Lessons learned from 65 transport aircraft fuel starvation incidents and accidents in the past four decades have prompted the (EASA) to propose certification rule modifications designed to mitigate the occurrence of similar incidents.
The notice of proposed rulemaking (NPA-2011-13) issued this summer would modify EASA's certification specifications for large aeroplanes (CS-25) by requiring the installation of fuel identification systems, replacing the currently required fuel quantity indicators for each fuel tank. The new systems would have to permanently display to the flight crew the total quantity of usable fuel on board as well as in each fuel tank, provide low-level fuel warnings for each tank, and warn the crew of an airplane configuration that, if left uncorrected, would starve one or more engines of fuel.
Such conditions include abnormal fuel transfer, trapped fuel and fuel leaks. Each alert must come with a set of corrective actions for the crew.
EASA notes that despite the lack of a regulatory requirement for a low-level fuel alert system, many large transport aircraft have one installed. However, the agency points out, “they are not all independent or fault tolerant from the normal fuel gauging system, and the alert level and setting point are not standardized.”
The events that led to EASA's move are a mix of well-known accidents and fate-tempting incidents caused by everything from bad weather to maintenance errors. Among the most publicized events is the 1983 “Gimli Glider,” anthat suffered from erroneous fuel loading calculations and fuel-gauge malfunctions but landed safely with no engine power.
A similar incident caused by a fuel leak left an Air Transatgliding to a landing in the Azores in 2001. Among the lesser-known incidents is a July 2010 situation in which an open cross-feed valve caused a Finnish Commuter Airlines 's right-side tank to run dry as the aircraft approached the gate following a flight from Kuopio to Helsinki. Several incidents were triggered by excessive go-arounds in poor weather.
EASA's analysis determined that 24 of the 30 accidents and 25 of the 35 incidents studied would have benefited from the proposed standards.
EASA explained that the proposal is based on a report prepared by a working group made up of representatives from numerous stakeholders, including original equipment manufacturers Airbus,, , and , as well as aviation authorities , and EASA. Most of the group's recommendations made it into EASA's draft rule.
One that did not was a continuous, automatic verification that the fuel on board was sufficient to complete the intended mission; the majority of group members found numerous problems with this proposal. Among them were onboard failures, such as fuel leaks or trapped fuel, that cannot be accurately predicted or monitored. “[C]onsidering the low safety benefit and the complex technical issues limiting the integrity, capability and the reliability of an automated fuel check function, the majority of the group decided not to require this function in the proposed certification specifications,” EASA said. The single objector was FAA, which would have required this additional function, EASA added.
FAA also took the position that the group's proposal—accepted by EASA and included in the NPA—for a 30-minutes-remaining, low-level fuel alert “would not necessarily be sufficient even for non-ETOPS twin-engined aeroplanes, because the operational rule authorizes the aircraft flying up to 60 minutes away from an airport (at the one engine inoperative cruise speed),” EASA said.
“Nevertheless,” EASA added, “the events analyzed and the available information did not identify any event where the fuel low-level alert would have been correctly triggered in a location where the aeroplane would have been too far away from a suitable place to land.”
Both FAA and Transport Canada are expected to propose similar changes to their certification standards. However, considering FAA's minority position, its rule may not be completely harmonious with EASA's final rule.