British Airways Flight 38

Date

17 January 2008

Phase of flight

Approach

Location

London Heathrow Airport, United Kingdom

Aircraft

Boeing 777-236ER

Registration

G-YMMM

Operator

British Airways

Flight

British Airways 38

Occupants

152

Fatalities

0One passenger seriously injured; 34 passengers and 12 cabin crew suffered minor injuries

Investigating body

Air Accidents Investigation Branch (United Kingdom)

Final report

AAIB Aircraft Accident Report 1/2010 (EW/C2008/01/01)

Report date

9 February 2010

Report title

Report on the accident to Boeing 777-236ER, G-YMMM, at London Heathrow Airport on 17 January 2008

On 17 January 2008 a British Airways Boeing 777-236ER, registration G-YMMM, was on final approach to runway 27L at London Heathrow after a flight from Beijing when both engines stopped responding to demands for more thrust. At about 720 ft the right engine's power fell back, and seven seconds later the left engine's did the same. The aircraft lost speed, descended below the glidepath and struck the grass 330 m short of the runway, inside the airfield boundary. All 152 people on board survived.

The investigation by the UK Air Accidents Investigation Branch (AAIB), whose final report was published in February 2010, included extensive fuel system tests and a search of data from 175,000 flights. It found no pre-existing defect in the aircraft or engines. Instead, ice that had formed from water naturally present in the fuel had built up inside the fuel feed pipes during the flight, then broke loose on approach and blocked the fuel oil heat exchanger (FOHE) of the right engine and, most likely, of the left. The AAIB's report identifies the aircraft by its registration and gives its call sign, 'Speedbird 38'; the flight is widely known as British Airways flight 38.

The accident revealed a failure mode that certification had not considered, and it shows how a crew can protect lives in the last seconds of an approach that can no longer reach the runway. Times below are UTC.

The flight

G-YMMM, serial number 30314, was powered by two Rolls-Royce Trent 800 engines. The flight crew consisted of a commander and two co-pilots, the extra co-pilot allowing in-flight rest. The commander, aged 43, had 12,700 hours, 8,450 of them on type; the operating senior co-pilot, aged 41, had 9,000 hours, 7,000 on type. The AAIB found the crew adequately rested.

The flight plan predicted "extreme cold" at a waypoint on the border between China and Mongolia, and the crew agreed on a fuel load of 79,000 kg, of which 71,401 kg was loaded at Beijing. The left main tank fuel was at -2 °C at take-off, which was at 02:09. The initial cruise was FL348. Two step climbs, to FL380 and FL400, were flown in vertical speed (VS) mode for passenger comfort, which kept fuel flows lower than a VNAV climb would. The crew monitored the fuel temperature, which reached a minimum of -34 °C, while the total air temperature reached -45 °C. The low fuel temperature warning never appeared. The AAIB found that these temperatures were unusual but within the aircraft's operating envelope.

The flight was uneventful to London. The aircraft held at Lambourne for about five minutes, descending from FL110 to FL90, and was vectored for the ILS to runway 27L. At 1,000 ft above aerodrome level it was fully configured with gear down and flap 30, autopilot and autothrottle engaged. The Heathrow weather was mild: wind 200° at 10 kt, visibility over 10 km, scattered cloud at 800 ft and a temperature of 10 °C.

The accident

At about 800 ft the co-pilot took control as briefed, intending to disconnect the autopilot at 600 ft and land manually. The autothrottles commanded more thrust and the engines at first responded. Then the thrust of both engines fell back, above flight idle but far below the commanded level, and stayed there.

The engines did not shut down: fuel flows settled at 6,000 pph on the right and 5,000 pph on the left, above flight idle, while each engine's electronic control opened its fuel metering valve fully without effect. Pushing the thrust levers fully forward achieved nothing. Because the co-pilot had been distracted by the thrust problem, the autopilot was still engaged and raised the nose to hold the glideslope, bleeding off speed until the "airspeed low" caution at 115 kt. To reduce drag, the commander retracted the flaps one stage; he also moved what he believed to be an engine starter/ignition switch. When the stick shaker operated, the co-pilot promptly pushed the control column forward, which disconnected the autopilot, but the aircraft was by then only about 150 ft above the ground.

The aircraft struck the soft ground about 110 m inside the perimeter fence with a vertical load of 2.9 g and a descent rate of about 1,400 ft/min, and slid 372 m. The nose gear collapsed, the left main gear collapsed and the right main gear separated, and the aircraft came to rest on the paved undershoot of runway 27L.

There was no time to warn the cabin or call "brace brace". The commander's first evacuation call went out on the tower frequency; when told, he repeated it on the PA. All escape slides deployed, the cabin crew ran an efficient evacuation, and the first fire vehicle reached the aircraft within two minutes. One passenger suffered a broken leg when parts of the right main gear penetrated the fuselage. There was no fire, but 6,750 kg of fuel leaked from the engines. The spar valves had stayed open because the gear separation damaged their wiring and, on the right side, because the fire handle was pulled before the fuel control switch was set to cutoff, which isolated the switch's signal to close the valve.

The investigation

Ruling things out

The fuel was Jet A-1 to specification, with 35 to 40 ppm of water, similar to other aircraft on similar routes. It never cooled to a temperature at which it would wax; the sampled fuel's freezing point was -57 °C. Fuel sumping, the water scavenge system and electromagnetic interference were all ruled out. Fresh cavitation on both high pressure fuel pumps showed that fuel had recently been restricted upstream of them, but no physical blockage remained when investigators examined the aircraft.

How ice formed and moved

Water is always present in jet fuel: dissolved, entrained as tiny droplets, or as free water. As fuel cools, dissolved water comes out of solution. Fuel system tests showed that ice can form on the inside of fuel pipes, and that ice crystals are most likely to stick in a sticky range between about -5 °C and -20 °C, most of all at -12 °C. Below about -35 °C ice did not appear to stick.

On G-YMMM, ice probably began to accumulate while warmer centre tank fuel flowed through feed pipes running through the cold main tanks. Accumulation continued, more slowly, once the main tanks fed the engines. Low fuel flows over many hours, including the VS-mode step climbs, gave the ice time to build up. On approach, the final engine accelerations, perhaps with turbulence, pitch changes and a warmer strut, released it as soft ice.

The fuel oil heat exchanger

The FOHE warms the fuel with hot engine oil, both to cool the oil and to protect downstream components from ice. It contains over 1,000 small tubes whose ends protruded about 4 mm into the fuel inlet chamber. Tests showed that soft ice in high concentration could restrict the FOHE when the fuel was colder than -10 °C and the flow was above flight idle. Reducing the flow to idle always cleared the restriction. No other component could be shown to collect enough ice to cause the restrictions seen on the accident flight.

On the right engine, a drop in oil pressure recorded at the start of the final acceleration matched a restricted FOHE. The left engine's data stopped too soon to confirm the same, but the AAIB judged a different mechanism within seven seconds very unlikely. The fuel temperature at the moment of rollback was -22 °C.

In November 2008 another Boeing 777-200ER, N862DA, also powered by Trent 800 engines, suffered a rollback of its right engine at FL390 on a flight from Shanghai to Atlanta. The engine recovered when the thrust lever was retarded to idle during descent, and the fuel temperature at the rollback was again -22 °C. The NTSB's preliminary conclusion was that its FOHE had become restricted by ice.

The data mining found that G-YMMM's flight was unique among 175,000 flights in combining a low cruise fuel flow, a high fuel flow during the approach and a low fuel temperature.

The crew's actions

The AAIB found that the crew faced an unprecedented double-engine rollback at low height, for which no specific training existed. Manufacturer analysis showed that retracting the flap at about 240 ft moved the touchdown about 50 m towards the runway; with flap 30 the aircraft would have landed just before the ILS antenna, still inside the airfield. The AAIB noted that the crew "kept the aircraft flying and under control so that, at impact, it was wings level and at a moderate pitch attitude."

Probable cause and contributing factors

The AAIB found that the reduction in thrust was due to restricted fuel flow to both engines: at the FOHE on the right engine, and most likely at the FOHE on the left. It listed four probable causal factors:

1. "Accreted ice from within the fuel system released, causing a restriction to the engine fuel flow at the face of the FOHE, on both of the engines."
2. Ice had formed within the fuel system from water that occurred naturally in the fuel, while the aircraft operated with low fuel flows over a long period and the localised fuel temperatures were in the "sticky range".
3. The FOHE, although compliant with the applicable certification requirements, was susceptible to restriction when presented with soft ice in a high concentration, with a fuel temperature below -10 °C and a fuel flow above flight idle.
4. Certification requirements did not take account of this phenomenon, as the risk was unrecognised at the time.

Safety recommendations and what changed

The AAIB made eighteen safety recommendations, several of them before the final report.

Fuel and fire drills (February 2008). Recommendation 2008-009 asked Boeing to tell all 777 operators to set the fuel control switch to cutoff before pulling the fire handle, in both the fire and evacuation drills. Boeing issued this advice on 15 February 2008; a service bulletin, SB 777-28-0025, allows the switch to close the spar valve even after the fire handle has been pulled.

Interim operating procedures (September 2008). Following recommendation 2008-047, Boeing amended the 777 flight manual for Trent 800-powered aircraft, mandated by the FAA and EASA:

• recirculation of fuel during refuelling when the fuel temperature is below 0 °C;
• when the fuel temperature is below -10 °C, maximum climb thrust for at least 10 seconds, first within 3 hours and later 2 hours before top of descent;
• a non-normal procedure if an engine fails to respond to thrust demands: thrust lever to idle for 30 seconds, then advance to maximum.

A redesigned heat exchanger (2009). Rolls-Royce modified the FOHE so that its tubes sit flush with the inlet face, without inlet crimps. Tests showed it could tolerate soft ice down to at least -44 °C. EASA AD 2009-0142 required it on Trent 800 engines by 1 January 2011 at the latest, and a similar change was mandated for the Trent 500 and Trent 700.

Research and certification. The AAIB asked the FAA and EASA to consider the findings for other airframe and engine combinations, to review certification so that fuel systems tolerate the build-up and sudden release of ice, to study wider use of anti-icing additives, and to research ice formation and release in fuel. Other recommendations asked for recording of fuel metering valve position on flight data recorders, less data buffering in the quick access recorder, a modified main gear drag brace to prevent fuel tank rupture, landing gear certification that considers side loads and different ground surfaces, and better retention of ceiling lights, cabin fittings and seat-back video monitors.

Lessons for pilots

A thrust lever split can be the first sign. Slight splits are common, and the AAIB noted that realigning them is a normal response. Here it was the first indication of a rollback. Any mismatch between commanded and achieved thrust, fuel flow or EPR on approach deserves an immediate check of the engine indications.

With no thrust, the glidepath is not the priority. The engaged autopilot tried to hold the glideslope and pitched the aircraft up, trading speed for height until the stick shaker. With thrust gone, the choice is between speed and distance, and a stall close to the ground is the worst outcome. The co-pilot's immediate response to the stick shaker kept the aircraft under control. See stall.

Fuel temperature is more than a freezing-point check. The EICAS low fuel temperature alert warns of fuel approaching its freezing point: it triggers 3 °C above the freezing point set, at -44 °C for Jet A-1 and -37 °C for Jet A. The ice that stopped G-YMMM's engines formed at much warmer temperatures, from the water always present in fuel. Knowing how water behaves in fuel, and why some aircraft use a fuel system icing inhibitor, is exam material. See fuel additives and contamination and gas turbine engine fuel systems.

Sequence the shutdown in the evacuation drill. Setting the fuel control switch to cutoff before pulling the fire handle matters. The operator's checklist split these actions between the two pilots with nothing to ensure their order; on G-YMMM the fire handles were pulled first, which removed the switch's ability to close the right spar valve, and fuel leaked until the valves were closed by hand. Check that the PA is selected before announcing an evacuation. See emergency evacuation.

Evacuation discipline saves time. The cabin crew had no warning, yet they kept passengers seated until the evacuation command and then emptied the aircraft quickly. Some passengers still took bags, and one even climbed back up a slide to retrieve belongings, a reminder of why the evacuation briefing matters.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.