investigators have recommended that Airbus reviews the design of A340-600 fuel
control monitoring systems after a serious incident last month in which a
Virgin Atlantic aircraft suffered fuel exhaustion in two tanks without alerting
Air Accidents Investigation Branch (AAIB) has ordered a full inquiry into the 8
February event after determining that failure of the A340’s automatic
fuel-transfer had initiated the problem.
route from Hong
Kong to London Heathrow, about
11hr into the flight and in Dutch airspace, the aircraft (G-VATL) unexpectedly
lost power in its outboard left-hand engine. About 10min later the engine power
on the outboard right-hand engine began fluctuating and, while the opening of
fuel cross-feeds enabled the engine to recover, the crew opted to divert to Amsterdam.
fuel transfer was started by the flight crew but they did not see immediately
the expected indications of fuel transfer on the ECAM (electronic centralised
aircraft monitor),” says an AAIB report. “Consequently the flight crew remained
uncertain of the exact fuel status.”
fact, says the AAIB, the total fuel on board at the start of the diversion was
25,000kg, “but there were significant quantities of fuel located in the trim,
centre and outer wing fuel tanks”.
has focused on the A340-600’s fuel system which is controlled through two
fuel-control monitoring computers. There are indications that one of these
computers suffered a failure about 3hr into the flight.
two computers normally operate as a master-slave combination. The master
computer can instruct valves and pumps to operate, and also provides alerts to
pilots if fuel levels run low. The slave is unable to send such commands.
health of each computer determines which takes the master role. But the AAIB
says: “There is a possibility that the master [computer] may have an output
failure and so may lose the ability to control the fuel system. However the
remaining slave [computer] may already be at a lower health status and cannot,
therefore, become the master unit.”
have recommended that Airbus review the master-slave determination logic in
order that a master computer with such an output failure cannot remain the
also point out that the back-up fuel-warning system depends on the status of
the two computers, leading to the possibility of a back-up warning not being
given if the computers appear normal. The AAIB says that Airbus should similarly
review this situation, stating: “The expectation would be for the back-up
system to have an overriding ability to trigger a warning and should not be
dependent on the status of other systems.”
issued a flight-operations telex a week after the incident advising pilots to
regularly check the electronic centralised aircraft monitor’s fuel page, as
well as a procedure for crews to follow should automatic fuel-transfer be lost.