A ruptured oxygen cylinder punched a hole in the fuselage and rattled around inside the aircraft causing additional damage, together with the sudden decompression of the airplane, forced an emergency landing of the Qantas jet in the Philippines, according to Australian investigators.

It is slightly ironic that the oxygen bottle, which supplies breathable air to the passengers in the event of decompression, in fact caused the loss of cabin altitude. Fortunately, the remaining 12 oxygen canisters had more than an ample supply for crew and passengers as the little yellow cups deployed from their stowage areas above the occupants. For passengers, emergency oxygen is often supplied by chemical canisters located overhead, but in the case of the B747-400, the emergency oxygen is supplied by an array of the 9 x 30-inch steel canisters located below the main cabin in the cargo hold; oxygen is routed through pipes and regulated by flow control units (see box below).

On July 25 2008 a flight from Hong Kong to Melbourne, at 29,000 feet, the number-4 oxygen cylinder failed, causing loss of cabin pressure, loss of the first officer’s aileron control, and loss of multiple electrical systems, prompting the flight crew to declare a MAYDAY and divert the airplane to an emergency landing at Manila in the Philippines. There were no injuries, but the aircraft was damaged.

The Australian Transport Safety Bureau (ATSB), which is investigating the event, just recently put out a preliminary report concluding:

“On the basis of the physical damage found with the aircraft forward cargo hold and cabin, it was evident that the number-4 passenger oxygen cylinder had sustained a failure that allowed a sudden and complete release of the pressurized contents. The rupture and damage to the aircraft fuselage was consistent with being produced by the energy associated with that release of pressure. Furthermore, it was evident that as a result of the cylinder failure, the vessel had been propelled upward, through the cabin floor and into the cabin space. Damage and impact witness marks found on the structure and fittings around the R2 cabin door showed the trajectory of the cylinder after the failure event.”

It is indeed fortuitous that no one in the main cabin was injured or killed. If, for example, the number-1 oxygen cylinder had failed in a like manner, the bottle would have penetrated the floor immediately below seats.

It is also extremely fortunate that the aircraft was not fatally disabled. The ATSB report is not comforting as this event could happen again.

The ATSB issued an advisory notice enjoining other operators to ensure that cylinder installations are maintained in full accordance with manufacturer’s requirements.

The cylinder in question was one of two to be fitted to the aircraft on June 14 2008. These two bottles were the most recent to be installed. The failed cylinder lies somewhere at the bottom of the Pacific Ocean, but the ATSB is exploring the history of cylinder failures and the filling process, in addition to manufacturer quality control processes.

What is known about the missing cylinder is that about one hour into the flight it burst with a loud bang heard in the cockpit. The flight crew donned emergency oxygen masks and began a descent. Oxygen masks automatically deployed in the cabin.

The pilots later said that many system failure messages were displayed in the cockpit which included all three instrument landing systems (ILS), the left VHF omnidirectional radio-range (VOR) navigation instrument, the left flight management computer (FMC) and the aircraft anti-skid braking system.

Investigators found that numerous electrical cables and bundles, routed through the lower aircraft fuselage near the point of rupture, had been damaged or severed. Approximately 86 discrete conductors from six separate bundles had been affected.

In addition, both of the first officer’s aileron control cables, routed along the lower right side of the fuselage, had been cut during the rupture event.

The captain assumed the duties of pilot flying. His aileron control cables were routed down the left side and were not affected.

The burst cylinder rocketed upward, punched through the cabin floor, and struck the R2 door handle, moving it about 120º from the locked position. A 180º movement of the handle represents the fully open position, raising the specter of the door opening in flight and its escape slide deploying.

The cylinder had enough velocity to continue traveling up, damaging overhead panels, fixtures and storage compartments. The cylinder then fell back through the hole it created in the floor and tumbled out of the 18 square-foot hole in the fuselage (see the following two boxes below).

The rupture in the fuselage, adjacent to the location in which cylinder number-4 is affixed, points to a failure of its 0.113 inch thick steel (see below).

The tape from the flight data recorder (FDR) was successfully downloaded. However, only a partial read-out of the cockpit voice recorder (CVR) was possible. Designed to capture 2 hours of audio, the CVR provided information only for the 30 minutes after the depressurization event occurred (fortunately, the most relevant portion of cockpit conversation).

The investigation is continuing. In addition to the efficacy of oxygen cylinder maintenance and inspection processes, the ATSB is looking at “the operator’s procedures for preserving a CVR recording following a serious incident or non-catastrophic accident.”

The ATSB has also interviewed all 16 of the cabin crew and will survey all of the passengers on the flight to determine “if any improvements in equipment design or crew procedures are needed to enhance safety.”

Although not mentioned in its preliminary report, the ATSB may want to consider, as a sensible afterthought, the routine non-destructive testing of oxygen bottles prior to installation. If such testing is currently required, it clearly failed to detect any latent failures, and why it did not is one of the questions of the hour.

Another key area where the ATSB would profitably spend its time is in the design of the airplane’s electrical system. The explosion of the oxygen canister had the force of a small bomb, in which wholesale severing of electrical systems resulted. The segregation and separation of electrical circuits for the kind of independent redundancy shown with the aileron cables seems essential and in need of improvement.

It should be noted that Amendment 97 to ICAO (International Civil Aviation Organization) Annex 8 includes “a requirement that flight-critical systems should be designed and separated such that airplane survival is maximized for any event (e.g., damage due to an explosive device) that causes airplane system damage.” In 2002 the Federal Aviation Administration (FAA) was considering a draft advisory circular (AC), Number 25.795(d), that recommended as much as five feet of separation for flight critical systems.

The working draft of that AC apparently is on the cutting room floor. A search of extant ACs does not turn it up. However, the oxygen cylinder burst with sufficient explosive force to sever about 7 dozen bundled circuits, stripping the flight crew of all three instrument landing systems and other important flight-control resources.

One would hope the ATSB would take its inquiry into this incident to explore electrical system design, in which circuits are closely bunched in a way that many can be severed in a single blow. (The ATSB preliminary report is at www.atsb.gov.au/publications/investigation_reports/2008/AAIR/aair200804689.aspx)