A few days ago, the General Civil Aviation Authority of the United Arab Emirates has released its final report on the Boeing 747 which crashed on the 3rd of September in 2010 after an uncontained cargo fire.

Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent Into Terrain

The 326-page accident report is excellently written and deals with all the issues involved with this tragic flight and an analysis of the situation. Truth be told, it’s hard to think of a more hopeless situation that a modern pilot could find herself in. Here’s a summary of the main points.

11:35 UPS Airlines Boeing 747-400AF, a two-crew four-engine wide-body aircraft, arrives from Hong Kong on a scheduled cargo service.

The Flight Crew reported a failure with the PACK 1 air conditioner during the flight. The ground engineer could not replicate the fault.

The PACKs provide preconditioned air to the pressurised fuselage. The Boeing 747 has three PACKs.

14:51 The Boeing 747 departs as UPS Airlines Flight 6 as a scheduled cargo flight to Cologne Bonn Airport. The First Officer is the Pilot Flying and the Captain is the Pilot Not Flying. They depart on Runway 30R and fly north west over the southern Arabian Gulf.

The First Officer flew the aircraft manually to an altitude of 11,300 feet and then engaged the autopilot after receiving another PACK 1 fault. The flight crew reset PACK 1 which cleared the fault.

The aircraft continued to climb. Shortly before they reached their cruising altitude of 32,000 feet, a fire warning bell sounded and the master warning light illuminated. They had a fire on the forward main deck.

The Captain took control of the aircraft.

15:12:57 CAPT in cockpit: Fire, main deck forward. Alright, I’ll fly the aircraft
15:13:07 CAPT in cockpit: I got the radio, go ahead and run [the checklist]

15:13:14 CAPT to ATC: Just got a fire indication on the main deck I need to land ASAP
15:13:19 BAE-C: Doha at your ten o’clock and one hundred miles is that close enough?
15:13:23 CAPT: how about we turn around and go back to Dubai, I’d like to declare an emergency
15:13:27 BAE-C: UPS six make a right turn heading zero nine zero descend to flight level two eight zero.

Doha was closer, they were about 180 miles from Dubai. However, it is unlikely that the crew understood the extent of the fire.

The crew put on oxygen masks and worked their way through the Fire/Smoke/Fumes checklist.

The fire suppression system automatically shut down PACK 2 and 3. The flight crew manually turned the switches to OFF, in accordance with their check list. In fire suppression mode, PACK 1 should have continued to supply preconditioned air to the upper deck. This provides positive air pressure to the cockpit to prevent smoke and fumes from entering the cockpit area. However, at 15:15:21, PACK 1 stopped operating. This meant that no packs were operating and there was no ventilation to the upper deck and flight deck.

Smoke began to enter the cockpit.

15:15:23 CAPT to ATC: I need a descent down to ten thousand right away sir.

It’s unclear why the Captain requested the descent, although it seems to me he was probably reacting to the smoke and concerned about available oxygen. However, this was not on his checklist, which stated he should fly at 25,000 feet, the optimum altitude to prevent combustion.

His action did not support the fire suppression system which was based on depressurisation and oxygen deprivation.

The uncontained cargo fire severely damaged the control cables, the truss frame supporting the cables and the cable tension.

15:15:37 CAPT: alright. I’ve barely got control
15:15:38 F.O: I can’t hear you
15:15:41 CAPT: Alright
15:15:47 F.O: alright… find out what the hell’s goin on, I’ve barely got control of the aircraft.
15:16:41 CAPT: I have no control of the aircraft.
15:15:43 F.O: okay… what?
15:16:47 CAPT: I have no pitch control of the aircraft
15:15:53 F.O: you don’t have control at all?
15:16:42 CAPT: I have no control of the aircraft.
15:16:47 CAPT: I have no pitch control of the aircraft.

They regained control of the elevator control system through the autopilot. Meanwhile, the cockpit was filling with smoke. Within two minutes, neither crew member could see the control panels or look out of the cockpit.

15:16:57 CAPT: Pull the smoke handle.

Pulling the smoke handle might have caused a pressure differential, drawing more smoke into the cockpit. The Captain contacted ATC to report the situation and then spoke to the First Officer.

15:17:39 CAPT: Can you see anything?
15:17:40 F.O: No, I can’t see anything.

The flight crew attempted to input the Dubai Runway 12 left data into the flight management computer, so that they could configure the aircraft for an auto-flight/auto-land approach, but they couldn’t see the FMC display for all the smoke.

At that point, the Captain’s oxygen supply failed.

15:19:56 CAPT: I’ve got no oxygen.
15:19:58 F.O: Okay
15:20:00 F.O: Keep working at it, you got it.
15:20:02 CAPT: I got no oxygen I can’t breathe.
15:20:04 F.O: okay okay.
15:20:06 F.O: what do you want me to get you?
15:20:08 CAPT: Oxygen.
15:20:11 F.O: Okay
15:20:12 CAPT: Get me oxygen.
15:20:12 F.O: hold on okay.
15:20:16 F.O: Are you okay?
15:20:17 CAPT: (I’m out of) oxygen.
15:20:19 F.O: I don’t know where to get it.
15:20:20 CAPT:(I’m out of) oxygen.
15:20:21 F.O: Okay
15:20:21 CAPT:You fly (the aircraft)

A portable oxygen bottle was behind the Captain’s seat, next to the left-hand observer’s seat, but neither crew member retrieved the bottle. The Captain moved aft of the cockpit area, presumably to try to find the supplementary oxygen. He removed his oxygen mask and smoke goggles and said, “I cannot see.” That was the last recording which included the Captain; he died as a result of carbon monoxide inhalation.

Seven minutes had elapsed since the fire alarm had first sounded. The First Officer was now Pilot Flying, with no support nor monitoring. A nearby aircraft contacted him to relay information to Bahrain. The First Officer established communication and attempted to cope with a swiftly escalating task load, which left him no time to enquire after the Captain.

15:25:42 PF: I would like immediate vectors to the nearest airport I’m gonna need radar guidance I cannot see.

Based on his comments, the investigators believe that the pilot was able to see heading, speed and altitude select windows. He could not see the primary flight displays. He could not read the navigation display. Thus he could set up flight configurations but he couldn’t see the response. He also made numerous comments about not being able to see outside and that the heat was increasing and his oxygen was getting low.

He couldn’t see the radio either, so he couldn’t change frequency although he was now out of range of the controller at BAE-C. The controller asked aircraft to relay information to and from the Boeing. Dubai ATC also transmitted several advisory messages to the flight on local frequencies in hopes of getting a message to the Boeing, including “any runway is available.” They turned on the lights for Runway 30L.

A relay aircraft contacted the Pilot Flying and attempted to pass his information on to Bahrain. The relay aircraft (identified as 751) struggled to relay the information and get answers from Bahrain. The relay system was of little use to the Pilot Flying who didn’t know his own altitude or speed and needed immediate data.

15:29:59 PF: Okay Bahrain give me what is my current airspeed?
15:30:07 PF: Current airspeed immediately immediately.
15:30:14 PF: What is my distance from Dubai International UPS er six what is my distance we are on fire it is getting very hot and we cannot see.
15:30:22 RELAY AIRCRAFT: Okay I ask Bahrain understood and UPS six request the distance from Dubai from now?
15:30:28 PF: Sir I need to speak directly to you I cannot be passed along I need to speak directly to you I am flying blind.
15:30:36 RELAY AIRCRAFT: Understood UPS six we are just changes to another aircraft to be with Dubai to relay with you I ask again to Bahrain Bahrain distance UPS six to Dubai?

The workload of the Pilot Flying was immense. He was communicating through aircraft relays while he controlled the flight and attempted to navigate to Dubai International, with no access to navigation equipment and no possibility of looking out the window. He repeatedly asked the relays for information on height, speed and direction in order to plan his blind flight. There was no opportunity to finish the checklist nor check on the Captain.

The options available to the pilot were limited. The aircraft was seriously compromised but without primary instruments, so the First Officer couldn’t see what was and wasn’t working. He couldn’t even ditch the aircraft in the Arabian Gulf as he didn’t know his own altitude and couldn’t see out the window.

The Boeing 747 approached Dubai travelling 350 knots at an altitude of 9,000 feet and descending.

The computed airspeed was 350 knots, at an altitude of 9,000 feet and descending on a heading of 105° which was an interception heading for the ILS at RWY12L. The FMC was tuned for RWY12L, the PF selected the ‘Approach’ push button on the Mode Control Panel [MCP] the aircraft captures the Glide Slope (G/S). The AP did not transition into the Localizer Mode while the Localizer was armed.

ATC at Dubai asked a relay aircraft to advise the Pilot Flying, “You’re too fast and too high. Can you make a 360? Perform a 360 if able.”

The First Officer responded simply with, “Negative, negative, negative.”

The Pilot Flying set the landing gear lever to down. This caused an aural warning alarm: Landing Gear Disagree Caution.

15:38:20 PF: “I have no gear.”

The aircraft passed north of the aerodrome on a heading of 89° at a speed of 320 knots, altitude 4200 feet and descending.

He had no landing gear. He was fast and high. The fire was still burning and the cockpit was thick with smoke. He couldn’t see a thing. And now he’d overflown the airport.

There was another airfield, Sharjah Airport, which was 10 nautical miles to the left of the aircraft. The relay pilot asked if the Pilot Flying could turn left onto a 10 mile final approach for Sharjah’s runway 30.

19:38:37 PF: Sir, where are we? Where are we located?
19:38:39 RELAY AIRCRAFT: Are you able to do a left turn now, to Sharjah? It’s ten miles away.
19:38:43 PF: Gimme a left turn, what heading?

The relay aircraft advised that SHJ was at 095° from the current position at 10nm. The PF acknowledged the heading change to 095° for SHJ.

However, the Pilot Flying selected 195°. The aircraft banked to the right as the Flight Management Computer captured the heading change. The aircraft entered a descending right-hand turn at an altitude of 4,000 feet. Then there were a number of pitch oscillations commanded by the Pilot Flying as the elevator effectiveness decreased.

The aircraft was heading straight for Dubai Silicone Oasis, a large urban community. I suppose the one good thing in this fiasco is that it never made it that far.

15:40:15 RELAY AIRCRAFT: Okay Dubai field is three o’clock it’s at your three o’clock and five miles
15:40:20 PF: What is my altitude, and my heading?
15:40:25 PF: My airspeed?

The pitch control was ineffective. The control column was fully aft but there was no corresponding elevator movement.

The aircraft was out of control.

15:41:33 The Ground Proximity Warning System sounds an alert: PULL UP

15:41:35 [data ends]

The Boeing crashed into a service road in the Nad Al Sheba military base nine miles south of Dubai.

So what caused the fire to go so quickly out of control?

The cargo loaded in Hong Kong included a large amount of lithium batteries distributed throughout the cargo decks. However, packing slips and package details, showing that the cargo contained lithium batteries and electronic devices packed with lithium batteries, were not inspected until after the accident. At least three of the shipments contained lithium ion batteries which are specified as a hazard class 9 and should have been declared as hazardous cargo.

Lithium batteries have a history of thermal runaway and fire, are unstable when damaged and can short circuit if exposed to overcharging, the application of reverse polarity or exposure to high temperature are all potential failure scenarios which can lead to thermal runaway. Once a battery is in thermal runaway, it cannot be extinguished with the types of extinguishing agent used on board aircraft and the potential for auto ignition of adjacent combustible material exists.

The investigators believe that a lithium battery or batteries went into an “energetic failure characterised by thermal runaway” – in other words a battery auto-ignited. This started a chain reaction, igniting all the combustible material on the deck. The resulting fast-burning blaze then ignited the adjacent cargo, which also included lithium batteries. The remaining cargo then ignited and continued in a sustained state of combustion, that is, the conflagration continued burning until the crash.

The single point of failure in this accident was the inability of the cargo compartment liner to prevent the fire and smoke penetration of the area above pallet locations in main deck fire zone 3.

This resulted in severe damage to the aircraft control and crew survivability systems, resulting in numerous cascading failures.

As the cargo compartment liner failed, the thermal energy available was immediately affecting the systems above the fire location: this included the control assembly trusses, the oxygen system, the ECS ducting and the habitable area above the fire in the supernumerary compartment and in the cockpit.

The probable causes start with the fire developing in the palletized cargo, which escalated rapidly into a catastrophic uncontained fire. The cargo compartment liners failed. The heat from the fire caused the malfunctions in the truss assemblies and control cables, disabling the cable tension and elevator function. The heat also affected the supplementary oxygen system, cutting off the Captain’s oxygen supply. The rate and volume of toxic smoke obscured the view of the primary flight displays and the view outside the cockpit, exacerbated by the shutdown of PACK 1. And finally, the fire detection itself did not give enough time for the flight crew or the smoke suppression systems to react before the fire was a conflagration.

A key consideration that the investigation puts forward is the useful response time in the case of an onboard fire.

A study conducted by the Transportation Safety Board of Canada, in which 15 in-flight fires between 1967 and 1998 were investigated, revealed that the average elapsed time between the discovery of an in-flight fire and the aircraft ditched, conducted a forced landing, or crashed ranged between 5 and 35 minutes, average landing of the aircraft is 17 minutes.

Two other B747 Freighter accidents caused by main deck cargo fires have similar time of detection to time of loss of the aircraft time frames, South African Airways Flight 295 was 19 minutes before loss of contact and Asiana Airlines Flight 991 was eight minutes. Both aircraft had cargo that ignited in the aft of the main deck cargo compartment.

The accident aircraft in this case, was 28 minutes from the time of detection until loss of control in flight. The cargo that ignited was in the forward section of the main deck cargo compartment. The average time is seventeen minutes. This should be factored into the fire checklist that an immediate landing should be announced, planned, organised and executed without delay.

These findings indicate that crews may have a limited time to complete various checklist actions before an emergency landing needs to be completed and the checklist guidance to initiate such a diversion should be provided and should appear early in a checklist sequence.

The English language accident report is very long; it is a very thorough investigation and well worth a read to understand the full context of the flight.

All I can hope is that something good comes out of such a detailed analysis in order to stop such a tragic crash from happening again.

---

If you found this interesting, you’ll probably enjoy my e-book, Why Planes Crash.