On 27 August 2008 at 1238 Eastern Standard Time, a solo student pilot in a Cessna Aircraft Company A150M aircraft, registered VH-UPY (UPY), and a student pilot and instructor in a Piper Aircraft Corp PA-28-161 aircraft, registered VH-CGT (CGT), were flying about 3 km north-west of Moorabbin Aerodrome, Victoria.

The pilot of UPY conducted a touch-and-go on runway 31 left (31L) at Moorabbin as CGT was entering the control zone from the north-west at 1,000 ft above mean sea level (AMSL) to join the circuit on left downwind for runway 31L. As CGT approached the circuit pattern, the student pilot saw UPY, very close and climbing from his left on a collision course and took avoiding action. However, the two aircraft collided, resulting in UPY colliding with terrain and fatal injuries to the solo student pilot.

In the time leading up to the collision, the air traffic controller workload had been high and relevant traffic information was not issued to the pilots in sufficient time to assist self‑separation. The investigation identified that the design of the then Moorabbin Aerodrome General Aviation Aerodrome Procedures (GAAP) airspace did not provide lateral or vertical separation between traffic flows, and that this increased the risk of a midair collision. In addition, Airservices Australia (Airservices) had not acted on a number of internal recommendations to manage a gradual increase in operations at Moorabbin.

As a result of this investigation, Airservices have undertaken a review of their internal processes for reviewing safety performance. In addition, as a result of a number of midair collisions in the vicinity of GAAP aerodromes, the Civil Aviation Safety Authority (CASA) undertook several reviews of GAAP leading to improved training procedures and, as an interim measure, restrictions on the number of aircraft in the circuit. On 3 June 2010, CASA implemented Class D airspace procedures at all GAAP aerodromes throughout Australia.

VH-UPY/VH-CGT response to the Coroner

The ATSB notes that the Victorian State Coroner, Judge Ian L Gray has recently released findings and, subsequently, amended findings  into the death of the pilot of VH-UPY without holding an inquest. The Coroner’s findings largely adopt the findings made by the ATSB in its report published on 31 May 2011.

Circumstances of the accident

The pilot of VH-UPY conducted a touch-and-go on runway 31 left (31L) at Moorabbin as VH-CGT was entering the control zone from the north-west. As VH-CGT approached the circuit pattern, the pilot of VH-CGT saw VH-UPY, very close and climbing from his left on a collision course, and took avoiding action. However, the two aircraft collided, resulting in VH-UPY colliding with terrain and fatal injuries to its pilot.

ATSB Findings

In terms of Contributory Safety Factors the ATSB found that the occupants of VH-UPY and VH-CGT did not see each other in time to prevent the collision. Further, relevant traffic information was not provided to either aircraft by the aerodrome controller who had been operating in a high workload environment in the period leading up to the midair collision which increased the risk of information not being able to be provided to flight crews. The ATSB also found that the risk of midair collision was increased by the Moorabbin Aerodrome General Aviation Aerodrome Procedures airspace design that did not assure lateral or vertical separation.

Other safety factors

Before the collision, the provision of relevant traffic information to pilots was sometimes incorrect or late. There was no evidence of any action taken by Airservices Australia to address safety recommendations related to a review of key performance indicators of General Aviation Aerodrome Procedure airspace operations. The student pilot of VH-UPY had not yet demonstrated an ability to operate safely in a busy circuit environment and his flight instructor did not provide any guidance to the student in the situation where the circuit activity changed during the solo flight. The ATSB determined, however, that the evidence did not demonstrate that the lack of supervision contributed to the development of the accident. The Coroner accepted that finding and while he considered that the lack of supervision may have been a contributing factor noted that the degree of contribution was indeterminate. The ATSB notes that for a matter to be a contributory safety factor for the purpose of ATSB investigations there must be a probability of at least 67 per cent. 

The Coroner noted, however, that corrective actions had rectified deficiencies in the supervision of student and supervising pilots and reduced the risk of future events.

Other key findings

There was no indication of any communication difficulties that could be attributed to the use and comprehension of English by the pilots or controllers involved. There was no indication of any significant factor in either student’s training that may have increased the likelihood of a midair collision.

Submissions

The ATSB made submissions to assist the coronial investigation. The Coroner was satisfied that the circumstances of the accident were thoroughly investigated and considered by the ATSB. The Coroner also noted that the ATSB had conducted a thorough review of all Loss of Separation Incidents for the period January 2008 to June 2012 resulting in observations, recommendations and safety messages.

ATSB investigations and coronial investigations

Coronial investigations are separate to ATSB investigations. In this matter the respective authorities are largely in accord as to the factors that contributed to the development of the accident.

The ATSB's report can be downloaded by clicking on the link:  ATSB Report

The Coroner's report can be obtained from the Coroner's Court of Victoria. Contact details are available at: www.coronerscourt.vic.gov.au/home. Queries regarding the Coroner's findings should be directed to the Coroner's Court of Victoria.

Preliminary report released 29 August 2008

On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft (registered VH-OJK) with 365 persons on board, departed Hong Kong International airport on a scheduled passenger transport flight to Melbourne, Australia. Approximately 55 minutes into the flight, while the aircraft was cruising at 29,000 ft (FL290), a loud bang was heard by passengers and crew, followed by the rapid depressurisation of the cabin. Oxygen masks dropped from the overhead compartments shortly afterward, and it was reported that most passengers and crew commenced using the masks. After donning their own oxygen masks, the flight crew carried out the 'cabin altitude non-normal' checklist items and commenced a descent to a lower altitude, where supplemental breathing oxygen would no longer be required. A MAYDAY distress radio call was made on the regional air traffic control frequency. After levelling the aircraft at 10,000 ft, the flight crew diverted to Ninoy Aquino International Airport, Manila, where an uneventful visual approach and landing was made. The aircraft was stopped on the runway for an external inspection, before being towed to the terminal for passenger disembarkation.

Subsequent inspection of the aircraft by the operator's personnel and ATSB investigators, revealed an inverted T-shaped rupture in the lower right side of the fuselage, immediately beneath the wing leading edge-to-fuselage transition fairing (which had been lost during the event). Items of wrapped cargo were observed partially protruding from the rupture, which extended for approximately 2 metres along the length of the aircraft and 1.5 metres vertically.

After clearing the baggage and cargo from the forward aircraft hold, it was evident that one passenger oxygen cylinder (number-4 from a bank of seven cylinders along the right side of the cargo hold) had sustained a sudden failure and forceful discharge of its pressurised contents into the aircraft hold, rupturing the fuselage in the vicinity of the wing-fuselage leading edge fairing. The cylinder had been propelled upward by the force of the discharge, puncturing the cabin floor and entering the cabin adjacent to the second main cabin door. The cylinder had subsequently impacted the door frame, door handle and overhead panelling, before falling to the cabin floor and exiting the aircraft through the ruptured fuselage.

Interim Factual report No.2 released 17 November 2009

The following report is provided as an update on the Australian Transport Safety Bureau's (ATSB's) investigation into the depressurisation of a Boeing Company 747-438 aircraft while en-route from Hong Kong to Melbourne, Australia on 25 July 2008. It is intended that this report be read together with the Preliminary Investigation Report published in August 2008 and the first Interim Factual Report, published in March 2009.

This second interim report provides a summary of factual information that has been derived from the continuing investigation of this occurrence. As the investigation is ongoing, readers are cautioned that there is the possibility that new evidence may become available that alters the circumstances as depicted in this report.

Key investigation outcomes

The ATSB has completed its investigation into the in-flight rupture of a pressurised oxygen cylinder and the resultant aircraft damage and depressurisation. The investigation was prolonged and made significantly more difficult by the evident loss of the failed cylinder from the aircraft during the depressurisation event.

Despite this significant obstacle, the ATSB's investigation has proven successful in highlighting the improbability of the failure event, and has confirmed the safety of current systems and procedures relating to the provision of emergency supplemental oxygen for passengers and crew of pressurised aircraft.

The investigation found no record of any other related instances of aviation oxygen cylinder rupture (civil or military). Given the widespread and long-term use of this type of cylinder in aerospace applications, it was clear that this occurrence was a very rare event.

A comprehensive program of testing and evaluation of cylinders of the same type, and from the same production batch as the failed item, did not identify any aspect of the cylinder design or manufacture that could represent a threat to the operational integrity of the cylinders. Published maintenance procedures were found to be valid and thorough, and inspection regimes appropriate.

In light of these findings, it is the ATSB's view that passengers, crew and operators of aircraft fitted with DOT3HT-1850 oxygen cylinders, can be confident that the ongoing risk of cylinder failure and consequent aircraft damage remains very low.

Summary of the occurrence

On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft, registered VH-OJK, departed Hong Kong International Airport on a scheduled passenger transport flight to Melbourne, Australia (flight number QF30). Aboard the aircraft were 350 passengers, 16 cabin crew and three flight crew.

Approximately 55 minutes after departure and while the aircraft was cruising at 29,000 ft (FL290), a very loud bang was heard by passengers and crew, followed immediately by the rapid depressurisation of the cabin. Many of the cabin crew reported feeling air moving and seeing light debris flying about. Oxygen masks dropped from the overhead compartments and the cabin crew reported that while most passengers began using them appropriately, some passengers had to be given immediate and direct instruction to use their masks. All cabin crew moved to crew seats or spare passenger seats and commenced using oxygen as emergency procedures dictated. At the time of the depressurisation, the aircraft was over the South China Sea, approximately 475 km to the north-west of Manila, Philippines.

The flight crew reported the initial event as a 'loud bang or cracking sound', with an associated jolt felt through the airframe. The autopilot immediately disengaged and multiple alert messages were displayed on monitoring instrumentation. The flight crew reported that upon noting a cabin altitude warning, they immediately donned oxygen masks and began executing the appropriate emergency procedures. A 'MAYDAY' radio call was made and an emergency descent initiated.

At 1024 local time, the aircraft reached and was levelled at an altitude of 10,000 ft, where the use of supplementary oxygen was no longer required. The flight crew cleared the cabin crew to 'commence follow-up duties' and after a review of the aircraft's position, commenced preparation for a diversion to Ninoy Aquino International Airport, Manila. Despite the apparent failure of multiple aircraft systems, the flight crew reported that the descent and approach into Manila was uneventful, and the aircraft landed safely on runway 06 at 1111 local time. Airport emergency services attended and inspected the aircraft after it was stopped on the runway; after which it was cleared for towing to the terminal and passenger disembarkation. None of the passengers or crew on board the aircraft had been physically injured during the event.

Summary of the investigation

From an inspection of the aircraft by engineering staff and investigators from the Australian Transport Safety Bureau (ATSB), it was evident that the aircraft's fuselage ruptured over an area measuring approximately 2 x 1.5 m (6.6 x 4.9 ft) and located immediately forward of the right wing leading edge transition. Fuselage materials, wiring and cargo from the aircraft's forward hold were protruding from the rupture. Further investigation determined that the fuselage rupture had, in itself, been induced by the forceful bursting of one of a bank of seven oxygen cylinders located along the right side of the cargo hold. Those cylinders (with an additional six located above the hold) provided the passengers' emergency supplementary oxygen supply. An analysis of the damage produced by the ruptured cylinder showed that the force of the failure had projected the cylinder vertically upward into the aircraft's cabin, where it had impacted the R2 door frame, handle and the overhead panelling and structure, before presumably falling to the cabin floor and being swept out of the aircraft during the depressurisation. No part of the cylinder body was located within the aircraft, despite a thorough search.

The operator's records showed the failed oxygen cylinder (S/N: 535657) was manufactured in January 1996, and had been subsequently inspected and re-qualified on four subsequent occasions (at 3-yearly intervals). The last inspection had been conducted on 26 May 2008; approximately 8 weeks before the in-flight failure.

In the absence of the failed cylinder, the ATSB undertook a comprehensive failure modes and effects analysis (FMEA), utilising the information known about the cylinder design and service history. Five key possibilities arose as factors that may have contributed to the cylinder failure:

• the cylinder contained a manufacturing flaw that subsequently developed during service
• the cylinder was critically damaged at some time before the last overhaul and inspection
• the cylinder was critically damaged during the last overhaul and inspection
• the cylinder was critically damaged at some time after the last overhaul and inspection
• the cylinder was critically damaged during the accident flight.

Each of the factors was explored in depth, using all available evidence and knowledge to assess the likelihood of the factor being associated with the cylinder failure. To add to the available evidence and understanding of the cylinder characteristics, an engineering examination and test program was conducted using 20 similar oxygen cylinders, including the remaining 12 from on board the aircraft and five that were sourced (with the assistance of the aircraft manufacturer) from the failed item's production batch. The objectives of the program were to determine whether there was any aspect of the cylinder design (including materials and methods of manufacture) that could predispose the items to premature failure while in-service, and to assess whether there was any aspect of the particular production batch of cylinders that had an inherent flaw or weakness.

In summary, the investigation found that the manner of cylinder failure was unusual and implicated the presence of a defect, or action of a mechanism that directly led to the rupture event. However, despite the extensive exploration of the available evidence and the study of multiple hypothetical scenarios, the investigation was unable to identify any particular factor or factors that could, with any degree of probability, be associated with the cylinder failure event.

Despite the inconclusive outcome of the investigation as to contributing factors, the associated engineering study did confirm that the cylinder type was fit-for-purpose. There was no individual or broad characteristic of the cylinders that was felt to be a threat to the safety or airworthiness of the design. Similarly, there was no aspect of the batch of cylinders produced with the failed item, which deviated from the type specification, or provided any indication of the increased potential for the existence of an injurious flaw or defect within that particular production lot.

The validity and efficacy of the component maintenance procedures and practices prescribed for the oxygen cylinders were examined and substantiated; as were the procedures, practices and facilities employed by the operator for the periodic inspection and re-certification of the cylinders. The investigation found no evidence that maintenance of the cylinder (or associated aircraft systems) was a factor in the occurrence.

Safety action stemming from this event centred on ensuring that oxygen cylinder handling and maintenance procedures are optimal; that flight and cabin crew are suitably prepared for efficient management of a depressurisation situation; and that passengers are clearly and succinctly informed of their responsibilities and likely experiences during a situation that requires the use of the cabin oxygen masks.