A main deck cargo fire fed by lithium batteries led to a Loss of Control Inflight and Uncontrolled Descent Into Terrain. UPS 747 fatal accident in Dubai.
Photo (C) BFIBRAVO. Airplane-Pictures.net
Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent Into Terrain. Boeing 747-44AF. N571UP. Dubai, United Arab Emirates. 03 September 2010
General Civil Aviation Authority of the United Arab Emirates
History of the Flight
Inbound Flight Arrival from Hong Kong [HKG] – Sept 03 2010
On September 3rd 2010, the Boeing 747-400AF aircraft, registered N571UP, arrived from Hong Kong [HKG] on a scheduled cargo service flight to Dubai International Airport [DXB] carrying, among other items, significant consignments of cargo that included lithium batteries. The aircraft was parked at the loading position, chocks on/block in at 11:35 UTC.
The inbound crew entered a logbook item for a PACK 1 fault which was reset on the inbound sector from HKG-DXB.
The following scheduled sector was Dubai (OMDB/DXB) direct to Koln-Bonn, Cologne (EDDK/CGN) scheduled to depart at 14:50 UTC on the 03 September 2010 – this is the accident flight.
Prior to the flight to Dubai, cargo was loaded into all positions in Hong Kong. A consignment of mixed cargo including a significant number of batteries, including lithium types, was loaded onto the pallets located at MD positions 4, 5, and 6, amongst other positions (Refer to Appendix A, Section F of the full final report for further information on these items.). Upon arriving in Dubai, the Unit Load Devices (ULD) in positions 13L, 14L, 14R, 18L, 19L, and 20 were removed from the aircraft. Some of these ULD’s were replaced with other out-bound ULD’s. No cargo was unloaded from the forward section of the main deck. The Cargo Group examined shipping invoices for the cargo on board the aircraft, and at least three shipments of lithium batteries which should have been declared as hazardous materials were identified in the pallets at positions 4 and 5. There were no declared shipments of hazardous materials on board the accident flight.
Filed Flight Plan (Refer to AIRAC AMDT 98 UAE eAIP for Enroute chart information)
The filed flight plan waypoints and airways are as follows:
OMDB RANBI N571 BALUS UL768 OTILA UR219 MODAD B544 ALE UB402 NISAP UM861 BUK UL602 BUDOP UL850 LALIN UL604 DEMAB T842 RUNER T858 KOPAG KOPAG1C EDDK
The flight departed Dubai and proceeded to waypoint RANBI, along airway N571 to BALUS, then airway UL768 towards waypoint OTILA. The flight returned to Dubai just after passing waypoint BALUS, having crossed into the Bahrain FIR.
Pushback, Engine Start, Taxi, and Departure from Dubai International Airport
Push back and engine start were normal. The aircraft pushed back at 14:41 departing DXB at 14:51 (18:51 GST local time) on a scheduled cargo service to Koln-Bonn, Cologne (CGN), Germany.
The departure runway was runway 30 Right (RWY 30R) from DXB, a northwesterly departure over the southern Arabian Gulf.
The First Officer [FO] was the Pilot Flying (PF) (Pilot Flying – handling pilot with direct responsibility for flying the aircraft for the complete flight) the Captain [CAPT] was the Pilot Non Flying (PNF) (Pilot Non Flying or Pilot Monitoring the flight management, and carrying out support duties such as communications and checklist reading) for the sector from DXB to CGN. At 14:50:53 the aircraft performed a normal take-off. 23
The aircraft was cleared for a RANBI2D departure from Dubai which required a left turn after take-off from DXB, heading west to towards the RANBI waypoint, then a right turn heading north/west overhead the RANBI waypoint towards the BALUS waypoint. The BALUS waypoint is on the Emirates Flight Information Region [FIR]/Bahrain East FIR boundaries.
14:49: Initial/Continuous Climb – PACK 1 Offline
The initial climb out from DXB was uneventful. The PF flew the aircraft manually to an altitude of 11,300 feet, then engaged the Auto Pilot [AP] for the climb to the selected cruise altitude of 32,000 feet.
The climb was uneventful until a Pack 1 fault was indicated via the Engine Indicating and Crew–Alerting System (EICAS) at approximately 10,000 ft.
The Capt, [PNF] reset the Pack (All CVR excerpts are verbatim. Missing words or phrases have not been recorded on the CVR transcript). Pack 1 fault reset by the PNF at 15:00:17, at an altitude of 12,500 ft. The Pack 1 reset was successful. All other recorded indications were normal.
- 15:00|CVR|CAPT: I’m gonna look at pack one.
- 15:00|CVR|CAPT: looks like we’re good to go here. it uh basically what it said was. trim’s on. pack selector A. I hit the reset
15:11: Radar Contact/Bahrain East ATC/Approaching Top of Climb [TOC]
The flight checked in with Bahrain East [BAE-C] at 15:11 on the climb to FL320. BAE-C confirms to the crew that they are on the radar at 15:11:32, the crew acknowledge the radar contact. There are no indications of any abnormalities.
15:12: Transition from the UAE FIR to Bahrain East Flight Information Region [FIR]
Over head the BALUS waypoint, the aircraft transitioned from the UAE Flight Information Region [FIR] entering into the Bahrain East [FIR], with the Left Audio Control Panel [ACP] tuned to BAE-C frequency 132.12 MHz on the primary radio.
Note: BAE-C frequency is 132.12 MHz, the UAE Area Control frequency at the time was 132.15 MHz
(C) Radek Oneksiak. Jetphotos.net
15:13: Fire Warning Master Warning Light/Audible Alarm
One minute after passing the BALUS waypoint, approaching the top of climb, as the aircraft was climbing to the selected cruise altitude of 32,000 feet, the Fire Warning Master Warning Light illuminated and the Audible Alarm [Fire Bell] sounded, warning the crew of a fire indication on the Main Deck Fire – Forward. (The smoke detectors had detected smoke in the forward main deck cargo compartment)
15:12:54/CVR: Audible alarm warning the crew of a Main Deck Fire Forward (The fire warning bell and master fire warning light comes on when any engine, APU, main deck cargo compartment, or lower cargo compartment smoke, fire, or overheat condition is detected )
- 15:12:57|CVR|CAPT: Fire, main deck forward. alright. I’ll fly the aircraft (Crew Resource Management [CRM] note: The Captain is now the PF, the F.O is now the PNF )
- 15:13:02|CVR|F.O: Okay
- 15:13:05|CVR|CAPT: Go ahead…we’re gonna return
15:14:In flight Turn Back/Emergency Descent (The phase of flight in which an intentionally rapid or premature descent, from a previously normal maneuver, is made in response to an in-flight emergency.The descent is controlled by the crew)
The CAPT advised BAE-C that there was a fire indication on the main deck of the aircraft, informing Bahrain ATC that they needed to land as soon as possible.
BAE-C advised that Doha International Airport (DOH) was at the aircraft’s10 o’clock position 100 nm DME from the current location (DOH was the nearest airport at the time the emergency was declared (100nm track miles). DXB was approximately 180 nm track miles from the flight position when advised). The Captain elected to return to the point of departure, DXB.
- 15:13:14|CVR|CAPT: Just got a fire indication on the main deck I need to land ASAP
- 15:13:19|CVR|BAE-C: Doha at your ten o’clock and one hundred miles is that close enough?
- 15:13:23|CVR|CAPT: How about we turna round and go back to Dubai, I’d like to declare an emergency.
15:15: Arming and Activation of the Fire Suppression System
The F.O was handling the Non Normal Checklist [NNC] checklist items, the Fire Main Deck switch was depressed and the cabin began to depressurise. (There is no requirement for active fire suppression in Class E cargo compartments. The fire extinguishing and fire propagation mitigation is through reducing the oxygen available for combustion through depressurization of the compartment)
Note: The Fire Main Deck Forward/Aft/Mid checklist on-board at the time of the accident was the pre-modified version. (Boeing MOM 1-1708015942 issued after the accident includes an advisory note to the revised non-normal checklist. Either air conditioning pack 1 or pack 3must remain operating to prevent excessive smoke accumulation on the flight deck)
The crew changed the selected altitude from 32,000 feet to 28,000 feet as the aircraft changed heading back to DXB, the Auto Throttle [AT] began decreasing thrust to start the decent.
The AP was manually disconnected, then reconnected, followed by the AP manually disconnecting for a short duration, the captain as handling pilot was manually flying the aircraft.
Following the turn back and the activation of the fire suppression, for unknown reasons, thePACK1 status indicated offline [PACKS2and 3 were off], in accordance with the firearm switch activation. There was no corresponding discussion recorded on the CVR that the crew elected to switch off the remaining active PACK1 (PACK1,2 & 3 -the PACK provides preconditioned air to the pressurised fuselage. There are 3 PACK’s in the Boeing 747.When the Main Deck Cargo Fire Arm switch is depressed, PACK 2 and 3shut down while PACK 1 continues to supply preconditioned air to the upper deck. This provides a positive pressure differential between the upper deck and the rest of the aircraft preventing smoke or fumes entering occupied areas)
Note: PACK 1, in fire suppression mode, provides positive air pressure to the cockpit to prevent smoke/fumes from entering the cockpit area. There is no other effective smoke barrier to prevent smoke/fumes ingress into the cockpit and occupied areas.
15:15: Crew Don Oxygen Masks/Intra-cockpit Communication
As the crew followed the NNC Fire/Smoke/Fumes checklist and donned their supplemental oxygen masks, there is some cockpit confusion regarding the microphones and the intra-cockpit communication as the crew cannot hear the microphone transmissions in their respective headsets.
- 15:14:57|CVR|F.O: Can you hear me?
- 15:14:58|CVR|CAPT: No, I can’t hear you.
- 12:15:17|CVR|F.O: Why can’t I hear you?
This communication problem appeared to be resolved as the flight progressed.
15:15 to 15:16: Pitch Control Anomalies
The crew configured the aircraft for the return to DXB the flight was in a descending turn to starboard onto the 095° reciprocal heading for DXB when the Captain requested an immediate descent to 10,000 ft.
- 15:15:23|CVR|CAPT: I need a descent down to ten thousand right away sir
- 15:15:26|CVR|BAE-C: Descend and maintain one zero thousand your discretion
The reason for the immediate descent was never clarified in the available data.
The AP was disengaged. The Captain then informed the F.O that there was limited pitch control of the aircraft when flying manually (The Autopilot controls the elevators directly from the aft quadrant. Autopilot input to the elevator control system is received by the elevator autopilot servo control modules [ref to section 2 Analysis]). The Captain was manually making inputs to the elevators through the control column, with limited response from the aircraft.
- 15:15:37|CVR|CAPT: alright. I’ve barely got control.
- 15:15:47|CVR|CAPT: alright… find out what the hell’s goin’ on, I’ve barely got control of the aircraft.
This was followed one minute later by the following exchange:
- 15:16:43|CVR|CAPT: I have no control of the aircraft
- 15:16:47|CVR|F.O: okay… what?
- 15:16:53|CVR|CAPT: I have no pitch control of the aircraft
- 15:16:57|CVR|F.O: you don’t have control at all? (See Section 2 – Analysis: The DFDR data indicates that there was a control column movement anomaly between the input by the crew on the control column and the travel of the elevators. The DFDR elevator data indicates nil to marginal elevator deflection while there are large deflections in column position)
The flight was approximately 4 minutes into the emergency. The aircraft was turning and descending, the fire suppression has been initiated and there was a pitch control problem (The AP controls the elevators directly from the aft quadrant, the zone in the aft of the aircraft where the AP actuators are located). The cockpit was filling with persistent continuous smoke and fumes and the crew had put the oxygen masks on.
15:17: Smoke in the Cockpit-Reduced Visibility Due to Smoke
The penetration by smoke and fumes into the cockpit area occurred early into the emergency (There is no cockpit door separating the cockpit area from the supernumerary area) The cockpit environment was overwhelmed by the volume of smoke. There are several mentions of the cockpit either filling with smoke or being continuous ‘full of smoke’, to the extent that the ability of the crew to safely operate the aircraft was impaired by the inability to view their surroundings.
Due to smoke in the cockpit, from a continuous source near and contiguous with the cockpit area [probably through the supernumerary area and the ECS flight deck ducting], the crew could neither view the primary flight displays, essential communications panels or the view from the cockpit windows.
The crew rest smoke detector activated at 15:15:15 and remained active for the duration of the flight (The supernumerary area is immediately aft of the cockpit while the crew rest is at the back end of the upper deck). There is emergency oxygen located at the rear of the cockpit, in the supernumerary area and in the crew rest area. Due to the persistent smoke, the Captain called for the opening of the smoke shutter, which stayed open for the duration of the flight.
The smoke remained in the cockpit area.
- 15:17:18|CAPT: UPS six we are full… the cockpit is full of smoke, attempting to turn to flight to one thirty please have…standing by in Dubai
15:18: Flight Management Computer [FMC] Inputs
There was a discussion between the crew concerning inputting the DXB runway 12 Left [RWY12L] Instrument Landing System [ILS] data into the FMC. With this data in the FMC, the crew can acquire the ILS for DXB RWY12L and configure the aircraft for an auto flight/autoland approach (Sections of the FMC were recovered, however, due to the fire damage analysis of the components for non-volatile memory recorded information has not been possible).
The F.O. mentions on several occasions difficulty inputting the data based on the reduced visibility. However, the ILS was tuned to a frequency of 110.1 (The ILS frequency for DXB Runway 12L is 110.1 – Based on the DFDR data – See Section 2 – Analysis), the Digital Flight Data Recorder [DFDR] data indicates that this was entered at 15:19:20 which correlates which the CVR discussion and timing.
- 15:18:00│CVR|CAPT: Try and get Dubai in the flight management computer.
- 15:18:02│CVR|F.O: I can’t see it [the FMC]
- 15:19:04│CVR|BAE-C: UPS six expect one two left proceed direct to ah final of your discretion
- 15:19:08│CVR|CAPT: Alright we’re doing our best. Give me a heading if you can I can’t see.
15:20: Crew Oxygen System Anomalies – Captain and First Officer
At approximately 15:20, during the emergency descent at around 21,000ft cabin pressure altitude, the Captain made a comment concerning the high temperature in the cockpit. This was followed almost immediately by the rapid onset of the failure of the Captain’s oxygen supply.
Following the oxygen supply difficulties, there was confusion regarding the location of the alternative supplementary oxygen supply location. The F.O either was not able to assist or did not know where the oxygen bottle was located; the Captain then gets out of the LH seat.
This CVR excerpt indicates the following exchange between the Captain and F.O concerning the mask operation and the alternative oxygen supply bottle location. The exchange begins when the Captain’s oxygen supply stops abruptly with no other indications that the oxygen supply is low or failing.
- 15:20:02│CVR|CAPT: I got no oxygen I can’t breathe.
- 15:20:12│CVR|CAPT: Get me oxygen.
- 15:20:19│CVR|F.O: I don’t know where to get it.
- 15:20:23│CVR|CAPT: You fly
- 15:20:41│CVR|CAPT: I can’t see
Note: the supplementary oxygen mask and the goggles on the accident flight were two separate units; when being worn by the pilot, in order to remove the mask, the goggles have to first be removed, followed by the mask. The oxygen bottle to the aft of the cockpit area is the only portable oxygen bottle with a full face mask.
At this point on the CVR, all of the associated recorded information including the conversation and ambient sounds indicate the Captain moved the seat back, got out of the seat and then moved to the aft of the cockpit area.
The Cockpit Voice Recorder [CVR] passages following the Captain’s decision to leave the seat and move out of the cockpit indicate that the environment was full of continuous blinding smoke and that a breathing apparatus or protective eyewear capable of displacing smoke was required. This is the zone contiguous with the probable location of the fire-breach in the cargo lining.
15:22: Pilot Incapacitation – Captain
Based on the pathological information, the Captain lost consciousness due to toxic poisoning.
After the Captain left the LH cockpit seat, the F.O. assumed the PF role (F.O now operating in a single pilot environment). The F.O. remained in position as P.F. for the duration of the flight. There was no further interaction from the Captain or inquiry by the F.O as to the location of the Captain or the ability of the Captain to respond.
15:22-15:37[09-24]: Radio Communication – Relay Aircraft/Transit to DXB
The PF informed the BAE-C controllers that due to the limited visibility in the cockpit that it was not possible to change the radio frequency on the Audio Control Panel [ACP]. This visibility comment recurs frequently during the flight (Covered in Section 2. Analysis – Flight Profile in the full final report)
The Bahrain East controller was communicating with the emergency aircraft via relays. Several were employed during the transition back to DXB (Refer to Section 2. Analysis for further information in the full final report)
The aircraft was now out of effective VHF radio range with BAE-C (The VHF radio range is limited to line of sight, so as the flight was descending and heading East away from the BAE-C FIR and the Designated Area of Coverage [DAC] for VHF radio transmission from Bahrain, the emergency aircraft and BAE-C, the radio signal strength and clarity diminish proportionally to the distance away from the transmitter and the height of the aircraft above the ground. The controller managing the emergency employed several aircraft transiting the area to relay communications between BAE-C and the accident aircraft on the BAE-C frequency).
In order for the crew to communicate with BAE-C, BAE-C advised transiting aircraft that they would act as a communication relay between BAE-C and the emergency aircraft. BAE-C would then communicate to the UAE controllers managing the traffic in the Emirates FIR via a landline, who would then contact the destination aerodrome at Dubai, also by landline.
The crew advised relay aircraft that they would stay on the Bahrain frequency as they could not see the ACP to changing frequency.
- 15:21:24|PF: Sir we’re gonna have to stay with you, we cannot see the radios
15:22-15:37[09-24]: Radio Communication on the Guard Frequency 121.5 MHz
The PF transmits three times on the guard frequency, at 15:35:12, 15:35:17 and 15:37:26. The transmissions cover a two minute and fourteen second period when the flight is inbound for DXB.
- 15:35:12|CVR|PF: Mayday, Mayday. UPS6, can anyone hear me?
- 15:35:17|CVR|PF: UPS 6, can you hear me?
- 15:37:26|CVR|PF: Mayday, Mayday
All of the 121.5 MHz transmissions by the PF were keyed via the VHF-R, all other radio communications with BAE-C and the relay aircraft are keyed from the VHF-L audio panel (Refer to Section 1.9 – Communications for the Boeing 747-400F Communications System Details in the full final report)
There are several attempts by the UAE’s Area Control [EACC] to contact the flight on the guard frequency in conjunction with aircraft relaying information transmitting on the guard frequency to the accident flight.
The PF of the accident flight does not appear to hear any of the transmissions from the air traffic control units or the relay aircraft on the guard frequency.
Around this time, given the proximity of the aircraft to the RWY12L intermediate approach fix, Dubai ATC transmits several advisory messages to the flight on the Dubai frequencies, for example, DXB ARR on 124.9 MHz advise that ‘Any runway is available’. The Runway lights for RWY30L were turned on to assist the return to DXB.
15:38: Missed Approach to DXB Runway 12 Left
The Aircraft condition inbound as the flight approached DXB for RWY12L.
The computed airspeed was 350 knots, at an altitude of 9,000 feet and descending on a heading of 105° which was an interception heading for the ILS at RWY12L. The FMC was tuned for RWY12L, the PF selected the ‘Approach’ push button on the Mode Control Panel [MCP] the aircraft captures the Glide Slope (G/S). The AP did not transition into the Localizer Mode while the Localizer was armed.
ATC, through the relay aircraft, advised the PF: you’re too fast and too high. Can you make a 360? Further requesting the PF to perform a ‘360° turn if able’. The PF responded ‘Negative, negative, negative’ to the request.
15:38: Over Flight of DXB RWY 12 Left
The landing gear lever was selected down at 15:38:00, followed approximately 20 seconds later by the aural warning alarm indicating a new EICAS caution message, which based on the data is a Landing Gear Disagree Caution. At 15:38:20 the PF says: ‘I have no, uh gear’.
15:39: Alternate Diversion Option of Sharjah International Airport [SHJ]
Following the overflight of DXB, on passing north of the aerodrome abeam RWY12L. The last Radar contact before the flight passed into the zone of silence was at 15:39:03 (A radar is not designed to detect aircraft directly above the radar antenna. This gap is known as the cone of silence ). The flight was on a heading of 89° at a speed of 320 knots , altitude 4200 feet and descending.
The flight was cleared direct to Sharjah Airport (SHJ), SHJ was to the aircraft’s left at 10 nm, the SHJ runway is a parallel vector to RWY12L at DXB. The relay pilot asked the PF if it was possible to perform a left-hand turn. This turn, if completed would have established the flight onto an approximate 10-mile final approach for SHJ RWY30.
The flight was offered vectors to SHJ (left turn required) and accepts.
- 19:38:37|PF: Sir, where are we? where are we located?
- 19:38:39|Relay: Are you able to do a left turn now, to Sharjah, its ten miles away
- 19:38:43|PF: Gimme a left turn, what heading?
The relay aircraft advised that SHJ was at 095° from the current position at 10 nm. The PF acknowledged the heading change to 095° for SHJ.
15:40: Turn And Descent Followed By Uncontrolled Flight Into Terrain
For reasons undetermined the PF selected 195° degrees on the Mode Control Panel [MCP], the AP was manually disconnected at 15:40:05, the aircraft then banked to the right as the FMC captured the heading change, rolled wings level on the new heading, the throttles were then retarded, the aircraft entered a descending right hand turn at an altitude of 4000 feet, the speed gradually reduced to 240 kts.
The PF made a series of pitch inputs which had a limited effect on the descent profile; the descent is arrested temporarily. There then followed a series of rapid pitch oscillations. These were not phugoid oscillations, these were commanded responses where the elevator effectiveness decreased rapidly as the airspeed decayed and the elevators could not compensate for the reduced thrust moment from the engines to maintain level flight in a steady state. This was due to the desynchronization of the control column inputs and the elevators.
At this point had the aircraft remained on the current heading and descent profile it would have intercepted the terrain at or near a large urban conurbation, Dubai Silicone Oasis.
The PF was in VHF communication with the relay aircraft requesting positional, speed and altitude information.
- 15:40:15|CVR|Relay: okay Dubai field is three o’clock it’s at your three o’clock and five miles
- 15:40:20|CVR|PF: what is my altitude… and my heading?
- 15:40:25|CVR|PF: my airspeed?
From this point onwards, approximately 50 seconds elapse prior to the data ending.
- 15:41:33|GPWS: pull up
15:41: Loss of Control Inflight followed by an Uncontrolled Descent Into Terrain – Data Ends (A digital flight data, CVR and communications analysis of the flight profile is in Section 2 of the full final report)
The effectiveness of the pitch control immediately prior to the end of the data was negligible.
The control column was fully aft when the data ended, there was no corresponding elevator movement.
The aircraft lost control in flight and made an uncontrolled descent into terrain.
- 15:41:35|CVR| Data Ends
Injuries to Persons
The accident flight crew was operating a two crew sector, the crew was comprised of a Captain and First Officer.
There was no other relief or supernumerary crew or passengers or other occupants on board the aircraft.
Neither crew member survived the accident.
Damage to the Aircraft
The aircraft – airframe, systems and available living space – were subject to significant thermal loading caused by fire, resulting in material degradation and damage. This resulted in the exposure of primary structural elements, components, and assemblies to significant heat damage and the cockpit area to continuous smoke and toxic fume penetration resulting from the onboard cargo fire.
The fire severely damaged significant systems leading to failures in aircraft controllability and crew survivability systems, failures which interfered with the normal flight management, directly with the aircraft controls and the crew supplementary oxygen system supply.
The aircraft was completely destroyed by the ground contact followed by a post-accident fire.
The aircraft contacted several street lamps on the perimeter of the Nad Al Sheba Military base during the uncontrolled descent.
The first ground contact was a service road with the aircraft in a right-hand wing down nose low attitude.
The right-hand wing struck several buildings and vehicle parking stands before progressing through a line of maintenance storage buildings immediately prior to the forward fuselage contacting an elevated sand bank and additional support buildings in the general vicinity ahead of the aircraft.
Cargo Identified In the debris
The cargo identified on scene included clothing, machined parts and subassemblies, flashlights, gun parts, costume jewellery, cases for electronic equipment, USB flash drives, unpopulated circuit boards, espresso makers, automotive entertainment and navigation systems, bike frames, pellets for injection moulding, wrist watch components, rubber bracelets, cell phones, MP3 and MP4 players, mannequin heads, wigs, shoes. No items posing a flammable fuel load or capable of acting as an ignition source were visually identified except for batteries and battery-containing devices.
The following photographs are of batteries and battery-containing devices found in the debris
Medical and Pathological Information
Both crew members were recovered from the crash site and removed to the medical and pathological facilities of the Dubai Police Forensics Department where autopsies were performed.
Full forensic examinations were performed following the accident with fluid and tissue samples screened for the following
- Psychoactive substances
- Toxic substances
- Percentage of Carboxyhaemoglobin (COHb) in the blood
Captains Medical Data – Dubai Police Forensics Department
- Blood sample revealed ethyl alcohol with a concentration of (11 mg/dl).
- Muscle sample revealed an ethyl alcohol with a concentration of (12 mg/100 g).
- Blood sample from the Captain indicated a Carboxyhaemoglobin (COHb) concentration of 49.5%. (This is considered a significant percentage that could lead to coma followed by acute respiratory failure followed by cardiovascular collapse. The incapacitation of the pilot‐in‐command is attributed to inhalation of toxic gases [carbon monoxide] produced by the fire)
First Officers Medical Data – Dubai Police Forensics Department
- Tissue samples did not reveal presence of ethyl alcohol.
- No prohibited narcotics substances indicated
- No toxic substances from chemical, natural, alcoholic or volatile sources were indicated.
Secondary Medical Samples Sent to the FAA Civil Aerospace Medical Institute (CAMI)
In accordance with international best practice, specimens of forensic material were requested and delivered to the Federal Aviation Administration (FAA) representative in the UAE by the GCAA.
This material was then sent by the FAA representative to the FAA Civil Aerospace Medical Institute (CAMI).
The CAMI laboratory performed an independent analysis of the specimens sent by the FAA to the institute. The CAMI specimen analysis indicates the presence of ethanol in samples from the captain and first officer; however, their report states that the ethanol reported in these cases are from postmortem ethanol formation and not from the ingestion of ethanol.
The Captain’s specimen indicated 20 (%) Carbon Monoxide detected in Blood.
The First Officer’s specimen was not tested for carbon monoxide.
Smoke in the Cockpit – Characterizing the Problem
Smoke as a factor in emergency situations is a quantitative problem based on density, volume and flow rate. What defines smoke and fumes as an obstruction to normal operation in a cockpit can be subjective, other than the fact that smoke is indicative or either a symptom of another failure, usually electrical or there is a cargo fire.
In this accident, the smoke was continuous and of sufficient density and rate of flow to prevent viewing the flight displays, radios panels, and the view outside the cockpit.
As an indication of the smoke in the cockpit problem, the pictures below are from FAA test of an EFB1/Laptop battery fire. The test is a good indication of the lack of visibility encountered when a cockpit is full or filling with smoke (This test was not connected to this accident investigation. This was an Electronic Flight Bag (EFB) Hazard Assessment. The Laptop was outfitted with a high capacity (7.2 Ah), 9 cell Li-Ion battery . The battery has been modified to initiate thermal runaway, and the laptop placed in a Boeing 737 cockpit)
Smoke Generation by a Continuous Source Involving Smoke Cockpit Penetration with no Method of Fire Suppression or Smoke Clearance
Smoke migration is a result of a spreading fire. As a fire burn, heat is created and the products of combustion begin to migrate. Minimizing the spreading of smoke and fumes into the flight deck is critical for continued safe operation of the aircraft.
Smoke is a factor in the inability to view the instruments. The composition of the smoke based on the residue found at the accident site was the result of black smoke, typically containing carbonized particles. The Pyrolysis of the burning material, especially incomplete combustion or smoldering without the adequate oxygen supply, also results in the production of a big amount of hydrocarbons. Heavier hydrocarbons may condense as tar, smoke with significant tar content is yellow to brown.
In addition to the above, the following conditions are considered unsafe:
There is a deficiency in certain components which are involved in fire protection or which are intended to minimize, retard the effects of fire, smoke in a survivable crash, preventing them performing their intended function; for instance, deficiency in cargo liners or cabin material leading to non-compliance with the applicable flammability requirements.
Summary of the Flight Profile
The accident flight was uneventful until just before the top of climb at about 15:12, when there was a Fire Main Deck indication and crew audible alert.
As the flight progresses into the Bahrain FIR, approaching the top of climb, the transition from a normal cockpit environment and the emergency reactions by the crew were handled as expected; there was a short reaction time lag based on the startle factor, but the transition to an emergency CRM was quick. There was some alarm expressed at the onset of the emergency.
The Captain had made the command decision to return to Dubai prior to informing BAE-C of the emergency. The F.O was aware of the Captains decision to return and the transition for the configuration changes were established.
Although the crew began the Fire Main Deck non-normal checklist, they did not complete the checklist. The Captain made a decision to return to DXB instead of landing at the nearest suitable airport (Doha) provided by the BAC-C. Also, the Captain elected to descend to 10,000 feet instead of 25,000 feet per the Fire Main Deck NNC.
There were some communication issues identified early in the sequence, these, however, did not affect the CRM as the procedures and vital actions were running as predicted.
Three events occurred rapidly and in quick succession following the start of the turn back which diverted the crew’s attention.
- The cockpit filled with smoke. The smoke was present at the start of the sequence, but it rapidly became noticeable in the CVR statements that the volume and the density of the smoke had increased significantly. Within two minutes neither crew member could view the panels or out of the cockpit.
- At about the same time, the pitch control problem became apparent which diverted the F.O’s attention as the Captain asked the F.O to ‘figure out what was going on’. The F.O was already managing a number of other problems, including the FMC input and the checklist.
- The Captains oxygen supply stopped, the Captain asked for oxygen, the portable oxygen bottle was behind the Captain’s seat next to the left-hand observer seat. The First Officer was not able to assist the Captain. The Captain, one minute after the oxygen supply stopped, got out of the seat and went back into the aft cockpit area. The Captain was heard to say ‘I cannot see’, there is no further CVR recording or interaction of the Captain.
Seven minutes into the emergency, the F.O is PF and the Captain is incapacitated. Almost immediately, the first relay aircraft contacts the accident flight to relay information. The F.O establishes communication with the relay, this distraction, and the requirement to complete the escalating task load precluded the F.O from enquiring as to the location of the Captain.
This aircraft was on the AP, heading on a direct track to DXB at around 380 KTS. The F.O does not attempt to contact the Captain or mention the incapacitation during the radio transmissions.
There are numerous references to the cockpit visibility problems while the PF is talking to the relay traffic. The following workload factors were considered significant when analyzing and demonstrating the basic workload functions for the flight crew.
Basic Workload Functions
(1) Flight path control.
o AP from FL220, heading direct to DXB. AP off and manual control from the right turn after the over-flight until the end of the data. It is possible due to the smoke and lack of visual clues available spatial disorientation was a factor after the unanticipated bank to the right confused the PF.
(2) Collision avoidance.
- The only hazard was following the turnover DXB RWY 12L, the aircraft’s descent profile and direction would have intercepted the urban conurbation of Silicone Oasis had the right hand turn not continued.
- Marginal. The PF was not aware spatially of the aircraft position relative to the destination aerodrome or the height above the ground. The radio transmissions repeatedly requested information on height, speed, and direction. Several transmissions asked the relays ‘Where am I?’
- Radio frequency selection and the confused problem around the guard frequency transmissions that were not heard by the PF were not resolved. It is possible the volume was turned down on the RH ACP.
- Had the Captain taken the Doha option, the communications problems experienced by the PF would have been negated as no frequency change was required.
(5) Operation and monitoring of aircraft engines and systems.
- The inability of the PF to view the instruments was a causal factor in the accident. Had this problem been resolved with either an effective smoke abeyance procedure or the fire suppression procedure extinguishing the pyrolyzing materials, then only other alternative in a continuously smoke filled cockpit is a vision assistance mechanism
(6) Command Decisions
- The Captain decided to return to DXB at the first fire bell alert. There was another available airport 100nm from the fire warning location, which could have been achieved in 18- 20 minutes. (See section 2.4 in the full final report).
(7) Checklist Interruption.
- Only the initial portions of the Fire Main Deck NNC were completed. As the crew began to experience smoke obscuration and flight control difficulties, the NNC was not completed. In the early stage of the emergency, the rapid escalation of the cascading failures occurred while other vital actions were being performed, notably, the Fire Main Deck non-normal checklist. The contact change of prioritization to deal with the number of problems that were presented to the crew prevented a thorough review of the problems that would be occurring in the near future, for example, tuning one of the radios to the destination frequency.
(8) Psychological Aspects
- Towards the end of the data Just prior to the turn the pilot asks the relay to tell him where are they located. The flight passes over the northern boundary of DXB and performs a steep unanticipated right-hand turn. Following this maneuver, it is possible that confusion resulting from spatial disorientation combined with vestibular disorientation and perception affected the pilot’s ability to judge the immediate environment.
Inflight Turn Back To Dubai Verses Diverting To Land At The Nearest Suitable Airport At Doha Or Ditching In The Gulf
The Captain’s decision to return to DXB instead of the nearest airport option of Doha International Airport [DOH] was not resolved in the various simulator function tests or through any of the other lines of inquiry. From the onset of the emergency the crew reacted to the normal drills required, the Captain assumed control of the aircraft and the F.O was running the QRH Fire Main Deck checklist.
Immediately following the first fire bell, the Captain indicated to the F.O that they would return to DXB. He then advised BAE-C of the main deck fire alarm and that they needed ‘to land ASAP’. BAE-C advised that Doha airport was at ten o’clock and 100 nm. The Captain replied that he would turn back to Dubai and declared an emergency.
There is no direct information as to why the crew elected to choose Dubai versus Doha, however, it is likely that at the time of the initiation of the turn back, the crew was not yet aware of the full extent of the fire and its effects.
At 15:13:31, the crew commanded a right turn and descent. Approximately 30 seconds later, the first indications of smoke and control issues became evident to the crew. From the onset of the emergency the crew reacted to the normal drills required, the Captain assumed control of the aircraft and the F.O reverted to Pilot Not Flying [Pilot Monitoring] duties which included running the QRH Fire Main Deck checklist.
A performance analysis for the emergency descent indicate that had the diversion started from the optimum starting point 15:14 UTC, the earliest possible landing time would have been approximately 15:34 UTC at DOH
Factors Influencing Pilot Decision Making During the Diversion/Return To Dubai
When the crew initiated the descent toward Dubai the Captain assessed that the situation was abnormal and had already informed the F.O that they would return to Dubai prior to informing BAE-C of the emergency. There was a request to the controller to land as soon as possible. DOH was advised at 100 track miles. This would have taken 17 minutes to achieve a straight-in approach from the sea onto RWY15.
DOH Approach Radar had 121.5 MHz as a listed emergency frequency/RWY 15 ILS frequency was available from the ATCO’s if required.
Factors affecting the turn back decision include the following. The crew were familiar with DXB and did not have the DOH charts and FMC information immediately available. The in-flight turn-back feature of the FMC automatically reprograms the departure/arrivals page to the departure airport when an air turn-back occurs within 400 nautical miles. This feature gives the pilots immediate access to the arrivals and approaches at the departure airport. The crew would have had recent knowledge of the airport information and weather conditions at DXB.
Based on the limited cues available, the crew took steps to prepare the aircraft for an emergency descent and landing on DXB RWY 12L t the initiation of the turn to DXB. The crew were familiar with DXB and did not have the DOH approach charts readily available or the ILS Frequency for Doha.
The crew knew that they would have to take additional time to familiarize themselves with, and set up for the approach and landing.
Land at Nearest Suitable Airport
The NNC Fire Main Deck checklist provides the instruction in step 8 to Plan to land at the nearest available airport.
When the crew advised BAE-C that there was a fire on board, the BAE-C controller advised the crew that DOH was the closest available runway at 100 nm track miles.
The Captain is talking to BAE-C immediately after the fire warning indication.
- 15:13:14|CVR|CAPT: just got a fire indication on the main deck I need to land ASAP.
- 15:13:19|CVR|BAE-C : Doha at your ten o’clock and one hundred miles is that close enough?
- 15:13:23|CVR|CAPT: How about we turn around and go back to Dubai, I’d like to declare an emergency. The F.O is running the checklist and at 15:15:34 calls, ‘ok land at nearest suitable airport’ followed almost immediately by the first indication of a control problem and checklist disruption.
This is one of numerous checklist interruption issues identified in the handling of the emergency.
DXB was a track mile distance of approximately 180 nm.
The investigation examined the possible outcome of an alternative scenario of diverting to DOH at the first indication of the fire. From the point where the diversion to Doha was advised, there were 100 track miles to DOH. A performance analysis based on a 3°-4° descent angle and a descent speed of 300kts indicate that from the notification until overhead DOH could have been achieved in approximately 17 minutes. Adding time for speed reduction and radar vectoring to the approach configuration, approximately 20 minutes would have been required.
Assuming the systems failure timeline remained linear, a similar level of controllability problems would have been apparent, including the oxygen supply problem and the elevator and speed brake problems identified earlier.
Additionally, the landing gear would not have been able to extend unless the crew used the manual gear extension procedure. How an auto landing without landing gear would have concluded is not known (Refer to Section 1 – Flight Controls in the full final report). The aircraft was within 20,000 lbs of the take-off fuel, fully loaded and in all probability would have made a wheels-up landing.
A descent, based on the fire suppression methodology of venting airflow and depressurisation of the cargo hold to reduce the available oxygen, could have exacerbated the fire, accelerating the cascading failure scenarios and the cascading failures.
However, it is clear that a major difficulty faced by the crew was a consequence of the course change back to DXB. Once the smoke prevented the crew from changing radio frequencies, the communications, navigation, and surveillance difficulties increased. On a course to Doha, the flight would have been in direct contact with BAE-C, and if relays were required as the airplane descended toward the airport, direct landline communication between BAE-C and Doha Approach would have greatly simplified the radio communication. ATC radar surveillance and coordination would also have been simplified. The SSR data would have been available to the ATCO and there would have been more available ambient light due to the longitude of Doha.
Analysis of the diversion to DOH and the likely outcome is speculative as the crew incapacitation and smoke/fumes in the cockpit would have prevailed as the rate of failure on the timeline of the failures was linear regardless of the destination. In addition, the aircraft control was seriously compromised by the fire and consequential events, a factor that was not apparent to the crew as they could not view the primary instruments, or the and alert and notification display. The likely outcome of the diversion to DOH is therefore, inconclusive, although the communication and task saturation issues experienced by the remaining pilot would have been negated by a DOH diversion. The communications difficulties with the relay aircraft/BAH-C/EACC/DXB chain of events was the result of the course change toward DXB.
The option to ditch was reviewed during the simulator sessions in Seattle (Refer to Appendix E in the full final report). Although feasible, the inability to see the instruments, particularly the radar altitude or outside of the cockpit window was problematic. The control of the aircraft descent with the AP was another issue that was unresolved.
Attempting to ditch using the auto flight functions was possible, however, the last five hundred feet managing the rate of descent, attitude, speed and gauging the sea state in all probability precluded this as an option.
This exercise was inconclusive.
Source of Ignition and Cargo Fire Sequence
As the wreckage was subjected to a large post-accident fire and the aircraft had an onboard fire for approximate 35 minutes prior to the accident, retrieval of evidence was limited to several relatively small pieces of assemblies and components.
It has been established that there were consignments of significant quantities of lithium batteries or derivatives of lithium type batteries on board (Where ‘Lithium Batteries’ are referenced in this section, it refers to all types of commercially available lithium battery).
Lithium batteries have a history of thermal runaway and fire, are unstable when damaged and can short circuit if exposed to overcharging, the application of reverse polarity or exposure to high temperature are all potential failure scenarios which can lead to thermal runaway. Once a battery is in thermal runaway, it cannot be extinguished with the types of extinguishing agent used on board aircraft and the potential for autoignition of adjacent combustible material exists.
Through a process of cross-referencing the location of the ACARS fire detection messages and other system indications and anomalies recorded on the FDR, with the cargo manifest for the type, number, location and of the lithium batteries on board, the investigation concludes with reasonable certainty that the location of the fire was in an element of the cargo that contained, among other items, lithium batteries. It is possible that a lithium type battery or batteries, for reasons which cannot be established, went into an energetic failure characterized by thermal runaway and auto ignited starting a chain reaction which spread to the available combustible material
This can ignite the cargo providing sufficient thermal energy to ignite the adjacent cargo, which included, but did not entirely consist of, lithium batteries.
It is probable that the remaining cargo, the cargo pallet, and the adjacent cargo ignited and continued in a sustained state or process of combustion for an indeterminate period of time; the sustained state of combustion in all probability continued up until the aircraft data ceased to record.
As found in the cargo contain fire testing, particularly in the case of the collapsible DMZ containers, the short time interval between a fire being detectable and peak energy release rate precludes any mitigating action to suppress the fire and protect the aircraft structure. The FAA regulation for cargo compartments certified with smoke detection (14 CFR 25.858) requires a 1 minute detection time from the start of a fire. The regulation does not account for any delay in detection caused by the container. Current certification tests do not use containers. Although 14 CFR 25.858 for cargo compartments certified with smoke detection does not specify any performance metric for what goes on after detection, the results of these fire tests suggest that the intent of the regulation as stipulated in paragraph (b) of 14 CFR 25.858, “the system must be capable of detecting a fire at a temperature significantly below that at which the structural integrity of the aircraft is substantially decreased,” is not being met.
Findings The findings are statements of all significant conditions, events or circumstances in the accident sequence. The findings are significant steps in the accident sequence, but they are not always causal or indicate deficiencies.
- The crew of the inbound sector from Hong Kong reported a PACK 1 failure. This failure could not be replicated on the ground in Dubai by the ground engineer.
- The Boeing 747-400 fleet was experiencing a lower than predicted MTBF of the turbine bypass valve [TBV], which is a component of the AC PACKs.
- A consignment of mixed cargo including a significant number of batteries, including lithium types, was loaded on the inbound flight from Hong Kong onto the pallets located at MD positions 4, 5, and 6, amongst other positions. This cargo was not unloaded in Dubai.
- At least three shipments including lithium type batteries should have been classified and fully regulated as Class 9 materials per ICAO Technical Instructions, and thus should have appeared on the cargo manifest. These shipments were located in the cargo at MD positions 4 and 5.
- Shippers of some of the lithium battery cargo loaded in Hong Kong did not properly declare these shipments and did not provide Test Reports in compliance with the UN Recommendations on the Transport of Dangerous Goods Manual of Tests and Criteria, Section 38.3, to verify that such these battery designs were in conformance with UN Modal Regulations.
- The aircraft was airworthy when dispatched for the flight, with MEL items logged. These MEL items are not contributory to the accident.
- The mass and the Center of Gravity [CG] of the aircraft were within operational limits.
- The crew was licensed appropriately and no fatigue issues had been identified.
- The Captains blood sample was positive for ethyl alcohol with a concentration of (11 mg/dl).
- Currently a universal fire protection certification standard covers all transport category aircraft.
- FAA Advisory Circular 25-9A Smoke Detection, Penetration, And Evacuation Tests And Related Flight Manual Emergency Procedures does not require the consideration of continuous smoke generation for cockpit smoke evacuation, the FAA recommends that the airframe design address this situation but it is not mandatory.
- The crew weas heard to confirm the oxygen mask settings during preflight, however sound spectrum analysis indicated that for unknown reasons, the First Officer’s mask was set to Normal instead of 100%, which likely allowed ambient air contaminated with smoke to enter his mask.
- The take-off at 14:50 UTC and initial climb were uneventful.
- At 14:58 UTC, Pack 1 went off line and was reset 2 minutes later by the PM.
- The crew acknowledged Bahrain radar and crossed into the Bahrain FIR at 15:11 UTC.
- At some point prior to the fire warning, contents of a cargo pallet, which included lithium batteries, auto-ignited, causing a large and sustained cargo fire which was not detected by the smoke detectors when in the early stages of Pyrolysis.
- Pallets with rain covers can contain smoke until a large fire has developed.
- Two minutes after passing into the Bahrain FIR, Twenty one minutes after take-off there is a fire alert at 15:12 indicating a, FIRE MAIN DK FWD.
- The Captain assumes control as Pilot Flying, the F.O begins the FIRE MAIN DK FWD non-normal checklist.
- The Capt advises the F.O they are to return to DXB before alerting Bahrain Area East Control [BAE-C] of the fire onboard, declaring an emergency and requesting to land as soon as possible.
- BAE-C advised the crew that Doha airport was 100 nm to the left. The turn back to DXB totaled 185 nm track distance. The likely outcome of a hypothetical diversion is inconclusive.
- At the time the Captain decided to turn back, the crew was not yet aware of the full extent of the fire and its effects.
- By the time that the smoke in the cockpit and fire damaged controls became apparent, diverting to Doha was no longer a feasible option.
- The course to DXB resulted in the airplane flying out of direct radio communication with ATC, requiring a complex relay of communication and increased task saturation for the F.O.
- In addition to the energy release from Lithium batteries resulting in combustion, there is an associated mechanical energy release. This mechanical energy release is capable of compromising the integrity of packaging and creating incendiary projectiles.
- The control of the aircraft when in manual control was compromised due to the thermal damage to the control cable assemblies. The first indication of the deteriorated synchronization problems between the control column movement and elevator position appear when the Captain disconnects the autopilot.
- The time interval between fire detection and the onset of aircraft system failures was two minutes and thirty seconds at the point of detection. In all probability the fire had damaged the control cables prior to autopilot disconnection.
- The aircraft begins to turn on to a heading for DXB and descends. As it was dusk, the aircraft is now descending to the east and back into an easterly time zone where there is limited available ambient solar light.
- The cargo compartment liner failed as a fire and smoke barrier under combined thermal and mechanical loads.
- Consequently, the damaged cargo compartment liner exposed the area above the cargo bay in fire zone 3 to sustained thermal loading either breaching the cargo compartment liner or causing the aluminium structure retaining the liner to collapse, exposing the area above and adjacent to the breach to continuous thermal loading.
- Consequently, the damaged cargo compartment liner exposed the supernumerary and cockpit area to sustained and persistent smoke and toxic fumes.
- Based on the NTSB pallet and container testing results, it is now known that the growth rate of container fires after they become detectable by the aircraft’s smoke detection system can be extremely fast, precluding any mitigating action and resulting in an overwhelming fire that cannot be contained.
- The high thermal loading damaged or destroyed the supporting trusses for the control cables directly affecting the control cable tension. The control column effectiveness was significantly reduced, subsequently the movement of the elevators, speed brake, rudders, brakes and landing gear control had been compromised.
- The high thermal loading caused damage to the ECS ducting,
- The ACARS/AHM data indicates a series of sensor failures and fire wire loops tripping to active in the area of the fire, the fault timing and the fire warning are corollary.
- The crew donned their oxygen masks, and experienced difficulty hearing each other.
- The oxygen masks had a required setting of100% and in emergency for smoke in the cockpit.
- The oxygen selector position cannot be viewed when the mask is on. The technique used to determine the selector position when the mask was on was not an operator technique or reinforced through training scenarios and non-cognitive muscle memory techniques.
- The mask settings remain unchanged for the duration of the flight.
- The main deck fire suppression system was activated and the cabin depressurized.
- Lithium-metal cell thermal stability and reactions that occur within a cell with elevated temperatures, up to the point of thermal runaway are not oxygen dependent. Electrolyte or vent gas combustion properties and the fire hazards associated with thermal runaway reactions do not respond to the FL250 assumed hazard mitigation methodology.
- The Class E cargo compartment fire suppression strategy of preventing venting airflow in to cargo compartment, depressurization and maintaining 25,000ft cabin altitude may not be effective for Class D metal fires.
- For unknown reasons Pack 1 went off and was not mentioned by the crew. The cockpit smoke prevention methodology when the fire suppression is active is to have pack one on low flow pressurizing the cockpit area to a higher than ambient pressure, preventing smoke ingress.
- It is unknown in this instance that if Pack one had been active this method would have worked as described based on the volume and flow of the smoke The Capt requests a descent to 10,000ft
- The QRH Fire Main Deck checklist does not address the key factor of descend or divert decision making. The checklist fire suppression methodology advises the crew to remain at 25,000 cabin pressure altitude to suppress a fire or land at nearest suitable airport. It does not provide guidance for when or how to transition to landing or the fact that descending early might provide more atmospheric oxygen to the fire. There is no intermediate step to verify or otherwise assess the condition of the fire and to evaluate the risk to the aircraft if a decent is initiated.
- The Class E certification standards for fire suppression does not require active fire suppression.
- Within three minutes of the fire alarm, smoke enters the cockpit area. This smoke in the cockpit, from a continuous source near and contiguous with the cockpit area, entered with sufficient volume and density to totally obscure the pilot’s view of the instruments, control panels and alert indicating systems for the duration of the flight.
- Once the liner had been breached, the openings in the liner would progressively expand, allowing an increase in the volume of dense noxious smoke, fire and combustion by-products to escape the cargo compartment.
- The cargo compartment liner structure certification does not include extreme heat and other input loads such as vibration, multi-axial loading, intermittent pressure pulses, thermo mechanical loadings based on differential materials coefficients, acoustic and ballistic damage testing.
- The crew made several comments concerning their inability to see anything in the cockpit. The crew in the smoke environment had reduced visibility and could not view the primary instruments such as the MFD, PFD, Nav Displays or the EICAS messages.
- The Captain selected the Autopilot on and leveled out following the pitch control problems. The aircraft remained in a stable steady state when controlled via the AP. There was no communication between the Captain and the F.O. that the controllability problem was resolved using the AP.
- Effective elevator and rudder control was only available with the autopilots. The aircraft was controllable with the AP as the servos are electrically controlled and hydraulically actuated, which for pitch control is in the tail section aft of the rear pressure bulkhead, and the fire had not compromised the electrical cabling to the actuators.
- The PF was not fully aware of the extent of the control limitations, could not see the EICAS messages and was not aware of all of the systems failures.
- The Captain called for the smoke evacuation handle to be pulled as the smoke accumulated in the cockpit. The smoke evacuation handle when pulled opens a port in the cockpit roof, which if the smoke is sustained and continuous, will draw smoke through the cockpit as the pressure is reduced by the open port venturi effect compounding the problem. The smoke evacuation handle remained open for the remainder of the flight.
- There are several instances of checklist interruption at critical times at the beginning of the emergency. The speed and quick succession of the cascading failures task saturated the crew. The smoke in the cockpit, combined with the communications problems further compounded the difficult CRM environment. With the incapacitation of the captain, the situation in the cockpit became extremely difficult to manage.
- One factor when dealing with the QRH and running checklists is that the B747 does not have a hot microphone function. This caused increasing difficulty managing cascading failures and high workload.
- The crew was unable to complete the Fire Main Deck checklist. The aircraft was not leveled off at 25,000 ft. Directly descending to the 10,000 ft may have exacerbated fire and smoke problem due to the extra available oxygen.
- The Captain instructed the F.O. to input DXB RWY12L into the FMC. This action was completed with difficulty due to the smoke. There was no verbal confirmation of the task completion, however, the the aircraft receivers detected the DXB Runway 12L glide slope beam when approaching Dubai.
- Captain made a comment mentioning the high cockpit temperature, almost immediately the Captains oxygen supply abruptly stopped without warning, this occurred seven minutes six seconds after the first Main Deck Fire Warning.
- The Captain’s inability to get oxygen through his mask was possibly the result of the oxygen hose failure near the connector. The high thermal loading was conducted through the supplementary oxygen stainless steel supply lines heating the supplementary oxygen directly affecting the flexible hose connector causing the oxygen supply line to fail.
- Systems analysis indicates that the oxygen supply is pressure fed, therefore venting oxygen could be released by a failed oxygen hose which could then discharge until the oxygen line fails or the oxygen supply is depleted.
- The Captain requests oxygen from the F.O. several times over approximately one minute. The First Officer due to possible task saturation was not able to assist the Captain.
- The oxygen requirement of the Captain became critical, the Captain removes the oxygen mask and separate smoke goggles and leaves the seat to look for the supplementary oxygen. The Captain did not return. The Captain was in distress locating the supplementary oxygen bottle and could not locate it before being overcome by the fumes.
- The Captain was incapacitated for the remainder of the flight. A post-mortem examination of the Captain indicates that the cause of death was due to carbon monoxide inhalation.
- A full face emergency oxygen supply is available in the cockpit. Oronasal masks are available in the lavatory, jump seat area and crew bunk area.
- Due to the Captain’s incapacitation the F.O became P.F. for the remainder of the flight, operating in a single pilot environment. Exposure to this type of environment in a controlled training environment could have been advantageous to the remaining crew member.
- The FO had breathing difficulties as the aircraft descended as the normal mode function of the mask supplies oxygen at a ratio to atmospheric, ambient air. The amount of oxygen supplied was proportional to the cabin altitude.
- The cockpit environment remained full of smoke in the cockpit, from a continuous source near and contiguous with the cockpit area for the duration of the flight.
- As the flight returned towards DXB, the crew were out of VHF range with BAE-C and should have changed VHF frequencies to the UAE FIR frequency 132.15 for the Emirates Area Control Center [EACC]. Due to the smoke in the cockpit the PF could not view the audio control panels to change the frequency selection for the duration of the flight.
- The flight remained on the Bahrain frequency 132.12 MHz on the left hand VHF ACP for the duration of the flight. To solve the direct line of communication problem, BAE-C requested traffic in the vicinity to relay communication between crew and BAE-C.
- The PF made a blind Mayday call on 121.5 MHz at 15:21 UTC.
- The PF had to relay all VHF communication through other aircraft. The radio communication relay between the PF, the relay aircraft and the ANS stations resulted in confusion communicating the nature and intent of the PF’s request for information with the required level of urgency.
- The PF requested from the relay aircraft immediate vectors to the nearest airport, radar guidance, speed, height and other positional or spatial information on numerous occasions to gauge the aircraft’s position relative to the aerodrome and the ground due to the persistent and continuous smoke in the cockpit.
- The relay aircraft did not fully comprehend or communicate to the BAE-C controller the specific nature of the emergency and assistance required, particularly towards the end of the event sequence.
- There was a multi-stage process to complete a standard request for information between the accident flight and the destination aerodrome via the relay aircraft and the ATCU.
- The flight crew did not or could not enter the transponder emergency code 7700, however, all ATCUs were aware that the airplane was in an emergency status.
- DXB controllers were aware that the flight was in an emergency status, however, were not aware of the specific nature of the emergency or assistance required, due to the complex nature of the relayed communications.
- There was no radar data sharing from the UAE to Bahrain ATC facilities. Bahrain had a direct feed that goes to the UAE but there was no reciprocal arrangement. This lack of data resulted in the BAE-C ATCO not having radar access the SSR track of the accident flight.
- The ATC facilities are not equipped with tunable transceivers.
- The accident aircraft transmitted on the Guard frequency 121.5 Mhz. The transmissions were not heard by the EACC or DXB ATC planners due to the volume of the 121.5 Mhz frequency being in a low volume condition.
- The PF did not respond to any of the calls from the ACC or the relay aircraft on 121.5 MHz, which were audible on the CVR, after the Mayday transmission.
- During the periods when direct radio communications between the pilot flying and the controllers were established, there was no negative effect. Therefore it is likely that if direct, 121.5, contact had been established the communications task could have been simplified.
- The relay aircraft handoff between successive aircraft caused increasing levels of frustration and confusion to the PF.
- All Dubai aerodrome approach aids and lighting facilities were operating normally at the time of the accident.
- There is no requirement for full immersion smoke, fire, fumes cockpit training for flight crews.
- The PF selected the landing gear handle down. The landing gear did not extend, likely due to loss of cable tension.
- The flaps extended to 20°. This limited the auto throttle power demand based on the max flap extension placard speed at 20° Flaps.
- The PF was in radio contact with a relay aircraft, who advised the PF through BAE-C that Sharjah airport was available, and a left-hand turn onto a heading of 095° was required.
- The PF made an input of 195° into the MCP for an undetermined reason when 095° was provided. The aircraft overbanked to the right, generating a series of audible alerts. It is probable that the PF, in the absence of peripheral visual clues, likely became spatially disorientated by this abrupt maneuver.
- The aircraft acquired 195°, the AP was selected off. The throttle was retarded and the aircraft began a rapid descent.
- The PF was unaware of the large urban area directly in the airplane’s path. The aircraft began a descent without a defined landing area ahead.
- Spatial disorientation, vestibular/somatogyral illusion due to unreliable or unavailable instruments or external visual references are a possibility. The PF was unaware of the aircraft location spatially. The PF may have been attempting an off-airfield landing, evidenced by numerous control column inputs.
- The control column inputs to the elevators had a limited effect on the descent profile. The pilot made a series of rapid column inputs, in response to GPWS warnings concerning the sink rate and terrain. The inputs resulted in pitch oscillations where the elevator response decreased rapidly at the end of the flight
- The available manual control of pitch attitude was minimal, the control column was fully aft when the data ends, there was insufficient trailing edge up [nose up] elevator to arrest the nose down pitch. Control of the aircraft was lost in flight followed by an uncontrolled descent into terrain.
- The aircraft was not equipped with an alternative viewing system to allow the pilot(s) to view the instruments and panels in the smoke filled environment.
Causes are actions, omissions, events, conditions, or a combination thereof, which led to this accident.
- A large fire developed in palletized cargo on the main deck at or near pallet positions 4 or 5, in Fire Zone 3, consisting of consignments of mixed cargo including a significant number of lithium type batteries and other combustible materials. The fire escalated rapidly into a catastrophic uncontained fire.
- The large, uncontained cargo fire, that originated in the main cargo deck caused the cargo compartment liners to fail under combined thermal and mechanical loads.
- Heat from the fire resulted in the system/component failure or malfunction of the truss assemblies and control cables, directly affecting the control cable tension and elevator function required for the safe operation of the aircraft when in manual control.
- The uncontained cargo fire directly affected the independent critical systems necessary for crew survivability. Heat from the fire exposed the supplementary oxygen system to extreme thermal loading, sufficient to generate a failure. This resulted in the oxygen supply disruption leading to the abrupt failure of the Captain’s oxygen supply and the incapacitation of the captain.
- The progressive failure of the cargo compartment liner increased the area available for the smoke and fire penetration into the fuselage crown area.
- The rate and volume of the continuous toxic smoke, contiguous with the cockpit and supernumerary habitable area, resulted in inadequate visibility in the cockpit, obscuring the view of the primary flight displays, audio control panels and the view outside the cockpit which prevented all normal cockpit functioning.
- The shutdown of PACK 1 for unknown reasons resulted in loss of conditioned airflow to the upper deck causing the Electronic Equipment Cooling [EEC] system to reconfigure to “closed loop mode”. The absence of a positive pressure differential contributed to the hazardous quantities of smoke and fumes entering the cockpit and upper deck, simultaneously obscuring the crew’s view and creating a toxic environment.
- The fire detection methodology of detecting smoke sampling as an indicator of a fire is inadequate as pallet smoke masking can delay the time it takes for a smoke detection system to detect a fire originating within a cargo container or a pallet with a rain cover.
Contributing factors. Actions, omissions, events, conditions, or a combination thereof, which, if eliminated, avoided or absent, would have reduced the probability of the accident or incident occurring, or mitigated the severity of the consequences of the accident or incident.
The identification of contributing factors does not imply the assignment of fault or the determination of administrative, civil or criminal liability.
- There is no regulatory FAA requirement in class E cargo compartments for active fire suppression.
- Freighter main deck class E fire suppression procedures which rely on venting airflow and depressurisation as the primary means of controlling a fire are not effective for large Class E cargo fires involving dangerous goods capable of Class D metal fire combustion.
- No risk assessment had been made for the failure of the cargo compartment liner based on the evolution of cargo logistics and associated cargo content fire threats, cargo hazards and bulk carriage of dangerous goods.
- The regulation standards for passive fire suppression do not adequately address the combined total thermal energy released by current cargo in a large cargo fire and the effect this has on the protection of critical systems.
- FAA and EASA regulatory requirements do not recognize the current total fire risk associated with pallets, pallet covers, and containers as demonstrated by the NTSB/FAA testing.
- Class 9 Hazmat packing regulations do not address the total or potential fire risk that can result from lithium battery heat release during thermal runaway. Although non-bulk specification packaging is designed to contain leaks and protect the package from failure, the packaging for Class 9 does not function to contain thermal release.
- The growth rate of container and pallet fires after they become detectable by the aircraft’s smoke detection system can be extremely fast, precluding any mitigating action and resulting in an overwhelming total energy release and peak energy release rate for a standard fire load that cannot be contained.
- The course to return to Dubai required a series of complex radio communication relays due to the Pilot Flying’s inability to view and tune the radio transceivers.
- The relay communication between the Pilot Flying, relay aircraft, and the various ATC stations resulted in communication confusion, incomplete, and delayed communications, which contributed to the escalated workload and task saturation for the Pilot Flying.
- The Fire Main Deck non-normal checklist in the QRH was not fully completed by the crew or adhered to regarding the fire suppression flight level or land at nearest airport instruction.
- Task saturation due to smoke and multiple systems failures prevented effective use of the checklist by the crew.
- Communications between the ATCO units involved multiple stages of information exchange by landline and the destination aerodrome was not fully aware of the specific nature of the emergency, the difficulty that the Pilot Flying was experiencing or the assistance required.
- The Pilot Flying had not selected transponder code 7700, the emergency code when radio communication with the destination aerodrome was not established.
Advisory Note: In Section 2 of the full final report, Analysis, reference is made to the FAA CFR14 regulations, so, for those Safety Recommendations addressed both to FAA and EASA, they are written as follows: “FAA in co-operation (or in coordination) with EASA to”. In this case, FAA will act as the focal point and as the responsible authority for replying to the Safety Recommendations, which will be coordinated with EASA.
Based on the findings of the investigation, 36 Safety Recommendations were produced: 25 directed to FAA and EASA, 1 to NTSB, FAA, and EASA, 7 to ICAO, 3 to GCAA. To read more about these Safety Recommendations, please refer to the full final report.
- United Arab Emirates General Civil Aviation Authority Accident Investigation Sector, Air Accident Investigation Report:Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent Into Terrain. Boeing 747-44AF. N571UP. Dubai, United Arab Emirates. 03 September 2010
Captain dead by toxic fumes, FO operating a B744F in a single pilot environment, in a cockpit full of dense smoke blocking the instruments panels and outside view… What an overwhelming, startling and stressful situation! I strongly doubt someone had been trained to face such a situation.
Posts in this blog:
Human Factors in Aviation
- The Organizational Influences behind the aviation accidents & incidents
- Pilot performance in emergencies: why can be so easy, even for experts, to fail
- When the error comes from an expert: The Limits of Expertise
- Normalization of Deviance: when non-compliance becomes the “new normal”
- Why do pilots takeoff with no flaps/slats?
- Multitasking in Complex Operations, a real danger
- Shutting down the wrong engine
- Managing the mission with a crew of… just you!
- Battling the Attraction of Distraction
- Equivalency between sleep loss and blood alcohol concentration
- Unrecoverable deviation from the intended flight path
- Stall Prevention and Recovery
- Loss of flight crew airplane state awareness
- Going around with all engines operating
- Speaking of going around
- The Head-Up Illusion: do you remember it?
- “Before I could intervene, the Flight Attendant pulled up on the handle. The door opened and the slide blew…”
- “To my horror… I unintentionally shut down the number two engine as well….”
- Germanwings: Deliberate flight into terrain.
- Cessna 172M and Sabreliner midair collision on August 16, 2015, final report
- Cessna 150M and a Lockheed Martin F-16CM midair collision. Final report
- See and Be Seen: Your Life Depends on It. NTSB Safety Alert 045 May 2015
- NTSB Issues Safety Alert to Pilots on Midair Collision Prevention. November 2016
- Jetblue A320 engine fire due to the fatigue fracture of a high-pressure turbine stage 2 disk blade
- Uncontained engine failure on American Airlines flight 383, Oct. 28, 2016. Fatigue fracture of a high-pressure turbine stage 2 disk suspected
- Uncontained Cargo Fire fed by Lithium Batteries Leading to 747 fatal accident
- Pilots fatigue lead to a Danish Air Transport ATR 72 serious incident
- Runway Excursion During Landing, Delta Air Lines MD-88, March 5, 2015. Final report
- Going around with no thrust. Emirates B773 accident at Dubai on August 3rd, 2016, interim report
- Flying an A330 with no autopilot, no autothrust, and incomplete navigation systems
- Lessons learned from Northwest Airlines Flight 255
- Spanair DC-9-82 (MD82) accident at Madrid Barajas Airport, on 20 August 2008
- Learning from the past: American Eagle Flight 3379, uncontrolled collision with terrain. Morrisville, North Carolina December 13th, 1994
- Lessons learned from British Midland Flight 92, Boeing B-737-400, January 8, 1989
- TransAsia Airways Flight GE235 accident Final Report
- Risk Assesment: TAP Runway excursion at Aeroporto Internacional de Belém (SBBE), Brasil
- Man-machine interface: KLM E190 hard landing after automatic approach
- EgyptAir A320 Accident Facts
- USAF C130J accident in Afghanistan: the Prospective Memory Failure
- Jakarta collision on runway, Preliminary Report
- LAM E190 over Botswana/Namibia on Nov 29th, 2013, deliberate flight into terrain
- On its 28th anniversary, lessons learned from Aloha flight 243, aircraft registration N73711
- Swiftair MD83 Loss Of Control In-flight final report
- Armavia A320 crash during go-around at night in poor meteorological conditions
- Flydubai accident Interim Report
- Tatarstan B735 crash during go-around at night. Learning from the recent past
- Flydubai accident update
- Germanwings accident final report published
Don’t forget your email address registration to receive instant notifications. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Lots of Human Factors information updated almost every day.