Pressurisation event involving Airbus A320, PK-AXD, 160 NM (300 km) north of Perth, Western Australia, on 15 October 2017

On 15 October 2017, at about 1152 Western Standard Time,^[1] the flight crew on board an AirAsia Indonesia Airbus A320-216, registered PK-AXD, initiated an emergency descent from flight level (FL)^[2] 340 to 10,000 ft in response to a malfunction of the aircraft’s pressurisation system.

Earlier, at about 1122, the aircraft departed Perth Airport, Western Australia, for the planned destination of Denpasar Airport (Bali), Indonesia, with two flight crew, four cabin crew and 146 passengers on board. On departure, air traffic control (ATC) issued the flight crew with a clearance to climb to FL 340. Prior to reaching FL 340, and while the aircraft was climbing through FL 250, the crew noticed repeated system 1 (CAB PR SYS 1 FAULT) fault messages for the pressurisation system appear and then disappear on the electronic centralised aircraft monitoring system. The flight crew reported that each time they accessed the flight management system’s pressure page the fault cleared. The captain queried the first officer as to whether a door could be open, and shortly afterwards both flight crew members commented feeling some discomfort, with the first officer indicating ear discomfort.

At about 1148, just after passing FL 300, the master caution activated for the opening of the cabin pressure system safety valve(s)^[3] (CAB PR SAFETY VALVE OPEN). In accordance with the emergency procedures, the flight crew selected manual control (MAN) for the pressurisation system and, noting a high cabin pressure rate of climb^[4] of 1,100 ft/min, they attempted to close the outflow valve to reduce the cabin pressure rate of climb to the target level of 500 ft/min. The first officer noted the cabin differential pressure^[5] was 8.3 pounds per square inch and the cabin altitude was 8,900 ft (the target cabin altitude for FL 300 in manual control was 5,500 ft). Before the checklist actions could be completed the master caution cleared.

Following the flight crew’s selection of manual control of the pressurisation system, the senior cabin crew member (P1) contacted them and together they discussed experiencing ear discomfort. The captain queried P1 about the security of the cabin doors, which she reported as indicating that they were secure. The P1 reported that there were intermittent activations of the cabin seat belt signs, similar to the indications of a depressurisation.

At about 1151, the master warning activated intermittently for a high cabin altitude (CAB PR EXCESS CAB ALT). The warning initially activated intermittently and then remained on until 1209. The flight crew donned their emergency oxygen masks and requested a clearance from ATC to descend to FL 220 due to pressurisation problems.^[6] The clearance request was then amended to an emergency descent to 10,000 ft. The captain then made a public address to announce the emergency descent to the cabin crew and passengers, which was repeated to the passengers by P1.

After securing herself in her seat, P1 noted the passenger emergency oxygen masks had not deployed and reported this to the flight crew. The flight crew manually deployed the passenger oxygen masks as part of the emergency descent procedure. During the descent, ATC first issued the flight crew with a clearance to return to Perth, and then provided them with radar vectors around active restricted airspace on their descent path. After reaching 10,000 ft, the flight crew announced the aircraft was at a safe altitude for oxygen masks to be removed, and informed the cabin crew and passengers of the aircraft’s return to Perth. The aircraft landed safely at Perth Airport at about 1248.

During the emergency descent there was an intermittent activation of the master caution for cabin low differential pressure (CAB PR LO DIFF PR). Figure 1 below depicts the flight data showing the activation of the alerts, and the descent from about FL 340 to 10,000 ft, which was at an average rate of about 2,300 ft/min (maximum of 4,300 ft/min). There were no reported injuries and the aircraft was not damaged. The post-flight maintenance tests identified a fault with the cabin pressure controller 1 (refer to Aircraft information).

Figure 1: Activation of alerts and start of emergency descent

Information from the flight data recorder depicting the activation of alerts and start of the emergency descent in UTC. [7]

Source: ATSB

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 340 equates to 34,000 ft.
3. There are two safety valves fitted, but it only takes one to activate the master caution.
4. The aircraft cabin pressure climbs and descends on a schedule, as the aircraft climbs and descends, to minimise the pressure difference across the cabin wall and to limit the maximum cabin altitude to a level that is acceptable for passenger comfort.
5. Cabin differential pressure is the difference in pressure between inside the aircraft cabin and the local external atmosphere (i.e. across the cabin wall).
6. The flight crew were communicating with air traffic control through their emergency oxygen masks, which, in addition to other radio traffic, contributed to the communications difficulties.
7. Coordinated Universal Time (UTC): the time zone used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC. Western Standard Time: UTC + 8.

Personnel information

For flight crew training and experience, refer to General details. For cabin crew training and experience, refer to Cabin safety.

Aircraft information

Throughout the normal operation of an aircraft, the crew and passengers must be kept in comfortable conditions regarding the temperature, humidity and pressure of the cabin air. This is managed by the various environmental control systems. The environmental system of interest to the investigation was the cabin pressurisation system. This system regulates the flow of air through the cabin and pressurises the cabin to an altitude that provides sufficient oxygen for normal human functions.

Pressurisation system

Cabin pressure can be set by the flight crew to operate in automatic, semi-automatic or manual mode. In automatic and semi-automatic mode, pressurisation is maintained by one of two independent cabin pressure controllers (CPCs), which communicate with each other via a discrete connection that indicates which system is in control. One CPC is in operational state while the other is in standby state. The operational CPC controls the cabin outflow valve position by means of its associated motor. This controls the cabin pressure and indirectly controls the difference in pressure between the cabin and external atmosphere (differential pressure).

If there is a problem with the automatic or semi-automatic mode of control, the flight crew can select manual mode and signal the outflow valve to open or close as desired to manage the differential pressure. In addition to the outflow valve, there are two independent pneumatic safety valves to prevent excessive excursions in differential pressure. They operate in the range of positive 8.6 plus or minus 0.10 pounds per square inch (psi) differential pressure.

The CPCs do not control the deployment of the passenger oxygen masks. They are controlled by an independent pressure sensor.

For an explanation of the alert messages provided to the flight crew during the incident, refer to Appendix A - Incident flight faults.

Manufacturer’s investigation

The aircraft’s two CPC’s and outflow valve were sent to the manufacturer, Nord-Micro, for inspections and tests. They isolated the source of the pressurisation system faults to the CPC 1 circuit board after excluding the pressure sensor fitted to CPC 1. The fault with the circuit board likely resulted in the intermittent incorrect calculation of cabin pressure by the CPC, which controlled the position of the outflow valve in automatic mode and produced spurious excessive cabin altitude warnings in the operational and standby state until it recorded a failure.

Cabin pressure controller 2 and the outflow valve were found to be serviceable with the exception of an intermittent fault with the outflow valve when tested in the manual mode. This fault was not associated with the automatic mode of operation and did not reoccur during a repeated test.

For further details about the manufacturer’s investigation and the calculation of cabin pressure values, refer to Appendix B - Manufacturer’s inspections and test results.

Previous related incidents

The Airbus Design Office reported that they had no similar cases of this specific mode of CPC malfunction. However, two previous serious incidents occurred in 2000 and 2006, in which the standby CPC did not take control from the operational CPC during a malfunction. The incidents were investigated by the Switzerland Aircraft Accident Investigation Bureau (AAIB) and the United Kingdom (UK) Air Accidents Investigation Branch (AAIB) respectively.

AAIB Switzerland

Pressurisation emergency, Final Report No. 1820 by the Aircraft Accident Investigation Bureau concerning the serious incident to the aircraft Airbus A321-111, HB-IOA, operated by Swissair under flight number SWR809 on 21 February 2000 during the flight.

According to the investigation report, at FL 330 the aircraft had a rapid increase in cabin altitude. CPC 2 was in control and indicating a malfunction without CPC 1 taking control. Shortly afterward, CPC 1 indicated a failure and the outflow valve remained half-open. An EXCESS CAB ALT warning was triggered, emergency descent initiated, and cabin pressurisation managed in manual mode. A defective cabin pressure sensor was subsequently identified.

AAIB United Kingdom

Serious incident involving an Airbus A320-232, registered G-MIDW, on 8 October 2006.

According to the investigation report, at FL380 the CAB PR EXCESS CAB ALT warning displayed, but the flight crew noted the cabin pressurisation system parameters were normal. Although not experiencing any physiological symptoms of hypoxia, the flight crew donned their oxygen masks. In accordance with their FCOM Pressurization: controls and indicators, the captain changed the operational CPC from 1 to 2.^[8]

Note: If the pilot suspects that the operating pressurization system is not performing properly, he [she] can attempt to select the other system by switching the MODE SEL pushbutton to MAN, for at least 10 seconds, then returning it to AUTO.

After selecting CPC 2, the cabin altitude indicated it was above 10,000 ft. The captain suspected this to be in error and reselected CPC 1. After a few minutes the captain reselected CPC 2 for a cross-check and noted the cabin altitude indicated about 14,000 ft. The captain then reselected CPC 1. The AAIB concluded that the absence of any physiological symptoms of hypoxia, and the expectation of the automatic transfer of control in the event of a malfunction, suggested to the captain the fault was with CPC 2, which led to the decision to reselect CPC 1. The cabin crew then reported to the flight crew that the passenger oxygen masks had deployed. The flight crew declared a MAYDAY^[9] and conducted an emergency descent to 10,000 ft.

Airbus confirmed an unspecified fault within the SYS 1 CPC and advised:

The failure scenario has been reviewed by the Airbus PSC (Product Safety Committee) in Feb 07. This scenario is rare (only one case reported up to now) but the information provided to Crew was confusing. This subject will be therefore further investigated by this Safety Committee to review possible improvement in the current architecture. (Next screening end of May 07).

Pressurisation system product improvements

Following the 2006 incident, investigated by the UK AAIB, several improvements to the system were introduced by Airbus. They included an amendment to the FCOM CAB PR EXCESS CAB ALT emergency procedure; consolidation of the CPC pressure information; and a new memo for the electronic centralised aircraft monitoring (ECAM) system when oxygen masks are deployed in the cabin.

Emergency procedure

The FCOM CAB PR EXCESS CAB ALT emergency procedure was amended to include the following information for the flight crew:

Rely on the CAB PR EXCESS CAB ALT warning even if not confirmed on the CAB PRESS SD [status display] page. The warning can be triggered by a cabin pressure sensor different from the one used to control the pressure and display the cabin altitude on the SD.

Consolidation of pressure information

Consolidation of the CPC pressure information for the A320 aircraft family was embodied through Airbus Service Bulletins (SBs) A320-21-1203 (outflow valve) and A320-21-1204 (CPC), introduced in February 2014. Service Bulletin A320-21-1203 introduced a modified outflow valve, which incorporated a pressure sensor within the Electronic Box (E/Box) to provide a second calculated cabin pressure value for comparison with the CPC calculated cabin pressure value to improve the system built-in-test capability. Service Bulletin A320-21-1204 introduced a modified CPC to communicate with the E/Box and allow the built-in-test-equipment to detect erroneous pressure data acquisition by comparison of the CPC pressure sensor value with the E/Box value (subject to embodiment of A320-21-1203). If the two values of calculated pressure differ too much, the active CPC will indicate a system fail and enable the standby CPC to take control of the pressurisation.

The SBs were recommended and not mandatory. The operator reported that they had reviewed the service bulletins and elected not to incorporate them in PK-AXD as they did not identify the potential consequences. The SBs included the potential consequence of incorrect control of the cabin pressure on their front page.

Electronic centralised aircraft monitoring system update

A further service bulletin, SB 35-1068, allowed the display of an ECAM message when the passenger oxygen masks are deployed in the cabin – OXY PAX ON. This message is displayed in green when both CPCs detect excessive cabin altitude and in amber when one CPC or both CPCs do not detect excessive cabin altitude.^[10] This will alert the flight crew to the condition of the passenger oxygen masks, without the need to rely on a verbal report from a member of the cabin crew. The operator reported that it elected not to incorporate the service bulletin as it was classified as recommended, rather than mandatory. However, the incorporation of SB 35-1068 would probably not have influenced the incident.

ATSB follow-up

In response to an ATSB query whether the circumstances and procedure for flight crew to manually change the operational CPC would be worth considering for inclusion in the CAB PR SYS 1(2) FAULT emergency procedure, Airbus reported that:

A modification of the CAB PR SYS1(2) FAULT procedure to be displayed on the ECAM requires a new Flight Warning Computer (FWC) standard that means development time before all aircraft can be fitted with this standard (retrofit time). A much quicker solution is to reintroduce the philosophy of this old note into the operational documentation. It already exists as a recommended action within the Quick Reference Handbook in the case of abnormal vertical speed. In this event, we know that the CPC1 computed and displayed wrong and excessive cabin altitudes, but without any previous indications of abnormal cabin vertical speed. Therefore, we intend to recommend a manual CPC changeover in case of excessive cabin altitude. This modification will be implemented in the A320 Quick Reference Handbook revision March 2019.

The ATSB noted that although the incident flight fault was isolated to the CPC 1 circuit board, it resulted in incorrect cabin pressure values, and therefore queried whether the embodiment of SBs A320-21-1203 and A320-21-1204 would have affected the performance of CPC 1. In response, Airbus reported that:

The implementation of the two SBs improves the cabin pressure control by modifying (1) the outflow valve with the introduction of a second pressure sensor and (2) the CPC to enable it to detect pressure sensor discrepancies by comparison of the two cabin pressures calculated using the CPC pressure sensor on one side and the outflow valve pressure sensor on the other side. Note: the comparison is done at the level of the calculated cabin pressure and not at pressure sensor level.^[11] It is therefore considered that the implementation of the SBs would have helped to detect the CPC 1 failure earlier and would have enabled an automatic changeover to CPC 2.

Cabin safety

The cabin crew consisted of a senior cabin crew member (P1) and cabin crew member P4, seated at the front of the cabin, and two cabin crew members, P2 and P3, seated at the rear of the cabin.

Events in passenger cabin

Cabin crew recollection of events

The cabin crew were preparing for the food service at the time the CPC 1 malfunctions started. At this time, P1 and P4 experienced some ear discomfort, but not P2 and P3. Before P1 spoke to the flight crew, the cabin emergency lighting, which included the seatbelt signs, activated intermittently. This was reported by P1 to the flight crew as ‘like an indication of depressurisation’. When the seatbelt signs illuminated, P3 checked to see if the passengers had fastened their seatbelts. P2, P3 and P4 reported that they initially believed the seatbelt signs were activated by the flight crew for turbulence.

Following her conversation with the flight crew about the symptoms in the cabin, P1 made a public address (PA) announcement for passengers to fasten their seatbelts, and began checking the passengers. When P1 heard the flight crew PA for the emergency descent, she moved from about row five to her seat at the front of the cabin and repeated the emergency descent PA - ‘EMERGENCY DESCENT, EMERGENCY DESCENT, EMERGENCY, EMERGENCY’ (in English only). She then called the flight deck and reported the oxygen masks had not deployed.

When the masks deployed, she donned her mask and announced three times to the passengers - ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’. In addition to her announcement, she used hand signals to demonstrate the instructions. This announcement and the use of hand signals were in accordance with the operator’s standard operating procedures.

At the rear of the cabin, P2 initially announced ‘SIT DOWN’, while waiting for the masks to deploy. When the masks deployed, P2 and P3 noted the passengers at the rear did not appear to know what to do, therefore the crew members announced the instructions, ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’, and demonstrated the actions, which appeared to elicit a positive response from the passengers.

Following the emergency descent, P1 heard the announcement that the aircraft was at a safe level and she then checked on the welfare of the other cabin crew members and confirmed there was no damage to the cabin. She instructed the other cabin crew to take the portable oxygen bottles for the passenger welfare checks and then contacted the flight crew to confirm there were no further problems. P1 then assisted the other cabin crew members with their passenger welfare checks and reported that no one needed medical assistance.

After arrival at Perth, P1 noted several passengers had donned their life jackets. During disembarkation she then received several passenger reports of the cabin crew members at the rear panicking, shouting and alarming the children. When P1 followed up with those members, P3 reported that she may have appeared to be panicking because she felt the oxygen mask was not providing sufficient oxygen. P2 and P3, at the rear of the cabin, reported that they were shouting as this was the procedure. P3 reported that she shouted at a passenger who stood up during the descent due to the risk of a fall.

Operator’s emergency announcement

When the passenger oxygen masks were released, an automatic recording was broadcast in seven different languages sequentially (English, Indonesian, Mandarin, Malaysian, Thai, Arabic and Japanese). The English instructions were:

Attention, Attention. There has been a loss of pressure in the cabin. Pull down firmly on the nearest mask, place over your nose and mouth, adjust the headband, and breathe normally. Attend to yourself before helping your child. If you are standing, go to the nearest seat, fasten your seatbelt, put on a mask and breathe normally. The cabin pressure will return to normal in a short time.

Although passengers reported hearing both the cabin crew commands and this automatic recording, it is not clear if they were at different times or at the same time. Given that the automatic recording starts when the oxygen masks drop on a sequential loop through the seven languages, it is probable that the cabin crew commands were given at the same time as the automatic recording was still playing.

Cabin crew procedures and training

Cabin crew depressurisation procedure

The operator’s Safety emergency procedures manual provided instructions for flight crew and cabin crew for a depressurisation. The action for the flight crew to alert the cabin crew of a depressurisation was the PA announcement ‘EMERGENCY DESCENT’. The cabin crew were then required to take the following action:

1. Grab and don nearest oxygen mask. Cabin crew must attend to their own oxygen needs first in order to be able to assist passengers.

2. Sit on nearest seat and fasten seatbelt. If necessary, sit on the floor and hold on to rigid structure.

3. If possible use the PA system or shout command to passengers through oxygen mask twice: ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’.

4. If descent not evident after masks drop, the nearest cabin crew to the Flight Deck shall contact the flight crew via interphone…

5. Remain seated until the PIC [pilot-in-command] advises cabin crew via PA that aircraft is at safe level.

After the aircraft has descended to a safe level, the flight crew were required to alert the cabin crew with a PA ‘CABIN CREW, AIRCRAFT AT SAFE LEVEL’, at which stage the cabin crew were required to attend to passengers and inspect the cabin.

Although not published in their emergency procedures manual, AirAsia had additional guidance in their training drills handbook if oxygen masks did not deploy. This included the announcement: ‘KEEP CALM, REMAIN SEATED, FASTEN SEATBELT’ [English and Bahasa].

Cabin crew training

• P1 had been employed by the operator for 12 years and her most recent emergency drills training (including depressurisation drill) was conducted in February 2017.
• P2 and P3 had been employed by the operator for three years and their most recent emergency drills training were in September and October 2017, respectively.
• P4 had been employed by the operator for four years and his previous emergency drills training was in July 2017.

The operator provided their cabin crew with annual emergency training. This was in accordance with the International Civil Aviation Organization (ICAO) Annex 6 requirement for a recurrent training program to be completed annually. Their annual training was either classroom alone, or included the emergency drills module at a maximum interval of 24 months. According to the operator, the drills modules ‘require crew members to actually operate the items of emergency equipment (hands-on)’. The cabin crew members on board the incident flight were current for their emergency drills training at the time of the incident.

The ICAO Cabin crew safety training manual provides further guidance and explanatory material to the requirements of Annex 6. The manual explains that although there is a requirement for annual recurrent training, not all competency elements are required to be covered annually. It is the responsibility of each (ICAO Member) State to determine the cycle (time-period) within which all recurrent training must be completed. The manual provides a 36-month cycle as an example.

The ATSB noted from a review of the regulations from five different jurisdictions that the frequency for cabin crew emergency drills training is generally low when compared with flight crew.^[12] Of those reviewed, the ATSB found the frequency of training for cabin crew emergency drills ranged from between a 12-month cycle to no requirement for recurrent drills training.^[13][14]

The ATSB also noted that the ICAO Cabin crew safety training manual made several recommendations to improve simulated exercises. They included joint flight crew and cabin crew exercises and a solo exercise for cabin crew members, so they could demonstrate their ability to take command of a situation. It also recommended other cabin crew trainees and employees act the role of passengers during the exercises. The intent was to ‘offer an acceptable level of practical experience close to what can be expected in actual occurrences’.

To support the delivery of the depressurisation module of emergency drills training, the operator used a single-aisle cabin trainer with deployable passenger emergency oxygen masks. The training for depressurisation included the physiological symptoms of hypoxia and how to manage the scenario. This included cabin preparation and instructions to passengers. The operator provided the ATSB with a training video of cabin crew depressurisation drills, which included additional personnel acting as compliant passengers.

Within the aviation industry, incorporating scenarios within training has been used extensively with flight crew.^[15] It has been found that crew who complete scenario-based training demonstrate scores higher in team co-ordination dimensions (such as communication) and make fewer errors in tasks compared to the crew who do not complete this type of training.^[16]

Passenger safety information for oxygen masks

Safety information standards

The requirements for passenger safety information on the use of oxygen equipment on international flights are published in ICAO Annex 6. Annex 6 detailed the following:

4.2.12.1 The operator shall ensure that passengers are made familiar with the location and use of:

d) oxygen dispensing equipment, if the provision of oxygen for the use of passengers is prescribed.

To provide guidance material in support of the provisions of Annex 6, in 2018 ICAO published Doc 10086: Manual on information and instructions for passenger safety. Doc 10086 provided the following explanatory material for the safety demonstration of oxygen masks:

2.6.2 The safety demonstration should include information about the following items:

e) location and use of oxygen masks, if applicable, including:

1) The actions to be performed by a passenger to: i) obtain a mask; ii) activate the flow of oxygen; and iii) don and secure the mask; and

2) The requirement for a passenger to don and secure his/her mask before assisting another passenger with his/her mask.

Chapter 3: Passenger safety briefing card, provided the same guidance for the content of the safety briefing card, with respect to oxygen masks, as per the safety demonstration.

In 2003, the United States Federal Aviation Administration published Advisory Circular 121-24C: Passenger safety information briefing and briefing cards. In addition to the need to demonstrate to passengers how to start the flow of oxygen, the circular also advised operators that their safety briefing ‘should include the information that oxygen mask reservoir bags may not inflate, although sufficient oxygen is flowing into the bag’.^[17]

In 2018, the Civil Aviation Safety Authority published version 2 of Civil Aviation Advisory Publication (CAAP) 253-02: Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators. CAAP 253-02 provided the following information about oxygen equipment for the pre-take-off oral brief:

Oxygen. Crew members must brief passengers on the use of oxygen where applicable:

i. This briefing should include locating, donning and adjusting the equipment, and any action that might be necessary to start the flow of oxygen. Passengers should also be given instructions regarding the automatic appearance of the masks (where applicable) and be advised to don their own oxygen mask before assisting others.

ii. It is suggested that passengers be advised (where applicable) that oxygen will flow through the mask even though the bag may not inflate.

CAAP 253-02 provided the following information for oxygen masks in the content of safety information cards:

Oxygen masks. The card should contain instructions on the location, donning and means for adjusting oxygen masks; any further actions needed to start the flow of oxygen; and instructions to passengers to don their own mask before assisting children.

The Civil Aviation Safety Authority assessed foreign air transport operators with Form 073-C, which was in accordance with the requirements of ICAO Annex 6.

Operator’s passenger safety information

The operator’s safety instructions to the passengers were provided in English and Bahasa before take-off (see Passenger attentiveness to the safety briefing). The announcement for oxygen masks included the following:

Should an OXYGEN MASK like this drop from the compartment above your seat, immediately pull the mask firmly towards you. Place the mask over your nose and mouth with the headband tightly around your head and breathe normally. Place your own mask [on] first, before assisting others under your care.

The operator provided a safety information card to every passenger seat. The operator’s safety information card content included instructions in English and Bahasa with images to demonstrate each of the three steps (Figure 2):

1. Pull the mask down towards you.

2. Place the mask over your nose and mouth, place strap behind your head and breathe normally.

3. Place mask on yourself before helping those under your care.

Figure 2: Passenger safety information card oxygen mask instructions

Source: AirAsia Indonesia, annotated by ATSB.

Passenger attentiveness to the safety briefing

The cabin crew delivered the passenger safety briefing after aircraft pushback from the gate. This was delivered without the support of audio-visual briefing media. The senior cabin crew reported the passenger attentiveness as normal. The cabin crew at the rear of the aircraft reported about 70 per cent of passengers were attentive to the safety briefing. The cabin crew members at the rear and over-wing exit noted several passengers were sleeping and asked some of the passengers to turn off their portable electronic devices, or remove headsets for the safety briefing. The cabin crew member at the front of the aircraft reported that the passengers were attentive.

Passenger oxygen units

Each row of seats in the passenger cabin had an emergency oxygen container installed above it. The container doors open automatically when the cabin altitude reaches 14,000 ft, or manually by flight crew selection. Each container had one chemical^[18] oxygen generator canister, four masks with lanyards and associated supply hoses (Figure 3).

Figure 3: Deployed oxygen unit

Source: ATSB

All four lanyards were attached to one release pin, which, when removed, allowed a spring-loaded firing pin to strike a percussion cap and initiate the chemical reaction (Figure 3 & 4). Only one lanyard was required to be pulled to remove the release pin and drop all four masks for the unit. Oxygen gas was released as a product of the chemical reaction. A thermal indicator on the canister will turn black to indicate the chemical has burned, and a green stripe will appear in the supply hoses to indicate oxygen has flowed (Figure 4).

Figure 4: Release pin and lanyards (top) and hose connection (bottom)

Source: ATSB

There were 180 passenger seats in the aircraft,^[19] and, with four masks for each row of three seats, there were 240 masks provided for the passenger seating. This ensured about a 33 per cent excess in the number of passenger oxygen masks. The certification requirement was for the number of dispensing units and outlets to exceed the seating capacity by 10 per cent, with the extra units distributed as uniformly throughout the cabin as practicable.^[20] In the event that a container door does not open, the aircraft was equipped with a manual release tool, which may be used by the cabin crew to release a unit. This was not used in-flight as the cabin crew remained seated during the emergency descent.

Performance of the passenger oxygen units

The ATSB inspected the cabin of the aircraft, with attention to the performance of the passenger emergency oxygen system, and noted the following:

• two containers did not open at seats 23 FED and 27 FED (Figure 5)
• two canisters had the release pin removed, but did not activate to produce oxygen, at seats 29 CBA and 31 CBA
• two containers were found deployed, but the masks were not pulled to remove the release pin at seats 17 CBA and 25 FED
• all other passenger seat masks were deployed and their associated canister activated
• all cabin crew and toilet masks were deployed
• one portable oxygen unit appeared to have been removed from storage.

Figure 5: Passenger oxygen units

Depiction of the passenger oxygen units, as found by the ATSB after the incident aircraft landed.
Source: ATSB

Airbus reported that incorrect mask packing could result in additional force on the container door which may prevent an automatic release of the door. In addition, there is a clearance limit between each container and adjacent panel, which could obstruct the automatic release of the door if the tolerance was infringed. According to the operator’s passenger manifest, there were passengers allocated to seats 17 BA (lanyards not pulled), 23 DEF and 27 EF (masks did not deploy), and 29 CB and 31 BA (masks did not provide oxygen).

The passenger oxygen system is subject to two separate maintenance checks. An operational check of manual mask release is required every 80 months or 8,500 flight hours. A functional check of the automatic release and detailed inspection of masks and oxygen generators is required every 72 months or 24,000 flight hours. The incident aircraft satisfactorily passed the operational check of the manual release during the last C06 inspection on 15 August 2016, and the functional check of the automatic release during the last C03 inspection on 17 July 2012.

Passenger survey information

The ATSB conducted a voluntary passenger survey about their experiences on the flight, which included the passenger emergency oxygen units. The survey included a section for parents to complete on behalf of their children. From 146 passengers on board, 67 responses were received, comprised of 57 adult and 10 children. The survey was completed within six months of the incident date with a response rate of 46 per cent.^[21]

Analysis of the survey results showed the following information from the adult respondents about the safety information:

• 98 per cent reported that they paid attention to the pre-flight safety demonstration or safety information card, and 74 per cent reported they paid attention to both.
• 81 per cent reported the safety information for the use of the oxygen masks was either ‘easy’ or ‘very easy’ to understand. Seventeen per cent reported it as ‘neutral’ and 2 per cent reported it as ‘hard’.

The following information was received in response to the deployment of the oxygen masks:

• In addition to the finding that the units in rows 23 DEF and 27 DEF did not deploy, it was reported that the units in rows 8 CBA, 10 CBA and 17 CBA did not automatically deploy, and were pulled down by passengers.
• 33 per cent reported the pre-recorded oxygen mask announcement was in a foreign language.
• 72 per cent reported their masks deployed automatically, 19 per cent reported they deployed automatically but had to pull them down, and 9 per cent reported their masks did not deploy.
• 56 per cent reported they were ‘somewhat confident’ in using their oxygen masks, and 32 per cent reported they were ‘very confident’. Twelve per cent reported they were ‘not confident’ due to not knowing if the oxygen was flowing, or feeling panicked, or not realising they had to pull down on the mask to start the flow of oxygen.
• 21 per cent reported oxygen was ‘not flowing’ from their mask, 21 per cent reported it was ‘flowing a little’, 5 per cent reported it was ‘flowing a lot’, and 53 per cent reported they could not tell if oxygen was flowing.
• Six respondents provided comments about the oxygen mask bag, which included that they were uncertain if oxygen was flowing because the bag did not inflate, and that the instructions should include reference to the fact that the bag may not inflate when oxygen is flowing.
• Two respondents reported the oxygen hose was required to be pulled to activate the flow of oxygen (this was a free text response, so it is possible the actual number was higher).

The following information was received in response to the cabin crew announcements and actions after the emergency descent started:

• 53 per cent reported that the cabin crew instructions included ‘emergency’, ‘brace’, ‘get down’ and ‘crash position’.
• 14 per cent reported that the cabin crew provided the instructions ‘sit down, fasten seatbelt, put masks on, and calm down’, repeatedly.
• 56 per cent reported the instructions provided during the emergency descent were not clear due to the cabin crew appearing distressed, which affected their ability to communicate with the passengers, limited English proficiency, the automatic broadcast was in a foreign language and there was no information provided about the reason for the emergency descent.
• 56 per cent reported they either felt panicked themselves, or observed others appearing to be panicking during the incident.
• Several respondents acknowledged that this may have been the first time the cabin crew had experienced such an event. Three considered the cabin crew responded well, given the instructions they provided were in a second language. Seven reported that the flight crew could have provided more information about the situation.

The respondents with children provided the following information:

• One reported there was no mask for their child and they provided their child with oxygen from their own mask.
• One reported the oxygen ceased to flow before the alarm ceased.
• One reported that there was no oxygen flow from the mask deployed for their child.
• Three reported their child experienced emotional distress from the incident.

Previous related safety issue

Following the rapid depressurisation of a Boeing 747, carrying 369 passengers at FL 290 on 25 July 2008, the cabin crew reported that while most passengers began to use the oxygen masks appropriately, some passengers had to be given immediate and direct instruction how to use their masks.^[22] As a result of this observation, the ATSB raised safety issue AO-2008-053-SI-02: Inadequate passenger safety briefing about oxygen masks, on 22 November 2010.

Safety issue

The safety information provided to passengers did not adequately explain that oxygen will flow to the masks without the reservoir bag inflating.

Proactive action by the operator

The operator indicated that the standard pre-flight safety video / briefings provided to passengers have been modified to reinforce the message that users must pull down on the mask firmly to activate oxygen flow, and to include the comment ‘Oxygen will flow without the bag inflating’.

__________

8. This was in the system description section of the FCOM and not in the abnormal and emergency procedures section. The 2006 FCOM procedure suggests to the flight crew the circumstances in which they may wish to consider changing the operational CPC, which was subsequently amended to the procedure at the time of the PK-AXD incident, as described in Appendix A - Incident flight faults.
9. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
10. The passenger oxygen mask system has its own pressure sensor and is not reliant on the CPC pressure sensor module.
11. Refer to Appendix B – Manufacturer’s inspections and test results, for the explanation of raw versus calculated cabin pressure values.
12. ICAO Annex 6 requires flight crew to conduct proficiency checks twice annually, and Mahony et al. (2008) research into cabin crew skills in first aid found that after 12 months they could not perform satisfactorily to manage a cardiac arrest scenario.
13. Where there was no requirement for cabin crew recurrent emergency drills training, there was still a requirement for recurrent annual training in emergency equipment and procedures.
14. The ATSB noted that the Civil Aviation Safety Authority (2015) draft Part 121 Manual of Standards for large aeroplane operations included depressurisation drills for initial cabin crew training only and omitted it as a recurrent training requirement. The Civil Aviation Safety Authority responded that this document is an industry draft document, which is still subject to consultation, and that during development of the final document, the content of the relevant ICAO documents will be considered for inclusion as appropriate.
15. Fowlkes J, Dwyer DJ, Oser RL and Salas E, 1998. Event-based approach to training (EBAT). The International Journal of Aviation Psychology, 8(3), 209-221.
16. Leedom, DK and Simon, R 1995. Improving team co-ordination: A case of behaviour-based training. Military Psychology, 7(2), 109-122.
17. The passenger oxygen is a continuous flow and whether or not the bag inflates will depend on the flow rate and passenger demand.
18. There is a combination of chemicals with the oxygen generator. The main ingredient is sodium chlorate, which produces oxygen gas when it is heated to 300 °C.
19. The aircraft was fitted with 30 rows of seats, but there was no row numbered 13. Therefore the last row was 31.
20. CS 25.1447: Equipment Standards for Oxygen Dispensing Units.
21. There was a delay of three months before the passenger manifest data was received, which may have adversely influenced the response rate and the memories of the respondents.
22. On average, three depressurisation events of high capacity passenger transport aircraft are reported to the ATSB each year.

Introduction

In response to the pressurisation system malfunctions and emergency descent of AirAsia Indonesia Airbus A320, registered PK-AXD, on 15 October 2017, the ATSB undertook enquiries into the technical failure, performance of the flight crew and cabin safety, which included interviewing cabin crew and conducting a passenger safety survey. While the investigation findings for the technical failure relate to the A320 aircraft operated by AirAsia Indonesia, the cabin safety findings may be relevant to other aircraft types and other airline operators.

Pressurisation system performance and procedures

Emergency descent

At about 1122 local time, the aircraft departed Perth Airport for the destination of Bali, Indonesia, with cabin pressure controller 1 (CPC 1) controlling cabin pressurisation in automatic mode. While on climb, passing FL 250 at about 1141, the flight crew received a series of intermittent cabin pressure system 1 (CPC 1) fault messages. However, each time the flight crew selected the cabin pressure display page, the fault message cleared.

Eight fault messages were generated between 1141 and 1148. At 1148:14 the cabin differential pressure had increased to 8.4 pounds per square inch (psi). Five seconds later at 1148:19 the cabin differential pressure had reduced to 7.8 psi. In that time, CPC 1 (incorrectly) commanded the outflow valve to close from the 6 per cent open position to 2 per cent open. This led to the over-pressurisation of the aircraft cabin and activation of the cabin safety valve(s). It is likely that between the period of 1148:14 and 1148:19, the cabin differential pressure reached 8.5 psi, which was within the tolerance to activate the safety valve(s), but the actual time of opening was not traceable.

At 1148:29 the flight crew selected manual control of the pressurisation system, and noting the high rate of cabin altitude climb of 1,100 ft/min, they attempted to manually set 500 ft/min, which was the published target figure. Between 1151 and 1155, while in manual cabin pressure control, the excess cabin altitude alert triggered three times. As the passenger oxygen masks are automatically deployed in response to a sensor independent of the CPCs, and there were no further excess cabin altitude warnings after CPC 1 generated its failure message, it is likely the cabin altitude never exceeded 14,000 ft (the trigger for passenger oxygen masks) and therefore there was low risk of a hypoxia-related event.

The repeated excess cabin altitude warnings were likely the result of what the manufacturer described as ‘abnormal stepwise changes’ in CPC 1’s calculated cabin pressure values, which deviated from the raw cabin pressure values.

As a result of the excess cabin altitude alerts, the flight crew conducted the emergency descent procedure, starting the descent at about 1152:20. A review of operator’s procedures, A320 emergency procedures, cockpit and flight data recorders, found no significant discrepancies between the flight crew’s actions and published procedures. However, the flight crew reported that they should have stopped the climb when the cabin pressurisation system 1 fault messages started and given more attention to the cabin altitude.

The ATSB concur with the flight crews’ comment and note that if a depressurisation had occurred due to incorrect outflow valve control, in-lieu of over-pressurisation, stopping the climb at a lower level would have increased their time of useful consciousness in order to don their oxygen masks. The time of useful consciousness is considered to be the ‘amount of time an individual is able to perform useful flying duties in an environment of inadequate oxygen’, and, for example, this will decrease from 3–5 minutes at 25,000 ft to 30–60 seconds at 35,000 ft.^[23]

Cabin pressure controller 1 fault

The aircraft’s CPC 1, CPC 2 and outflow valve were sent to the manufacturer for inspections and tests. They found that CPC 1 produced 12 intermittent fault messages between 1141 and 1151, before registering a failure at 1159. They concluded an automatic changeover from CPC 1 to CPC 2 would likely have occurred at 1159, following the CPC 1 failure code. However, the flight crew had already intervened and taken manual control of the system at 1148:29. Bench testing of CPC 1 reproduced the fault with and without the CPC 1 pressure sensor module, which isolated the fault to the CPC 1 main circuit board. The fault could not be isolated any further.

From the test results, the ATSB noted that if the flight crew had selected CPC 2 (manual changeover) during the initial period of cabin pressurisation system 1 fault messages, the subsequent alerts and emergency descent might have been avoided. Airbus have reviewed the incident flight faults and elected to amend the A320 Quick Reference Handbook to provide further instructions to flight crew as to when it would be appropriate to manually change the active the CPC, rather than rely on automatic change (see Safety issues and actions).

Service bulletins

Following a previous related incident, Airbus produced two service bulletins to improve the reliability of cabin pressure control. They required the modification of the cabin pressure controllers and outflow valve. Pre-modification, with only one pressure sensor, the system built-in-test-equipment could not detect incorrect cabin pressure values, used to schedule the position of the outflow valve. The incorporation of both service bulletins provided a second calculated pressure sensor value at the outflow valve, which the built-in-test-equipment could compare with the active CPC calculated pressure sensor value to detect a mismatch in calculated values. The incident aircraft did not have the service bulletins incorporated at the time of the incident.

The component manufacturer’s testing found that on several occasions the calculated cabin pressure deviated from the raw cabin pressure, with the calculated values identified as corrupted values. In addition, the crew reports of ear discomfort, which is a common symptom of pressure changes, and activation of the safety valve(s) suggested that CPC 1 was providing incorrect scheduling information to the outflow valve before the excess cabin altitude alerts. The incorrect scheduling of the outflow valve position suggested CPC 1 was using incorrect calculated pressure values, resulting in a cabin overpressure, before the flight crew had selected manual control of the system. Therefore, the ATSB requested, and received, analysis from Airbus about the likely effect of the incorporation of the service bulletins in this incident scenario. In response, Airbus concluded that the embodiment of the service bulletins by the operator would have helped to detect the CPC 1 failure earlier and that would have enabled an automatic changeover to CPC 2.

In consideration of the likelihood that incorrect calculated pressure values were used by CPC 1 prior to, and after, the flight crew selected manual control, and that incorporation of the service bulletins would have provided the system built-in-test-equipment with a different source of calculated pressure values for comparison, the ATSB concurred with Airbus. It was therefore considered likely that the incorporation of the service bulletins would have facilitated the earlier activation of a CPC 1 system fail, automatic changeover to CPC 2, and prevention of the nuisance warnings and associated emergency descent.

Cabin safety

Passenger oxygen mask instructions

A high percentage of passengers that responded to the survey indicated that they had given their attention to the operator’s safety information card and safety demonstration. They also reported the safety information card was easy to understand. However, despite the generally high positive response to the safety information presented, a number of respondents reported they were not confident in using the oxygen masks and a high number of respondents reported that oxygen was either not flowing, or could not tell if it was flowing (this number was far greater than the number of oxygen units that malfunctioned).

The operator’s safety information included the instruction to ‘Pull the mask down towards you’. This was the required action to start the flow of oxygen, which was consistent with several published standards for passenger safety briefing. However, as it did not state that this action would start the flow of oxygen, there was a risk that passengers would not understand the association. Two survey responses that the ‘oxygen hose’ was required to be pulled to activate the flow of oxygen, suggested a possible misunderstanding amongst some of the passengers.

In addition to the uncertainty surrounding the activation of oxygen flow, a number of passengers reported that the oxygen mask bag did not inflate. This was associated with the comment that they did not feel that there was oxygen flowing, and a significant percentage who reported they could not tell if there was oxygen flowing. The chemical oxygen generator is a constant flow device, which will not respond to passenger demand and therefore the relationship between the rate of flow and demand will determine if the mask bag inflates. Low breathing rates will allow the bag to inflate, whereas higher breathing rates, such as those experienced during an emergency, may result in the bag not inflating.

The International Civil Aviation Organization (ICAO) and various regulatory authorities have recognised that ‘Well-informed, knowledgeable passengers have a better chance of surviving a life-threatening situation that may occur on board an aircraft.’ While the operator’s passenger safety briefing and safety information card met the requirements of ICAO Annex 6 for passenger oxygen masks, the ATSB’s review of various passenger safety briefing standards, and a safety issue from a previous ATSB investigation, led to the conclusion that the oxygen mask information provided to passengers could be improved. In a depressurisation scenario, more specific information about the activation of oxygen flow, and that the oxygen mask bag may not inflate, will improve passenger knowledge and thereby likely reduce passenger anxiety and their susceptibility to a hypoxia-related event.

Passenger oxygen system

After the aircraft landed at Perth Airport, the ATSB inspected the passenger oxygen units and found two units had not deployed (23 FED and 27 FED) and two units had deployed and the release pin removed from the canister, but the firing pin had not activated (29 CBA and 31 CBA). The passenger survey results suggested that there were some additional units that were pulled-down manually by passengers.

Despite the numerous passenger reports of uncertainty about the flow of oxygen, the ATSB found that all canisters, with the exception of 29 CBA and 31 CBA, had activated and oxygen flowed in the hoses. All events where oxygen masks are deployed may experience some failures like this, which is why there is a requirement for a minimum of 10 per cent extra. The aircraft exceeded the certification requirement by providing about 30 per cent extra masks and there were no reported incidents of hypoxia, although some passengers had to move around the cabin to access a spare mask. Regarding the reported and observed malfunctions, the ATSB noted the following:

• Airbus reported that a unit may not deploy if it is incorrectly packed or does not have the minimum separation with adjacent units.
• The two units where the canister firing pin did not activate had their release pin removed, which suggested a possible internal fault with the firing pin spring.

Cabin crew response to the emergency descent

In the event of an emergency situation, the cabin crew are required to perform a safety leadership role for the passengers in the cabin. In a stressful situation, they are the individuals the passengers will turn to for directions. Their ability to effectively direct the passengers will depend on their own knowledge, skills, and composure under increased stress. According to the ICAO Cabin crew safety training manual, cabin crew members play an important proactive role in managing safety and the prevention of accidents. This includes preventing the escalation of risk associated with events in the cabin and informing the flight crew of abnormal situations observed such as pressurisation problems.

Prior to the emergency descent, the senior cabin crew (P1) noticed the intermittent activation of the emergency lighting and seatbelt signs in the cabin and contacted the flight crew to inform them of the indications. In addition to the lighting, P1 also discussed ear discomfort with the flight crew and suggested the indications were like a depressurisation. Following the captain’s announcement of an emergency descent, P1, upon noting the delay in the deployment of passenger oxygen masks, contacted the flight crew and informed them of the problem. These actions were consistent with the role of informing the flight crew of abnormal situations in the cabin, as described by the ICAO Cabin crew safety training manual.

At the time the captain announced the emergency descent, P1 was in the cabin aisle. She immediately returned to her seat at the front of the cabin and repeated the captain’s emergency descent announcement to the passengers. This announcement was not in accordance with the operator’s procedures for a depressurisation, but the passenger oxygen masks had not deployed at that stage. Although her intent may have been to ensure everyone was seated, the manner of its delivery may have increased passenger anxiety.

The cabin crew reported that when the oxygen masks deployed, they shouted at the passengers to ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’. However, about half of the passenger survey respondents reported additional commands from the cabin crew members, such as ‘BRACE’, ‘EMERGENCY’, ‘GET DOWN’ and ‘CRASH POSITION’. The CVR recording also included ‘EMERGENCY’ calls from cabin crew. In addition, about half of the respondents reported feeling, or observing other passengers, in a state of panic. Several passengers associated their panic with these additional commands from the cabin crew and that some of the cabin crew members themselves appeared to be distressed.

Following the deployment of the oxygen masks, several passengers reported moving about the cabin to locate a spare mask. They each reported a cabin crew member shouted an instruction at them to sit down when they moved. This included situations where a passenger either changed seats or reached over a row of seats to grasp a spare mask. Therefore, it is likely that some of the additional commands the cabin crew shouted were in response to passengers moving around the cabin.

The ATSB noted that, while the cabin crew were issuing commands in a second language, the use of the words ‘BRACE’ and ‘CRASH POSITION’, during an emergency descent, may have resulted in a misunderstanding by the passengers of the expected outcome. The command ‘BRACE’ is a command used when impact with land or water is imminent. This may have resulted in the misapprehension by some passengers that the aircraft was going to crash, rather than conduct a controlled descent to 10,000 ft. As a result, some passengers donned their life jackets during the emergency.

Passenger panic may result in increased difficulty following instructions at a time the cabin crew can only provide limited assistance. This could be alleviated by the cabin crew providing clear, concise, assertive instructions to the passengers during the emergency; and the flight crew providing a brief explanation of the nature of the problem and intended action as soon as practicable.

Cabin crew training

The cabin crew members were all considered current for their emergency drills training, which included depressurisation. The cabin crew involved reported that the depressurisation training included learning the signs and symptoms of depressurisation and how to manage it. They reported that recurrent training included revising the procedures for managing a depressurisation incident, including the emergency descent, the instructions to passengers and how to prepare the cabin.

The operator’s cabin crew department had published work instructions for their emergency training drills. The assessment criteria was in accordance with their published emergency procedures. According to the work instructions, two cabin crew trainees were assigned to perform the drill and one pilot trainee (if available) was assigned to perform the flight crew alerts to the cabin crew. While their work instructions did not include additional staff members assigned to role-play passengers, a training video showed that there were personnel used for this role. However, the role-playing passengers were compliant throughout the scenario, and the cabin crew may have had limited exposure to abnormal passenger behaviour during their drills. Therefore, the use of role-playing passengers in this instance may not have offered ‘an acceptable level of practical experience close to what can be expected in actual occurrences’ as recommended in the ICAO Cabin crew safety training manual.

During the emergency descent, the cabin crew were confronted with passengers acting in an unexpected manner when they moved about the cabin to obtain spare oxygen masks. This resulted in the cabin crew improvising their instructions to passengers and shouting commands, such as ‘GET DOWN’ and ‘BRACE’, which were appropriate for a crash landing or ditching, but unnecessary for a controlled descent to 10,000 ft. This suggested the operator’s current standard of assessment criteria, strictly against the published procedures, might not be adequate for scenarios that are more complex.

Role-playing abnormal passenger behaviour in emergency drills could offer the operator’s cabin crew assessors with the opportunity to expose their trainees to more complex scenarios, and provide a more realistic assessment of the trainee’s ability to take command of an emergency situation. While it may not be practical to routinely provide this resource during cabin crew emergency drills training, it may be feasible on a rotational basis, thereby providing them with the opportunity to practice their drills in a more realistic environment.

__________

23. Sheffield P and Heimbach R, 1996. Respiratory Physiology, in R DeHart (ed) Fundamentals of Aerospace Medicine, 2nd edn. University of Oklahoma, US; Williams & Wilkens.

From the evidence available, the following findings are made with respect to the pressurisation event involving AirAsia Indonesia Airbus A320, registered PK-AXD, 160 nautical miles north of Perth, Western Australia, on 15 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• During climb, the active cabin pressure controller produced a series of intermittent faults, which led to the cabin over-pressurising and the safety valve(s) opening. The malfunctioning controller then produced a series of intermittent excess cabin altitude alerts, which resulted in the flight crew performing the emergency descent in accordance with the procedure.
• The source of the cabin pressurisation system faults was isolated to the main circuit board in cabin pressure controller 1, which was the master controller. Cabin pressure controller 1 declared itself in failure after the flight crew had selected manual control of the cabin pressurisation system and therefore cabin pressure controller 2 did not take control.
• The operator had not incorporated two of the aircraft manufacturer's non-mandatory service bulletins for more reliable cabin pressure control, which likely would have facilitated the automatic changeover from cabin pressure controller 1 to cabin pressure controller 2, thereby preventing escalation of the malfunction.

Other factors that increased risk

• The pre-flight safety briefing and safety information card did not include a clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing. This resulted in some passengers not understanding whether or not there was oxygen flowing in the mask [Safety issue].
• The cabin crew provided additional commands to passengers that were inappropriate for a depressurisation, which had the potential to increase confusion in the cabin and likely increased the level of panic experienced by some passengers.
• AirAsia Indonesia’s cabin crew emergency procedures training did not include the role-play of non-compliant passenger behaviour, which likely limited the cabin crew’s opportunity for exposure to more complex real-world scenarios, similar to what they encountered during the incident.

Other findings

• Following activation of the passenger emergency oxygen system, at least two units did not deploy, and two units that did deploy, did not activate to produce oxygen when their release pins were removed. However, as there were about 30 per cent more oxygen masks available than seats, sufficient masks were still available for passengers and cabin crew.

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

Passenger oxygen mask instructions 

Safety issue number: AO-2017-098-SI-01

Safety issue description: The pre-flight safety briefing and safety information card did not include a clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing. This resulted in some passengers not understanding whether or not there was oxygen flowing in the mask.

Safety Recommendation description: The ATSB recommends that AirAsia Indonesia take further action to review its current passenger pre-flight safety briefing and safety information card to ensure passengers are provided with clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing.

Other safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Airbus

As a result of this occurrence, Airbus has advised the ATSB that they have taken the following safety action:

Procedures

The Quick Reference Handbook and Flight Crew Operating Manual for the Airbus A320, A330 and A340 aircraft were amended to include abnormal cabin altitude as a circumstance when the manufacturer recommends the flight crew perform a manual changeover of the active cabin pressure controller. The recommended actions include the procedural steps for the flight crew to follow to perform the changeover.

AirAsia Indonesia

As a result of this occurrence, AirAsia Indonesia has advised the ATSB that they have taken the following safety action:

Procedures

The AirAsia Safety Emergency Procedures Manual was amended to include the following announcement for cabin crew:

If oxygen masks do not deploy, ‘KEEP CALM, REMAIN SEATED, FASTEN SEATBELT’ [English and Bahasa].

Pilot details (Captain)

Pilot details (First Officer)

Sources of information

The sources of information during the investigation included:

• AirAsia Indonesia
• Airbus
• Civil Aviation Safety Authority
• Nord-Micro (courtesy Airbus)
• Operator’s flight crew and cabin crew
• On-board recorders
• Passengers (survey).

References

Civil Aviation Safety Authority, 2018. CAAP 253-02(2) Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators. Canberra; CASA.

Civil Aviation Safety Authority, 2015. Draft Part 121 Manual of Standards: Large aeroplane operations. Canberra; CASA.

Fowlkes J, Dwyer DJ, Oser RL and Salas E, 1998. Event-Based Approach to Training (EBAT). The International Journal of Aviation Psychology, 8(3), 209-221.

International Civil Aviation Organization, 2016. Annex 6 - Part I: International Commercial Air Transport – Aeroplanes, 10th edn. Montréal, Canada; ICAO.

International Civil Aviation Organization, 2014. Cabin Crew Safety Training Manual (Doc 10002). Montréal, Canada; ICAO.

International Civil Aviation Organization, 2018. Manual on Information and Instructions for Passenger Safety (Doc 10086). Montréal, Canada; ICAO.

Leedom, DK and Simon, R 1995. Improving team co-ordination: A case of behaviour-based training. Military Psychology, 7(2), 109-122.

Sheffield P and Heimbach R, 1996. Respiratory Physiology, in R DeHart (ed) Fundamentals of Aerospace Medicine, 2nd edn. University of Oklahoma, US; Williams & Wilkens.

United States Federal Aviation Administration, 2003. AC 121-24C: Passenger safety information briefing and briefing cards. US; FAA.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to AirAsia Indonesia, Airbus, Civil Aviation Safety Authority, French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA), Republic of Indonesia National Transportation Safety Committee (NTSC).

The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Appendix A – Incident flight faults

From the start of the incident flight faults at about FL 250, the flight crew received 18 alerts related to the cabin pressurisation (CAB PR) system between 1141 and 1159 Western Standard Time. The alerts were a mixture of fault messages, cautions and warnings as per the following descriptions.

The CAB PR SYS 1 (or 2) FAULT triggers when the respective CPC has failed. The Flight Crew Operating Manual (FCOM) procedure indicated the alert was for ‘Crew awareness’ only and no action was required. In addition, the operator’s FCOM: Aircraft Systems – Pressurisation – Controls and Indicators, page 1/10, contained the following note:

Switching the MODE SEL pb to MAN [mode select pushbutton to manual], for at least 10 s, then returning it to AUTO will select the other system.

The CAB PR SAFETY VALVE OPEN caution triggers in-flight if either safety valve is not fully closed for more than 1 minute. The FCOM procedure indicated that if differential pressure was above 8.0 psi, then manual control of the outflow valve should be selected to reduce the differential pressure.

The CAB PR EXCESS CAB ALT warning triggers if the cabin altitude is above 9,550 ft. It may be triggered by the active or standby CPC, or, if both CPCs have failed, by an independent cabin pressure sensor. The FCOM procedure indicated that if the aircraft was above 10,000 ft, the flight crew are required to don their oxygen masks and initiate an emergency descent to 10,000 ft. If the cabin altitude exceeds 14,000 ft the flight crew are required to manually deploy the passenger oxygen masks, with the following note:

This action confirms that the passenger oxygen masks are released.

The CAB PR LO DIFF PR caution triggers if the time for the cabin to reach a differential pressure of 0.0 is less than 1.5 minutes and the aircraft is at least 3,000 ft above the landing elevation. The FCOM procedure indicated that vertical speed should be reduced, but with the note:

This line is not displayed in case of Emergency Descent due to Excessive Cabin Altitude.

Appendix B – Manufacturer’s inspections and test results

The two CPCs and outflow valve were sent to the manufacturer, Nord-Micro, for inspections and testing. A visual inspection of the three components did not identify any damage or irregularities which could affect system performance.

The aircraft’s flight data recorder and non-volatile memory of the pressurisation system components revealed the following:

• 0341 UTC first CPC 1 fault message
• 0348:14 cabin differential pressure of 8.4 psi recorded
• CPC 1 commanded the outflow valve to close from 6 per cent to 2 per cent, increasing the cabin differential pressure
• safety valve opened (the exact time of activation is not traceable)^[24]
• 0348:19 cabin pressure differential of 7.8 psi recorded
• 0348:29 pressurisation system changed from automatic control to manual control
• 0359 CPC 1 fault with failure message (PC_SENSOR_FAIL) generated.

The manufacturer’s root cause analysis revealed a rare intermittent fault, in which the CPC 1 non-volatile memory remained in the operational state despite generating multiple fault messages (Figure 6).

Figure 6: Activation and frequency of alerts

The timings and frequency of activation of alerts of the cabin pressurisation system in UTC [GMT]. Blue line refers to Aircraft altitude, Grey line refers to Aircraft climb/descent rate.

Source: Nord-Micro (courtesy Airbus)

Cabin pressure controller 1 fault

As the master controller, CPC 1 stores in non-volatile memory if it is in either the operational or standby state. The CPC 1 non-volatile memory state must change from operational to standby for CPC 2 to take control. The message CAB PR SYS 1 FAULT is only generated if the system status of CPC 1, via ARINC^[25] output label^[26] 057, bit^[27] 12 is set from ‘good’ (bit 12 = 0) to ‘fail’ (bit 12 = 1). According to the software logic, this should occur if the CPC is in fact faulty by the system fail flag (fault code 32_SYSTEM_FAIL). The CPC 1 eventually declared itself as faulty with fault code 61 PC_SENSOR_FAIL at 0359 after the twelfth CAB PR SYS 1 FAULT message.

From the repetitive fault messages it can be inferred that the system status bit 12 changed multiple times between ‘good’ and ‘fail’, without the setting of the system fail flag (no fault code 32_SYSTEM_FAIL). However, the bit 12 can also change to indicate ‘fail’ if the ARINC output label 057 is invalid as a result of an intermittent power interruption. Following a power interruption, CPC 1 will read the non-volatile memory state and maintain control of the pressurisation system if it has remained operational (no ‘fail’ stored in non-volatile memory).

The manufacturer concluded that it was likely that CPC 2 would have taken control at 0359 if the system was still in automatic mode. At this time the CPC 1 non-volatile memory state should have changed from operational to standby, with ‘fail’ recorded, however the flight crew had already selected manual control. The system misbehaviour and wrong information associated with CPC 1 (EXCESS CAB ALT alerts) was able to continue until this time.^[28] Therefore, the manufacturer speculated that the circuit board may have been subjected to multiple power interruptions due to fatigue cracked solder joints or cracks in the conductor path within the circuit board.

Calculated cabin pressure

The CPC pressure sensor module provides a raw cabin pressure value to the main circuit board, which uses calibration data stored in the random-access-memory (RAM) to produce a calculated cabin pressure value. It is the calculated value that is used for system management. The CPC copies the calibration data from read-only-memory (ROM) to the RAM integrated circuits during the initialisation phase of the CPC. The manufacturer noted that several times during the incident flight, and subsequent tests, the ‘calculated cabin pressure values deviated substantially from the raw cabin pressure values and during the system check, the calculated cabin pressure values were recorded with abnormal stepwise changes…’.^[29] This suggested the possibility that the relevant calibration data could not be successfully read from or stored in the CPC RAM, or successfully transferred via the ARINC bus.

Test results

After return to Perth Airport, CPC 1 was removed from slot 1 (Master Slot) and installed in slot 2 (Slave Slot), and subsequently failed with stored fault code 61 PC_SENSOR_FAIL. The raw cabin pressure value of +375 ft and calculated cabin pressure value of -12,841 ft were recorded.

After the components were returned to the manufacturer, several flight test scenarios were performed with CPC 1, using either the CPC 1 pressure sensor module or a simulation box for pressure values. A standard flight profile of take-off, climb to FL 390, cruise, descent and landing was simulated. The CPC 1 fault was reproduced under both pressure sensor input conditions (tests 1 and 3), which isolated the fault to the main circuit board of CPC 1 (excluded the CPC 1 pressure sensor module).

In test 1, CPC 1 transmitted abnormal stepwise changes of the cabin altitude between ‑15,000 ft and +28,000 ft within a few seconds and produced multiple excessive cabin altitude warnings, which were transmitted via ARINC output label 057. The test results also included sporadic changes in the CPC 1 flight mode, initially between the modes of ‘Take-Off’, ‘Climb’ and ‘Descent’. During the descent phase, the flight mode remained in ‘Cruise’, however, the CPC detected the descent and regulated the cabin to the scheduled landing field as expected. The failure of CPC 1 in test 1 included the fault codes 32 SYSTEM_FAIL, 42 PC_CAL_ROM_FAIL (invalid checksum of the RAM copy of the calibration data) and 61 PC_SENSOR_FAIL.

In test 3, a stepwise change from +8,000 ft to +256 ft resulted in an intermittent fault, which produced the command to open the outflow valve position in order to depressurise the cabin. After a power reset, the cabin altitude was initially recorded as +11,936 ft. The failure of CPC 1 in test 3 included the fault codes 32 SYSTEM_FAIL and 61 PC_SENSOR_FAIL.

The manufacturer reported that the outflow valve and CPC 2 passed their tests, with the exception that the outflow valve initially produced an intermittent fault in ‘Manual Motor Operation – Position Feedback Signalling Test’. The second test was passed.^[30]

__________

24. The cabin differential pressure data point of 8.5 psi to trigger the safety valve(s) was not recorded, but the manufacturer concluded that it could be inferred that the minimum threshold was likely reached, given the sequence of events.
25. Common data bus used on civil transport aircraft.
26. Label guidelines are provided as part of the ARINC specification for various types of equipment.
27. Bit: used to indicate a number in the binary system (1 or 0).
28. For activation of flight crew warning messages while in standby mode, refer to: Appendix A - Incident flight faults
29. A stepwise change indicates a non-normal abrupt vertical change in the value of calculated cabin pressure.
30. The fault was within the potentiometer’s manual channel and it was noted that subsequent to the testing, the potentiometer would be replaced.