ATSB TRANSPORT SAFETY REPORT

Boeing Company 747-438, VH-OJK

475 km north-west of Manila, Philippines, 25 July 2008
Oxygen cylinder failure and depressurisation
Aviation Occurrence Investigation AO-2008-053
Final

Oxygen cylinder failure and depressurisation

475 km north-west of Manila, Philippines
25 July 2008
Boeing Company 747-438, VH-OJK
Intentionally Blank
 ATSB TRANSPORT SAFETY REPORT
Aviation Occurrence Investigation
AO-2008-053
Final

Oxygen cylinder failure and depressurisation

475 km north-west of Manila, Philippines
25 July 2008
Boeing Company 747-438, VH-OJK

Released in accordance with section 25 of the Transport Safety Investigation Act 2003

- i ­
Published by: Australian Transport Safety Bureau
Postal address: PO Box 967. Civic Square ACT 2608
Office location: 62 Northbourne Ave, Canberra City, Australian Capital Territory, 2601
Telephone: 1800 020 616, from overseas +61 2 6257 4150
Accident and incident notification: 1800 011 034 (24 hours)
Facsimile: 02 6247 3117, from overseas +61 2 6247 3117
Email: [email protected]
Internet: www.atsb.gov.au

© Commonwealth of Australia 2010.

This work is copyright. In the interests of enhancing the value of the information contained in this
publication you may copy, download, display, print, reproduce and distribute this material in
unaltered form (retaining this notice). However, copyright in the material obtained from other
agencies, private individuals or organisations, belongs to those agencies, individuals or
organisations. Where you want to use their material you will need to contact them directly.
Subject to the provisions of the Copyright Act 1968, you must not make any other use of the
material in this publication unless you have the permission of the Australian Transport Safety
Bureau.
Please direct requests for further information or authorisation to:
Commonwealth Copyright Administration, Copyright Law Branch
Attorney-General’s Department, Robert Garran Offices, National Circuit, Barton, ACT 2600
www.ag.gov.au/cca
ISBN and formal report title: see ‘Document retrieval information’ on page vii

- ii -
CONTENTS

THE AUSTRALIAN TRANSPORT SAFETY BUREAU ............................... viii

TERMINOLOGY USED IN THIS REPORT ..................................................... ix

EXECUTIVE SUMMARY .................................................................................... x

1 FACTUAL INFORMATION ........................................................................ 1

1.1 History of the flight .............................................................................. 1
1.1.2 Sequence of events - overview .................................................. 2
1.2 Injuries to persons ................................................................................. 3
1.3 Damage to the aircraft .......................................................................... 4
1.3.1 Airframe..................................................................................... 4
1.3.2 Oxygen system........................................................................... 8
1.3.3 Engine number-3 ..................................................................... 13
1.3.4 Cabin – R2 door....................................................................... 13
1.3.5 Electrical systems .................................................................... 19
1.3.6 Flight control systems .............................................................. 21
1.4 Other damage...................................................................................... 21
1.4.1 Cargo........................................................................................ 21
1.5 Personnel information......................................................................... 23
1.5.1 Flight crew ............................................................................... 23
1.5.2 Cabin crew ............................................................................... 23
1.6 Aircraft information............................................................................ 25
1.6.1 Aircraft general ........................................................................ 25
1.6.2 Cabin door ............................................................................... 25
1.6.3 Flight control system ............................................................... 25
1.6.4 Oxygen system......................................................................... 26
1.6.5 Oxygen cylinder history........................................................... 32
1.6.6 Fuselage maintenance .............................................................. 34
1.7 Meteorological information ................................................................ 34
1.8 Aids to navigation............................................................................... 35
1.9 Communications ................................................................................. 35
1.10 Aerodrome information ...................................................................... 35
1.11 Flight recorders................................................................................... 36
1.11.1 Recorder recovery.................................................................... 36
1.11.2 Cockpit voice recorder ............................................................. 36

- iii -
 1.11.3 Flight data recorder.................................................................. 37
1.11.4 Quick-access recorder.............................................................. 41
1.11.5 Recorded data examination ...................................................... 41
1.12 Fire...................................................................................................... 43
1.13 Survival factors – cabin safety............................................................ 43
1.13.1 Events in the cabin ................................................................... 43
1.13.2 Oxygen mask availability and use ........................................... 45
1.13.3 Time of useful consciousness (TUC)....................................... 46
1.13.4 Previous depressurisation events ............................................. 47
1.13.5 Cabin crew procedures............................................................. 48
1.13.6 Cabin crew actions................................................................... 49
1.13.7 Knowledge of oxygen flow...................................................... 50
1.13.8 Passenger address tape reproducer .......................................... 51
1.13.9 Safety demonstration video ..................................................... 51
1.13.10 Passenger survey ................................................................ 51
1.13.11 Post-accident response by the operator .............................. 56
1.14 Tests and research............................................................................... 57
1.14.1 Explosive residue testing ......................................................... 57
1.14.2 Previous cylinder failures ........................................................ 57
1.14.3 Oxygen gas analysis................................................................. 57
1.14.4 Valve components ................................................................... 58
1.14.5 Cylinder standards ................................................................... 59
1.14.6 Exemplar cylinders .................................................................. 60
1.14.7 Engineering examination ......................................................... 60
1.14.8 Hydrostatic pressure tests ........................................................ 75
1.14.9 Stress analysis / fracture mechanics......................................... 78
1.14.10 Artificially-flawed cylinder test program ........................... 82
1.14.11 Environmental compatibility testing .................................. 85

2 ANALYSIS .................................................................................................... 89
2.1 Depressurisation event........................................................................ 89
2.2 Aircraft structural damage .................................................................. 89
2.2.1 Fuselage ................................................................................... 89
2.2.2 Cabin door ............................................................................... 90
2.2.3 Cabin door area ........................................................................ 90
2.3 Oxygen cylinder failure ...................................................................... 93
2.3.1 Effect on the oxygen system.................................................... 93
2.3.2 Loss of the cylinder.................................................................. 93
2.3.3 Manner of cylinder failure ....................................................... 94
2.3.4 Potential factors contributing to cylinder failure ..................... 95

- iv ­
 2.3.5 Cylinder type evaluation ........................................................ 101
2.4 Cabin safety ...................................................................................... 103
2.4.1 Cabin crew actions immediately after depressurisation......... 103
2.4.2 Follow-up cabin crew actions ................................................ 104
2.4.3 Passenger address tape reproducer ........................................ 104
2.4.4 Time of useful consciousness (TUC)..................................... 104
2.4.5 Passenger announcements and communication ..................... 105
2.4.6 Oxygen flow .......................................................................... 105

3 FINDINGS ................................................................................................... 107

3.1 Context ............................................................................................. 107
3.2 Contributing safety factors ............................................................... 107
3.3 Other safety factors ........................................................................... 108
3.4 Other key findings ............................................................................ 109

4 SAFETY ACTION...................................................................................... 111

4.1 Aircraft operator ............................................................................... 111
4.1.1 Procedures In the event of a depressurisation and failure of
the automatic passenger address system ................................ 111
4.1.2 Passenger briefing information on oxygen masks
inadequate .............................................................................. 111
4.1.3 Cabin crew knowledge of oxygen system ............................. 112
4.1.4 Cabin crew uncertainty regarding the emergency descent
profile..................................................................................... 112
4.1.5 Laboratory accreditation ........................................................ 113
4.1.6 Other safety action ................................................................. 113
4.2 Civil Aviation Safety Authority (CASA) ......................................... 114
4.3 Australian Transport Safety Bureau ................................................. 114
4.3.1 Cabin safety ........................................................................... 114
4.3.2 Oxygen systems ..................................................................... 114
4.3.3 Aviation research and analysis reports .................................. 115

APPENDIX A: Artificially-flawed cylinder tests............................................ 117

1 FACTUAL INFORMATION .................................................................... 118

1.1 Introduction ...................................................................................... 118
1.2 Cylinder fracture control .................................................................. 118
1.3 Damage tolerance ............................................................................. 119
1.4 Fracture resistance ............................................................................ 119
1.5 Flawed-cylinder burst testing - background ..................................... 120
1.6 Flawed-cylinder burst testing undertaken ......................................... 121

- v ­
 1.7 Test method ...................................................................................... 123
1.7.1 Basic approach....................................................................... 123
1.7.2 Flaw geometry and sizes ........................................................ 123
1.8 Test results........................................................................................ 125
1.8.1 Flaw machining ..................................................................... 125
1.8.2 Testing ................................................................................... 127

2 ANALYSIS .................................................................................................. 129

2.1.1 Leak – Fracture boundary ...................................................... 129

3 SUMMARY ................................................................................................. 133

3.1 Cylinder failure behaviour................................................................ 133
3.2 Critical defect size estimates ............................................................ 133

4 Support information ................................................................................... 135

4.1 Test certificates................................................................................. 135

APPENDIX B: Cylinder material corrosion tests .......................................... 139

1 FACTUAL INFORMATION .................................................................... 140

1.1 Introduction ...................................................................................... 140
1.2 Corrosion testing - background ........................................................ 140
1.3 Methodology..................................................................................... 141
1.4 Test procedure .................................................................................. 141
1.4.1 Summary of Practice .............................................................. 141
1.4.2 Test Specimens ...................................................................... 142
1.4.3 Stress Calculations ................................................................. 143
1.4.4 Test Conditions ...................................................................... 144
1.5 Test results........................................................................................ 145
1.5.1 Visual Inspection ................................................................... 145
1.5.2 Metallurgical Evaluation........................................................ 148
1.5.3 Bend test ................................................................................ 150

2 ANALYSIS .................................................................................................. 151

3 SUMMARY ................................................................................................. 153

APPENDIX C: SOURCES AND SUBMISSIONS........................................... 155

- vi ­
DOCUMENT RETRIEVAL INFORMATION

Report No. Publication date No. of pages ISBN

AO-2008-053 November 2010 170 978-1-74251-110-8

Publication title
Oxygen cylinder failure and depressurisation, 475 km north-west of Manila, Philippines, 25 July 2008
Boeing Company 747-438, VH-OJK
Prepared By Reference Number
Australian Transport Safety Bureau ATSB-Nov10/ATSB141
PO Box 967, Civic Square ACT 2608 Australia
www.atsb.gov.au

Acknowledgements
Figures 4, 12, 30, 31, 32, 38 and 39 reproduced courtesy of the Boeing Company.
Figures 65 – 69 formed part of QinetiQ Aerostructures Pty Ltd report ER-ATSB-35-ASM727.

Abstract
On 25 July 2008, a Boeing Company 747-438 aircraft carrying 369 passengers and crew rapidly
depressurised following the forceful rupture of one of the aircraft’s emergency oxygen cylinders in the
forward cargo hold. The aircraft was cruising at 29,000 ft and was 55 minutes into a flight between
Hong Kong and Melbourne.
Following an emergency descent to 10,000 ft, the flight crew diverted the aircraft to Ninoy Aquino
International Airport, Manila, Philippines, where it landed safely. None of the passengers or crew
sustained any physical injury.
A team of investigators, led by the Australian Transport Safety Bureau (ATSB) and including
representatives from the US National Transportation Safety Board (NTSB), the US Federal Aviation
Authority (FAA), Boeing and the Civil Aviation Authority of the Philippines (CAAP) examined the
aircraft on the ground in Manila. From that work, it was evident that the oxygen cylinder (number-4 in
a bank along the right side of the forward cargo hold) had burst in such a way as to rupture the adjacent
fuselage wall and be propelled upwards; puncturing the cabin floor and impacting the frame and handle
of the R2 door and the overhead cabin panelling. No part of the cylinder (other than the valve
assembly) was recovered and it was presumed lost from the aircraft during the depressurisation.
The ATSB undertook a close and detailed study of the cylinder type, including a review of all possible
failure scenarios and an engineering evaluation of other cylinders from the same production batch and
of the type in general. It was evident that the cylinder had failed by bursting through, or around the
base – allowing the release of pressurised contents to project it vertically upwards. While it was
hypothesised that the cylinder may have contained a defect or flaw, or been damaged in a way that
promoted failure, there was no evidence found to support such a finding. Nor was there any evidence
found to suggest the cylinders from the subject production batch, or the type in general, were in any
way predisposed to premature failure.
Several minor safety issues and areas for potential safety improvement identified during the flight
operations and cabin safety investigations have been addressed by the operator’s safety action, or were
the subject of safety advisory notices (SAN’s) issued by the ATSB.

- vii -
THE AUSTRALIAN TRANSPORT SAFETY BUREAU
The Australian Transport Safety Bureau (ATSB) is an independent Commonwealth
Government statutory agency. The Bureau is governed by a Commission and is entirely
separate from transport regulators, policy makers and service providers. The ATSB's
function is to improve safety and public confidence in the aviation, marine and rail modes of
transport through excellence in: independent investigation of transport accidents and other
safety occurrences; safety data recording, analysis and research; fostering safety awareness,
knowledge and action.
The ATSB is responsible for investigating accidents and other transport safety matters
involving civil aviation, marine and rail operations in Australia that fall within
Commonwealth jurisdiction, as well as participating in overseas investigations involving
Australian registered aircraft and ships. A primary concern is the safety of commercial
transport, with particular regard to fare-paying passenger operations.
The ATSB performs its functions in accordance with the provisions of the Transport Safety
Investigation Act 2003 and Regulations and, where applicable, relevant international
agreements.
Purpose of safety investigations
The object of a safety investigation is to identify and reduce safety-related risk. ATSB
investigations determine and communicate the safety factors related to the transport safety
matter being investigated. The terms the ATSB uses to refer to key safety and risk concepts
are set out in the next section: Terminology Used in this Report.
It is not a function of the ATSB to apportion blame or determine liability. At the same time,
an investigation report must include factual material of sufficient weight to support the
analysis and findings. At all times the ATSB endeavours to balance the use of material that
could imply adverse comment with the need to properly explain what happened, and why, in
a fair and unbiased manner.
Developing safety action
Central to the ATSB’s investigation of transport safety matters is the early identification of
safety issues in the transport environment. The ATSB prefers to encourage the relevant
organisation(s) to initiate proactive safety action that addresses safety issues. Nevertheless,
the ATSB may use its power to make a formal safety recommendation either during or at the
end of an investigation, depending on the level of risk associated with a safety issue and the
extent of corrective action undertaken by the relevant organisation.
When safety recommendations are issued, they focus on clearly describing the safety issue of
concern, rather than providing instructions or opinions on a preferred method of corrective
action. As with equivalent overseas organisations, the ATSB has no power to enforce the
implementation of its recommendations. It is a matter for the body to which an ATSB
recommendation is directed to assess the costs and benefits of any particular means of
addressing a safety issue.
When the ATSB issues a safety recommendation to a person, organisation or agency, they
must provide a written response within 90 days. That response must indicate whether they
accept the recommendation, any reasons for not accepting part or all of the recommendation,
and details of any proposed safety action to give effect to the recommendation.
The ATSB can also issue safety advisory notices suggesting that an organisation or an
industry sector consider a safety issue and take action where it believes it appropriate. There
is no requirement for a formal response to an advisory notice, although the ATSB will
publish any response it receives.

- viii -
TERMINOLOGY USED IN THIS REPORT
Occurrence: accident or incident.
Safety factor: an event or condition that increases safety risk. In other words, it is
something that, if it occurred in the future, would increase the likelihood of an
occurrence, and/or the severity of the adverse consequences associated with an
occurrence. Safety factors include the occurrence events (e.g. engine failure, signal
passed at danger, grounding), individual actions (e.g. errors and violations), local
conditions, current risk controls and organisational influences.
Contributing safety factor: a safety factor that, had it not occurred or existed at the
time of an occurrence, then either: (a) the occurrence would probably not have
occurred; or (b) the adverse consequences associated with the occurrence would
probably not have occurred or have been as serious, or (c) another contributing safety
factor would probably not have occurred or existed.
Other safety factor: a safety factor identified during an occurrence investigation
which did not meet the definition of contributing safety factor but was still considered
to be important to communicate in an investigation report in the interests of improved
transport safety.
Other key finding: any finding, other than that associated with safety factors,
considered important to include in an investigation report. Such findings may resolve
ambiguity or controversy, describe possible scenarios or safety factors when firm
safety factor findings were not able to be made, or note events or conditions which
‘saved the day’ or played an important role in reducing the risk associated with an
occurrence.
Safety issue: a safety factor that (a) can reasonably be regarded as having the potential
to adversely affect the safety of future operations, and (b) is a characteristic of an
organisation or a system, rather than a characteristic of a specific individual, or
characteristic of an operational environment at a specific point in time.
Risk level: The ATSB’s assessment of the risk level associated with a safety issue is noted
in the Findings section of the investigation report. It reflects the risk level as it existed at the
time of the occurrence. That risk level may subsequently have been reduced as a result of
safety actions taken by individuals or organisations during the course of an investigation.
Safety issues are broadly classified in terms of their level of risk as follows:
• Critical safety issue: associated with an intolerable level of risk and generally
leading to the immediate issue of a safety recommendation unless corrective
safety action has already been taken.
• Significant safety issue: associated with a risk level regarded as acceptable only
if it is kept as low as reasonably practicable. The ATSB may issue a safety
recommendation or a safety advisory notice if it assesses that further safety
action may be practicable.
• Minor safety issue: associated with a broadly acceptable level of risk, although
the ATSB may sometimes issue a safety advisory notice.
Safety action: the steps taken or proposed to be taken by a person, organisation or agency in
response to a safety issue.

- ix -
EXECUTIVE SUMMARY

Key investigation outcomes

The ATSB has completed its investigation into the in-flight rupture of a pressurised
oxygen cylinder and the resultant aircraft damage and depressurisation. The
investigation was prolonged and made significantly more difficult by the evident
loss of the failed cylinder from the aircraft during the depressurisation event.
Despite this significant obstacle, the ATSB’s investigation has proven successful in
highlighting the improbability of the failure event, and has confirmed the safety of
current systems and procedures relating to the provision of emergency supplemental
oxygen for passengers and crew of pressurised aircraft.
The investigation found no record of any other related instances of aviation oxygen
cylinder rupture (civil or military). Given the widespread and long-term use of this
type of cylinder in aerospace applications, it was clear that this occurrence was a
very rare event.
A comprehensive program of testing and evaluation of cylinders of the same type,
and from the same production batch as the failed item, did not identify any aspect of
the cylinder design or manufacture that could represent a threat to the operational
integrity of the cylinders. Published maintenance procedures were found to be valid
and thorough, and inspection regimes appropriate.
In light of these findings, it is the ATSB’s view that passengers, crew and operators
of aircraft fitted with DOT3HT-1850 oxygen cylinders, can be confident that the
ongoing risk of cylinder failure and consequent aircraft damage remains very low.

Summary of the occurrence

On 25 July 2008, at 0922 local time, a Boeing Company 747-438 aircraft, registered
VH-OJK, departed Hong Kong International Airport on a scheduled passenger
transport flight to Melbourne, Australia (flight number QF30). Aboard the aircraft
were 350 passengers, 16 cabin crew and three flight crew.
Approximately 55 minutes after departure and while the aircraft was cruising at
29,000 ft (FL290), a very loud bang was heard by passengers and crew, followed
immediately by the rapid depressurisation of the cabin. Many of the cabin crew
reported feeling air moving and seeing light debris flying about. Oxygen masks
dropped from the overhead compartments and the cabin crew reported that while
most passengers began using them appropriately, some passengers had to be given
immediate and direct instruction to use their masks. All cabin crew moved to crew
seats or spare passenger seats and commenced using oxygen as emergency
procedures dictated. At the time of the depressurisation, the aircraft was over the
South China Sea, approximately 475 km to the north-west of Manila, Philippines.
The flight crew reported the initial event as a ‘loud bang or cracking sound’, with
an associated jolt felt through the airframe. The autopilot immediately disengaged
and multiple alert messages were displayed on monitoring instrumentation. The
flight crew reported that upon noting a cabin altitude warning, they immediately
donned oxygen masks and began executing the appropriate emergency procedures.
A ‘MAYDAY’ radio call was made and an emergency descent initiated.

- x -
At 1024 local time, the aircraft reached and was levelled at an altitude of 10,000 ft,
where the use of supplementary oxygen was no longer required. The flight crew
cleared the cabin crew to ‘commence follow-up duties’ and after a review of the
aircraft’s position, commenced preparation for a diversion to Ninoy Aquino
International Airport, Manila. Despite the apparent failure of multiple aircraft
systems, the flight crew reported that the descent and approach into Manila was
uneventful, and the aircraft landed safely on runway 06 at 1111 local time. Airport
emergency services attended and inspected the aircraft after it was stopped on the
runway; after which it was cleared for towing to the terminal and passenger
disembarkation. None of the passengers or crew on board the aircraft had been
physically injured during the event.

Summary of the investigation

From an inspection of the aircraft by engineering staff and investigators from the
Australian Transport Safety Bureau (ATSB), it was evident that the aircraft’s
fuselage ruptured over an area measuring approximately 2 x 1.5 m (6.6 x 4.9 ft) and
located immediately forward of the right wing leading edge transition. Fuselage
materials, wiring and cargo from the aircraft’s forward hold were protruding from
the rupture. Further investigation determined that the fuselage rupture had, in itself,
been induced by the forceful bursting of one of a bank of seven oxygen cylinders
located along the right side of the cargo hold. Those cylinders (with an additional
six located above the hold) provided the passengers’ emergency supplementary
oxygen supply. An analysis of the damage produced by the ruptured cylinder
showed that the force of the failure had projected the cylinder vertically upward into
the aircraft’s cabin, where it had impacted the R2 door frame, handle and the
overhead panelling and structure, before presumably falling to the cabin floor and
being swept out of the aircraft during the depressurisation. No part of the cylinder
body was located within the aircraft, despite a thorough search.
The operator’s records showed the failed oxygen cylinder (S/N: 535657) was
manufactured in January 1996, and had been subsequently inspected and re-
qualified on four subsequent occasions (at 3-yearly intervals). The last inspection
had been conducted on 26 May 2008; approximately 8 weeks before the in-flight
failure.
In the absence of the failed cylinder, the ATSB undertook a comprehensive failure
modes and effects analysis (FMEA), utilising the information known about the
cylinder design and service history. Five key possibilities arose as factors that may
have contributed to the cylinder failure:
• the cylinder contained a manufacturing flaw that subsequently developed during
service
• the cylinder was critically damaged at some time before the last overhaul and
inspection
• the cylinder was critically damaged during the last overhaul and inspection
• the cylinder was critically damaged at some time after the last overhaul and
inspection
• the cylinder was critically damaged during the accident flight.
Each of the factors was explored in depth, using all available evidence and
knowledge to assess the likelihood of the factor being associated with the cylinder

- xi -
failure. To add to the available evidence and understanding of the cylinder
characteristics, an engineering examination and test program was conducted using
20 similar oxygen cylinders, including the remaining 12 from on board the aircraft
and five that were sourced (with the assistance of the aircraft manufacturer) from
the failed item’s production batch. The objectives of the program were to determine
whether there was any aspect of the cylinder design (including materials and
methods of manufacture) that could predispose the items to premature failure while
in-service, and to assess whether there was any aspect of the particular production
batch of cylinders that had an inherent flaw or weakness.
In summary, the investigation found that the manner of cylinder failure was unusual
and implicated the presence of a defect, or action of a mechanism that directly led
to the rupture event. However, despite the extensive exploration of the available
evidence and the study of multiple hypothetical scenarios, the investigation was
unable to identify any particular factor or factors that could, with any degree of
probability, be associated with the cylinder failure event.
Despite the inconclusive outcome of the investigation as to contributing factors, the
associated engineering study did confirm that the cylinder type was fit-for-purpose.
There was no individual or broad characteristic of the cylinders that was felt to be a
threat to the safety or airworthiness of the design. Similarly, there was no aspect of
the batch of cylinders produced with the failed item, which deviated from the type
specification, or provided any indication of the increased potential for the existence
of an injurious flaw or defect within that particular production lot.
The validity and efficacy of the component maintenance procedures and practices
prescribed for the oxygen cylinders were examined and substantiated; as were the
procedures, practices and facilities employed by the operator for the periodic
inspection and re-certification of the cylinders. The investigation found no evidence
that maintenance of the cylinder (or associated aircraft systems) was a factor in the
occurrence.
Safety action stemming from this event centred on ensuring that oxygen cylinder
handling and maintenance procedures are optimal; that flight and cabin crew are
suitably prepared for efficient management of a depressurisation situation; and that
passengers are clearly and succinctly informed of their responsibilities and likely
experiences during a situation that requires the use of the cabin oxygen masks.

- xii -
1 FACTUAL INFORMATION

1.1 History of the flight

At 0922 local time (0122 UTC1) on 25 July 2008, a Boeing 747-438 aircraft,
registered VH-OJK, departed Hong Kong International Airport on a scheduled
passenger transport service to Melbourne, Australia. On board the aircraft
(operating as flight number QF30) were 350 passengers (including four infants), 16
cabin crew and three flight crew (captain, first officer and second officer).
The flight crew reported that the departure and climb-out from Hong Kong was
normal, with the aircraft established at the assigned cruising altitude of 29,000 ft
(FL290) by 0942 (0142 UTC).
At 1017 (0217 UTC), the captain and first officer reported hearing a ‘loud bang or
cracking sound’, with an associated airframe jolt. At that time, the autopilot
disconnected and the first officer, who was the pilot flying at the time, assumed
manual control of the aircraft. Multiple EICAS2 messages were displayed, including
warnings regarding the R23 door status and cabin altitude4. The second officer, who
was in the forward crew rest position, returned to the first observer’s crew seat and
all flight crew donned oxygen masks before completing the ‘cabin altitude non-
normal’ checklist. At that time, the aircraft was approximately 475 km to the north­
west of Manila, Philippines.
The cabin crew reported that shortly after the bang was heard, oxygen masks fell
from most of the personal service units in the ceiling above passenger seats and in
the toilets. Most passengers started using the oxygen masks soon after they
dropped. All cabin crew, who were engaged in passenger service activities at the
time, immediately located oxygen masks to use. Some crew located a spare
passenger mask and sat in between passengers, while others went to a crew jump-
seat at an exit, and one used a mask in a toilet.
Approximately 20 seconds after the event, the flight crew reduced the thrust on all
four engines and extended the speed brakes. An emergency descent was
commenced and a MAYDAY5 declared on the Manila flight information region
(FIR) radio frequency.
At 1024 (0224 UTC), the aircraft reached, and was levelled at an altitude of 10,000
ft, where the use of supplementary oxygen by passengers and crew was no longer
required.
After reviewing the aircraft’s position, the flight crew elected to divert to Ninoy
Aquino International Airport, Manila. As part of the landing preparations, excess
fuel was jettisoned to ensure the aircraft landing weight was within safe limits. The
flight crew reported that many system failure messages were displayed, including

1
Universal Time Coordinated (previously Greenwich Mean Time, GMT).
2
Engine Indication and Crew Alerting System.
3
The R2 door was the second main cabin door on the right side of the aircraft.
4
The altitude corresponding to the air pressure inside the aircraft cabin.
5
International call for urgent assistance.

- 1 ­
 all three instrument landing systems (ILS), the left very high frequency (VHF)
omnidirectional radio-range (VOR) navigation instrument, the left flight
management computer (FMC) and the aircraft anti-skid braking system.
The crew reported that at all times during the ensuing descent into Manila, they
were able to maintain the aircraft in visual flight conditions. Following radar
vectoring from Manila air traffic control, the captain, who had assumed the pilot
flying role, conducted an uneventful approach and landing on runway 06, with a
smooth touchdown, full reverse thrust and minimal braking. Emergency services
were in attendance after the aircraft was stopped on the runway, after which
intercom contact was made with a ground engineer and the aircraft verified as being
safe to tow to the airport terminal and disembark the passengers via a terminal air-
bridge.

1.1.2 Sequence of events - overview

A chronological outline of the key events occurring during the occurrence flight
was prepared using data from the aircraft’s flight recorders. A more detailed
sequence is presented in the Flight Recorders section (1.11) of this report.

Table 1: Sequence of events

Time (UTC) Time relative Event:
to event
(hh:mm:ss)
(hh:mm:ss)

01:22:12 -00:55:04 Takeoff at Hong Kong

01:42:30 -00:34:46 Aircraft reached top of climb (FL290)
02:17:16 0:00:00 Depressurisation event
02:17:19 0:00:03 Cabin pressure warning commenced
02:17:54 0:00:38 Aircraft left FL293 on descent
02:17:57 0:00:41 A minimum cabin pressure of 5.25 psi was recorded6
02:22:50 0:05:34 Cabin pressure warning ceased
02:23:09 0:05:53 Aircraft descended through 11,000 ft
02:23:48 0:06:32 Aircraft altitude reached 10,000 ft
7
02:47:57 0:30:41 Start of available cockpit voice recorder (CVR) audio
02:56:11 0:38:55 Aircraft left 10,000 ft on descent
03:11:56 0:54:40 Aircraft touched down at Manila
03:17:38 1:00:22 No. 3 engine shutdown on runway
03:19:10 1:01:54 Remaining engines shutdown on runway
03:26:53 1:09:37 Park brake released for tow
04:01:12 1:43:56 Chocks on (aircraft at gate)
04:51:06 2:33:50 CVR shutdown (aircraft powered-down)

6
This corresponds to a cabin altitude of 25,900 ft.
7
The aircraft was fitted with a 2 hour (nominal) capacity CVR. The delayed powering-down of the
aircraft meant that the audio associated with the depressurisation event was over-written.

- 2 ­
1.2 Injuries to persons
None of the passengers reported any physical injuries to the cabin crew
immediately following the depressurisation event, or to the operator’s staff upon
arrival in Manila. The Australian Transport Safety Bureau (ATSB) subsequently
conducted a survey of all passengers on the flight. Of the survey respondents who
reported that they had experienced some pain, the majority described symptoms and
experiences associated with the rapid depressurisation of the aircraft cabin. Those
included ear pain and/or ‘popping’, temporary loss of hearing and headaches. Many
passengers also reported high levels of anxiety and feelings of panic, with
associated physiological symptoms such as a racing heart. The survey questioned
the passengers as to whether they had experienced any unusual effects during the
depressurisation – effects that may have suggested the individual was experiencing
the onset or development of oxygen deprivation (hypoxia). Several passengers
reported feelings of faintness, light-headedness and/or tremors. However, it was
unclear as to whether those symptoms were associated with hypoxic effects, or the
anxiety brought upon by the situation.
ATSB investigators interviewed all members of the aircraft’s flight and cabin
crews. Several of the crew reported experiencing ear discomfort and ‘ringing’
immediately following the event. However, none sustained any injury or physical
condition that incapacitated them in any way.
During the interviews, it was noted that several cabin crew members had become
very distressed during the depressurisation and were initially unable to carry out
emergency tasks. Senior cabin crew reported that the affected staff were withdrawn
from duty for a period, after which they were able to resume duties and assist
passengers.
The ‘Survival factors – cabin safety’ section of this report (1.13) provides additional
detail on the adverse effects reported through the passenger experience survey.

Table 2: Injuries to persons

Flight crew Cabin crew Passengers Total

Fatal
Serious
Minor
Nil 3 16 350 369
Total 3 16 350 369

- 3 ­
1.3 Damage to the aircraft

1.3.1 Airframe
An initial inspection of the external aircraft surfaces on the ground in Manila
revealed the complete loss of the right wing forward leading edge-to-fuselage
fairing, with separation occurring along the lines of interconnection between the
fairing and fuselage skins (Figure 1). In the area exposed by the fairing loss was an
inverted T-shaped rupture in the fuselage skin, with several items from within the
forward cargo hold partially protruding from the rupture (Figure 2). The
approximate vertical centreline of the skin rupture was positioned at fuselage
station8 (STA) 820, with skin damage extending longitudinally for 79 inches (201
cm), from STA 777 to STA 856. Vertically, the rupture extended for approximately
60 inches (152 cm) between fuselage stringer9 31 at the top, to stringer 38 at the
lower extent of the damage. While some of the fuselage skin had folded outward
and away from the rupture, it was evident that an area of skin and structure equal to
approximately one-half of the total ruptured area had separated from the aircraft and
was not recovered. On the basis of measurements taken around the ruptured areas,
the total area of the skin rupture was estimated at around 1.74 square metres (2,700
square inches). Figure 3 illustrates the extent of the fuselage rupture as viewed from
outside the aircraft.
An examination of the rupture profile and fuselage skin damage found that all
fractures were typical of a ductile tearing mechanism, with no evidence of
corrosion, prior cracking or pre-existing defects in any of the areas examined.
Along the forward edge of the rupture void, an area of skin presented a sharply
folded appearance, with an outward curvature that appeared to match the profile of
the breathing oxygen cylinders installed internally along the fuselage wall (Figure 5
and Figure 6).
Rearward of the fuselage rupture, several localised areas of scuffing, puncture and
scoring were evident along the underside of the aircraft, extending along a diagonal
path from the ruptured area rearward toward the left body landing gear (Figure 7).
Elongated score marks were also noted extending for several metres around the left
side of the rear fuselage – typically around STA 1880 to STA 2000.
On the left side of the aircraft fuselage, immediately forward and below the L210
door (approximately STA 790), the external blowout doors of both pressurisation
relief valves were latched open (Figure 8). The relief valves provided protection to
the aircraft against excessive differential pressures, with the external latching doors
providing a positive indication of valve operation. Aircraft systems documentation
specified that the valves open at a differential pressure of 63.8 kPa (9.25 psi) to vent
the fuselage interior to the ambient atmosphere. An additional relief setting of 66.9
kPa (9.7 psi) acts as a backup.

8
Fuselage stations are measured in inches from the front of the aircraft, with the forward surface of
the aircraft’s nose (radome) located at fuselage station (STA) 90 (Figure 4).
9
Stringers are longitudinally oriented reinforcing sections used to increase the strength and rigidity
of the fuselage pressure shell.
10
The L2 door was the second main cabin door on the left side of the aircraft.

- 4 ­
Figure 1: Fuselage rupture – external view

Figure 2: Fuselage rupture with protruding cargo

- 5 ­
Figure 3: Extent of the fuselage rupture, after removal of further transition
fairings. Stringers [S] and Body Stations [BS] are denoted

S 33

S 32

S 32

S 34

S 36

S 38

BS 840
BS 820 BS 800 BS 780

Figure 4: 747-400 forward fuselage Section and Station diagram

- 6 ­
Figure 5: Sharply folded area of fuselage skin

Figure 6: Oxygen cylinder held against skin fold to illustrate conformance

- 7 ­
 Figure 7: Panel damage to the rear of the rupture site

Figure 8: Pressure relief valve blowout doors open (arrowed)

1.3.2 Oxygen system

Following removal of all cargo materials and lowering of the hold right-side curtain
panels, it was found that the fuselage rupture was aligned with the nominal position
of the number-411 passenger emergency oxygen cylinder; one of seven such
cylinders in a bank along the right side of the hold (Figure 9). A further six
cylinders were located in a central location within the ceiling of the cargo hold. The
number-4 cylinder was missing from the bank, with the upper support bracket bent

11
Cylinders were numbered (for the purposes of this investigation) from the front of the cargo hold.

- 8 ­
downward and both the retaining strap and lower cradle not present (Figure 10).
The adjacent number-5 cylinder lower support cradle had been pulled downward
and away from the cylinder as a result of the fuselage rupture. However, the upper
cylinder mount and strapping remained secure and the cylinder gas connections
intact (Figure 11).
Each of the passenger oxygen cylinders had three connected stainless steel lines –
an overpressure relief vent line, a delivery line and a service/filling line. The filling
and delivery lines were fed through a tee-piece from a common cylinder
connection, with a pressure regulator and transducer integral to the assembly. The
number-4 cylinder valve had fractured and separated from the system lines in
several locations around the valve assembly (Figure 12):
• the service/delivery T-piece had fractured from the cylinder valve outlet, with
the damaged and partly intact pressure reducer remaining connected to the
delivery line (Figure 13)
• the service line had fractured through the thermal compensator fitting at the
service/delivery T-piece (Figure 14)
• the overpressure relief vent line had fractured immediately before its connection
into the common line for the cylinder bank (Figure 15). The green indicator disk
within the overboard discharge port at the end of the common vent line (refer to
the Oxygen system description) was found intact and in-place.

Figure 9: Forward cargo hold wall with remaining six oxygen cylinders

- 9 ­
Figure 10: Fuselage rupture coincident with mounting position of the number­
4 oxygen cylinder

Figure 11: Number-5 oxygen cylinder adjacent to fractured fittings and lines
from the number-4 cylinder

- 10 -
Figure 12: Oxygen cylinder and valve illustration – points of fracture marked
in red, oxygen delivery line in green

Figure 13: Number-4 cylinder pressure reducer and tee-piece - fractured away
from cylinder valve at arrowed connection

- 11 -
Figure 14: Number-4 cylinder service line fracture (arrowed)

Figure 15: Number-4 cylinder overpressure discharge line fracture (arrowed)

Close examination of all exposed connections, fittings and lines showed no

evidence of heating, sooting or discolouration that might have suggested localised
combustion had occurred within or in proximity to the cylinder and its connections.

- 12 -
 Similarly, all structural, panel and cargo surfaces that surrounded the fuselage
rupture showed no evidence of heating or damage associated with combustion
effects. There were no unusual coatings, deposits or sprays of foreign material
noted over any of the surfaces exposed to the event.
The pressure gauges on all 12 remaining passenger oxygen cylinders showed all to
have been exhausted i.e. zero internal pressure remaining.

1.3.3 Engine number-3

Several small pieces of structural honeycomb material of the type comprising the
wing leading edge fairing were found trapped around the edges of panels within the
left side of the number-3 engine pylon (side facing the rupture). A small indentation
and cut was found within the number-3 engine intake acoustic panelling, located
immediately inside the plane of rotation of the engine fan (Figure 16). There was no
evidence of damage to the fan blades themselves, nor was there any evidence of the
ingestion of debris into the engine core.
The aircraft operator reported that an internal boroscopic inspection of the engine
while in Manila identified some damage to the turbine components, although the
nature of the damage suggested that it was unrelated to the depressurisation event.
The engine was changed as a precaution.

Figure 16: Damage to acoustic lining (arrowed) behind the number-3 engine
fan

1.3.4 Cabin – R2 door

The R2 door into the aircraft’s main cabin was located directly above the fuselage
rupture (at STA 830). An external panel located between the two door hinges
showed localised outward bulging from a point immediately below the upper hinge,
with the forward edge of the panel raised above the surrounding fuselage skin

- 13 -
(Figure 17). The main external door handle was in the fully closed position,
however the upper and lower door gates12 were partially retracted.
Within the aircraft, the cabin around the R2 door had sustained substantial damage
and disruption (Figure 18). The cabin floor to the left and immediately inside the R2
door frame had sustained an impact that created a single circular perforation
approximately 20 cm (8 inches) in diameter, located immediately above the
number-4 oxygen cylinder position (Figure 19). Fragments of the cabin flooring and
covering extended down into the hole. Above the hole, the forward partitioning
panel between the door and the row 26J and K seats showed an elongated green
coloured abrasion, leading upward to an area of impact damage at the mid-height
position of the forward R2 door frame (Figure 20). The door escape slide shroud
(bustle) also showed vertically-oriented scoring and green smear marks along the
corner and forward facing surface. The portable walk-around oxygen cylinder
normally located in an alcove just inside the R2 door was not present and was not
accounted for in a subsequent search of the aircraft.

Figure 17: Cabin R2 door – damage to external panelling

12
The cabin door gates are flap-like panels at the top and bottom of the door that are retracted by the
door opening mechanism, to allow the door to move outward through the door frame opening.

- 14 -
Figure 18: Interior of R2 door and cabin – location of floor hole arrowed

Figure 19: Hole in cabin floor – viewed from position of number-4 oxygen
cylinder. Broken yellow lines mark the normal route of the first
officer’s aileron control cables

- 15 -
Figure 20: Door frame damage, green paint smear and rotated R2 door handle

The internal door handle was found in approximately the one-o’clock position
(looking from inside), with the turned-in handle end embedded into the door lining
material. That position was consistent with a movement through approximately 120
degrees from the fully-closed (locked) position. A 180 degree handle movement
represented the fully open position. The downward facing surfaces of the handle
end (when the door is in the locked position) showed damage and abrasion
consistent with impact against another object. Inspection of the internal door
systems showed the handle shaft had fractured and the actuating cam plate and
retainer had pulled away from its associated mechanism (Figure 21), allowing the
handle to rotate freely. As such, the handle position as observed inside the cabin
was not indicative of the actual door security.
Above the R2 door within the cabin, the overhead panelling, fixtures and utility
storage compartments had sustained extensive impact damage. The panels above
the door frame had been pushed inward, exposing the overhead structure and
pressure reservoir for the door emergency power assist opening system (EPAS,
Figure 22). Among the impact damage, it was observed that an unusually uniform
semi-circular section had been forcibly cut from the panelling and access door
(Figure 23), with the cut-out section later recovered from above the damaged
storage compartment casing (Figure 24). The diameter of the cut-out region closely
matched that of the passenger oxygen cylinders (Figure 25). Adjacent to the cut-out
opening was a semi-circular area of crushing damage to a partitioning panel (Figure
26); the damage being of a similar diameter to the cut-out section. A light fitting,
normally present in the overhead panels had sustained upward crushing damage and
presented clear green paint smears of a similar colouration to the marks on the
partition panel and door bustle.

- 16 -
Various items of debris were found around the aircraft cabin in the vicinity of the
R2 door. Of note, this included fragments of the number-4 oxygen cylinder valve
handle, the valve pressure relief assembly and the valve body itself. A fragment of
the valve body was also recovered from within the damaged area on the door frame.
A thorough search of the cabin and overhead ceiling void space failed to locate any
part of the number-4 oxygen cylinder itself.

Figure 21: R2 door panel underside – fractured shaft and separated plate

Figure 22: Damage above R2 door, exposing the EPAS cylinder (arrowed)

- 17 -
Figure 23: Panels above the R2 door showing circular cut-out area

Figure 24: Overhead panel cut-out section recovered from the structure above
the R2 door

- 18 -
 Figure 25: Panel with cut-out placed against another oxygen cylinder to
illustrate the conformance in diameter

Figure 26: Semi-circular damage in partition of compartment above R2 door

1.3.5 Electrical systems

The oxygen cylinder failure and associated fuselage rupture damaged many
electrical cables and cable bundles that were routed through the affected area
(Figure 27). The investigation identified the functions associated with that wiring
and was able to assess the impact of the wiring damage on the aircraft systems.

- 19 -
A total of 85 individual wires were either severed or partially cut during the
fuselage rupture. After allowing for duplicates and two unidentified wires, 52
discrete conductors were identified as being applicable to the following aircraft
systems:
• 38 relate to the operation and function of the oxygen system (see below)
• three served the forward cargo hold lights
• two served the cargo area external lights
• one served the right wing leading-edge flap drive primary electrical system
• one served the right wing ground refuelling valve
• four served the right wing outboard trailing-edge flap primary electrical and
asymmetry protection systems
• one served the right body landing gear anti-skid system
• two served the potable water and drain line heaters.
The ATSB requested the aircraft manufacturer to carry out an analysis of the
damaged wiring to determine the possible effects on the functionality of the aircraft
oxygen system. The majority of the 38 damaged conductors associated with the
oxygen system were 22-gauge wires originating from the cylinder pressure
transducers and feeding an averaging unit that provides a total system pressure
indication on an EICAS status page.

Figure 27: Damaged wiring adjacent to the number-4 cylinder location

- 20 -
 Several fractured wires would have affected the functionality of the oxygen system
flow control units (FCU) and the system reset solenoid. According to the
manufacturer’s analysis, the fractured wires would have impaired the flight crew’s
ability to:
• manually select operation of the passenger oxygen system
• verify the passenger oxygen system activation by an indication on the EICAS
• activate or deactivate the flow of therapeutic oxygen
• reset the passenger oxygen system.
It was noted that normal activation and control functions of the system, based on
cabin altitude, would not be affected by the damaged wiring.

1.3.6 Flight control systems

Both right-side (first officer’s) aileron control cables, routed along the right side of
the fuselage above the passenger oxygen cylinders, had been fractured during the
rupture event. All separated cable ends showed the irregular splaying and
unwinding of the cable wires; characteristic of a tensile overstress failure. The
nature of the cable failure and the proximity of the cable route to the cabin floor
damage immediately above the number-4 oxygen cylinder location (Figure 19)
indicated that the cables had been fractured as the cylinder was projected upward
after rupturing.

1.4 Other damage

1.4.1 Cargo
The forward hold of the aircraft contained both containerised and palletised cargo.
All passenger baggage was located within conventional metal containers positioned
forward of the point of rupture. None of the containers within the hold showed
evidence of damage or other markings that could be associated with the rupture
event. The cargo adjacent to the fuselage rupture was a plastic-wrapped and netted
pallet of general freight in cardboard boxes and similar. The cargo packed along the
side closest to the rupture had been pulled towards the opening, with several items
becoming lodged within, and protruding from, the void (Figure 28). Items packed
near to the fuselage rupture showed varying degrees of forced impact type damage
(Figure 29) and a section of aluminium structure from the hold framework was
recovered from among the packaging. There was no evidence of an explosive event
having originated from within the cargo itself, and a review of the cargo manifests
showed no items that could be considered capable of causing or contributing to such
an event. Reconciliation of the recovered cargo by the freight service provider
accounted for all items on the manifest.

- 21 -
Figure 28: Cargo pallet adjacent to the fuselage rupture
(view looking towards the rear of the aircraft)

Figure 29: Cargo pallet after removal from the aircraft, showing the end facing
the rupture

- 22 -
1.5 Personnel information

1.5.1 Flight crew

Table 3 summarises the operational qualifications and experience of the flight crew
at the time of the occurrence. At the time of the fuselage rupture, the first officer
was in control of the aircraft (pilot flying), with the autopilot engaged and the
aircraft established in the cruise at FL290. The captain was in his seat on the flight
deck and the second officer was in the forward crew rest position.

Table 3: Flight crew qualifications and experience

Captain First Officer Second Officer

Licence Category ATPL13 ATPL ATPL

Instrument rating Command Command Co-pilot
Last Class-1 medical 27 Sep 2007 20 May 2008 27 Jun 2008
Total flying hours 15,999 12,995 4,067
Total on 747-400 2,786 5,736 2,292
Total last 30 days 67h 48m 96h 57m 67h 48m
Total last 90 days 221h 54m 251h 27m 137h 33m

1.5.2 Cabin crew

There were 16 cabin crew members on board the aircraft, including the customer
services manager (CSM) and customer services supervisor (CSS).
The CSM had 17 years total experience, including 6 years with the operator and 3
months as a CSM. The CSS had 30 years total experience, including 7 years with
the operator and four months as a CSS.
Overall cabin crew experience ranged from 2 months to 27 years with the operator,
with some crew also having additional experience with other operators. All cabin
crew were current on their emergency procedures training requirements.
The CSM station was situated at the front of the aircraft and the CSS station at the
rear. The CSM had responsibility for the entire aircraft; however, their main focus
during normal flight was the first and business class cabin areas. The CSS was
normally responsible for the operation of all economy class cabin areas (including
premium economy).
At the moment of the fuselage rupture and commencement of depressurisation, the
cabin crew were located as follows:
• the CSM was standing near the workstation, in the vicinity of the doors-2
crossover
• the CSS was walking from first class towards the rear of the aircraft and was in
the vicinity of door L1
• three crew were standing in the doors-1 galley

13
Air Transport Pilot Licence.

- 23 -
• five crew were standing at various positions in the doors-2 cross-over/galley
• four crew were working in the economy class cabin between doors 3 and 5
• one crew-member was descending the upper/lower deck stairway
• one crew-member was in the upper deck galley.
Figure 30 presents a diagram of the aircraft cabin and crew stations.

Figure 30: VH-OJK cabin and crew stations

- 24 -
1.6 Aircraft information

1.6.1 Aircraft general

Table 4: General aircraft details
Aircraft type Boeing Company 747-438

Serial number 25067

Year of manufacture 1991
Registration VH-OJK
Certificate of Airworthiness SY 45 valid from 17 June 1991
Certificate of Registration last issued on 24 October 2005
Total airframe hours 79,308
Total airframe cycles 10,419
Last ‘A’ maintenance check 13 June 2008, at 78,967 h, 10,357 cyc
Last ‘D’ maintenance check 9 April 2004, at 58,367 h, 8,173 cyc

1.6.2 Cabin door

All main cabin doors of the 747-438 aircraft type were designed as outward-
opening ‘plug doors’. A plug door is designed to be physically larger than the
doorway opening and mates with the frame around the full circumference when in
position. It was designed to increase the security of the pressurised fuselage, with
pressurisation loads serving to force the door more tightly against the frame.
Retractable gates at the top and bottom of the door allow it to move inward and then
sideways through the door frame during the opening and closing process when the
aircraft is not pressurised. The plug door design provides for a level of protection
against inadvertent or intentional attempts to open the door while the aircraft is in
flight. A latch mechanism holds the door in the closed position when the aircraft is
not pressurised.

1.6.3 Flight control system

The Boeing 747-438 flight control system was a hydraulically-assisted mechanical
arrangement, with inputs from the primary cockpit controls being translated to the
control surface actuating systems via cables. The systems were designed to provide
complete duplication and redundancy between the captain’s and first officer’s
controls, such that the failure of any particular system would not lead to a loss of
functionality affecting aircraft controllability. Basic certification specifications for
all modern transport category aircraft require this behaviour by design. In respect of
the first officer’s aileron control cables that were severed in the occurrence, those
were duplicated by the captain’s system, the cables from which were routed along
the opposite (left) side of the forward cargo hold. Interlinks between the aileron
systems provided the necessary redundancy in this instance, ensuring the continued
safety of flight after the event.

- 25 -
1.6.4 Oxygen system
The 747-438 aircraft was equipped with three separate supplemental breathing
oxygen systems. Use of oxygen by passengers and crew is necessary if cabin
pressurisation is lost during high-altitude flight. A diluter-demand14 system
provided oxygen to each flight crew station and an independent, continuous flow15
system served the passenger cabins, crew rest areas, toilets and cabin crew stations.
Portable oxygen equipment was also stored throughout the passenger cabins for
medical and walk-around use. All three systems were of the pressurised gaseous
storage type, with no chemical oxygen generators employed on the aircraft.

Oxygen storage system

The passenger oxygen storage system consisted of 13 high-pressure (12,755 kPa /
1,850 psi) steel cylinders, each with an integral shut-off valve, pressure gauge and
over-pressure protection system (frangible disk). Each cylinder carried a quantity of
oxygen equivalent to 3,256 litres (115 cu.ft) when charged to 12,755 kPa (1,850
psi) at ambient conditions of 1,013 HPa (760 mmHg) and 21 ºC (70 ºF). Seven of
the cylinders were located along the right side of the forward cargo hold; the
remainder were positioned within the void space between the cargo hold ceiling and
the main cabin floor (Figure 31). A coupling with an integral thermal compensator
and check-valve connected each cylinder to an electrical pressure transducer and
pressure reducer. The cylinder over-pressure protection system was designed to
operate in the event that cylinder pressure rises to between 17,237 and 19,133 kPa
(2,500 and 2,775 psi). In that instance, the internal frangible disk bursts, venting the
cylinder contents into a manifold that flows to an overboard discharge port located
rearward of the forward cargo door. A green coloured disk was recessed into the
port to protect the pipe-work internals and to provide an external indication of
pressure relief in the event of a cylinder valve burst disk rupture.
System servicing was achieved by replenishing the cylinder contents from a
common service panel, or by individual replacement of the depleted cylinders. A
common high-pressure manifold line fed each cylinder from the service panel.

14
A diluter-demand oxygen system provides diluted or 100% oxygen flow as required by the
breathing action of the user.
15
A continuous flow oxygen system delivers a constant stream of oxygen to the user, once the
system and mask have been activated.

- 26 -
Figure 31: Locations of passenger oxygen cylinders installed on VH-OJK

Oxygen delivery system

The outlet of each cylinder, after being reduced to around 4,150 kPa (600 psi) via
the integral pressure reducer, was directed to a common supply line that fed a bank
of three parallel-connected continuous flow control units (FCU). Internal aneroids
within each unit sense the cabin altitude, and automatically actuate the units if the
cabin altitude increases to, or exceeds, 13,250 ft. The system was also designed to
be activated manually via a switch on the flight deck. On activation, oxygen was
metered into the low-pressure distribution manifold, which fed the passenger and
cabin crew service units. The flow control units regulated the pressure of oxygen
fed to the service units in proportion to the cabin altitude, with a greater pressure
(hence flow) being delivered at higher altitudes. System information from the
manufacturer indicated that the flow control unit delivery pressures could vary from
69 kPa (10 psig16) at 14,000 ft cabin altitude, to 296 kPa (43 psig) at 40,000 ft.
Activation of the passenger oxygen system was accompanied by an EICAS ‘PASS
OXY ON’ message, the commencement of an automated passenger address
announcement, and illumination of the cabin lighting. Figure 32 provides a
schematic overview of the aircraft passenger oxygen supply system.
The passenger service units located in the overhead panels above the seats carried
one or more oxygen modules, each containing a valve assembly and oxygen masks.
When activated, the passenger oxygen system delivers an initial pressure surge
which actuates the latch valve plunger, forcing the module cover open and allowing
the masks to fall. The passenger must then grasp and pull down on the mask
assembly, which pulls an actuating pin from the valve assembly and allows oxygen
to flow to the mask. Should the module cover fail to open, the internal latch may be

16
Psig – pounds per square inch gauge – a pressure measurement relative to the surrounding
atmosphere (ambient).

- 27 -
disengaged by a cabin crew-member using a dedicated tool, and the cover opened
manually.

Figure 32: Overview of the passenger oxygen supply system

Passenger oxygen masks

The passenger oxygen mask units fitted to VH-OJK were a continuous flow design
and typical of masks installed in all modern commercial passenger airliners (Figure
33). The mask assembly comprised a flexible orange silicone rubber face-piece and
an affixed polyvinyl chloride (PVC) reservoir bag. The face-piece was fitted with a
single, thin elastic strap designed to fit over the user’s head and secured using a
slip-toggle arrangement. The face-piece back plate was equipped with an
inhalation/exhalation valve assembly, and was coupled to the reservoir bag through
a separate inhalation valve. The reservoir bag was printed with a large illustration of
a fitted mask, showing the face-piece correctly covering the user’s nose and mouth
and the strap fitted behind the user’s head. The illustration also showed the mask
being held in place by the user, with the reservoir bag partially inflated.
Oxygen is fed to the mask assembly via a length of PVC tubing. Once activated,
oxygen continuously flows into the reservoir bag. As the user breathes, oxygen is
drawn from the bag to supplement the ambient air entering the face-piece via the
inhalation valve. As discussed in the Oxygen delivery system section above, the rate
of oxygen flow to the reservoir bag is governed by the flow control units and was
proportional to the cabin altitude. At lower flow rates, positive inflation of the bag
would not be expected. At the end of the reservoir bag was a green-coloured
chamber that acted as an indicator of oxygen flow to the mask.

- 28 -
Figure 33: Typical passenger oxygen masks

Oxygen cylinder description

All passenger oxygen cylinders installed in the Boeing 747-438 aircraft were
produced as seamless, single piece deep-drawn and forged units from heat-treated
Chromium-Molybdenum (Cr-Mo) alloy steel material17. The cylinders measured
nominally 22.8 cm outside diameter by 75.1 cm long (8.98 in x 29.56 in) with a
specified minimum wall thickness of 2.87 mm (0.113 in). The cylinder design
incorporated a constant-thickness hemispherical base and body, transitioning to a
spin-forged upper dome and neck. The machined neck threads were specified as a
1-11.5 American National Standard Taper Pipe Thread (ANPT) with a ± 1 turn
gauge tolerance.
The internal surface finish required a minimum 1000 mg/ft² of a phosphate coating
for corrosion inhibition. External coating specifications required primer and
overcoats of two-part catalysed urethane paint.

17
AISI/SAE grade 4130.

- 29 -
The cylinders had been manufactured to comply with the requirements of the
United States Code of Federal Regulations (CFR) Title 49 (Transportation), Part
178 (Specifications for Packagings), Subpart C (Specifications for Cylinders)
§178.44 ‘Specification 3HT seamless steel cylinders for aircraft use’. The cylinders
were identified as type DOT3HT-185018, and were allocated the manufacturer’s
part number 801307-00 (for the cylinder-valve assembly) and the equivalent Boeing
part number 60B50087-7.

Oxygen cylinders installed on the aircraft

Due to periodic removal and replacement for maintenance or replenishment
purposes, the cylinders installed in VH-OJK at the time of the occurrence were of
varying ages and serial numbers (Table 5).

Table 5: Details of the passenger oxygen cylinders fitted to VH-OJK at the

time of the occurrence
Location Serial No. Manufactured date Fitted to aircraft date

Right side #1 240341 Feb 92 16 Jun 07

Right side #2 ST30395 Sep 01 14 Jun 08
Right side #3 ST20539 Apr 01 19 Jan 07
Right side #4 535657 Feb 96 14 Jun 08
Right side #5 666845 Mar 99 01 Mar 06
Right side #6 240293 Dec 91 07 Jan 08
Right side #7 239949 Nov 91 07 Jan 08
R Fwd O/H 883198 May 89 07 Jan 08
L Fwd O/H 686764 May 98 01 Sep 06
R Mid O/H 805949 Sep 04 17 Nov 07
L Mid O/H 686716 Jun 99 28 Sep 05
R Aft O/H 679454 Apr 99 07 Jan 08
L Aft O/H 71505 Jan 91 22 Jul 07

From the aircraft operator’s records of installed equipment, the missing (presumed
failed) oxygen cylinder was identified as serial number 535657 (highlighted in the
table). Records obtained in the United States by representatives of the National
Transportation Safety Board (NTSB), identified the cylinder as one of a batch of 94
such items manufactured and certified in February 1996. The production batch
serial number range commenced at serial number 535585 and concluded at 535678.

Oxygen system maintenance - routine

Records from the aircraft operator provided a history of general maintenance
actions carried out on the passenger and crew oxygen systems (Table 6) during and
since the last major inspection (D-check) completed on 9 April 2004.

18
United States Department of Transportation, 1,850 psi nominal operating pressure.

- 30 -
Table 6: Oxygen system maintenance history
Activity Date

Crew system cylinder and plumbing inspection 25 March 2004

Passenger system test 1 April 2004
Therapeutic system test 3 April 2004
Passenger system pressure indication test 3 April 2004
Crew and passenger portable cylinder check 9 February 2008
Crew and passenger system cylinder and plumbing inspection 11 February 2008

Checks of the fixed oxygen cylinder pressure indication system were also
conducted during routine aircraft maintenance inspections – the last three checks
being conducted on 1 March, 17 April and 14 June 2008. Passenger oxygen
cylinders number-2 (S/N ST30395) and number-4 (S/N 535657 – the failed item)
were fitted to the aircraft during this last check; replacing cylinders that were due
for requalification testing.

Oxygen system maintenance – non-routine

Aircraft equipment operational faults and conditions requiring maintenance action
were documented in the aircraft’s technical log system. Copies of all log entries and
remedial actions from the date of the number-4 cylinder installation (14 June 2008)
to the date of the occurrence, were obtained and reviewed by the ATSB, with a
view to identifying any issues that may have been experienced with the aircraft
oxygen systems, and any maintenance activity that may have been conducted in the
vicinity of the passenger oxygen system cylinder installation.
Between 14 June and 2 July 2008, the only technical log entries relating to the
aircraft’s oxygen systems were those recording the ad-hoc use and replacement of
portable oxygen bottle and masks, and the installation and removal of temporary
oxygen cylinders for passenger therapeutic purposes. On 3 July 2008, the logs noted
that the crew oxygen system pressure was low and the system was subsequently
replenished. On 16 July, the logs noted that the crew had observed a fluctuation in
the flight-deck indication of the crew oxygen system pressure. In response, a
physical check of the cylinder pressure was made, together with a check of the
electrical interconnections to the system pressure sensing transducers, with no
serviceability issues identified. An entry into the aircraft’s minimum equipment list
(MEL19) was also raised at that time to permit continued operation of the aircraft.
Over the subsequent days of operation, several further log entries had been made
regarding the indicated fluctuation of crew oxygen system pressure. In all cases,
physical checks confirmed the system to be within the serviceable pressure range.
The only entry in the technical log relating to the passenger oxygen system was
made on 22 July 2008, when the crew noted an EICAS status message ‘PASS OXY
REFILL’ during a flight from Los Angeles, USA to Sydney, Australia. Under

19
A MEL is a document approved by CASA that contains the conditions under which a specified
aircraft may operate, with particular items of equipment inoperative, at the time of dispatch. It
provides a time interval for the rectification of the faulty item, relevant to the operational
significance of the item. This document is carried on board the aircraft and provides the pilot in
command with clear guidance to make an informed decision as to whether the particular flight
should or should not proceed.

- 31 -
 normal circumstances, that message would be displayed if the passenger oxygen
system pressure falls below 11,032 kPa (1,600 psi). The log action entry reported
that ground checks could not duplicate the message, and checks of the system
pressure on the EICAS, the system servicing (refill) panel and the individual
cylinders themselves, found that all indications were within serviceable limits.

Oxygen cylinder maintenance

The US federal regulations, under which the cylinder design was certified, required
that each cylinder be subject to periodic requalification in order to remain approved
for use. Under US CFR Title 49 §180.209, specification 3HT cylinders must be
requalified at intervals not exceeding 3 years. Under an exception provided in CFR
Title 49 §175.8, the FAA allows installed cylinders that have reached or passed
their requalification date, to remain in service until the next significant scheduled
maintenance visit of the aircraft in which they are fitted. Installed cylinders that
have passed their requalification date may not be serviced or filled until requalified.
Requalification requirements for specification 3HT cylinders state that the cylinder
must undergo internal and external visual inspection, followed by a hydrostatic
pressure test within a water jacket, for the determination of the cylinder volumetric
expansion20 while under pressure. The hydrostatic test pressure was specified to be
1.667 (5/3) times the nominal cylinder service pressure, which equates to 21,256
kPa (3,083 psi) for the cylinders in question.
In addition to the periodic requalification requirements, DOT-3HT cylinders carry a
mandatory retirement life of 24 years from the date of the original test as marked on
the cylinder, or after 4,380 discrete pressurisations (recharge cycles).
The cylinder manufacturer’s component maintenance manual for part number
801307 series cylinder and valve assemblies mirrored the regulatory requirements
for cylinder requalification, and provided additional guidelines and requirements for
routine cylinder maintenance operations.

1.6.5 Oxygen cylinder history

Records from the cylinder manufacturer and the aircraft operator allowed the
compilation of a life-time history / sequence of events table for the failed oxygen
cylinder.

Table 7: Cylinder S/N 535657 sequence of events

Date Event

3 Jan 1996 Cylinder manufactured and certified (including hydrostatic testing)

14 Feb 1996 Delivered installed in a new Boeing 767 aircraft (VH-OGQ)
2 Feb 1999 Removed from VH-OGQ for requalification
3 Apr 1999 Inspection and second hydrostatic testing – accepted
10 Apr 1999 Fitted to B747-400, VH-OJL (ceiling middle position)
20 Feb 2001 Moved to ceiling aft right position, VH-OJL
24 Feb 2001 Moved to ceiling aft left position, VH-OJL

20
Both elastic and permanent (plastic) expansion criteria for acceptance are specified.

- 32 -
24 Feb 2001 Moved to ceiling middle right position, VH-OJL
20 Jan 2002 Removed from VH-OJL
8 Mar 2002 Inspection and third hydrostatic testing – accepted
29 Mar 2002 Fitted to B747-300, VH-EBY (right sidewall #7)
31 Jan 2005 Removed from VH-EBY
3 Feb 2005 Inspection and fourth hydrostatic testing – accepted
22 Feb 2005 Fitted to B747-400, VH-OJK (ceiling aft right)
7 Jan 2008 Removed from VH-OJK
26 May 2008 Inspection and fifth hydrostatic testing – accepted
14 Jun 2008 Refitted to VH-OJK (right sidewall #4)
22 Jul 2008 Physical (visual) check of cylinder pressure
25 Jul 2008 Cylinder failure event

All requalification testing and inspection of the aircraft oxygen cylinders had been
carried out at the operator’s in-house workshops and facilities. Following the
occurrence, a series of inspections of those facilities was carried out – initially by
representatives of the Australian Civil Aviation Safety Authority (CASA), and
subsequently by a team of investigators from the ATSB, NTSB, US Federal
Aviation Authority (FAA), Boeing and CASA. The purpose of the inspections was
primarily to gather information on the procedures and processes employed for
handling, servicing and inspecting the oxygen cylinders, and to discuss the broader
issues and ongoing investigation with the technical staff. Compliance with
regulatory, original equipment manufacturers (OEM) requirements, and general
best-practice was examined.

Cylinder recertification process

The operator routinely examined and re-tested the oxygen cylinders from its
inventory, and had integrated the 49CFR180.209 recertification requirements into
its internal procedures and quality system. Table 8 outlines the cylinder re­
certification process that was demonstrated during the investigation team
inspection.

Table 8: Basic cylinder work-flow for inspection and re-certification

Removal from Cylinders due for periodic inspection and re-certification are removed from
service service and stored in padded cases for transport to the workshop
Preliminary Cylinders are vented, valve removed and a general external and top-end
inspection internal inspection conducted
Hydrostatic Cylinders are filled with potable water, immersed into test chamber and
testing pressurised, while measuring the elastic expansion (via chamber water
displacement)
Alcohol rinsing Test water is emptied and approx 500 ml Isopropyl alcohol added and
agitated.
Solvent rinsing Alcohol emptied and approx 200 ml of ‘Lenium GS’ (n-Propyl Bromide) or ‘A-
Gasol’ (1-1 Dichloro-1-fluoroethane) added and agitated
Drying Solvent drained, cylinder inverted on stand and stream of dry, warmed
Nitrogen (~190ºF) introduced via inductor tube. Time on dryer minimum of
one minute

- 33 -
 Internal Visual inspection of internal surfaces using borescope or direct visual
inspection examination (with illuminator)
Reinstall valve Original valve re-fitted and low pressure oxygen introduced & vented –
checked for odour
Oxygen refill Full charge of oxygen introduced (1,850 psi) and leak-check

During the inspection, it was observed that the facility was using a modified
cylinder drying process, wherein the time allowed for internally drying the
cylinders (after solvent rinsing) had been reduced from the 4 minutes specified by
the maintenance manual, to 1 minute. That change had been formally documented
and internally-authorised as an exception to the maintenance manual procedures.
While the reasons for the change were not documented, the investigation team was
advised that in-house trials had shown that the cylinders typically dried very rapidly
under warmed nitrogen, and were found to be completely dry after 1 minute. As
such, the procedure had been modified to remove the redundant 3 minutes of drying
time and reduce the wastage of nitrogen gas. The investigation team witnessed the
cylinder drying process and verified (by visual inspection) that the cylinders were
fully dry internally after 1 minute.
Overall, the facility inspections did not identify any significant issues or deviation
from appropriate practice that had the potential to affect the integrity of the
cylinder-valve assemblies. It was noted that while the operator’s engineering group
maintained a quality system accredited to the requirements of ISO 9001 ‘Quality
Management Systems – Requirements’, the hydrostatic testing and oxygen
workshops did not carry formal third-party or external technical accreditation21 for
the performance of the inspections and tests carried out on the cylinders. The
component maintenance manual (CMM) for the cylinder and valve assembly
specified that:
Hydrostatic tests must be performed as noted in Table 5003 using approved procedures
by service locations having up-to-date United States Department of Transportation
Approval.

Such accreditation provides an additional level of external assurance that the test
methods and techniques employed are valid, the testing officers’ training and
qualifications appropriate, and equipment is serviceable and calibrated.

1.6.6 Fuselage maintenance

The aircraft operator carried out a review of their maintenance records for the
aircraft fuselage in the vicinity of the damaged zone (STA720 to STA880 and
fuselage stringer 29 to 40 on the right side) and reported that those records showed
no evidence of prior damage or repair activity in that area.

1.7 Meteorological information

During interviews following the occurrence, the flight crew recalled that the
weather during the initial part of the flight, and subsequently for the diversion and

21
In Australia, the National Association of Testing Authorities (NATA) provides such accreditation,
based on the requirements of ISO/IEC 17025 ‘General requirements for the competence of testing
and calibration laboratories’.

- 34 -
 approach into Manila, was good and presented no difficulties. The crew indicated
that while there was scattered cloud present during the diversion, they were able to
remain in visual conditions at all times.

1.8 Aids to navigation

The Boeing 747-400 aircraft was fitted with a number of avionic systems to
facilitate en-route and local-area navigation. Following the rupture and
depressurisation of the fuselage, the flight crew reported that the following systems
had failed or were behaving anomalously:
• left flight management computer (FMC)
• all three instrument landing systems (ILS)
• left VHF omnidirectional radio range (VOR).
While some of the electrical system issues reported by the flight crew could be
attributed to the wiring damage sustained in the vicinity of the fuselage rupture, the
behaviour of the navigational system components above could not be directly
reconciled against that damage. Consultation with the operator’s engineering staff
determined that those systems may have been affected by a brief power interruption
sustained during the initial cylinder failure and fuselage rupture event. It was also
indicated by the operator, that at the time of the occurrence and diversion into
Manila, that there may have been some pre-existing unservicabilities with the
Ninoy Aquino International Airport runway 06 instrument landing system (ILS).
However, the pilot-in-command’s description of the error messages presented by all
ILS displays was not consistent with that situation, and as such, the precise nature
of the ILS difficulties was not identified.

1.9 Communications
The flight crew did not report any issues with the ongoing operability of the
aircraft’s external (radio) communications systems following the depressurisation.
Communications within the aircraft were affected however, and are discussed
further within the Survival factors – cabin safety section of this report (1.13).

1.10 Aerodrome information

The aircraft depressurisation occurred approximately 55 minutes into the flight,
with the aircraft located over the South China Sea, around 868 km from Hong
Kong. After descending the aircraft to a safe altitude, the flight crew reviewed their
location and selected Ninoy Aquino International Airport, Manila, for the diversion
and landing. Ninoy Aquino International Airport provided:
• full air-traffic control services with radar vectoring
• full emergency services
• sufficient runway length for a landing with anti-skid braking inoperative
(runway 06)
• ground services and facilities for the operator.

- 35 -
1.11 Flight recorders
The aircraft was equipped with three separate flight recording systems:
• a cockpit voice recorder (CVR)
• a flight data recorder (FDR)
• a quick-access recorder (QAR).
The FDR and CVR are the so-called ‘black-boxes’ of the aircraft and are required
by regulation to be fitted to certain types of aircraft. Information recorded by the
FDR and CVR is stored in ‘crash-protected’ modules.
The QAR is an optional recorder that the operator has chosen to fit to all of its
Boeing 747-400 aircraft. Information recorded by the QAR is not ‘crash-protected’,
and is used for engineering system monitoring, fault-finding, incident investigation
and flight operations quality assurance (FOQA) programs. The QAR design allows
the recording media to be accessed and downloaded conveniently, and the
parameters recorded can be as-chosen by the individual operator. In many cases, the
QAR systems record more parameters than the parallel FDR systems.

1.11.1 Recorder recovery

Under ATSB supervision, the CVR, FDR and QAR media (disk) were removed
from the aircraft in Manila and transferred to the operator’s safety department in
Sydney, Australia. The CVR and FDR were quarantined, and subsequently sent to
the ATSB technical facilities in Canberra.

1.11.2 Cockpit voice recorder

The CVR fitted to the aircraft was a model FA2100, solid-state technology
recorder, manufactured by L3 Communications Corporation in 2002. The device
recorded four discrete channels of high-quality audio of 30 minutes duration, as
well as two channels of standard-quality audio of 120 minutes duration (combined
crew positions and the cockpit area microphone).
The CVR recorded the total audio environment in the cockpit area. This included
crew conversation, radio transmissions, aural alarms, switch activations, engine
noise and airflow noise. CVR systems are designed to operate even when the
aircraft is on the ground with the engines shut down. This allows investigators
access to important crew conversation or checklist actions before the first engine is
started for takeoff, or after the last engine is shut down following landing. The
disadvantage is that valuable audio information is overwritten following a non-
catastrophic accident or serious incident where there has been a significant interval
between the occurrence and when the flight is completed and electrical power is
removed from the CVR.

Audio recovery
The full 2 hours of recorded audio from VH-OJK was successfully downloaded by
ATSB specialist investigators in Canberra. Analysis of the audio showed that the
oldest information retained by the CVR related to operation of the aircraft while
cruising at 10,000 ft – after the depressurisation and emergency descent had already
taken place. Of the 2 hours of CVR audio, 24 minutes covered flight time, including

- 36 -
 the approach and landing at Manila. The remaining audio covered ground
operations, including the aircraft being towed from the runway to the gate, and time
with the aircraft stationary at the gate.
After recovery, the CVR audio was examined by ATSB operations, technical and
cabin safety specialists. Key events, actions and observations were noted and
integrated into the analysis of the occurrence.

1.11.3 Flight data recorder

The flight data recording system fitted to the aircraft comprised:
• a flight data recorder unit (FDR)
• a digital flight data acquisition card (DFDAC)
• an airframe-mounted accelerometer.
The FDR fitted to the aircraft was a magnetic tape unit, manufactured by
Sundstrand Data Control (Honeywell). The FDR recorded approximately 300
aircraft operational and monitoring parameters for a 25-hour duration. Typically,
the FDR records when at least one engine is operating and stops recording when the
last engine is shut down.

Data recovery
The magnetic tape recording medium was removed from the FDR unit and replayed
in the ATSB’s technical facilities in Canberra. After decoding and analysis, it was
found that the FDR contained recorded data from the following flights:
• Singapore – London on 23 July 2008
• London – Hong Kong on 24 July 2008
• Hong Kong – Manila on 25 July 2008 (the occurrence flight).
Continuous data from engine start on the ground in Hong Kong, until engine
shutdown on the runway in Manila was successfully recovered from the FDR. The
data was used to produce a sequence of events (Table 9) and allowed the production
of a graphical presentation of the depressurisation event (Figure 34 and Figure 35).
Figure 36 provides a graphical illustration of the time periods for which recorder
coverage (FDR and CVR) was available for the occurrence flight. Figure 37 is a
plot of the aircraft’s track between departure from Hong Kong, the depressurisation
event, diversion and arrival in Manila.

- 37 -
Table 9: Detailed sequence of events
Time (UTC) Time relative Event:
to event
(hh:mm:ss)
(hh:mm:ss)

01:22:12 -00:55:04 Takeoff at Hong Kong

01:42:30 -00:34:46 Aircraft reached top of climb (FL290)
02:12:28 -00:04:48 QAR entered ‘sleep mode’ and stopped recording
02:17:16 0:00:00 Depressurisation event
02:17:17 0:00:01 Autopilot (right) disengaged
Cabin pressure warning commenced
02:17:19 0:00:03
(activates when cabin altitude exceeds 10,000 ft).
02:17:20 0:00:04 QAR resumed recording data
02:17:38 0:00:22 Speed brake extended, engine thrust reduced
02:17:43 0:00:27 Left and Right isolation valves change to closed
02:17:54 0:00:38 Aircraft left FL293 on descent
22
02:17:57 0:00:41 A minimum cabin pressure of 5.25 psi was recorded
02:18:43 0:01:27 Autopilot (centre) engaged
02:19:09 0:01:53 Autothrottle disconnected
02:22:50 0:05:34 Cabin pressure warning ceased
02:23:09 0:05:53 Aircraft descended through 11,000 ft
02:23:48 0:06:32 Aircraft altitude reached 10,000 ft
02:29:40 0:12:24 Captain’s NAV SEL changed to right FMC
23
02:47:57 0:30:41 Start of available cockpit voice recorder (CVR) audio
02:56:11 0:38:55 Aircraft left 10,000 ft on descent
03:09:58 0:52:42 Autopilot (centre) disengaged
03:11:56 0:54:40 Aircraft touched down at Manila
03:17:38 1:00:22 No. 3 engine shutdown on runway
03:19:10 1:01:54 Remaining engines shutdown on runway
03:26:53 1:09:37 Park brake released for tow
04:01:12 1:43:56 Chocks on (aircraft at gate)
04:51:06 2:33:50 CVR shutdown (aircraft powered-down)

22
This corresponds to a cabin altitude of 25,900 ft.
23
The aircraft was fitted with a 2 hour (nominal) capacity CVR. The delayed powering-down of the
aircraft meant that the audio associated with the depressurisation event was over-written.

- 38 -
Figure 34: Plot of FDR information for the full flight duration

Figure 35: Plot of FDR information for the depressurisation event

- 39 -
Figure 36: FDR and CVR recording periods

Figure 37: Aircraft track plot

- 40 -
1.11.4 Quick-access recorder
The QAR system fitted to VH-OJK utilised a magneto-optical disk recording
technology to record approximately 500 flight parameters onto a 230 Mb capacity
removable media. To reduce the amount of data recorded per flight, the QAR
system was configured to enter a ‘sleep mode’, once a period of stable cruise flight
had been detected. A subsequent climb or descent would bring the QAR system out
of this mode and it would resume recording.

Data recovery
The QAR disk was downloaded by the aircraft operator under authorisation from
the ATSB. As an empty disk had been installed into the QAR on 23 July 2008, data
from the five subsequent flights (including the occurrence flight) was present on the
disk and successfully recovered. The flights recorded were:
• Sydney – Melbourne on 23 July 2008
• Melbourne – Singapore on 23 July 2008
• Singapore – London on 23 July 2008
• London – Hong Kong on 24 July 2008
• Hong Kong – Manila on 25 July 2008 (the occurrence flight).
Preliminary analysis of the QAR data showed that information had been
continuously recorded from engine start on the ground in Hong Kong, until 0212:28
UTC, when the QAR entered sleep mode while the aircraft was in cruise at FL290.
The depressurisation event occurred at 0217:16 and, approximately 4 seconds later,
the QAR resumed recording.

1.11.5 Recorded data examination

ATSB specialists conducted a detailed examination of the recorded data from the
FDR and QAR, and the audio from the CVR, to determine:
• whether the data indicated any unusual flight characteristics (i.e. turbulence
encounters) before the depressurisation
• whether there were any crew actions, selections or unusual system indications
immediately before the depressurisation
• the extent of any secondary damage sustained as a result of the fuselage rupture
and the effects of that damage on the aircraft systems and handling
• characteristics of the aircraft manoeuvring after the depressurisation
• any other anomalies evident in the recorded information.

Vertical accelerations
Vertical, lateral and longitudinal acceleration data was recorded continuously
throughout the accident flight. A qualitative review of that information did not
reveal any unusual characteristics or indications of turbulence encounters leading
up to, immediately before, or following the depressurisation event. The maximum

- 41 -
and minimum vertical accelerations recorded during the flight were +1.18 g24 and
+0.87 g respectively – values well within the typical loading experienced during
normal flight manoeuvring.

Crew actions
Comments recorded on the CVR indicated that the flight crew had made a Heading
Select (HDG SEL) input on the Mode Control Panel (MCP, Figure 38) immediately
before the depressurisation occurred. While HDG SEL activation was not explicitly
recorded on the FDR, the QAR did record the selected heading value in degrees; the
last value recorded before the QAR entered sleep mode (at 0212:28 UTC) was 154º.
When the QAR resumed recording immediately after the depressurisation event (at
0217:20 UTC), the first recorded value for selected heading was 162º ‒ implying
that a HDG SEL change was made between those times.

Figure 38: Mode Control Panel (MCP) with the HDG SEL area highlighted

The FDR showed that, coincident with the depressurisation event (Master Warning
activation and autopilot disconnection), the aircraft began to bank to the right,
reaching a maximum bank angle of 7 degrees. It was not evident from the recorded
data whether the initiation of this bank was an autopilot response to a HDG SEL
input, a crew reaction to the depressurisation itself, or an aircraft aerodynamic
response to the fuselage rupture. In any case, there was no known relationship
between the HDG SEL function and the oxygen systems of the aircraft.

Aircraft handling
The aircraft fuselage structure (frames and stringers) was damaged when the
oxygen cylinder ruptured. In light of this, an examination of the post-event aircraft
handling was conducted to qualitatively assess the airframe loading experienced
during the diversion to Manila.
Forces on the damaged fuselage area were probably largest during the emergency
descent at the time of the maximum computed airspeed (CAS) of 335 kt. After the
oxygen cylinder ruptured, the autopilot was re-engaged and used throughout the
remainder of the flight. The maximum bank angle and maximum vertical
acceleration recorded during the diversion to Manila were -26.4º and 1.25 g
respectively. Until the bank angle reaches 30º, there is only a small increase in load
factor with bank angle. The maximum bank angle, maximum CAS and maximum
vertical acceleration values recorded during the diversion to Manila were within the
range expected for normal aircraft operation and were comparable to the values
recorded during the two previous flights. The largest range in vertical acceleration
values (0.43 – 1.48 g) occurred during the Singapore to London flight and was due
to turbulence.

24
An acceleration of 1 g equates to 1 x the force of gravity.

- 42 -
 Recorded cabin pressure
It was noted that after the oxygen cylinder ruptured, the cabin pressure (FDR
parameter) reduced to a minimum value of 5.25 psi while the aircraft was at an
altitude of 29,200 ft (compared with a standard atmospheric pressure at FL290 of
4.57 psi). Later, while the aircraft was cruising at 10,000 ft, the recorded cabin
pressure was 10.97 psi (compared with a standard atmospheric pressure at 10,000 ft
of 10.11 psi). It was observed that when the airspeed decreased during cruise at
10,000 ft, there was a coincident decrease in cabin pressure. The observation that
the cabin pressure, after the hull was breached, exceeded the outside atmospheric
pressure could be explained by the hull rupture acting as a scoop, producing a ram
air effect. After landing, the recorded cabin pressure and atmospheric pressure
values were equal.

1.12 Fire
There was no evidence that a fire or combustion event had contributed to, or
preceded the cylinder failure and depressurisation events; nor was there any
evidence of the development of a fire at any time during, or subsequent to the
depressurisation.

1.13 Survival factors – cabin safety

1.13.1 Events in the cabin

The flight from Hong Kong to Melbourne had 16 cabin crew assigned. All cabin
crew were conducting their normal service duties prior to the depressurisation. The
first indication of depressurisation that the majority of cabin crew had was hearing a
bang and observing that the passenger oxygen masks had deployed.
Most cabin crew reported hearing a loud bang and all crew reported feeling wind in
the cabin, as well as many seeing a mist and debris flying about. Many crew-
members, especially the crew in the immediate vicinity of the R2 door also felt the
force of the depressurisation. Two cabin crew members that were standing in the
galley between the R2 and L2 doors reported being thrown towards the R2 door and
had to grab hold of galley equipment to steady themselves. All cabin crew reported
they noticed the oxygen masks had fallen from the overhead panels immediately
following the bang.
The cabin services supervisor (CSS), who was in the front of the main cabin, was
thrown towards the left side of the aircraft, although she was further forward from
the R2 door.
Cabin crew moved to crew seats or spare passenger seats and went onto available
oxygen as per the operator’s depressurisation procedures. Some crew, including the
cabin services manager (CSM), sat in the foot well of passenger seats and used
spare passenger oxygen masks until given the all clear to conduct follow-up duties.
The CSM did leave this position and moved to his work station in an attempt to
contact the flight crew. However, the oxygen masks had not dropped in the
workstation area, so he returned to the passenger seats to ensure he was on oxygen
before returning again to brief the flight crew on the damage to the R2 door area.

- 43 -
The CSS, who was thrown into a toilet in the front cabin of the aircraft, was using a
passenger oxygen mask provided in the toilet cubicle.
Cabin crew reported that most passengers grabbed a mask and held it over their
mouth, however many crew had to shout or point instructions to passengers to pull
down on the mask to activate the flow of oxygen. Some crew also had to tell
passengers to secure the mask by the elastic strap instead of just holding it over
their mouth and nose. Crew also shouted instructions to passengers with
babies/children to wake them up and keep the mask on their child’s face. Some
young children were fidgeting and resisting their parents’ efforts to put or keep the
mask on.
Two of the cabin crew left their crew seats during the emergency descent. One
crew-member reported that she had observed two elderly passengers whose masks
had not deployed and who seemed to be having trouble breathing. She moved
through the cabin to the passengers, breathing through spare oxygen masks on the
way. She then deployed the masks and ensured they were fitted and working before
returning to her seat.
Another cabin crew-member, who was using portable oxygen, reported that upon
seeing her colleague assisting passengers, she also proceeded to move around the
cabin checking on children and infants in her area.
The cabin crew in the vicinity of the R2 door noticed the damage when the
depressurisation occurred. After the cabin crew were told they could move about
the cabin, a few more crew saw or reported the damage to others. Not all cabin crew
were aware of the damage prior to landing. Just after the descent, the CSM
contacted the flight crew to report the damage he could see to the area around the
R2 door.
Prior to the commencement of the diversion to Manila, the flight crew informed the
CSM they were planning to divert to Manila. The CSM acknowledged this and
responded by giving the order for cabin crew to secure the cabin for landing and
then awaited further details.
According to reports from the second officer and the CSM, as well as data from the
CVR, the captain made four public announcements (PA) and the second officer
made two. The first PA, from the second officer, directed crew and passengers to be
seated and to go onto oxygen. He then told the cabin crew to carry out follow-up
duties once 10,000 ft was reached. After reaching 10,000ft, the captain then
informed passengers that there was a problem and they would be diverting to
Manila. The next PA stated that they expected the landing would be normal,
although they would use the full length of the runway and the aircraft would be met
on the runway by emergency services to conduct an assessment of the aircraft.
Once the cabin crew were advised to conduct follow-up duties (when the aircraft
had reached an altitude of 10,000 ft), they all obtained portable oxygen equipment25
and moved about the cabin checking on passengers. The use of portable oxygen at
that time was compliant with procedures to guard against hypoxia due to exertion.

25
The portable oxygen systems consist of a cylinder and breathing mask and are carried on the back
using a strap.

- 44 -
 Cabin crew reported that most passengers were using oxygen masks, although some
children and babies were not keeping the oxygen mask on. Most passengers were
reported to have been holding the mask on their face instead of tightening the strap.
Two cabin crew members could not carry out their follow-up duties immediately ‒
one was suffering from shock and the other was continuing to use oxygen as she felt
light-headed. They had both recovered sufficiently to resume acting in their
assigned positions by the time the descent into Manila commenced.
There was also a staff engineer travelling in business class, who inspected the
damage once the all clear was given to move about the cabin and advised the cabin
crew to remain clear of the R2 door area.
After the captain advised the CSM of the diversion to Manila, the CSM instructed
the cabin crew to move through the cabin in their assigned areas and prepare the
cabin for landing. They then returned to their assigned seats for landing in Manila,
with the exception of the crew-member whose assigned seat was adjacent to the R2
door. That crew-member was positioned at the R3 door for landing. The flight
landed without further incident.

1.13.2 Oxygen mask availability and use

While on-site in Manila, investigators conducted a walk-though survey of the
aircraft cabins to gather information on oxygen mask availability and usage. In the
passenger cabin (353 passenger seats), a total of 476 oxygen masks had deployed,
with 426 of those also having been activated (i.e. pulled down for use). Within the
15 aircraft toilets, 30 masks had deployed, with five activated – both in the L1 door
left toilet and one in each of the three upper-deck toilets.
In the cabin crew positions, a total of 26 masks were found deployed, with 16
activated. Of the 19 portable oxygen cylinder/mask units, six were found with
indications of use; the cylinders being either empty or with pressures less than their
‘full’ value of 1,850 psi.

- 45 -
 Figure 26: Typical appearance of the cabin after arrival in Manila. Note the
passenger masks dropped and activated, and those dropped and
not activated (arrowed)

1.13.3 Time of useful consciousness (TUC)

The following is an excerpt from the ATSB publication ‘Aircraft Depressurisation
Cabin crew information bulletin’26.

One of the most serious hazards associated with depressurisation is hypoxia.

Hypoxia is caused by less oxygen being available and the reduced ability of
our body to use the oxygen that is available.
The time of useful consciousness (TUC) refers to the amount of time crew
and passengers can continue to conduct duties and activities in an
environment with inadequate oxygen. It is measured from the time when the
occupants of the aircraft are exposed to a low-pressure environment to the
time when the occupants have lost the capability to take corrective and
protective actions, such as self-administer oxygen.
The time of useful consciousness is dependent on the pressure altitude inside
the cabin following the depressurisation.

Table 10 presents an overview of the variation of TUC with altitude.

26
ATSB (2008) Aviation Research and Analysis Report AR-2008-075(2) Aircraft Depressurisation
Cabin crew information bulletin http://www.atsb.gov.au/media/27376/ar2008075_2.pdf

- 46 -
 Table 10: Time of useful consciousness (TUC)27
Cabin Pressure Altitude (ft) TUC

15,000 More than 30 min

18,000 20 - 30 min
22,000 10 min
25,000 3 - 5 min
28,000 2.5 - 3 min
30,000 1 – 2 min
35,000 30 sec – 1 min
40,000 15 – 20 sec

As the aircraft was cruising at 29,000 ft at the time of the depressurisation, the TUC
(without supplemental oxygen) would be expected to have been approximately 2
minutes. However, as a result of the prompt emergency descent initiated by the
flight crew, by 2 minutes after depressurisation, the aircraft had already descended
to 23,000 ft, where the TUC would be expected to have been 8 to 9 minutes. In
another 4 minutes the aircraft was at 10,000 ft ‒ an altitude at which supplemental
oxygen was not needed.
The TUC figures are a guide and various factors will reduce a person’s TUC at
altitude. People who have respiratory or heart conditions, who are smokers, or are
physically unfit, will likely have a shorter TUC. Exercise, exertion or activities that
elevate the heart rate can also shorten the TUC.
Some cabin crew reported feeling light-headed or short of breath after moving
about the cabin without using supplemental oxygen (just before reaching 10,000 ft).
It is possible they were starting to feel the effects of hypoxia.
Based on cabin crew reports of the condition of two elderly passengers, it is also
possible that they were suffering from hypoxia, as they were short of breath, turning
blue and slumping in their seats.

1.13.4 Previous depressurisation events

The following depressurisation events highlight the importance of oxygen use at
altitude and how rapidly hypoxia can set in.

737 depressurisation event, 199828

In 1998, a Boeing 737-200 aircraft was en-route from Dubrovnik, Croatia to
London, England when it depressurised. The first officer recognised the aircraft was
depressurising and successfully went onto oxygen. The captain attempted to don his
oxygen mask, however in doing so, the mask became entangled with his spectacles
and knocked them off. As he reached to retrieve them, the captain became
unconscious.

27
Reinhart, R. O. (1996) Basic Flight Physiology (2nd ed). McGraw-Hill: New York.
28
AAIB (1999) Bulletin No: 6-99 Ref: EW/C98/8/6 Boeing 737-204 ADV, G-SBEB
http://www.aaib.gov.uk/cms_resources/dft_avsafety_pdf_501968.pdf.

- 47 -
 The first officer realised he could not help the captain and called for the senior
cabin crew member to administer oxygen to revive the captain. The senior cabin
crew member had to remove her oxygen mask to enter the flight deck, and did not
subsequently go onto portable oxygen, as it was located away from her station. As
she went to enter the flight deck, she also became unconscious and collapsed.
The first officer initiated a descent and was able to put the captain’s oxygen mask
on. He then asked another cabin crew member on portable oxygen to help the senior
cabin crew member.
The flight conducted an emergency landing without further incident.

737 depressurisation event, 200529

On 9 November 2005, a Boeing 737-700 aircraft was en-route between Sydney,
New South Wales and Melbourne, Victoria, when it sustained a depressurisation
event. The captain recognised the physical indications of a depressurisation (upset
stomach and discomfort in the ears) and realised the cabin altitude had climbed to
the maximum indicated value.
An emergency descent was initiated and the captain attempted to inform the cabin
crew of the descent, but the announcement was not heard in the cabin. The cabin
supervisor had noticed the oxygen masks drop in the galley and she sat down and
activated the mask. She also noticed that not all passengers had used their masks
and after talking to the flight deck, she made an announcement telling passengers to
activate their masks.
The cabin supervisor also noted that two cabin crew members had moved to the
spare passenger seats in the cabin to get oxygen and another crew member in the
galley was having difficulty putting on a mask.
One cabin crew member could not continue with their assigned duties after a lower
altitude was reached. This crew member was placed in a cabin seat with portable
oxygen.
The cabin supervisor was later informed that two cabin crew members had moved
through the cabin after they rendered their oxygen masks inoperative during the
attempt to activate them. The cabin crew reported that they were not prepared for
the amount of force needed to be applied to activate the system, nor were they
aware of the flow indicator, which showed whether or not oxygen was flowing to
the mask.

1.13.5 Cabin crew procedures

The following is an excerpt from the Operator’s Aircrew Emergency Procedures
Manual, Chapter 7, In-flight Emergencies, dated 2 June 2008:
7.2.5.2 Cabin Crew Immediate Actions
(1) Leave galley.

29
ATSB (2005) Occurrence report 200505683 ‘Loss of Pressurisation; 15km north-west of
Jindabyne NSW’
http://www.atsb.gov.au/publications/investigation_reports/2005/aair/aair200505683.aspx.

- 48 -
 (2) Use nearest available drop down mask.
(3) Sit in spare seat and fasten seat belt or wedge yourself between
passengers or seat rows.
(4) Remain seated and on oxygen.
(5) After emergency descent and when the aircraft has reached a safe
altitude the flight deck will make the PA “Cabin Crew carry out
follow up duties”.
(6) Cabin Crew commence follow up procedure.
Note: The aircraft may level out above 14,000ft due to terrain, however
Flight Crew will not make the PA until the cabin altitude is at or below
14,000ft.

7.2.5.3 Primary Cabin Crew Follow Up Procedure

(1) Obtain and fit portable oxygen cylinder from own primary
station/position.
(2) Check condition of the passengers and cabin.
(3) Inform the Customer Service Manager.
(4) Customer Service Manager to inform the Captain of the condition
of the cabin and passengers.
• Check Condition of Passengers
• Supply oxygen from PSU.
• Supply first aid as required.
• Attend to unconscious passengers first.
• If passenger does not regain consciousness or a passenger
requires further oxygen, provide at HI flow by appropriate
means (refer to type chapter).
• Notify Customer Service Manager of progress.

7.2.5.4 Assist Cabin Crew Follow Up Procedure

(1) Return to station and fit PSU oxygen and harness
(2) If required, carry out follow up duties for incapacitated Primaries
or Customer Service Manager.

1.13.6 Cabin crew actions

Those cabin crew members who were close enough to crew seats moved back to the
seats, secured themselves and obtained oxygen, (either the oxygen that dropped
from overhead units, or portable oxygen stowed at the crew seats), as the
procedures required. Some cabin crew (including the CSS), who were away from
their stations at the time, activated and commenced using a nearby (unused)
passenger oxygen mask. There were some crew however, that ran back to their crew
seat, or the nearest vacant crew seat, instead of using the closest spare passenger
mask.

- 49 -
 The CSM was located near the business class section of the lower deck at the time
of the depressurisation. Recognising that communication with the flight deck was
necessary, the CSM returned to the work station located at the front of premium
economy. However, upon arriving, the CSM saw that no oxygen had deployed at
this station. To subsequently obtain oxygen, the CSM sat between the row 34
passenger seats and used a spare mask. From that position however, the CSM was
unable to reach a cabin interphone to communicate with the rest of the cabin crew
or the flight deck. Needing to communicate with the flight deck, the CSM used
oxygen and then moved into the workstation to brief the flight deck on the damage
to the R2 door before returning to the oxygen mask in row 34.
The CSS remained in business class using a passenger oxygen mask until the flight
crew told cabin crew to resume follow-up duties.
Observing passengers having problems with their oxygen masks (either failing to
fall or passengers not getting any oxygen from their masks), two cabin crew left
their seats before the ‘resume follow-up duties’ PA was made by the flight crew.
The first crew member to leave her seat reported that she felt it was safe to do so
and recognised the need to supply oxygen to two passengers whose service units
had failed to deploy, as she could see they were suffering the early signs of hypoxia.
This cabin crew member reported that she felt her actions were safe, so long as she
used spare passenger oxygen masks as she moved through the cabin to assist. The
second (less experienced) cabin crew member, reported that she also felt it was safe
to move around after observing her colleague doing so, and given she was using a
portable oxygen system.
The majority of the crew followed the operator’s procedures for immediate actions
by using the nearest available drop down mask. Of the crew that did not, three used
the closest crew seat instead of wedging in with passengers, and while two used the
nearest seat, their drop down masks were unserviceable, having detached from the
overhead unit. Those two crew members commenced using portable oxygen.
Most cabin crew members adhered to the operator’s follow-up procedures
according to their position. Primary cabin crew members were those assigned to sit
next to the exit doors, with the responsibility of opening or manning that door in an
emergency. Assistant cabin crew members were positioned next to primary cabin
crew members and were to act in their place if the primary became incapacitated for
any reason.
All assistant cabin crew members were assigned to follow-up duties in the cabin or
galley to check on passengers and prepare the cabin for landing in Manila. While
two cabin crew members were initially incapacitated after the event, by the time the
aircraft was on descent into Manila, all cabin crew members were able to act in
their assigned positions for landing.

1.13.7 Knowledge of oxygen flow

Individual cabin crew members’ knowledge varied regarding the use of the
aircraft’s oxygen systems, and in particular, how to determine if oxygen was
flowing to the masks. Many cabin crew members reported that they used more than
one method to check for oxygen flow.
In terms of being able to tell if their oxygen was working, four cabin crew indicated
they looked for the green flow indicator built into the mask assembly. Seven cabin

- 50 -
 crew members relied on the fact they could breathe and/or felt better with the mask
on. Two pinched the mask cord to see if the bag would inflate, two felt for a flow
rate by feeling within the mask and one crew member observed the bag inflating
and took that as confirmation that oxygen was flowing.
In addition to those crew-members who looked for the green flow indicator on their
mask, five crew members stated that they knew the green flow indicator was on the
mask, but did not look for it on their particular mask, or did so after establishing the
flow by another means. At least one crew member looked for the green flow
indicator on passenger masks to ensure oxygen was flowing.

1.13.8 Passenger address tape reproducer

The aircraft was fitted with a passenger address tape reproducer (PATR), which was
designed to deliver an automatic, pre-recorded announcement to passengers in the
event of a depressurisation.
The recording is designed to tell passengers to sit down, pull down the closest
available oxygen mask and fasten seat belts. It also gave an instruction to pull the
mask towards your face to turn the oxygen on and hold it over your nose and mouth
and breathe normally until advised oxygen is no longer needed.
Cabin crew had been trained that in the case of a rapid depressurisation, the
recording would activate and inform passengers of the need to stay seated and go on
to oxygen. All crew expressed surprise that the system did not activate, and in
response, many started shouting instructions to passengers to go on oxygen and stay
in their seats.
As the cabin crew were also required to be on oxygen during this time, they could
not easily give verbal instructions. Therefore, in order to effectively instruct
passengers on what to do, they either had to remove the mask and shout commands
or hand-signal to passengers to activate their mask and secure it over their mouth
and nose. Signalling to passengers was harder in the first and business class cabins
as the passenger seats were orientated away from the crew seats. Cabin crew were
forced to remove their masks to issue verbal instructions in these areas. Economy
crew were able to effectively signal to passengers, as the majority of crew were
facing aft and therefore looking at passengers during this time.

1.13.9 Safety demonstration video

During departure from Hong Kong, the safety demonstration video was not played
as the audio component of the video was unserviceable. Instead, the CSM read out
the safety demonstration PA from the Onboard Managers Manual and the crew
carried out demonstration actions as normal.
These actions were in accordance with standard procedures in the case of an
unserviceable safety demonstration video.

1.13.10 Passenger survey

As part of the investigation, the ATSB conducted a survey of passengers about their
experiences on the flight.

- 51 -
Surveys were distributed to all 350 passengers and contained a section for parents to
complete about their children’s experiences. A total of 152 individual surveys were
returned ‒ corresponding to a response from 179 passengers (once 34 children were
included from a parent’s response); a response rate of 51%.
The survey was issued and completed by passengers within about 6 months of the
accident.

Passengers’ perception of the problem

Passengers were asked about their awareness of the depressurisation event. The
majority of respondents (149 out of 152) reported that they were aware of the event
when it occurred. Three respondents said they did not immediately notice the event
due to being asleep at the time of the fuselage rupture.
Passengers were also asked to describe what they noticed at the time the
depressurisation occurred. The majority of passengers (87%) heard a bang or loud
noise. The next greatest response regarded feeling cold air or wind sweep through
the cabin (63%). A smaller amount of passengers noticed mist or condensation in
the cabin (24%) and/or had problems with their ears popping or blocking (18%).
In addition, some passengers reported seeing objects being swept through the cabin,
predominately papers and light materials. A few passengers also reported a burning
smell immediately after the depressurisation occurred.

Actions following depressurisation

Almost half (47%) of passengers who responded to the survey indicated that they
were very confident that they knew how to operate the oxygen masks when they
dropped. Of the others, 46 % were somewhat confident, and 7% were not confident.
Most passengers (88%) thought that the safety demonstration and/or safety cards
were of assistance in knowing what to do. Figure 39 presents the visual instructions
contained in the seat-back pocket safety card.

Figure 39: Oxygen mask procedure in the seat pocket safety card

The majority of passengers reported that they were seated at the time of the
depressurisation event (98%). Of these, most had their seat belt fastened (84%),
with 14% reporting they were seated without their seat belt on. Only two passengers
reported that they were not seated at all and one passenger could not recall.
Passengers were asked to detail their actions immediately following the
depressurisation. The majority (59%) reported that they started using oxygen, with
various other responses, including ‘remained seated’, ‘looked to crew for
directions’ and ‘helped others’.

- 52 -
Oxygen Masks
Passengers were asked to describe their knowledge, from safety demonstrations and
safety cards, of what to do in the case of a depressurisation. Out of the 152
passengers who completed and returned the survey, 86% indicated that they
believed they were aware of what to do in the event of a depressurisation. The
remaining 14% either did not answer the question at all or did not give a relevant
answer.
The survey also asked passengers to detail their understanding of how the oxygen
system worked.
• 76% of passengers understood that the mask had to be pulled down to
activate the flow of oxygen
• 59% reported that they knew to tighten the strap once the mask was fitted
• 38% of passengers responded that they were to fit their mask before helping
others
• 30% stated they knew to breathe normally once the mask was in place.
Of the 152 responses, only four passengers reported that they knew the bag on the
mask would not necessarily inflate when oxygen was flowing. No other passengers
mentioned inflation in this section.
Regarding deployment of the oxygen masks in the cabin, most passengers (93%)
indicated that their mask dropped automatically, while 3% indicated they needed
help from a crew-member or other passenger to access their mask. Four passengers
said their masks did not drop at all, and one did not answer the question.
Passengers were asked how quickly they used the masks once they deployed.
Ninety-one percent of passengers used it immediately or after a few seconds. Of the
remainder, 8% used a mask more than a few seconds after it deployed, two
passengers reported they did not use a mask at all and one respondent did not
answer the question.
A common source of difficulty for passengers was the elastic strap on the mask.
Eighty-five percent of passengers had problems with the strap, with 29% having to
hold their mask by hand for the entire time that oxygen was required. Only 19
respondents indicated their mask was held on by the strap the whole time. The most
common problem with the strap indicated by passengers was the lack of elasticity.
Most reported that the straps did not hold the mask on properly due to aging of the
elastic.
Passengers were asked to choose as many options as appropriate for why they used
their oxygen mask. Eighty-six percent of passengers said they used the mask due to
the safety demonstration or card; the remainder either followed other passenger
actions or instructions, cabin crew commands or acted instinctively. Most
passengers who indicated more than one reason for using the mask also selected
‘due to safety demonstration/safety card’.
Just over half of the responding passengers (58%) indicated that they could not tell
if oxygen was flowing, with only 27% stating that they knew it was, and the
remainder (15%) stating that it was not flowing at all. The most common reason
given for why passengers thought oxygen was flowing was because they could
breathe (16 respondents). A smaller number (six respondents) could feel it and

- 53 -
some passengers noted the green flow indicator (six respondents). The most
common reasons given for passengers who said there was no flow at all was that the
bag did not inflate (seven respondents) and that they experienced breathing
problems (eight respondents). Two respondents indicated that they had a tingling or
numbness that they put down to lack of oxygen.
Passengers who indicated that they could not tell if oxygen was flowing gave both
positive and negative reasons for this. The majority of passengers (35 respondents)
in this category said they couldn’t be sure it was flowing, but since they could
breathe they assumed it was. A smaller number (six respondents) noticed that the
green flow indicator showed oxygen was flowing. Of the remainder, the lack of
flow indications such as feeling or hearing oxygen was the most common response
(29 respondents). The next most common reason for being unsure was that the bag
didn’t inflate (19 respondents).
As to be expected, a number of passengers found the depressurisation event very
stressful. In addition to the natural stress of the sudden depressurisation and the
effect of this in the cabin (mist, wind, objects blowing about), some passengers had
problems accessing a mask, some could not activate their masks and most had
problems with tightening the strap. Many passengers became anxious about the
aircraft descent profile and did not realise that the flight crew were taking the
aircraft to a lower level quickly and safely.

Passenger announcements and crew actions

Passengers were asked to detail any announcements made by the pilots regarding
the event and following activities that they heard or could remember. The majority
of passengers (87%) heard a PA about the diversion to Manila by the captain. Forty
percent of passengers recalled hearing a PA about how the pilots would be
conducting a normal landing in Manila and that the aircraft would be met by
emergency services on the runway. A smaller number of passengers remembered
hearing a PA once on the ground. Overall, the passenger comments about
communication from the flight deck were positive and most passengers
acknowledged that the PA’s gave sufficient information.
Although a number of passengers thought that they could have been informed faster
and provided with more information, many also indicated that they understood that
the flight and cabin crew were both very busy following the depressurisation.
A few passengers indicated problems hearing or understanding announcements.
Passengers were also asked to detail their observations of cabin crew members’
immediate and later actions. Many passengers gave more than one answer about
what the crew members were doing.
Almost half the passengers recalled cabin crew telling them to remain seated and to
use their mask (43%). The majority of passengers (71%) said cabin crew members
walked through the cabin once the aircraft was at a lower level and checked on the
wellbeing of passengers and that masks were being used properly. Once the
announcement was made to remove the masks, the cabin crew started preparing the
cabin for landing (16% of passengers noted this) and handing out water (9%). A
smaller amount of passengers noticed cabin crew either opening overhead mask
panels for passengers whose masks did not deploy (5%) or assisting passengers to
use their masks (8%).

- 54 -
Many passengers noted the cabin crew members were calm and professional,
although 13% of passengers said they saw some cabin crew-members distressed,
upset or in shock. Some passengers remarked that despite this, these crew members
reacted appropriately after the event and helped passengers.

Children
Of the survey responses received, 21 passengers reported that they were travelling
with children, which equated to survey responses for 27 children.
One of the survey questions related to whether or not there were adequate masks
within reach for children. Out of the 27 responses about children, 17 indicated there
were, five did not answer the question, and five indicated there were not adequate
masks for their children.
Parents were asked if they experienced any problems relating to oxygen for their
children. Fifteen said they did, with five giving no explanation of the problem. Nine
said they had no problem and three did not answer the question.
In terms of problems, three parents reported that their child wouldn’t keep the mask
on and/or there was a problem with the elastic strap. Four children were reported as
experiencing disorientation upon waking, with one child who could not work the
oxygen mask at all and the remainder wouldn’t keep their mask on after waking.
The masks for two of the children did not deploy (neither did their parents’) and
four reported problems with flow, either that their children couldn’t breathe
properly or they couldn’t tell whether oxygen was flowing. One child pulled the
mask cord out of the overhead unit.
Most passengers who indicated a problem either rectified the problem themselves or
with assistance from cabin crew. In one case where masks did not deploy at all, the
problem was not resolved and these passengers were without oxygen for the descent
to 10,000 ft.

Injuries
Passengers were asked if they suffered from any injuries or adverse effects as a
direct result of the incident. Forty-six passengers indicated they did not, but 106
indicated they suffered from an injury or adverse effect during the flight and/or
afterwards. The majority of adverse effects reported involved problems with ear
pressure or blocked ears and associated pain and hearing loss.
The majority of passengers who reported problems with hearing or ear pain stated
that the pain or hearing loss lasted less than 30 mins (27 respondents). A smaller
number of passengers had symptoms for a longer period, with seven passengers
reporting that the pain or hearing loss was gone within an hour or by landing. A
further eight passengers stated that their symptoms were gone in a few hours, with
16 passengers reporting problems lasting a few days. Some passengers experienced
pain, ear blockages or hearing loss for a longer period of time, with 11 passengers
reporting a continuation of symptoms for a few weeks and four for over a month.
A small number of passengers (26 respondents) reported that they had sought
medical attention after the flight for pain and/or injury. The majority of these
medical visits were related to problems with hearing and/or ear pain and pressure. A
few were due to on-going psychological reactions to the event.

- 55 -
 There were reports from four passengers of symptoms that could have been
indicative of the early stages of hypoxia, including a tingling sensation travelling up
their arms, a rush of blood to the head once oxygen was supplied, slurred speech
and slowed comprehension, and other symptoms that were self-identified as the
effects of altitude. The affected passengers all reported they were on oxygen once
the masks fell, with only one passenger saying they had to switch masks because
the first one didn’t work.
Many passengers also reported adverse psychological reactions of fear, anxiety and
stress during, and especially after the flight.
Of the 21 responses received for children, 10 indicated an injury of some kind. The
majority (eight) were reported as anxiety or fear, with two reported as ear pain. The
ear pain lasted until the aircraft descended, while anxiety issues ranged from
between the time until the aircraft landed, to on-going problems at the time the
report was made.

Passenger attention to safety demonstration / cards

The majority of passengers reported that they had either given full attention or some
attention to the safety demonstration at their port of departure (London or Hong
Kong). Four percent of passengers travelling from London and 8% from Hong
Kong said they gave no attention at all to the safety demonstration.
The main reason given by passengers for either not paying attention, or only paying
little attention to the demonstration was that they were either frequent travellers, or
they knew it already.
The majority of passengers reported the safety demonstration and/or safety card as
being ‘very useful’ (51%) or ‘somewhat useful’ (38%) during the event. A further
8% of respondents said the demonstration and/or card was ‘not useful’ with the
remainder not giving an answer.

1.13.11 Post-accident response by the operator

Once the aircraft landed in Manila, all crew and passengers were taken to hotels
before completing their journey. The company organised one flight back to Sydney
on the night the incident occurred and another the following day. The passengers
and less than half of the cabin crew returned to Australia on the first flight. The
remainder returned on the next flight.
The crew held an informal debrief at the aircraft, and again at the hotel, which gave
them a chance to talk about the event. They were also given the opportunity to call
their families before leaving the aircraft and once again at the hotel.
Cabin crew reported that they were met on arrival in Australia and were given time
off after the event, as well as a medical assessment and access to counselling
services. In addition, the operator held a group debrief with all flight and cabin crew
a few days after the crew had returned to Australia. This was a formal process
designed to review the event and give the crew a chance to discuss their experiences
and hear the experiences of the rest of the crew.

- 56 -
1.14 Tests and research

1.14.1 Explosive residue testing

During the on-site investigation in Manila, an officer of the Australian Federal
Police, with the assistance of the Philippine National Bureau of Investigation,
conducted tests for the presence of explosive residue within the aircraft forward
cargo hold and passenger cabin.
No indications of any residues of explosive compounds were detected in any of the
examined areas.

1.14.2 Previous cylinder failures

To explore any historical experiences with the in-service failure of compressed gas
cylinder/s, the ATSB discussed the issue with several large manufacturers and users
of transportable compressed gas containers, from both aviation and general
industrial operations. On that basis, it appeared that the VH-OJK cylinder event has
been without precedent in the aviation arena, in terms of what is known about the
nature of the failure and the aircraft damage sustained. Aviation oxygen cylinders
have failed on board aircraft previously, however all of the known events have been
attributed to external influences, such as on board fires or damage sustained during
accident impacts.
Industrial oxygen and compressed gas cylinder failures have also been reported.
However, in each instance examined, the failures have been attributed to valve
damage or to improper maintenance activity, resulting in excessive corrosion or
material degradation. Corrosion-related ruptures of steel oxygen cylinders have
been reported as a result of residual water being left in the cylinders after previous
hydrostatic pressure testing, but in those instances, the failures have been
characterised by a visible ‘spray’ of mud-like brown corrosion product over nearby
surfaces.

1.14.3 Oxygen gas analysis

During the inspection of the operator’s oxygen cylinder maintenance and servicing
facilities, records were provided of other DOT3HT-1850 cylinders that had been
inspected and refilled around the same time as the failed cylinder S/N 535657. Two
of those filled cylinders (S/N 681134 & 806422) were provided by the operator and
submitted to the Defence Science and Technology (DSTO) Aircraft Forensic
Engineering laboratories for the chemical analysis of the oxygen gas. Those
cylinders had been inspected and hydrostatically tested the day following the failed
cylinder test.
The gas analysis from both cylinders was assessed against the requirements of MIL­
O-27210F Type 1 ‘Aviators’ Breathing Oxygen’. All results, with the exception of
the moisture content, complied with the specification requirements. The moisture
content results (36 and 34 ppm30 respectively) exceeded the specification limit of 7
ppm.

30
Parts per million.

- 57 -
 To further investigate this issue, the oxygen gas manufacturer was contacted and
subsequently provided analytical certificates for the contents of the bulk transport
containers from which the operator filled the aircraft cylinders. Those certificates
reported a moisture content of less than 1 ppm – compliant with the specification
requirements.

1.14.4 Valve components

While the entire body of the number-4 passenger oxygen cylinder had been lost
from the aircraft, a number of damaged fragments and components from the valve
assembly were recovered from the aircraft cabin, or remained attached to the pipe-
work servicing the missing cylinder (Figure 40).

Figure 40: Cylinder number-4 valve components and fragments recovered

The ATSB conducted a detailed laboratory examination of the valve components,

including a study of the principal fracture surfaces, the valve sealing surfaces and
the condition of the internal galleries and chambers normally exposed to oxygen
service. Axial sectioning of the valve body was required to facilitate inspection of
the frangible (burst) disk and provide access to the internal parts. An identical valve
assembly was also disassembled and sectioned to permit a direct comparison
against the damaged items. The key observations from this work were:
• the cylinder valve was fully opened at the time of failure
• witness marks and fracture features exhibited by the valve body were consistent
with blunt impact and tensile/bending forces
• there was no evidence that the valve assembly had been exposed to a significant
overpressure condition. The frangible (burst) disk within the valve was intact
(Figure 41) and comparable in appearance to other serviceable items

- 58 -
 • there was no evidence of a combustion event (i.e. an oxygen-promoted fire)
having initiated within, or in the vicinity of the valve body or interconnected
components.

Figure 41: Transverse section through the frangible disk (arrowed) and
retaining assembly from the number-4 cylinder. The outward
curvature is typical of normal service.

1.14.5 Cylinder standards

Each of the 13 passenger oxygen cylinders aboard the aircraft had been
manufactured to comply with the requirements of United States Department of
Transportation (DOT) specification 3HT. DOT 3HT cylinders are seamless
quenched and tempered alloy steel cylinders, with nominal water capacities not
greater than 136 kg (300 lb) and service pressures of at least 6,205 kPa (900 psi).
The US DOT 3HT specification was brought into US legislation by Code of Federal
Regulation (CFR) Title 49, Part 178, subpart C, subsection 178.44, ‘Specification
3HT seamless steel cylinders for aircraft use’ (49CFR§178.44). Research by the
NTSB investigation team determined that the current DOT 3HT specification had
its origins as Interstate Commerce Commission (ICC) specification 3HT, which had
been developed from specification 3AA in the 1960s, to provide light-weight
cylinders for commercial aircraft installation.
Other standards have been developed for seamless high-strength steel gas cylinders,
including the ISO 9809 series. A comparison of the 3HT specification against the
comparable ISO 9809:1 (1999) showed both standards to have comparable
requirements in terms of material properties and performance attributes.

- 59 -
1.14.6 Exemplar cylinders
The entire number-4 oxygen cylinder body was not located on board the aircraft,
having presumably been lost from the aircraft during the rupture and subsequent
depressurisation.
In the absence of a subject for direct investigative analysis, the ATSB, with the
assistance of the Boeing Office of Air Safety Investigation, initiated a program to
identify other cylinders from the same 1996 production batch. Select cylinders from
those identified were provided to the ATSB to enable a general engineering study of
the type, and to facilitate the identification of any metallurgical quality issues that
may have affected the cylinder production at that time. The Boeing Company
provided replacement cylinder/s to those operators that submitted cylinders to the
ATSB for examination.

1.14.7 Engineering examination

Five part number 801307-00 cylinders from the same production batch as cylinder
serial number 535657 were received by the ATSB – serial numbers 535652,
535626, 535598, 535667 and 535643. A program of engineering examinations and
tests of those items was subsequently undertaken, with the tests based around the
original certification requirements of 49CFR§178.44 ‘Specification 3HT seamless
steel cylinders for aircraft use’ and the visual inspection criteria provided in the US
Compressed Gas Association document CGA C-8-2005 ‘Standard for
requalification of DOT-3HT, CTC-3HT and TC-3HTM seamless steel cylinders’. In
addition, 15 other cylinders obtained by the ATSB (including the 12 remaining
from VH-OJK) were examined as part of the overall study.
Table 11 provides general details of the cylinders examined during the
investigation. The serial number and manufacturing date were hard-stamped onto
the upper dome, and the steel heat code in the centre of the lower dome.

Table 11: Oxygen cylinders examined

Cylinder S/N Origin Manuf. date Steel Heat Code[1].

240341 VH-OJK, Right side, #1 Feb 92 CWH

ST30395 VH-OJK, Right side, #2 Sep 01 Unknown
ST20539 VH-OJK, Right side, #3 Apr 01 Unknown
666845 VH-OJK, Right side, #5 Mar 99 ZANC
240293 VH-OJK, Right side, #6 Dec 91 CWH
239949 VH-OJK, Right side #7 Nov 91 CWH
686764 VH-OJK, L Fwd O/H May 98 ZA-1
883198 VH-OJK, R Fwd O/H May 89 AWY
686716 VH-OJK, L Mid O/H Jun 99 ZAME
805949 VH-OJK, R Mid O/H Sep 04 AUN
071505 VH-OJK, L Aft O/H Jan 91 CTD
679454 VH-OJK, R Aft O/H Apr 99 ZATD
535598 Same production batch Feb 96 ZCSU
535626 Same production batch Feb 96 ZCSU

- 60 -
 535643 Same production batch Feb 96 ZCSU
535652 Same production batch Feb 96 ZCSU
535667 Same production batch Feb 96 ZCSU
535571 Previous production batch Feb 96 ZCSU
535691 Next production batch Apr 96 ZCSU
535721 Next production batch Apr 96 ZCSU
[1] - Unique identifier of the steel production batch.

External / internal examination

The 20 cylinders were examined externally by eye, and internally using general
illumination and a flexible video endoscope.
All were painted in the standard green colour for identification of their contents and
service. All carried hard-stamped identification over the upper dome surfaces, and
most also carried the steel heat code identifier in the centre of the lower dome –
placed using a dot-matrix, low-stress stamping technique. The cylindrical surfaces
carried a general identification / warning label – ‘Breathing Oxygen Use No Oil’
and a specifications label providing a summary of the cylinder type, part-numbers
and operating details (Figure 42).
In general, most cylinders presented only isolated light external surface abrasions,
scrapes and rub marks, with localised paint removal and superficial corrosion in
some areas. Most also showed evidence of touch-up painting in isolated areas where
the original paint coating had been previously scratched or damaged (Figure 43).
Damage to the underlying steel in those areas was not evident. The largest of the
individual (unrepaired) marks measured approximately 10 x 10 mm (0.4 x 0.4 in),
although multiple such marks were sometimes evident in clusters or lines (Figure
44).
Two cylinders provided from the inventory of an international operator (535691 and
535721) were in a notably more scuffed, scratched and abraded condition (Figure
45) – particularly over the lower dome surfaces (Figure 46).

Figure 42: Cylinder S/N 883198 showing typical external condition and
labelling

- 61 -
Figure 43: Surface paint repair on cylinder S/N 883198

Figure 44: External surface marks on exemplar cylinder S/N 535598

Figure 45: Cylinder S/N 535691 – relatively poor external surface condition

- 62 -
Figure 46: Paint loss and abrasion on lower dome of cylinder S/N 535691

Internally, all cylinders were essentially free from any visible evidence of active
pitting or general corrosion attack. Superficial corrosion staining and/or light
surface deposits were evident in some cylinders (Figure 47), with the most visible
areas around the upper dome and neck transition regions. One cylinder (S/N
535626) showed an irregular linear feature extending from the upper dome to part
way along the cylindrical body (Figure 48). That cylinder was subsequently
selected for sectioning and destructive examination to facilitate the characterisation
of that feature and the general metallurgical condition.

Figure 47: Internal endoscopic view of the upper dome and neck region of
cylinder S/N 535571

- 63 -
Figure 48: Linear feature observed inside cylinder S/N 535626 (arrowed)

Wall thickness assessment

Eighteen cylinders, including the five from the S/N 535657 batch, were examined
ultrasonically to ascertain the absolute values and uniformity of the wall thicknesses
along the cylinder length. Each cylinder body was examined at 25 mm (1 in)
intervals, along four longitudinal traverses spaced equally around the
circumference. Each traverse commenced within the upper dome, at 50 mm (2 in)
from the body transition, and was completed at the centre of the lower dome.
Figure 49 presents the results of the thickness survey, with the broken line below
representing the design allowable minimum cylinder thicknesses for the cylindrical
section (2.87 mm, 0.113 in) and the lower dome (2.58 mm, 0.102 in).

- 64 -
Figure 49: Graphical presentation of cylinder wall thickness measurements

Of the cylinders examined, only cylinder S/N 686764 showed a thickness value
below the specified minima – a single location towards the centre of the lower
dome. To further evaluate, a comprehensive survey was subsequently conducted
over 100% of the lower dome surfaces of this cylinder. From that work, it was
evident that the non-compliant area was restricted to a partial ring-shaped region
approximately 20 to 40 mm (0.79 to 1.57 in) from the centre of the dome. Figure 50
and Figure 51 present the results of this work in conditionally-formatted tables.
A comparison of the measured thicknesses of the cylinders from the same
production batch as the failed item, against the other examined cylinders (various
batches) showed no notable variation from the range of typical values presented
(Figure 52).

- 65 -
 Figure 50: Thickness survey data for the lower dome of cylinder S/N 686764.
The table cells are conditionally coloured to reflect the range of
thicknesses, with the lowest in red and highest in green

Raw thickness measurements (mm)

Circumferential Location - 15 degree spacing
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Centre 1 3.02 3.02 3 3.02 3.02 3.02 2.99 3.02 3 3.05 3 3.05 3.03 3.03 3.03 3.03 3.05 3.09 3.06 3.06 3.06 3.03 3.02 3.05
2 2.85 3.05 3.12 3.16 3.21 3.19 3.18 3.08 3.12 2.97 2.99 3.02 3.06 3.15 3.05 3.05 3.02 2.72 2.79 2.69 2.59 2.66 2.71 2.81
3 2.72 2.82 2.93 3.02 3.15 3.19 3.09 3.05 3 2.91 2.84 2.81 2.85 3.02 2.85 2.69 2.69 2.53 2.34 2.17 2.2 2.26 2.53 2.71
L o n g itu d in a l L o c a tio n - 1 0 m m s p a c in g

4 2.96 2.91 2.99 3.02 3.05 3.02 3.05 3.02 3 2.91 2.82 2.69 2.66 2.63 2.56 2.34 2.19 2.14 2.23 2.35 2.66 2.82 3.02 3.02
5 3.21 3.16 3.18 3.13 3.11 3.06 3.05 3.11 3.08 3.11 3.09 3.08 3.08 3.02 2.94 2.84 2.82 2.85 2.93 3.02 3.13 3.18 3.18 3.18
6 3.24 3.21 3.19 3.19 3.25 3.22 3.15 3.24 3.22 3.25 3.24 3.28 3.22 3.22 3.22 3.12 3.13 3.15 3.21 3.21 3.22 3.22 3.19 3.19
7 3.22 3.25 3.22 3.22 3.22 3.22 3.27 3.28 3.27 3.28 3.28 3.28 3.28 3.24 3.25 3.25 3.19 3.22 3.24 3.25 3.24 3.27 3.25 3.25
8 3.3 3.28 3.28 3.27 3.28 3.3 3.3 3.31 3.31 3.31 3.33 3.34 3.31 3.3 3.31 3.31 3.28 3.31 3.3 3.3 3.3 3.28 3.28 3.3
9 3.34 3.34 3.34 3.36 3.31 3.31 3.33 3.34 3.34 3.36 3.37 3.37 3.34 3.34 3.36 3.34 3.36 3.34 3.34 3.34 3.34 3.36 3.34 3.34
10 3.36 3.37 3.37 3.37 3.4 3.37 3.37 3.4 3.4 3.4 3.45 3.43 3.43 3.4 3.42 3.39 3.4 3.37 3.36 3.37 3.39 3.4 3.37 3.37
11 3.42 3.42 3.46 3.42 3.43 3.45 3.43 3.46 3.46 3.49 3.46 3.48 3.46 3.45 3.45 3.43 3.43 3.43 3.42 3.43 3.46 3.45 3.42 3.45
12 3.52 3.49 3.49 3.5 3.49 3.52 3.48 3.5 3.5 3.52 3.52 3.52 3.5 3.52 3.5 3.49 3.49 3.5 3.49 3.5 3.52 3.49 3.49 3.52
13 3.52 3.53 3.53 3.55 3.53 3.55 3.52 3.55 3.56 3.56 3.56 3.58 3.55 3.55 3.55 3.55 3.55 3.55 3.53 3.55 3.55 3.52 3.5 3.5
14 3.56 3.55 3.55 3.56 3.55 3.56 3.55 3.59 3.59 3.59 3.59 3.59 3.58 3.56 3.58 3.55 3.58 3.58 3.55 3.55 3.53 3.55 3.55 3.53
15 3.58 3.59 3.58 3.61 3.58 3.58 3.62 3.59 3.58 3.59 3.59 3.58 3.59 3.58 3.58 3.61 3.61 3.62 3.61 3.62 3.62 3.62 3.64 3.61
16 3.65 3.65 3.67 3.64 3.65 3.65 3.64 3.67 3.65 3.67 3.67 3.65 3.65 3.64 3.62 3.64 3.64 3.68 3.64 3.65 3.65 3.64 3.64 3.65
17 3.67 3.67 3.67 3.67 3.64 3.61 3.61 3.65 3.68 3.68 3.7 3.7 3.67 3.67 3.67 3.67 3.65 3.65 3.64 3.67 3.7 3.68 3.67 3.65
Shell 18 3.67 3.68 3.7 3.7 3.65 3.61 3.67 3.7 3.74 3.76 3.73 3.73 3.73 3.71 3.7 3.7 3.7 3.68 3.67 3.68 3.7 3.7 3.68 3.7

Minimum Recorded Thickness: 2.14

Minimum permitted thickness - hemisphere: 2.58
Minimum permitted thickness - shell: 2.87

Figure 51: Thickness survey data for the lower dome of cylinder S/N 686764,
presented as the relative deviation from the minimum for the lower
dome (2.58 mm). Cells are coloured to reflect deviations above
(green) and below (red) the minimum value.

Deviation from minimum hemisphere thickness (mm)

Circumferential Location - 15 degree spacing
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Centre 1 0.44 0.44 0.42 0.44 0.44 0.44 0.41 0.44 0.42 0.47 0.42 0.47 0.45 0.45 0.45 0.45 0.47 0.51 0.48 0.48 0.48 0.45 0.44 0.47
2 0.27 0.47 0.54 0.58 0.63 0.61 0.6 0.5 0.54 0.39 0.41 0.44 0.48 0.57 0.47 0.47 0.44 0.14 0.21 0.11 0.01 0.08 0.13 0.23
3 0.14 0.24 0.35 0.44 0.57 0.61 0.51 0.47 0.42 0.33 0.26 0.23 0.27 0.44 0.27 0.11 0.11 -0.05 -0.24 -0.41 -0.38 -0.32 -0.05 0.13
L o n g itu d in a l L o c a tio n - 1 0 m m s p a c in g

4 0.38 0.33 0.41 0.44 0.47 0.44 0.47 0.44 0.42 0.33 0.24 0.11 0.08 0.05 -0.02 -0.24 -0.39 -0.44 -0.35 -0.23 0.08 0.24 0.44 0.44
5 0.63 0.58 0.6 0.55 0.53 0.48 0.47 0.53 0.5 0.53 0.51 0.5 0.5 0.44 0.36 0.26 0.24 0.27 0.35 0.44 0.55 0.6 0.6 0.6
6 0.66 0.63 0.61 0.61 0.67 0.64 0.57 0.66 0.64 0.67 0.66 0.7 0.64 0.64 0.64 0.54 0.55 0.57 0.63 0.63 0.64 0.64 0.61 0.61
7 0.64 0.67 0.64 0.64 0.64 0.64 0.69 0.7 0.69 0.7 0.7 0.7 0.7 0.66 0.67 0.67 0.61 0.64 0.66 0.67 0.66 0.69 0.67 0.67
8 0.72 0.7 0.7 0.69 0.7 0.72 0.72 0.73 0.73 0.73 0.75 0.76 0.73 0.72 0.73 0.73 0.7 0.73 0.72 0.72 0.72 0.7 0.7 0.72
9 0.76 0.76 0.76 0.78 0.73 0.73 0.75 0.76 0.76 0.78 0.79 0.79 0.76 0.76 0.78 0.76 0.78 0.76 0.76 0.76 0.76 0.78 0.76 0.76
10 0.78 0.79 0.79 0.79 0.82 0.79 0.79 0.82 0.82 0.82 0.87 0.85 0.85 0.82 0.84 0.81 0.82 0.79 0.78 0.79 0.81 0.82 0.79 0.79
11 0.84 0.84 0.88 0.84 0.85 0.87 0.85 0.88 0.88 0.91 0.88 0.9 0.88 0.87 0.87 0.85 0.85 0.85 0.84 0.85 0.88 0.87 0.84 0.87
12 0.94 0.91 0.91 0.92 0.91 0.94 0.9 0.92 0.92 0.94 0.94 0.94 0.92 0.94 0.92 0.91 0.91 0.92 0.91 0.92 0.94 0.91 0.91 0.94
13 0.94 0.95 0.95 0.97 0.95 0.97 0.94 0.97 0.98 0.98 0.98 1 0.97 0.97 0.97 0.97 0.97 0.97 0.95 0.97 0.97 0.94 0.92 0.92
14 0.98 0.97 0.97 0.98 0.97 0.98 0.97 1.01 1.01 1.01 1.01 1.01 1 0.98 1 0.97 1 1 0.97 0.97 0.95 0.97 0.97 0.95
15 1 1.01 1 1.03 1 1 1.04 1.01 1 1.01 1.01 1 1.01 1 1 1.03 1.03 1.04 1.03 1.04 1.04 1.04 1.06 1.03
16 1.07 1.07 1.09 1.06 1.07 1.07 1.06 1.09 1.07 1.09 1.09 1.07 1.07 1.06 1.04 1.06 1.06 1.1 1.06 1.07 1.07 1.06 1.06 1.07
17 1.09 1.09 1.09 1.09 1.06 1.03 1.03 1.07 1.1 1.1 1.12 1.12 1.09 1.09 1.09 1.09 1.07 1.07 1.06 1.09 1.12 1.1 1.09 1.07
Shell 18 1.09 1.1 1.12 1.12 1.07 1.03 1.09 1.12 1.16 1.18 1.15 1.15 1.15 1.13 1.12 1.12 1.12 1.1 1.09 1.1 1.12 1.12 1.1 1.12

- 66 -
Figure 52: Comparison of thicknesses from the failed cylinder batch, against
the total lot examined

In general, the minimum wall thickness of the cylinder design was found within the
central regions of the cylinder body, although the variability was minimal (typically
± 0.1 mm, 0.004 in) along the body length. The thickness measurements also
highlighted the presence of a localised increase in thickness of around 0.5 mm (0.02
in) immediately before the lower dome transition.

Magnetic particle inspection (MPI)

After sectioning cylinder S/N 535626 to expose the internal surfaces, a fluorescent
magnetic particle inspection (MPI) technique was employed to examine 100% of
the internal surface area, including the linear feature observed during the
endoscopic examination (Figure 48). While no evidence of crack-like features was
observed within the cylinder body, multiple linear indications were detected
radiating outward from the cylinder neck transition region (Figure 53). The longest
of the indications extended for approximately 12 mm (0.5 in). The linear feature
shown in Figure 48 did not present as a defect indication under MPI.

- 67 -
Figure 53: Linear indications extending from the internal neck bore of cylinder
S/N 535626 (largest arrowed)

Material / microstructural examination

Prior to further sectioning for microstructural study, the internal surfaces of cylinder
S/N 535626 were examined visually. It was noted that the internal surfaces around
the upper dome and neck transition displayed a considerably coarser and irregular
surface finish when compared with the general cylindrical and lower dome surfaces.
A radial pattern of fissures and rivulet features was observed, becoming more
prominent toward the neck (Figure 54). The larger of those features were typical of
the linear indications highlighted by the magnetic particle inspection process.
The entire surface in the neck and upper dome region presented a partially oxidised
or thick scale-like appearance. The linear feature observed endoscopically (Figure
48) was revealed to be a diffuse surface mark, with no characteristics of a surface
flaw or other injurious defect.
A number of transverse sections were removed from the cylinder and prepared for
microscopic study, encompassing the upper and lower dome transition regions and
the material around the cylinder neck that exhibited the linear indications. The bulk
cylinder microstructure (Figure 55) presented fine and uniform tempered
transformation products (martensite / bainite), with a ferritic decarburisation31 layer
extending to around 0.2 mm (0.008 in) depth from all surfaces. The linear
indications within the upper dome and neck presented as intrusive, oxide-filled
flaws, with a characteristic envelope of decarburised material around the profile
(Figure 56), consistent with their formation during the initial high-temperature
forging and forming processes used to produce the cylinder. The largest of the
features displayed a branched nature and extended to a depth of approximately

31
Decarburisation is a high-temperature diffusion process where elemental carbon is lost from the
surfaces of steels and other ferrous alloys.

- 68 -
0.9 mm (0.035 in) beneath the normal surface plane. None of the intrusions showed
any indication of crack growth from the tips or other extremities.

Figure 54: Linear features on the internal surfaces around the cylinder neck

Figure 55: General cylinder material microstructure – tempered martensite /

bainite

- 69 -
Figure 56: Largest of the internal surface intrusions identified around the
cylinder neck transition

Mark stamping characteristics

A series of detailed stereomicroscopic examinations were conducted on the upper
dome of an exemplar cylinder (S/N 535626) in the areas that had been marked with
hard-stamping identification. In each area, the heaviest (deepest) stamped profile
was characterised optically using stereographic techniques, to identify the absolute
depth of the impression, and the nature of the impression base.
Of the stamped areas examined after removal of the surface paint coatings, the
deepest impression (Figure 58) measured 1.196 mm (0.047 in), and presented a
smooth, uniformly curved base profile (Figure 57). The typical depth of impression
ranged from 0.4 to 0.8 mm (0.016 to 0.031 in), and all were smooth and uniformly
formed in profile.

Figure 57: Profile form and measurements of a cylinder stamp marking

- 70 -
Figure 58: Cylinder stamp marking (letter ‘U’) with plane of profile
measurement shown

Thread form and characteristics

The cylinder manufacturing specification required the neck threads to be even,
clean-cut and without cracks. To assess, a series of sections were taken
longitudinally through the threaded neck of cylinder S/N 535626 and prepared for
microscopic study. When examined in profile (Figure 59), the cylinder threads
appeared fully-formed, with no evidence of cracks, tears or mal-formed areas.

Figure 59: Cylinder neck thread profile

- 71 -
Chemical analysis
Table 12 presents the spectrographic analyses of two samples of material from
cylinder S/N 535626 (upper dome and lower cylindrical section), together with the
analytical requirements for cylinders produced to the 3HT specification.

Table 12: Analyses and specification for cylinder material (weight %)

C Mn Si S P Ni Cr Mo Cu V Nb Ti Al B Ca

Sample: Upper dome area

.30 .46 .30 .005 .01 .10 1.08 .25 .19 <.01 <.01 <.01 .037 <.0005 .006

Sample: Lower cylindrical area

.30 .45 .29 .005 .01 .10 1.07 .24 .19 <.01 <.01 <.01 .035 <.0005 .007

Specification: 49CFR178.44 (AISI 4130) Authorised Material

.28 .40 .15 .04 .04 .80 .15

.33 .60 .35 Max Max 1.10 .25

Both cylinder samples fell within the defined specification limits and contained
levels of residual elements that were below the generally-accepted upper content
limits32 for alloy steels of this type.

Tensile tests
The cylinder production standard (US CFR Title 49 §178.44) required the
demonstration of satisfactory material physical strength and ductility through the
performance of material tensile tests. Suitable samples for these tests were removed
from exemplar cylinder S/N 535652 and tested in accordance with the requisite
standards by an accredited independent laboratory (Table 13).
Specimens for the assessment of the tensile properties of the cylinder material were
removed from the barrel section, in both longitudinal and transverse orientations.
Additional specimens were also removed from the lower dome transition region;
oriented radially with respect to the cylinder longitudinal axis (Figure 60).

Table 13: Tensile test results

Sample 0.2% Proof Tensile Strength Elongation Elongation
Stress (MPa) (MPa) A85 (%) A2” (%)

Longitudinal – 1 996 1061 9 12

Longitudinal – 2 1002 1069 9 12
#
Circumferential – 1 774 1060 5 9
Circumferential – 2 806 1059 7 11
Circumferential – 3 845 1072 8 11

32
ISO 9809-1 specifies S+P < 0.025%, V+Nb+Ti+B+Zr < 0.15%.

- 72 -
Transition – 1* 1021 - - -
*
Transition – 2 982 - - -
#
Transition – 3 890 1106 5 8
Transition – 4 871 1127 7 9

Requirements as per - 1138 Max 6 min -

49CFR178.44 (165,000 psi)
# - Fracture location was less than 25% of the original gauge length from a gauge mark,
hence the elongation result may be unrepresentative.
* - Samples fractured through the pinned end grip – two retests were performed.
a – elongation measured over an 85mm gauge length (as per §178.44)
b – elongation measured over a 2 inch gauge length

Where valid results were obtained, all samples examined complied with the
elongation and limiting tensile strength requirements of the cylinder manufacturing
specification.

Flattening tests
A single flattening test as described in section I of CFR Title 49 §178.44, was
prepared and tested from the upper cylindrical section of the cylinder (the location
marked F1 in Figure 60). When flattened between opposing knife edges having a
60º included angle and 12.5 mm (0.5 in) edge radii, the specimen cracked
longitudinally (Figure 61) at a knife edge separation of approximately 60 mm (2.4
in). As such, the test did not comply with the requirements specified by CFR Part
49 §178.44 section (p)(1), which stipulated ‘flattening required without cracking to
ten times the wall thickness of the cylinder’ (28 mm / 1.13 in).
A repeat of the flattening test (using a non-standard 25 mm / 1 in wide specimen)
also failed to comply with the specification requirements – exhibiting cracking and
surface tearing across one of the stressed surfaces.

Figure 60: Cylinder S/N 535652 with locations of mechanical test specimens
marked. L, T & C are the longitudinal, transition and circumferential
tensile test specimens, F1 the flattening test specimen

- 73 -
Figure 61: Completed flattening test, with area of cracking arrowed

Guided bend tests

To further explore the bending performance of the cylinder material, a set of two 25
mm (1 in) wide strip specimens were removed from around the circumference of
cylinder S/N 535626 and tested by bending to 180º around a 22 mm (0.87 in)
diameter former, with the cylinder external surface in tension. When assessed in
this way, both tests demonstrated good ductility, with no evidence of the cracking
and tearing that was sustained during the flattening tests.

Impact tests
A small suite of Charpy V-notch impact tests were conducted on specimens
removed from cylinder S/N 535626. The specimens were taken from a sample of
cylindrical-section material from the subject cylinder, and were oriented along the
longitudinal and transverse cylinder axes. The test specimens were machined to a
2.5 mm sub-size standard, and a set of three specimens was tested at each of +20ºC
and -50ºC test temperatures. Table 14 presents the test results.

Table 14: Impact test results – cylinder material

Orientation Test Temp Impact Energy (Joules)

Longitudinal +20ºC 18 - 17 - 17
Longitudinal -50ºC 19 - 16 - 16
Transverse +20ºC 12 - 12 - 14
Transverse -50ºC 12 - 12 - 11

- 74 -
 Impact tests of the cylinder parent material are not routinely specified for heat-
treated steel cylinders with a limiting tensile strength value of less than 1,100 MPa
(159 ksi33), and neither 49CFR178.44 nor ISO 9809.1 does so.

Tempering temperature evaluation

To ensure a sufficiently tempered (and hence metallurgically acceptable)
microstructure, the 49CFR178.44 manufacturing standard required that during
production, the cylinder material be tempered at not less than 454ºC (850ºF).
Using samples removed from the cylinder body material, a series of increasing
temperature heat-treatments and intermediary hardness tests were conducted. The
evaluation was based on the principle that heat treatments carried out below the
original tempering temperature will not significantly affect the material hardness,
while heat treatments conducted above the original temperature will induce
additional tempering, and thus a measurable reduction in hardness.

Table 15: Tempering test results

Sample heat treatment Average hardness Relative hardness change
condition (HV10)[1]

As-received (reference) 374 -

400ºC soak for 1 hour 369 -5
425ºC soak for 1 hour 369 -5
450ºC soak for 1 hour 374 0
475ºC soak for 1 hour 373 -1
500ºC soak for 1 hour 366 -8
525ºC soak for 1 hour 356 - 18
[1] - Vickers hardness scale, 10 kg indenter load.

From the trial results, it was evident that the original cylinder tempering heat
treatment had been conducted at a temperature around 500ºC (932 ºF) – compliant
with 49CFR178.44.

1.14.8 Hydrostatic pressure tests

To assess the compliance of the cylinder production lot with the requirements of the
manufacturing specification, a series of hydrostatic pressure tests were conducted
on three of the exemplar cylinders. Two cylinders were subject to proof expansion
and subsequent rupture tests; a third underwent a proof expansion test followed by a
cyclic pressurisation program, a second proof expansion test, and a final rupture
test. All tests were conducted as required by the 49CFR178.44 specification.

Expansion tests
Each cylinder was pressurised to a nominal test value of 3,083 psi (21,256 kPa)
within an external water jacket. Displacement of water from the jacket into a burette
assembly permitted the assessment (Table 16) of the volumetric expansion of the
cylinder at the test pressure.

33
Kilopounds per square inch.

- 75 -
Table 16: Expansion test results
Cylinder REE[1] (ml) Expansion (ml)

535667 170.1 157.8

535643 168.0 152.2
535598 test 1[2] 169.1 160.2
[2]
535598 test 2 169.1 154.2

[1] – Rejectable Elastic Expansion requirement - marked on cylinder.

[2] – tests conducted before (1) and after (2) program of cyclic pressure tests.

Rupture tests
Each cylinder was progressively pressurised within a containment room until failure
occurred, with the peak pressure and failure mechanism (leak or burst) being
recorded (Table 17).

Table 17: Rupture test results

Cylinder Failure pressure Failure mode
(psi / kPa)

535667 4,400 / 30,337 Burst

535643 5,005 / 34,508 Burst
535598[1] 4,200 / 28,958 Leak

[1] – After the cyclic testing program.

The minimum allowable rupture pressure prescribed by 49CFR178.44 was 4,111

psi (28,344 kPa), and all test cylinders exceeded that value. Figure 62, Figure 63
and Figure 64 present the external appearance of the cylinders following the rupture
testing program.

Figure 62: Rupture of cylinder S/N 535667

- 76 -
Figure 63: Rupture of cylinder S/N 535643

Figure 64: Leak of cylinder S/N 535598

Cyclic tests
Cylinder 535598 was subjected to a program of repeated pressurisations from 0 to
1,850 psi (12,755 kPa) in accordance with 49CFR178.44. A total of 10,000 discrete
pressure cycles were applied, over a period of 6 days (10 blocks of 1,000 cycles), at
a nominal rate of six cycles per minute. After each block of cycles, the cylinder was
visually examined for evidence of leakage or other anomalies, and after completion
of the 10,000 cycles, the cylinder was subject to expansion and rupture tests as
previously detailed.
At no stage during the program did the subject cylinder show any evidence of
leaking, perforation or becoming structurally compromised in any way.

- 77 -
1.14.9 Stress analysis / fracture mechanics
To obtain indicative estimates of the critical flaw sizes34 for failure of the 3HT1850
oxygen cylinder type in question, the ATSB retained the services of QinetiQ
Aerostructures Pty Ltd, for the performance of a finite element analysis of the
design, along with a residual strength analysis using linear elastic fracture
mechanics (LEFM) techniques.

Finite element stress analysis

The finite element model (FEM, Figure 65) was prepared using data from
engineering drawings sourced from the cylinder manufacturer. Values for the
minimum cylindrical wall thickness (0.113 in / 2.87 mm), average internal cylinder
diameter (8.75 in / 222.2 mm) and minimum lower hemisphere wall thickness
(0.102 in / 2.60 mm) were obtained from the production test certificate for the
cylinder lot.

Figure 65: Finite element model of the oxygen cylinder design

The FEM analysis produced an average longitudinal cylindrical wall stress value of
36.3 ksi (250.3 MPa) and average hoop (circumferential) stress value of 72.6 ksi
(499.9 MPa), for the 1,850 psi design service pressure of the cylinder. Both values
compared favourably with the conventionally calculated values of 37.3 ksi (257.2
MPa) and 74.7 ksi (515.0 MPa) respectively.
Taking into consideration the allowable reduction in wall thickness within the lower
hemisphere (90% of the minimum cylindrical thickness), the FEM analysis revealed
the presence of elevated peaks in the longitudinal stress field associated with the
transition region between the cylindrical and lower hemispherical sections (Figure
66 and Figure 67). The peak longitudinal stress in this region was 45.9 ksi (316.5
MPa); a factor of 1.3 times the average longitudinal stress in the main body of the
cylinder.

34
The critical size of a flaw is defined as the minimum size required to cause failure of the cylinder
at a given stress (pressure) level.

- 78 -
Figure 66: Stress distribution within the cylinder. Peak stress is shown in red

Figure 67: Stress distribution across the cylinder lower dome transition

Critical flaw size determination

Two potential locations were considered for the possible presence of critical semi-
elliptical flaws within the failed cylinder (Figure 68):
• the inner surface longitudinal flaw within the cylindrical (main body) of the
cylinder
• the inner surface circumferential flaw within the transition region between the
main body and the lower hemispherical end of the cylinder.

- 79 -
Figure 68: Cylinder flaw locations considered

Longitudinal flaw

Circumferential flaw
(transition region)

Through the preparation of residual strength diagrams that demonstrate the

relationship between flaw size and pressure vessel stress, a conservative
representation of critical sizes for semi-elliptical flaws (Figure 69) of various aspect
ratios35 was prepared for two nominal values of fracture toughness (K1C) of the shell
material (50 / 75 ksi√in).

Figure 69: Dimensional illustration of the surface flaws considered

35
The aspect ratio is the relationship between length and depth of the flaw and is normally expressed
as the ratio of crack depth to half the crack length (i.e. depth/0.5xlength).

- 80 -
Table 18: Critical sizes determined for longitudinal flaws

Aspect Ratio

Loading K1C Dimensions 0.2 0.3 0.4 0.5

a (in) 0.009 0.011 0.013 0.016

50ksi√in
Test C (in) 0.046 0.037 0.033 0.031
Pressure a (in) 0.012 0.016 0.020 0.026
75ksi√in
C (in) 0.060 0.053 0.049 0.052
a (in) 0.048 0.059 0.070 0.081
50ksi√in
Working C (in) 0.239 0.195 0.175 0.164
Pressure a (in) 0.063 0.084 0.105 No
75ksi√in
C (in) 0.318 0.279 0.263 Failure

Table 19: Critical sizes determined for circumferential flaws at the lower
dome transition region

Aspect Ratio

Loading K1C Dimensions 0.2 0.3 0.4

a (in) 0.050 0.059 0.069

50ksi√in
Test C (in) 0.249 0.196 0.173
Pressure a (in) 0.070 0.087 No
75ksi√in
C (in) 0.350 0.291 Failure
a (in) 0.078 0.098 No
50ksi√in
Working C (in) 0.390 0.325 Failure
Pressure a (in) No No No
75ksi√in
C (in) Failure Failure Failure

The analysis results illustrated the key role played by aspect ratio in establishing the
critical flaw size, with lower aspect ratio (longer, shallower) flaws proving more
critical. From the results presented in Table 18 and Table 19, it was shown that the
most significant (i.e. smallest) flaw that could present as critical to the integrity of
the cylinder type at its working pressure (1,850 psi), was a longitudinal defect with
a depth of 0.048 in (1.22 mm) and length of 0.478 in (12.1 mm), when evaluated
using a limiting material fracture toughness of 50 ksi√in. The smallest
circumferential defect (at the lower dome transition) that could lead to failure, was
one with a depth of 0.078 in (2.00 mm) and length of 0.780 in (19.8 mm).
It was noted by the analysts however, that the flaw sizes determined by this process
were likely to be conservative, and should be supplemented by additional analyses
using elastic-plastic fracture mechanics techniques (EPFM) and/or a physical test
program on cylinders with artificially-produced flaws.

- 81 -
1.14.10 Artificially-flawed cylinder test program
Following from the numerical fracture mechanics assessment of the cylinder design,
a program of tests was designed to physically assess the integrity of the cylinders in
the presence of (artificially-induced) defects within the shell wall. The program was
based on a large body of work conducted by an International Standards
Organisation (ISO) working group on cylinder fracture36, and documented in ISO
technical reports 12391-1 through 12391-4 (ISO/TR 12391-1,2,3,4). That work was
used to develop the fracture behaviour requirements of ISO 9809-2:2000, which
requires that the cylinder type will fail by leaking (as opposed to bursting) in the
presence of a given physical flaw, and at a pressure exceeding the designated
working pressure.
While requirements for the practical establishment of fracture behaviour in the
presence of shell flaws were not a part of 49CFR178.44 for the DOT3HT cylinder
type, in light of the occurrence cylinder failure, it was desirable to explore the
behaviour of the design in a way that would be likely to highlight any fracture
behaviour that may have contributed to the in-flight rupture event.
Appendix A to this report provides details of the artificially-flawed cylinder test
program undertaken, and readers are referred to the appendix for information
regarding the production of the artificial flaws and the full test results.

Test method
The following presents a basic outline of the test method followed:
1. Machine a standard exterior37 surface flaw within a subject cylinder, using
a defined and reproducible technique, and at a location of probable
maximum stress under service loading (gas pressure).
2. Record the flaw length, depth and the actual cylinder thickness at the flaw
location.
3. Pressurise the cylinder hydrostatically in a controlled manner, and increase
the pressure until cylinder failure occurs.
4. Record the pressure at failure (Pf) and the mode of failure (leak or burst),
where bursting is defined as an extension of the flaw length of greater than
10% of the original machined flaw length.
5. If the mode of failure was bursting, iteratively repeat the test with a deeper
flaw (same length) until failure occurs by leaking.
6. Conversely, if the mode of failure was leaking, iteratively repeat the test
with a shallower flaw (same length) until failure occurs by bursting.
7. Repeat steps 1 to 6 for a range of flaw lengths.

36
ISO technical committee 58, subcommittee 3, working group 14 ((ISO/TC 58/SC3/WG14).
37
Machining of flaws was performed on the exterior surface for practical reasons. The
comparatively thin-walled nature of the cylinder meant that the stress distribution across the flaw
profile would be essentially independent of its location (internal or external) on the cylinder shell.

- 82 -
 8. Plot the test results as failure pressure against flaw length, and define a
boundary line that represents the transition from leak to burst behaviour
against defect length.
9. Assess the defect length necessary to produce rupture failure at the nominal
cylinder operating pressure.
Twelve tests in total were performed across four cylinders (a welding technique was
used to seal cylinders that had failed by leaking at the defect location – allowing re­
use).

Test results and outcomes

Table 20 presents a summary of the test results (failure pressure and failure mode)
against the dimensions of the flaw at which failure occurred. Figure 71 and Figure
72 present the test results graphically, with the Leak – Rupture boundary fitted to
the data set.
From an extrapolation of the Leak ‒ Rupture boundary, the critical defect length for
failure by rupture at 1,850 psi was estimated at approximately 49 mm (1.93 in). A
similar technique applied to assess critical flaw aspect ratio returned a nominal
value of 0.096, which represents a flaw depth of around 2.3 mm (0.09 in).

Table 20: Artificial flaw dimensions and test results

Flaw Flaw Flaw Shell Ligament Failure
Test Cyl [1] Failure
Length Depth Aspect Thickness Thickness Pressure
No. S/N Mode
(mm) (mm) Ratio (mm) (mm) (psi)

1 240341 45.7 2.73 0.12 3.26 0.53 Leak 1,835

2 240293 34.0 2.73 0.16 3.24 0.51 Leak 2,423
3 071505 26.9 2.73 0.20 3.24 0.51 Leak 3,251
4 240341 47.0 2.44 0.10 3.23 0.79 Leak 1,957
5 240293 34.2 2.44 0.14 3.26 0.82 Leak 2,657
6 071505 25.6 2.44 0.19 3.18 0.74 Leak 3,251
[2]
7 240341 46.5 2.15 0.09 3.17 1.02 Burst 2,218
8 240293 34.5 2.15 0.12 3.14 0.99 Leak 2,697
Failed by bursting at weld repair – invalid result
9 071505 3,338
Failed by leaking at weld repair – invalid result
10 240293 2,563
Failed by leaking at weld repair – invalid result
11 240293 2,207
12 239949 34.5 1.50 0.08 3.11 1.61 Burst 3,346
[1] Thickness of material remaining below the machined flaw
[2] See Figure 70

- 83 -
Figure 70: Cylinder 240341 ruptured at a 46.5 mm L x 2.15 mm D artificial flaw
(Test No. 7)

Figure 71: Graphical representation of failure pressure against defect length

and failure mode

- 84 -
 Figure 72: Graphical representation of failure pressure against defect aspect
ratio and failure mode

1.14.11 Environmental compatibility testing

For continued safe operation, it is imperative that the cylinder material (in this
instance heat-treated alloy steel) be compatible38 with all products it is likely to
come into contact with. While standards such as ISO 1111439 address the likely
compatibility of the cylinder and valve materials with their intended storage
contents (in this case, dry breathing oxygen), all cylinders are routinely exposed to
other materials and products during their service lives.
During a review of the passenger oxygen cylinder maintenance and operating
environments, a number of differing materials were identified as routinely coming
into contact with the cylinder internal surfaces. Table 21 identifies these.

38
Compatible in this sense can be considered as the cylinder material not sustaining any physical,
metallurgical or other changes or effects (i.e. corrosion) that could threaten the ongoing fitness­
for-purpose of the cylinder, as a result of being exposed to the product in question.
39
Transportable gas cylinders – Compatibility of cylinder and valve materials with gas contents.

- 85 -
Table 21: Routine cylinder contents
Product Formal name State Function

Oxygen Dry breathing oxygen Compressed gas, 0­ Normal cylinder storage

128 bar (1,850 psi) contents
Water Potable water Liquid, ambient Hydrostatic testing
temperature, 0-214 medium
bar (3,100 psi)
Alcohol Isopropyl alcohol Liquid, ambient Post-hydrostatic test
temperature washing agent
®
Lenium GS n-propyl bromide Liquid, ambient Post-alcohol wash rinsing
based solvent temperature agent
®
A-Gasol 1-1 dichlor-1­ Liquid, ambient Alternate post-alcohol
fluoroethane (HCFC­ temperature wash rinsing agent
141b) based solvent
Air Ambient air Uncompressed gas, None
ambient temperatures
and humidity
Nitrogen Dry Nitrogen Uncompressed gas, Internal drying and
warmed to 180-200ºF flushing of solvent vapour
(82-93ºC)

While the likely mechanisms of degradation and the associated risks of short and
long-term exposure to some of these products were well documented and
understood (oxygen, water, air and nitrogen), information as to the possible effects
of long-term exposure to the other chemicals of interest (Isopropyl alcohol, Lenium
GS® and A-Gasol®) was not readily available. As such, a program of environmental
testing was developed to gauge the specific behaviour of the cylinder steel, when
exposed to these chemicals for an extended period, and in an environment that
replicated the in-service conditions.

Cylinder material behaviour

High-strength alloy steel materials are known to be subject to environmental
damage mechanisms such as stress-corrosion cracking (SCC) and hydrogen
embrittlement (HE). Such phenomena represent the synergistic behaviour of a
specific chemical environment and an applied or residual stress-state, on the
susceptible material. Embrittlement mechanisms such as SCC and HE were
considered to represent the most significant risk in respect of producing (or
contributing to the production of) a critically-sized flaw that could subsequently
result in cylinder rupture.

Test regime
The environmental testing program consisted of placing suitably-prepared and pre­
stressed40specimens into solutions of Isopropyl alcohol, Lenium GS® and A-Gasol®.
The solutions were saturated by continuously bubbling a stream of oxygen through
the liquid and into the vapour space above. Figure 73 illustrates the test
arrangements.

40
To simulate the in-service cylinder wall stresses from the pressurised oxygen.

- 86 -
 The test specimen size and stressing method was as outlined in ATSM G69
Standard Practice for Preparation and Use of Bent Beam Stress-Corrosion Test
Specimens (2009).
Appendix B to this report provides greater detail on the test method, parameters of
exposure, conditions and outcome.

Figure 73: Environmental exposure testing arrangement

Vapour
space

Solution
under
evaluation

Stressed test
Specimen

Oxygen gas

Test results
The total exposure period of the cylinder material against the three solutions was:
• Isopropyl Alcohol - 70 days
• Lenium GS® - 70 days
• A-Gasol® - 49 days (due to initial sourcing issues)
During the exposure there was no visible change in the appearance of the specimens
or the condition of the test solutions. Upon removal and microscopic scrutiny of the
exposed surfaces, evidence of possible corrosion activity was noted However,
subsequent metallographic (microscopic) and physical testing showed no changes in
the bulk material condition or ductility, and no significant differences between the
exposed specimens and a control sample of the cylinder material.
Appendix B presents full details of the post-exposure specimen evaluation.

- 87 -
Previous exposure incident
On 25 September 2007, the ATSB was notified of an incident where an aircraft
emergency breathing oxygen system had been inadvertently replenished with dry
nitrogen gas. While the factors that contributed to that occurrence had been
addressed as a result of the operator’s investigation findings, the possibility that
nitrogen may have been inadvertently introduced into the passenger oxygen system
of VH-OJK was considered during this investigation.
Dry nitrogen is commonly used for engineering purposes (charging oleo struts,
inflating tyres and otherwise), as it is a stable and inert (non-reactive) gas. Should
nitrogen have been used to replenish the oxygen cylinder contents, the effects on
the breathability of the product delivered by the emergency oxygen system would
have been significant, however it is very likely that there would have been little or
no effect on the physical integrity of the cylinder/s. Atmospheric air is comprised of
approximately 78% by volume of nitrogen (oxygen is 21%), and as such, the
introduction of nitrogen into cylinders containing oxygen would likely reduce the
potential for corrosive or chemical damage.

- 88 -
2 ANALYSIS

2.1 Depressurisation event

The Australian Transport Safety Bureau’s investigation has determined that the
sudden depressurisation of Boeing 747-438 aircraft, VH-OJK, that occurred
approximately 475 km north-west of Manila, Philippines, on 25 July 2008, resulted
from the forceful rupture (bursting) of a single passenger emergency oxygen
cylinder that was installed along the right side of the aircraft’s forward cargo hold.
The forceful nature of that cylinder failure and the release of its pressurised oxygen
contents, ruptured the adjacent fuselage skin and seriously damaged the associated
airframe structure. As the cargo hold formed part of the pressurised volume of the
aircraft fuselage, it, together with the passenger cabin, rapidly depressurised. The
cabin, which was pressurised to approximately 12.5 psia41 at the time of the event,
depressurised to a minimum of 5.25 psia42 over a 20 to 25 second period, triggering
the emergency supplemental oxygen system and the automatic deployment of the
passenger oxygen masks. Approximately 38 seconds after the rupture event, the
flight crew commenced an emergency descent to 10,000 ft – an altitude at which the
general use of supplementary oxygen could be discontinued. The aircraft reached,
and was levelled at 10,000 ft, approximately 6 ½ minutes after the rupture event.

2.2 Aircraft structural damage

2.2.1 Fuselage
The fuselage rupture produced by the bursting oxygen cylinder encompassed an
area of approximately 1.74 m2; centred on fuselage body station 820 (BS 820) and
coinciding with the right wing leading edge root fairing. A total of five adjacent
longitudinal stringers (32 to 36) and two adjacent circumferential frames (800 and
820) had been structurally compromised during the fuselage rupture event.
The physical damage sustained was entirely consistent with a localised, outwards-
forcing explosive event, with all fracture surfaces examined showing typical ductile
tearing and tensile overstress features. An outward and upward-folded flap of
fuselage skin at the top of the ruptured area and encompassing fuselage stringers 32
and 33, showed clear outward bulging and deformation – that skin had been located
immediately behind the lower part of the number-4 passenger oxygen cylinder.
There was no evidence of a fire or combustion-related event having either
contributed to, or been associated with the fuselage rupture; nor was there any
evidence that an explosive device had detonated at, or adjacent to, the rupture area.
There was no evidence of any pre-existing cracking, corrosion or other flaws in the
ruptured area, nor was there any indication of repair work or other signs that the
affected area of the fuselage may have sustained prior damage during its earlier

41
Pounds per square-inch (absolute) – equivalent to an altitude of 3,700 ft.
42
Equivalent to an altitude of 25,900 ft.

- 89 -
 history. A review of maintenance documentation confirmed that there was no
record of the aircraft having been previously damaged in that area.

2.2.2 Cabin door

From the associated physical evidence, it was apparent to the investigation team,
that upon failure, the oxygen cylinder had travelled forcefully upward, puncturing
the cabin floor above and impacting the Right-2 (R2) cabin door frame and handle.
That impact had forced the door handle through approximately 120 degrees from its
closed and locked position. The force of that rotation had torsionally-fractured the
handle shaft and disrupted the door’s internal locking/unlocking mechanism.
An analysis of the potential for the door to have unintentionally opened during the
event, or during the subsequent diversion and landing in Manila, found that the
door’s security had not been significantly affected by the damage sustained.
Principally, this was due to the plug design of the door – which used the pressure
differential between the cabin and the ambient environment43 to hold the door in
place. In addition, the sacrificial nature of the door shaft and mechanism failure had
served to keep the door secure by limiting the disengagement of the locking
systems, despite the handle rotation.

2.2.3 Cabin door area

Appreciable damage had been sustained by the cabin area in the vicinity of the R2
door. Green paint witness marks, embedded brass valve fragments and
characteristically-shaped cut-outs and crush damage attested to the trajectory of the
cylinder (or part thereof) as it entered the cabin area.
From the collection of physical evidence, a picture of the likely trajectory followed
by the cylinder was developed, and is illustrated in Figure 74 through to Figure 80
following.

Figure 74: Cross-sectional representation of the aircraft at the R2 door

Normal arrangement
(oxygen cylinder
and valve arrowed)

43
The FDR data showed that despite the void opened in the aircraft’s pressure hull, the aircraft’s
systems and/or a ram-air effect maintained a pressure differential of approximately + 0.86 psi
relative to the outside ambient air pressure.

- 90 -
Figure 75: Trajectory sequence 2

Cylinder failure produces

fuselage rupture, with the
bulk of the cylinder length
propelled upward through the
cabin floor - see Figure 19

Figure 76: Trajectory sequence 3

Cylinder impacts R2 door

frame and internal door
handle - see Figure 20

Figure 77: Trajectory sequence 4

Door frame impact breaks off

cylinder valve and causes
cylinder to invert while
continuing to travel upward

- 91 -
Figure 78: Trajectory sequence 5

Cylinder impacts overhead

panelling end-on, producing
circular cut-out type damage
– see Figure 23 to Figure 25

Figure 79: Trajectory sequence 6

Still rotating cylinder impacts

overhead storage bin,
producing semi-circular
crushing damage – see
Figure 26

Figure 80: Trajectory sequence 7

Cylinder falls to cabin floor

and exits the aircraft through
the ruptured fuselage

- 92 -
2.3 Oxygen cylinder failure

2.3.1 Effect on the oxygen system

As a result of the destructive nature of the cylinder failure, considerable localised
damage was sustained by the oxygen delivery, charging and overpressure discharge
lines, and the associated electrical wiring. Given that the cylinder failure also
produced the depressurisation of the aircraft, and thus brought into operation the
passenger emergency oxygen system (of which it was a part), it was relevant to
conduct an assessment of the effects of that damage, on the overall capacity of the
system to function adequately. Table 22 presents the basic data used for this
assessment.

Table 22: Oxygen system performance data

Parameter Value Notes

Volume of gas in cylinder @ 1,850 psi 25.58 L Physical volume of the cylinder
44
Volume of gas in cylinder @ 14.696 psi 3,220 L
Total gas volume at depressurisation 38,640 L44 12 cylinders left in the system
Total masks deployed and activated 447
Flow rate per mask @ 5.25 psi 2.122 L / min Min. pressure recorded in the cabin
Leakage rate from fractured line 120 L / min From design performance data
Total demand on system @ 5.25 psi 1,069 L / min

On the basis of the data presented, it was seen that the system could be expected to
deliver oxygen to all activated masks for a period in excess of 36 minutes.
Practically, as the flow control system functions to reduce the oxygen flow rate in
response to a reducing cabin altitude (as the aircraft descends), it is likely that
oxygen would have remained available for considerably longer than this
conservative value.
The damage to the oxygen system electrical monitoring and control wiring,
although significant, did not affect the functionality of the system. All key
operations such as cabin altitude sensing, automatic activation and barometric flow-
rate control were mechanical in nature and not reliant on the supply of electrical
power or signals.

2.3.2 Loss of the cylinder

With the exception of the damaged valve components, the failed oxygen cylinder
body, or any part thereof, was not located within the aircraft after a thorough
examination of the cabin, forward cargo hold and associated overhead and
underfloor void spaces. Table 23 presents an evaluation of the possible scenarios
that may explain the absence of the cylinder.

44
At standard sea-level atmospheric pressure (14.696 psi / 101.325 kPa).

- 93 -
 Table 23: Missing cylinder – scenario evidence
Possibility Evidence supporting Evidence against

Cylinder ejected from Thorough search during Small opening in cabin floor –
aircraft during investigation - cylinder not cylinder would not easily slip
depressurisation event found on board. through.
Rapid airflow could evacuate
cylinder from cabin and/or
hold.
Cylinder removed from Thorough search during Aircraft secured and access
aircraft after landing investigation - cylinder not restricted after disembarking
found on board. passengers.
Cylinder large and visible to
others if a passenger
attempted to remove it.
Cylinder remains on board Small opening in cabin floor Thorough search during
aircraft – cylinder would not easily investigation – cylinder not
slip through. found on board.

On the balance of the available evidence, it was considered most likely that the
oxygen cylinder had been lost from the aircraft during the initial depressurisation
event, and as such, was not available for an engineering and metallurgical
examination to determine the nature and reasons behind its failure.

2.3.3 Manner of cylinder failure

While the failed oxygen cylinder itself was not available for examination, the
damage produced by its failure provided a strong insight into the manner in which
the cylinder failed.
Being a source of considerable stored energy, the forces on, and subsequent motion
of a pressure vessel as it fails, is a product of where that failure originates and how
the fracture propagates through the vessel walls. In its most basic sense, it is a
manifestation of Newton’s Third Law of motion – being that for every action (i.e.
the escape of pressurised gas), there is an equal and opposite reaction (i.e. the
motion of the cylinder).
In the present case, it was evident that the cylinder failure had resulted in its
projection vertically upward with sufficient force to puncture the main cabin floor
and subsequently cause serious impact-related damage. That motion directly
implies that the cylinder must have failed either by bursting downward through the
lower hemispherical dome, or by fracturing circumferentially around the body
section – allowing the lower section to separate and the bulk of the pressurised gas
contents to escape downward.
Given that the ‘typical’ manner of failure of a cylindrical pressure vessel in
response to an over-pressure condition (and in the absence of any injurious flaws) is
by longitudinal rupture (refer to section 1.14.8) in response to the dominant hoop45
stress in the vessel walls, any reaction forces from such a rupture would tend to
force the vessel sideways, and in a direction opposite to the direction of the
escaping gas.

45
Hoop stress is the tensile stress acting circumferentially around the cylinder.

- 94 -
 As such, it was evident that the oxygen cylinder on board VH-OJK had failed in an
anomalous manner, and in a manner that was consistent with the effects of a pre­
existing defect, flaw or condition that had affected the physical integrity of the
cylinder shell in a way that promoted rupture around the lower circumference or
through the lower dome.

2.3.4 Potential factors contributing to cylinder failure

To explore the potential factors that may have contributed to the cylinder failure, a
form of Failure Modes and Effects Analysis46 (FMEA) process was undertaken,
utilising the information known about the cylinder design and service history. As a
result, five possible eventualities were identified (Table 24) – each with the
potential to have affected the cylinder integrity in a way that could have produce the
failure as it occurred.

Table 24: Potential factors contributing to cylinder failure

Possible factor Explanation

Cylinder manufacturing flaw During manufacture, the cylinder sustained

critical damage or developed an injurious
flaw or damage that was not detected by
quality control processes
Cylinder damaged before the last overhaul During service, handling or maintenance
before the last overhaul, the cylinder
sustained critical damage that was not
detected during the last overhaul
Cylinder damaged during the last overhaul During the last overhaul process, an event
occurred that critically damaged the cylinder,
with the damage not detected during the
inspections associated with the overhaul
Cylinder damaged after the last overhaul During service or handling after the last
overhaul, the cylinder sustained critical
damage that was not detected during
subsequent operation
Cylinder damaged during the accident flight During the course of the accident flight, the
cylinder sustained critical damage that
triggered or led directly to the rupture event

Each of the factors was explored in depth, with all available evidence used to assess
the likelihood or otherwise, of that factor having contributed either directly or
indirectly, to the cylinder failure.

Cylinder manufacturing flaw

Three categories of potential manufacturing flaw were identified:
• strength deficiency – heat treatment anomaly
• strength deficiency – incorrect cylinder material
• propagating crack / lap / intrusion / localised defect.

46
A Failure Modes and Effects Analysis explores the potential modes of failure that could be
exhibited by a component or system, and the specific characteristics (and likely interactions) of
each of those failure modes.

- 95 -
Given that the subject cylinder had been through five hydrostatic pressure tests
during its lifetime, it is highly likely that any gross strength deficiency (whether
from material or heat-treatment issues) would have been identified at some time
earlier in the cylinder life. The elastic expansion limitation assessed during
hydrostatic testing was intended to highlight any deficiency in the physical strength
of the cylinder shell.
Regarding the potential for a localised manufacturing flaw; for such a feature to
have led to cylinder failure after 12 years of normal cylinder service, it is incumbent
that the feature must have been subject to some form of growth or propagation
mechanism that increased its size and influence to a point where it became critical
during the occurrence flight. It is also incumbent that such a flaw must have been of
a form that allowed it to escape detection during manufacture, and during all
subsequent maintenance and recertification operations (overhauls). This aspect is
difficult to reconcile, in view of the comparatively short time period between the
last overhaul and successful hydrostatic pressure test on 26 May 2008, and the
failure of the cylinder while in service on 25 July 2008.

Cylinder damaged before the last overhaul

Speculatively, many events and mechanisms can be envisaged that had the potential
to compromise the cylinder integrity. These have been grouped into External
damage and Internal damage factors.
External damage:
• electrical arcing to the cylinder shell from defective adjacent wiring
• general surface corrosion
• malicious damage – saw cut or the like
• heating / fire
• clamping damage – fretting / wear / localised corrosion
• mechanical impact.
Internal damage:
• corrosion – incompatible gas fill
• corrosion – contaminated / moist oxygen
• corrosion – contents left standing during previous hydro-test
• yielding / cracking from previous over-filling.
Many of these mechanisms were assessed as highly improbable, in that they would
have resulted in visible damage and/or effects that would have been observed or
detected during the next inspection and overhaul process. In the case of the over­
filling possibility, it was noted that the valves of all cylinders contain fixed burst-
disks that limit the internal pressures to values well below the threshold for physical
cylinder damage.

- 96 -
Cylinder damaged during the last overhaul
The process of cylinder overhaul and re-certification was examined in some detail,
with a view to identifying all potential mechanisms for cylinder damage. Those fell
into two main groups.
Mechanical damage factors
• physical damage from an object left inside the cylinder
• handling – impact, abrasion, gouging
• yielding / cracking from excessive test pressure
• yielding / cracking from excessive refilling pressure.
Internal corrosion factors
• left standing (water/chemical inside) before drying
• chemical left inside the cylinder
• water left inside the cylinder
• filled with incorrect and incompatible gas
• filled with contaminated / moist oxygen.
It was possible to effectively discount all of the mechanical damage factors on the
basis that they would have been evident to maintenance staff either during
inspection or handling (object left inside or physical damage), or would have
resulted in test failure and rejection of the cylinder (in the case of over­
pressurisation).
Many of the corrosion-related factors were discountable, as they would not have
allowed sufficient time for corrosion to develop to the extent where it could present
a threat to the cylinder integrity. In the case however, of chemical or water
remaining within the cylinder (residual or otherwise) after the overhaul process, a
period of approximately 8 weeks existed between the completion of the overhaul
and the cylinder failure event. In an oxygenated and high-pressure environment, as
would exist within the refilled cylinder, corrosion rates would be high, and the
potential would certainly have existed for critical damage to have developed within
the 8-week interval between overhaul and cylinder rupture. Table 25 presents an
assessment of the available evidence against this scenario.

Table 25: Cylinder failure – residual chemical scenario evidence

Hypothesis: Cylinder failure resulted from an advanced corrosion or stress-corrosion cracking
mechanism related to the presence of residual or remnant chemicals and/or water left in the
cylinder following the last overhaul process
Evidence supporting Evidence against
Water and chemicals are introduced into Procedures exist for the effective flushing and
the cylinder during the testing and drying of the cylinder internals.
overhaul process. Procedures require the internal inspection of the
cylinder after rinsing and drying.

- 97 -
Corrosion rates would be expected to be There was no evidence of ‘sprayed’ ferrous
high, in the presence of 100% oxygen at corrosion products over the surfaces
high pressure. surrounding cylinder location.
ATSB research and tests of the cylinder material
showed no susceptibility to generalised
corrosion or stress-corrosion cracking.
The cylinder burst at or near the base, The cylinder lower dome and transition are also
where any residual chemical or water the areas most susceptible to manufacturing
would be expected to sit, given its vertical defects and flaws.
installation along the cargo bay wall.

Moist oxygen
Sampling and analysis of the oxygen contained by cylinders filled at the same time
as the failed item (section 1.14.3) showed that the moisture content was around 30
parts-per-million higher than the allowable limits. While elevated moisture is
undesirable, in that it can lead to internal condensation and subsequent corrosion,
the satisfactory and relatively corrosion-free internal condition of all other cylinders
on board the aircraft (including S/N. ST30395, fitted to the aircraft on the same day
as the failed cylinder) suggested the extent of such an effect was negligible, in the
context of the failure in question.
Laboratory quality assurance
The operator’s cylinder inspection and testing facilities were part of the larger
engineering services group, which conducted its general operations in accordance
with ISO 9001 ‘Quality Management Systems – Requirements’, and had received
independent third-party accreditation of its systems to this standard. While ISO
9001 accreditation is recognised as best-practice in terms of engineering operations
management, such assessments do not generally extend to the formal recognition of
competence and technical validity of testing and inspection procedures and
personnel. In many Australian industries and organisations, this role is carried out
by the National Association of Testing Authorities (NATA). Specific laboratory
accreditation by NATA includes the detailed examination of test procedure validity,
equipment calibration and personnel qualifications and practical competency. The
importance of this level of oversight is recognised in the cylinder maintenance
manual, which requires that facilities conducting hydrostatic tests must hold up-to­
date United States Department of Transportation approval.
Inspections of the operator’s cylinder maintenance facilities were carried out on two
separate occasions after the accident - initially by the Civil Aviation Safety
Authority (CASA) and subsequently by the Australian Transport Safety Bureau
(ATSB)/National Transportation Safety Board (NTSB)/Federal Aviation
Administration (FAA) investigation team. Those inspections found no evidence of
inadequacies with the procedures, personnel qualifications or materials used by the
operator in the cylinder inspection and recertification process.

- 98 -
Cylinder damaged after the last overhaul
When grouped in terms of internal and external damage, the following factors were
considered:
External damage
• electrical arcing from adjacent wiring
• corrosion – under cylinder clamp surfaces
• corrosion – general surfaces
• mechanical – from handling during removal and replacement
• mechanical – from malicious action
• mechanical – wear between clamp and/or base surfaces
• adjacent damaging event – explosion / fire
• adjacent damaging event – cargo movement and contact
• adjacent damaging event – aircraft mishap.
Internal damage
• corrosion – topped-up with incompatible / contaminated / moist gas
• yielding / cracking from overfilling.
In general, most of these contingencies would require specific circumstances or
conditions to exist for the factor/s to become manifest. Most would require gross
(and therefore evident) levels of damage to be inflicted, or periods of time well in
excess of that available, for the development of mechanisms such as corrosion or
wear to levels that could prove critical.

Cylinder damaged during the accident flight

The last group of potential factors that may have contributed to the cylinder failure
relates to those events that could have occurred at any stage during the occurrence
flight. These factors were grouped into four key areas:
• electrical arcing to the cylinder shell (from defective adjacent wiring)
• cylinder mounting wear and movement
• oxygen system fire and resultant over-pressurisation
• adjacent damaging event (explosion / fire / cargo impact).
As previously, each factor was considered in some depth, so as to develop a
perspective on the likelihood, consequence and the nature of any supporting
evidence that could reasonably be expected to be present, should the particular
factor have existed. Table 26 to Table 29 outline the analysis considerations for
each scenario.

- 99 -
 Table 26: Cylinder damaged during the accident flight - electrical
Hypothesis: Cylinder failure resulted from the effects of electrical arcing between the cylinder
body and the adjacent wiring.
Evidence supporting Evidence against
Electrical arcing produces very high For arcing to occur, it would be necessary for the
localised temperatures – capable of wiring insulation and the cylinder paint to have
weakening the cylinder material in the been disrupted in the area of physical contact
heat-affected zone. between the two.
The number-4 cylinder is located adjacent The adjacent aircraft wiring is securely routed
to several clusters of electrical wiring and tied in clusters against the fuselage
servicing the oxygen and other aircraft framework. Substantial damage to the wiring
systems. clusters would be necessary to bring one or
more wires into contact with the cylinder.
Electrical arcing damage (to a level The aircraft electrical systems are designed to
sufficient to cause cylinder rupture) could protect against damage associated with
occur quickly. electrical faults (e.g. circuit breakers).
There was no recorded or other evidence of an
electrical fault developing before the
depressurisation.
Comment: While there was substantial damage to the electrical wiring adjacent to the cylinder location,
there was no evidence of any significant arcing, heating or other electrically-related damage – either on
the wiring itself, or on any surrounding structure.

Table 27: Cylinder damaged during the accident flight – mounting wear
Hypothesis: Cylinder failure resulted from the effects of physical wear at the mounting /
contact points.
Evidence supporting Evidence against
The cylinders are in contact with the The cylinder is protected from abrasion by pads
mounts around the base of the lower around the inside of the upper strap and
dome, and around the circumference of between the lower dome and the support frame.
the cylindrical section.
The trajectory of the cylinder after rupture Wear rates between the contact surfaces would
suggests failure at one of those general likely be very low – requiring a timeframe well in
locations. excess of the duration of the occurrence flight for
critical levels of damage to be sustained.
Comment: None of the other aircraft cylinders, or any of the others examined showed any evidence of
wear or damage associated with its mounting arrangements.

Table 28: Cylinder damaged during the accident flight – oxygen fire
Hypothesis: Cylinder failure resulted from an oxygen-assisted fire internally within the
cylinder, valve or associated systems.
Evidence supporting Evidence against
Combustion events in high oxygen No evidence of combustion products or thermal
concentration / high-pressure effects found within the remnants of the cylinder
environments can be extremely energetic valve and hardware.
and violent.
The rapid nature of over-pressurisation Any over-pressurisation event would be
associated with an oxygen-assisted fire expected to burst the cylinder along the
within the cylinder could overcome the longitudinal axis in response to the dominant
protection provided by the valve burst-disk. hoop stresses.
Comment: The design and materials used in the cylinder construction were chosen to minimise the risk of
any known oxygen-assisted fire ignition mechanism. There was no identified precursor (such as the
activation of the oxygen system) that might have provided the potential for an ignition event.

- 100 -
 Table 29: Cylinder damaged during the accident flight – adjacent event
Hypothesis: Cylinder failure resulted from an adjacent (external) damaging event (explosion,
fire, cargo impact).
Evidence supporting Evidence against
The cylinder was located in the forward The cargo adjacent to the failed cylinder
cargo hold and immediately adjacent to a contained no items classified as Dangerous
wrapped (uncontainerised) cargo pack. Goods, nor did it contain any objects with the
potential to inflict critical cylinder damage in the
event of a forceful impact.
The cargo pack adjacent to the burst There was no physical or chemical evidence of
cylinder contained many discrete boxes the detonation or action of an explosive or other
and items of individually-consigned freight. malicious device. There was no evidence of the
development of a fire or thermal event within the
cargo adjacent to the burst cylinder, or on the
aircraft materials around the cylinder location.
Comment: The cylinder design has been shown to be robust and damage-tolerant.
It can be seen that there was no substantial, evidence-based argument to be made
for the cylinder having sustained critical damage during the flight on 25 July 2008.
As was the case for the previous considerations however, the inability to directly
examine the failed cylinder had prevented any definitive conclusions from being
drawn.

2.3.5 Cylinder type evaluation

As part of the investigative process, a number of cylinders of an identical design to
the failed item were studied in a detailed and critical assessment of the type. That
work had two principal aims:
• to assess whether any aspect of the cylinder design had predisposed the cylinder
to premature failure
• to assess whether any aspect of the production of the batch of cylinders (from
which the failed cylinder originated) had predisposed those items to premature
failure.

Compliance with specifications

The failed passenger oxygen cylinder (and its counterparts) had been manufactured
to comply with the requirements of US Code of Federal Regulations, Title 49, part
178.44, Specification 3HT seamless steel cylinders for aircraft use. Section 1.14.7
of this report details the series of evaluations conducted on cylinders from the same
production batch as the failed item, and on selected cylinders of the same type. The
examination was based on the specification test requirements, and was
supplemented by other tests that were selected to further explore the condition and
properties of the cylinders.
While the outcome of that work confirmed and demonstrated that the cylinder type
design was sound, several tests returned anomalous results that did not directly
comply with the specific requirements of the 178.44 production specification.

- 101 -
Wall thickness
When examined using ultrasonic thickness measurement techniques, a single
oxygen cylinder (S/N 686764) showed an isolated area of thinning within the lower
hemispherical dome. The minimum wall thickness measured in that area was
2.14 mm (0.084 in); representing approximately 83% of the minimum wall
thickness allowable by the specification (2.58 mm / 0.102 in). To assess the
significance of this finding, calculations were made to determine the nominal stress
levels across the thinned area of the dome (Table 30).

Table 30: Cylinder lower dome stress – thinned area comparison

Location Pressure Stress47

Lower dome (t = 2.58 mm) Service (1,850 psi) 276 MPa (39.9 ksi)
Test (3,083 psi) 459 MPa (66.6 ksi)
Lower dome – thin area (t = 2.14 mm) Service (1,850 psi) 333 MPa (48.3 ksi)
Test (3,083 psi) 555 MPa (80.5 ksi)

When compared against the measured strength properties of the cylinder material
(Table 13), it can be seen that the peak stress in the thinned area of the lower dome
was still considerably below the minimum material yield (proof) stress of 806 MPa
(116.9 ksi). As such, the thinned area was considered as a benign flaw, with little or
no potential effect on the integrity of the cylinder during service or periodic
recertification testing. The fact that the affected cylinder (manufactured in 1999)
had itself passed through initial certification and two subsequent re-certification
hydrostatic tests further supports this conclusion.

Flattening test
Section I of the 49CFR178.44 specification requires that the cylinder type must be
able to withstand flattening (without cracking) to a thickness equal to ten times the
original wall thickness. Practically, this required the 220 mm (8.75 in) diameter
cylinder to be able to be crushed to a thickness no greater than 28 mm (1.13 in)
without cracking or splitting around the minimum radius of curvature. Under
evaluation, it was found that meeting this requirement (using a ring-type specimen,
not a full cylinder) was not achievable, due to the tendency of the specimen to
unevenly deform – creating a very tight radius of curvature and very high localised
material strain. When evaluated using a guided bend test method48, the cylinder
material withstood bending around an 11 mm (0.43 in) radius former without
cracking or tearing.
In view of the aggressive nature of the flattening test and the adequate ductility of
the cylinder material demonstrated during the tensile and guided bend tests, the
failure of the cylinder to comply with the 49CFR178.44 flattening test requirements
was considered insignificant and potentially irrelevant in terms of assessing the
overall integrity of the cylinder type.

47
Dome stress = P x r / 2 x t, where P = pressure, r = dome radius, t = dome thickness, as per Roarks
Formulas for Stress and Strain, 6th Edition, pp.523
48
A guided bend test utilises 3-point bending around a uniform former with a defined radius – as
defined by ATSM E290-09 and other related standards.

- 102 -
2.4 Cabin safety
On the whole, the cabin crew prepared the passengers and cabin for an emergency
landing in a timely way. A small number of less-than-optimal events did occur
however, and are detailed in the sections following.

2.4.1 Cabin crew actions immediately after depressurisation

While the majority of the cabin crew remained seated during the event (either at
their stations or in spare passenger seats or foot wells), two cabin crew did move
from their positions to assist passengers before the flight crew had given the cabin
crew the all clear to resume duties and move about the cabin.
While both the crew-members cited urgent reasons for doing this (passengers were
either not accessing or not receiving oxygen), the individuals did place themselves
in a situation that had the potential to result in their injury or incapacitation. Had
incapacitation occurred, the flight would have continued with a reduced capacity to
perform cabin safety duties.
The crew-members involved recognised this; however, they believed that the
situation was not as serious as it could have been and they both felt comfortable
moving around the cabin during this time. This perception was reinforced by the
fact that they felt the aircraft was in a shallow descent, not a steep dive like they had
been led to believe would happen in a serious depressurisation event.
Considering that both crew-members continued to access oxygen during their
actions (one was on portable oxygen the whole time, the other intermittently used
cabin oxygen), this may have been an accurate judgement. However, given that the
crew had no way of knowing the full extent and nature of the situation, it would
have been safer for them to comply with emergency procedures and remain seated
with their seatbelt fastened and on oxygen until given the all clear to move about
the cabin.
The two depressurisation events detailed in section 1.13.4 outlined the dangers of
moving about the cabin without supplementary oxygen and highlight the necessity
of going onto oxygen as soon as possible.
Some cabin crew reported running to crew seats instead of using the closest spare
mask. Given that these cabin crew members reported feeling lightheaded and dizzy,
it is likely they were starting to experience symptoms consistent with the onset of
hypoxia. Those actions could have resulted in the crew becoming unconscious or
incapacitated had they not made it back to their crew seats or not been able to
access oxygen once seated. The previous depressurisation events also highlight the
importance of understanding, and being familiar with, the use of the oxygen masks
themselves. The experiences of the cabin crew in this incident bore some
resemblance to those of the crew of the 2005 Sydney to Melbourne depressurisation
event, who reported some difficulty in using their masks appropriately. This,
coupled with the lack of consistency in crew knowledge of the use of masks and
indications of oxygen flow, suggested a potential training issue for cabin crew
regarding oxygen use.

- 103 -
2.4.2 Follow-up cabin crew actions
The majority of the cabin crew conducted their subsequent duties without incident;
however two crew-members became incapacitated during this time. One crew-
member felt unwell and went back onto oxygen. After a short time on oxygen, they
reported feeling sufficiently recovered to resume duties.
Another crew-member experienced significant psychological distress from the
event and was visibly shaken. This crew-member was removed from duties until
they felt they had recovered enough to continue.
There was sufficient cabin crew to ensure that all doors were manned and important
duties were able to be carried out, even if some primary crew had been
incapacitated, as it was a function of assisting cabin crew to take over primary
duties if required. As such, while some crew were temporarily incapacitated during
follow-up actions, overall cabin safety was not compromised at any time. All cabin
crew were sufficiently recovered by the time the aircraft was approaching Manila,
and all stations were manned for the landing (except for R2, the damaged door).
Cabin safety procedures called for all cabin crew to use portable oxygen while
carrying out follow-up actions, until being notified that oxygen was no longer
needed. The use of portable oxygen systems at an altitude of 10,000 ft was required
to ensure that cabin crew did not develop hypoxia from the exertion of actively
moving about the cabin conducting follow-up duties. Moving about the cabin
carrying a portable oxygen bottle presents its own hazards however; the portable
oxygen systems are quite bulky and heavy and could present a danger to passengers
and crew if the aircraft encountered turbulence or became unstable.

2.4.3 Passenger address tape reproducer

Failure of the automatic passenger address system following the depressurisation
meant that the cabin crew had to individually shout instructions for passengers to
stay seated with their seatbelt fastened and to start using oxygen. Crew-members
also had to instruct some passengers to pull down on the mask to activate the flow
of oxygen. During this time, communication was difficult, as crew-members were
also required to use oxygen. To effectively instruct passengers on what to do, they
either had to remove their mask and shout commands, or hand-signal to passengers
to activate their mask and secure it over their mouth and nose. Signalling
passengers was not effective in the first and business class cabins as the passenger
seats were orientated away from the crew seats. Economy crew were more easily
able to signal passengers as the majority of crew seats faced backward (towards the
passengers) in that area.
The failure of the passenger address tape reproducer had implications for the
effective delivery of information to passengers and may have added to the early
uncertainty of passengers about the event. It also added to the cabin crew workload
– requiring them to repeatedly inform and reassure passengers about the use of the
oxygen masks.

2.4.4 Time of useful consciousness (TUC)

As the aircraft was cruising at 29,000 ft at the time of the depressurisation, the TUC
at that altitude would be expected to be approximately 2 minutes. However, after 2
minutes, the aircraft had descended to 23,000 ft, where the TUC would be expected

- 104 -
 to be 8 to 9 minutes. After another 4 minutes, the aircraft was at 10,000 ft; an
altitude at which supplemental oxygen was not needed. Based on these calculations,
the majority of passengers (having remained seated and inactive), would not have
lost consciousness as the aircraft descended ‒ even without the use of supplemental
oxygen.
The reported experiences of two elderly passengers whose masks had not deployed
were consistent with the symptoms of hypoxia. According to the cabin crew-
member who attended to them, they were short of breath, turning blue and slumping
in their seats. However, the majority of passengers accessed oxygen shortly after
the masks deployed and there were no reports of anyone losing consciousness.

2.4.5 Passenger announcements and communication

A few passengers indicated problems hearing or understanding passenger
announcements from both the flight deck and cabin crew. This may have been a
result of shock and/or hearing problems incurred during the depressurisation and
descent.
A number of passengers also commented on the lack of timely information passed
to them by the flight deck or cabin crew. While there was limited communication
from the flight deck during the early stages of the response to the event, this was not
unusual given the workload the flight crew were attending to. The failure of the
automatic passenger address system and the requirement for all cabin occupants to
use oxygen meant that cabin communication was necessarily limited at that time.

2.4.6 Oxygen flow

The survey responses received from passengers indicated that while the majority of
passengers felt they knew how to use the oxygen masks and felt confident in using
them, just over half could not tell if oxygen was flowing. The most common reason
for this was the expectation of passengers that the oxygen bag would visibly inflate
during use. As discussed in section 1.6.4, the oxygen mask bag is used as a
reservoir to store excess oxygen that is not directly inhaled. At low delivery rates or
rapid breathing rates, all oxygen is inhaled and hence the bag would not be expected
to visibly inflate. Cabin crew and some passengers who reported that their bags did
inflate also mentioned that they had ensured their breathing was slow and measured.
Rapid breathing or hyperventilation could account for why some passengers did not
see their bag inflate and therefore felt they were not getting any oxygen.
The investigation found that individual cabin crewmembers’ knowledge varied
regarding presence and functionality of the flow indication system inbuilt into each
oxygen mask assembly.

- 105 -
- 106 -
3 FINDINGS

3.1 Context
On 25 July 2008, approximately 55 minutes into a scheduled passenger flight
between Hong Kong, PRC, and Melbourne, Australia, a Boeing Co. 747-438
aircraft (registered VH-OJK) carrying 369 passengers and crew, sustained an
uncontrolled and rapid depressurisation while cruising at an altitude of 29,000 ft.
The flight crew subsequently made an emergency descent to 10,000 ft and diverted
to Ninoy Aquino International Airport, Manila, Philippines, where the aircraft
landed safely. There were no injuries.
Depressurisation of the aircraft had resulted from the sudden and forceful rupture of
one of the seven passenger emergency oxygen cylinders that were located along the
right side of the aircraft’s forward cargo hold. The cylinder rupture damaged the
fuselage immediately forward of the right wing root – opening a void
approximately 1.5 m x 2.0 m in size. It was presumed that the failed cylinder had
been lost from the aircraft during the depressurisation, as it was not found on board
following arrival in Manila.
From the evidence available, the following findings are made with respect to the
depressurisation of VH-OJK on 25 July 2008, and should not be read as
apportioning blame or liability to any particular organisation or individual.

3.2 Contributing safety factors

Contributing safety factors are defined as those safety factors that, had they not
occurred or existed at the time of an occurrence, then either:
• the occurrence would probably not have occurred; or
• the adverse consequences associated with the occurrence would probably not
have occurred or have been as serious; or
• another contributing safety factor would probably not have occurred or existed.
In the context of this event, the inability to physically examine the key item of
physical evidence (the failed oxygen cylinder), meant that the only verifiable
contributing safety factors were those associated with the occurrence event itself:
• During flight, a single pressurised oxygen cylinder failed by rupture; forcefully
releasing its contents.
• The force of the suddenly-released pressurised contents of the oxygen cylinder
locally ruptured the aircraft’s fuselage and allowed the aircraft to depressurise in
an uncontrolled manner.

- 107 -
3.3 Other safety factors
Other safety factors, in the context of an ATSB investigation, are those factors that
do not meet the criteria for being a contributing safety factor, yet were still
considered important to communicate in the interests of improved transport safety.
• Following the depressurisation, the aircraft’s left VHF omni-range (VOR)
navigational system and all three instrument landing systems (ILS) were
inoperative.
• Following the depressurisation, the aircraft’s left Flight Management Computer
(FMC) was inoperative.
• Following the depressurisation, the aircraft’s right body landing gear anti-skid
braking system was partially inoperative.
• Upon automatic activation of the cabin emergency oxygen system, several
passenger service units failed to deploy the contained oxygen masks.
• Cabin crew-members were required to shout or signal instructions to passengers
on the use of their oxygen masks following the failure of the automatic
passenger address tape reproducer (PATR) system.
• The operator’s cabin emergency procedures did not include specific crew
actions to be carried out in the event of a PATR failure. [Minor safety issue]
• The safety information provided to passengers did not adequately explain that
oxygen will flow to the mask without the reservoir bag inflating. [Minor safety
issue]
• Some passengers did not appropriately activate and/or secure their oxygen
masks, or did not ensure their dependants had done so.
• A loss of elasticity in the oxygen mask straps required many passengers to
manually hold their masks in place.
• Some cabin crew-members did not have an appropriate understanding of the
oxygen mask flow indication system. [Minor safety issue]
• Some cabin crew-members left their seats or positions to assist passengers
before clearance to resume duties had been given by the flight crew.
• Some cabin crew-members did not have an appropriate understanding of the
aircraft’s emergency descent profile, leading to misapprehensions regarding the
significance of the situation. [Minor safety issue]
• Several cabin crew-members became partially and temporarily incapacitated
during the emergency response.
• Cabin crew training facilities did not appropriately replicate the equipment
installed within the aircraft, including the drop-down oxygen mask assemblies.
[Minor safety issue]
• While maintaining the appropriate general quality accreditation (ISO 9001) of
its engineering facilities, the operator did not maintain independent accreditation
of the specific procedures and facilities used for the inspection, maintenance and
re-certification of oxygen cylinders. [Minor safety issue]

- 108 -
3.4 Other key findings
The following findings were not classified as safety factors (i.e. they did not
increase safety risk), however they were significant in the context of understanding
the occurrence and the continuing safety-of-flight of transport-category aircraft
fitted with supplemental breathing oxygen systems.
• The trajectory followed by the oxygen cylinder after it ruptured, and the damage
produced as it impacted items within the cabin, was consistent with the cylinder
having burst through the hemispherical dome at the base, or having fractured
circumferentially around the cylinder at, or towards, the lower dome transition.
• The manner of cylinder failure was atypical and suggested the presence of a
defect, or action of a mechanism, that weakened the cylinder and predisposed it
to failure in the manner sustained.
• The testing and research conducted as part of the investigation demonstrated the
DOT3HT-1850 cylinder type to be an inherently robust and damage-tolerant
design.
• The investigation was unable to identify any other historical instance of a
DOT3HT-1850 (or similar) aviation oxygen cylinder having ruptured or
forcefully failed while in normal operating service.
• There was no evidence that any aspect of the design and construction of the
DOT3HT-1850 specification aviators’ breathing oxygen cylinder could
predispose the type to premature and destructive failure while in service.
• There was no evidence that any other cylinders from the same production batch
as the failed item were at any increased risk of the same premature and
destructive failure as sustained by cylinder S/N 535657.
• There was no evidence to suggest that the processes and procedures used to
handle, maintain and operate the cylinder across its life had in any way
contributed to the failure event, or had the potential to contribute to the failure in
the manner sustained.
• There was no evidence that the cylinder or its related systems had sustained
damage that could have contributed to its premature failure, at any time during
or prior to the occurrence flight.
• There was no evidence that a malicious action had caused or contributed to the
cylinder failure.
• The flight crew provided a compliant, well-managed and appropriate emergency
response that minimised the risks associated with the depressurisation and the
ongoing flight.
• The cabin crew-members’ overall management of the depressurisation response
was effective and directly contributed to the ongoing safety of the passengers.

- 109 -
Intentionally Blank

- 110 -
4 SAFETY ACTION
The safety issues identified during this investigation are listed in the Findings and
Safety Actions sections of this report. The Australian Transport Safety Bureau
(ATSB) expects that all safety issues identified by the investigation should be
addressed by the relevant organisation(s). In addressing those issues, the ATSB
prefers to encourage relevant organisation(s) to proactively initiate safety action,
rather than to issue formal safety recommendations or safety advisory notices.
All of the responsible organisations for the safety issues identified during this
investigation were given a draft report and invited to provide submissions. As part
of that process, each organisation was asked to communicate what safety actions, if
any, they had carried out or were planning to carry out in relation to each safety
issue relevant to their organisation.

4.1 Aircraft operator

4.1.1 Procedures In the event of a depressurisation and failure of the

automatic passenger address system

Minor safety issue

The operator’s cabin emergency procedures did not include specific crew actions to
be carried out in the event of a Passenger Address Tape Reproducer (PATR) failure.

Action taken
The operator advised the ATSB that emergency procedures have been changed to
require the flight crew to make a direct passenger address in the event of a cabin
depressurisation and failure of the PATR system (NSA-092).

ATSB assessment of action

The ATSB is satisfied that the action taken satisfactorily addresses the safety issue.

4.1.2 Passenger briefing information on oxygen masks inadequate

Minor safety issue

The safety information provided to passengers did not adequately explain that
oxygen will flow to the mask without the reservoir bag inflating.

Action taken
The operator indicated that the standard pre-flight safety video / briefings provided
to passengers have been modified to reinforce the message that users must pull
down on the mask firmly to activate oxygen flow, and to include the comment
‘Oxygen will flow without the bag inflating’ (NSA-056).

- 111 -
 ATSB assessment of action
The ATSB is satisfied that the action taken satisfactorily addresses the safety issue.

4.1.3 Cabin crew knowledge of oxygen system

Minor safety issues

• Some cabin crew-members did not have an appropriate understanding of the
oxygen mask flow indication system.
• Cabin crew training facilities did not appropriately replicate the equipment
installed within the aircraft, including the drop-down oxygen mask assemblies.

Action taken
The operator has advised the ATSB that all facilities used to train cabin and flight
crew-members now have appropriate drop-down oxygen mask assemblies, so as to
accurately simulate the aircraft cabin during a depressurisation. All training
modules relating to depressurisation have been revised and upgraded, and have
been implemented into all training programs undertaken by staff. (NSA-057)

ATSB assessment of action

The ATSB is satisfied that the action taken satisfactorily addresses these safety
issues.

4.1.4 Cabin crew uncertainty regarding the emergency descent profile

Minor safety issue

Some cabin crew-members did not have an appropriate understanding of the
aircraft’s emergency descent profile, leading to misapprehensions regarding the
significance of the situation.

Action taken
The operator advised the ATSB that material used during emergency procedures
training has been enhanced to improve awareness of likely emergency descent
profiles (NSA-093).

ATSB assessment of action

The ATSB is satisfied that the action taken satisfactorily addresses the safety issue.

- 112 -
4.1.5 Laboratory accreditation

Minor safety issue

While maintaining the appropriate general quality accreditation (ISO 9001) of its
engineering facilities, the operator did not maintain independent accreditation of the
specific procedures and facilities used for the inspection, maintenance and re­
certification of oxygen cylinders.

Action taken
The operator has advised the ATSB that their engineering component workshop has
embarked upon a program of equipment replacement and staff training revalidation,
with an estimated completion date of 15 November 2010 (NSA-104). The program
includes:
• inspection and certification of new hydrostatic test equipment by a US DOT-
certified inspector
• revalidation of the training of seven existing cylinder test workshop staff by a
DOT-certified authority
• training of three new cylinder test workshop staff by a DOT-certified authority.

ATSB assessment of action

The ATSB is satisfied that the action taken satisfactorily addresses the safety issue.

4.1.6 Other safety action

Fleet inspection
Two days after the accident the operator, in agreement with the Civil Aviation
Safety Authority (CASA), commenced a fleet-wide program of detailed safety
inspections of its Boeing 747 oxygen system installations. The ATSB was advised
that those inspections were complete by 1 August 2008.

Cabin procedures
Resulting from its internal investigations and review of occurrence events, the
operator found that the efficient participation of cabin crew during the emergency
response could be enhanced by revised procedures. As a result, changes to the cabin
crew emergency procedures have been implemented as follows:
On receipt of the ‘Cabin crew carry out follow-up duties’ PA from the flight crew:
• The CSM shall:
o return to / remain at the designated communication station
o be ready to communicate passenger injuries and aircraft damage to
the flight crew as soon as known

- 113 -
 • All remaining cabin crew shall:
o check for passenger injuries and aircraft damage – reporting such
to the CSM
o administer first-aid and supply oxygen to passengers if required
o close passenger service unit (PSU) outlet valves when passenger
oxygen is not required
o clear and secure loose objects in the cabin.

4.2 Civil Aviation Safety Authority (CASA)

On 29 July 2008, an airworthiness team from CASA’s Sydney air transport field
office visited the operator’s oxygen cylinder overhaul workshop and hydrostatic test
facility and inspected the process of how the cylinders were received, handled,
inspected, overhauled and tested hydrostatically. The visit included discussions with
maintenance and management staff about the processes and inspection procedures,
examination of task cards, computer systems, training records and witnessing the
test procedures.
From this visit, CASA representatives stated that they were satisfied that the
operator was acting in an appropriate manner in response to the occurrence.

4.3 Australian Transport Safety Bureau

4.3.1 Cabin safety

Minor safety issue

The safety information provided to passengers did not adequately explain that
oxygen will flow to the mask without the reservoir bag inflating.

ATSB safety advisory notice AO-2008-053-SAN-105

The Australian Transport Safety Bureau advises that operators of transport category
aircraft fitted with pressurised gaseous oxygen systems should consider the safety
implications of these safety issues, with a view to ensuring that passenger briefings
provide sufficient detail and instruction as to the functionality of the system and the
actions necessary to appropriately activate the flow of oxygen.

4.3.2 Oxygen systems

It is acknowledged that any corrective or precautionary action undertaken in
response to a safety occurrence should be justifiable in terms of established or
probable safety issues. However, in view of the nature of the depressurisation event
and the implication of a possible mechanism or condition that could affect the
integrity and safety of other oxygen cylinders used in the aviation environment, the
ATSB draws attention to the following advisory notices.

- 114 -
 ATSB safety advisory notice AO-2008-053-SAN-006
The Australian Transport Safety Bureau encourages all organisations performing
inspection, testing, maintenance and repair activities on aviation oxygen cylinders,
to note the circumstances detailed in this report, with a view to ensuring that all
relevant procedures, equipment, techniques and personnel qualifications satisfy the
applicable regulatory requirements and established engineering best-practices.

ATSB safety advisory notice AO-2008-053-SAN-106

The Australian Transport Safety Bureau encourages all organisations performing
inspection, testing, maintenance and repair activities on aviation oxygen cylinders,
to note the circumstances detailed in this report, with a view to ensuring that all
facilities establish and maintain independent external accreditation of their
procedures, processes and equipment.

ATSB safety advisory notice AO-2008-053-SAN-007

The Australian Transport Safety Bureau encourages other operators of transport
category aircraft fitted with pressurised gaseous oxygen systems, to note the
circumstances detailed in this report, with a view to ensuring that all oxygen
cylinders and cylinder installations are maintained in full accordance with the
relevant manufacturer’s requirements, statutory regulations and established
engineering best-practices.

4.3.3 Aviation research and analysis reports

The ATSB research and analysis section has published two reports intended as
information bulletins for passengers and cabin crew of pressurised aircraft.
• Staying Safe During an Aircraft Depressurisation - Passenger information
bulletin. Aviation research and analysis report AR-2008-075(1)
• Aircraft Depressurisation – Cabin crew information bulletin
Aviation research and analysis report AR-2008-075(2)
The bulletins have been written to provide passengers and cabin crew with an
improved understanding of the potential effects of a depressurisation event on the
individual, and to provide advice regarding actions that can minimise the risk of
injury.
The information bulletins are available for download from the ATSB website at the
following addresses:
Passenger bulletin: http://www.atsb.gov.au/publications/2008/AR2008075.aspx
Cabin crew bulletin: http://www.atsb.gov.au/publications/2009/AR2008075_2.aspx

- 115 -
- 116 -
APPENDIX A: Artificially-flawed cylinder tests

ATSB TECHNICAL ANALYSIS

Depressurisation – 475 km north-west of

Manila, Philippines – 25 July 2008
Boeing 747-478, VH-OJK

Artificially-flawed cylinder test program

- 117 -
1 FACTUAL INFORMATION

1.1 Introduction
On 25 July 2008, during a scheduled passenger flight from Hong-Kong to
Melbourne, a Boeing 747-438 aircraft with 369 persons on board, sustained the
rupture of a single high-pressure oxygen cylinder (one of an array of seven
cylinders in a fixed installation along the right side of the aircraft forward cargo
hold). The force of the cylinder rupture compromised the fuselage structure and
skin in the area of the failure, allowing the aircraft to rapidly depressurise. The
nature of the rupture also resulted in the cylinder (or upper part thereof) being
projected upward, through the cabin floor and into the main cabin area in the
vicinity of the R2 main deck door, where it impacted the door handle and frame, the
doorway overhead structure and the ceiling-mounted storage bins and panelling. It
was presumed that the cylinder or cylinder sections had subsequently been lost from
the aircraft during the depressurisation, as no physical remnants of the item were
recovered (other than valve fragments), despite a thorough search.
The investigation found no evidence that the cylinder failure was precipitated by an
oxygen-related combustion event, or by any external influence such as an explosion
or severe impact. There was no evidence to suggest the cylinder had been over-
pressurised during servicing and the internal over-pressure protection mechanism
(burst-disk), built into the service valve was intact when examined after the failure.

1.2 Cylinder fracture control

The design of cylinders for the safe storage of compressed gasses must incorporate
measures to mitigate the risk of unstable fracture and the consequential forceful and
destructive release of the contents. Fundamentally, the design must ensure that the
cylinder will not fail by unstable fracture when exposed to injurious conditions, or
in the presence of injurious flaws. Failure must demonstrably occur by stable
(arresting) fracture – the traditional leak before break scenario.
Predominantly, it is the fracture toughness of the material used to produce the
cylinder that defines whether that cylinder will fail by fracture or by leaking, at a
given stress level (internal pressure) and in the presence of a given physical flaw.
Modern technologies for the production of higher strength alloy steels with practical
fracture toughness levels have allowed an increase in the nominal wall stress levels;
thereby allowing the production of thinner wall (lighter) cylinder designs. The
DOT-3HT cylinder type in question is an example of these developments.

- 118 -
1.3 Damage tolerance
Considering the significant hazards associated with the storage of sometimes
flammable and/or toxic gasses at considerable elevated pressures, the avoidance of
in-service failure is of paramount importance. As discussed, the resistance to
fracture (and hence an explosive release of the cylinder contents) is governed by the
fracture toughness of (and nominal wall stresses within) the cylinder shell material.
As fracture toughness decreases with increasing material strength, designers are
faced with a compromise situation – the need to balance the advantages of a higher-
strength material against the risks associated with reduced fracture toughness (and
the associated lower tolerance to damage and defects). To practically address this
challenge, standards for cylinder design have been developed that mandate the
physical assessment of the total fracture resistance of the product. The Flawed-
cylinder Burst Test incorporated within ISO 9809-2 is an example of such an
assessment.

1.4 Fracture resistance

From the evidence available to the accident investigation, it was apparent that a
single DOT-3HT1850 oxygen cylinder had failed violently by rapid, unstable
fracture while the aircraft was in-flight. From the philosophy relating to cylinder
design, this event indicated a deviation from the intended (and expected) behaviour
of the cylinder type, in that the failure (if it was to occur) should have manifested as
a stable (arresting) fracture and subsequent safe leakage of the contents.
While the US DOT 49CFR178.44 specification for 3HT cylinders provides for the
application of a range of type design and production tests to ensure the quality of
the product, the specification does not require the performance of any test designed
to assess fracture resistance. This is in-line with international practice, where such
evaluation is only generally specified for cylinders produced from alloy steel
materials with an ultimate tensile strength above 1,100 MPa (159.5 ksi).
In view of the occurrence event therefore, it was desirable to obtain some level of
understanding of the fracture behaviour expected from the DOT3HT cylinder type.
A review of the literature by the ATSB did not identify any body of work where
this has been undertaken.
A finite element and linear-elastic fracture mechanics (LEFM) assessment was
undertaken to obtain some level of understanding of the likely critical flaw size
required to produce unstable fracture. That work predicted that a semi-elliptical,
longitudinal surface flaw of around 6.07 mm (0.239 in) length and 1.22 mm (0.048
in) depth (defect aspect ratio49 of 0.2) could produce unstable fracture at the
cylinder working pressure of 12.75 MPa (1,850 psi)50. Larger aspect ratio defects
(shorter and deeper) were predicted to produce stable fracture i.e. leak behaviour at
failure.
While the results were informative, in that they illustrated the significant effects of
smaller defect aspect ratios on the propensity for the initiation of unstable fracture,

49
Aspect ratio is the ratio of flaw length to depth, and for symmetrical flaws, can be represented as
flaw depth / 0.5 x flaw length.
50
Using a fracture toughness value (K1C) of 50 ksi√in.

- 119 -
 limitations associated with the LEFM methodology employed suggest that the
results of the theoretical assessment may be conservative and/or unreliable.

1.5 Flawed-cylinder burst testing - background

In light of the cylinder failure and the outcomes of the theoretical fracture
mechanics assessments undertaken, it was considered appropriate to conduct a
program of practical tests designed to establish the actual fracture behaviour of the
DOT-3HT1850 cylinder type. Preliminary testing to investigate the compliance of
the type with the DOT 49CFR178.44 specification requirements, involved the
performance of three full-scale cylinder burst tests taken from the same production
lot as the occurrence failure cylinder. Visual and non-destructive examination of
those cylinders before the destructive tests confirmed the absence of any flaws or
defects that could have been considered as potentially influential on the fracture
performance.

Table A1. Hydrostatic test results

Test type Reference Cyl S/N: Failure Pressure # Failure mode

Hydrostatic burst # 1 49CFR178.44 i) 535643 5,005 psi / 345.1 bar Rupture

Hydrostatic burst # 2 49CFR178.44 i) 535667 4,400 psi / 303.4 bar Rupture
Hydrostatic burst # 3, 49CFR178.44 j) 535598 4,200 psi / 289.6 bar Leak
after 10,000 cycles 0 –
1,850 psi

# - minimum acceptable failure pressure was 4,111 psi / 283.4 bar, per
49CFR178.44 p) 3).
Requirements for the practical establishment of fracture behaviour in the presence
of shell flaws are not a normative part of 49CFR178.44 for the DOT3HT cylinder
type, nor are they specified with comparable standards such as ISO 9809-1:1999.
For material strengths exceeding 1,100 MPa (159.5 ksi) however, standards such as
ISO 9809-2:2000 do incorporate requirements to demonstrate that the cylinder type
will fail by leaking in the presence of a given physical flaw. ISO9809-2 defines
compliance for this assessment, as the failure of a test cylinder by leaking at the site
of a pre-defined artificial flaw51, and at a pressure exceeding the designated service
pressure for the cylinder design. This provides some assurance that it would
require a cylinder to sustain a lengthy and deep flaw in service, in order to induce
failure by unstable fracture (rupture).
The requirements of ISO9809-2:2000 had their origins from an extensive program
of monotonic and cyclic flawed-cylinder tests conducted by a working group on
cylinder fracture (WG14), formed under ISO Technical Committee 58,
Subcommittee 3 (ISO/TC 58/SC 3). The philosophy, background, results and
conclusions of those tests are presented in ISO Technical Reports 12391-1 to 4
(ISO/TR 12391-1,2,3,4). Of note when reviewing this program, was that the US
DOT3HT cylinder specification was not included among the many US, French and
ISO specification cylinder types selected for evaluation.

51
ISO9809-2:200 prescribes a flaw length (lo) of 1.6 √ D a, where D is the nominal cylinder outside
diameter (mm) and a is the calculated minimum shell thickness (mm).

- 120 -
1.6 Flawed-cylinder burst testing undertaken
To facilitate direct comparison against the body of work published in ISO/TR
12391-2, a series of flawed-cylinder monotonic burst tests that were comparable to
the tests conducted by ISO WG14, were conducted on four DOT-3HT1850
cylinders selected from among those that were fitted to VH-OJK at the time of the
rupture and depressurisation.
It was intended that the program of flawed-cylinder tests would allow the empirical
establishment of the leak ‒ fracture boundary conditions for the DOT-3HT1850
cylinder type. Typically, these conditions are defined for a range of normalised
shell flaw lengths (original flaw length as a ratio of design wall thickness), and are
presented as a ratio of the cylinder failure pressure (Pf) against the cylinder service
pressure (PS) ‒ Figure A1. The leak ‒ fracture boundary (LFB) is defined as the
average of the highest pressure which failure by leakage occurs, and the lowest
pressure at which failure by fracture occurs, i.e.

LFB = (Pf / Ps) Leak + (Pf / Ps) Fract

2

Figure A1.Leak – Fracture boundary chart – example (ref. ISO/TR 12391-2 fig. 3)

- 121 -
Table A2: Cylinder technical information
Specification US Department of Transportation (DOT) type 3HT1850
Material AISI / SAE 4130 alloy steel
Construction Seamless single sheet deep drawn, spin-forged closure
Internal Diameter (DO) 8.75 in / 222.2 mm (nominal)
Wall thickness (design, td) 0.113 in / 2.87 mm (minimum)
External Diameter (D) 8.98 in / 228.0 mm (nominal)
Length 29.56 in / 750.82 mm (nominal)
Weight (tare) 34 lb 0 oz / 15.42 kg
Water capacity 54 pts 1 oz / 25.58 litres (minimum)
Service pressure (PS) 1,850 psi / 127.55 bar
Test pressure (PH) 3,085 psi / 212.70 bar
Rupture pressure (Pf) 4,113 psi / 283.58 bar (minimum)
Wall hoop stress at test pressure 104,241 psi / 718.7 MPa (max, per 49CFR178.44 f 2)
Wall hoop stress at service 62,538 psi / 431.2 MPa (per 49CFR178.44 f 2)
pressure
Material Tensile Strength (min) 138,988 psi / 958.3 MPa
Material Tensile Strength (max) 165,000 psi / 1,137.6 MPa

Table A3: Measured cylinder properties

Material Tensile Strength – longitudinal (RmL) 1,065 MPa / 154,465 psi (average of 2 tests)
Material Tensile Strength – circumferential 1,064 MPa / 154,320 psi (average of 3 tests)
(RmC)
Material Yield Strength – longitudinal (ReL) 999 MPa / 144,893 psi (average of 2 tests)
Material Yield Strength – circumferential (ReC) 808 MPa / 117,190 psi (average of 3 tests)
Material Elongation – longitudinal 9% over 85 mm / 12% over 2 in
Material Elongation – circumferential 7% over 85mm / 11% over 2 in
Material Hardness 359 HV10 across 10 readings (mid-thickness)
Material Tempering temperature (indicative) 475 – 500ºC
Wall thickness (ta) 3.07 mm / 0.121 in (minimum over 6 cylinders)

- 122 -
1.7 Test method

1.7.1 Basic approach

• Machine a standard exterior surface flaw within a subject cylinder, using a
defined and reproducible technique, and at a location of probable maximum
stress under service loading (gas pressure).
• Record the flaw length, depth and the actual cylinder thickness at the flaw
location.
• Pressurise the cylinder hydrostatically in a controlled manner, and increase the
pressure until cylinder failure occurs.
• Record the pressure at failure (Pf) and the mode of failure (leak or burst), where
bursting is defined as an extension of the flaw length of greater than 10% of the
original machined flaw length.
• If the mode of failure was bursting, iteratively repeat the test with a deeper flaw
(same length) until failure occurs by leaking.
• Conversely, if the mode of failure was leaking, iteratively repeat the test with a
shallower flaw (same length) until failure occurs by bursting.
• Repeat steps 1 to 6 for a range of flaw lengths.
• Plot the test results as failure pressure against flaw length (as per Figure A1).
For the specified flaw size (length and depth) and failure pressure (Pf), it is the
cylinder fracture resistance that governs whether the cylinder fails by leaking or
fracture (i.e. the leak ‒ fracture boundary, LFB). Establishment of the LFB for the
DOT-3HT1850 cylinder type was intended to provide the investigation with direct
evidence as to the possible magnitude of the defect/s within the cylinder that failed
aboard the aircraft. It was also intended to provide some level of knowledge as to
the severity (i.e. physical size) of cylinder damage that could be considered as
‘critical’ (i.e. from which potential rupture could occur at the cylinder working
pressure).

1.7.2 Flaw geometry and sizes

The geometry of the artificial flaws machined into the test cylinders was as-
developed by the ISO/TC 58/SC 3 subcommittee, and presented in ISO/TR 12391­
1:2001.
To encompass the widest practicable range of flaw lengths and depths, a
distribution of four nominal flaw lengths and depths were proposed. The values
were chosen on the basis of values used within the body of work conducted by
ISO/TC 58 SC/3 and presented in ISO/TR12391-2:2002
To minimise the number of cylinders required for the test-work, each cylinder had
four (4) flaws machined into each, spaced at 90º around the central circumference.
Each set of four flaws was machined at the same length, but at individual depths, as
identified in Table A4. Pressurisation to rupture would then proceed, with failure
expected at the deepest flaw (i.e. thinnest remaining ligament). In the event that
failure occurred by leaking, the flaw could then be sealed by over-welding, and
subsequently re-pressurised to failure at the second-deepest flaw. By repeating this

- 123 -
exercise, it was expected that a data set of failure pressures (Pf) and failure modes
(leak or fracture) would be obtained for each flaw length in consideration.

Figure A2: Representation of the standard flaw geometry employed for

the tests

t – measured cylinder wall thickness

r – transition radius – 40 mm
a – machined flaw depth – see table A4 below
lo – machined flaw length – see table A4 below

Table A4: Target dimensions of machined flaws

n = (Lo/td) 4 8 12 16
Length
Measured Lo (mm) 11.5 23.0 34.5 46.0
% of td 65 75 85 95
Depth
Measured (mm) 1.86 2.15 2.44 2.73

Dimensions as proposed would produce flaws with a typical remaining ligament

thickness of between 1.21 mm and 0.34 mm, based on a typical minimum wall
thickness (t) of 3.07 mm (as measured during previous work).

- 124 -
1.8 Test results

1.8.1 Flaw machining

As a result of the milling tool diameter, it was not possible to achieve an effective
flaw length of less than approximately 22 mm, at the intended range of flaw depths
(1.86 to 2.73 mm). As such, only three cylinders were initially machined (cylinders
A, C and D), with cylinder B kept as a reserve, for machining and testing once the
outcomes of the tests on the other cylinders were known and assessed. The flaw
machining was carried out using a vertical milling machine equipped with precision
control over the X, Y and Z axes. The cylinders were secured using a custom jig
and the cutting conducted in a single pass. Figure A3 illustrates the milling
arrangements. In each area where the milling was performed, the cylinder paint had
been chemically stripped and the location uniquely identified. Figure A4 presents a
typical defect after the machining process.

Figure A3: Artificial flaw milling arrangements

Table A5 presents the measured flaw dimensions and the corresponding cylinder
wall thicknesses at the flaw positions. Only a single flaw was machined into
cylinder B, and this was carried out after the tests had been completed on cylinders
A, C and D. The depth and length of that flaw was chosen in an attempt to produce
a failure by rupture (burst), so as to ensure a better distribution of test results across
leaking and bursting modes.

- 125 -
Table A5: Test cylinder and machined flaw measured dimensions
Cylinder Cylinder Flaw Thickness at Flaw Flaw
Serial No. Code Position Flaw (mm) Length (mm) Depth (mm)

071505 A 1 3.26 22.2 1.86

2 3.24 23.2 2.15
3 3.18 25.6 2.44
4 3.24 26.9 2.73
240293 C 1 3.20 34.7 1.86
2 3.14 34.5 2.15
3 3.26 34.2 2.44
4 3.24 34.0 2.73
240341 D 1 3.26 45.8 1.86
2 3.17 46.5 2.15
3 3.23 47.0 2.44
4 3.26 45.7 2.73
239949 B 4 3.11 34.5 1.50

Figure A4: Typical artificial flaw after machining

- 126 -
1.8.2 Testing
Each flawed cylinder was hydrostatically pressurised progressively until evidence
of failure was apparent – either by a drop in pressure (typical of leaking), or the
cylinder ruptured. The rate of pressurisation was manually controlled and set such
that the point of failure was reached after a number of minutes. Peak pressure was
recorded using a calibrated, peak-holding digital pressure indicator.
Once a cylinder had failed by leaking, the flaw at which the failure occurred was
identified (Figure A5) and subsequently over-welded using a gas-metal arc process
(GMAW / MIG, Figure A6).

Figure A5: Flaw A4, after testing – failure by leaking

Figure A6: Flaw D4, after failure by leaking and over-welding in

preparation for subsequent tests

- 127 -
Table A6: Raw test results
Test No. Cylinder Failure Failure Failure Comments
Code Location Mode Pressure (psi)

1 D 4 Leak 1,835
2 C 4 Leak 2,423
3 A 4 Leak 3,251
4 D 3 Leak 1,957
5 C 3 Leak 2,657
6 A 3 Leak 3,251
7 D 2 Burst 2,218 See Figure A7
8 C 2 Leak 2,697
9 A At weld 3 Burst 3,338 Invalid
10 C At weld 2 Leak 2,563 Invalid, weld repaired
11 C At weld 2 Leak 2,207 Invalid
12 B 4 Burst 3,346

Figure A7: Flaw D2, after testing – failure by bursting (rupture)

- 128 -
2 ANALYSIS

2.1.1 Leak – Fracture boundary

The results presented in Table A6 were plotted as failure pressure against defect
length, and illustrate the general behaviour of the cylinder type, when pressurised in
the presence of localised, axially-oriented physical defects (Figure A8).

Figure A8:Graphical representation of test results

- 129 -
From the graphical representation of the test results, it was possible to establish an
approximate Leak – Rupture boundary, and from that, a nominal estimation of the
defect length required to induce failure by rupture at the cylinder service pressure
(1,850 psi). From the graph, that length was around 49 mm (2 in).
Given that defects are two-dimensional (i.e. have length and depth), the test data
was examined to establish a relationship between failure pressure, failure mode and
defect aspect ratio. Figure A9 illustrates this relationship.

Figure A9:Graphical representation of flaw aspect ratio against failure

pressure and mode

- 130 -
While the number of data points available has limited the accuracy of the Leak-
Rupture boundary line fitted to the Flaw Length and Aspect Ratio graphs, the
estimates obtained for those parameters at the nominal service (operating) pressure
of the cylinder type (1,850 psi) were considered valid, and indicative of the
magnitude of a physical flaw that could produce failure by rupture at that pressure.
As such:
Critical defect length estimate = 49 mm (from Figure A8)
Critical defect aspect ratio estimate = 0.096 (from Figure A9)
On that basis, the critical defect depth (to cause failure by rupture at 1,850 psi), at a
nominal length of 49 mm, would be in the order of 2.3 mm.

- 131 -
- 132 -
3 SUMMARY

3.1 Cylinder failure behaviour

From the results of the documented cylinder test program, it was established that
the DOT-3HT1850 cylinder type will notionally behave in a manner consistent with
the fundamentals of sound pressure vessel design. It was demonstrated that in the
presence of increasingly deep physical flaws of a given length, the predominant
failure mode will be one of leaking (i.e. localised perforation from the flaw, without
subsequent propagation of the flaw by fracture).

3.2 Critical defect size estimates

From the test program, it was established that the DOT-3HT1850 cylinder type
could be induced to fail by rupture at its operating pressure, in the presence of an
axially-oriented and centrally-located physical flaw measuring approximately 49
mm (2 in) in length, and 2.3 mm (0.09 in) depth. Such a flaw could be considered a
worst-case scenario, in that defects with other possible orientations (i.e.
circumferential) or locations (i.e. hemispheres), would need to be somewhat larger
in size before rupture would be expected to occur.
In considering these findings, it must be noted that the data set from which they
were drawn, was very small. It would be necessary that further work be carried out
to properly validate and verify the conclusions drawn, should any external or other
use of the data be desired, however for the purposes of the subject investigation, the
findings were considered indicative and informative.

- 133 -
- 134 -
4 SUPPORT INFORMATION

4.1 Test certificates

- 135 -
- 136 -
- 137 -
- 138 -
APPENDIX B: Cylinder material corrosion tests

ATSB TECHNICAL ANALYSIS

Depressurisation – 475 km north-west of

Manila, Philippines – 25 July 2008
Boeing 747-478, VH-OJK

Cylinder material corrosion tests

- 139 -
1 FACTUAL INFORMATION

1.1 Introduction
On 25 July 2008, during a scheduled passenger flight from Hong-Kong to
Melbourne, a Boeing 747-438 aircraft, experienced rupture of a single high-
pressure oxygen cylinder (one of an array of seven cylinders in a fixed installation
along the right side of the aircraft forward cargo hold). The force of the cylinder
rupture compromised the fuselage structure and skin in the area of the failure,
allowing the aircraft to rapidly depressurise. It was presumed that the cylinder or
cylinder sections had subsequently been lost from the aircraft during the
depressurisation, as no physical remnants of the item were recovered (other than
valve fragments), despite a thorough search.
The investigation has found no evidence that the cylinder failure was precipitated
by an oxygen-related combustion event, or by any external influence such as an
explosion or severe impact. There was no evidence to suggest the cylinder had been
over-pressurised during servicing and the internal over-pressure protection
mechanism (burst-disk) built into the service valve was intact when examined after
the failure.
Following a literature review and ongoing discussions regarding the possible failure
mechanisms of the ruptured cylinder from VH-OJK, it was conceivable that an
environmental cracking or corrosion mechanism could have had the potential to
weaken the cylinder and predispose it to failure in the manner sustained.

1.2 Corrosion testing - background

A literature review of potential stress cracking corrosion mechanisms in high
strength steels did not reveal any specific information in relation to the two
chemicals used by the operator in the requalification process of passenger oxygen
cylinders installed its aircraft.
The subject cylinders are overhauled and requalified every 3 years as detailed in the
main body of the report. Part of that process involves hydrostatically testing the
cylinders above the service pressure of 1,850 psi. Following testing, the water is
drained from the cylinders, which are then rinsed with isopropyl alcohol to displace
the water. The cylinder is then flushed with a solvent, allowed to drain, and then
dried using heated nitrogen gas. The cylinders are then inspected and refilled with
oxygen ready to return to service.
The current solvent used by the operator during the flushing phase was identified as
Lenium GS®, an n-propyl bromide-based solvent. This solvent was a replacement
for a previously used product, A-Gasol®. A-Gasol® is a 1,1-dichloro-1-fluoroethane
solvent, currently being phased out in Australia for environmental reasons. During
the course of the investigation, it was determined that A-Gasol® had been used
during the last overhaul of the failed cylinder (SN 535657) due to a depletion of
Lenium GS® stocks.
The proposed corrosion test regime was aimed at mimicking a scenario where a
quantity of the subject solvent/s had inadvertently remained in the cylinder after
overhaul and return to service. As such, test pieces removed from the subject
cylinder type were independently exposed to the two solvents in a highly­

- 140 -
 oxygenated environment. The samples were stressed in tension (to replicate the
stresses associated with cylinder pressure) and maintained at ambient temperatures.
It was intended that the test would run for approximately 8 weeks; a period
consistent with the time elapsed between the requalification and subsequent failure
of the number-4 cylinder. The test specimens would be checked on a regular basis
for the onset of any stress-corrosion cracking, pitting corrosion or any other visual
evidence of environmental degradation or exposure effects. Sectioning of the
samples for a metallurgical evaluation following the conclusion of exposure to the
solvents would also be conducted to provide a more in-depth evaluation of any
corrosive attack or material effects.

1.3 Methodology
The stress corrosion test procedure was based on that given in ASTM G39-99
(reapproved 2009), ‘Standard Practice for Preparation and Use of Bent Beam
Stress-Corrosion Test Specimens’.
Stress-corrosion cracking (SCC) is a failure mechanism that occurs by slow
environmentally induced crack propagation. The crack propagation results from an
interaction between external physical stresses and corrosion reactions acting on the
material surfaces. Cracking can occur at stresses well below the yield strength of
the material. The stresses can be externally applied or residual internal stresses.
The test outlined in ASTM G39 involves the quantitative stressing of a beam
specimen by application of a bending stress. The stresses applied are determined by
the size of the specimen and the induced bending deflection.
The time taken for cracks to appear after the commencement of exposure to the
environment under evaluation is used as a measure of the stress-corrosion resistance
of the particular material, in that environment, at that particular stress level.

1.4 Test procedure

1.4.1 Summary of Practice

• The formula provided in the literature was used to determine the dimensions for
the test pieces, and to calculate the approximate deflection required for a desired
applied stress.
• The test pieces were removed from the barrel section of the cylinder in the
longitudinal direction. Dimensional measurements were performed on the
length, width and thickness of each sample. The test specimens were then
assembled using a bolted, three-point bending configuration to apply the stress.
• Once the test specimens were assembled, the final deflection was measured and
the formula used to calculate the induced tensile stress at the outer mid-point of
the sample.
• Cylindrical glass vessels were filled with the test solutions, and covered with a
plastic lid. A plastic tube was inserted through the lid in order to allow a flow of
oxygen into the solutions.

- 141 -
 • The test specimens were then placed into the solution in the presence of oxygen,
and the initial pH measured.
• The tests were examined daily for the onset of cracking and any observations
recorded.
• The test was considered to have been complete at the onset of cracking, or after
a specified period had elapsed.

1.4.2 Test Specimens

The test pieces were removed from cylinder S/N 686764. The samples were
removed from the centre of the barrel in the longitudinal direction. Ten samples
were removed from the cylinder, with eight used in the final test program.
The test specimen used was a double-beam design referred to in ASTM G39 but
detailed in ‘Symposium on Stress-Corrosion Testing, ASTM STP 425’, ASTM,
1967, p 319 (refer to Figure B1 below). The outer face in tension (as shown on the
figure) was the internal surface of the cylinder.

Figure B1: Double beam specimen configuration used in the SCC test

ATSM STP 425 also provided specimen dimensions for given plate thicknesses.
The wall thickness of the cylinder type was approximately 3mm. Table B1 presents
the dimensions for a 1/8 inch thick sample (3.125mm):

Table B1: Guideline dimensions for test specimens

t a b L S

1/8 inch (3.125mm) 4”(101.6mm) 2” (50.8mm) 10” (254mm) 12” (304.8mm)

The double-beam test specimen configuration meant that two samples would be
tested in each of the solutions. One of the samples was tested in the service
condition, i.e. with the phosphate conversion coating intact, while the other had the
coating removed by abrasion with fine-grade emery paper.
Figure B2 presents the test specimens in the assembled and stressed condition.

- 142 -
 Figure B2: Double beam specimen configuration used in the SCC test

Test specimen configuration Test specimen after application of bending stress.

The spacers between the samples and the washers (half sections of round bar) used
in the bolting configuration were manufactured from bright (plain carbon) steel.
The nuts and bolts were galvanised Grade 8.8, with the zinc coating chemically
stripped from the fasteners prior to assembly of the test specimens.

1.4.3 Stress Calculations

The formula for the tensile stress on the mid-point of the outer span is given by the
following equation;
2݂ܽ
∆݀ ൌ ሺ3‫ ܮ‬െ 4ܽሻ
3‫ݐܧ‬
Where Δd = deflection (inches), f = nominal stress (psi), E = Young’s modulus.
The required deflection for the samples was calculated from the above equation
using a stress of 1,000 MPa, the approximate yield strength of the cylinder material
in the longitudinal direction. The resultant deflection was 1.42 inches (36.12mm).
As mentioned previously in the test procedure section, once the test specimens were
prepared and assembled, further dimensional measurements were performed,
including deflection calculations. The above formula was again used to calculate
the actual applied stress at the mid-point. It was assumed that the stress would be
equal in both samples. The results are given in Table B2 below:

Table B2: Calculated stress applied at the mid-point of the assembled test
specimens
Specimen Stress (MPa)

1 986.4
2 981.1
3 922.1

- 143 -
1.4.4 Test Conditions
The two solvents used during the flushing phase of the cylinder requalification
process were used in the testing. A third (control) solution used in the test consisted
of an isopropyl alcohol solution.
A fourth test specimen was also assembled and stressed, but not exposed to the
solution as a further control sample to understand how the material would behave
under stresses close to the yield point for the test duration.
Table B3 presents details of the test solutions.

Table B3: Solutions evaluated in corrosion test

Test Solution

1 Lenium GS®: n-Propyl bromide based solvent, used to

remove contaminants such as oils, greases, adhesives
and resins. A direct replacement for HCFC-141b.
2 A-Gasol®: 1-1, dichlor-1-fluoroethane (HCFC-141b)
based parts cleaning solvent. Phased out due to
environmental reasons
3 Isopropyl alcohol – control solution
4 No solution

Three test specimens were placed in glass cylinders filled with each of the test
solutions. A 2 mm thick high density polyethylene (HDPE) lid was placed over the
cylinders and held in place with a weight.
Industrial oxygen gas was supplied from a bottled cylinder and was introduced
through a small diameter polyvinyl chloride (PVC) tube (Figure B3). The oxygen
flow rate was controlled by a pressure regulator. The oxygen flow was kept low
(less than 1 litre/min), to reduce evaporation of the solvent.
The tests were conducted in a fume-controlled environment and were kept at
constant room temperature (approximately 22°C) for the duration of the test.

Figure B3: Corrosion test setup showing oxygen gas feed line

- 144 -
 The test solutions were checked regularly, with observations recorded and the level
of solution topped up where required. The solution pH was also recorded
periodically.

1.5 Test results

The tests using the Lenium GS® solution and the control solution were commenced
on 27 January 2010. The test using the A-Gasol® solution was commenced on 19
February 2010.
The pH of all solutions was measured at the beginning of the test using 3-pad pH
test strips (‘Precision’ brand). A pH of 5 was recorded at the beginning of the test,
and did not change for the duration.
A visual examination of the samples, while in solution, was performed every 2 to 3
days. Any observations were recorded, which included when the solution was
topped up or the oxygen supply changed. The pH was originally checked every 2-3
days (when observations recorded); however, once no changes were recorded after
1 month’s testing, the pH was then recorded on a weekly basis.
The testing was concluded on 7 April 2010.

1.5.1 Visual Inspection

The test specimens were removed from the solution, rinsed and dried. They were
then examined visually and photographed prior to disassembly. Once disassembled,
the individual test pieces were further examined visually and with the aid of a low
powered stereo-binocular microscope.
Very minor levels of general corrosion were observed on the outer surfaces of the
test pieces, i.e. the side in tension and internal surface of the cylinder. No evidence
of cracking was observed on any of the samples. Refer to Table B4 below and
Figures B4 to B6, for detailed observations on each of the test pieces.

- 145 -
Table B4: Visual observations recorded following conclusion of testing
Sample Visual Observations
Coated test piece – Minor general corrosion observed. No evidence of
cracking. Appears to be some loss of coating.
1. Lenium GS® De-coated test piece – Minor general corrosion observed, appeared to be
more severe at the mid-point of the sample, i.e., consistent with the
highest applied stress.
Minor red rust observed on contact surfaces between test pieces and
spacer.
®
2. A-Gasol Coated test piece – No visual indications of any corrosion
De-coated test piece – General corrosion observed on entire surface;
appears more severe at mid-point. No evidence of cracking.
Sample was difficult to disassemble, with the nut difficult to undo on one
side. Examination following removal showed damaged threads on one of
the nuts.
3. Control
Coated test piece – No evidence of any corrosive attack, but may exhibit
(isopropyl
some loss of coating. Surface displayed similar characteristics at mid­
alcohol)
point at outer edges.
De-coated test piece – Evidence of general corrosion, but appears to be
less than other samples. No cracking observed.
4. Control (no No evidence of corrosive attack. Exhibited similar appearance to those in
solution) solution. Some permanent deformation observed following disassembly.

Figure B4: Samples removed from the Lenium GS® solution showing
centre of sample under the highest tensile stresses

- 146 -
Figure B5: Centre of de-coated sample removed from the A-Gasol®
solution. Samples from all test solutions displayed similar
characteristics

Figure B6: Magnified view of A-Gasol® sample shown in Figure B5,

showing very minor general corrosion and discolouration

- 147 -
1.5.2 Metallurgical Evaluation
Sections were removed from each of the test pieces and prepared for metallurgical
evaluation of the surface in contact with the solvent. Table B5 provides the cylinder
location from which the samples were removed.

Table B31: Samples removed for metallurgical examination

Sample Number Description

1 Lenium GS®, de-coated, centre, transverse

®
2 Lenium GS , coated, centre, transverse
3 A-Gasol®, de-coated, centre, transverse
®
4 A-Gasol , de-coated, centre, longitudinal
®
5 A-Gasol , de-coated, edge, transverse
6 A-Gasol®, coated, centre, transverse
7 Control (isopropyl alcohol), de-coated, centre,
transverse
8 Control (isopropyl alcohol), coated, centre,
transverse
9 Control (no solution), de-coated centre,
transverse

The focus of the examination was on the surface in tension during the testing, i.e.
the internal surface of the cylinder.
The samples all exhibited similar features consistent with the visual observations.
The surface was rough and irregular in nature, with some shallow pit/depression
type features observed along all samples (Figure B7).
Evidence of very shallow grain-boundary penetration was observed on the surface
in tension along the entire length of all examined samples. In all instances the
features extended less than 1 grain diameter into the bulk material (Figure B9).
There were no significant differences noted between the centre and edge samples,
nor were there any notable differences between the transverse and longitudinally-
oriented samples.

- 148 -
Figure B7: Micrograph of de-coated sample removed from Lenium GS
upon conclusion of testing. Sample is in the un-etched
condition

Figure B8: Micrograph of a sample removed from A-Gasol solution. Note

the grain boundary penetrations (consistent across all
samples). The sample was etched in 2% Nital

- 149 -
 Figure B9: Magnified view of image in Figure B8, showing general
corrosion and shallow grain-boundary penetrations

1.5.3 Bend test

Samples were selected for bend testing from the test pieces exposed to the A-
Gasol® and Lenium GS® samples, along with the un-exposed sample.
The test pieces were subjected to a 180° bend test, in order to determine the
susceptibility to cracking, and the effects of the testing procedure.
The samples were initially bent around a 25mm former; a mechanical vice was used
to complete the deformation.
All samples tested achieved the full bend, (Figure B10) with no cracking, tearing or
other indications of reduced ductility, when observed both unaided and under the
stereo-binocular microscope.

Figure B10: A-Gasol® sample during bend testing

- 150 -
2 ANALYSIS

The exposure and post-test evaluation results were similar for all samples tested in
each of the environments, including the stressed sample which was not exposed to
any solution.
The tests were conducted for a minimum of 49 days, with no notable visual effects.
The samples did not exhibit any cracks that were discernable to the naked eye, and
did not exhibit any gross discolouration. The exposure solutions did not discolour,
and the pH levels remained constant throughout the test period.
A visual examination of the samples following removal from the test solutions
revealed some evidence of possible corrosive attack. The surfaces appeared rough
in nature and examination under a stereobinocular microscope revealed some
evidence of minor pitting.
A microstructural examination however, did not reveal any evidence of stress-
corrosion cracking. Small grain boundary penetrations (less than one grain in
depth), were observed extending from the internal surface of the cylinder samples.
They were consistent along the entire length, and thus were unrelated to the applied
stress levels. Evidence of several deeper features was also observed at various
locations on the examined samples; however there was no indication that these had
been generated by a corrosion mechanism. Similar features were observed in
specimens not exposed to the test solutions.
The 180° bend tests performed on the samples following exposure to the test
solutions did not reveal any cracking or evidence of reduced ductility within the
cylinder material.

- 151 -
- 152 -
3 SUMMARY

• The cylinder material did not show any susceptibility to stress- corrosion
cracking or other corrosion mechanisms in the presence of oxygenated Lenium
GS®, A-Gasol®, or isopropyl alcohol.
• The ductility or microstructural characteristics of the cylinder material did not
appear to have altered in any way following stressing and exposure to the test
solutions.

- 153 -
- 154 -
APPENDIX C: SOURCES AND SUBMISSIONS

Sources of information and assistance

The ATSB investigation into the oxygen cylinder failure and subsequent
depressurisation of Boeing 747-438 aircraft VH-OJK, used information from, or
was provided assistance by the following organisations or individuals:
• Flight crew of VH-OJK
• Cabin crew of VH-OJK
• Qantas Airways Ltd
• Boeing Co. Office of Flight Safety Investigation
• US National Transportation Safety Board (NTSB) and advisors
• US Federal Aviation Administration (FAA)
• Civil Aviation Authority of the Philippines
• Civil Aviation Safety Authority (Australia)
• Lufthansa Technik Philippines Inc
• Avox Systems Inc
• BOC Ltd
• Air Liquide Australia Ltd
• QinetiQ Aerostructures Pty Ltd
• PearlStreet Ltd
• Australian Pressure Testing Services
• Spectrometer Services Pty Ltd
• Defence Science and Technology Organisation (DSTO), Australia
• Queensland University of Technology, School of Physical Sciences

References

US Code of Federal Regulations, Title 49: Transportation

• § 178.44 Specification 3HT seamless steel cylinders for aircraft use
• § 178.35 General requirements for specification cylinders
• § 180.205 General requirements for requalification of specification cylinders
• § 180.209 Requirements for requalification of specification cylinders
• § 180.212 Repair of seamless DOT 3-series specification cylinders and
seamless UN pressure receptacles

- 155 -
Compressed Gas Association Inc.
• CGA C-6-2007 Standards for visual inspection of steel compressed gas
cylinders
• CGA C-8-2005 Standard for requalification of DOT-3HT, CTC-3HT and
TC-3HTM seamless steel cylinders

International Organisation for Standardisation

• ISO/TR 12391-1 Gas cylinders – refillable seamless steel – performance
tests – Part 1: Philosophy, background and conclusions
• ISO/TR 12391-2 Gas cylinders – refillable seamless steel – performance
tests – Part 2: Fracture performance tests – monotonic
burst tests
• ISO 9809-1 Gas cylinders – refillable seamless steel gas cylinders -
design, construction and testing – Part 1: Quenched and
tempered steel cylinders with tensile strength less than
1,100 MPa
• ISO 9809-2 Gas cylinders – refillable seamless steel gas cylinders -
design, construction and testing – Part 2: Quenched and
tempered steel cylinders with tensile strength greater than
or equal to 1,100 MPa
• ISO/DIS 11114-1 Transportable gas cylinders – compatibility of cylinder and
valve materials with gas contents – Part 1: Metallic
materials

Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety
Investigation Act 2003, the ATSB may provide a draft report, on a confidential
basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of
the Act allows a person receiving a draft report to make submissions to the ATSB
about the draft report.
A draft of this report was provided to:
• Civil Aviation Safety Authority (Australia)
• Qantas Airways Ltd
• National Transportation Safety Board
• Federal Aviation Administration
• The Boeing Company
• Flight and cabin crew of the aircraft
• QinetiQ Aerostructures Pty Ltd
Upon receipt, each submission or comment was reviewed, and where considered
appropriate, the text of the report was amended accordingly.

- 156 -
 ATSB TRANSPORT SAFETY REPORT

Boeing Company 747-438, VH-OJK

475 km north-west of Manila, Philippines, 25 July 2008
Oxygen cylinder failure and depressurisation
Aviation Occurrence Investigation AO-2008-053
Final

Oxygen cylinder failure

and depressurisation
475 km north-west of Manila, Philippines
25 July 2008
Boeing Company 747-438, VH-OJK