This aftermath view shows the aircraft on the grass, an evacuation slide and nearby debris. It records the result of the landing short, but does not reveal the internal fuel-system restriction investigated as the cause of the loss of thrust.
Resized and JPEG recompressed; no content changes.
Geographic context
Beijing Capital
London Heathrow
Approximate airport and geographical reference positions. This schematic shows the planned journey and relevant locations, not a recorded flight track. Basemap: Natural Earth, public domain.Read supporting evidence
After a long flight from Beijing, Flight 38 was established on the instrument landing system at Heathrow with its landing gear and flaps extended. The right engine lost commanded thrust, followed by the left seven seconds later. Both continued running, but neither delivered the thrust requested by the autothrottle or the crew. Airspeed fell. The crew reduced flap to limit drag and lowered the nose when the stall warning activated. The aircraft struck the grass about 330 metres before the paved runway and came to rest in the undershoot area. All 152 occupants evacuated; one passenger was seriously injured.
Read the full incident Follow what happened, from the flight to the investigation findings.
What investigators concluded
The AAIB identified probable causal factors involving ice formed from water naturally present in aviation fuel. Ice accumulated during prolonged low-flow, cold conditions and later restricted fuel flow at the fuel oil heat exchangers. The right-engine restriction was established at that component; the equivalent location on the left was judged most likely, rather than proved conclusively. The exchangers met the certification requirements then in force, but those requirements did not account for this previously unrecognised icing mechanism. The findings led to operational measures and a modified heat exchanger.
1,758 words / about 8 minutes to read. Based on the investigation records cited below.
A long flight with no fuel-temperature warning
British Airways flight 38 was returning from Beijing to London Heathrow on 17 January 2008. The Boeing 777, registered G-YMMM, had a commander and two co-pilots on the flight deck roster. The additional co-pilot allowed the crew to take rest during the long journey. Nothing in the outbound flight's reported defects had pointed to the emergency that would develop on the return. Before departure, the crew reviewed a flight plan that highlighted extreme cold along part of the route and agreed a fuel load of 79,000 kilograms.
Takeoff and the initial climb were uneventful. An air traffic control request put the aircraft at a different initial cruise altitude from the planned profile, and the pilots agreed to monitor fuel temperature. Later climbs took the aircraft higher as it crossed northern Europe. The lowest displayed fuel temperature that the crew noted was minus 34 degrees Celsius. No low fuel-temperature warning appeared. These observations mattered to the investigation because the eventual restriction involved ice formed from water naturally present in the fuel, rather than exhaustion of the aircraft's fuel supply.
The flight continued normally into its descent from flight level 400. Near London, it entered the Lambourne hold and remained there for about five minutes before controllers vectored it towards runway 27L. At 1,000 feet above the airfield, 83 seconds before touchdown, the landing gear was down and flap 30 was selected. The aircraft was established on the instrument landing system, with the autopilot and autothrottle engaged. The long flight had reached a familiar final approach without an obvious warning of the fuel-system problem developing upstream of the engines.
At about 800 feet, the operating co-pilot took control in accordance with the crew's briefing. He intended to disconnect the autopilot at 600 feet and complete a manual landing. Shortly after this handover, the autothrottle commanded more thrust. Both engines initially responded. Then, at about 720 feet and 57 seconds before touchdown, thrust from the right engine reduced. Seven seconds later, the left engine also fell to a similar reduced level.
Neither engine shut down. They continued producing more than flight-idle thrust, but they could no longer deliver the power being demanded. That distinction is central to what happened. The crew had two running engines, yet insufficient thrust to sustain the intended approach. The co-pilot noticed that the thrust levers had begun to separate in position. The flight was still close to the runway, and the immediate indications had to be interpreted while the aircraft continued descending.
The tower cleared the aircraft to land as it passed 500 feet. The crew acknowledged the clearance. At about 430 feet, the commander assessed the approach as stable, but the margin was disappearing. Soon afterwards, the co-pilot saw the airspeed fall below the expected approach speed of 135 knots. The pilots tried to identify the loss of thrust and demanded more power, both through the autothrottle and by moving the thrust levers fully forward. Neither method restored the required engine response. As the autopilot maintained the glide slope, the aircraft's airspeed continued decreasing.
At 115 knots, an airspeed-low warning and a master caution sounded. The airspeed briefly steadied, and the commander reduced the flap setting from 30 to 25 in an attempt to reduce drag. This was an action taken within a rapidly developing emergency, with little height remaining. The report also records that he moved what he believed to be an engine starter or ignition switch. The pilots were trying to recover thrust while keeping the aircraft flying, but the underlying fuel restriction remained.
By 200 feet, airspeed had fallen to about 108 knots. Ten seconds before touchdown, the stick shaker activated, warning that the aircraft was approaching a stall. The co-pilot pushed the control column forward. This lowered the aircraft's nose-high attitude and disconnected the autopilot. The final approach could no longer be maintained to the paved runway. In the remaining seconds, the commander tried to start the auxiliary power unit and transmitted a distress call as the impending crash became apparent.
The co-pilot pulled back on the control column as the ground approached. The aircraft struck the grass approximately 330 metres short of the paved surface of runway 27L, inside the airfield perimeter fence. The report's sequence explains why simply describing the event as a failed landing misses the essential problem: a normally configured approach had become a descent with insufficient power from both engines. The flap change and control inputs were recorded responses to that loss of performance. They did not remove the restriction that had prevented the engines from producing the thrust demanded during the final minute.
The nose landing gear and both main landing gears collapsed during impact and the short ground roll. The right main landing gear separated, while the left remained attached. The aircraft stopped on the paved undershoot surface. Its landing gear had absorbed and transmitted severe loads, and detached items from the right main gear penetrated the fuselage. One passenger suffered a broken leg and was classified as seriously injured. The report records no fatalities. Its injury table combines minor injuries and no injuries, so it does not provide a separate minor-injury total.
The commander attempted to order an evacuation, but his first announcement went out on the tower frequency rather than the cabin public-address system. After the tower pointed this out, he repeated the evacuation instruction over the correct system. The co-pilot began the evacuation checklist, and the flight crew subsequently left through the forward escape slides. Cabin crew supervised the evacuation. All occupants left through slides, and the report states that all slides operated correctly.
Heathrow initiated its accident plan, and fire crews arrived one minute and 43 seconds after the crash message. The evacuation was completed shortly after their arrival. Fuel leaked significantly from the engine fuel pipes, and oxygen leaked from disrupted passenger oxygen bottles. There was no fire. Fuel continued leaking until the spar valves were manually closed. The Boeing 777 was damaged beyond economic repair, but the short ground roll, evacuation and emergency response brought the accident to an end without loss of life.
How ice could restrict fuel without freezing the whole supply
The Air Accidents Investigation Branch established that restricted fuel flow caused the reduction in thrust. On the right engine, the restriction occurred at the fuel oil heat exchanger, commonly shortened to FOHE. For the left engine, the same location was judged most likely. The investigators could not eliminate every alternative location because recorded data were limited. Testing and examination of other data made an alternative restriction elsewhere very unlikely, and a separate mechanism occurring within seven seconds of the right-engine event was also considered very unlikely.
The probable causal sequence involved ice accumulating within the fuel system and then being released towards the heat exchangers. Water naturally present in the fuel had formed ice during prolonged operation at low fuel flows and local temperatures in a range that allowed the ice to adhere. The problem was therefore more specific than fuel becoming universally frozen. Ice that had collected upstream could be transported as a concentrated release and restrict the face of the exchanger.
The FOHE met the certification requirements applicable at the time. The investigation nevertheless showed that it was susceptible to restriction when exposed to a high concentration of soft ice with fuel below minus 10 degrees Celsius and flow above flight idle. The certification requirements had not addressed this phenomenon because the risk had not been recognised. The crew's displayed minimum fuel temperature and the absence of a warning did not rule out the local accumulation and release mechanism later identified through the investigation.
Investigators had to distinguish a restriction caused by ice from a lasting mechanical obstruction. Examination of the heat exchangers found no blockage in the internal fuel tubes. Small pieces of debris were present in the inlet chamber, but none was considered to have impaired normal operation. The oil bypass valves were serviceable. These findings helped direct the investigation towards a mechanism that could affect fuel flow during the approach without leaving a permanent blockage for investigators to find afterwards.
The recorded drop in right-engine oil pressure near the final acceleration was consistent with a restriction at that engine's heat exchanger. Equivalent recorded information for the left engine ended before it could support a positive determination. This is why the final report uses stronger language for the right-engine location and qualified language for the left. The account of the accident needs to preserve that difference, even though the wider testing and closely spaced engine responses supported the same general explanation.
The final report brought together the recorded approach, component examinations, testing and analysis of the fuel system. It described probable causal factors rather than claiming direct observation of every stage of ice formation on the accident flight. The supported conclusion is that restricted fuel flow left both engines unable to meet thrust demands. The more detailed reconstruction explains how an unrecognised susceptibility of the fuel system could produce that result after an otherwise uneventful long flight. It does not turn the left-engine location into a finding more certain than the investigators made.
The investigation led to operational measures and a redesigned heat exchanger. The final report records that Boeing introduced operational changes intended to reduce fuel-icing risk on Boeing 777 aircraft powered by Trent 800 engines. Rolls-Royce developed a modified FOHE, which the European Aviation Safety Agency approved and mandated. These were changes documented by the investigation, rather than simply proposals that this account assumes were implemented.
The redesign altered the face of the exchanger so that the fuel heat-transfer tubes were flush with the end plate and the inlet crimps were removed. Testing described in the report demonstrated that the modified design could withstand soft ice released from the fuel system at temperatures down to at least minus 44 degrees Celsius. The investigation also prompted recommendations on fuel-system certification, research into ice formation and release, and improved recording of information relevant to fuel metering.
Those measures addressed different parts of the problem: interim operating exposure, the component's response to ice and the standards used to establish that a fuel system could tolerate foreseeable conditions. The accident's outcome also drew attention to landing-gear behaviour and the preservation of useful flight data. The report recorded 18 safety recommendations overall. This account describes the action and recommendations at the report date. It does not claim a current fleet-wide compliance status. Flight 38 remains an example of a specific fuel-system vulnerability that became apparent during the short, high-demand phase of a flight when the crew had very little time or height left.
Follow the main stages, then open the evidence beneath each step.
1
Water in fuel forms ice
The AAIB identified naturally present water forming ice during prolonged low-flow, cold conditions. This was not a finding that the aircraft had run out of fuel.
With thrust insufficient, airspeed fell. The crew reduced flap to limit drag and lowered the nose in response to the stall warning before impact short of the runway.
About 50 seconds before touchdownLeft engine follows
Seven seconds after the right-engine reduction, left-engine thrust fell to a similar level. Both engines produced more than idle thrust but less than commanded.
27 seconds before touchdownAirspeed loss recognised
Seven seconds after the stable-approach call at 34 seconds before touchdown, the co-pilot noticed airspeed dropping below the expected 135 knots. Further thrust demands did not restore power.
During the final descentFlaps reduced to limit drag
After the low-airspeed warning, the commander selected flap 25 from flap 30. Airspeed nevertheless continued falling, reaching about 108 knots at 200 feet.
The identified mechanism involved ice from water naturally present in the fuel restricting flow. It was not a finding that the entire fuel load had frozen solid.
The fuel-system components met the applicable requirements, but those requirements did not account for the concentrated soft-ice restriction mechanism because the risk was unrecognised.
The AAIB considered the left heat exchanger the most likely location but could not eliminate restriction elsewhere because of limitations in recorded data.
Actions and recommendations are described at the dates of the cited records. A recommendation is not proof of implementation.
Recorded action: operational measures
Finding 114 records Boeing operational changes to mitigate fuel-icing risk on Trent 800-powered Boeing 777 aircraft in response to recommendation 2008-047.
Finding 115 records a modified heat exchanger developed by Rolls-Royce, approved and mandated by EASA. This describes the action documented in the 2010 report.
Recommendation 2008-049 called for a review of certification requirements so fuel systems tolerate ice build-up and sudden release. This report recommendation should not be read as proof that every related certification change is complete.
The commander reduced flap to decrease drag, and the co-pilot lowered pitch in response to stall warning. These actions are described without treating them as the initiating failure.
Matching dossiers for Certification assumptions: No other dossier in this collection.
Read alongside
These comparisons connect specific research topics. Shared circumstances do not establish identical causes. Evidence from both investigations is provided below.
Both crews faced insufficient thrust from two engines. Flight 38 encountered fuel-system restriction during final approach; US Airways 1549 encountered bird strikes shortly after departure, so the available height and landing choices were very different.
Explore the records below for additional context. They open on the publisher's site and are not all included in our report search. Source reuse terms apply.
Regulator explanation of the fuel-system icing mechanism and lessons from the accident.
Sources and transparency
Checked against the AAIB final report and its chronology. No independent expert review.
Source limitations
The investigation describes probable causal factors and explicitly qualifies the location of the left-engine restriction. The injury table combines minor injuries with no injury, so this page does not infer a separate minor-injury count. Relative approach times follow the report narrative; they are not independently reconstructed clock times.
Aircraft Accident Report 1/2010: Boeing 777-236ER, G-YMMM, London Heathrow Airport, 17 January 2008
Air Accidents Investigation Branch (AAIB) Final report, published 9 February 2010
Official report PDF, hosted by assets.publishing.service.gov.uk
Crown copyright 2010. The report permits publication of extracts when the source is acknowledged. Full report, photographs and illustrations are not republished. Source terms / provenance.
Kevin Murphy writes the incident accounts on AirlineIncidents.com, out of a long interest in aviation safety and the lessons each investigation leaves behind.
Prepared by
AirlineIncidents editorial desk
Report citation check
Independent expert review
Not completed
Citation checks compare supporting text with the indexed report pages. They do not constitute independent expert review. How these pages are prepared.
Revision history
: Checked report citations and source hashes. Added credited photographs, geographic context, sequence diagrams, reader answers, evidence limits, report-era safety follow-up, further records, sourced incident comparisons and this editorial record.
: Added a full chronological account with section-level report references and links from the short summary.
