Executive summary
Key investigation outcomes
The ATSB has completed its investigation into the in-flight rupture of a pressurised oxygen cylinder and the resultant aircraft damage and depressurisation. The investigation was prolonged and made significantly more difficult by the evident loss of the failed cylinder from the aircraft during the depressurisation event.
Despite this significant obstacle, the ATSB's investigation has proven successful in highlighting the improbability of the failure event, and has confirmed the safety of current systems and procedures relating to the provision of emergency supplemental oxygen for passengers and crew of pressurised aircraft.
The investigation found no record of any other related instances of aviation oxygen cylinder rupture (civil or military). Given the widespread and long-term use of this type of cylinder in aerospace applications, it was clear that this occurrence was a very rare event.
A comprehensive program of testing and evaluation of cylinders of the same type, and from the same production batch as the failed item, did not identify any aspect of the cylinder design or manufacture that could represent a threat to the operational integrity of the cylinders. Published maintenance procedures were found to be valid and thorough, and inspection regimes appropriate.
In light of these findings, it is the ATSB's view that passengers, crew and operators of aircraft fitted with DOT3HT-1850 oxygen cylinders, can be confident that the ongoing risk of cylinder failure and consequent aircraft damage remains very low.
Summary of the occurrence
On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft, registered VH-OJK, departed Hong Kong International Airport on a scheduled passenger transport flight to Melbourne, Australia (flight number QF30). Aboard the aircraft were 350 passengers, 16 cabin crew and three flight crew.
Approximately 55 minutes after departure and while the aircraft was cruising at 29,000 ft (FL290), a very loud bang was heard by passengers and crew, followed immediately by the rapid depressurisation of the cabin. Many of the cabin crew reported feeling air moving and seeing light debris flying about. Oxygen masks dropped from the overhead compartments and the cabin crew reported that while most passengers began using them appropriately, some passengers had to be given immediate and direct instruction to use their masks. All cabin crew moved to crew seats or spare passenger seats and commenced using oxygen as emergency procedures dictated. At the time of the depressurisation, the aircraft was over the South China Sea, approximately 475 km to the north-west of Manila, Philippines.
The flight crew reported the initial event as a 'loud bang or cracking sound', with an associated jolt felt through the airframe. The autopilot immediately disengaged and multiple alert messages were displayed on monitoring instrumentation. The flight crew reported that upon noting a cabin altitude warning, they immediately donned oxygen masks and began executing the appropriate emergency procedures. A 'MAYDAY' radio call was made and an emergency descent initiated.
At 1024 local time, the aircraft reached and was levelled at an altitude of 10,000 ft, where the use of supplementary oxygen was no longer required. The flight crew cleared the cabin crew to 'commence follow-up duties' and after a review of the aircraft's position, commenced preparation for a diversion to Ninoy Aquino International Airport, Manila. Despite the apparent failure of multiple aircraft systems, the flight crew reported that the descent and approach into Manila was uneventful, and the aircraft landed safely on runway 06 at 1111 local time. Airport emergency services attended and inspected the aircraft after it was stopped on the runway; after which it was cleared for towing to the terminal and passenger disembarkation. None of the passengers or crew on board the aircraft had been physically injured during the event.
Summary of the investigation
From an inspection of the aircraft by engineering staff and investigators from the Australian Transport Safety Bureau (ATSB), it was evident that the aircraft's fuselage ruptured over an area measuring approximately 2 x 1.5 m (6.6 x 4.9 ft) and located immediately forward of the right wing leading edge transition. Fuselage materials, wiring and cargo from the aircraft's forward hold were protruding from the rupture. Further investigation determined that the fuselage rupture had, in itself, been induced by the forceful bursting of one of a bank of seven oxygen cylinders located along the right side of the cargo hold. Those cylinders (with an additional six located above the hold) provided the passengers' emergency supplementary oxygen supply. An analysis of the damage produced by the ruptured cylinder showed that the force of the failure had projected the cylinder vertically upward into the aircraft's cabin, where it had impacted the R2 door frame, handle and the overhead panelling and structure, before presumably falling to the cabin floor and being swept out of the aircraft during the depressurisation. No part of the cylinder body was located within the aircraft, despite a thorough search.
The operator's records showed the failed oxygen cylinder (S/N: 535657) was manufactured in January 1996, and had been subsequently inspected and re-qualified on four subsequent occasions (at 3-yearly intervals). The last inspection had been conducted on 26 May 2008; approximately 8 weeks before the in-flight failure.
In the absence of the failed cylinder, the ATSB undertook a comprehensive failure modes and effects analysis (FMEA), utilising the information known about the cylinder design and service history. Five key possibilities arose as factors that may have contributed to the cylinder failure:
- the cylinder contained a manufacturing flaw that subsequently developed during service
- the cylinder was critically damaged at some time before the last overhaul and inspection
- the cylinder was critically damaged during the last overhaul and inspection
- the cylinder was critically damaged at some time after the last overhaul and inspection
- the cylinder was critically damaged during the accident flight.
Each of the factors was explored in depth, using all available evidence and knowledge to assess the likelihood of the factor being associated with the cylinder failure. To add to the available evidence and understanding of the cylinder characteristics, an engineering examination and test program was conducted using 20 similar oxygen cylinders, including the remaining 12 from on board the aircraft and five that were sourced (with the assistance of the aircraft manufacturer) from the failed item's production batch. The objectives of the program were to determine whether there was any aspect of the cylinder design (including materials and methods of manufacture) that could predispose the items to premature failure while in-service, and to assess whether there was any aspect of the particular production batch of cylinders that had an inherent flaw or weakness.
In summary, the investigation found that the manner of cylinder failure was unusual and implicated the presence of a defect, or action of a mechanism that directly led to the rupture event. However, despite the extensive exploration of the available evidence and the study of multiple hypothetical scenarios, the investigation was unable to identify any particular factor or factors that could, with any degree of probability, be associated with the cylinder failure event.
Despite the inconclusive outcome of the investigation as to contributing factors, the associated engineering study did confirm that the cylinder type was fit-for-purpose. There was no individual or broad characteristic of the cylinders that was felt to be a threat to the safety or airworthiness of the design. Similarly, there was no aspect of the batch of cylinders produced with the failed item, which deviated from the type specification, or provided any indication of the increased potential for the existence of an injurious flaw or defect within that particular production lot.
The validity and efficacy of the component maintenance procedures and practices prescribed for the oxygen cylinders were examined and substantiated; as were the procedures, practices and facilities employed by the operator for the periodic inspection and re-certification of the cylinders. The investigation found no evidence that maintenance of the cylinder (or associated aircraft systems) was a factor in the occurrence.
Safety action stemming from this event centred on ensuring that oxygen cylinder handling and maintenance procedures are optimal; that flight and cabin crew are suitably prepared for efficient management of a depressurisation situation; and that passengers are clearly and succinctly informed of their responsibilities and likely experiences during a situation that requires the use of the cabin oxygen masks.
