Maintenance
The aircraft's fuel tanks were last checked for water2 in the fuel on the 15 January 2008 at Heathrow; this was prior to its refuelling for the outboard sector to Beijing.
A check for water in the fuel tank is carried out by draining fluid from the sump drains located at the lowest point of each fuel tank in its 'on-ground' attitude.
Access by maintenance personnel, to the aircraft's fuel tanks, had last taken place during maintenance activity in 2005. The last scheduled maintenance activity on the aircraft was on the 13 December 2007.
Spar valves
On examination, both of the engine spar valves were found to be OPEN, allowing the fuel leak evident at the accident site.
The spar valves are designed to shut off the fuel supply to the engines following the operation of the fuel control switches or after operation of the fire handles in the cockpit. Their function is to cut off the fuel flow to the engine in the event of an engine fire or an accident.
Each valve has two separate electrical wire paths which can be used to supply power to shut the valve; the first is via a run/cut-off relay, controlled by the fuel control switches, the other is directly from the fire handles.
The wiring on G-YMMM was as originally designed and manufactured, and such that when the fire handle was operated, it isolated the power supply to the run/cutoff relay. When tested, the run/cut-off relays for the left and right engines were still in the valve OPEN position, despite the fuel control switches being set to cut-off.
The fire handles had also been pulled and the engine fire bottles had been fired. Therefore the fire handles had been operated prior to the fuel control switches.
The left spar valve circuit breaker (CB) had been tripped. This was due to damaged wiring to the valve as a result of the left main landing gear being forced upward through the conduit at the initial impact. The tripping of the CB meant there was no means of electrically closing the left spar valve. Similar damage was also evident to the right spar valve wiring, however, in this instance the CB had remained set.
Examination and tests of the wiring identified that, in the case of the right engine, the valve CLOSE wire from the run/ cut-off relay was still continuous. This could have allowed the valve to operate had the fuel switch been operated before the fire handle.
Boeing had issued a Service Bulletin (SB 777-28-0025) which advised the splicing together of the wires for the fuel control switches and the fire handles to avoid the need to sequence their operation.
An FAA airworthiness directive requires this SB to be completed by July 2010. This had not yet been incorporated on G-YMMM; however, had it been incorporated, the right spar valve should have closed when the fuel control switch was operated.
The evacuation checklist for the Boeing 777, issued by Boeing, shows operation of the fuel control switches to cut-off prior to operation of the fire handles. This sequence allows for both CLOSE paths to the spar valve to be exploited and increases the likelihood that the spar valves close before electrical power to the spar valves is isolated. However, if the fire handle is operated first, then only a single path is available.
The operator's evacuation checklist, for which Boeing had raised no technical objection, required the commander to operate the fuel control switches whilst the first officer operated the fire handles, this was in order to reduce the time required to action the checklist. These actions were carried out independently, with no measure in place to ensure the correct sequencing. The evacuation drill was placarded on the face of the control column boss, directly in front of each pilot.
An evacuation checklist with the division of independent tasks between the crew leaves a possibility that the fire handles could be operated before the fuel control switches which, with fire handle to spar valve wire damage, could leave the engine fuel spar shut-off valves in an OPEN position. This occurred in this accident, and resulted in the loss of fuel from the aircraft. This was not causal to the accident but could have had serious consequences in the event of a fire during the evacuation.
It is therefore recommended that: Safety Recommendation 2008-009
Boeing should notify all Boeing 777 operators of the necessity to operate the fuel control switch to cut-off prior to operation of the fire handle, for both the fire drill and the evacuation drill, and ensure that all versions of its checklists, including electronic and placarded versions of the drill, are consistent with this procedure.
Boeing has accepted this recommendation. On 15 February 2008 Boeing issued a Multi Operator Message, which advised operators to ensure that evacuation and engine fire checklists specifiy that the fuel control switches are placed in the cut-off position prior to the operation of the fire handles". This advice only relates to those aircraft that have not had Boeing SB 777-28-0025 incorporated.
Boeing also recommends that operators review their engine fire and evacuation checklists (Quick
Reference Handbook, Electronic and Placard) to make sure that they are consistent with this advice.
Continuing investigation
Investigations are now underway in an attempt to replicate the damage seen to the engine high pressure fuel pumps, and to match this to the data recorded on the accident flight. In addition, comprehensive examination and analysis is to be conducted on the entire aircraft and engine fuel system; including the modelling of fuel flows taking account of the environmental and aerodynamic effects.