Fuel imbalance and engine shutdown involving Boeing 737, VH-VZT, 135 NM south of Kalgoorlie-Boulder Airport, Western Australia, on 25 October 2021

Executive summary

What happened

On the afternoon of 25 October 2021, a Boeing 737 aircraft, registered VH‑VZT and operated by Qantas, was being prepared for a passenger air transport flight from Perth, Western Australia to Adelaide, South Australia. During a routine external aircraft check (‘walk-around’), the captain identified the presence of frost on the wings, resulting from cold fuel from the previous flight in the main tanks located in the wings and presenting a safety risk. To remove the frost, the cold fuel was transferred from the main (wing) tanks to the centre tank, and the main tanks were filled with warmer fuel via refuelling.

Just after reaching the assigned cruise altitude, the flight crew completed a routine procedure to switch the centre tank fuel pumps off and the aircraft began to use main tank fuel. At about 1749 a fuel imbalance alert was displayed, indicating unequal fuel quantities in each main tank. While actioning relevant checklists the flight crew diagnosed the reason for the unequal fuel quantities was a fuel leak and shut down the left engine. The flight diverted to Kalgoorlie, Western Australia where the aircraft landed without incident. Post-flight inspections determined that there was no fuel leak and that the fuel system was serviceable.

What the ATSB found

The licensed aircraft maintenance engineer (LAME) directed the flight crew on the fuel transfer from memory. The procedures required the crossfeed valve to be closed when the operation was completed, however, the valve was not closed. This was likely associated with the crew following the LAME’s instructions rather than referring to the relevant procedure. While this is permissible, referring to procedures is a more reliable method to ensure all steps are carried out.

During pre-flight checks, and later during the climb and level-off, the flight crew did not notice the crossfeed selector in the open position or the associated dimmed blue indicator light on the fuel panel. In flight, after the centre tank fuel pumps were switched off, fuel had been continually pumped from the left main tank to the right engine via the open crossfeed valve as the result of uneven fuel pump pressures. Although the aircraft’s manuals stated that this could occur when the crossfeed valve was open in flight and lead to a fuel imbalance, the flight crew did not recall this at the time. In addition, the Boeing 737 IMBAL (imbalance) checklist did not provide sufficient guidance for a flight crew to identify an open crossfeed valve as being a potential reason for a fuel imbalance. Consequently, the flight crew decided that there could be a fuel leak.

Partly as a result of confirmation bias, stress and perceived time pressure with the aircraft approaching an overwater segment of the flight, the flight crew abbreviated the relevant checklists. Flight crew actions when completing the Fuel leak engine checklist resulted in them mistakenly confirming the presence of a fuel leak, but unknown to the flight crew at the time, the method used to determine the presence of a fuel leak was invalid due to a step being inadvertently performed out of sequence.

As a result, the crew unnecessarily shut down an engine during flight.

What has been done as a result

Following the occurrence, Qantas communicated the factors involved to 737 flight crews.

Safety message

Checklists are designed to minimise performance variability under workload and stress, and thereby increase the likelihood that all required actions are successfully carried out. The importance of precision when following checklists, especially when under stress and time pressure, is highlighted by this occurrence.

The investigation

Decisions regarding the scope of an investigation are based on many factors, including the level of safety benefit likely to be obtained from an investigation and the associated resources required. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.

The occurrence

Pre-flight activities

On the afternoon of 25 October 2021, a Boeing 737-838 aircraft, registered VH‑VZT and operated by Qantas, was being prepared for a passenger air transport flight from Perth, Western Australia to Adelaide, South Australia.

The first officer (FO), who was undergoing line training,[1] was assigned the pilot flying role and the captain (a check and training captain) was the pilot monitoring.[2] The captain was responsible for the external aircraft check (‘walk-around’), and the FO had responsibility for conducting the flight deck pre-flight procedure.[3]

The captain made their way to the apron for the walk-around at about 1627, and at the same time the refueller positioned their vehicle at the aircraft to commence refuelling.[4] During the walk‑around, the captain saw extensive cold soaked fuel frost[5] (CSFF) on the lower surfaces of both wings, which had formed after the previous flight (see Cold soaked fuel frost).

At the completion of the walk-around, the captain located the licenced aircraft maintenance engineer (LAME) responsible for the aircraft’s line certification and maintenance. They discussed the presence of CSFF, and noted that the temperature of the fuel onboard was -4° C (there was 4.2 tonnes of fuel remaining after the previous flight, with 2.1 tonnes in each of the 2 main, or wing, tanks). The LAME suggested conducting a ground transfer of fuel to attempt to remove the CSFF, to which the captain agreed. This process transfers cooler fuel from the 2 main tanks to the centre tank, making room in the main tanks to receive warmer fuel when the aircraft is refuelled to melt the CSFF. At about 1631, the captain returned on board the aircraft. The captain recalled that after boarding the aircraft they went to the washroom, and then returned to the flight deck.

Ground transfer of fuel

The following sequence of events was reconstructed mainly from CCTV recordings and interviews with the flight crew and LAME. The cockpit voice recorder (CVR) data was later overwritten, and the other on-board recorders did not contain data relevant to this period.

The FO recalled that the fuel transfer began with the captain on the flight deck, after the captain returned from the walk-around, and that the captain mentioned the presence of CSFF. However, the captain recalled that a fuel transfer (to remove the CSFF) was underway when they returned to the flight deck.

At about 1631, the LAME placed an access stand (moveable ladder/platform) under the fuelling station located near the leading edge of the right wing. About this time, the LAME asked the refueller to delay the fuelling to allow for the fuel transfer to be conducted. The LAME then opened the defuel panel (located next to the fuelling station) and opened the manual defueling valve.

Based on the CCTV recording, the LAME got the flight crew’s attention at about 1633. The LAME recalled instructing the FO to switch on all the main tank fuel pumps and to open the crossfeed valve. The FO recalled that both flight crew heard this over the flight deck speakers. The FO recalled complying with the LAME’s verbal instructions (without referring to the written procedures) by reconfiguring the forward overhead fuel panel, under the captain’s supervision. As stated previously, the captain recalled returning to the flight deck after the fuel transfer was begun.

The CCTV showed the LAME returning to the right wing and accessing the defuel panel at about 1634. The LAME recalled that they opened the centre tank fuelling valve switch, and monitored the fuel transfer via the tank quantity gauges on the fuelling panel.

Between 1637:02 and 1637:22, the LAME inspected the right and left lower wing surfaces, then returned to monitor the fuel transfer. Because of fuel pump operating limitations, this allowed for 1 tonne of fuel to be safely transferred to the centre tank from the main tanks. The LAME recalled assessing that, based on the planned uplift of fuel, moving 500 kg of fuel out of each main tank into the centre tank would not be sufficient to allow enough warmer fuel to be uplifted to melt the CSFF.

The planned total amount of fuel for the next flight was 8.6 tonnes (requiring 4.4 tonnes to be uplifted by the refueler). The LAME recalled they contacted the flight crew 3 times to request an increase to the fuel order and that their requests were not accepted until the third time.[6] According to the LAME, shortly after this they saw that the fuel was pumping out of the right tank faster than the left tank and instructed the FO to turn off the right main tank fuel pumps.

The FO recalled only one discussion about an increase to fuel and that the captain was present at the time. The captain recalled one discussion during which the LAME advised that a patch of CSFF remained on one of the wings and recommended adding extra fuel to melt it.

Ultimately the captain requested an additional 1 tonne of fuel be uplifted. The LAME recalled that not long after this, they instructed a flight crew member to switch off the left main fuel pumps and to close the crossfeed valve. The LAME could not recall with certainty who they spoke to but believed it was the FO. The FO did not recall hearing back from the LAME regarding the completion of the fuel transfer.

The Before start checklist required the crew to ensure the fuel pumps were on, the switches for which were on the same overhead panel as the crossfeed selector. As the FO was undergoing line training, the captain scanned the overhead panel. They recalled looking at the fuel pump switches but not the crossfeed selector. Additionally, they did not notice the dimmed[7] blue light located on the overhead fuel panel which indicated the crossfeed valve was open. The captain stated glare from the sun may have hindered their ability to notice the dimmed light.

Preparation for pushback and taxi

At 1638:39, upon completion of the fuel transfer, the LAME closed the defuel valve and the defuel panel. The LAME recalled advising the refueller of the revised fuel order and that fuelling could commence, and removed the access stand clear of the aircraft.

Fuelling was completed at 1648. Both flight crew recalled the flight deck fuel indications showing 9.6 tonnes, and the captain observed the fuel distribution between the centre and main fuel tanks was as expected. The FO did not recall any communication with the LAME about the crossfeed valve at this time. The FO recalled the captain requesting all fuel pumps be turned on and interpreted this to be the end of the fuel transfer procedure but could not recall the fuel crossfeed valve position. Furthermore, the FO did not recall a discussion that the frost had been removed from the aircraft wings.

After the passengers were on board, the flight crew conducted the before start procedure and at 1702 the aircraft was pushed back from the bay and commenced taxi to the runway for take-off. At this time, the fuel quantity in each main tank was approximately equal.

Commencement of imbalance

The aircraft took off from Perth at 1711, and by 1731 had reached the cruising altitude of 39,000 ft. At 1733, the annunciator light FUEL illuminated. Both flight crew recalled looking at the overhead fuel control panel and as they expected at this point in the flight,[8] observing both centre tank fuel pump LOW PRESSURE amber lights illuminated (which can indicate low fuel in that tank). After confirmation by the FO, the captain selected both centre tank fuel pumps off. Neither flight crew recalled observing any other light illuminated on the fuel panel.

At about this time, the captain made a mental calculation adding the quantity of fuel used to the current fuel quantity remaining in each main tank and confirmed the total was equal to the departure fuel quantity.

Recorded data indicated that the fuel quantities in the left and right fuel tanks began to differ at this time, as the fuel used by the engines was mostly drawn from the left fuel tank (see Operation with the fuel pumps on and crossfeed valve open). The rate of fuel imbalance change over the next 35 minutes averaged about 1,700 kg/h, with significantly more fuel being used from the left fuel tank than the right throughout this period. Fuel flow to each engine was approximately equal throughout the flight until the left engine was later shut down.

At about 1748, an amber fuel IMBAL (imbalance) alert appeared on the upper display unit in the centre of the instrument panel. This alert is triggered when the difference in fuel quantity between the main tanks is more than 453 kg for at least 60 seconds and is not associated with an audible indication or master caution.

Identification of imbalance and conduct of relevant checklists

The following events are mainly based on the flight crew recollections, and it was not possible to determine their actual sequence.

When the flight crew noticed the IMBAL alert, they looked at the fuel control panel and confirmed that the main fuel tank pumps were all on.

At 1753, the FO wrote down the left and right fuel tank quantities and the current time. The captain recalled that this was done when they saw the IMBAL alert. The quantities were consistent with the recorded data at this time, and the fuel imbalance (difference between the quantities) was 630 kg.

More than half of the aircraft’s planned flight path to Adelaide was over water, and the latter half would be at night. The captain reported feeling time pressure to determine the most appropriate actions as the aircraft approached the coastline; at this time the aircraft was less than 15 minutes from crossing it. The FO reported experiencing elevated stress with the increasing workload and recalled becoming focused more on flying the aircraft.

The flight crew initiated the quick reference handbook (QRH) IMBAL (fuel imbalance) non-normal checklist (NNC) with the captain (as pilot monitoring) referring to the physical book on the flight deck (see Fuel imbalance and engine fuel leak checklists for the content of the relevant checklists). Step 3 of the IMBAL checklist stated that a fuel leak should be suspected if the total fuel remaining is less than planned, or if an engine has excessive fuel flow. If a fuel leak was suspected, the checklist directed flight crews to the Fuel leak engine checklist.

The captain saw the fuel quantity indication for the left tank reduce at a high rate and thought that there must be a fuel leak. The captain also confirmed around this time that other engine and fuel indications appeared normal.

While neither criterion had been met, the flight crew agreed that a fuel leak was suspected and commenced the Fuel leak engine checklist. Step 3 of this checklist required the flight crew to confirm that the crossfeed selector was closed (or close it). According to the captain’s recollection, while actioning the checklist, the captain identified that the crossfeed valve switch was in the open position and moved it to the closed position. At the time, neither pilot recalled that flight with the crossfeed valve open would lead to a progressive fuel imbalance (see Aircraft fuel system). With the crossfeed valve closed, each engine would draw fuel only from the same-side tank.

Step 5 of the Fuel leak engine checklist required the flight crew to record the main tank fuel quantities and the current time. Step 6 of the checklist stated that a fuel leak is ‘confirmed’ if:

• fuel spray is observed from an engine or strut, or
• if there is a change in fuel imbalance of 230 kg within 30 minutes or less (equivalent to 460 kg/h).

The captain contacted the cabin service manager (CSM) and requested they look out a rear cabin window for signs of a fuel leak. The CSM advised the captain they could not see any indication of a fuel leak.

The FO recalled checking the fuel imbalance again about 2 minutes after writing the quantities down, showing an increase in imbalance greater than 230 kg per 30 minutes, although the exact time at which this assessment was done could not be established. The actual imbalance increased by 230 kg within 10 minutes. Within the limitations of the recorded data,[9] the average imbalance rate appeared lowest from about 1753–1755, at about 225 kg/h.

Aware of the risk of commencing the overwater section of the flight with an apparent fuel leak and likely imminent engine shutdown, the flight crew considered diversion options, which included Perth and Kalgoorlie-Boulder, Western Australia. Accordingly, the flight crew prepared for a diversion to Perth.

Diversion, engine shutdown and landing

At 1800, the flight crew advised air traffic control of their intention to return to Perth and commenced a turn at 1801. The flight crew then discussed Kalgoorlie-Boulder Airport was closer and had fire services available. At 1805 the flight crew declared a PAN[10] and prepared for a landing at Kalgoorlie-Boulder Airport, commencing descent at 1806.

Continuing the Fuel leak engine checklist, and having considered the rapid reduction of fuel in the left tank being indicative of a fuel leak, the flight crew shut down the left engine at 1806:58. At this time there was about 6,423 kg of fuel on board, including about 3,701 kg in the right tank. The checklist did not require the crossfeed valve to be reopened unless there was a Fuel LOW alert. At 1807:41 the flight crew started the auxiliary power unit (APU) in accordance with the Fuel leak engine checklist. The APU, which draws fuel from the left main tank, consumed about 34 kg over the remainder of the flight.

From about 1808 to 1812, the fuel quantity in the left main tank was steady. From 1812 to the end of the flight, the fuel quantity in each main tank decreased at an almost equal rate (indicating that the crossfeed valve was open during this period).

The aircraft landed at Kalgoorlie-Boulder Airport on runway 29, coming to a stop on the runway at 1852 with about 5,357 kg of fuel remaining on board, including 3,225 kg in the right tank. The flight crew then made an alert announcement to the cabin. The left engine was inspected and declared safe by the Aviation Rescue Fire Fighting Service (ARFFS), and the cabin alert was cancelled. The aircraft was then taxied to the bay and the passengers were disembarked.

The aircraft was inspected and tested at Kalgoorlie by aircraft maintenance engineers. They determined that:

• there were no fuel leaks or other relevant unserviceabilities
• when tested, the fuel used by both engines was within normal limits
• the fuel quantities in each tank after landing (2.05 tonnes in the left main tank and 3.18 tonnes in the right main tank) met the criteria for a fuel imbalance.[11]

After receiving information from the flight crew, the operator concluded that the crossfeed valve had likely been open during the occurrence flight, and this led to the fuel imbalance (see Operation with the fuel pumps on and crossfeed valve open). The aircraft was then returned to service.

Context

Personnel information

Captain

The captain held an Air Transport Pilot (Aeroplane) Licence (ATPL) and was appropriately qualified and authorised to conduct the flight. The captain had almost 12,000 hours total flying experience with over 5,000 hours on 737 variants. The captain was a check and training pilot for the operator and had flown about 110 hours in the previous 90 days.

As a result of the Qantas response measures to COVID-19[12], the captain was stood down from mid-April 2020 until 23 September 2020. Upon completion of simulator training, they returned to flying duties at the end of September 2020. Although the captain remained stood up after that time, their monthly rostered flying hours were lower than was usual prior to the pandemic. In the 12 months prior to the event, they flew 40% of the hours they had flown in the 12 months prior to stand down. In the 3 months immediately prior to the event flight, their monthly average flying hours were roughly half their pre-pandemic average. The captain reported that while being comfortable to fly, because of the stand down and reduced flying hours, they noted a degradation in their skills.

First officer

The FO held a Commercial Pilot (Aeroplane) Licence and was appropriately qualified and authorised to conduct the flight. The FO had about 1800 hours total flying experience and about 110 hours on the 737. The FO had flown about 24 hours in the previous 90 days. The FO was undergoing line training and was qualified to act as a first officer on revenue flights alongside a check and training captain.

The FO joined Qantas as a second officer on the Boeing 787 fleet. In 2019 they commenced FO promotion and 737 type rating training, however soon after this was delayed. The FO’s training recommenced in May 2021. As a result of Qantas’ COVID-19 response measures, the FO was stood down between September and October 2021, re-commencing flying duties mid-October 2021.

Licenced aircraft maintenance engineer

The LAME was employed by Qantas, and the holder of an Australian Aircraft Maintenance Engineers Licence. The LAME’s licence was appropriately endorsed, and they were authorised to conduct maintenance on Boeing 737-838 aircraft in the Qantas fleet.

Recorded data

Flight data (Figure 1) showed that after the fuel in the centre tank had been consumed, an imbalance between the left and right main fuel tanks began to develop and was maintained for the remainder of the flight.

Figure 1: Fuel quantities on the occurrence flight

Image source: ATSB.

Aircraft manuals

The Boeing aircraft maintenance manual (AMM) contained procedures to carry out maintenance and testing on the aircraft. It was primarily used by maintenance personnel and generally not available to flight crews. The Qantas fuelling manual contained procedures for maintenance personnel, fuel company staff, and flight crew.

The aircraft’s flight crew operation manual (FCOM) was prepared by Boeing and reproduced by Qantas. It comprised of 2 volumes plus a quick reference handbook (QRH). Volume 1 included guidance for ground transfer of fuel. Volume 2 contained systems information.

Cold soaked fuel frost

Background

Aircraft such as the 737 typically cruise at altitudes around 40,000 ft where the outside air temperature can be as low as -57° C. On longer flights such as Australian transcontinental flights, the temperature of the fuel in the main tanks decreases considerably, a phenomenon known as cold-soaking. After a flight, the temperature of the fuel in the main tanks may be at a sufficiently low temperature such that it lowers the wing skin temperature to below the freezing point.

Between flights, if there is rain or high humidity and regardless of the ambient temperature, ice can form on the upper and lower surfaces of the cold-soaked wings and accumulate over time. This ice can be invisible to the eye (referred to as clear ice) or visible frost.

The presence of any ice or frost on the wings of an aircraft prior to flight can significantly reduce lift, and therefore compromise take-off and flight performance. The US Federal Aviation Administration (FAA) approved de-icing program update[13] stated:

For the 737, take-off is permitted with cold soaked fuel frost (CSFF) on the wings provided strict conditions are met. Outside these conditions, ice or frost formations on upper or lower wing surfaces must be removed. General guidance in the Qantas de-icing/anti-icing procedure manual stated:

Removal of cold soaked fuel frost by fuel transfer

In colder climates, frost, snow, and ice is removed with fluids applied to the aircraft with dedicated equipment. For ports where this equipment is unavailable, the cold soaked fuel can be transferred into the aircraft’s centre tank making room for the wings to be refuelled. The introduced fuel is warmer, and therefore frost and ice can be prevented or removed.

Qantas advised that fuel transfers were usually carried out by LAMEs, however during the COVID‑19 pandemic flight crew were sometimes required to carry out the flight deck actions because of quarantine requirements (keeping flight and ground crews more separate).

There were 3 documents available to Qantas staff that contained the procedural requirements to carry out a fuel transfer – the Boeing AMM used by maintenance personnel, the Qantas fuelling manual used by maintenance personnel and flight crews, and the flight crew operation manual (FCOM) used by flight crews. The procedures to transfer fuel differed, with several steps presented in a different order across the 3 documents.

Aircraft fuel system

Description and operation

The 737 fuel system (Figure 2) comprised the following major components:

• 3 fuel tanks – left and right main tanks in the wings, and a centre tank
• 2 fuel pumps for each tank
• an engine and APU fuel feed system (including a crossfeed allowing engines to be fed from any tank)
• a fuel quantity and temperature indicating system
• a refuel / defuel system.

Figure 2: Fuel system schematic

Image source: Boeing, annotated by the ATSB.

Operation with the fuel pumps on and crossfeed valve open

The description of the fuel system in Volume 1 of the FCOM stated that the fuel pumps supplied both engines from the centre tank until the centre tank quantity decreased to near zero. The fuel pumps normally then supplied the engines from their respective main tanks. The centre tank fuel pumps produced higher pressure than the main pumps to ensure that centre tank fuel was used before the main tank fuel, even with all fuel pumps in operation.

The FCOM also stated that continued flight with the crossfeed valve open would result in a progressive fuel imbalance. The 737 flight crew training manual (FCTM) stated:

…the fuel pumps in the airplane have allowable variations in output pressure. If there is a sufficient difference in pump output pressures and the crossfeed valve is opened, fuel feeds to the operating engine from the fuel tank with the highest pump output pressure. This may result in the fuel unexpectedly coming from the tank with the highest output pressure.

Fuel imbalance condition

The FCTM stated that aircraft controllability was not significantly affected by a fuel imbalance but that its structural life could be reduced by frequently operating with an out-of-limit fuel balance condition. It stated that the primary purpose of fuel balance alerts is to prevent higher fuel consumption that results from increased trim drag.

Diagnosis of a fuel imbalance condition

The FCTM stated:

The FCTM additionally stated:

On the position of the crossfeed valve after an in-flight engine shutdown, the FCTM stated:

Fuel imbalance and engine fuel leak checklists

The QRH provided instructions for abnormal situations and to where possible return the aircraft to a normal operating state. Flight crews accessed the section relevant to the abnormal situation and followed the QRH procedural steps sequentially. Decision points in the QRH procedural steps in some cases led to another QRH section depending on the nature of the abnormal situation that was being diagnosed.

The QRH IMBAL checklist is shown in Figure 3. From step 5, the checklist contained steps to verify the functionality of the crossfeed valve, rectify the imbalance if the valve is serviceable, and then close the valve.

Relevant sections of the Fuel leak engine checklist are shown in Figure 4 and Figure 5. From step 11, the checklist contained steps to shut down the affected engine, including starting the APU when available and (only when a fuel low alert is shown) opening the crossfeed selector.

Figure 3: QRH IMBAL checklist

Image source: Boeing.

Figure 4: QRH Fuel leak engine checklist (first 2 pages)

Image source: Qantas.

Figure 5: QRH Fuel leak engine checklist (remaining pages)

Image source: Qantas.

Safety analysis

Introduction

When carrying out an exterior inspection of the aircraft prior to departure, the captain observed extensive cold soaked fuel frost on the lower surface of both wings. The presence of frost is a risk to flight safety, and the captain and the attending licenced aircraft maintenance engineer agreed on removing the frost by a ground transfer of fuel. This was carried out by the engineer and the first officer (FO). Transferring fuel from the main tanks to the centre tank required the crossfeed selector (in the flight deck) to be opened to commence the transfer and closed once completed.

The procedural step to close the crossfeed valve was not carried out, and the aircraft was dispatched. This resulted in a progressive fuel imbalance, which was misdiagnosed by the flight crew as a fuel leak. As a result, the left engine was shut down in flight unnecessarily and the aircraft was diverted to Kalgoorlie-Boulder.

The analysis will examine the coordination of pre-departure fuel transfer procedures, and the flight crew’s management of the fuel imbalance.

Fuel transfer coordination

The licensed aircraft maintenance engineer (LAME), who was licenced on the aircraft type, drew on their technical knowledge of the aircraft’s systems to facilitate the fuel transfer, and the FO recalled being directed to carry out the required actions in the flight deck. It could not be established when the captain arrived on the flight deck but the captain was present later to approve the additional fuel.

The recollections of the LAME, captain and FO differed in regard to the completion of the fuel transfer. As the captain needed to authorise the change in fuel uplifted, it is likely that both flight crew were on the flight deck at the conclusion of the fuel transfer when the crossfeed valve was to be closed.

However, the procedural step to close the crossfeed valve was not carried out. This was likely associated with the FO and/or captain following the LAME’s instructions rather than referring to the relevant procedure. While this is permissible, referring to procedures is a more reliable method to ensure all steps are carried out. In any case, there was insufficient evidence to determine the reasons for the crossfeed valve not being closed.

There are numerous tasks that may be carried out without referring to a procedure. However, for tasks that are infrequently performed or that may be unfamiliar, the use of a procedure increases the likelihood they will be accomplished successfully.

Flight with open crossfeed valve

During subsequent preparations for the flight, the captain and FO did not identify that the crossfeed selector had remained in the open position, and at the time its accompanying ‘valve open’ light would be dimmed. As the fuel panel was out of the normal field of view, the selector position and indicator light would not be readily detectable.

Neither flight crew member noticed the crossfeed selector was positioned to open or the dimmed blue ‘valve open’ light immediately above it on the overhead fuel panel during the first part of the flight. There was no requirement for the selector or indicator to be checked in normal flight.

The IMBAL (imbalance) alert does not usually require immediate attention as an imbalance condition is itself a relatively minor concern, and not a strong indicator of a serious problem. It is presented as an amber warning on the fuel tank quantity indication and is not associated with an aural alert. Associated with this manner of indication, the flight crew probably did not notice the alert immediately.

Use of checklists in response to the in-flight fuel imbalance

Introduction

The correct response to an IMBAL alert is to commence the IMBAL (imbalance) checklist. The objective of this checklist was to decide if a fuel leak is suspected and, if not, balance the fuel. With a suspected fuel leak, the IMBAL checklist led to the Fuel leak engine checklist. The objective of this checklist was to confirm the existence of an engine fuel leak and either shut down the affected engine or continue with normal operations if there was no fuel leak.

The following sections discuss the flight crew’s application of these checklists and the reasons for the diversion and erroneous shutting down of the aircraft’s left engine.

Not recognising crossfeed issue when using the IMBAL (imbalance) checklist

When the imbalance alert was triggered, the flight crew commenced actioning the QRH IMBAL non-normal checklist. The IMBAL checklist stated that the alert may be caused by a fuel leak, an inoperative crossfeed valve or a fuel imbalance; it did not state that it could be the result of the crossfeed valve being open. This meant that a critical piece of information was absent from the flight crew’s awareness at the time; had they recalled this knowledge or if it had been included in the checklist as a note or step, they may have re-evaluated the possibility of a leak and continued the IMBAL checklist. This would have directed the flight crew to perform steps to verify the functionality of the crossfeed valve and then rectify the imbalance if the valve was serviceable.

Although the presence of crossfeed information probably would have led to a different outcome in this case, a fuel imbalance condition is itself usually minor and a flight crew erroneously progressing to the Fuel leak engine checklist should still usually be able to detect or rule out a more serious condition such as a fuel leak.

Misdiagnosing fuel leak

The IMBAL checklist stated that a fuel leak should be suspected if the total fuel remaining is less than planned, or if an engine has excessive fuel flow. Neither of these conditions existed, but the crew reported they felt time pressure to take action prior to the aircraft crossing the coastline.

Consequently, although there was no evidence that the remaining fuel was less than expected and no leak was visible, the flight crew formed a mental model that there was a fuel leak, originating with and/or reinforced by the rapid reduction of fuel in the left main tank. Consequently, the flight crew progressed to the Fuel leak engine checklist.

The Fuel leak engine checklist had a step to check that the crossfeed valve was closed. It was not possible to conclusively determine whether, or at what time, the flight crew did this due to the limitations of the recorded data and the flight crew’s recollections. However, until around the time the left engine was shut down, more fuel was being used from the left tank than the right. From 1753-1755, the average imbalance rate reduced to about 225 kg/h, which may indicate that the crossfeed valve may have been closed during all or part of this period. However, the imbalance continued to increase through this period, with each engine having a comparable fuel flow, and the imbalance increased again after this period. This indicates that if the crossfeed valve had been closed at about 1753 it was likely also opened again, but the evidence suggests that it was more likely than not open throughout this period. Also, fuel flow rates after this indicate that the crossfeed valve was closed at about the same time the left engine was shut down (1807), and then reopened about 4 minutes later, staying open for the rest of the flight. In either case, the step of the Fuel leak engine checklist to close the crossfeed valve (and keep it closed) was not carried out correctly. If there had been an actual leak from the left engine fuel system, having the crossfeed valve open would have resulted in a greater loss of fuel than would otherwise have occurred.

After this step, the checklist required crews to record the fuel quantities and ‘the current time’ and monitor for a change in imbalance of more than 230 kg ‘within 30 minutes or less', and to check for visual indications of fuel spray. If either or both of these conditions are met, a fuel leak was to be considered ‘confirmed’.

The relevant step in the checklist, to ‘record the main tank fuel quantities and the current time’, required that the fuel record was to be contemporaneous. However, the flight crew calculated the rate of imbalance change using the fuel quantity that was recorded prior to commencing this checklist, so it included a period of time during which the crossfeed valve was open. Therefore, the imbalance was continuing to increase because the fuel for both engines was mostly being drawn from the left fuel tank.

While it is prudent to record fuel quantities as soon as practicable after a fuel leak is suspected, the effect of changing the order of the two checklist steps was probably not apparent to the crew. The decision to use the quantity that they previously recorded was probably influenced by perceived time pressure of approaching the coastline, at night, with a suspected fuel leak. Had the flight crew recorded the fuel quantities again they would have had to wait several more minutes to assess the rate of imbalance change. Furthermore, the monitoring condition could be misread or misunderstood by a flight crew experiencing stress and time pressure.

During this period, the imbalance changed by more than 230 kg within 10 minutes. As a result, one of the conditions to confirm a fuel leak appeared to be met, but unknown to the crew at the time, was based on incorrect information as the relevant checklist was not followed precisely.

This is likely an example of confirmation bias, which is the tendency for people to seek information that confirms their hypotheses, interpret ambiguous evidence as supporting their hypotheses, and either discount or not seek information that contradicts their hypotheses (Wickens and others 2013).

Although the flight crew may have realised that the crossfeed valve had been open when they later closed the crossfeed valve, by this time they had erroneously ‘confirmed’ the presence of a fuel leak based on what information they considered at the time, and likely did not recall the systems knowledge about the effect of an open crossfeed valve and did not have enough contradictory information to question their now well-established mental model of a fuel leak, nor to question the validity of the imbalance calculation. Accordingly, the flight crew decided to follow the checklist steps that ultimately led to an engine shutdown.

With ample fuel on board for the 46-minute descent and landing, even accounting for the hypothetical potential to lose all fuel from the left main tank, in principle the flight crew now had time to reconsider the situation. However, they did not have enough information at hand to give them a compelling reason to perform a new calculation of the imbalance rate, or of the fuel remaining compared with the expected amount. Further, while it is likely that these actions would have provided correct information, it would also have contradicted the information previously used and potentially confused the flight crew further.

Stress and time pressure

Both flight crew members reported stress and time pressure with diagnosing the reason for the fuel imbalance. Research has shown that stress may result in ‘attentional narrowing’, resulting in people drawing upon fewer information sources (Staal 2004), and narrowing their perception of the most relevant or threatening cues (Burian and others 2005, Wickens and Hollands 2000).

The ability to carry out complex tasks and access working memory is impaired (Burian and others 2005). People can also act more impulsively (Dismukes and others 2007), and the capacity to retrieve information from long term memory is affected (Dismukes and others 2015). When under time pressure, trained and experienced individuals often make decisions based on their recognition of a situation rather than methodically reviewing all available options (Klein 1998).

This occurrence is an example of how stress and time pressure can affect decision-making by reducing the effective search for information and the ability to evaluate a solution. This impacted the flight crew’s ability to recall and gather information, such as checking the crossfeed selector or recalling the effect of it being open, carefully evaluating the fuel used against the expected amount.

This led to a cautious and conservative but somewhat hasty decision to suspect a fuel leak. In turn, and further associated with stress and time pressure, a step in the Fuel leak engine checklist—to record the fuel quantities at the current time—was skipped or overlooked in favour of using the fuel quantities recorded earlier. This inadvertently led to an incorrect fuel imbalance calculation and, ultimately, an unnecessary engine shutdown.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the fuel imbalance and engine shutdown involving Boeing 737, VH-VZT, near Esperance, Western Australia, on 25 October 2021.

Contributing factors

• Under instruction from the engineer, the flight crew conducted steps to perform a ground transfer of fuel (to remove cold soaked fuel frost from the wings) without referring to the relevant procedures. Consequently, an error was made in not closing the fuel crossfeed valve before flight.
• During pre-flight checks, and later during the climb and level-off, the flight crew did not notice the crossfeed selector in the open position or the associated dimmed blue indicator light on the fuel panel.
• The Boeing 737 IMBAL (imbalance) checklist did not provide sufficient guidance for a flight crew to identify an open crossfeed valve as being a potential reason for a fuel imbalance.
• Partly as a result of confirmation bias, stress and perceived time pressure, the flight crew abbreviated the relevant checklists. As a result, the flight crew’s calculation of the rate of fuel imbalance change was invalid, and they misdiagnosed the fuel imbalance as being the result of a fuel leak, resulting in an unnecessary inflight engine shutdown.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.

Safety action by Qantas Airways

After the occurrence, Qantas communicated the factors involved to 737 flight crews.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Airservices Australia
• the flight crew and cabin crew on board VH-VZT
• the licenced aircraft maintenance engineer
• Qantas Airways Limited.

References

Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.

Dismukes RK, Berman BA & Loukopoulos LD 2007, The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Aldershot UK.

Dismukes RK, Goldsmith TE & Kochan JA 2015, Effects of acute stress on aircrew performance: Literature review and analysis of operational aspects, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2015-218930.

Klein G 1998, Sources of power: How people make decisions, Massachusetts Institute of Technology.

U.S. Department of Transportation Federal Aviation Administration 2022, Notice 8900.636 – Revised FAA-Approved Deicing Program Updates, Winter 2022–2023.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Wickens CD & Hollands JG 2000, Engineering psychology and human performance, 3rd edition, Prentice-Hall International Upper Saddle River, NJ.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• flight crew of VH-VZT
• licenced aircraft maintenance engineer
• Boeing
• Qantas Airways
• Civil Aviation Safety Authority (CASA).

Submissions were received from:

• captain of VH-VZT
• licenced aircraft maintenance engineer
• Qantas Airways.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

---