Virgin Atlantic flight VS207 was operated on 08-02-2005 with an Airbus A340-600 from Hong Kong International Airport to London Heathrow. Some 11 hours after takeoff, at about 0330 hrs with the aircraft in Dutch airspace and at Flight Level 380, the No 1 (number one) engine of Virgin Atlantic flight VS207 lost power and ran down.

Initially the pilots suspected a leak had emptied the contents of the fuel tank feeding No 1 engine but a few minutes later, the No 4 engine started to lose power. At that point all the fuel crossfeed valves were manually opened and No 4 engine recovered to normal operation.

Virgin Atlantic flight VS207 – Airbus A340-642 (G-VATL)

The pilots of Virgin Atlantic flight VS207 then observed that the fuel tank feeding No 4 engine was also indicating empty and they realised that they had a fuel management problem. Fuel had not been transferring from the centre, trim and outer wing tanks to the inner wing tanks so the pilots attempted to transfer fuel manually.

Although transfer was partially achieved, the expected indications of fuel transfer in progress were not displayed so the commander decided to divert to Amsterdam (Schipol) Airport where the aircraft landed safely on three engines.

The investigation determined that the following causal factors led to the starvation of Inner fuel tanks 1 and 4 and the subsequent rundown of engine numbers 1 and 4:

• Automatic transfer of fuel within the aircraft stopped functioning due to a failure of the discrete outputs of the master Fuel Control and Monitoring Computer (FCMC).
• Due to FCMC ARINC data bus failures, the flight warning system did not provide the flight crew with any timely warnings associated with the automated fuel control system malfunctions.
• The alternate low fuel level warning was not presented to the flight crew because the Flight Warning Computer (FWC) disregarded the Fuel Data Concentrator (FDC) data because its logic determined that at least one FCMC was still functioning.
• The health status of the slave FCMC may have been at a lower level than that of the master FCMC, thus preventing the master FCMC from relinquishing control of the fuel system to the slave FCMC when its own discrete and ARINC outputs failed.