FACTUAL INFORMATION History of the flight The aircraft, with 214 passengers and 13 crew, was conducting a scheduled passenger service from Sydney to Melbourne. At about 1634 EST, while passing flight level 350 (FL350) on climb to FL390, the flight crew felt a thud similar to that caused by the bumping of service trolleys in the forward galley. They were then alerted to a malfunction of the automatic pressurisation controllers by the "cabin auto inop" caution message and display of the "auto inop" indicator light. At the time, the cabin crew were serving refreshments. The purser, located in the forward galley, detected an air pressure change and entered the flight deck to inquire as to the condition of the cabin pressurisation. On being advised that there was a problem, she returned to the forward cabin. A loud bang followed by the noise of a large volume flow of air was heard in the centre and rear cabins. Two flight attendants went forward to report the noise to the purser, who directed that the service trolleys be stowed and the galleys secured. On return to the rear cabin, the flight attendants found that a strong flow of hot air containing dust and fibrous particles was entering the right side of the cabin near seat row 21. Fourteen seconds after the initial fault indication, the "body duct leak" caution message and the "duct leak" light displayed, indicating a leak in the pneumatic ducting between the auxiliary power unit (APU) and the centre bleed air isolation valve. A flight attendant, located in the forward cabin, observed the contaminated air in the rear cabin and, due to a previous experience, assumed that it was mist associated with a depressurisation. Without prior consultation with the purser, she proceeded quickly to the flight deck and called "masks". An indication of cabin altitude rate of climb of about 2,000 ft/min was observed by the flight crew who donned their oxygen masks and deployed the cabin masks. Pressurisation system manual control was selected and the cabin altitude stabilised at approximately 7,000 ft. At 1635, as the aircraft passed through FL365, the pilot in command discontinued the climb. Approximately 15 seconds later, the co-pilot transmitted a Pan call, requiring an emergency descent. When the cabin oxygen masks deployed, the purser assumed that a depressurisation was occurring and directed the flight attendants accordingly. Having fitted a mask, she expected to be advised by the flight crew when the aircraft had descended to a safe altitude. Some flight attendants continued to secure the galleys, while others responded to passenger concerns. Although all the oxygen mask access doors opened, a number of masks failed to drop automatically, requiring that they be manually drawn from the oxygen module. In the centre and rear cabin, passengers, particularly some with pre-existing medical conditions, were becoming distressed at the increasing heat and air contamination. Flight deck instrument indications for the rear cabin temperature were observed to rise to 39 degrees C. Passengers expressed fear that the heat, which was concentrated near seat 21G, was caused by a fire. Some who had been seated close to the heat source preferred to stand in the aisle. Many passengers were unsure that their oxygen masks were operating correctly, and some changed their masks. When this concern was recognised by cabin staff, they advised the passengers to observe the flow indicator to confirm correct operation. When masks at two locations did not indicate oxygen flow, the passengers were provided with spare masks from adjacent units. At approximately 1637, an ATC clearance to descend to FL110 was received and the descent commenced. The flight crew completed the required checklist procedures and selected the centre bleed duct isolation valve to off. At approximately 1638 the "body duct leak" caution extinguished. Following the selection of the isolation valve to off, the flight engineer attempted, by hand signal, to inquire of the purser as to whether or not the cabin temperature was reducing. The signal was misinterpreted by the purser for a requirement to be seated. Consequently, she again directed that all cabin staff should be seated. A flight attendant assessed that the heat at the sidewall adjacent to seat 21G was excessive. She discharged two BCF fire extinguishers into the general area and behind the sidewall panelling. She then went forward and advised the purser, who conveyed to the pilot in command the concern regarding the cabin environment and that fire extinguishers had been discharged. The pilot in command had expected that the closure of the isolation valve would diminish the heat and air contamination; however, on being advised by the purser of continuing concern, he increased the rate of descent and obtained a clearance to land at Canberra. The flight crew members discussed the possibility that bleed air may still be entering the cabin. As a precaution, both engine bleed air valves were then closed. The purser proceeded to the rear cabin to inspect the area. Although the cabin temperature was still high, she found no evidence of a fire and returned to the forward cabin. During the descent the pilot in command advised the passengers that there was a problem with an air conditioning duct, and that a landing at Canberra was to be made. He assured the passengers that the landing would be normal. The cabin temperature subsequently stabilised and then gradually reduced. An announcement was not made to advise that the pressurisation had been stabilised, and that the masks were not required. Consequently, several cabin staff remained seated until late in the flight and passengers continued to use the oxygen masks. The subsequent approach and landing at Canberra were uneventful. The aircraft was met by emergency response crews, including paramedics who attended distressed passengers. After a delay in the provision of suitable boarding steps, passengers egressed normally. Flight deck crew Each of the three-member flight crew was correctly licensed and endorsed, and had satisfactorily completed required recurrent training. The pilot in command, aware of the circumstances of a previous pneumatic duct failure, had initially assumed that continuation of the flight at a lower altitude would be possible. The decision to land at Canberra was taken when, having completed the duct-leak checklist, he was advised that fire extinguishers had been discharged and that there was continuing passenger distress. Almost four minutes elapsed from the initial duct-leak warning to the closure of the isolation valve. This delay was critical to the intensity of the cabin temperature and air contamination. There had not been a depressurisation. However, after the cabin pressure was stabilised, the flight crew did not advise the purser that the oxygen masks were not required. Cabin crew Each of the ten flight attendants was appropriately licensed and had completed recurrent training in emergency procedures during the preceding 12 months. The cabin crew included a flight attendant, located in the rear cabin, who was designated as second senior. At the time of the occurrence, there was no requirement for the second senior to assume a particular role during an emergency procedure. The existing additional requirements for that position related to the provision of passenger services. No additional training was provided for the management of emergency situation response. The deployment of the oxygen masks caused the cabin crew to follow the loss of cabin pressurisation procedures. This required returning to their station and fitting a mask, or if more appropriate, staying in their present position and using or sharing a passenger mask. Visibility from the forward cabin to the rear cabin was restricted, due to the location of bulkheads. The purser would, therefore, rely on timely communication from the rear cabin, normally by use of the interphone system, to ensure an appropriate response to any emergency situation. On this occasion, however, she was not initially advised of the excessive heat at and near seat 21G, nor of passenger health concerns or oxygen mask difficulties. Current emergency procedures training did not include training on how to respond to simultaneous multiple emergencies. An element of uncertainty existed among some cabin crew. The hot contaminated air, while not containing smoke, suggested a possible fire. However, the deployed oxygen masks indicated a depressurisation. The flight attendant who discharged the fire extinguishers reported her action to the purser after the discharge had been undertaken. She also had been unsure of the appropriate response, especially in relation to the advisability of using portable oxygen unit while confronting a possible fire. She had not sought to summon help because she had expected other cabin crew members to support her response to the possible fire. However, none had provided direct support, and most remained at their stations, apparently unsure as to how to respond to the indications of both a depressurisation and possible fire. Due to the extreme heat at row 21 passengers had moved out of their seats. However, the flight attendants did not relocate them away from this area. Although there were no spare passenger seats available, in an emergency there was provision for armrests to be stowed to provide additional seating capacity. Aircraft information Boeing 767-277, VH-RMF, was manufactured in 1982. At the time of the occurrence the aircraft had accumulated a total of 25,631 flight hours and 19,281 flight cycles. This represents a relatively high number of cycles when compared with the world B767 fleet. In October 1993, the world B767 average fleet flight hours and cycles were 17,236 and 6,454 respectively. No deficiencies were identified in the maintenance procedures or documentation for the pneumatic duct system. The operator had complied with all the relevant manufacturer and Civil Aviation Authority requirements. Inspection of the aircraft revealed a complete rupture of the centre pneumatic supply duct. The failure had occurred at a bend in the duct, located immediately aft of the bulkhead which separates the mainwheel well from the rear cargo compartment. A significant volume of hot air escaping from the ruptured duct had entered the passenger cabin through the right-side air returns near seat row 21. Dust and other matter from insulation blankets in the region of the bulkhead had been carried by the air flow into the cabin. There was no evidence of either fire or smoke having been present. The fire extinguishers were examined. One extinguisher was fully depleted, while a second was substantially depleted. Although passengers later expressed concern that one extinguisher had not operated correctly, cabin crew reported that both had discharged normally. The failed pneumatic duct, P/N 212T3116-5, was fabricated from grade-3 titanium, and was installed during aircraft manufacture. The duct, which had not received stress-relief treatment, was last inspected 2,048 hours prior to the occurrence. The required inspection interval was 3,000 hours. Duct P/N 212T3116-5 is variously referred to in manufacturer documentation as a component of the body duct, centre duct, or APU supply duct. Passenger oxygen masks The masks were each provided with a green in-line flow indicator with a reservoir bag also attached, which would not necessarily fully inflate during normal mask operation. The oxygen flow was at a low pressure. When operating in a pressurised cabin, indications of mask oxygen availability may not be readily apparent. Some crew members assumed that use of the masks would provide protection against air contamination. However, the masks were designed to draw upon cabin air, in addition to providing supplemental oxygen. The oxygen masks at five flight attendant stations and one passenger unit failed to drop automatically, although the panels had opened normally. All cabin oxygen masks were inspected and repacked. Prior to this occurrence there was no requirement for the operator to verify that the masks could drop from their stowed position when testing the operation of the oxygen access door latch mechanism. A post-incident survey of 42 passengers who had been located in the rear cabin was conducted. The investigation found that of the 22 respondents, 17 expressed concern that the oxygen masks had not operated correctly. One passenger advised that he had expected the flow to be similar to that from the overhead air vents. Some reasoned that the apparent lack of oxygen flow was a precaution against the fire. Other passengers had continued to use the masks on the assumption that they provided protection against the contaminated air. Passenger oxygen generators Oxygen masks at two passenger locations were reported to have failed to operate. All oxygen generators were inspected for indication of normal discharge. Two generators, Puritan Bennett Aero Systems P/N 117003-13, S/N 06148 and S/N 06158, manufactured in November 1982 and installed as original aircraft equipment were found to have failed to activate. The release pins had operated correctly. The defective oxygen generators were returned to the manufacturer for examination. The failure of both generators was attributed to thermal deactivation of the primer. Each was within the designated service life and was otherwise functional. The thermal deactivation of the primer was caused by inadvertent exposure to high temperature during production. This production process anomaly had been recognised, resulting in 1987 Service Bulletin No. 11703-13-35-1 being issued. The service bulletin advised that Puritan P/N 117003-13 oxygen generators with S/Ns 06339 through 06559 should be removed from service and replaced. Some generators with serial numbers outside this range have also been found to have thermally damaged primers but the incidence of these did not indicate any discernible pattern. Manufacturing process improvements were made in December 1982. These improvements are thought by the manufacturer to have eradicated any potential for thermally degrading primers. Flight recorder The aircraft was equipped with a Lockheed model 209E digital flight data recorder and a Teledyne flight data acquisition unit. Ninety-four engineering and 188 discrete parameters were recorded. The flight data recorder provided an accurate sequence of events of the occurrence. This information indicated the time at which the aircraft systems sensed the duct leak, and the timing and sequence of the crew response. The data confirmed that the cabin altitude had not exceeded 10,000 ft. However, information on cabin temperature, cabin pressure, cabin oxygen mask deployment and the time of cabin public address calls was not recorded. Titanium pneumatic ducting Several aircraft systems, including air conditioning and pressurisation, rely on pneumatics for their operation. Air for the pneumatic system can be supplied by the engines, the APU, or a ground air source. The pneumatic supply is distributed throughout the aircraft via titanium ducting. In flight, each engine supplies bleed air through its corresponding system ducting to the centre pneumatic duct which distributes it to the various systems. Bleed air flow into or out of the centre pneumatic duct is controlled by the centre isolation switch. The switch is on for all normal operations. The aircraft manufacturer first recorded titanium pneumatic duct failures in 1982 on B747 series aircraft. By 1983, a number of ruptures of titanium ducts had occurred, but by December 1987 the manufacturer had recognised conclusive evidence of the contribution made by hydrogen embrittlement to duct failures and the benefits to be gained by implementing stress-relief measures. In February 1988, the first B747 service bulletin relating to stress relief of in-service titanium ducting was issued. The first stress-relieved ducts were delivered on B747 aircraft in January 1989. The first B767 titanium duct failure was reported in 1986. Stress relief of B767 production ducting did not commence until May 1990 and the first B767 aircraft with stress relief to all ducting was delivered in August 1990. A service bulletin, SB 767-36-0033, addressing in-service stress relief of specified ducting components was issued in October 1991. Together with stress-relief processes, the manufacturer also introduced increased duct-wall thickness to some components and changed the titanium specification from grade 3 to grade 2, where grade 2 titanium has a lower hydrogen content. Correspondence from the manufacturer, dated 5 October 1990, to operators indicated that there had been a total of 44 reported B767 pneumatic duct ruptures to date. Service bulletins and service letters provided operators with background information on titanium duct failure, including the following description of hydride embrittlement cracking, contained in Service Letter 767-SL-36-30, dated 21 December 1992: "The cracks were the result of concentration of titanium hydrides in the heat-affected zones of the welds. At duct-operating temperatures of 300-4000 degrees F, hydrogen, in the titanium duct material, migrates toward areas of high stress. During cooling, hydrides are formed. Hydrides have an embrittling effect on the duct material and leave the material susceptible to crack formation. Once initiated, the cracks propagate slowly by either the formation of additional hydrides or fatigue, or both. Material thickness mismatch and pullouts also tend to aggravate the problem. Studies have shown that stress relieving the ducts eliminates the areas of residual stress near the welds, preventing hydrogen migration to the weld heat affected zones and thereby preventing further hydride embrittlement in the weld areas.". Service Letter 767-SL-36-30 aimed to inform operators of all service bulletins related to the improvement plan for prevention of hydride embrittlement cracking of pneumatic ducting. Service bulletins had been issued to address the inspection, testing, stress relief and, in some applications, the replacement, of ducting. However, a planned service bulletin, SB 767-36-0045, which included the centre duct, had not been issued. Consequently, although all other titanium ducting had been addressed by service bulletins, duct P/N 212T3116-5 and adjacent ducting had not. The aircraft manufacturer assessed that the centre or APU supply duct represented a comparatively low risk of failure. This assessment was based on the following considerations: - the number of ruptures reported to have occurred in the centre duct system, compared to the number of ruptures in other parts of the pneumatic system, was relatively small. - the secondary damage resulting from a centre duct rupture would not affect aircraft safety to the degree that a rupture in the crossover or leading edge ducting would. - the air escaping from a rupture in the centre duct could be controlled by the flight crew. At the time of this occurrence, the number of manufacturer-recorded B767 pneumatic duct failures was 84. The records included two previous failures of duct P/N 212T3116-5 and 17 failures of adjacent APU supply ducting. There have been no reported duct failures following stress-relief treatment conducted in accordance with the relevant service bulletins. VH-RMF duct examination A specialist laboratory examination of the failed duct was conducted. The duct had fractured at a corner bend through the toe of a weld in the heat-affected zone, where the wall thickness is 0.50 mm. The wall thickness of the bend section of the duct was measured at 0.89 mm. The specialist report noted that: "[4.1] The failures of titanium ducts all seem to occur at the toe of welded joints where the residual stresses are high and stress raisers are present. It would appear that the residual stresses result from welding a 0.50 mm wall thickness duct to a 0.89 mm wall thickness flange section of duct by expanding the duct outside diameter to match the outside diameter of the flange section.". Failure of the ducting fitted to VH-RMF was considered to be due to a combination of hydrogen embrittlement cracking and fatigue. This finding is consistent with previous advice contained in B767 service bulletins. Critical to the development of the titanium embrittlement is the thermal cycling associated with system startup and shutdown. Small cracks were initiated during the manufacturing/proof pressure testing process. However, the cracks were below the threshold sensitivity of the penetrant inspection process. The report observed that had repetitive inspections of the ducting been conducted during service, significantly sized cracks may have been detected prior to failure. ANALYSIS Pneumatic ducting Timely promulgation of and compliance with the proposed service bulletin, SB 767-36-0045, should have prevented this occurrence. The manufacturers low risk assessment for a failure of the centre duct meant that the service bulletin was only promulgated after this occurrence. The processes and materials used in the manufacture of the centre duct were identical to those used on other duct components which had experienced many failures. The manufacturer had since 1987, been aware of the causal effect of the hydrides in the duct failures and of the benefit to be gained by stress-relief treatment. The role of thermal cycling in the development of hydrogen-induced cracking of titanium ducting had also been recognised by the manufacturer. The manufacturer may have therefore anticipated that as B767 aircraft accumulated higher flight-cycle counts, non-stress-relieved ducting would fail with increasing frequency. However, there is no indication that the manufacturer, when conducting risk assessments, or in the programming of inspection/replacement procedures, provided priority attention for ducting exposed to higher flight-cycle counts. A failure of the centre duct may potentially result in less secondary damage to the aircraft and its systems and therefore less risk to flight safety than that which could result from a failure of either the crossover or the leading edge ducting. However, the centre-duct failure in VH-RMF resulted in an immediate and dramatic disruption to the cabin environment. Flight crew actions The malfunction indications observed by the flight crew were responded to in accordance with established checklist procedures. However, the degree to which the cabin environment was degraded was directly related to the time required to complete the checklist procedures and close the centre isolation valve. It is likely that completion of these procedures was delayed by the reports of possible decompression and fire. The secondary effect of the duct failure, in causing a significant disruption to the cabin environment, could not reasonably have been anticipated by the crew. Had the rupture occurred at a position on the duct from where the air flow would not be directed into the cabin, the result may not have been as significant and the flight crew response to the duct failure may have been completed sooner. When the flight attendant called for the cabin oxygen masks to be deployed, the cabin altitude was well within the normal range. However, the pilot in command complied, possibly due to the manner in which the request was made and the rate at which the cabin altitude indication was seen to be rising. The perception that the oxygen masks provided protection against the contaminated cabin air may have influenced the flight crew not to advise the purser that the cabin pressurisation had stabilised or that the aircraft had descended to a safe altitude. Cabin crew actions The flight attendants had been trained to take immediate action in response to emergency situations and not necessarily rely on a more senior crew member to take the initiative. However, the precipitous action of one flight attendant, in calling for the cabin masks to be deployed, and the compliance by the flight crew, had a profound influence on the conduct of the response to the occurrence. The purser was not advised of the call for the masks; however, she was aware that a pressurisation system problem existed. Therefore, she assumed that the deployment of the masks resulted from an actual depressurisation and responded accordingly. Without the deployment of the oxygen masks, the cabin crew would have been able to focus more appropriately on the actual occurrence. They would also have been better able to address the passenger concerns, which may have been considerably less intense. Prompt advice to the purser concerning the effect of the heat and air contamination on the passengers was not provided by the second senior. Consequently, the purser was not involved in the management of the response by the flight attendant, who was unsure that a fire existed, but concerned that the symptoms should be treated immediately. The expectation that the aircraft would soon descend to a safe height may have influenced some flight attendants to delay their response to the excessive heat. The failure to relocate passengers away from the heat-affected area, or to respond as a team to an apparent threat of fire, may have been due to a lack of training in responding to simultaneous multiple emergencies. One of the aims of training should be to ensure that when faced with ambiguous situations, flight attendants can prioritise required actions and respond with appropriate equipment. Most of the passenger concern relating to the effectiveness of the oxygen masks is considered to have been due to an erroneous expectation concerning the oxygen flow pressure. Advice to the passengers on the use of the in-line flow indicator and the function of the attached reservoir bag may have alleviated much of their concern. It is likely that the failure of some oxygen masks to drop automatically was the result of the position in which they had been folded and stowed. Summary The aircraft manufacturer was aware of the probability of failure of any titanium pneumatic ducting which had not been stress relieved, and which had accumulated a relatively high flight-cycle count. However, at the time of this occurrence, the proposed service bulletin addressing the stress relief of the centre duct had not been issued. When assessing the potential safety implications of a centre-duct failure, the manufacturer compared the possible secondary damage resulting from a crossover or a leading-edge duct failure. It would appear reasonable to assume that a failed centre duct should result in less aircraft damage. However, this occurrence has shown that a centre-duct failure can have a significant impact upon the passenger cabin environment. The degree to which the cabin environment was degraded was directly attributable to the elapsed time from the duct rupture to the isolation valve closure. The valve closure was probably delayed by attempts to resolve the confusion resulting from the information regarding the cabin environment. Flight attendants in the forward cabin were aware of a possible pressurisation problem. When they observed the contaminated air in the rear cabin, they assumed that this was the mist associated with a depressurisation, and responded accordingly. Meanwhils, flight attendants in the rear cabin, while aware of a requirement to respond to a depressurisation, were also confronted with indications of a possible explosion and fire. Inadequate communication between the flight attendants in the rear cabin and the purser ensured that this confusion persisted and that the flight crew were not initially made fully aware of the concerns of the attendants in the rear cabin. It is likely that the response to the occurrence would have resulted in significantly less disruption to the cabin environment had there been better communication between all elements of the crew. CONCLUSIONS Findings 1. A rupture of the pneumatic duct P/N 212T3116-5 occurred as the aircraft climbed through FL350. 2. Engine bleed air escaping from the ruptured pneumatic duct was deflected into the cabin, causing excessive heat at the cabin side panel near seat 21G. 3. The aircraft manufacturer had, by 1987, identified the significance of hydrogen embrittlement in the failure of titanium ducting, and the effectiveness of stress-relief measures in preventing this type of failure. 4. The flow of air into the cabin contained dust and fibrous particles, resulting from disruption of insulation blankets near the failed duct. 5. There was no fire. 6. The cabin altitude did not exceed permissible limits. 7. The cabin oxygen masks were deployed, but were not required. 8. The deployment of the masks caused the flight attendants to adopt the loss of cabin pressurisation procedures. 9. Passenger anxiety, already raised due to the noise, heat and air contamination, was further elevated when they did not recognise that their oxygen masks were operating. 10. Passengers apparently expected that the oxygen mask would provide a flow of oxygen under significant pressure. 11. Two oxygen generators failed to operate. Significant factors 1. The titanium pneumatic duct P/N 212T3116-5 failed as a result of hydrogen embrittlement and fatigue. 2. Cracks had been initiated in the duct during the manufacturing process. However, these cracks were too small to be detected at that time. 3. At the time of the occurrence there was no requirement for repetitive inspection and pressure testing of the duct P/N 212T3116-5. 4. A service bulletin to address the failure of ducting P/N 212T3116-5 and adjacent APU supply ducting had not been issued prior to this occurrence. 5. A breakdown in communications occurred between the cabin crew, and between the cabin crew and the flight crew. SAFETY ACTION Oxygen system Passenger concerns relating to the operation of oxygen masks were evident in this occurrence and were also apparent in occurrence 9401312 involving VH-ANA on 17 May 1994. In view of these occurrences, the following recommendation is made: R940214 The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority, in consultation with aircraft operators who utilise deployable passenger oxygen systems: (i) consider introducing an additional passenger briefing on the use of the deployed masks. This briefing should take place at the time of deployment of the oxygen masks and should detail the correct fitment and operation of the masks. (ii) consider the introduction of automated briefing systems for this purpose. Manufacturer's actions Following this occurrence, the aircraft manufacturer brought forward the promulgation date for the service bulletin addressing inspection and stress-relief treatment of pneumatic ducting P/N 212T3116-5 and adjacent ducting. Operator's actions The aircraft operator has addressed the safety aspects identified in the investigation of this occurrence through the introduction of the following measures. Flight crew procedures 1. The operations manual smoke-removal drill has been amended to caution against deployment of oxygen masks when the cabin altitude is within safe limits. 2. The body duct leak drill has been revised from a reference item to a recall item, in order to reduce the delay in closing the centre duct isolation valve. 3. The importance of improved flight crew awareness of cabin staff procedures during abnormal situations will be emphasised during emergency procedures training. Flight attendant procedures 1. Cabin crew promotion training has been improved, with the incorporation of additional leadership responsibilities in an emergency. 2. Greater emphasis has been placed on the quality of communications to passengers and communication procedures between crew members. 3. Training is provided in simultaneous emergency event response. Maintenance procedures 1. All titanium pneumatic ducting has been replaced on each of the operator's B767 aircraft.