Download PDF: download

ATSB TRANSPORT SAFETY REPORT
Aviation Occurrence Investigation AO-2008-053
Preliminary
Depressurisation
475 km north-west of Manila, Philippines
25 July 2008
Boeing Company 747-438, VH-OJK

i
ATSB TRANSPORT SAFETY REPORT
Aviation Occurrence Investigation
AO-2008-053
Preliminary
Depressurisation
475 km north-west of Manila, Philippines
25 July 2008
Boeing Company 747-438, VH-OJK
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
ii
Published by: Australian Transport Safety Bureau
Postal address: PO Box 967, Civic Square ACT 2608
Office location: 15 Mort Street, Canberra City, Australian Capital Territory
Telephone: 1800 621 372; from overseas + 61 2 6274 6440
Accident and incident notification: 1800 011 034 (24 hours)
Facsimile: 02 6247 3117; from overseas + 61 2 6247 3117
E-mail: atsbinfo@atsb.gov.au
Internet: www.atsb.gov.au
© Commonwealth of Australia 2008.
This work is copyright. In the interests of enhancing the value of the information contained in this
publication you may copy, download, display, print, reproduce and distribute this material in
unaltered form (retaining this notice). However, copyright in the material obtained from other
agencies, private individuals or organisations, belongs to those agencies, individuals or
organisations. Where you want to use their material you will need to contact them directly.
Subject to the provisions of the Copyright Act 1968, you must not make any other use of the
material in this publication unless you have the permission of the Australian Transport Safety
Bureau.
Please direct requests for further information or authorisation to:
Commonwealth Copyright Administration, Copyright Law Branch
Attorney-General’s Department, Robert Garran Offices, National Circuit, Barton ACT 2600
www.ag.gov.au/cca
ISBN and formal report title: see ‘Document retrieval information’ on page v.
iii
CONTENTS
THE AUSTRALIAN TRANSPORT SAFETY BUREAU ................................. vi
FACTUAL INFORMATION ................................................................................ 1
History of the flight........................................................................................... 1
Injuries to persons............................................................................................. 2
Damage to the aircraft....................................................................................... 2
Airframe ............................................................................................... 2
Engine number-3 .................................................................................. 4
Oxygen system ..................................................................................... 5
Cabin – R2 door.................................................................................... 7
Cabin – safety systems ....................................................................... 13
Electrical............................................................................................. 13
Flight control ...................................................................................... 14
Other damage.................................................................................................. 14
Cargo ................................................................................................. 14
Personnel information..................................................................................... 15
Aircraft information ........................................................................................ 15
Aircraft general................................................................................... 15
Cabin door .......................................................................................... 15
Flight control system .......................................................................... 16
Oxygen systems.................................................................................. 16
Cylinder information .......................................................................... 17
Flight recorders ............................................................................................... 17
Recording system operation ............................................................... 18
Recorder recovery .............................................................................. 19
Results ................................................................................................ 19
Sequence of events.......................................................................................... 20
The flight ............................................................................................ 20
Cylinder event .................................................................................... 21
ONGOING INVESTIGATION ACTIVITIES .................................................. 22
Survival factors ............................................................................................... 22
Cylinder failure ............................................................................................... 22
Flight recorders ............................................................................................... 23
SAFETY ACTIONS ............................................................................................. 25
Aircraft operator ............................................................................................. 25
iv
ATSB assessment of action ................................................................ 25
ATSB safety action ......................................................................................... 25
Safety advisory notice (AO-2008-053-SAN-006).............................. 25
Safety advisory notice (AO-2008-053-SAN-007).............................. 25
ATTACHMENT A: AIRCRAFT STATIONS................................................... 26
ATTACHMENT B: OXYGEN CYLINDER LOCATIONS ............................ 27
ATTACHMENT C: FLIGHT DATA RECORDER PLOTS ........................... 28
ATTACHMENT D: PROBABLE OXYGEN CYLINDER
TRAJECTORY............................................................................................. 29
Probable oxygen cylinder trajectory (continued)............................................ 30
v
DOCUMENT RETRIEVAL INFORMATION
Report No.
AO-2008-053
Publication date
August 2008
No. of pages
38
ISBN
978-1-921490-65-1
Publication title
Depressurisation, 475 km North-West of Manila, Philippines
Boeing Company 747-438, VH-OJK
Prepared by
Australian Transport Safety Bureau
PO Box 967, Civic Square ACT 2608 Australia
www.atsb.gov.au
Reference No.
INFRA - 08244
Acknowledgements
The diagrams presented within Attachments A and B of this report were provided courtesy of the
Boeing Company.
Abstract
On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft (registered VH-OJK)
with 365 persons on board, departed Hong Kong International airport on a scheduled passenger
transport flight to Melbourne, Australia. Approximately 55 minutes into the flight, while the
aircraft was cruising at 29,000 ft (FL290), a loud bang was heard by passengers and crew,
followed by the rapid depressurisation of the cabin. Oxygen masks dropped from the overhead
compartments shortly afterward, and it was reported that most passengers and crew commenced
using the masks. After donning their own oxygen masks, the flight crew carried out the ‘cabin
altitude non-normal’ checklist items and commenced a descent to a lower altitude, where
supplemental breathing oxygen would no longer be required. A MAYDAY distress radio call was
made on the regional air traffic control frequency. After levelling the aircraft at 10,000 ft, the
flight crew diverted to Ninoy Aquino International Airport, Manila, where an uneventful visual
approach and landing was made. The aircraft was stopped on the runway for an external
inspection, before being towed to the terminal for passenger disembarkation.
Subsequent inspection of the aircraft by the operator’s personnel and ATSB investigators,
revealed an inverted T-shaped rupture in the lower right side of the fuselage, immediately beneath
the wing leading edge-to-fuselage transition fairing (which had been lost during the event). Items
of wrapped cargo were observed partially protruding from the rupture, which extended for
approximately 2 metres along the length of the aircraft and 1.5 metres vertically.
After clearing the baggage and cargo from the forward aircraft hold, it was evident that one
passenger oxygen cylinder (number-4 from a bank of seven cylinders along the right side of the
cargo hold) had sustained a sudden failure and forceful discharge of its pressurised contents into
the aircraft hold, rupturing the fuselage in the vicinity of the wing-fuselage leading edge fairing.
The cylinder had been propelled upward by the force of the discharge, puncturing the cabin floor
and entering the cabin adjacent to the second main cabin door. The cylinder had subsequently
impacted the door frame, door handle and overhead panelling, before falling to the cabin floor and
exiting the aircraft through the ruptured fuselage.
The investigation is continuing.
vi
THE AUSTRALIAN TRANSPORT SAFETY BUREAU
The Australian Transport Safety Bureau (ATSB) is an operationally independent
multi-modal bureau within the Australian Government Department of
Infrastructure, Transport, Regional Development and Local Government. ATSB
investigations are independent of regulatory, operator or other external
organisations.
The ATSB is responsible for investigating accidents and other transport safety
matters involving civil aviation, marine and rail operations in Australia that fall
within Commonwealth jurisdiction, as well as participating in overseas
investigations involving Australian registered aircraft and ships. A primary concern
is the safety of commercial transport, with particular regard to fare-paying
passenger operations.
The ATSB performs its functions in accordance with the provisions of the
Transport Safety Investigation Act 2003 and Regulations and, where applicable,
relevant international agreements.
Purpose of safety investigations
The object of a safety investigation is to enhance safety. To reduce safety-related
risk, ATSB investigations determine and communicate the safety factors related to
the transport safety matter being investigated.
It is not the object of an investigation to determine blame or liability. However, an
investigation report must include factual material of sufficient weight to support the
analysis and findings. At all times the ATSB endeavours to balance the use of
material that could imply adverse comment with the need to properly explain what
happened, and why, in a fair and unbiased manner.
Developing safety action
Central to the ATSB’s investigation of transport safety matters is the early
identification of safety issues in the transport environment. The ATSB prefers to
encourage the relevant organisation(s) to proactively initiate safety action rather
than release formal recommendations. However, depending on the level of risk
associated with a safety issue and the extent of corrective action undertaken by the
relevant organisation, a recommendation may be issued either during or at the end
of an investigation.
The ATSB has decided that when safety recommendations are issued, they will
focus on clearly describing the safety issue of concern, rather than providing
instructions or opinions on the method of corrective action. As with equivalent
overseas organisations, the ATSB has no power to implement its recommendations.
It is a matter for the body to which an ATSB recommendation is directed (for
example the relevant regulator in consultation with industry) to assess the costs and
benefits of any particular means of addressing a safety issue.
About ATSB investigation reports: How investigation reports are organised and
definitions of terms used in ATSB reports, such as safety factor, contributing safety
factor and safety issue, are provided on the ATSB web site www.atsb.gov.au.
1
FACTUAL INFORMATION
The information contained in this preliminary report is derived from the initial
investigation of the occurrence. Readers are cautioned that there is the possibility
that new evidence may become available that alters the circumstances as depicted
in the report.
History of the flight
At 0922 local time (0122 UTC1) on 25 July 2008, a Boeing 747-438 aircraft,
registered VH-OJK, departed Hong Kong International Airport on a scheduled
passenger transport service to Melbourne, Australia. On board the aircraft
(operating as flight number QF30) were 346 passengers (including four infants), 16
cabin crew and three flight crew (captain, first officer and second officer).
The flight crew reported that the departure and climb-out from Hong Kong was
normal, with the aircraft established at the assigned cruising altitude of 29,000 ft
(FL290) by 0942 (0142 UTC).
At 1017 (0217 UTC), the captain and first officer reported hearing a ‘loud bang or
cracking sound’ with an associated airframe jolt. At that time, the autopilot
disconnected, and the first officer, who was the pilot flying at the time, assumed
manual control of the aircraft. Multiple EICAS2 messages were displayed, including
warnings regarding the R2 door status and cabin altitude.3 The second officer, who
was in the forward crew rest position, returned to the first observer’s crew seat and
all flight crew donned oxygen masks before completing the ‘cabin altitude nonnormal’
checklist. At that time, the aircraft was approximately 475 km to the northwest
of Manila, Philippines.
The cabin crew reported that shortly after the bang was heard, oxygen masks fell
from most of the personal service units in the ceiling above passenger seats and in
the toilets. Most passengers started using the oxygen masks soon after they
dropped. All cabin crew, who were engaged in passenger service activities at the
time, immediately located oxygen masks to use. Some crew located a spare
passenger mask and sat in between passengers, while others went to a crew jumpseat
at an exit, and one used a mask in a toilet.
Approximately 20 seconds after the event, the captain reduced the thrust on all four
engines and extended the speed brakes. The first officer commenced the descent
while the captain declared a MAYDAY4 on the Manila flight information region
(FIR) radio frequency.
At 1024 (0224 UTC), the aircraft reached, and was levelled at an altitude of 10,000
ft, where the use of supplementary oxygen by passengers and crew was no longer
required.
1 Universal Time, Coordinated (previously Greenwich Mean Time, GMT).
2 Engine Indication and Crew Alerting System.
3 The altitude corresponding to the air pressure inside the aircraft cabin.
4 International call for urgent assistance.
2
After reviewing the aircraft’s position, the flight crew elected to divert and land at
the Ninoy Aquino International Airport, Manila, and landing preparations
subsequently commenced, including the jettisoning of excess fuel to ensure the
aircraft landing weight was within safe limits. The flight crew reported that many
system failure messages were displayed, including all three instrument landing
systems (ILS), the left VHF omnidirectional radio-range (VOR) navigation
instrument, the left flight management computer (FMC) and the aircraft anti-skid
braking system.
The crew reported that at all times during the ensuing descent into Manila, they
were able to maintain the aircraft in visual flight conditions. With radar vectoring
assistance from Manila air traffic control, the captain, who had assumed the pilot
flying role, conducted an uneventful approach and landing on runway 06, with a
smooth touchdown, full reverse thrust and minimal braking. Emergency services
were in attendance after the aircraft was stopped on the runway, after which
intercom contact was made with a ground engineer and the aircraft verified as being
safe to tow to the airport terminal and disembark the passengers via a terminal
airbridge.
Injuries to persons
None of the passengers or crew aboard the aircraft reported any physical injuries to
the cabin crew immediately following the depressurisation event, or to the
operator’s staff upon arrival in Manila.
Damage to the aircraft
Airframe
An initial inspection of the external aircraft surfaces on the ground in Manila
revealed the complete loss of the right wing forward leading edge-to-fuselage
fairing, with separation occurring along the lines of interconnection between the
fairing and fuselage skins (Figure 1). In the area exposed by the fairing loss was an
inverted T-shaped rupture in the fuselage skin, with several items from within the
forward cargo hold partially protruding from the rupture (Figure 2). The
approximate vertical centreline of the skin rupture was positioned at fuselage
station5 (STA) 820, with skin damage extending longitudinally for 79 inches (201
cm), from STA 777 to STA 856. Vertically, the rupture extended for approximately
60 inches (152 cm) between fuselage stringer6 31 at the top, to stringer 38 at the
lower extent of the damage. While some of the fuselage skin had folded outward
and away from the rupture, it was evident that an area of skin and structure equal to
approximately one-half of the total ruptured area had separated from the aircraft and
was not recovered. On the basis of measurements taken around the ruptured areas,
the total area of the skin rupture was estimated at around 1.74 square metres (2,700
5 Fuselage stations are measured in inches from the front of the aircraft, with the forward surface of
the aircraft’s nose (radome) located at fuselage station (STA) 90 (Attachment A).
6 Stringers are longitudinally oriented reinforcing sections used to increase the strength and rigidity
of the fuselage pressure shell.
3
square inches). Figure 3 illustrates the extent of the fuselage rupture as viewed from
outside the aircraft.
Rearward of the fuselage rupture, several localised areas of scuffing, puncture and
scoring were evident along the underside of the aircraft, extending along a diagonal
path from the ruptured area rearward toward the left body landing gear (Figure 4).
Elongated score marks were also noted extending for several metres around the left
side of the rear fuselage – typically around STA 1880 to STA 2000.
Figure 1: Fuselage rupture – external view
Figure 2: Fuselage rupture with protruding cargo
4
Figure 3: Extent of the fuselage rupture, after removal of further transition
fairings
Figure 4. Panel damage to the rear of the rupture site
Engine number-3
Several small pieces of structural honeycomb material of the type comprising the
wing leading edge fairing were found trapped around the edges of panels within the
left side of the number-3 engine pylon (side facing the rupture). A small indentation
and cut was found within the number-3 engine intake acoustic panelling, located
immediately inside the plane of rotation of the engine fan (Figure 5). There was no
5
evidence of damage to the fan blades themselves, nor was there any evidence of the
ingestion of debris into the engine core.
Figure 5: Damage to acoustic lining (arrowed) behind the number-3 engine
fan
Oxygen system
Following removal of all cargo materials and lowering of the hold right-side curtain
panels, it was found that the fuselage rupture was aligned with the nominal position
of the number-47 passenger emergency oxygen cylinder; one of seven such
cylinders in a bank along the right side of the hold (Figure 6). A further six
cylinders were located in a central location within the ceiling of the cargo hold. The
number-4 cylinder was missing from the bank, with the upper support bracket bent
downward and both the retaining strap and lower cradle not present (Figure 7). The
adjacent number-5 cylinder lower support cradle had been pulled downward and
away from the cylinder as a result of the fuselage rupture. However, the upper
cylinder mount and strapping remained secure and the cylinder gas connections
intact. Each of the passenger oxygen cylinders had three connected stainless steel
lines – an overpressure relief vent line, a delivery line and a filling line. The filling
and delivery lines were fed through a tee-piece from a common cylinder
connection, with a pressure regulator and transducer integral to the assembly
(Figure 8). All three lines to the missing number-4 cylinder had fractured, with
remnants of the delivery regulator and filling connection fittings remaining attached
to their respective lines. Close examination of all exposed connections, fittings and
lines showed no evidence of heating, sooting or discolouration that might have
suggested localised combustion had occurred within or in proximity to the cylinder
and its connections. Similarly, all structural, panel and cargo surfaces that
surrounded the fuselage rupture showed no evidence of heating or damage
associated with combustion effects. The pressure gauges on all 12 remaining
7 Cylinders were numbered (for the purposes of this investigation) from the front of the cargo hold.
6
passenger oxygen cylinders showed all to have been exhausted i.e. zero internal
pressure remaining.
Figure 6: Forward cargo hold wall with remaining six oxygen cylinders
Figure 7: Fuselage rupture coincident with mounting position of the
number-4 oxygen cylinder
7
Figure 8: Number-5 oxygen cylinder adjacent to fractured fittings and lines
from the number-4 cylinder
Cabin – R2 door
The R28 door into the aircraft’s main cabin was located directly above the fuselage
rupture (at STA 830). An external panel located between the two door hinges
showed localised outward bulging from a point immediately below the upper hinge,
with the forward edge of the panel raised above the surrounding fuselage skin
(Figure 9). The main external door handle was in the fully closed position, however
the upper and lower door gates9 were partially retracted.
Within the aircraft, the cabin around the R2 door had sustained substantial damage
and disruption (Figure 10). The cabin floor to the left and immediately inside the
R2 door frame had sustained an impact that created a single circular perforation
approximately 20 cm (8 inches) in diameter, located immediately above the
number-4 oxygen cylinder position (Figure 11). Fragments of the cabin flooring and
covering extended down into the hole. Above the hole, the forward partitioning
panel between the door and the row 26J,K seats showed an elongated green
coloured abrasion, leading upward to an area of impact damage at the mid-height
position of the forward R2 door frame (Figure 12). The door escape slide shroud
(bustle) also showed vertically-oriented scoring and green smear marks along the
corner and forward facing surface. The portable walk-around oxygen cylinder
normally located in an alcove just inside the R2 door was not present, and was not
accounted for in a subsequent search of the aircraft.
8 The R2 door was the second main cabin door on the right side of the aircraft.
9 The cabin door gates are flap-like panels at the top and bottom of the door that are retracted by the
door opening mechanism, to allow the door to move outward through the door frame opening.
8
Figure 9: Cabin R2 door – damage to external panelling
Figure 10: Interior of R2 door and cabin – location of floor hole arrowed
9
Figure 11: Hole in cabin floor – viewed from position of number-4 oxygen
cylinder
Figure 12: Door frame damage, green paint smear and rotated R2 door
handle
10
The internal door handle was found in approximately the one-o’clock position
(looking from inside), with the turned-in handle end embedded into the door lining
material. That position was consistent with a movement through approximately 120
degrees from the fully-closed (locked) position. A 180 degree handle movement
represented the fully open position. The downward facing surfaces of the handle
end (when the door is in the locked position) showed damage and abrasion
consistent with impact against another object. Inspection of the internal door
systems showed the handle shaft had fractured and the actuating cam plate and
retainer had pulled away from its associated mechanism (Figure 13), allowing the
handle to rotate freely. As such, the handle position as observed inside the cabin
was not indicative of the actual door security.
Above the R2 door within the cabin, the overhead panelling, fixtures and utility
storage compartments had sustained extensive impact damage. The panels above
the door frame had been pushed inward, exposing the overhead structure and
pressure reservoir for the door emergency power assist opening system (EPAS,
Figure 14). Amongst the impact damage, it was observed that an unusually uniform
semi-circular section had been forcibly cut from the panelling and access door
(Figure 15), with the cut-out section later recovered from above the damaged
storage compartment casing. The diameter of the cut-out region closely matched
that of the passenger oxygen cylinders (Figure 16). Adjacent to the cut-out opening
was a semi-circular area of crushing damage to a partitioning panel (Figure 17); the
damage being of a similar diameter to the cut-out section. A light fitting, normally
present in the overhead panels had sustained upward crushing damage and
presented clear green paint smears of a similar colouration to the marks on the
partition panel and door bustle.
Various items of debris were found around the aircraft cabin in the vicinity of the
R2 door. Of note, this included fragments of the number-4 oxygen cylinder valve
handle, the valve pressure relief assembly and the valve body itself. A fragment of
the valve body was also recovered from within the damaged area on the door frame.
A thorough search of the cabin and overhead ceiling void space failed to locate any
part of the number-4 oxygen cylinder itself.
Figure 13: R2 door panel underside – fractured shaft and separated plate
11
Figure 14: Damage above R2 door, exposing the EPAS cylinder (arrowed)
Figure 15: Cut-out section found in panels above the R2 door
12
Figure 16: Panel with cut-out placed against another oxygen cylinder to
illustrate the conformance in diameter
Figure 17: Semi-circular damage in partition of compartment above R2 door
13
Cabin – safety systems
Investigators conducted a comprehensive walk-through examination of the
aircraft’s cabin and a survey of the safety systems; in particular, the status of the
passenger oxygen masks and equipment (Figure 18).
The following preliminary observations were made during that examination:
• there were 353 passenger seats in the aircraft
• 476 passenger oxygen masks had deployed from their overhead compartments
• 426 passenger oxygen masks were pulled down (i.e. activated for use)
• row 53 centre overhead passenger service unit was hanging down
• forward crew rest and customer support manager station masks had not
deployed
• the covering on the rear surface of the partition in front of seats 40A,B,C was
damaged
• floor pressure relief panels were open at seats 24A (2), 25A, 37K and 54A
• one mask hose was detached from the ceiling fitting at seat 4K (3 masks
deployed).
Figure 18: Typical appearance of cabin. Note passenger masks dropped and
activated, and those dropped and not activated (arrowed)
Electrical
Numerous electrical cables and cable bundles, routed through the lower aircraft
fuselage near the point of rupture, had sustained damage or been severed by the
rupture event. Approximately 86 discrete conductors from six separate bundles had
been affected.
14
Flight control
Both right side (first officer’s) aileron control cables, routed along the right side of
the fuselage above the passenger oxygen cylinders, had been fractured during the
rupture event. All separated cable ends showed the irregular splaying and
unwinding of the cable wires; characteristic of a tensile overstress failure.
Other damage
Cargo
The forward hold of the aircraft contained both containerised and palletised cargo.
All passenger baggage was located within conventional metal containers positioned
forward of the point of rupture. None of the containers within the hold showed
evidence of damage or other markings that could be associated with the rupture
event. The cargo adjacent to the fuselage rupture was a plastic wrapped and netted
pallet of general freight in cardboard boxes and similar. The cargo packed along the
side closest to the rupture had been pulled towards the opening, with several items
becoming lodged within, and protruding from, the void (Figure 19). Items packed
near to the fuselage rupture showed varying degrees of forced impact type damage
and a section of aluminium structure from the hold framework was recovered from
amongst the packaging. There was no evidence of an explosive event having
originated from within the cargo itself, and a review of the cargo manifests showed
no items that could be considered capable of causing or contributing to such an
event. Reconciliation of the recovered cargo by the freight service provider
accounted for all items on the manifest.
Figure 19: Cargo pallet adjacent to fuselage rupture (view looking to the
rear)
15
Personnel information
Table 1 summarises the operational qualifications and experience of the flight crew
at the time of the occurrence.
Table 1: Flight crew qualifications and experience
Captain First Officer Second Officer
Licence Category ATPL ATPL ATPL
Instrument rating Command Command Co-pilot
Last Class-1 medical 27 Sep 2007 20 May 2008 27 Jun 2008
Total flying hours 15,999 12,995 4,067
Total on 747-400 2,786 5,736 2,292
Total last 30 days 67h 48m 96h 57m 67h 48m
Total last 90 days 221h 54m 251h 27m 137h 33m
Aircraft information
Aircraft general
Aircraft type Boeing Company 747-438
Serial number 25067
Year of manufacture 1991
Registration VH-OJK
Certificate of Airworthiness SY 45 valid from 17 June 1991
Certificate of Registration last issued on 24 October 2005
Total airframe hours 79,308
Total airframe cycles 10,419
Last ‘A’ maintenance check 13 June 2008, at 78,967 h, 10,357 cyc
Last ‘D’ maintenance check 9 April 2004, at 58,367 h, 8,173 cyc
Cabin door
All main cabin doors of the 747-400 aircraft type were designed as outwardopening
‘plug doors’. A plug door is designed to be physically larger than the
doorway opening, and mates with the frame around the full circumference when in
position. It is designed to increase the security of the pressurised fuselage, with
pressurisation loads serving to force the door more tightly against the frame.
Retractable gates at the top and bottom of the door serve to allow it to move inward
and then sideways through the door frame during the opening and closing process
when the aircraft is not pressurised. The plug door design provides for a level of
protection against inadvertent or intentional attempts to open the door while the
aircraft is in flight. A latch mechanism holds the door in the closed position when
the aircraft is not pressurised.
16
Flight control system
The Boeing 747-400 flight control system was a hydraulically-assisted mechanical
arrangement, with inputs from the primary cockpit controls being translated to the
control surface actuating systems via cables. The systems were designed to provide
complete duplication and redundancy between the captain and first officer’s
controls, such that the failure of any particular system would not lead to a loss of
functionality affecting aircraft controllability. Basic certification specifications for
all modern transport category aircraft require this behaviour by design. In respect of
the first officer’s aileron control cables that were severed in the occurrence; those
were duplicated by the captain’s system, the cables from which were routed along
the opposite (left) side of the forward cargo hold. Interlinks between the aileron
systems provided the necessary redundancy in this instance, ensuring the continued
safety of flight after the event.
Oxygen systems
The 747-438 aircraft was equipped with three separate supplemental breathing
oxygen systems. Use of oxygen by passengers and crew is necessary if cabin
pressurisation is lost during high-altitude flight. A diluter-demand10 system
provided oxygen to each flight crew station and an independent, continuous flow11
system served the passenger cabins, crew rest areas, toilets and cabin crew stations.
Portable oxygen equipment was also stored throughout the passenger cabins for
medical and walk-around use. All three systems were of the pressurised gaseous
storage type, with no chemical oxygen generators employed on the aircraft.
The passenger oxygen system consisted of thirteen high-pressure (1,850 psi /
12,755 kPa) steel cylinders, each with an integral shut-off valve, pressure gauge and
over-pressure protection system (frangible disk). A coupling connected each
cylinder to an electrical pressure transducer and pressure reducer. The outlet of each
cylinder fed a common supply line, which was routed through three continuous
flow control units connected in parallel. The flow control units served to control the
flow of oxygen to the passenger mask distribution manifold, and to regulate that
flow according to the cabin altitude. Seven of the cylinders were located along the
right side of the forward cargo hold; the remainder positioned within the void space
between the cargo hold ceiling and the main cabin floor (Attachment B).
Due to periodic removal and replacement for maintenance or replenishment
purposes, the installed cylinders were of varying ages and serial numbers. Table 2
presents general details of the complement of passenger oxygen cylinders fitted to
VH-OJK at the time of the occurrence.
10 A diluter-demand oxygen system provides diluted or 100% oxygen flow as required by the
breathing action of the user.
11 A continuous flow oxygen system delivers a constant stream of oxygen to the user, once the
system and mask have been activated.
17
Table 2: Details of the passenger oxygen cylinders fitted to VH-OJK at the
time of the occurrence
Location Serial No. Manufactured date Fitted to aircraft date
Right side #1 240341 Feb 92 16 Jun 07
Right side #2 ST30395 Oct 01 14 Jun 08
Right side #3 ST20539 Apr 01 19 Jan 07
Right side #4 535657 Feb 96 14 Jun 08
Right side #5 666845 Mar 99 01 Mar 06
Right side #6 240293 Dec 91 07 Jan 08
Right side #7 239949 Nov 91 07 Jan 08
R Fwd O/H 883198 May 89 07 Jan 08
L Fwd O/H 686764 May 98 01 Sep 06
R Mid O/H 805949 Sep 04 17 Nov 07
L Mid O/H 686716 Jun 99 28 Sep 05
R Aft O/H 679454 Apr 99 07 Jan 08
L Aft O/H 71505 Jan 91 22 Jul 07
Cylinder information
All passenger oxygen cylinders installed in VH-OJK were of a single piece, heattreated
alloy steel construction. The missing (presumed failed) oxygen cylinder,
part number 801307-0012, serial number 535657, was one of a batch of 94 cylinders
manufactured in February 1996 to the DOT13 3HT1850 specification. The cylinders
measured 22.8 cm outside diameter by 75.1 cm long (8.98 inches x 29.56 inches)
and had a minimum 2.87 mm (0.113 inch) wall thickness.
Flight recorders
The aircraft was fitted with three flight recorders:
• cockpit voice recorder (CVR)
• flight data recorder (FDR)
• quick-access recorder (QAR).
The CVR and FDR are required by regulation to be installed on certain types of
aircraft. Information recorded by the CVR and FDR is stored in ‘crash-protected’
modules.
The QAR is an optional recorder that the operator has chosen to fit to all their
B747-400 aircraft. Information recorded by the QAR is not crash-protected. As the
name suggests, QARs allow quick access to flight data whereas FDR’s require
specialist downloading equipment. The parameters that are recorded by an FDR are
12 Equivalent Boeing part number 60B50087-7.
13 United States Department of Transportation.
18
defined by regulatory requirements. However QAR systems can be configured by
an airline to record different and, in most cases, more parameters than the FDR
system. Airlines routinely use QAR data for engineering system monitoring and
fault-finding, incident investigation and flight operations quality assurance
programs.
Recording system operation
CVR system
The CVR records the total audio environment in the cockpit area. This includes
crew conversation, radio transmissions, aural alarms, control movements, switch
activations, engine noise and airflow noise. The CVR installed in VH-OJK retained
the last 2 hours of information in solid-state memory, operating on an endless-loop
principle.
CVR systems are designed to operate even when the aircraft is on the ground with
the engines shutdown. This allows investigators access to important crew
conversation or checklist actions before the first engine is started for takeoff or after
the last engine is shutdown after landing. The disadvantage is that valuable audio
information is quickly overwritten following a non-catastrophic accident or serious
incident, where there is a significant interval between the occurrence and when the
flight is completed and electrical power is removed from the CVR.
FDR system
The FDR records aircraft flight data and, like the CVR, operates on an endless-loop
principle. The recording duration of the FDR fitted to VH-OJK was 25 hours; the
FDR typically records when at least one engine is operating and stops recording
when the last engine is shutdown. The FDR installed in VH-OJK recorded
approximately 300 parameters and used a magnetic tape as the recording medium.
QAR system
Like the FDR, the QAR records aircraft flight data. The QAR installed in VH-OJK
stored data on a removable magneto-optical disk with a capacity of 230 Mb and
approximately 500 recorded parameters. Airlines balance the logistics of handling
large quantities of QAR disks with the benefits of obtaining the data as soon as
possible after a flight has occurred. Typically, most airlines will leave a disk
inserted in the QAR for several days until the aircraft returns to a suitable
maintenance base.
The QAR system installed on VH-OJK was configured to enter a ‘sleep’ mode once
a period of stable cruise had been detected. Once a climb or a descent was detected,
the QAR would resume recording until a further period of cruise was detected. As
B747-400 aircraft are typically used on long-range flights, using this sleep mode
technique reduced the amount of data that was recorded per flight and increased the
number of flights that could be recorded on a single disk. Worldwide experience
over many decades has shown that the take-off and landing phases of flight have the
highest risk and these periods are continuously recorded using this ‘sleep’ mode
technique.
19
Recorder recovery
The CVR, FDR and QAR disk were removed from the aircraft in Manila under the
control of the Australian Transport Safety Bureau (ATSB) and sent to the operator’s
safety department in Sydney. They were received on Sunday 27 July 2008.
Permission was given by the ATSB for the operator to replay the QAR disk and a
copy of the QAR data was provided to the ATSB.
The CVR and FDR were quarantined and sent to the ATSB technical analysis
laboratories in Canberra. They were received on 28 July 2008. The CVR was
downloaded on 28 July 2008 and the FDR was downloaded on 29 July 2008.
Results
CVR
The entire 2 hours of recorded audio was successfully downloaded by ATSB
investigators in Canberra. Analysis of the audio showed that the oldest information
retained by the CVR related to aircraft operation while cruising at 10,000 ft, after
the emergency descent had already taken place. A comparison with the FDR
information showed that the start of the CVR audio occurred 30 minutes and 41
seconds after the depressurisation event had occurred.
Of the 2 hours of CVR audio, 24 minutes covered flight time including the
approach and landing at Manila. The remaining audio covered ground operations
including the aircraft being towed from the runway to the gate and time with the
aircraft stationary at the gate.
FDR
The tape was removed from the FDR by ATSB investigators in Canberra and
downloaded. The FDR had recorded data from the following flights:
23 July 2008: Singapore – London
24 July 2008: London – Hong Kong
25 July 2008: Hong Kong – Manila
Continuous data from engine start on the ground in Hong Kong until engine
shutdown on the runway in Manila, was successfully recovered. The FDR data was
used to produce a sequence of events and plots (Attachment C).
20
QAR
The QAR disk was replayed by the operator. As an empty disk had been installed in
the QAR at Sydney on 23 July 2008, flight data from five flights was successfully
recovered. The flights recorded were:
23 July 2008: Sydney – Melbourne
Melbourne – Singapore
Singapore – London
24 July 2008: London – Hong Kong
25 July 2008: Hong Kong – Manila
Analysis of the QAR data, in conjunction with FDR data, showed that the QAR
recorded continuously from engine start on the ground in Hong Kong until 0212:28
UTC when, as expected, the QAR entered ‘sleep’ mode while the aircraft was in
cruise at FL290. The depressurisation event occurred 4 minutes and 48 seconds
later. Four seconds after the event, the QAR resumed recording data.
Sequence of events
The flight
The following sequence of events table was prepared from data obtained from the
aircraft’s flight recorders.
Table 3. Occurrence flight sequence of events
Time (UTC)
(hh:mm:ss)
Time relative
to event
(hh:mm:ss)
Event:
01:22:12 -00:55:04 Takeoff at Hong Kong
01:42:30 -00:34:46 Aircraft reached top of climb FL290
02:12:28 -00:04:48 QAR entered 'sleep' mode and stopped recording
02:17:16 0:00:00 Depressurisation event
02:17:17 0:00:01 Autopilot (Right) disengaged
02:17:19 0:00:03 Cabin pressure warning commenced
02:17:20 0:00:04 QAR resumed recording data
02:17:38 0:00:22 Speed brake extended, engine thrust reduced
02:17:43 0:00:27 L & R isolation valves change to closed
02:17:54 0:00:38 Aircraft left FL293 on descent
02:17:57 0:00:41 A minimum cabin pressure of 5.25 psi was recorded14
02:18:43 0:01:27 Autopilot (Centre) engaged
14 This corresponds to a cabin altitude of 25,900 ft.
21
Time (UTC)
(hh:mm:ss)
Time relative
to event
(hh:mm:ss)
Event:
02:19:09 0:01:53 Autothrottle disconnected
02:22:50 0:05:34 Cabin pressure warning ceased
02:23:09 0:05:53 Aircraft descended through 11,000 ft
02:23:48 0:06:32 Aircraft altitude reached 10,000 ft
02:29:40 0:12:24 Captain's NAV SEL changed to right FMC
02:47:57 0:30:41 Start of CVR audio
02:56:11 0:38:55 Aircraft left 10,000 ft on descent
03:09:58 0:52:42 Autopilot (Centre) disengaged
03:11:56 0:54:40 Aircraft touched down at Manila
03:17:38 1:00:22 No. 3 engine shutdown on runway
03:19:10 1:01:54 Remaining engines shutdown on runway
03:26:53 1:09:37 Park brake released for tow
04:01:12 1:43:56 Chocks on
04:51:06 2:33:50 CVR shutdown
Cylinder event
On the basis of the physical damage found with the aircraft forward cargo hold and
cabin, it was evident that the number-4 passenger oxygen cylinder had sustained a
failure that allowed a sudden and complete release of the pressurised contents. The
rupture and damage to the aircraft fuselage was consistent with being produced by
the energy associated with that release of pressure. Furthermore, it was evident that
as a result of the cylinder failure, the vessel had been propelled upward, through the
cabin floor and into the cabin space. Damage and impact witness marks found on
the structure and fittings around the R2 cabin door showed the trajectory of the
cylinder after the failure event.
Figures D1 – D7 (Attachment D) illustrate the likely trajectory of the cylinder. The
graphics represent a cross-sectional view through the aircraft at the position of the
R2 main cabin door (STA 830).
22
ONGOING INVESTIGATION ACTIVITIES
Survival factors
A cabin safety / survival factors investigation will examine the serviceability and
functionality of the cabin oxygen apparatus and other cabin safety equipment, cabin
crew actions, and passenger actions and problems. The investigation has
interviewed all 16 of the cabin crew about their experiences, and a review of cabin
crew procedures will be conducted.
The investigation is also conducting a survey of all passengers on the flight. The
results of this survey will help the investigation determine what occurred and enable
the investigation to document passenger and crew actions, equipment issues, and
whether there were any resulting injuries. The effects of the damage sustained by
the oxygen system on its capacity to function adequately and for a sufficient period
will also be investigated. The survey will also help determine if any improvements
in equipment design or crew procedures are needed to enhance safety.
The survey has been emailed or posted to passengers where the ATSB could locate
contact details. Passengers who have not received a survey but who would like to
receive one are requested to provide an email or postal address to the ATSB (email
aviation.investigation@atsb.gov.au or phone +61 2 6257 4150 (from overseas) or
1800 020 616 (within Australia).
Cylinder failure
The ongoing engineering investigation into the apparent oxygen cylinder failure
will focus on (but not be limited to) the following:
• cylinder design, manufacturing methods and type testing procedures
• manufacturing quality control processes and results
• modes and mechanisms of cylinder failure
• historical oxygen and pressurised cylinder failure experiences, civil and military,
aviation and industrial
• cylinder degradation mechanisms
• the adequacy and efficacy of inspection, maintenance and repair processes,
procedures and equipment prescribed by the manufacturer and implemented by
maintenance organisations
• cylinder filling processes and procedures.
As the failed cylinder was not recovered, the ATSB is currently working with the
aircraft manufacturer, other aircraft operators and the oxygen cylinder
manufacturer, to obtain samples of cylinders from the same manufacturing batch as
the failed item, to facilitate the ongoing investigation of all relevant issues.
23
Flight recorders
Examination of CVR, FDR and QAR information is ongoing and will include the
following:
• Analysis of CVR audio regarding crew actions, aircraft handling and crew/cabin
communications during the approach and landing at Manila.
• Analysis of QAR data to assist in identifying secondary damage from the
oxygen bottle failure and the effects of that damage to aircraft systems and
aircraft handling.
• Analysis of FDR data to produce a detailed sequence of events and assist in
identifying secondary damage from the oxygen bottle failure and the effects of
that damage to aircraft systems and aircraft handling.
• A review of the operator’s procedures for preserving a CVR recording following
a serious incident or non-catastrophic accident.

25
SAFETY ACTION
Aircraft operator
On 27 July (2 days following the VH-OJK event), the aircraft operator, in
agreement with the Civil Aviation Safety Authority (CASA), commenced a fleetwide
program of detailed visual inspections of its Boeing 747 oxygen system
installations. The ATSB was advised that those inspections were completed by 1
August.
The operator has also completed a preliminary internal review of the event,
addressing the crew and passenger response, the emergency passenger oxygen
system operation, supplementary passenger oxygen requirements, and the
functionality of the depressurisation emergency announcement system operation.
ATSB assessment of action
The ATSB has requested a copy of the findings of the inspection program and
review from the aircraft operator and will consider any issues that may have been
identified, in its ongoing investigation of the event.
ATSB safety action
It is acknowledged that any corrective or precautionary action undertaken in
response to a safety occurrence should be justifiable in terms of established or
probable facts. However, in view of the nature of the depressurisation event and the
implication of a possible mechanism or condition that could affect the structural
integrity and safety of other oxygen cylinders used in the aviation environment, the
ATSB draws attention to the following advisory notices, on the basis of prudence,
until such time that the mechanism/s contributing to the cylinder failure on board
VH-OJK are established and understood.
Safety advisory notice (AO-2008-053-SAN-006)
The Australian Transport Safety Bureau encourages all organisations performing
inspection, testing, maintenance and repair activities on aviation oxygen cylinders,
to note the circumstances detailed in this preliminary report, with a view to ensuring
that all relevant procedures, equipment, techniques and personnel qualifications
satisfy the applicable regulatory requirements and established engineering bestpractices.
Safety advisory notice (AO-2008-053-SAN-007)
The Australian Transport Safety Bureau encourages other operators of transport
category aircraft fitted with pressurised gaseous oxygen systems, to note the
circumstances detailed in this preliminary report, with a view to ensuring that all
oxygen cylinders, and cylinder installations, are maintained in full accordance with
the relevant manufacturer’s requirements, statutory regulations, and established
engineering best practices.
26
ATTACHMENT A: AIRCRAFT STATIONS
Figure A1: Boeing 747-400 forward fuselage station diagram
27
ATTACHMENT B: OXYGEN CYLINDER LOCATIONS
Figure B1: Typical cylinder locations in the Boeing 747-400 aircraft
28
ATTACHMENT C: FLIGHT DATA RECORDER PLOTS
Figure C1: Data plot for complete flight duration
Figure C2: Data plot for the depressurisation event
29
ATTACHMENT D: PROBABLE OXYGEN CYLINDER
TRAJECTORY
Figures D1 – D7: Cross-sectional view through aircraft fuselage at the
R2 cabin door location
1. Normal arrangement
(Oxygen cylinder and valve
arrowed)
2. Cylinder failure produces
fuselage rupture, with bulk of
the cylinder length propelled
upward through the cabin
floor. See Figure 11.
3. Cylinder impacts R2 door
frame and internal door
handle. See Figures 10 & 12.
4. Door frame impact breaks
off cylinder valve and
causes cylinder to invert
while continuing to travel
upward.
30
Probable oxygen cylinder trajectory (continued)
5. Cylinder impacts overhead
panelling end-on,
producing circular cut-out
type damage. See Figures
14-16.
6. Still rotating cylinder
impacts overhead storage
bin, producing semicircular
crushing damage.
See Figure 17.
7. Cylinder falls to cabin floor
and exits the aircraft
through the ruptured
fuselage.