The Boeing 747-400 was cruising 29,000 ft over the South China Sea the morning of July 25, 2008, when an emergency oxygen cylinder burst and ripped a hole through the right side of the forward cargo hold, causing a rapid depressurization of the aircraft. The flight crew conducted an emergency descent to 10,000 ft and diverted to Manila, Philippines, where they landed the aircraft safely despite damage to several navigation systems and the anti-skid braking system. Damage to the 747 was substantial, but none of the 350 passengers or 19 crewmembers was injured.
In a final report issued in November 2010, the Australian Transport Safety Bureau (ATSB) said that the oxygen cylinder “had burst in such a way as to rupture the adjacent fuselage wall and be propelled upward, puncturing the cabin floor and impacting the frame and handle of the R2 door [the second main door on the right side of the cabin] and the overhead cabin paneling.”
Only the valve assembly was found; the remainder of the cylinder likely was ejected from the aircraft during the depressurization. Thus, investigators were unable to determine conclusively why the cylinder failed. “While it was hypothesized that the cylinder may have contained a defect or flaw, or been damaged in a way that promoted failure, there was no evidence found to support such a finding,” the report said. “Nor was there any evidence found to suggest that the cylinders from the subject production batch, or the [cylinder] type in general, were in any way predisposed to premature failure.”
In a media release on Nov. 22, the ATSB said that the cylinder failure “was a unique event and highly unlikely to happen again.”
‘Loud Bang’
The 747, operated by Qantas Airways as Flight QF30, departed from Hong Kong International Airport at 0922 local time for a scheduled flight to Melbourne, Australia.
The captain had 15,999 flight hours, including 2,786 hours in type. The first officer, the pilot flying, had 12,995 flight hours, including 5,736 hours in type. The second officer had 4,067 flight hours, with 2,292 hours in type; he left the cockpit for a rest break after departure.
The flight crew said that the aircraft had been airborne about 55 minutes when they heard a “loud bang or cracking sound” and felt a jolt. The autopilot disengaged, and the first officer took manual control of the aircraft. Warnings about cabin altitude and the status of the R2 door were among several messages that appeared on the engine indicating and crew alerting system. Although the cylinder had forced the R2 door handle to move 120 degrees from the closed-and-locked position, the plug-type door had not opened.
The second officer returned to the cockpit, and all three pilots donned their oxygen masks. They conducted the “Cabin Altitude Non-Normal” checklist, declared an emergency and reduced power and extended the speed brakes to initiate an emergency descent. A minimum cabin pressure of 5.25 psi, which corresponds to a cabin altitude of 25,900 ft, was recorded a few seconds after the descent was initiated. The 747’s pressure vessel — which includes the cabin, cockpit and forward cargo hold — had been pressurized to about 12.5 psi before the depressurization occurred.
The pilots leveled the aircraft at 10,000 ft about seven minutes after initiating the descent. Visual meteorological conditions, with scattered clouds and good visibility, prevailed throughout the area. “After reviewing the aircraft’s position, the crew elected to divert to Ninoy Aquino International Airport, Manila,” which was about 475 km (257 nm) southeast, the report said. “As part of the landing preparations, excess fuel was jettisoned to ensure that the aircraft’s landing weight was within safe limits.”
Masks Misused
The cabin crew and passengers also had heard a “very loud bang” and saw the passenger oxygen masks deploy, the report said. “Many of the cabin crew reported feeling air moving and seeing light debris flying about.”
Many passengers did not properly use their oxygen masks. “Cabin crew reported that most passengers grabbed a mask and held it over their mouth,” the report said. The public address system had been disabled, and “many crew had to shout or point instructions to passengers to pull down on the mask to activate the flow of oxygen. Some crew also had to tell passengers to secure the mask by the elastic strap instead of just holding the mask over their mouth and nose. Crew also shouted instructions to passengers with babies/children to wake them up and keep the mask on their child’s face. Some young children were fidgeting and resisting their parents’ efforts to put or keep the mask on.”
The cabin crew, who had been providing meal service when the depressurization occurred, took seats at their stations or unoccupied passenger seats and used portable oxygen systems or spare passenger masks during the descent. “One crewmember reported that she had observed two elderly passengers whose masks had not deployed and who seemed to be having trouble breathing,” the report said. “She moved through the cabin to the passengers, breathing through spare oxygen masks on the way. She then deployed the masks and ensured they were fitted and working before returning to her seat.
“Another cabin crewmember, who was using portable oxygen, reported that upon seeing her colleague assisting passengers, she also proceeded to move around the cabin, checking on children and infants in her area.”
After the aircraft reached 10,000 ft, all the cabin crewmembers used portable oxygen systems while moving about the cabin and checking on the passengers. “The use of portable oxygen at that time was compliant with procedures to guard against hypoxia due to exertion,” the report said.
Ear Pain and Stress
Although none of the passengers reported any physical injury, a subsequent survey by ATSB indicated that several passengers had experienced symptoms of rapid depressurization, including ear pain and/or “popping” of the ears, temporary loss of hearing and headaches.
“Many passengers also reported high levels of anxiety and feelings of panic, with associated physiological symptoms such as a ‘racing heart,’” the report said. “Several passengers reported feelings of faintness, lightheadedness and/or tremors.
However, it was unclear as to whether those symptoms were associated with hypoxic effects or the anxiety brought upon by the situation.”
Several crewmembers said that they had experienced ear discomfort and “ringing” of the ears. “However, none sustained any injury or physical condition that incapacitated them in any way,” the report said. “Several cabin crewmembers had become very distressed during the depressurization and were initially unable to carry out emergency tasks. Senior cabin crew reported that the affected staff were withdrawn from duty for a period, after which they were able to resume their duties and assist passengers.”
Big Hole
The failed oxygen cylinder was fourth in a bank of seven cylinders installed on the right wall of the forward cargo hold. The energy released when the cylinder burst had torn a hole about 2.0 m (6.6 ft) high and 1.5 m (4.9 ft) wide, just forward of the right wing root. “Fuselage materials, wiring and cargo from the aircraft’s forward hold were protruding from the rupture,” the report said. The excess pressure created when the cylinder burst also opened the two pressure relief valve blowout doors on the left side of the cargo hold.
Although the cylinder itself was not recovered, the damage it caused enabled investigators to assemble a likely failure scenario. “It was evident that the cylinder had failed by bursting through or around the base, allowing the release of pressurized contents to project it vertically upward,” the report said. The cylinder severed 85 electrical wires and the first officer’s aileron control cables1 before it penetrated the cabin floor, struck the R2 door frame and smashed the overhead paneling and storage cabinets. Investigators believe the cylinder then dropped back through the hole in the cabin floor and was swept out of the aircraft through the tear in the fuselage.
No one was near the R2 door when the cylinder penetrated the cabin floor. A Qantas engineer, who was aboard as a passenger, examined the damage and recommended that the cabin crew keep themselves and the passengers away from the area.
The cylinder burst had disabled all three instrument landing systems, the left VHF omnidirectional navigation system, the left flight management computer and the anti-skid braking system for the landing gear on the right side of the lower fuselage.
“Despite the apparent failure of multiple aircraft systems, the flight crew reported that the descent and approach into Manila were uneventful,” the report said. “The aircraft landed safely on Runway 06 at 1111 local time,” or about 54 minutes after the depressurization occurred. The aircraft was inspected on the runway by aircraft rescue and fire fighting personnel and then towed to the terminal.
A cut and a small dent were found in a panel on the no. 3 engine. “The aircraft operator reported that an internal boroscopic inspection of the engine identified some damage to the turbine components, although the nature of the damage suggested that it was unrelated to the depressurization event,” the report said. “The engine was changed as a precaution.”
‘Improbable Failure’
The failed cylinder was manufactured in 1996 and had undergone four required three-year inspections and requalifications, the last of which was about eight weeks before the accident. Investigators examined and tested the other 12 oxygen cylinders that were aboard the aircraft, as well as five cylinders from the failed cylinder’s production batch.
The oxygen cylinders conformed to U.S. Department of Transportation (DOT) 3HT-1850 specifications for “seamless steel cylinders for aircraft use.” The cylinders aboard the 747 were 75 cm (30 in) long and 23 cm (9 in) in diameter. They were constructed of chromium-molybdenum steel with a minimum wall thickness of 2.9 mm (0.1 in). Each cylinder holds 3,256 L (115 cu ft) of oxygen when charged to 12,755 kPa (1,850 psi). “The cylinder overpressure protection system was designed to operate in the event that cylinder pressure rises to between 17,237 and 19,133 kPa (2,500 and 2,775 psi),” the report said. Examination of the valve assembly from the failed cylinder showed no sign that overpressurization had occurred.
Investigators found no record of similar oxygen cylinder failures. “Aviation oxygen cylinders have failed aboard aircraft previously; however, all of the known events have been attributed to external influences, such as on-board fires or damage sustained during accident impacts,” the report said.
The report said the absence of the failed cylinder was a “significant obstacle to the investigation.” Nevertheless, “a comprehensive program of testing and evaluation of cylinders of the same type and from the same production batch as the failed item did not identify any aspect of the cylinder design or manufacture that could represent a threat to the operational integrity of the cylinders. In light of these findings, it is the ATSB’s view that passengers, crew and operators of aircraft fitted with DOT3HT-1850 oxygen cylinders can be confident that the ongoing risk of cylinder failure and consequent aircraft damage remains very low.”
Among the actions taken by ATSB after the accident were the publication of two bulletins providing information to passengers and cabin crew on aircraft depressurization.2
This article is based on ATSB Aviation Occurrence Investigation AO-2008-053, “Oxygen Cylinder Failure and Depressurisation; 475 km North-West of Manila, Philippines; 25 July 2008; Boeing Company 747-438, VH-OJK.” The full report is available at atsb.gov.au/publications/investigation_reports/2008/aair/ao-2008-053.aspx.
Notes
- Interlinks with the captain’s control cables, routed on the left side of the cargo hold, allowed the first officer to maintain aileron control.
- The passenger bulletin, Staying Safe During an Aircraft Depressurisation, is available at atsb.gov.au/publications/2008/AR2008075.aspx. The cabin crew bulletin, Aircraft Depressurisation, is available at atsb.gov.au/publications/2009/AR2008075_2.aspx.