg and the remaining main fuel pump also becomes inoperative.
5. The fuel tanks had not been water drained as per the company procedure. The aircraft operated for an extended period of time without the draining of the fuel tanks, thereby increasing the risk of water contamination.
6. The cockpit voice recorder (CVR) was not deactivated and preserved following the event, resulting in the cockpit conversations being overwritten. Consequently, CVR information relevant to the occurrence was not available to TSB investigators.

3.3 Other Finding

1. Following the event, the aircraft was inspected, repaired, refuelled, test flown and returned to service without prior coordination with the TSB. Therefore, much of the evidence related to this incident was handled by several parties before the TSB investigation began.

4.1 Action Taken

4.1.1 Air Canada

• A fleet manager information was issued to provide background information to the crews and highlight the results of the Airbus test flight, analysis and conclusions.
• All fuel pressure switches were replaced with the latest recommended model (FRH100002A).
• An aircraft technical bulletin was issued to revise the A330 minimum fuel over destination (FOD) to 3600 kg.
• The water removal procedure is now performed at every service check without options to defer.
• The anticipated low fuel ECAM (ALFE) procedure was rescinded for the A330.

4.1.2 Airbus

• An A330 temporary revision (No. 251-1) was issued in November 2008, whereby the gravity fuel feeding procedure now indicates that 2000 kg of fuel in the affected fuel tank cannot be used by gravity.
• Temporary revisions No. 01-28/010 and No. 02- 28/020, dated October 2009 and approved by the European Aviation Safety Agency (EASA) on 16 November 2009, updated the A330 master minimum equipment list (MEL). The conditions and operational procedures in the case of dispatch with one main inner tank fuel pump inoperative were changed to ensure that the crossfeed valve is operative, and that 2000 kg of additional fuel is loaded in the aircraft.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 06 August 2010.

Image

Appendix B — A330 Gravity Fuel Feeding Procedure

Image