On 25 July 2008, a Boeing Company 747-438 aircraft carrying 369 passengers and crew rapidly depressurised following the forceful rupture of one of the aircraft's emergency oxygen cylinders in the forward cargo hold. The aircraft was cruising at 29,000 ft and was 55 minutes into a flight between Hong Kong and Melbourne.

Following an emergency descent to 10,000 ft, the flight crew diverted the aircraft to Ninoy Aquino International Airport, Manila, Philippines, where it landed safely. None of the passengers or crew sustained any physical injury.

A team of investigators, led by the Australian Transport Safety Bureau (ATSB) and including representatives from the US National Transportation Safety Board (NTSB), the US Federal Aviation Authority (FAA), Boeing and the Civil Aviation Authority of the Philippines (CAAP) examined the aircraft on the ground in Manila. From that work, it was evident that the oxygen cylinder (number-4 in a bank along the right side of the forward cargo hold) had burst in such a way as to rupture the adjacent fuselage wall and be propelled upwards; puncturing the cabin floor and impacting the frame and handle of the R2 door and the overhead cabin panelling. No part of the cylinder (other than the valve assembly) was recovered and it was presumed lost from the aircraft during the depressurisation.

The ATSB undertook a close and detailed study of the cylinder type, including a review of all possible failure scenarios and an engineering evaluation of other cylinders from the same production batch and of the type in general. It was evident that the cylinder had failed by bursting through, or around the base - allowing the release of pressurised contents to project it vertically upwards. While it was hypothesised that the cylinder may have contained a defect or flaw, or been damaged in a way that promoted failure, there was no evidence found to support such a finding. Nor was there any evidence found to suggest the cylinders from the subject production batch, or the type in general, were in any way predisposed to premature failure.

Several minor safety issues and areas for potential safety improvement identified during the flight operations and cabin safety investigations have been addressed by the operator's safety action, or were the subject of safety advisory notices (SAN's) issued by the ATSB

Executive summary

Key investigation outcomes

The ATSB has completed its investigation into the in-flight rupture of a pressurised oxygen cylinder and the resultant aircraft damage and depressurisation. The investigation was prolonged and made significantly more difficult by the evident loss of the failed cylinder from the aircraft during the depressurisation event.

Despite this significant obstacle, the ATSB's investigation has proven successful in highlighting the improbability of the failure event, and has confirmed the safety of current systems and procedures relating to the provision of emergency supplemental oxygen for passengers and crew of pressurised aircraft.

The investigation found no record of any other related instances of aviation oxygen cylinder rupture (civil or military). Given the widespread and long-term use of this type of cylinder in aerospace applications, it was clear that this occurrence was a very rare event.

A comprehensive program of testing and evaluation of cylinders of the same type, and from the same production batch as the failed item, did not identify any aspect of the cylinder design or manufacture that could represent a threat to the operational integrity of the cylinders. Published maintenance procedures were found to be valid and thorough, and inspection regimes appropriate.

In light of these findings, it is the ATSB's view that passengers, crew and operators of aircraft fitted with DOT3HT-1850 oxygen cylinders, can be confident that the ongoing risk of cylinder failure and consequent aircraft damage remains very low.

Summary of the occurrence

On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft, registered VH-OJK, departed Hong Kong International Airport on a scheduled passenger transport flight to Melbourne, Australia (flight number QF30). Aboard the aircraft were 350 passengers, 16 cabin crew and three flight crew.

Approximately 55 minutes after departure and while the aircraft was cruising at 29,000 ft (FL290), a very loud bang was heard by passengers and crew, followed immediately by the rapid depressurisation of the cabin. Many of the cabin crew reported feeling air moving and seeing light debris flying about. Oxygen masks dropped from the overhead compartments and the cabin crew reported that while most passengers began using them appropriately, some passengers had to be given immediate and direct instruction to use their masks. All cabin crew moved to crew seats or spare passenger seats and commenced using oxygen as emergency procedures dictated. At the time of the depressurisation, the aircraft was over the South China Sea, approximately 475 km to the north-west of Manila, Philippines.

The flight crew reported the initial event as a 'loud bang or cracking sound', with an associated jolt felt through the airframe. The autopilot immediately disengaged and multiple alert messages were displayed on monitoring instrumentation. The flight crew reported that upon noting a cabin altitude warning, they immediately donned oxygen masks and began executing the appropriate emergency procedures. A 'MAYDAY' radio call was made and an emergency descent initiated.

At 1024 local time, the aircraft reached and was levelled at an altitude of 10,000 ft, where the use of supplementary oxygen was no longer required. The flight crew cleared the cabin crew to 'commence follow-up duties' and after a review of the aircraft's position, commenced preparation for a diversion to Ninoy Aquino International Airport, Manila. Despite the apparent failure of multiple aircraft systems, the flight crew reported that the descent and approach into Manila was uneventful, and the aircraft landed safely on runway 06 at 1111 local time. Airport emergency services attended and inspected the aircraft after it was stopped on the runway; after which it was cleared for towing to the terminal and passenger disembarkation. None of the passengers or crew on board the aircraft had been physically injured during the event.

Summary of the investigation

From an inspection of the aircraft by engineering staff and investigators from the Australian Transport Safety Bureau (ATSB), it was evident that the aircraft's fuselage ruptured over an area measuring approximately 2 x 1.5 m (6.6 x 4.9 ft) and located immediately forward of the right wing leading edge transition. Fuselage materials, wiring and cargo from the aircraft's forward hold were protruding from the rupture. Further investigation determined that the fuselage rupture had, in itself, been induced by the forceful bursting of one of a bank of seven oxygen cylinders located along the right side of the cargo hold. Those cylinders (with an additional six located above the hold) provided the passengers' emergency supplementary oxygen supply. An analysis of the damage produced by the ruptured cylinder showed that the force of the failure had projected the cylinder vertically upward into the aircraft's cabin, where it had impacted the R2 door frame, handle and the overhead panelling and structure, before presumably falling to the cabin floor and being swept out of the aircraft during the depressurisation. No part of the cylinder body was located within the aircraft, despite a thorough search.

The operator's records showed the failed oxygen cylinder (S/N: 535657) was manufactured in January 1996, and had been subsequently inspected and re-qualified on four subsequent occasions (at 3-yearly intervals). The last inspection had been conducted on 26 May 2008; approximately 8 weeks before the in-flight failure.

In the absence of the failed cylinder, the ATSB undertook a comprehensive failure modes and effects analysis (FMEA), utilising the information known about the cylinder design and service history. Five key possibilities arose as factors that may have contributed to the cylinder failure:

• the cylinder contained a manufacturing flaw that subsequently developed during service
• the cylinder was critically damaged at some time before the last overhaul and inspection
• the cylinder was critically damaged during the last overhaul and inspection
• the cylinder was critically damaged at some time after the last overhaul and inspection
• the cylinder was critically damaged during the accident flight.

Each of the factors was explored in depth, using all available evidence and knowledge to assess the likelihood of the factor being associated with the cylinder failure. To add to the available evidence and understanding of the cylinder characteristics, an engineering examination and test program was conducted using 20 similar oxygen cylinders, including the remaining 12 from on board the aircraft and five that were sourced (with the assistance of the aircraft manufacturer) from the failed item's production batch. The objectives of the program were to determine whether there was any aspect of the cylinder design (including materials and methods of manufacture) that could predispose the items to premature failure while in-service, and to assess whether there was any aspect of the particular production batch of cylinders that had an inherent flaw or weakness.

In summary, the investigation found that the manner of cylinder failure was unusual and implicated the presence of a defect, or action of a mechanism that directly led to the rupture event. However, despite the extensive exploration of the available evidence and the study of multiple hypothetical scenarios, the investigation was unable to identify any particular factor or factors that could, with any degree of probability, be associated with the cylinder failure event.

Despite the inconclusive outcome of the investigation as to contributing factors, the associated engineering study did confirm that the cylinder type was fit-for-purpose. There was no individual or broad characteristic of the cylinders that was felt to be a threat to the safety or airworthiness of the design. Similarly, there was no aspect of the batch of cylinders produced with the failed item, which deviated from the type specification, or provided any indication of the increased potential for the existence of an injurious flaw or defect within that particular production lot.

The validity and efficacy of the component maintenance procedures and practices prescribed for the oxygen cylinders were examined and substantiated; as were the procedures, practices and facilities employed by the operator for the periodic inspection and re-certification of the cylinders. The investigation found no evidence that maintenance of the cylinder (or associated aircraft systems) was a factor in the occurrence.

Safety action stemming from this event centred on ensuring that oxygen cylinder handling and maintenance procedures are optimal; that flight and cabin crew are suitably prepared for efficient management of a depressurisation situation; and that passengers are clearly and succinctly informed of their responsibilities and likely experiences during a situation that requires the use of the cabin oxygen masks.

Interim Factual report No.2 released 17 November 2009

The following report is provided as an update on the Australian Transport Safety Bureau's (ATSB's) investigation into the depressurisation of a Boeing Company 747-438 aircraft while en-route from Hong Kong to Melbourne, Australia on 25 July 2008. It is intended that this report be read together with the Preliminary Investigation Report published in August 2008 and the first Interim Factual Report, published in March 2009.

This second interim report provides a summary of factual information that has been derived from the continuing investigation of this occurrence. As the investigation is ongoing, readers are cautioned that there is the possibility that new evidence may become available that alters the circumstances as depicted in this report.

Interim Factual No.1 report released 6 March 2009

On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft (registered VH-OJK) with 365 persons on board, departed Hong Kong International airport on a scheduled passenger transport flight to Melbourne, Australia. Approximately 55 minutes into the flight, while the aircraft was cruising at 29,000 ft (FL290), a loud bang was heard by passengers and crew, followed by the rapid depressurisation of the cabin. Oxygen masks dropped from the overhead compartments and it was reported that most passengers and crew commenced using the masks. The flight crew carried out the 'cabin altitude non-normal' checklist items and commenced a descent to a lower altitude. A MAYDAY distress radio call was made on the regional air traffic control frequency. After levelling the aircraft at 10,000 ft, the flight crew diverted to Ninoy Aquino International Airport, Manila, where an uneventful visual approach and landing was made.

Inspection of the aircraft by the operator's personnel and Australian Transport Safety Bureau (ATSB) investigators, revealed a rupture in the lower right side of the fuselage, immediately beneath the wing leading edge-to-fuselage transition fairing. The rupture extended for approximately 2 metres along the length of the aircraft and 1.5 metres vertically. It was evident that one passenger oxygen cylinder (number-4 from a bank of seven cylinders along the right side of the cargo hold) had sustained a sudden failure and forceful discharge of its pressurised contents, rupturing the fuselage and propelling the cylinder upward, puncturing the cabin floor and entering the cabin adjacent to the second main cabin door. The cylinder had impacted the door frame, door handle and overhead panelling, before presumably falling to the cabin floor and exiting the aircraft through the ruptured fuselage, as the cylinder was not located within the aircraft.

In the absence of the failed cylinder, the ATSB, with the assistance of the aircraft manufacturer, has obtained a number of exemplar cylinders from the same production batch. A program of engineering assessments is examining the compliance of the cylinders with the original production specification, the damage tolerance of the design, and the potential mechanism for cylinder failure. To date, the investigation has not identified any verifiable deficiency in the cylinder design. Preliminary analyses
of the cabin safety systems and crew/passenger experiences have indicated that the aircraft oxygen systems had operated satisfactorily, despite the damage sustained during the rupture and depressurisation events.

Preliminary report released 29 August 2008

On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft (registered VH-OJK) with 365 persons on board, departed Hong Kong International airport on a scheduled passenger transport flight to Melbourne, Australia. Approximately 55 minutes into the flight, while the aircraft was cruising at 29,000 ft (FL290), a loud bang was heard by passengers and crew, followed by the rapid depressurisation of the cabin. Oxygen masks dropped from the overhead compartments shortly afterward, and it was reported that most passengers and crew commenced using the masks. After donning their own oxygen masks, the flight crew carried out the 'cabin altitude non-normal' checklist items and commenced a descent to a lower altitude, where supplemental breathing oxygen would no longer be required. A MAYDAY distress radio call was made on the regional air traffic control frequency. After levelling the aircraft at 10,000 ft, the flight crew diverted to Ninoy Aquino International Airport, Manila, where an uneventful visual approach and landing was made. The aircraft was stopped on the runway for an external inspection, before being towed to the terminal for passenger disembarkation.

Subsequent inspection of the aircraft by the operator's personnel and ATSB investigators, revealed an inverted T-shaped rupture in the lower right side of the fuselage, immediately beneath the wing leading edge-to-fuselage transition fairing (which had been lost during the event). Items of wrapped cargo were observed partially protruding from the rupture, which extended for approximately 2 metres along the length of the aircraft and 1.5 metres vertically.

After clearing the baggage and cargo from the forward aircraft hold, it was evident that one passenger oxygen cylinder (number-4 from a bank of seven cylinders along the right side of the cargo hold) had sustained a sudden failure and forceful discharge of its pressurised contents into the aircraft hold, rupturing the fuselage in the vicinity of the wing-fuselage leading edge fairing. The cylinder had been propelled upward by the force of the discharge, puncturing the cabin floor and entering the cabin adjacent to the second main cabin door. The cylinder had subsequently impacted the door frame, door handle and overhead panelling, before falling to the cabin floor and exiting the aircraft through the ruptured fuselage.