We as pilots are all at the mercy of those packing their own baggage, those loading the cargo, and pretty much anyone permitted to put stuff on the hollow aluminum tubes we fly. Nobody is at greater risk, I think, than those flying the heavy lift cargo airplanes. In this case, lithium batteries mixed with other combustible materials were made worse by the fact everything was packed in rain resistant plastic. The captain was dead within 20 minutes. The smoke in the cockpit made it impossible for the first officer to see the instruments in front of him. The fire was so intense it burned through the flight control cables. He was unable to get the airplane back on the ground in almost impossible circumstances.

— James Albright

image

Updated:

2013-10-14

image

Inflight Turnback Fire Suppression Activation,
from: Accident Investigation Report, Figure 2.

UPS, to its credit, made several changes to the way they vet and prepare cargo, train crews, and most importantly to how they equip their airplanes. They are installing Emergency Vision Assurance Systems (EVAS) to their aircraft.

The only thing I would like to add here is the caveat: if you have a fire on the airplane and if you don't put it out in eight minutes, you won't; if you don't get the airplane on the ground in fifteen minutes, you won't under your terms. With a fire indication, the flight is over, point it towards some pavement and put it on the ground immediately.

1 — Accident report

2 — Narrative

3 — Analysis

4 — Cause

5 — Postscript

image

1

Accident report

  • Date: 3 September 2010
  • Time: 19:41
  • Type: Boeing 747-44AF
  • Operator: United Parcel Service - UPS
  • Registration: N571UP
  • Fatalities: 2 of 2 crew
  • Aircraft Fate: Destroyed
  • Phase: Approach
  • Airports: (Departure) Dubai Airport (DXB/OMDB), United Arab Emirates; (Destination) Koln/Bonn-Konrad Adenauer Airport (CGN/EDDK), Germany

2

Narrative

  • The initial climb out from DXB was uneventful. The PF flew the aircraft manually to an altitude of 11,300 feet, then engaged the Auto Pilot [AP] for the climb to the selected cruise altitude of 32,000 feet. The climb was uneventful until a Pack 1 fault was indicated via the Engine Indicating and Crew-‐Alerting-System (EICAS) at approximately 10,000 ft.
  • The Capt, [PNF] reset the Pack11. Pack 1 fault reset by the PNF at 15:00:17, at an altitude of 12,500 ft. The Pack 1 reset was successful. All other recorded indications were normal.
  • One minute after passing the BALUS waypoint, approaching the top of climb, as the aircraft was climbing to the selected cruise altitude of 32,000 feet, the Fire Warning Master Warning Light illuminated and the Audible Alarm [Fire Bell] sounded, warning the crew of a fire indication on the Main Deck Fire - Forward.
  • 15:12:54/CVR: Audible alarm warning the crew of a Main Deck Fire Forward
  • 15:12:57|CVR|CAPT: Fire, main deck forward. alright. I'll fly the aircraft
  • 15:13:02|CVR|F.O: Okay
  • 15:13:05|CVR|CAPT: Go ahead . . . we’re gonna return
  • The CAPT advised BAE-C that there was a fire indication on the main deck of the aircraft, informing Bahrain ATC that they needed to land as soon as possible.
  • BAE‐C advised that Doha International Airport (DOH) was at the aircraft’s 10 o’clock position 100 nm DME from the current location. The Captain elected to return to the point of departure, DXB.
  • 15:13:14|CVR|CAPT: Just got a fire indication on the main deck I need to land ASAP
  • 15:13:19|CVR|BAE-C: Doha at your ten o’clock and one hundred miles is that close enough?
  • 15:13:23|CVR|CAPT: How about we turn around and go back to Dubai, I'd like to declare an emergency.
  • The F.O was handling the Non Normal Checklist [NNC] checklist items, the Fire Main Deck switch was depressed and the cabin began to depressurized.
  • Note: The Fire Main Deck Forward/Aft/Mid checklist on-board at the time of the accident was the pre-modified version.
  • The crew changed the selected altitude from 32,000 feet to 28,000 feet as the aircraft changed heading back to DXB, the Auto Throttle [AT] began decreasing thrust to start the decent.
  • The AP was manually disconnected, then reconnected , followed by the AP manually disconnecting for a short duration, the captain as handling pilot was manually flying the aircraft.
  • Following the turn back and the activation of the fire suppression, for unknown reasons, the PACK 1 status indicated off line [PACKS 2 and 3 were off], in accordance with the fire arm switch activation.
  • There was no corresponding discussion recorded on the CVR that the crew elected to switch off the remaining active PACK 1.
  • Note: PACK 1, in fire suppression mode provides positive air pressure to the cockpit to prevent smoke/fumes from entering the cockpit area. There is no other effective smoke barrier to prevent smoke/fumes ingress into the cockpit and occupied areas.
  • As the crew followed the NNC Fire/Smoke/Fumes checklist and donned their supplemental oxygen masks, there is some cockpit confusion regarding the microphones and the intra-cockpit communication as the crew cannot hear the microphone transmissions in their respective headsets.
  • The AP was disengaged, the Captain then informed the F.O that there was limited pitch control of the aircraft when flying manually20. The Captain was manually making inputs to the elevators through the control column, with limited response from the aircraft.
  • 15:15:37|CVR|CAPT: alright. I've barely got control.
  • 15:15:47|CVR|CAPT: alright… find out what the hell's goin’ on, I've barely got control of the aircraft.
  • This was followed one minute later by the following exchange:
  • 15:16:43|CVR|CAPT: I have no control of the aircraft
  • 15:16:47|CVR|F.O: okay... what?
  • 15:16:53|CVR|CAPT: I have no pitch control of the aircraft
  • 15:16:57|CVR|F.O: you don't have control at all?
  • The flight was approximately 4 minutes into the emergency. The aircraft was turning and descending, the fire suppression has been initiated and there was a pitch control problem. The cockpit was filling with persistent continuous smoke and fumes and the crew had put the oxygen masks on.
  • The penetration by smoke and fumes into the cockpit area occurred early into the emergency. The cockpit environment was overwhelmed by the volume of smoke. There are several mentions of the cockpit either filling with smoke or being continuously ‘full of smoke’, to the extent that the ability of the crew to safely operate the aircraft was impaired by the inability to view their surroundings.
  • Due to smoke in the cockpit, from a continuous source near and contiguous with the cockpit area [probably through the supernumerary area and the ECS flight deck ducting], the crew could neither view the primary flight displays, essential communications panels or the view from the cockpit windows.
  • The crew rest smoke detector activated at 15:15:15 and remained active for the duration of the flight.
  • There is emergency oxygen located at the rear of the cockpit, in the supernumerary area and in the crew rest area. Due to the persistent smoke the Captain called for the opening of the smoke shutter, which stayed open for the duration of the flight.
  • The smoke remained in the cockpit area. This CVR excerpt indicates the following exchange between the Captain and F.O concerning the mask operation and the alternative oxygen supply bottle location. The exchange begins when the Captain’s oxygen supply stops abruptly with no other indications that the oxygen supply is low or failing.
  • 15:20:02│CVR|CAPT: I got no oxygen I can't breathe.
  • 15:20:12│CVR|CAPT: Get me oxygen.
  • 15:20:19│CVR|F.O: I don't know where to get it.
  • 15:20:23│CVR|CAPT: You fly
  • 15:20:41│CVR|CAPT: I can’t see
  • At this point on the CVR, all of the associated recorded information including the conversation and ambient sounds indicate the Captain moved the seat back, got out of the seat and then moved to the aft of the cockpit area. Based on the pathological information, the Captain lost consciousness due to toxic poisoning.
  • After the Captain left the LH cockpit seat, the F.O. assumed the PF role28. The F.O. remained in position as P.F. for the duration of the flight. There was no further interaction from the Captain or inquiry by the F.O as to the location of the Captain or the ability of the Captain to respond.
  • The Aircraft condition inbound as the flight approached DXB for RWY12L.
  • The computed airspeed was 350 knots, at an altitude of 9,000 feet and descending on a heading of 105° which was an interception heading for the ILS at RWY12L. The FMC was tuned for RWY12L, the PF selected the ‘Approach’ push button on the Mode Control Panel [MCP] the aircraft captures the Glide Slope (G/S). The AP did not transition into the Localizer Mode while the Localizer was armed.
  • ATC, through the relay aircraft advised the PF, ‘you're too fast and too high can you make a 360? Further requesting the PF to perform a ‘360° turn if able’. The PF responded ‘Negative, negative, negative’ to the request. The landing gear lever was selected down at 15:38:00, followed approximately 20 seconds later by an the aural warning alarm indicating a new EICAS caution message, which based on the data is a Landing Gear Disagree Caution. At 15:38:20 the PF says: ‘I have no, uh gear’.
  • The PF made a series of pitch inputs which had a limited effect on the descent profile; the descent is arrested temporarily. There then followed a series of rapid pitch oscillations. These were not phugoid oscillations, these were commanded responses where the elevator effectiveness decreased rapidly as the airspeed decayed and the elevators could not compensate for the reduced thrust moment from the engines to maintain level flight in a steady state. This was due to the desynchronisation of the control column inputs and the elevators.
  • The PF was in VHF communication with [a] relay aircraft requesting positional, speed and altitude information.
  • • 15:40:15|CVR|Relay: okay Dubai field is three o'clock it’s at your three o'clock and five miles
  • 15:40:20|CVR|PF: what is my altitude, and my heading?
  • 15:40:25|CVR|PF: my airspeed?
  • From this point onwards, approximately 50 seconds elapse prior to the data ending.
  • 15:41:33|GPWS: pull up
  • The effectiveness of the pitch control immediately prior to the end of the data was negligible.
  • The control column was fully aft when the data ended, there was no corresponding elevator movement.
  • The aircraft lost control in flight and made an uncontrolled descent into terrain.

Source: UAE Report, §1.1


3

Analysis

image

Cargo, UAE Report, p. 92

  • The cargo identified on scene included clothing, machined parts and subassemblies, flashlights, gun parts, costume jewelery, cases for electronic equipment, USB flash drives, un-populated circuit boards, espresso makers, automotive entertainment and navigation systems, bike frames, pellets for injection moulding, wrist watch components, rubber bracelets, cell phones, MP3 and MP4 players, mannequin heads, wigs, shoes. No items posing a flammable fuel load or capable of acting as an ignition source were visually identified except for batteries and battery containing devices.

Source: UAE Report, §1.12.3

  • As detailed in other sections of this report, a cargo fire originating on the main cargo deck breached the cargo compartment liner, severely damaging the control cable support trusses, oxygen system and other essential systems impairing the ability of the crew to safely operate the aircraft for the duration of the flight from the time of the first fire indication.
  • Due to the cargo compartment liner failing to operate as an effective fire and smoke barrier, the supernumerary and cockpit areas filled with continuous smoke. The smoke did not abate for the duration of the emergency.
  • From the tests involving batteries, the following conclusions were made:
    • At the single-cell level, the energy release rate of lithium and lithium-ion type batteries is relatively small when compared to other ordinary materials.
    • In addition to the energy release from batteries resulting in combustion, there is an associated mechanical energy release. This mechanical energy release is capable of compromising the integrity of packaging and creating incendiary projectiles.
    • Lithium (primary) batteries tend to exhibit more energetic failures than lithium-ion (secondary) batteries.
    • The total energy release of a box of 100 lithium-ion batteries can be fairly accurately predicted based on single battery cell calorimetry data.
    • The thermal runaway of lithium-ion batteries is capable of spreading from cell to cell within a package of batteries.
    • The thermal runaway of lithium-ion batteries is capable of causing adjacent combustibles to ignite.

Source: UAE Report, §1.14

  • The Captain’s decision to return to DXB instead of the nearest airport option of Doha International Airport [DOH] was not resolved in the various simulator function tests or through any of the other lines of inquiry. From the onset of the emergency the crew reacted to the normal drills required, the Captain assumed control of the aircraft and the F.O was running the QRH Fire Main Deck checklist.
  • There is no direct information as to why the crew elected to choose Dubai verses Doha, however, it is likely that at the time of the initiation of the turn back, the crew was not yet aware of the full extent of the fire and its effects.
  • Factors effecting the turn back decision include the following. The crew were familiar with DXB and did not have the DOH charts and FMC information immediately available. The inflight turn-back feature of the FMC automatically reprograms the departure/arrivals page to the departure airport when an air turn-back occurs within 400 nautical miles. This feature gives the pilots immediate access to the arrivals and approaches at the departure airport. The crew would have had recent knowledge of the airport information and weather conditions at DXB.
  • The investigation examined the possible outcome of an alternative scenario of diverting to DOH at the first indication of the fire. From the point where the diversion to Doha was advised there were 100 track miles to DOH. A performance analysis based on a 3°-4° descent angle and a descent speed of 300kts, indicate that from the notification until overhead DOH could have been achieved in approximately 17 minutes. Adding time for speed reduction and radar vectoring to the approach configuration, approximately 20 minutes would have been required.

Source: UAE Report, §2.3

  • Providing the fire rate of acceleration remained constant, it is possible that the fire initial point of ignition was at a point approximately 10-15 minutes prior to the smoke alarm, which establishes the point of ignition in the initial cruise phase.
  • It has been established that there were consignments of significant quantities of lithium batteries or derivatives of lithium type batteries on board.
  • Lithium batteries have a history of thermal runaway and fire, are unstable when damaged and can short circuit if exposed to overcharging, the application of reverse polarity or exposure to high temperature are all potential failure scenarios which can lead to thermal runaway. Once a battery is in thermal runaway, it cannot be extinguished with the types of extinguishing agent used on board aircraft and the potential for auto ignition of adjacent combustible material exists.
  • Through a process of cross referencing the location of the ACARS fire detection messages and other system indications and anomalies recorded on the FDR, with the cargo manifest for the type, number, location and of the lithium batteries on board, the investigation concludes with reasonable certainty that the location of the fire was in an element of the cargo that contained, among other items, lithium batteries. It is possible that a lithium type battery or batteries, for reasons which cannot be established, went into an energetic failure characterised by thermal runaway and auto ignited starting a chain reaction which spread to the available combustible material.
  • This can ignite the cargo providing sufficient thermal energy to ignite the adjacent cargo, which included, but did not entirely consist of, lithium batteries.
  • It is probable that the remaining cargo, the cargo pallet and the adjacent cargo ignited and continued in a sustained state or process of combustion for an indeterminate period of time; the sustained state of combustion in all probability continued up until the aircraft data ceased to record.
  • As found in the cargo contain fire testing, particularly in the case of the collapsible DMZ containers, the short time interval between a fire being detectable and peak energy release rate precludes any mitigating action to suppress the fire and protect the aircraft structure. The FAA regulation for cargo compartments certified with smoke detection (14 CFR 25.858) requires a 1 minute detection time from the start of a fire. The regulation does not account for any delay in detection caused by the container.
  • Current certification tests do not use containers. Although 14 CFR 25.858 for cargo compartments certified with smoke detection does not specify any performance metric for what goes on after detection, the results of these fire tests suggest that the intent of the regulation as stipulated in paragraph (b) of 14 CFR 25.858, “the system must be capable of detecting a fire at a temperature significantly below that at which the structural integrity of the aircraft is substantially decreased,” is not being met.

Source: UAE Report, §2.6


4

Cause

  • A large fire developed in palletized cargo on the main deck at or near pallet positions 4 or 5, in Fire Zone 3, consisting of consignments of mixed cargo including a significant number of lithium type batteries and other combustible materials. The fire escalated rapidly into a catastrophic uncontained fire.
  • The large, uncontained cargo fire, that originated in the main cargo deck caused the cargo compartment liners to fail under combined thermal and mechanical loads.
  • Heat from the fire resulted in the system/component failure or malfunction of the truss assemblies and control cables, directly affecting the control cable tension and elevator function required for the safe operation of the aircraft when in manual control.
  • The uncontained cargo fire directly affected the independent critical systems necessary for crew survivability. Heat from the fire exposed the supplementary oxygen system to extreme thermal loading, sufficient to generate a failure. This resulted in the oxygen supply disruption leading to the abrupt failure of the Captain’s oxygen supply and the incapacitation of the captain.
  • The progressive failure of the cargo compartment liner increased the area available for the smoke and fire penetration into the fuselage crown area.
  • The rate and volume of the continuous toxic smoke, contiguous with the cockpit and supernumerary habitable area, resulted in inadequate visibility in the cockpit, obscuring the view of the primary flight displays, audio control panels and the view outside the cockpit which prevented all normal cockpit functioning.
  • The shutdown of PACK 1 for unknown reasons resulted in loss of conditioned airflow to the upper deck causing the Electronic Equipment Cooling [EEC] system to reconfigure to “closed loop mode”. The absence of a positive pressure differential contributed to the hazardous quantities of smoke and fumes entering the cockpit and upper deck, simultaneously obscuring the crew’s view and creating a toxic environment.
  • The fire detection methodology of detecting smoke sampling as an indicator of a fire is inadequate as pallet smoke masking can delay the time it takes for a smoke detection system to detect a fire originating within a cargo container or a pallet with a rain cover.

Source: UAE Report, §3.2


5

Postscript

You may have heard that cargo flight operators have significantly improved their hazardous materials handling. In 2010, the FAA came out with SAFO 10017, Risks in Transporting Lithium Batteries in Cargo by Aircraft. The main points:

  • Lithium batteries are currently classified as Class 9 materials under the Hazardous Materials Regulations (HMR) (49 CFR 180 185). Nonetheless, most lithium batteries and devices are currently classified as excepted from the Class 9 provisions of the HMR. Because of this exception, they do not require a Notice to the Pilot in Command (NOTOC) to alert the crew of their presence on-board an aircraft.
  • Lithium metal batteries are highly flammable and capable of ignition. Ignition of lithium metal batteries can be caused when a battery short circuits, is overcharged, is heated to extreme temperatures, is mishandled, or is otherwise defective. Once a cell is induced into thermal runaway, either by internal failure or by external means such as heating or physical damage, it generates sufficient heat to cause adjacent cells to go into thermal runaway. The result of thermal runaway in a lithium metal cell is a more severe event as compared to a lithium-ion cell in thermal runaway. The lithium metal cell releases a flammable electrolyte mixed with molten lithium metal, accompanied by a large pressure pulse. The combination of flammable electrolyte and the molten lithium metal can result in an explosive mixture. Halon 1301, the suppression agent found in Class C cargo compartments, is ineffective in controlling a lithium metal cell fire.
  • The explosive potential of lithium metal cells can easily damage (and potentially perforate) cargo liners, or activate the pressure relief panels in a cargo compartment. Either of these circumstances can potentially lead to a loss of Halon 1301, allowing rapid fire spread within a cargo compartment to other flammable materials. For this reason, lithium metal cells are currently prohibited as bulk cargo shipments on passenger carrying aircraft.
  • FAA testing has shown that encased or enclosed lithium metal batteries may pose a safety risk. Two types of robust, readily available containers were tested at the FAA Tech Center: five gallon steel pails with crimp on gasketed lids, and 30 gallon steel drums with bolt closed ring seals and gasketed metal lids. For both types of container, as few as six loose CR2 lithium metal cells were sufficient to cause failure when induced into thermal runaway by an electric cartridge heater. The confined electrolyte and the molten lithium ignition source formed an explosive condition, forcefully separating the lid from the container. The explosive force in this test was likely high enough to cause physical damage to an aircraft’s Class C cargo compartment.
  • Our test results have also demonstrated that lithium-ion cells are flammable and capable of self-ignition. Self-ignition of lithium-ion batteries can occur when a battery short circuits, is overcharged, is heated to extreme temperatures, is mishandled, or is otherwise defective. Like lithium metal batteries, lithium-ion batteries can be subject to thermal runaway. A battery in thermal runaway can reach temperatures above 1,100 degrees F, which exceeds the ignition temperature of most Class A materials, including paper and cardboard. These temperatures are also very close to the melting point of aluminum (1,220 degrees F). The fire suppression system in Class C compartments, Halon 1301, has been shown to be effective in suppressing fires generated by lithium-ion batteries, but does not eliminate the risk of transporting such batteries.

References

(Source material)

United Arab Emirates General Civil Aviation Authority, Air Accident Investigation Report, Case Reference 13/2010, Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent Into Terrain, Boeing 747-44AF, N571UP, Dubai, United Arab Emirates, 03 September 2010

Safety Alert for Operators (SAFO) 10017, Risks in Transporting Lithium Batteries in Cargo by Aircraft, 10/8/10, Department of Transpiration