Air Transat Flight 236

An engine change before the crossing

Metal particles appeared in the right engine's oil system on 15 August 2001 and again two days later. Air Transat decided to replace the engine. Its own spare was unavailable, so technicians used a Rolls-Royce loan engine already at Mirabel. Work began at midnight on 17 August. The removed engine had a modified hydraulic pump and associated pipework; the loan engine had an earlier configuration. Receiving checks and maintenance planning had failed to identify the difference.

During installation, the rear hydraulic pump interfered with a fuel tube. The lead technician found a reference to a service bulletin but could not retrieve it through the company network. He consulted the engine controller and proceeded using verbal advice. Technicians transferred the newer fuel tubes from the removed engine and kept the older hydraulic tube on the replacement. The bulletin required the tubes to be fitted together as a matched set. The resulting combination placed the hydraulic and fuel tubes too close together.

Technicians reported achieving clearance while tightening the hydraulic connection. GPIAA found that hydraulic pressure forced the line back towards its natural position and eliminated that clearance. Subsequent contact deformed and chafed the fuel tube, which fractured under repeated vibration. Inspections and the ground run had revealed no discrepancy, and the aircraft returned to service. By the accident flight, the replacement engine had accumulated 67.5 flight hours.

Toronto departure and the first indications

Flight 236 departed Toronto for Lisbon at 00:52 UTC on 24 August with 293 passengers and 13 crew. The captain was flying the aircraft. The reported takeoff fuel was 46.9 metric tons, and the planned load included 5.5 tons above the regulatory requirement. The flight initially progressed normally across the North Atlantic. Recorded data later placed the start of the right-engine fuel leak at 04:38.

The first unusual indications noticed by the pilots concerned engine oil. Around 05:03, they observed low oil temperature, high pressure and reduced quantity on the right engine. They selected the engine display, reviewed manuals and contacted the maintenance control centre in Canada. The readings remained within operating limits, but their combination was unexplained. Examination after the accident connected them to the fuel leak: excess fuel passing through the fuel/oil heat exchanger cooled the oil, increased its viscosity and changed its circulation.

Meanwhile, automatic fuel management transferred the remaining trim-tank fuel forward. A transfer beginning at 05:11 continued for 19 minutes and moved about 3.2 tons into the wing system. Fuel went into the depleted right side and continued through the leaking engine. GPIAA's risk findings say this transfer delayed the fuel advisory by 15 minutes. The pilots did not recall the transfer messages. Their attention was occupied by the oil indications while the aircraft's fuel reserve was falling.

The imbalance and a worsening loss

At 05:33, a white advisory appeared for a 3,000 kg difference between the wing tanks. The manually selected engine page initially prevented the fuel page from appearing automatically. The pilots deselected the engine page and saw the imbalance. At 05:36, they opened the crossfeed valve and switched off the right-wing pumps so that the fuller left tanks supplied both engines. That selection also supplied the leak in the right engine from the left side.

The captain performed the imbalance actions from memory. The handbook's caution directed crews to the fuel-leak procedure when a leak was suspected, but he did not consider that caution while taking the actions. The aircraft's monitoring system supplied no dedicated fuel-leak warning. A rapidly decreasing fuel quantity, falling destination-fuel predictions and normal engine fuel-flow indications left the pilots uncertain about the fault. They believed a computer malfunction could explain the readings.

At 05:45, with insufficient predicted fuel to reach Lisbon, the crew diverted towards Lajes on Terceira Island. Cabin attendants checked the wings and engines for signs of escaping fuel, turning off the cabin lights to improve visibility. They saw no leak in the darkness. At 05:54, the captain reversed the pump selection to use fuel from the right tanks, believing the loss might be from those tanks. Communications with maintenance control and further changes to the fuel configuration followed as the quantities continued to fall.

Preparing for a possible ditching

The flight director first learned of the diversion while visiting the cockpit around 05:45. Cabin attendants collected trays and secured galley equipment. After the unsuccessful visual inspection, the captain instructed the flight director to prepare passengers for a ditching. She used the emergency action plan to explain life jackets and the brace position. The briefing began in English and French; another attendant repeated it in Portuguese when passengers had difficulty understanding.

Some passengers needed help finding or fastening their life-jacket straps. Two types of jacket were on board although the demonstration and safety card described the single-strap version. In the cockpit, the pilots were simultaneously flying, investigating the fuel problem, arranging the diversion and communicating with the ground. GPIAA found that this high workload left little capacity to reassess their interpretation or the actions already taken.

The captain considered the fuel-leak procedure but believed its descent to 20,000 feet would sacrifice altitude and performance margin while fuel was critically low. He continued at high altitude. Destination-fuel predictions also overstated the reserve because the flight management computer calculated consumption by operating engines and did not incorporate the leak rate. The investigation found that applying the fuel-leak procedure would have conserved fuel on the left side and allowed a landing at Lajes with that engine operating.

Both engines stop

At 06:13, the right engine flamed out while the aircraft was at flight level 390, about 150 miles from Lajes. The pilots reported the failure and began descending. At 06:15, they reported only 600 kg of fuel remaining. The first officer declared Mayday at 06:23. Three minutes later, the left engine also stopped, with the aircraft about 65 nautical miles from the airport at approximately flight level 345. The crew completed the all-engines-flameout procedure and continued towards the island in a glide.

Loss of the engine-driven generators and hydraulic supplies brought the aircraft into emergency configuration. The ram air turbine deployed and powered the green hydraulic system and emergency generator. Numerous services became unavailable, including the flight management displays, electric trim and normal braking and anti-skid functions. Pitch authority was reduced. The cockpit voice recorder and flight data recorder stopped when their normal power supply was lost. Cabin lighting fluctuated, the public address system became intermittent and emergency lighting came on.

The cabin lost pressurisation and oxygen masks deployed during the descent. Some mask containers failed to open, and attendants reported oxygen-flow problems at several positions. Investigators found a maintenance retaining pin still installed in the R3 oxygen generator. The attendant there used a mask at an empty passenger seat across the aisle. The first officer subsequently told the cabin to prepare for a landing on or near the runway and a land evacuation.

Reaching the runway

Lajes approach controllers supplied radar vectors and distance information. The crew used the LM navigation beacon for directional guidance and requested flashing runway lights. Visibility was good despite the night conditions. The pilots confirmed the runway in sight during the descent. When the aircraft reached about eight miles from runway 33 at approximately 13,000 feet, the captain made a left 360-degree turn to lose height. He extended the landing gear and leading-edge slats, then used S-turns on final to reduce the remaining excess altitude.

At 06:45, the aircraft crossed the threshold at about 200 knots. It touched down hard, bounced and touched down again roughly 2,800 feet beyond the approach end. The captain applied and held maximum braking. The emergency accumulator allowed only a limited number of brake applications; with anti-skid unavailable, the wheels locked and the tires rapidly abraded and deflated. Wheel and brake components wore against the runway and separated. The aircraft stopped about 7,600 feet from the approach end.

Small fires developed around the left main wheels. Rescue vehicles were already positioned and responded immediately. GPIAA described the captain's handling during the glide and landing as remarkable and found his decision to maintain maximum braking justified by the speed and touchdown position. It also found that the first officer provided full and effective support. The captain's flying averted a catastrophic accident and saved the passengers and crew.

Evacuation and injuries

The captain ordered evacuation shortly after the aircraft stopped. Cabin attendants attempted to use all exits, but door L3 opened only about 20 to 25 centimetres. They redirected passengers to other doors. Some passengers tried to take cabin baggage, and two passengers with limited mobility required physical assistance to reach the exits and slides. The evacuation was reported complete in approximately 90 seconds, after which passengers were gathered away from the aircraft.

All 306 occupants survived. Two passengers received serious injuries, while 14 passengers and two cabin attendants received minor injuries during evacuation. The fuselage and main landing gear suffered structural damage. Wheel and brake debris also punctured or struck parts of the airframe and left engine nacelle. The disabled aircraft closed the airport for four days while recovery crews obtained undercarriage parts and lifting equipment.

Investigation findings and safety action

Inspection found an approximately 80 mm L-shaped crack in the right-engine fuel inlet tube and hard contact with the hydraulic tube beside it. Laboratory examination found high-cycle fatigue associated with deformation and vibration. GPIAA identified the mismatched installation as the initiating event and failure to perform the fuel-leak procedure as the key factor leading to exhaustion. Its calculations showed that completing the engine-leak procedure at 05:45 would have allowed a landing at Lajes with about 5,136 kg of fuel remaining.

The investigation also identified deficiencies in maintenance configuration checks, access to service bulletins, warning design and fuel-leak training. Transport Canada suspended Air Transat's A330 extended-range authority and required inspections and special training. Air Transat introduced fuel-leak scenarios into initial and recurrent training. Airbus and Rolls-Royce issued pipe-clearance inspection instructions. The final report recommended stronger fuel-loss alerts, crew training, safeguards against abnormal automatic transfers, improved checklist priorities and better planning to identify component-configuration differences before installation.