What happened
On 8 February 2005, an Airbus A340-642, registration G-VATL, was operating a passenger flight from Hong Kong to London Heathrow. During the pre-flight phase, the crew noted issues with the Fuel Control Monitoring Computers (FCMCs), which required resets. Shortly after takeoff, an advisory alert indicated a fault in FCMC2. While the crew attempted to reset the computer once the aircraft reached cruise altitude, the attempt was unsuccessful.
While cruising at Flight Level 380 over Dutch airspace, the number 1 engine lost power. The crew secured the engine and elected to continue the flight on three engines. Shortly after, the crew observed that the fuel quantity in the inner 1 fuel tank had dropped to zero. A physical inspection of the engine area from the passenger cabin revealed no visible leaks. However, the situation escalated when the number 4 engine power began to fluctuate, and the inner 4 fuel tank also indicated zero fuel content. The commander opened the fuel crossfeed valves, which allowed the number 4 engine to recover. The crew declared a 'MAYDAY' and diverted to Amsterdam Schiphol Airport.
During the diversion, the crew initiated manual fuel transfer from the trim, centre, and outer wing tanks. However, they encountered difficulties interpreting the ECAM indications, leading to uncertainty regarding the exact fuel status. The aircraft landed safely in Amsterdam with no fatalities and no injuries to the 18 crew members or 2'293 passengers.
The investigation
Following the incident, the AAIB took over the investigation from the Dutch Transport Safety Board. Investigators examined the aircraft's Central Maintenance Computer, which produced a Post Flight Report detailing various cockpit faults. Physical inspections of the fuel pumps, valves, and engine components revealed no mechanical defects or leaks.
Technical analysis of the removed computers—including the FCMCs, Flight Warning Computers (FWCs), and System Data Acquisition Concentrators (SDACs)—showed that the hardware and wiring were functioning correctly. However, data downloads revealed that FCMC2 had suffered a loss of the ARINC 429 data bus A and various discrete output command failures.
Findings
- The investigation established that the master FCMC failed to provide necessary command and warning signals to the cockpit displays.
- A flaw in the master/slave logic allowed an FCMC with an output failure to retain master status, preventing a healthy slave unit from taking control of the fuel system commands.
- The low fuel level warning logic was found to be dependent on the status of the FCMCs; the backup discrete signal from the Fuel Data Concentrators (FDCs) was ignored by the FWCs because the system believed the FCMCs were still functioning normally.
- Consequently, the crew was not alerted to the depleting fuel levels in the inner tanks until the engines actually began to run down.