Catastrophic Uncontained Fire

Shortly after the Boeing 747-400F departed from Dubai, United Arab Emirates (UAE), a fire erupted in a cargo pallet containing lithium batteries and other combustible materials. By the time the flight crew received a warning, a “catastrophic uncontained fire” raged in the forward main cargo deck, and the cockpit soon filled with “continuous blinding smoke,” said the report by the Air Accident Investigation Sector (AAIS) of UAE’s General Civil Aviation Authority.

Thermal damage to flight control cable supports and oxygen lines, and the failure of a crucial air conditioning pack, minimized the chances of survival. The pilots attempted to return to Dubai, but the captain’s oxygen supply was cut off, and he was overcome by toxic fumes while trying to retrieve a portable oxygen bottle. The first officer, alone at the controls, had trouble breathing and could not see his instruments or the view outside the windshield.

Investigators concluded that the first officer eventually became spatially disoriented and lost control of the crippled freighter, which struck terrain on a military base near Dubai International Airport. No one on the ground was hurt.

The investigation of the Sept. 3, 2010, accident generated many safety recommendations, including a review of transport category aircraft fire-protection certification standards; modification of cargo compartments and pallet covers to better contain fires; requirements for full-face oxygen masks and vision-assurance devices on the flight deck; more realistic training for emergencies involving smoke, fire and fumes; further testing of lithium battery ignition properties; and development of packaging and technical instructions to ensure safe carriage of lithium batteries aboard aircraft.

‘Medically Fit, Adequately Rested’

The flight crew had begun their assignment for United Parcel Service (UPS) several days earlier with a deadhead flight from Anchorage, Alaska, U.S., to Hong Kong, China, via Seoul, South Korea. After a layover of 47 hours in Hong Kong, they flew a different aircraft to Dubai, where they had a 24-hour layover.

The captain, 48, had 11,200 flight hours, including 4,054 hours in type. He had flown for several regional airlines and a major U.S. airline before he was hired by UPS in July 1995.

The first officer, 38, had 5,549 flight hours, including 77 hours as a second-in-command of 747-400s. He had flown as a captain for a regional airline before joining UPS in June 2006.

The report said that neither pilot had a history of accidents, incidents or regulatory violations, and that both were “medically fit and adequately rested in compliance with the fatigue regulations in place at the time of the accident.”

Undeclared Hazmat

Another UPS flight crew had flown the accident aircraft from Hong Kong to Dubai the night before the accident. Pallets loaded in the 747’s forward cargo deck in Hong Kong contained a significant number of lithium batteries that were not declared as hazardous material in accordance with International Civil Aviation Organization requirements, the report said.

“Lithium batteries have been in the spotlight for the past few years due to their possible involvement in aircraft cargo fires,” and the hazards posed by the shipment of lithium-­metallic and lithium-ion batteries are still not fully understood, the report said.

Tests performed to date have shown that “the thermal runaway of lithium-ion batteries is capable of causing adjacent combustibles to ignite [and that] in addition to the energy release from batteries resulting in combustion, there is an associated mechanical energy release,” the report said. “This mechanical energy release is capable of compromising the integrity of packaging and creating incendiary projectiles.”

The pallets remained aboard the aircraft for the subsequent scheduled flight from Dubai to Cologne, Germany. The cargo manifest for the flight showed no declared shipments of hazardous materials.

Also of significance regarding the flight from Hong Kong was a logbook entry about resetting the aircraft’s no. 1 air conditioning pack after it failed en route. A ground engineer in Dubai checked the pack, but could not replicate the failure.

The freighter, manufactured in 2007 and registered in the United States as N571UP, was within weight and balance limits when it departed from Dubai International Airport at dusk, 1851 local time, and proceeded northwest in visual meteorological conditions over the Arabian Gulf.

The first officer was the pilot flying. He hand flew the aircraft to 11,300 ft and then engaged the autopilot for the remainder of the climb to the assigned cruise altitude, 32,000 ft.

During the climb, the engine indicating and crew alerting system (EICAS) generated a fault message for the no. 1 pack, the same pack that had failed during the flight from Hong Kong to Dubai. The captain reset the pack, and the EICAS message cleared.

Investigators determined that the no. 1 pack’s turbine bypass valve, which works in conjunction with the ram air door, had failed before takeoff, causing the subsequent failure of the pack.

Fire Warnings

About 20 minutes after departure, the flight was handed off by UAE Area Control to Bahrain East Area Control. The aircraft was nearing its assigned cruise altitude two minutes later when the crew received visual and aural warnings of a fire on the forward main cargo deck (Figure 1).

“Fire, main deck forward,” the captain announced. He told the first officer, “[All right], I’ll fly the aircraft. I got the radio. Go ahead and run [the checklist].”

Investigators were unable to determine conclusively how the fire began, but the report said it might have been sparked by the auto-ignition of lithium batteries stored in one of the cargo pallets: “Lithium batteries have a history of thermal runaway and fire. … It is possible that a lithium type battery or batteries, for reasons which cannot be established, went into an energetic failure characterised by thermal runaway and auto-ignited, starting a chain reaction which spread to the available combustible material.”

The captain reported the fire warning to Bahrain Control and said that he needed to land as soon as possible. The controller advised the crew that Doha (Qatar) International Airport was at their 10 o’clock position and 100 nm (182 km) away, and asked, “Is that close enough?”

“How about we turn around and go back to Dubai,” the captain replied. “I’d like to declare an emergency.” The controller cleared the crew to turn right to a heading of 090 degrees and to descend to 28,000 ft. At this point, the Dubai airport was 180 nm (333 km) east.

“There is no direct information as to why the crew elected to choose Dubai [rather than] Doha,” the report said. “However, it is likely that at the time of the initiation of the turn-back, the crew was not yet aware of the full extent of the fire and its effects.”

The captain flew the aircraft on autopilot while the first officer conducted the “Fire Main Deck” checklist, which called for depressurizing the main cargo deck to shut off the ventilating airflow. The report explained that because this deck is classified as a Class E cargo compartment, active fire suppression is not required there: “The fire extinguishing and fire propagation mitigation is through reducing the oxygen available for combustion through depressurization of the compartment.”

Pack Fails Again

The depressurization of the main deck involved deactivation of the no. 2 and no. 3 air conditioning packs. With these packs shut down, the no. 1 pack alone provides conditioned airflow to the upper deck. “This provides a positive pressure differential between the upper deck and the rest of the aircraft, preventing smoke or fumes [from] entering occupied areas,” the report said.

However, the no. 1 pack subsequently failed again. No discussion of the failure was captured by the cockpit voice recorder, and there apparently was no attempt to reset the pack.

The pilots donned their oxygen masks and goggles when the cockpit began to fill with smoke. Noting that the microphones inside the masks are not “hot” but must be keyed with intercom switches on the control columns or the audio control panel, the report said that the pilots’ inability to readily hear what each other was saying caused some confusion and difficulty in communicating.

The captain advised the controller that the cockpit was full of smoke and that they could not see the radios. He requested and received clearance to descend to 10,000 ft. This might have been a mistake, according to the report: “Directly descending to 10,000 ft may have exacerbated the fire and smoke problem due to the extra available oxygen.”

The report noted, however, that the “Fire Main Deck” checklist provided conflicting guidance, with successive items on the checklist requiring the crew to “climb or descend to 25,000 ft” and to “plan to land at the nearest suitable airport.”

The checklist “does not provide guidance for when or how to transition to landing or the fact that descending early might provide more atmospheric oxygen to the fire,” the report said. “There is no intermediate step to verify or otherwise assess the condition of the fire and to evaluate the risk to the aircraft if a descent is initiated.”

‘I’ve Barely Got Control’

A few minutes after the crew received warnings about the fire on the main cargo deck, additional warnings indicated that the fire had spread to the aft main cargo deck. By this time, the fire had penetrated the main cargo deck liners and had caused severe damage to flight control cable support trusses.

The captain, who had disengaged the autopilot and was hand flying the 747, told the first officer, “I’ve barely got control of the aircraft.” Recorded flight data indicated that, due to the decreased control cable tension resulting from the damaged supports, even large movements of the control column and rudder pedals had limited effect on the deflection of the elevators and rudder.

The control problems abated somewhat when the captain re-engaged the autopilot, which sends electrical signals to the elevator control servos and hydraulic actuators located in the tail of the aircraft, behind the rear pressure bulkhead. The fire had not damaged the wiring for this system.

The cockpit environment may have worsened when the captain asked the first officer to “pull the smoke handle,” which opens a smoke-evacuation port in the cockpit ceiling. The report noted that this action is not on the “Fire Main Deck” checklist and that opening the port, with no air conditioning packs in operation, could have caused a pressure differential that drew more smoke into the cockpit.

‘I Can’t See’

The pilots discussed and agreed on the option of conducting an autoland approach and landing on Runway 12L at the Dubai airport. Although the first officer was having trouble seeing anything through the smoke, he was able to enter the instrument landing system (ILS) frequency into the flight management system (FMS).

The controller cleared the crew to proceed directly to the final approach fix. “[All right], we’re doing our best,” the captain replied. “Give me a heading if you can. I can’t see.”

The 747 was descending through 21,000 ft, about seven minutes after the crew received the fire warning, when the captain commented about the high temperature in the cockpit. Shortly thereafter, the oxygen flow to his mask abruptly ceased when the fire damaged some of the lines leading from the three crew oxygen bottles mounted on the sidewall of the forward main cargo compartment.

“I got no oxygen,” the captain said. “I can’t breathe. Get me oxygen.”

The report said that the first officer was unable to assist the captain because of task-saturation or because he did not know where the portable oxygen system was stowed. “The first officer was already managing a number of other problems, including the [FMS] input and the checklist.”

The captain told the first officer to take control of the aircraft. He then left his seat to retrieve the portable oxygen system, which was stowed in the aft cockpit area. The last recorded comment by the captain was: “I can’t see.” Investigators determined that he was rendered unconscious by toxic fumes shortly after leaving his seat and that he eventually succumbed to carbon monoxide poisoning.

Complicated Communications

The thick, acrid smoke obliterated the first officer’s view of the instrument panel. He also was having trouble breathing because his mask had inadvertently been set to the normal mode, which provides a mix of ambient air and 100 percent oxygen, rather than to the emergency mode, which provides only pure oxygen.

He advised Bahrain East Area Control that he was unable to change radio frequencies due to the limited visibility in the cockpit. “Sir, we’re going to have to stay with you,” he said. “We cannot see the radios.”

Eventually, the freighter flew out of radio range with Bahrain Control, but the pilot and the Bahrain controller were able to relay messages to each other through other aircraft operating in the vicinity. The Bahrain controller coordinated via landline with UAE Area Control and the control tower at the Dubai airport.

Recorded voice data indicated that the delay inherent in the relay of messages was problematic for the first officer, who repeatedly said that he was “flying blind” and asked for radar vectors and for information about his current altitude, heading, airspeed and distance from the airport.

Through a relay, the Bahrain controller asked the pilot to change to the guard frequency, 121.5 MHz, but the first officer apparently was unable to do so. Among the messages relayed to the pilot from the Bahrain controller was to maintain his current heading, 105 degrees.

‘Too Fast and Too High’

The 747 was descending through 9,000 ft at 350 kt as it neared the ILS final approach fix. The crew of another aircraft relayed the following message: “You’re too fast and too high. Can you make a three-sixty [i.e., a 360-degree turn]?”

“Negative, negative, negative,” the first officer replied.

Although the first officer had armed the approach mode, the autopilot did not capture the localizer because of the aircraft’s relatively high speed and altitude. The 747 was descending through 4,200 ft at 320 kt and was on a heading of 089 degrees when it passed to the north of the airport.

“Sir, where are we?” the first officer asked. “Where are we located?”

Through a relay aircraft, the controller asked the first officer if he would be able to make a left turn, to fly north toward Sharjah International Airport. The controller advised that the Sharjah airport was 10 nm (18 km) away.

“Give me a left turn,” the first officer said. “What heading?”

A heading of 095 degrees to Sharjah was relayed, and the first officer acknowledged the information. However, he inadvertently selected 195 degrees on the mode control panel. Recorded data showed that the aircraft rapidly turned right toward the selected heading while descending through 4,000 ft and slowing to 240 kt. The abrupt and unanticipated right turn might have confused the pilot and triggered the onset of spatial disorientation, the report said.

Loss of Control

The freighter was flying southwest, away from both the Sharjah and the Dubai airports, when the first officer disengaged the autopilot. The aircraft abruptly pitched 14 degrees nose-down.

The first officer pulled back on his control column to arrest the descent, but the result was a series of rapid pitch oscillations and only momentary reductions of the descent rate “due to the desynchronisation of the control column inputs and the elevators,” the report said.

The first officer received a relayed message advising that Dubai International Airport was 5 nm (9 km) away at his 3 o’clock position. “What is my altitude, and my heading?” he asked. “My airspeed?”

Shortly thereafter, the enhanced ground-proximity warning system generated the first of several “SINK RATE, PULL UP” and “TOO LOW, TERRAIN” warnings. Recorded data indicated that the first officer’s control column was fully aft when the aircraft descended out of control and struck the ground 9 nm (17 km) southwest of the Dubai airport.

The crash occurred 51 minutes after takeoff and 29 minutes after the crew received the fire warnings. On impact, the 747 was in a nose-down and right-wing-low attitude. It struck several street lamps before coming down on a service road at the perimeter of the military base, just outside a densely populated area.

“The right-hand wing struck several buildings and vehicle-parking stands before progressing through a line of maintenance storage buildings immediately prior to the forward fuselage contacting an elevated sand bank and additional support buildings,” the report said. “The aircraft was completely destroyed by the ground contact followed by a post-­accident fire.” 

This article is based on AAIS Case Reference 13/2010: “Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent Into Terrain — Boeing 747-44AF, N571UP; Dubai, United Arab Emirates; 03 September 2010.” The 324-page report, published in English on July 24, 2013, is available from the UAE General Civil Aviation Authority.