Country
Crash of a Boeing 747-44AF near Dubai: 2 killed
Date & Time:
Sep 3, 2010 at 1941 LT
Operator:
Registration:
N571UP
Survivors:
No
Schedule:
Hong Kong - Dubai - Cologne
MSN:
35668/1393
YOM:
2007
Flight number:
UPS006
Crew on board:
2
Crew fatalities:
Pax on board:
0
Pax fatalities:
Other fatalities:
Total fatalities:
2
Captain / Total hours on type:
367.00
Copilot / Total hours on type:
78
Aircraft flight hours:
9977
Aircraft flight cycles:
1764
Circumstances:
The four engine aircraft was completing a cargo flight from Hong Kong to Cologne with an intermediate stop in Dubai with two pilots on board. One minute after passing the BALUS waypoint, approaching the top of climb, as the aircraft was climbing to the selected cruise altitude of 32,000 feet, the Fire Warning Master Warning Light illuminated and the Audible Alarm [Fire Bell] sounded, warning the crew of a fire indication on the Main Deck Fire - Forward. The captain advised BAE-C that there was a fire indication on the main deck of the aircraft, informing Bahrain ATC that they needed to land as soon as possible. BAE-C advised that Doha International Airport (DOH) was at the aircraft’s 10 o’clock position 100 nm DME from the current location. The Captain elected to return to the point of departure, DXB. The crew changed the selected altitude from 32,000 feet to 28,000 feet as the aircraft changed heading back to DXB, the Auto Throttle [AT] began decreasing thrust to start the decent. The AP was manually disconnected, then reconnected , followed by the AP manually disconnecting for a short duration, the captain as handling pilot was manually flying the aircraft. Following the turn back and the activation of the fire suppression, for unknown reasons, the PACK 1 status indicated off line [PACKS 2 and 3 were off], in accordance with the fire arm switch activation. There was no corresponding discussion recorded on the CVR that the crew elected to switch off the remaining active PACK 1. As the crew followed the NNC Fire/Smoke/Fumes checklist and donned their supplemental oxygen masks, there is some cockpit confusion regarding the microphones and the intra-cockpit communication as the crew cannot hear the microphone transmissions in their respective headsets. The crew configured the aircraft for the return to DXB, the flight was in a descending turn to starboard onto the 095° reciprocal heading for DXB when the Captain requested an immediate descent to 10,000 ft. The reason for the immediate descent was never clarified in the available data. The AP was disengaged, the Captain then informed the FO that there was limited pitch control of the aircraft when flying manually. The Captain was manually making inputs to the elevators through the control column, with limited response from the aircraft. The flight was approximately 4 minutes into the emergency. The aircraft was turning and descending, the fire suppression has been initiated and there was a pitch control problem. The cockpit was filling with persistent continuous smoke and fumes and the crew had put the oxygen masks on. The penetration by smoke and fumes into the cockpit area occurred early into the emergency. The cockpit environment was overwhelmed by the volume of smoke. There are several mentions of the cockpit either filling with smoke or being continuously ‘full of smoke’, to the extent that the ability of the crew to safely operate the aircraft was impaired by the inability to view their surroundings. Due to smoke in the cockpit, from a continuous source near and contiguous with the cockpit area [probably through the supernumerary area and the ECS flight deck ducting], the crew could neither view the primary flight displays, essential communications panels or the view from the cockpit windows. The crew rest smoke detector activated at 15:15:15 and remained active for the duration of the flight. There is emergency oxygen located at the rear of the cockpit, in the supernumerary area and in the crew rest area. Due to the persistent smoke the Captain called for the opening of the smoke shutter, which stayed open for the duration of the flight. The smoke remained in the cockpit area. There was a discussion between the crew concerning inputting the DXB runway 12 Left [RWY12L] Instrument Landing System [ILS] data into the FMC. With this data in the FMC the crew can acquire the ILS for DXB RWY12L and configure the aircraft for an auto flight/auto land approach. The F.O. mentions on several occasions difficulty inputting the data based on the reduced visibility. However, the ILS was tuned to a frequency of 110.1 (The ILS frequency for DXB Runway 12L is 110.126), the Digital Flight Data Recorder [DFDR] data indicates that this was entered at 15:19:20 which correlates which the CVR discussion and timing. At approximately 15:20, during the emergency descent at around 21,000ft cabin pressure altitude, the Captain made a comment concerning the high temperature in the cockpit. This was followed almost immediately by the rapid onset of the failure of the Captain’s oxygen supply. Following the oxygen supply difficulties there was confusion regarding the location of the alternative supplementary oxygen supply location. The F.O either was not able to assist or did not know where the oxygen bottle was located; the Captain then gets out of the LH seat. This CVR excerpt indicates the following exchange between the Captain and F.O concerning the mask operation and the alternative oxygen supply bottle location. The exchange begins when the Captain’s oxygen supply stops abruptly with no other indications that the oxygen supply is low or failing. Based on the pathological information, the Captain lost consciousness due to toxic poisoning. After the Captain left the LH cockpit seat, the F.O. assumed the PF role. The F.O. remained in position as P.F. for the duration of the flight. There was no further interaction from the Captain or enquiry by the F.O as to the location of the Captain or the ability of the Captain to respond. The PF informed the BAE-C controllers that due to the limited visibility in the cockpit that it was not possible to change the radio frequency on the Audio Control Panel [ACP]. This visibility comment recurs frequently during the flight. The Bahrain East controller was communicating with the emergency aircraft via relays. Several were employed during the transition back to DXB. The aircraft was now out of effective VHF radio range with BAE-C. In order for the crew to communicate with BAE-C, BAE-C advised transiting aircraft that they would act as a communication relay between BAE-C and the emergency aircraft. BAE-C would then communicate to the UAE controllers managing the traffic in the Emirates FIR via a landline, who would then contact the destination aerodrome at Dubai, also by landline. The crew advised relay aircraft that they would stay on the Bahrain frequency as they could not see the ACP to change frequency. All of the 121.5 MHz transmissions by the PF were keyed via the VHF-R, all other radio communication with BAE-C and the relay aircraft are keyed from the VHF-L audio panel. There are several attempts by the UAE’s Area Control [EACC] to contact the flight on the guard frequency in conjunction with aircraft relaying information transmitting on the guard frequency to the accident flight. The PF of the accident flight does not appear to hear any of the transmissions from the air traffic control units or the relay aircraft on the guard frequency. Around this time, given the proximity of the aircraft to the RWY12L intermediate approach fix, Dubai ATC transmits several advisory messages to the flight on the Dubai frequencies, for example DXB ARR on 124.9 MHz advise that ‘Any runway is available’. The Runway lights for RWY30L were turned on to assist the return to DXB. The Aircraft condition inbound as the flight approached DXB for RWY12L. The computed airspeed was 350 knots, at an altitude of 9,000 feet and descending on a heading of 105° which was an interception heading for the ILS at RWY12L. The FMC was tuned for RWY12L, the PF selected the ‘Approach’ push button on the Mode Control Panel [MCP] the aircraft captures the Glide Slope (G/S). The AP did not transition into the Localizer Mode while the Localizer was armed. ATC, through the relay aircraft advised the PF, ‘you're too fast and too high can you make a 360? Further requesting the PF to perform a ‘360° turn if able’. The PF responded ‘Negative, negative, negative’ to the request. The landing gear lever was selected down at 15:38:00, followed approximately 20 seconds later by an the aural warning alarm indicating a new EICAS caution message, which based on the data is a Landing Gear Disagree Caution. At 15:38:20 the PF says: ‘I have no, uh gear’. Following the over flight of DXB, on passing north of the aerodrome abeam RWY12L. The last Radar contact before the flight passed into the zone of silence was at 15:39:03. The flight was on a heading of 89° at a speed of 320 knots , altitude 4200 feet and descending. The flight was cleared direct to Sharjah Airport (SHJ), SHJ was to the aircraft’s left at 10 nm, the SHJ runway is a parallel vector to RWY12L at DXB. The relay pilot asked the PF if it was possible to perform a left hand turn. This turn, if completed would have established the flight onto an approximate 10 mile final approach for SHJ RWY30. The flight was offered vectors to SHJ (left turn required) and accepts. The relay aircraft advised that SHJ was at 095° from the current position at 10 nm. The PF acknowledged the heading change to 095° for SHJ. For reasons undetermined the PF selected 195° degrees on the Mode Control Panel [MCP], the AP was manually disconnected at 15:40:05, the aircraft then banked to the right as the FMC captured the heading change, rolled wings level on the new heading, the throttles were then retarded, the aircraft entered a descending right hand turn at an altitude of 4000 feet, the speed gradually reduced to 240 kts. The PF made a series of pitch inputs which had a limited effect on the descent profile; the descent is arrested temporarily. There then followed a series of rapid pitch oscillations. These were not phugoid oscillations, these were commanded responses where the elevator effectiveness decreased rapidly as the airspeed decayed and the elevators could not compensate for the reduced thrust moment from the engines to maintain level flight in a steady state. This was due to the desynchronization of the control column inputs and the elevators. At this point had the aircraft remained on the current heading and descent profile it would have intercepted the terrain at or near a large urban conurbation, Dubai Silicone Oasis. The PF was in VHF communication with the relay aircraft requesting positional, speed and altitude information. From this point onwards, approximately 50 seconds elapse prior to the data ending. The effectiveness of the pitch control immediately prior to the end of the data was negligible. The control column was fully aft when the data ended, there was no corresponding elevator movement. The aircraft lost control in flight and made an uncontrolled descent into terrain.
Probable cause:
Probable causes:
- A large fire developed in palletized cargo on the main deck at or near pallet positions 4 or 5, in Fire Zone 3, consisting of consignments of mixed cargo including a significant number of lithium type batteries and other combustible materials. The fire escalated rapidly into a catastrophic uncontained fire.
- The large, uncontained cargo fire, that originated in the main cargo deck caused the cargo compartment liners to fail under combined thermal and mechanical loads.
- Heat from the fire resulted in the system/component failure or malfunction of the truss assemblies and control cables, directly affecting the control cable tension and elevator function required for the safe operation of the aircraft when in manual control.
- The uncontained cargo fire directly affected the independent critical systems necessary for crew survivability. Heat from the fire exposed the supplementary oxygen system to extreme thermal loading, sufficient to generate a failure. This resulted in the oxygen supply disruption leading to the abrupt failure of the Captain’s oxygen supply and the incapacitation of the captain.
- The progressive failure of the cargo compartment liner increased the area available for the smoke and fire penetration into the fuselage crown area.
- The rate and volume of the continuous toxic smoke, contiguous with the cockpit and supernumerary habitable area, resulted in inadequate visibility in the cockpit, obscuring the view of the primary flight displays, audio control panels and the view outside the cockpit which prevented all normal cockpit functioning.
- The shutdown of PACK 1 for unknown reasons resulted in loss of conditioned airflow to the upper deck causing the Electronic Equipment Cooling [EEC] system to reconfigure to “closed loop mode”. The absence of a positive pressure differential contributed to the hazardous quantities of smoke and fumes entering the cockpit and upper deck, simultaneously obscuring the crew’s view and creating a toxic environment.
- The fire detection methodology of detecting smoke sampling as an indicator of a fire is inadequate as pallet smoke masking can delay the time it takes for a smoke detection system to detect a fire originating within a cargo container or a pallet with a rain cover.
Contributing Factors:
- There is no regulatory FAA requirement in class E cargo compartments for active fire suppression.
- Freighter main deck class E fire suppression procedures which relay on venting airflow and depressurisation as the primary means of controlling a fire are not effective for large Class E cargo fires involving dangerous goods capable of Class D metal fire combustion.
- No risk assessment had been made for the failure of the cargo compartment liner based on the evolution of cargo logistics and associated cargo content fire threats, cargo hazards and bulk carriage of dangerous goods.
- The regulation standards for passive fire suppression do not adequately address the combined total thermal energy released by current cargo in a large cargo fire and the effect this has on the protection of critical systems.
- FAA and EASA regulatory requirements do not recognize the current total fire risk associated with pallets, pallet covers and containers as demonstrated by the NTSB/FAA testing.
- Class 9 Hazmat packing regulations do not address the total or potential fire risk that can result from lithium battery heat release during thermal runaway. Although non-bulk specification packaging is designed to contain leaks and protect the package from failure, the packaging for Class 9 does not function to contain thermal release.
- The growth rate of container and pallet fires after they become detectable by the aircraft’s smoke detection system can be extremely fast, precluding any mitigating action and resulting in an overwhelming total energy release and peak energy release rate for a standard fire load that cannot be contained.
- The course to return to Dubai required a series of complex radio communication relays due to the Pilot Flying’s inability to view and tune the radio transceivers.
- The relay communication between the Pilot Flying, relay aircraft and the various ATC stations resulted in communication confusion, incomplete and delayed communications, which contributed to the escalated workload and task saturation for the Pilot Flying.
- The Fire Main Deck non-normal checklist in the QRH was not fully completed by the crew or adhered to regarding the fire suppression flight level or land at nearest airport instruction.
- Task saturation due to smoke and multiple systems failures prevented effective use of the checklist by the crew.
- Communications between the ATCO units involved multiple stages of information exchange by landline and the destination aerodrome was not fully aware of the specific nature of the emergency, the difficulty that the Pilot Flying was experiencing or the assistance required.
- The Pilot Flying had not selected transponder code 7700, the emergency code, when radio communication with the destination aerodrome was not established.
- A large fire developed in palletized cargo on the main deck at or near pallet positions 4 or 5, in Fire Zone 3, consisting of consignments of mixed cargo including a significant number of lithium type batteries and other combustible materials. The fire escalated rapidly into a catastrophic uncontained fire.
- The large, uncontained cargo fire, that originated in the main cargo deck caused the cargo compartment liners to fail under combined thermal and mechanical loads.
- Heat from the fire resulted in the system/component failure or malfunction of the truss assemblies and control cables, directly affecting the control cable tension and elevator function required for the safe operation of the aircraft when in manual control.
- The uncontained cargo fire directly affected the independent critical systems necessary for crew survivability. Heat from the fire exposed the supplementary oxygen system to extreme thermal loading, sufficient to generate a failure. This resulted in the oxygen supply disruption leading to the abrupt failure of the Captain’s oxygen supply and the incapacitation of the captain.
- The progressive failure of the cargo compartment liner increased the area available for the smoke and fire penetration into the fuselage crown area.
- The rate and volume of the continuous toxic smoke, contiguous with the cockpit and supernumerary habitable area, resulted in inadequate visibility in the cockpit, obscuring the view of the primary flight displays, audio control panels and the view outside the cockpit which prevented all normal cockpit functioning.
- The shutdown of PACK 1 for unknown reasons resulted in loss of conditioned airflow to the upper deck causing the Electronic Equipment Cooling [EEC] system to reconfigure to “closed loop mode”. The absence of a positive pressure differential contributed to the hazardous quantities of smoke and fumes entering the cockpit and upper deck, simultaneously obscuring the crew’s view and creating a toxic environment.
- The fire detection methodology of detecting smoke sampling as an indicator of a fire is inadequate as pallet smoke masking can delay the time it takes for a smoke detection system to detect a fire originating within a cargo container or a pallet with a rain cover.
Contributing Factors:
- There is no regulatory FAA requirement in class E cargo compartments for active fire suppression.
- Freighter main deck class E fire suppression procedures which relay on venting airflow and depressurisation as the primary means of controlling a fire are not effective for large Class E cargo fires involving dangerous goods capable of Class D metal fire combustion.
- No risk assessment had been made for the failure of the cargo compartment liner based on the evolution of cargo logistics and associated cargo content fire threats, cargo hazards and bulk carriage of dangerous goods.
- The regulation standards for passive fire suppression do not adequately address the combined total thermal energy released by current cargo in a large cargo fire and the effect this has on the protection of critical systems.
- FAA and EASA regulatory requirements do not recognize the current total fire risk associated with pallets, pallet covers and containers as demonstrated by the NTSB/FAA testing.
- Class 9 Hazmat packing regulations do not address the total or potential fire risk that can result from lithium battery heat release during thermal runaway. Although non-bulk specification packaging is designed to contain leaks and protect the package from failure, the packaging for Class 9 does not function to contain thermal release.
- The growth rate of container and pallet fires after they become detectable by the aircraft’s smoke detection system can be extremely fast, precluding any mitigating action and resulting in an overwhelming total energy release and peak energy release rate for a standard fire load that cannot be contained.
- The course to return to Dubai required a series of complex radio communication relays due to the Pilot Flying’s inability to view and tune the radio transceivers.
- The relay communication between the Pilot Flying, relay aircraft and the various ATC stations resulted in communication confusion, incomplete and delayed communications, which contributed to the escalated workload and task saturation for the Pilot Flying.
- The Fire Main Deck non-normal checklist in the QRH was not fully completed by the crew or adhered to regarding the fire suppression flight level or land at nearest airport instruction.
- Task saturation due to smoke and multiple systems failures prevented effective use of the checklist by the crew.
- Communications between the ATCO units involved multiple stages of information exchange by landline and the destination aerodrome was not fully aware of the specific nature of the emergency, the difficulty that the Pilot Flying was experiencing or the assistance required.
- The Pilot Flying had not selected transponder code 7700, the emergency code, when radio communication with the destination aerodrome was not established.
Final Report:
