After the fatal crash, there was a flurry of activity from aircraft manufacturer Boeing and from the industry regulator, the Federal Aviation Administration (FAA). Neither Boeing’s actions nor the FAA’s after-the-disaster advisory addressed the core problems of fire in transport-category aircraft. The situation is similar to a New Orleans funeral, in which a jazz band plays loudly while the deceased, who died of medical neglect, is buried.
The FAA and Boeing are playing the clarinet and the trumpet in a comparable jazz ensemble, tooting the virtues of safety while egregious lapses in safety persist.
The most recent example concerns a United Parcel Service (UPS) B747-400 freighter that crashed shortly after takeoff from Dubai for a flight to Cologne, Germany. The airplane was loaded with shipments of clothes, shoes, books, toys, transformers, solenoids, computer drives, assorted circuitry, etc. Although many of the shipments contained lithium batteries, the airplane carried no declared shipments of hazardous cargo. At least three shipments contained lithium ion batteries, which should have been declared as Hazardous Class 9 on the cargo manifest provided the aircrew. The crew had no idea that shipments of lithium ion batteries were on board. The Air Line Pilots Association (ALPA) has called for a prohibition on lithium battery shipments until rules are in place giving flight crews information that lithium battery shipments are on board. (See Aviation Safety Journal, August 2009, “Pilots Union Seeks Ban on Lithium Battery Shipments”)
Scene of the crash
Lithium ion batteries are a particular hazard because they burn with intense heat and cannot be extinguished by conventional Halon suppression chemicals. If a single battery in a shipment catches fire, neighboring batteries will be ignited and the resulting raging conflagration cannot be suppressed. On an airplane, where fire suppression is a given until an emergency landing can be made, a lithium ion battery fire will only stop when it has been cooled or it has consumed itself. There is also the associated problem of “thermal runaway”, a chain reaction leading to self-heating and the release of a battery’s stored energy. In short, a lithium ion fire involving multiple batteries in a shipment is a dangerous risk. If a battery is damaged in shipment – through errant handling, dropping, penetration of forklift tines into the pallet – there is a high likelihood that a battery fire will result. Heat, vibration and even manufacturing defects can catalyze a major problem in the cargo area.
Each battery is a potential detonator. In a large shipment of lithium ion batteries, the risk quotient can be determined by multiplying the number of plastic foil separators in each battery by the number of batteries carried.
There is no regulatory requirement that the main deck of a cargo jet be equipped with built-in fire suppression. Federal Express (FedEX) has developed an automatic fire suppression system (FSS) for the main decks of its international MD-11 and B777 freighters, approximately 74 aircraft. (See Aviation Safety Journal, October 2009, “New Fire Suppression System for Cargo Aircraft”)
The main dek fire suppression system developed by FedEx
Fred Smith, FedEx’s chief executive, said the FSS was developed by the company after a cargo fire on the main deck destroyed one of the company’s MD-10 freighters in 2003 at Memphis, TN. The fire was caused by an undeclared hazardous materials shipment. After making an emergency landing, the crew evacuated and the airplane burned up. If the fire had broken out over the ocean, hours from an airport, the crew might not have survived.
In the Dubai crash, Captain Douglas Lampe and his first officer were killed. The accident occurred in September 2010. The General Civil Aviation Authority (GCAA) of the United Arab Emirates recently issued a preliminary report of the accident.
The loaded UPS B747 freighter took off from Dubai airport about 1900 local time for a flight to Cologne, Germany.
Approaching the top of climb, at an altitude of about 32,000 feet, the main cargo deck fire alarm sounded. The crew donned oxygen masks and smoke goggles and began working through the smoke/fire checklist. Coordination between the two crewmembers was hindered by the masks, which did not feature “hot mikes” but required the microphone switch on the control yoke to be toggled.
They initiated a descent and return to the airfield at Dubai. To get on the ground from 32,000 feet takes about 15 minutes. The captain advised air traffic control (ATC) that the cockpit was full of smoke. The first officer commented on the rising heat in the cockpit. The GCAA report noted:
“Based on the information available to date, it is likely that less than 5 minutes after the fire indication on the main deck, smoke had entered the flight deck and intermittently degraded the visibility to the extent that the flight instruments could not effectively be monitored by the crew.”
The radio control panel also was obscured by smoke, so the crew requested to ATC that they remain on the existing frequency for the duration of the flight. (For a discourse on limited cockpit visibility resulting from smoke, and a safety device to mitigate this hazard, see Air Safety Journal, “Taking Credit For Scant Accomplishments”)
A frantic race against time to land the burning aircraft
Seven minutes after the fire alarm first sounded, the captain declared a lack of oxygen. At this time, the airplane was at 20,000 feet. The captain handed control of the airplane to the first officer and left his seat to retrieve a portable oxygen bottle. That was the last communication between the two pilots.
Since both pilots were on the same emergency oxygen supply, it is not clear why the first officer did not have the same problem. It seems likely that the captain needed the oxygen bottle to go aft, to find and fight the seat of the blaze. The two pilots could not call upon any rear crew-members to assist; there aren’t any. The huge B747-400 freighter is manned by a two-person crew. There is not a loadmaster.
Because the radio frequency could not be changed, transmissions were relayed via another aircraft in the vicinity.
The first officer requested immediate vectors and advised he would need radar guidance due to the difficulty in seeing the instruments. This transmission was at 14 minutes after the fire alarm first sounded. The airplane was at 10,000 feet and still some 90 miles from the airport.
Approximately 10 miles from the Dubai airport, through the radio relay aircraft, ATC advised the UPS plane that it was too high and too fast for landing. A 360º orbit was requested to slow down. “Negative” replied the first officer.
The aircraft flew over the airport boundary at 340 knots at an altitude of 4,500 feet and descending.
Shortly thereafter, the Ground Proximity Warning System (GPWS) sounded, “Too Low Terrain” and warnings of excessive “Bank Angle”.
The aircraft crashed about 9 miles south of Dubai airport. Based on the ground scar, the aircraft was in an almost at a level attitude. Given the thick smoke in the cockpit, it is probable that the first officer did not see the ground looming up; his only indication of impending disaster was the GPWS alerts. He may have been blinded by smoke-induced tears. The separate mask/goggles is not the best for sealing the eyes; at two-strap “cinchable” full-face smoke-mask is preferable.
Following the accident, Boeing and the FAA issued messages to operators of B747 freighter aircraft.
On 12 October 2010, just 39 days after the accident at Dubai, the Boeing message said:
“We recommend that flight crews of 747-400F … model airplanes be made aware that either air conditioning pack number 1 or pack number 3 must remain operating after accomplishing the checklists associated with the following EICAS [Engine Indication and Crew Alert System] messages: FIRE MAIN DECK, FIRE MN DK AFT, FIRE MAIN DK FWD, or FIRE MAIN DK MID. The purpose of this is to prevent excessive smoke accumulation on the flight deck under actual fire/smoke conditions.”
Coming after the accident, Boeing’s notice is a marked sign of a prior hazard analysis.
In less than 3 minutes, the fire spread from forward to aft
On the accident airplane, all three air conditioning packs were inoperative. Pack #1 was shut down due to a fault before the fire alarm sounded. This disabling action would not have helped suppress smoke entry into the cockpit. Packs 2 and 3 were shut down during the course of the in-flight emergency.
The loss of pack #1 was especially significant. If the #1 system had been serviceable, then the flight deck would enjoy a higher delivery pressure and a net outflow – rather than a smoke inflow, as turned out to be the case.
Systems #2 and #3 provide combined circulation to the cockpit and cabin.
One wonders why airflow in the cockpit is not isolated from the cabin. The Boeing guidance to rely on pack #1 or #3 is based on the fact that there is no dump valve on pack #2. With the smoke switch in the armed position, packs #1 and #3 will keep on running with the dump valve in the closed position, thereby providing the higher delivery pressure indicated above.
Still, the concept of using recirculated air in the cockpit of the B747-400 seems an affront to the ethic of independent, triple redundancy. Certification standards in this area seem lax.
The migration of smoke into the cockpit was facilitated by the absence of a cockpit door on the freighter version of the B747. There is a smoke curtain that can be zippered to isolate the cockpit; whether it was in the closed position is unknown. Suffice to say it may be easier to not zipper/unzipper the curtain for routine trips to the lavatory.
There is also a smoke curtain that is supposed to be zippered shut in front of cargo on the main deck, to further impede the migration of smoke upward and into the cockpit area. This curtain, zippered shut by ground personnel, was probably in place. Its effectiveness in a nasty, smoky fire, in which smoke will permeate anywhere and everywhere, is moot.
It is probable that the fire emanated from a shipment of lithium batteries that had been damaged during ground handling. The palletized shipment likely had been damaged by the tines on a forklift. Smashing a forklift into a cargo of lithium batteries and then loading them onto an airplane may be akin to arming a bomb. This pallet should have been broken apart, boxes carefully examined, and batteries inspected before loading back onto the aircraft. This was not done, and the pallet was reloaded onto the airplane with no assurance that contents were undamaged.
On 8 October 2010, just before the Boeing message, the Federal Aviation Administration (FAA) issued cautionary guidance about the risks of transporting lithium batteries. Called a Safety Alert for Operators (SAFO) contains information and advice, not mandatory actions. The SAFO 10017, issued in the wake of the Dubai disaster, recommended that air freight operators:
“ (1) Request customers to identify bulk shipments of currently excepted lithium batteries by information on air waybills and other documents provided by shippers offering shipments of lithium batteries …
“ (2) Where feasible and appropriate, stow bulk shipments of lithium batteries in Class C cargo compartments or in locations where alternative fire suppression is available.”
Class C cargo compartments – belly holds – feature fire detection and suppression. A main deck cargo compartment is classified as a Class E space. According to FAA regulations, Class E spaces are not required to have built-in fire suppression or extinguishing systems controllable from the cockpit. Only fire detection is required.
The Civil Aeronautics Authority (CAA) of the UK issued a Flight Operations Communication (FODCOM 30/2010) in November 2010 confirming that U.S. dangerous goods regulations were lax and below the international standard:
“Lithium ion and lithium metal batteries have become everyday household articles … Because of the energy stored within these batteries, improper preparation for transport or inappropriate handling can result in such batteries failing. The effects of such a failure can be quite dramatic and there have been a number of fires reported as a result.
“On 7 February 2006 a UPS DC-8 aircraft suffered an in-flight fire and subsequently burned out after landing at Philadelphia airport. The cause of the incident was not established, but suspicion centered on consignments of lithium batteries, which were being carried as cargo.
“Following the 2006 incident … the International Civil Aviation Organization (ICAO) Dangerous Goods Panel conducted a comprehensive review of the provisions in the Technical Instructions for the Safe Transport of Dangerous Goods by Air … [and adopted] .enhancements …
“These enhancements have not been adopted by the United States … Consequently, the current U.S. requirements do not align with those of ICAO …
“On 3 September 2010 another UPS aircraft … crashed in Dubai … Following this accident, the FAA produced SAFO 10017 …
“On 20 October 2010, EASA [European Aviation Safety Agency] issued SIB 2010-30, which supported the recommended actions in the FAA SAFO. It should be noted that the CAA is not aware of the consultation of any dangerous goods specialists from the various European Aviation Authorities by the EASA Certification Directorate prior to its publication.”
Thus, the FAA’s slack standards (below these recommended by ICAO) are proliferating.
There are three other issues meriting discussion in the wake of the Dubai crash.
First, Boeing recommends that in the event of the smoke/fire alarm, the pilots immediately climb or descend the aircraft to 25,000 feet. The reason for the prompt descent is due to the action taken to shut off air conditioning packs #2 and #3, which supply conditioned air to main deck and lower cargo holds.
Obviously, the aircraft will become very cold very quickly. This is a problem for passenger aircraft, but not necessarily for cargo aircraft. Consider the following line of thought for cargo airliners: remaining at cruise altitude can buy time. The reduction in pressure at the higher altitude means the available oxygen for the fire is less, reducing the probability of flashover.
Colder temperatures associated with a higher altitude would also delay the time for heat transfer to ignite combustible materials near the smoldering components that have previously ignited. It is more difficult for radiant heat to spread from one pallet to another.
A cargo aircraft kept at altitude retains the benefit of oxygen deprivation, increased time to reduce the heat from the primary ignition source and – assuming the presence of a loadmaster –possibly more time for a crewman to locate and put out the fire with a squirt from a hand-held Halon extinguisher.
Second, lithium batteries are often shipped fully charged. There may be a way to ship them more safely – empty or discharged. An energy state below, say, 3.5 volts, would prevent the much dreaded thermal runaway.
Unfortunately, there is no regulation regarding the charge level of the batteries. It is more economical for the manufacturer to ship a “ready for use” item to a retail customer.
Third, packing the batteries in a container more robust than cardboard seems essential given the hazard they pose.
The FAA has tested 5-gallon steel pails and 30-gallon steel drums, both with crimp-on metal lids.
The results were discouraging. As few as six loose lithium batteries, when exposed to heat in these closed steel receptacles, created enough explosive force to blow the lids off the containers.
If a fire cannot be contained in a sealed, gasketed, steel container, perhaps lithium ion batteries ought not be shipped by air cargo. If so, cargo airlines would face a loss of revenue. According to government statistics, last year cargo airlines shipped over two-thirds of all lithium ion batteries imported into the U.S. valued at some $470 million.
The value per flight cannot be determined. However, the loss of a B747-400 airplane and two lives involved a statistical valuation in excess of $100 million. The UPS B747-400 was carrying lithium ion batteries with a net value of a few million dollars, at most. In other words, the FAA’s favored tool of a cost-benefit calculation would surely show that the potential loss in lives and airplanes is not worth the risk of hauling these prone-to-burst-on-fire batteries.
The jazz ensemble remains at the ready to play loudly when the next crash occurs.