Local safety action
As a result of this incident the aircraft and component manufacturers have changed the software for the EIUs and reclassified the IOP #1 fault as a hard3 fault. Further testing was being conducted at the time of this report's release.
___________
[3] A fault that would completely shut down the affected EIU.
The on-board recorders showed that the highest cabin altitude
captured was 8553 feet with a subsequent continuous decrease in
cabin altitude recorded prior to the loss of the system data. The
cabin altitude did not reach the required height for supplementary
oxygen which was consistent with the reported lack of oxygen flow
through the passenger drop masks after they had deployed.
The operation of the pressure relief valve indicated that an
over-pressurisation condition had been experienced in the cabin.
This was most likely due to the manual closing of the outflow
valves by the flight crew while the aircraft was continuing to be
pressurised by the controlling CPC. The resultant rate of change of
cabin pressure may have contributed to the reported injury
sustained by a passenger.
The concern at the lack of oxygen flow through the masks led to
some cabin crew moving from their seated position to obtain
portable oxygen, or to assist passengers during the emergency
descent.
Extensive research has shown that the effect of oxygen
deprivation can be insidious and, as such, cabin crew may not be
the best judges of their own oxygen intake. Although the cabin
altitude may not have been high enough to require supplemental
oxygen, that information was not available to the cabin crew at the
time. As the cabin crew were unable to accurately judge the
aircraft's altitude, remaining seated until advised by the flight
crew that a safe altitude had been reached, in accordance with
procedures, may have been a safer practice than moving through the
cabin to assist passengers and accessing bottled oxygen.
Although the flight crew conducted an appropriate emergency
descent, most cabin crew commented that the floor angle in the
cabin during the descent seemed less steep than their emergency
decompression training had led them to expect. Previous
decompression events have shown that cabin floor angles less steep
than expected may have led to cabin crew judgement that it was safe
to move about the cabin during an emergency descent.
The reason for the loss of the IDUs could not be determined or
reproduced during the subsequent testing of system components. The
IOP#1 fault found on one of the EIUs, could have led to the
blanking of the PIC's primary flight display, but it should not
have resulted in the failure of the remaining IDUs. The subsequent
IDU blanking incident in January 2003 has resulted in further
investigation by the CAAS, the NTSB, the aircraft and EIU
manufacturers.
History of the flight
On 6 November 2001, as the Boeing 747-400 aircraft was approaching flight level 360 en-route from Sydney to Singapore, the flight crew observed a CABIN ALT AUTO message and an increase in cabin altitude. The crew carried out the non-normal checklist, which included manually closing the outflow valves and turning off one of the air conditioning packs. However, the cabin altitude continued to rise and could not be controlled. The pilot in command (PIC) decided to conduct an emergency descent. The flight crew donned their oxygen masks and manually deployed the passenger oxygen masks.
As the aircraft commenced descent, one of the flight crew noticed the PIC's primary flight display screen go blank, with its data transferring to the PIC's navigation display screen. At that point a number of messages momentarily flashed onto the centre, Engine Indicating and Crew Alerting System (EICAS) screen, before all the display screens that are referred to as integrated display units (IDUs) blanked. The crew continued the emergency descent using standby instruments for reference, levelling at 10,000ft. The IDU system circuit breakers (CBs) were checked with all CBs found to be in their normal configuration. Manual selection between alternate system controllers was made but the IDUs remained blank.
After the post decompression drill announcement was made to the cabin crew, the PIC was advised that one passenger had sustained an injury in the form of bleeding from the ear. The PIC was also advised that there appeared to be no oxygen flowing through any of the passenger cabin oxygen masks, however this did not seem to have had any ill effect on the passengers. After the PIC cycled the passenger oxygen switch, a momentary surge of oxygen through the passenger masks was observed.
With Melbourne Air Traffic Control Centre providing vectoring assistance and using the standby flight instrumentation, the flight crew returned the aircraft to Sydney. Due to the loss of the display screens monitoring information, dumping of excess fuel was not possible. Information regarding the position of the landing gear or flaps was also not available. On approach to Sydney, the flight crew requested that the tower controller visually confirm that the landing gear was down and after receiving that confirmation, the crew conducted an uneventful, but overweight landing.
An inspection of the aircraft by engineers revealed that a cabin pressure relief valve had operated, indicating that the cabin had been over-pressurised at some stage during the flight. After a number of system CBs were cycled, the flight deck display screens returned to normal operation. An engine ground run and system check was then carried out, but the inflight faults could not be reproduced. The primary components of the aircraft's pressurisation and flight deck display systems were removed for further testing.
Cabin crew survey
The Australian Transport Safety Bureau carried out a survey of the cabin crew, which revealed the following:
Some cabin crew were concerned about the lack of oxygen flow through their masks during the descent and opted to use the emergency bottled oxygen. A number of cabin crew were observed removing their mask and later stated that they "could feel the presence of air" in the cabin. Some cabin crew were moving about the cabin during the descent assisting passengers. The majority of the cabin crew described the cabin floor angle as being less steep than their emergency decompression training had led them to expect. There was no evidence that any passengers or cabin crew showed signs of suffering from the effects of decompression sickness.
The operator's decompression drill detailed in the non-normal procedures of the operations manual stated that "When there is a loss of cabin pressure and the cabin altitude exceeds 14,000 feet the oxygen masks will drop. The pre- recorded announcement (where fitted) will start playing automatically".
The cabin crew were then required to immediately "Put on a drop mask as quickly as possible" and "Sit down at nearest available seat and fasten seat belt". The procedure then stated that after the aircraft had levelled off, the cabin crew were to "transfer from drop mask to portable oxygen bottle and mask" and to "assist the passengers".
The procedures also contained supplementary information regarding the symptoms and "effects of decompression sickness". The manual stated that at 10,000 feet cabin altitude, the cabin crew and passengers could experience headaches and fatigue. At 14,000 feet the effect may cause sleepiness, headaches, dizziness, impaired vision, personality changes and cyanosis-bluing of fingernails.
Subsequent occurrences involving this aircraft
On 11 November 2001, the flight crew reported that during climb there were large erratic oscillations of both outflow valves, causing large changes in the cabin altitude. The flight crew reported discomfort to their ears and observed significant rates of change in cabin altitude. The system returned to normal operation when the cabin pressure controller (CPC) was manually selected to position B.
On 16 November 2001, during taxi to the terminal, the flight crew observed the advisory message OUTFLOW VALVE L indicating a failure of the left outflow valve. After a ground test of the CPC was carried out, the message disappeared. During the next flight the message again appeared and again was cleared on completion of a ground test of the CPC.
Subsequent fleet occurrence
On 24 January 2003, all six IDUs blanked on another of the operator's Boeing 747-400 aircraft during a flight from Singapore to Sydney, while at FL350. After discussion with the operator's maintenance control personnel, the flight crew were advised to cycle selected CBs. On reset of the CBs, all the IDUs returned to normal operation and the flight continued on to Sydney. The Civil Aviation Administration of Singapore (CAAS) in conjunction with the United States National Transportation Safety Board (NTSB) are investigating the occurrence.
Component testing
The IDUs and EIUs1 removed after the 6 November flight were subjected to examination and testing by their manufacturers, under the supervision of the NTSB. One of the EIUs was found to have an internal IOP #1 card 'soft'2 fault. This fault should not have led to the IDU failure during the incident flight. No faults were found with the IDUs.
Testing of the pressurisation system components following the initial occurrence did not reveal any faults. After the subsequent flights on 11 and 16 November, further testing was conducted, which revealed that the CPC that had been fitted after the 6 November flight had a faulty pressure sensor that was giving erratic signals. One of the system's relays also displayed evidence of failure. The remaining pressurisation components were considered to be serviceable.
Oxygen system
The aircraft was fitted with two separate oxygen systems; one dedicated flight crew system and one dedicated passenger system. The crew system provided a continuous supply of oxygen to each of the flight deck regulators. Removal of the oxygen mask from the stowage box initiated the flow of oxygen. The passenger system had both manual and automatic deployment. Automatic deployment activated when the cabin altitude reached the "equivalent of 13,250 to 14,250 feet", with manual deployment available at any cabin altitude. This was a free-flow oxygen system with oxygen flow being controlled through flow control units (FCU) located downstream of the oxygen cylinders. During the first few seconds of operation, a surge of oxygen was released to open the panels above the passenger seats, allowing the masks to fall within easy reach of the passengers. The quantity of oxygen supplied was then controlled by altitude compensation mechanisms in the FCUs. The higher the cabin altitude, the greater the flow. Chapter 35-21-00 of the operator's aircraft maintenance manual stated: "Passengers are not required to receive [supplemental] oxygen below 10,000 feet, except for medical reasons".
On-board recorders
Data retrieved from the aircraft's on-board recorders revealed the following:
6:47:22 The first officer's IDUs switched from right to left EIU control, at the same time the pressurisation/air-conditioning system data stopped recording correctly.
6:47:44 The CABIN ALT AUTO message was observed.
6:48:09 The right and left EIU's were recorded as inactive.
6:52:58 Highest cabin altitude was recorded at 8553 feet.
6:54:10 Cabin altitude recorded at 6033 feet.
6:54:15 Numerous systems stopped recording data correctly and the Centre EIU became inactive.
(Note: Times refer to Coordinated Universal Time)
[1] The electronic interface units that transfer data from the electronic flight instrument (EFIS) and engine indicating and crew alerting (EICAS) systems to the IDUs.
[2] A fault that is internally logged but does not result in a complete EIU shut down.