From The Sunday Times January 20, 2008

Hunt for fatal flaw of Flight 38
An electronic systems failure is emerging as the prime suspect in BA.s 
brush with disaster at Heathrow, report Richard Woods, Steven Swinford 
and Paul EddyRichard Woods, Steven Swinford and Paul Eddy 
After 10 hours of flying, Speedbird 038 was almost home. First Officer 
John Coward was preparing to land the British Airways flight from 
Beijing to Heathrow. In front of him on the right side of the cockpit 
were three screens displaying flight, navigation and engine data; 
another three were arrayed in front of Captain Peter Burkill, who sat on 
the left. 

Beyond, through the cockpit windows, Coward could see central London, 
one of the most densely populated areas of Europe, stretch into the 
distance. It was Thursday lunchtime and they were approaching Heathrow 
from the east. There is a preference for flights into the airport to 
cross the capital in this direction because it is quieter than having 
them take off over the city. Below them, millions of people were going 
about their business, never imagining that a plane might fall out of the 
sky. 

At eight nautical miles from the airport, BA038 was down to about 
2,400ft in a shallow glide. At 7. nautical miles, the plane lined up 
with the instrument landing system that would guide it into Heathrow. 

.At 2,000ft you lower the gear,. said a former 777 pilot, referring to 
the undercarriage. .That.s the procedure.. 

The plane was lining up for a .category one. landing in good weather, 
being guided in by two radio beams, one horizontal, one vertical. They 
were drawing the plane down a three-degree glidepath onto the southern 
runway, known as 27L, at Heathrow. Everything appeared normal. 

The Boeing 777 is one of the most advanced passenger jets in the world, 
crammed with highly sophisticated electronics. Over 12 years it had 
established a remarkable safety record - more than 600 of the planes had 
gone into service and not one had crashed. 

To Coward, a 41-year-old career pilot with BA, it was a routine flight 
and the plane was taking the strain. The autopilot and autothrottle were 
engaged and making the necessary adjustments. 

.You can see the throttles moving themselves. It.s as if they have a 
ghostly hand on them,. another retired 777 pilot said. .The gear is down 
and the flaps are down. In most cases you.d see the runway at this 
point. The aircraft would be holding a speed or even slowing slightly.. 

As the plane approached, Coward, according to former pilots, would have 
announced: .1,000 radio. Man land 200.. This meant the plane was at 
1,000ft, in its final approach, and that Coward was going to switch from 
autopilot to a manual landing at 200ft. 

Once such a procedure was set, the plane would continue under automatic 
control until it reached an altitude of 250ft. Then a female computer 
voice would say, .Decide.. 

.That.s decision time,. said a former 777 pilot. .The co-pilot would 
take the autopilot out. He.d say, .Man land 200, I have control... 

At two miles out and 600ft up, the plane was .established on late 
finals. - it was less than a minute from landing. The crew and 
passengers must have thought that they would soon be inside the 
terminal. 

As Coward stared at the controls, the autothrottle demanded more thrust. 
It was a normal procedure, a small adjustment intended to keep the plane 
at the correct speed and height. Nothing happened. The computer system 
again ordered more thrust. Again, no response. 

In the central control displays of the 777 is a screen that shows the 
engine pressure rate (EPR). One indicator shows the .command EPR., the 
level ordered by the pilot; another indicates the actual EPR. .The 
pilots would have noticed that the achieved EPR was drifting back,. said 
one former 777 flier. .That would have been one of their first 
indicators.. 

Coward or Burkill - it is not clear which - tried to increase thrust 
manually. Still nothing happened. 

At high altitudes, planes that lose power can glide for distances of up 
to 100 miles, according to Boeing, helped by starting at cruising speeds 
of more than 600mph. At less than 1,000ft and at much slower speeds, 
they can drop like a stone. 

Yesterday Coward said the plane had suffered .catastrophic failure. in 
both engines and that he feared it would smash into the ground and 
disintegrate. He told a Sky News reporter that his .adrenaline kicked 
in.. 

There were no drills for such a situation, no time to try to restart the 
engines. Pilots are taught how to recover from potential disasters at 
normal cruising altitudes, but not so close to the ground. .I was just 
focused on holding it up in the air for as long as possible, then 
keeping it straight,. said Coward. 

Below 600ft the .ground proximity. warning is inhibited so that it does 
not distract pilots from an ordinary landing. But other signs and sounds 
would have rapidly filled the cockpit. 

Through his clenched hand, Coward would have felt the control stick 
judder. .If a stall is imminent, the aircraft analyses its airspeed and 
gives a preliminary shake to the yoke,. said one former pilot. .It won.t 
let you miss it. We call it the .stick shaker.. An .airspeed low. 
warning will also flash up on screen.. 

Coward had only seconds to respond, only seconds before the plane would 
hit the ground. 

Just 100ft or so below, Pym Reehal, whose house lies in the Heathrow 
flightpath, had gone outside to his car. He had an engine problem of his 
own and was trying to jumpstart the vehicle. 

As he tinkered, BA038 hurtled overhead. .I had a quick glimpse and saw 
it was coming in at a very weird angle,. recalled Reehal. .It was sat at 
such a strange angle.. 

A short distance away, John Rowland was driving his taxi just outside 
the airport perimeter fence. .It looked as though it was just missing 
the roof of my cab,. he said. .So low you would think you could lean out 
of the window and touch it.. 

The plane skimmed the road and missed the perimeter fence by a few feet. 
Further down the Heathrow airfield another BA flight was preparing to 
take off. One of the air crew watched as BA038 hurtled towards the 
ground. 

.I thought: oh my God, something.s terribly wrong,. said the witness, 
who asked not to be named. .The angle was all wrong. It just looked like 
it would be a disaster.. 

Inside the cockpit of BA038 Coward and Burkill had no time to issue a 
Mayday, no time to warn passengers to brace. In the few remaining 
seconds they just fought to keep the plane flying. 

The failure of the engines had cut the main power. The 777 does not have 
cables connecting wing flaps and rudder to the pilots. controls. It is 
all done by sending electronic signals. However, the plane has several 
back-up batteries that enable the instruments to work until the 
emergency power units kick in. 

.If they had done nothing, the autopilot would have tried to fly the 
glide path,. said a former pilot. The plane would probably then have 
stalled and crashed. .So they have to lower the nose to maintain speed, 
then lift it just before hitting the ground.. 

Coward, who lives in Valbonne in the south of France with his wife, said 
yesterday that he had thought it was .the end. for him - that the plane 
would land with an .almighty crash.. He added that .some thanks has to 
go to the man upstairs for giving us that little lift at the end.. 

But he and Burkill, said one former pilot, did .a brilliant job.. If the 
angle is right, a plane gets the benefit of .ground effect. - the wings 
in effect trap a cushion of air underneath them that softens the 
landing. 

The Boeing 777 has the biggest landing gear of any craft, with six 
wheels instead of four on each assembly. As the plane slammed into the 
grass before the start of the runway, the landing gear on the left side 
smashed upwards through the wing; the right-side landing gear was torn 
off. 

.It wasn.t just one thud,. said Coward yesterday. .It was a series of 
thuds.. 

The plane ploughed great gouges in the earth as it skidded hundreds of 
metres, skewed right and came to rest on the edge of the runway. 

.I felt like I was in a washing machine,. said Jason Johnson, one of the 
passengers. .The wings were making cracking sounds. You think of your 
family and your loved ones.. 

Others barely noticed that the plane had crash landed until oxygen masks 
fell from the overhead storage lockers. 

The passengers fled down the emergency chutes that had been triggered 
when the crew opened the doors. Amazingly, nobody was killed and 
injuries were relatively minor. 

How did one of the safest aircraft ever made come to crash-land, 
narrowly avoiding disaster, and why did both engines apparently shut 
down at the same time? 

THE 777 is the first plane to be designed entirely on computers, with 
input from pilots from the outset. It is a long-range fuel-efficient 
workhorse. Since it started commercial operations in 1995, 777s have 
made more than 2m flights. Boeing claims that operators enjoy a .99% 
dispatch reliability rate.. In other words, 777s rarely go wrong. 

According to one database, there have been only a handful of recent 777 
incidents . and two of those were hijackings. The only fatality had been 
that of an airport worker who was burnt to death when a refuelling 
operation went wrong in 2001 in Denver, Colorado. 

The pilots got much of what they asked for in designing the plane, 
including a highly automated .glass cockpit. that does away with all 
analogue gauges and presents flight information on bright, software-
driven LCD displays. Integrated into the software is EICAS (engine 
indication and crew alerting system) which monitors the two engines and 
alerts the crew to any abnormalities. 

Nancy Novaes, an American pilot who flew 777s until she retired last 
year, said: .This is a great plane to fly. It.s highly computerised, 
highly logical. It knows what it needs . . . and EICAS tells you what it 
wants.. 

However, the 777 and its computers are not infallible - as investigators 
knew before last week.s crash. 

Early in the evening of August 1, 2005, a Malaysia Airlines 777, en 
route from Perth, Australia, to Kuala Lumpur was climbing past 38,000ft 
towards its cruising level when the flight crew were confronted with 
what the official report on the incident described as .a situation that 
had previously been considered not possible.. 

On the EICAS screen a .low speed. warning appeared, suggesting the plane 
was approaching the speed at which it would stall. But almost 
simultaneously, the primary flight display screen warned exactly the 
opposite: that the aircraft was approaching the overspeed limit, the 
maximum speed at which it is designed to operate. 

Too slow or too fast? Before the crew could decide, the autopilot 
pitched up the nose and the 777 climbed for 3,000ft, while the air speed 
dropped from 270 knots to 158 knots - at which point the stall-warning 
horn correctly sounded and the stick-shakers activated. 

The pilot prevented disaster by disconnecting the autopilot and pushing 
the nose down. But then the autothrottle kicked in, commanding more 
thrust from the engines. The nose pitched up again and, of its own 
volition, the aircraft climbed another 2,000ft until it was brought 
under control. 

The plane landed safely but, as the Australian Transport Safety Bureau 
report put it, the combination of a failed sensor and .a software 
anomaly. had created an .unexpected situation that had not been 
foreseen. and for which the crew had not been trained. 

The sensor was a tiny .accelerometer. - a device used to measure the 
plane.s acceleration that is similar to those used in cars to deploy 
airbags. 

Airlines were subsequently warned that they had to modify the plane.s 
software. Yesterday BA said it had received the directive and 
implemented it immediately. 

Could a similar electronic or computer fault have occurred on flight 
BA038? Were the pilots not warned of engine failure or did a system 
erroneously shut down the engines? 

One former 777 pilot believes that the accidental mechanical failure of 
both engines at the same time is unthinkable. 

.There are separate autothrottles, a left computer and a right computer 
. . . everything is split. That is the philosophy of the plane,. he 
said. .For [both engines to fail] at the same time it has got to have 
been commanded. We are all aghast.. 

In other words, it may have been an error in the computerised engine 
control systems. The Air Accidents Investigation Branch (AAIB) is 
examining all possibilities and downloading full data from the flight 
recorders. 

Experts noted that its initial report said it would be .examining the 
range of aircraft systems that could influence engine operation.. 

As investigators picked over the crash site, other hypotheses were being 
aired. One was that a .bird strike. had shut down both engines. The 
impact of large birds such as Canada geese hitting the fans inside the 
jet engine can cause engine damage; but no witnesses have recalled 
seeing any flocks of geese or other birds in the vicinity. 

Authorities also monitor flocks by radar and said there were none on 
Thursday. 

.The possibility of geese is remote at that height,. said one pilot. 
.And though they bend the blades, the engine keeps producing power.. 

Pictures of the crashed plane also suggest that this was not the cause. 
The blades in the plane.s starboard engine were undamaged. 

Turbulence is another possibility, particularly at busy airports. Sudden 
wind shear or even the wake left by powerful jets can damage the 
surfaces of planes, sending them out of control. But again there seem to 
be no signs that such forces were at work. 

A fuel problem was another hypothesis. In the immediate aftermath of the 
crash, internet forums populated by pilots were rife with speculation 
that BA038 had run out of fuel. 

Some airlines, although not BA, are known to run their planes with as 
little fuel as possible to reduce costs: heavier planes use more fuel. 
However, this policy can be problematic when planes face unexpected 
headwinds or delays in landing. BA had got its sums wrong, went the 
theory. 

It holds little water, however. .It is well known that if all the 
engines snuff it, fuel is the most common cause,. said David Learmount, 
operations and safety editor at Flight International magazine. 

.But fuel exhaustion is not the issue here because the AAIB report says 
fuel was spilt all over the [crash site]. Luckily it didn.t catch fire.. 

Learmount suggested, however, that water could have got into the fuel, 
frozen at high altitude, thawed as the plane came into land and caused a 
slush in the tanks. This may have blocked fuel to both engines. Reports 
yesterday suggested that BA ground staff were warned to check the fuel 
mix in all its 777s. 

Fuel starvation in certain tanks is another possible explanation, 
because large jets like the 777 have multiple tanks in both wings. Some 
aircraft have additional tanks in the belly and even the tail. 

Transferring fuel between the tanks during the flight to maintain the 
aircraft.s equilibrium is a routine process, controlled by sensors, 
pumps and valves. Like all technologies, it is not infallible. 

On February 7, 2005, a Virgin Atlantic Airbus 340, flying from Hong Kong 
to Heathrow, was passing through Dutch airspace when, without warning, 
one of its four engines - the outer engine on the port wing - went dead. 

The crew quickly established from the Airbus.s sophisticated displays 
that the amount of fuel contained in the inner tank, from which the 
engine was feeding, registered as .0.. What they did not realise was 
that the automatic transfer system between the tanks had failed. 

The outer engine on the right wing also began to lose power and the 
warning display showed that its tank contained zero fuel. The captain 
immediately realised there was a .fuel management problem. and opened 
the valves between the tanks to begin a manual transfer. It worked, but 
the crew still declared a Mayday and diverted to Amsterdam. 

Some experts are sceptical that such a problem affected BA038. One 
former pilot on the 777 pointed out that during landing, fuel is going 
directly from tank to engine - there may be no transferring from one 
tank to another - and it is unlikely that both engines would suffer such 
a problem at the same time. 

THE wreckage of the plane will be removed from the runway tomorrow and 
the airport will start getting back to normal. But crash investigators 
will not produce a definitive report into the cause of the accident for 
months. Until then, suspicion is likely to remain with the avionics. 

So far other 777s have been allowed to continue flying, but the 
implications are serious. A senior airline industry source said: .I have 
heard that BA are going to have to check every single one of their 777s. 
They are not grounding them, but they will be checking every one because 
the AAIB has identified that it seems to be something connected with 
electrics and avionics coming from the flight deck to the engines, 
because the engines seem to be okay. 

.They will go through the records of every single 777 flight looking for 
similar issues. They will go through all the engineering logs to find 
out if have had any similar problems between the flight deck and the 
engines. 

.Each 777 will be brought in one by one for a maintenance check to look 
at whether there are any untoward signs. They will have to do that out 
of good practice as much as anything else.. 

Whatever the cause of the accident, it was a remarkable piece of flying 
by Coward and Burkill and an extraordinary escape for their passengers. 

The pilots, hailed as heroes, have been modest about their achievement. 
But Novaes, before she retired, had experienced the reality of crisis in 
the cockpit. 

.These pilots have practised flying with limited controls,. she said. 
.They wouldn.t panic. Bravery is saying, .I.m afraid, okay, so deal with 
it.. Most pilots really only have to think about themselves. They are in 
the front. They are first on the scene. If they take care of themselves, 
everybody behind them is safe. 

.But afterwards you feel a tremendous sense of relief. You are on the 
ground and you're almost giddy. The entire glut of emotions is probable. 

.The pilot is a human being who may be better practised and controlled 
than others, but they.re still human.. 

Why did both engines fail? The competing theories

Bird strike: A flock would have to have struck and stopped both engines. 
But there is no evidence this happened. Verdict: implausible 

Pilot error: A mistake by those flying the plane must always be 
considered by air traffic investigators. But it is unlikely that BA 
would have allowed the pilots to be hailed as heroes if there were any 
suspicion that they had made a mistake. Verdict: highly unlikely 

Running out of fuel: Last week pilots. internet forums buzzed with 
speculation that the plane had run out of fuel. But the interim accident 
report said that .a significant amount of fuel leaked from the 
aircraft., suggesting the plane was not short of fuel. Verdict: very 
unlikely 

Fuel contamination: Reports yesterday suggested that investigators were 
focusing on the possibility that the plane.s kerosene fuel had been 
contaminated with water. A poor fuel mix has, however, never been held 
responsible for an air crash and one would expect other planes that were 
refuelled in Beijing to have been affected as well. No such problems 
have been reported. Verdict: unlikely 

Fuel management problem: Fuel is transferred as required between various 
tanks in the wings and centre of large planes. In one incident, two 
engines on an Airbus 340 failed, even though the plane had plenty of 
fuel, because the transfer system malfunctioned. But it is unlikely to 
happen to both engines at the same time. Verdict: possible, but unlikely 

Computer glitch:This happened with a Malaysian Airlines 777 and a former 
777 captain told The Sunday Times that for both engines to fail at the 
same time .it has got to be commanded. - ie, it was computer error in 
controlling the engines. Verdict: possible and many experts. prime 
concern 

Boeing 777: how it measures up

- There are about 670 Boeing 777s in service around the world. Last 
Thursday.s crash was the first involving the plane, although in Denver, 
Colorado, in 2001 a member of ground staff was killed while refuelling a 
777 when the fuel hose malfunctioned. 

- It was the first plane to be digitally designed using 3D computer 
graphics. Its flight-control system also differs from earlier Boeings in 
using electronics to control the wing flaps and rudder, rather than 
mechanical systems such as cables. 

- The 209ft-long plane can carry between 305 and 440 passengers at a 
cruising speed of 615mph with a range of up to 8,300 miles. 

- When it came into service in June 1995 it became the first twin-
engined plane permitted to fly three hours from the nearest runway. 
Until then, no twin-engined plane could fly more than 60 minutes from a 
landing spot. Airlines liked its reduced fuel consumption compared with 
four-engine planes. Double-engine failures are also rare. 

- The Boeing 777s have, however, been involved in at least 12 incidents 
where electrical systems have overheated during or before flights, four 
of which resulted in .major damage. to the power panels involved in 
controlling the plane, according to Britain.s Air Accidents 
Investigations Branch. Single engine failure or forced shutdown 
resulting in an early landing has occurred on 11 known occasions.
--- SBBSecho 2.12-Win32