Serious A340-600 fuel incident prompts design query

This story is sourced from Pro
See more Pro news »

UK investigators have recommended that Airbus reviews the design of A340-600 fuel control monitoring systems after a serious incident last month in which a Virgin Atlantic aircraft suffered fuel exhaustion in two tanks without alerting the crew. 

The Air Accidents Investigation Branch (AAIB) has ordered a full inquiry into the 8 February event after determining that failure of the A340’s automatic fuel-transfer had initiated the problem. 

En route from Hong Kong to London Heathrow, about 11hr into the flight and in Dutch airspace, the aircraft (G-VATL) unexpectedly lost power in its outboard left-hand engine. About 10min later the engine power on the outboard right-hand engine began fluctuating and, while the opening of fuel cross-feeds enabled the engine to recover, the crew opted to divert to Amsterdam

“Manual fuel transfer was started by the flight crew but they did not see immediately the expected indications of fuel transfer on the ECAM (electronic centralised aircraft monitor),” says an AAIB report. “Consequently the flight crew remained uncertain of the exact fuel status.” 

In fact, says the AAIB, the total fuel on board at the start of the diversion was 25,000kg, “but there were significant quantities of fuel located in the trim, centre and outer wing fuel tanks”.

Attention has focused on the A340-600’s fuel system which is controlled through two fuel-control monitoring computers. There are indications that one of these computers suffered a failure about 3hr into the flight. 

These two computers normally operate as a master-slave combination. The master computer can instruct valves and pumps to operate, and also provides alerts to pilots if fuel levels run low. The slave is unable to send such commands. 

The health of each computer determines which takes the master role. But the AAIB says: “There is a possibility that the master [computer] may have an output failure and so may lose the ability to control the fuel system. However the remaining slave [computer] may already be at a lower health status and cannot, therefore, become the master unit.” 

Investigators have recommended that Airbus review the master-slave determination logic in order that a master computer with such an output failure cannot remain the master. 

They also point out that the back-up fuel-warning system depends on the status of the two computers, leading to the possibility of a back-up warning not being given if the computers appear normal. The AAIB says that Airbus should similarly review this situation, stating: “The expectation would be for the back-up system to have an overriding ability to trigger a warning and should not be dependent on the status of other systems.” 

Airbus issued a flight-operations telex a week after the incident advising pilots to regularly check the electronic centralised aircraft monitor’s fuel page, as well as a procedure for crews to follow should automatic fuel-transfer be lost.