History of Flight

United Parcel Service (UPS) Flight 6 arrived at Dubai International Airport (DXB) in Dubai, United Arab Emirates (UAE) from Hong Kong, China on a scheduled cargo flight carrying mixed cargo, including lithium-type batteries. On the inbound flight, the crew experienced a fault in air conditioning pack number 1 of 3 which was reset by the flight crew. Several cargo containers, referred to as Unit Load Devices (ULDs), were unloaded and new ULDs were loaded in the aft end of the airplane in DXB. The flight departed DXB at 1850 local time, Gulf Standard Time (GST), bound for Cologne, Germany.

The first officer was the Pilot Flying (PF); and the captain was the Pilot Not Flying (PNF). The aircraft made a normal, northwesterly departure over the southern Arabian Gulf. Because of the direction of travel at dusk, the flight deck was lit by the setting sun.

The PF manually flew the aircraft to 11,300 feet altitude and then engaged the autopilot (AP) for the climb to a cruise altitude of 32,000 feet. The climb was uneventful except for another pack 1 fault at approximately 10,000 feet. The captain successfully reset pack 1 at 1858. All other flight deck indications were normal.

The airplane flew out of the UAE Flight Information Region (FIR) into the Bahrain FIR and checked in with Bahrain East (BAE-C) during the climb. On the transition out of UAE FIR into Bahrain FIR, the crew tuned the left audio control panel to the BAE-C frequency on the primary radio.

One minute later, 21 minutes into the flight and approaching the top of climb, the main deck fire warning bell sounded and the fire warning light illuminated, warning the crew of fire or smoke on the Fire Main Deck - FWD.

The captain took control of the airplane as PF and told the FO they would turn back to DXB. The captain then notified BAE-C of the fire indication on the main deck and requested the nearest airport. The controller offered Doha airport; however, the captain had decided to return to DXB. He then declared an emergency. At the time, the crew did not know the extent of the emergency.

The FO, now PNF, began accomplishing the non-normal checklist and activated the fire suppression system. As a result of the actions taken per the checklist, the main cargo deck began to depressurize. The pack 2 and 3 switches were then turned to OFF on the overhead panel, also in accordance with the checklist. Two minutes later, the crew received a second main deck fire warning, at which time both pilots donned their oxygen masks. The crew then received a third warning: Fire Main Deck - Zone 12.

For a short while following the fire warnings, the captain was manually flying the airplane. The crew then turned back toward DXB and initiated a descent. Following the heading change back to Dubai, the flight deck was now travelling away from the sun and was in shadow. Three and a half minutes into the emergency pack 1 failed. The crew did not respond to the pack failure. The crew then received a fourth smoke detection warning indicating the presence of smoke in the upper-deck flight crew rest area, just aft of the flight deck.

About four minutes into the emergency, the airplane was becoming progressively less responsive to manual control inputs. The captain then told the FO he had no control of the aircraft and reengaged the autopilot, which was still capable of controlling the airplane.

Investigators concluded that the flight deck had filled with persistent smoke and fumes, which severely restricted the ability of the crew to see their surroundings, primary flight displays, essential communications panels, or the view from the flight deck windows. The flight crew informed Air Traffic Control (ATC) numerous times throughout the flight that the flight deck was full of smoke and they could not see.

The crew received a fifth warning: Fire Main Deck - Aft, and a cabin altitude warning, followed by three fire warnings from the aft, lower-lobe cargo compartment. Investigators noted that there was no recorded discussion in the flight deck regarding the cabin altitude warning. Due to the persistent smoke, the captain called for the flight deck smoke shutter to be opened, which was not part of the non-normal checklist for this emergency. (Note: The 747 flight deck is equipped with a smoke shutter, which can be opened in flight, to aid in the evacuation of smoke from the flight deck.) The smoke shutter was opened and remained open for the remainder of the flight.

About seven minutes into the emergency, the captain's oxygen supply suddenly stopped with no indication that the oxygen supply was low or failing. The first officer was unable to help the captain, who then told the first officer to fly the airplane. One minute after his oxygen failed, the captain moved to the aft area of the flight deck, believed by investigators to have been searching for a portable oxygen container. The captain did not return to his seat. For the remainder of the flight the first officer was the pilot flying and attempted both to control the airplane and communicate with the ground. The autopilot remained engaged and capable of controlling the airplane.

 

 

The aircraft had flown out of effective radio communication range with BAE-C. The first officer informed the BAE-C controllers that due to limited visibility in the flight deck, he could not change the radio frequency on the audio control panel back to the UAE frequency.

In order for the pilot to continue communicating with BAE-C, the Bahrain controllers called nearby aircraft into service as communication relays between BAE-C and the emergency aircraft. BAE-C then communicated via landline with UAE controllers managing the traffic in the Emirates FIR. The UAE controllers then contacted the aerodrome at Dubai, also by landline. For an eight-minute period, while the accident aircraft was inbound to DXB, four different relay aircraft assisted. This complex communication system continued until the end of the flight.

UPS 6 had already been configured for landing and cleared to land. The aircraft, however, was unable to intercept the glideslope. At twenty five minutes after the first fire warning, the pilot was unable to successfully continue the approach and executed a missed approach. Controllers provided information to divert to Sharjah (SHJ), ten miles to the left. The pilot attempted to initiate an approach to SHJ, but entered the wrong heading, causing the airplane to turn right. The pilot attempted to control the plane, but flight control responses were by then so degraded that airplane control was lost.

Twenty-eight minutes and forty-one seconds after the first indication of fire in the main deck cargo compartment, UPS Flight 6 crash-landed in an unoccupied area of a military installation in Dubai. Both pilots were killed.

View UPS Flight 6 Flight Path Animation: 

 

 

 

The United Arab Emirates General Civil Aviation Authority (GCAA) led the accident investigation and published the final accident report with support and close cooperation from the United States (US) National Transportation Safety Board (NTSB) and the European Aviation Safety Agency (EASA), with assistance from the aircraft manufacturer, the US Federal Aviation Administration (FAA), the aircraft operator, and the labor union representing its pilots.  

Onboard Cargo

Investigators determined that a large number of lithium-type batteries were loaded in Hong Kong, the point of origin for the accident flight. At least three of the shipments loaded in Hong Kong should have been treated as hazardous materials and declared as such on the airplane loading manifest and accompanying shipping documents. This lack of shipping documentation left the crew unaware that they were transporting regulated hazardous goods. In addition, some shippers failed to provide investigators evidence that batteries had been tested as required, in accordance with the United Nations Recommendations on the Transport of Dangerous Goods Manual of Tests and Criteria.

While in Dubai, Unit Load Devices (ULDs) were removed from positions 13L, 14L, 14R, 18L, 19L and 20. Some of these ULDs were replaced with other out-bound ULDs. No cargo was unloaded from the forward section of the main deck.

The flight, which had departed from Dubai International Airport, was fully loaded with cargo on the main deck and in the lower-lobe cargo compartments. The contents of the cargo containers were spread throughout the debris field, both inside and outside the post-crash fire zone.

As noted on the shipping manifest, on board the flight was a wide variety of cargo, including more than 80,000 lithium-type batteries.

 

 

Fire Initiation

The investigation and analysis concluded that the initial fire most likely occurred in Fire Zone 3, which covers the area including the forward section of ULDs 5L and 5R, and most of ULDs 4L and 4R on the main cargo deck. At least three shipments of lithium batteries, which had been loaded in Hong Kong and should have been declared as hazardous materials, were identified in the pallets at positions 4 and 5. No hazardous material had been declared on board the accident flight.

 

 

Fire zone 3 stretches from approximately body station (STA) 580 to STA 700, and is where the ceiling makes a slope up as it continues aft from below the upper deck, to the high main-deck ceiling. This area is just below the left- and right- hand truss assemblies which support the flight control cables and ducting. The stairs between the main deck and upper deck are at approximately STA 500.

Cargo Liners

Cargo liners provide passive fire protection and are intended to prevent a cargo compartment fire from spreading to other parts of the airplane. Containment of a fire also prevents damage to essential systems and equipment until a fire can be controlled by the fire suppression system.

To be approved for installation into an aircraft, the cargo and ceiling liner are subjected to an oil burner test. This test applies a 1700°F flame for five minutes and must result in a temperature no higher than 400°F, four inches away on the side opposite the flame. The accident airplane was equipped with cargo liners on the entire main cargo deck.

Control of the Aircraft

The pilots were unable to control the aircraft manually and depended on the autopilot for most of the descent. Excerpts from the flight data recorder information provided from the accident report show manual control-column and rudder pedal inputs made by the flight crew, compared to control surface responses, at different stages of the accident flight.

 

 

 

The location of the fire at the cargo liner transition point is right below the left-hand and right-hand truss assemblies, which support the flight control cables. Once the fire had breached the cargo liner, systems and equipment above the main deck ceiling were compromised.

The following is taken from the accident report: "Control cables in the flight control system transmit the pilots' control inputs to the corresponding control surface actuators. The control cables for the elevators, rudders, speed brakes, landing gear, and brakes are routed under the flight deck and then up into the crown of the airplane where they are supported by two large cable pulley trusses. They all continue aft along the crown. The cables for speed brakes, landing gear, and brakes are routed down near the wheel well area, and the cables for elevator and rudder continue aft in the crown, to the tail."

 

 

The pulley bracket truss assemblies are located aft of the supernumerary area near body station 800, suspended from the overhead fuselage by a series of brackets. Control cables are thin strands of tinned carbon steel, some with 6061-T4, -T6 aluminum cladding. The steel control cables run through the pulley wheels. The truss assembly is composed of aluminum 2024-T3, T42 (brackets, tie rods) and 7075-T73 (pulleys, tie rod fittings). The metal cable materials will experience significant elongation at temperatures around 200°F to 400°F and higher, and will experience melting at temperatures of 935°F to 990°F.

Autopilot control of the aircraft is unaffected by these mechanical control cables, as autopilot control, power control, and servos are electronically operated and located near the tail or empennage of the aircraft, near where the elevators and rudder are located. Electrical connections for the autopilot are routed along the crown of the airplane and were therefore remote from the fire.

Smoke Detection and Environmental System

The smoke detection system for the 747 main deck cargo compartment has sixteen zones, each zone having two smoke detectors. The smoke detection system continuously samples air through a network of tubes (called "sniffers") in the cargo compartment. If smoke is detected, the system provides a visual and/or audible warning to the flight crew of the presence of smoke and its general location.

The smoke detection system is designed to detect a fire before it can cause significant damage to the airplane or its systems. The accident aircraft experienced five confirmed smoke detection events on the main and upper deck and three in the lower cargo hold.

The airplane was equipped with a main deck fire suppression system. When activated from the flight deck, the suppression system automatically shuts down packs 2 and 3 and depressurizes the cargo areas, reducing available oxygen to the fire. Procedures call for the crew to climb or descend to 25,000 feet, which the accident airplane did not do. Instead, they descended to 10,000 feet, which continued an oxygen source for the fire. In fire suppression mode, pack 1 provides positive air pressure to the flight deck to prevent smoke and fumes from entering the flight deck area. When pack 1 faulted and went off-line during the emergency, it resulted in a loss of airflow and loss of protection from smoke and fumes to the upper deck and flight deck. If the pack 3 switch had still been in the "norm" position when pack 1 failed, pack 3 would have automatically reconfigured and begun supplying air to the flight deck. This did not occur on the accident flight because pack 3 had previously been selected off in accordance with the pilot's non-normal checklist.

The environmental control system ducts, some of which were routed directly above the location of the fire and cargo liner transition, could not be inspected by investigators because they were consumed in the post-crash fire. Investigators concluded that due to the location of the ducting, it was likely damaged by the on-board fire and, had there been any air supply to the flight deck, it would have been mixed with smoke. As a result, the procedurally mandated reconfiguration of the environmental control system and the failure of pack 1 were determined by investigators to have been of little consequence in this emergency.

Flight Crew Oxygen

Failure of the cargo liner to protect the supplemental oxygen system from the cargo fire was considered by investigators to be a causal factor in the failure of the crew oxygen system. The oxygen system, damaged by the fire, stopped oxygen flow to the captain's mask and reduced flow for the rest of the flight to the FO's mask.

Oxygen cylinders for the flight crew oxygen system are stored in the aircraft lower lobe, in the forward cargo compartment. A manifold system provides oxygen to four masks; the captain, first officer, and two observer locations. The oxygen line tubing is mostly made of CRES (corrosion resistant steel) and PVC hoses located where flexibility is necessary. It was believed by investigators that a PVC hose connector which failed in the captain's oxygen supply.

 

 

Communications

During the emergency descent from the Bahrain FIR into the Emirates FIR, communication between the ATC at Bahrain, the UAE, and the accident aircraft was complex because smoke in the flight deck prevented the crew from changing the radio frequency. Following the emergency descent to 10,000 feet, all communication with BAE-C was through relay aircraft.

Examination of the Wreckage

At the crash site, the debris path was linear, covering a distance of over 2,000 feet. Most of the airplane wreckage and cargo was consumed by post-crash fire. Two debris fields were identified, Zone 1: where the debris was subjected to a post-crash ground fire, and Zone 2: where the debris was found outside of the post-crash fire zone. The majority of the aircraft inside debris Zone 1 was destroyed by the post-accident fire, resulting from the rupture of the fuel tanks.

The on-scene wreckage examination focused on items found on the border of Zone 1 and inside Zone 2. Some of the items found were aircraft structure with thermal damage and soot patterns which investigators believed to have occurred in flight, prior to impact and not resulting from the post-crash fire.

Items Recovered from the Accident Site

Flight Data Recorder and Cockpit Voice Recorder

 

 

Cockpit voice recorder: despite significant heat, fire, and impact damage, upon disassembly the internal circuit cards and memory chips were removed, downloaded, and reviewed, and all data was recovered.

 

Smoke Shutter

 

 

Smoke shutter cutout: a very thick soot trail, almost resembling tar, extended from the cut-out location aft to the end of the recovered portion of fuselage.

 

Stairs

 

Stairs: the stairs to the flight deck extend from the floor of the main cargo deck up to the upper deck. The stairs have soot marks at the top which then taper off towards the bottom. The soot present on the stairs suggests a smoke layer extending to the height shown by the line in the photo below.

 

 

Galley Shelf Covered in Soot

 

 

Lithium Battery Overview

Significant research has been conducted on lithium and lithium-ion batteries and cells. The FAA has conducted numerous large- and small-scale tests both prior to and after the UPS accident in Dubai. Much of that research is presented here.

There are two general categories of lithium batteries and cells (also referred to as batteries): primary, or non-rechargeable, and secondary, or rechargeable. The primary batteries are known as lithium batteries and secondary batteries are typically known as lithium-ion batteries.

The four primary functional components of a lithium-ion battery are the negative electrode (anode), positive electrode (cathode), separator, and electrolyte. Alternating layers of anode and cathode are separated by a porous film (separator). An electrolyte composed of an organic solvent and dissolved lithium salt provides the medium for lithium-ion transport.

The term lithium-ion battery refers to a battery where the anode and cathode materials serve as a host for the lithium ion (Li+). Lithium ions move from the anode to the cathode through an electrolyte and separator. During discharge they are inserted into the voids of the crystalline structure of the cathode, and the ions reverse direction during charging.

 

 

Cell and Battery Failure Modes

Large- and small-scale testing has been completed on the failure modes and effects of lithium-type batteries. Lithium-ion batteries experiencing energetic failures enter a mode known as "thermal runaway."

Thermal runaway refers to rapid self-heating of a cell resulting from sudden internal increase in temperature and pressure. In a thermal runaway reaction, a cell rapidly releases its stored energy. The more energy a cell has stored (charging state), the more energetic a reaction will be in thermal runaway.

The causes of energetic cell thermal runaway and battery failures are classified as follows:

• Thermal abuse
• Mechanical abuse
• Electrical abuse
• Poor cell electrochemical design
• Internal cell faults associated with cell manufacturing defects

Lithium cell thermal runaway reactions can be very energetic because the batteries have very high energy densities compared to other cell chemistries. This is also one of the benefits to consumer use; more energy in less space. Additionally, construction using flammable electrolyte material, rather than water-based electrolyte, contributes to the energy release. Consequently, not only do the batteries store electrical energy, they store energy in the form of combustible and flammable materials.

For thermal runaway of a cell to begin, the rate of heat generation must be greater than the rate of heat loss. The most severe thermal runaway reaction occurs when a cell is at 100% state of charge (SOC), or is overcharged, since the cell contains maximum electrical energy.

During a thermal runaway, lithium-ion cells can reach temperatures of 1100°F, measured on the surface of the cell, which is sufficient to heat adjacent cells, causing them to also go into thermal runaway (propagation). Thermal runaway may occur if a cell is heated to 450°F. When undergoing thermal runaway, the 1100°F surface temperature can easily ignite adjacent flammable materials. If a single cell in a typical box of 100 cells goes into thermal runaway, all the cells in that box will sequentially go into thermal runaway.

Both primary and secondary lithium batteries, once the cell is heated, will experience a dramatic increase in pressure inside the cell, causing the enclosure to burst, and expelling hot battery contents (such as flammable electrolyte gas or molten lithium) outside the cell.

If a fully charged (or overcharged) lithium-ion cell undergoes a thermal runaway, a number of reactions occur. Cell internal temperature and pressure increases. This results in cell venting, and internal contents may be ejected. Due to the high surface temperatures generated, the thermal runaway may propagate to adjacent cells.

In order to better understand the characteristics of Lithium-ion battery failure modes, Sandia National Laboratories in Albuquerque, New Mexico conducted a series of tests to document the effects of various types of mechanical damage to the battery. The following links show the results of two of those tests.

The first video depicts a crush test of an automotive type lithium-ion battery assembly. The test setup used a single battery pack, and involved crushing the battery.

View Sandia National Laboratories Lithium-Ion Battery Crush Test Video below: 

 

 

 

 

The second video depicts a test involving a 10-cell pack assembled from batteries identified as an “18650,” – a 4.2 volt battery typically used in hand held devices; e.g. LED flashlights, etc. The cells were wired in parallel, and a nail was pressed through a single cell. The test was an investigation into failure propagation properties when a single cell enters a thermal runaway.

View Sandia National Laboratories Lithium-Ion Battery Nail Penetration Test Video below: 

 

 

Lithium Battery Cargo Shipment Testing

Among the many organizations involved in the development and testing of lithium-type batteries, the FAA conducted extensive testing to understand the hazards and risks of shipping lithium batteries on aircraft. Lithium-type batteries in varying chemistries, amounts, environments, sizes, and states of charge have been analyzed.

Tests included the following:

Flammability comparison of lithium-type batteries and nickel metal hydride batteries

• Lithium and lithium-ion batteries both experience violent fires during thermal runaway. Thermal runaway was rapid in lithium metal batteries and slower with lithium-ion batteries, while nickel metal hydride batteries were fairly inert.

Lithium-ion cell propagation test

• The heat generated from a single battery caused adjacent batteries to go into thermal runaway. Thermal runaway propagated both within the package and from package to package.

Combustion sphere

• Analysis of the flammable gases emitted during thermal runaway have shown that in addition to flammable hydrocarbons and carbon monoxide, the gas may contain up to thirty percent pure hydrogen. Large quantities of gas can be produced during thermal runaway. For lithium-ion batteries, the volume of gas produced increases as the state of charge increases.

Full-scale lithium battery testing in class C and class E cargo compartments

• Tests show that the fire suppression systems in these cargo compartments will not prevent the propagation of thermal runaway in lithium-type battery fires. The ineffectiveness of halon is due mostly to the large quantity of the vented flammable hydrogen gas generated by the batteries.

Class C cargo compartment flammable gas test

• Tests show that the gases produced by just six lithium-ion batteries can produce enough flammable gas that, when confined and ignited, can raise the class C cargo compartment pressure more than one pound per square inch (psi). This is enough to damage cargo liners, activate pressure relief features, allow fire suppressant to leak out of the compartment, and expose passengers and crew to smoke and gases. An explosion from the gases produced by a large number of batteries in thermal runaway could potentially cause structural damage to the aircraft.

State of charge propagation testing

• Many lithium-ion batteries are shipped at a 50% state of charge (SOC). Tests show a significant safety improvement when the SOC for lithium-ion batteries is reduced to 30% or less. Lithium-ion batteries at 30% SOC are less likely to go into thermal runaway, or to propagate during thermal runaway, and will produce reduced amounts of flammable gases when in thermal runaway. In contrast, lithium-ion batteries shipped at higher states of charge are more likely to go into thermal runaway, propagate, and produce greater quantities of flammable gases. 

5,000 lithium-ion battery test (fire resistant container with suppression)

Testing has shown that lithium-ion batteries can generate a large amount of hydrocarbon, escalating the risk for an explosion or flash fire. The explosion is the result of hydrocarbons building up and auto-igniting due to high temperatures or flames. As noted, forces generated by such an explosion are great enough to damage an airplane's internal structure and protective materials, and potentially expose additional, vulnerable areas of the airplane to fire and damage.

One of the FAA tests involved a fire-resistant container, equipped with a fire suppression system, to determine whether such a container could contain a fire from a bulk load of lithium-ion batteries.

The test used 5,000 lithium-ion 18650-sized batteries (similar in size, but longer than a AA battery), occupying only a small portion of the container. The rest of the container was full of combustible material. A 100-watt cartridge heater was used to simulate a cell undergoing thermal runaway. The heater reached a temperature of approximately 1000 °F, over the initial ten minutes. Thermocouples were located in several of the other battery boxes to monitor temperatures within the boxes during the test. Within approximately 10-15 minutes of test initiation, the first adjacent battery entered thermal runaway.

Approximately 24 minutes into the test, the fire suppression agent was activated within the container. The purpose of the dry chemical extinguishing agent is to knock down the flames and create an inert environment within the container. However, it is unable to arrest a thermal runaway or prevent propagation and subsequent venting of cells. These events led to an explosion, which occurred 44 minutes after the start of the test. For cells with larger capacity or higher states of charge than those used in this test, the hazards would be increased and time to explosion could be much less.

After the explosion, the breach in the container allows the suppressant to escape, and also allows oxygen to enter the container. This provides oxygen to the once-suppressed fire, increasing the reaction rate and accelerating the flames.

View FAA Lithium-Ion Battery Test Video below: 

 

 

Test Results

Following the test, the cells were collected to determine how many might have contributed to the explosion. Approximately 335 cells had undergone thermal runaway, and a number of batteries were still experiencing thermal runaway after the test was terminated. Based on this information, gases from less than 335 cells undergoing thermal runaway caused the explosion. FAA test conductors concluded that initially propagation of thermal runaway occurred in one battery at a time, but as the temperature within the box or container increased, more cells were affected, entering into thermal runaway simultaneously.

Test results led to recognition that lithium and lithium-ion batteries, when shipped in bulk, pose an extreme hazard to an airplane in flight. It is also recognized that airplanes are not designed to withstand the intensity of fires and explosions resulting from bulk shipments of batteries undergoing thermal runaway.

Burning Characteristics of Aircraft Cargo Container Fires

FAA airplane design regulations address cargo liner materials and the certification of cargo compartments equipped with aircraft-based smoke detection systems. 

 

 

Investigators conducted tests on cargo containers in order to evaluate the delay in smoke escaping the container and activating the smoke detection system. Testing measured various characteristics, including the time elapsed between the escape of a detectable amount of smoke and the time for the associated fire to reach its peak. Rigid and collapsible containers were tested.

 

 

The accident report stated: "From the tests involving cargo containers, the following conclusions were made:

• Differences in container design and materials have a significant effect on fires originating within them.
• Container design has a significant effect on the time it takes for an internal fire to become detectable to a smoke detector outside the container.
• Container construction materials have a significant effect on the total fire load and energy release rate of a cargo fire.
• The time it takes for a fire detection system to detect a fire originating within a cargo container may easily exceed the 1 minute time frame specified in Title 14 Code of Federal Regulations (CFR) 25.858(a).
• The growth rate of container fires after they become detectable by the aircraft's smoke detection system can be extremely fast, precluding any mitigating action and resulting in an overwhelming fire."

Conclusion

The investigation concluded with reasonable certainty that the fire started in cargo which included lithium batteries. It was believed a lithium-type battery, for reasons unknown, failed and went into thermal runaway, auto ignited, and spread to other batteries and combustible material. As the fire spread, the cargo compartment liner then failed as a fire and smoke barrier, allowing fire to damage unprotected systems and smoke to spread throughout the airplane, including the flight deck. According to the accident report, it is probable that the remaining cargo, the cargo pallet, and the adjacent cargo, ignited and continued to burn. The fire most likely continued until the crash.

Following the accident, investigators conducted tests that demonstrated the magnitude of the threat posed by the bulk shipment of lithium-type batteries. Once this hazard was demonstrated, airlines voluntarily stopped these bulk shipments on passenger airplanes. Subsequently, and in recognition of the significant hazard posed by lithium-ion batteries, the International Civil Aviation Organization (ICAO) has banned the bulk shipment of lithium-ion batteries on passenger aircraft, effective April 1, 2016. Bulk shipments of lithium metal batteries had already been banned on passenger aircraft, in the United States in December of 2004 and by ICAO on January 1, 2015.

In this accident, regulations relative to hazardous cargo were not followed. Required testing of some batteries was apparently not conducted, and battery shipments were not treated as hazardous material and declared on shipping documents for transport on the airplane.

 

Back to top

Investigators summarized the findings of the UPS Flight 6 accident under Chapter 3 of the Accident Report. There were 95 findings issued, ranging from flight crew qualifications and aircraft condition at takeoff, to characterization of energy release from lithium batteries, the capability of such energy release to compromise the integrity of packaging and create incendiary projectiles, and the effect of the uncontained fire on aircraft critical systems.

The accident board findings may all be read at this link, Accident Board Findings.

From the accident report: "The findings are statements of all significant conditions, events or circumstances in the accident sequence. The findings are significant steps in the accident sequence, but they are not always causal or (do not necessarily) indicate deficiencies."

The following are causes identified by the accident board, in their report.

"Causes are actions, omissions, events, conditions, or a combination thereof, which led to this accident.

1. A large fire developed in palletized cargo on the main deck at or near pallet positions 4 or 5, in Fire Zone 3, consisting of consignments of mixed cargo including a significant number of lithium type batteries and other combustible materials. The fire escalated rapidly into a catastrophic uncontained fire.
2. The large, uncontained cargo fire, which originated on the main cargo deck, caused the cargo compartment liners to fail under combined thermal and mechanical loads.
3. Heat from the fire resulted in the system/component failure or malfunction of the truss assemblies and control cables, directly affecting the control cable tension and elevator function required for the safe operation of the aircraft when in manual control.
4. The uncontained cargo fire directly affected the independent critical systems necessary for crew survivability. Heat from the fire exposed the supplementary oxygen system to extreme thermal loading, sufficient to generate a failure. This resulted in the oxygen supply disruption leading to the abrupt failure of the Captain's oxygen supply and the incapacitation of the captain.
5. The progressive failure of the cargo compartment liner increased the area available for the smoke and fire penetration into the fuselage crown area.
6. The rate and volume of the continuous toxic smoke, contiguous with the cockpit and supernumerary habitable area, resulted in inadequate visibility in the cockpit, obscuring the view of the primary flight displays, audio control panels and the view outside the cockpit which prevented all normal cockpit functioning.
7. The shutdown (failure) of PACK 1 for unknown reasons resulted in loss of conditioned airflow to the upper deck causing the Electronic Equipment Cooling [EEC] system to reconfigure to "closed loop mode". The absence of a positive pressure differential contributed to the hazardous quantities of smoke and fumes entering the cockpit and upper deck, simultaneously obscuring the crew's view and creating a toxic environment.
8. The fire detection methodology of detecting smoke sampling as an indicator of a fire is inadequate as pallet smoke masking can delay the time it takes for a smoke detection system to detect a fire originating within a cargo container or a pallet with a rain cover."

For additional contributing factors from the final report, view Contributing Factors.

View Accident Report.

 

Back to top

The accident board issued several safety recommendations relative to this accident. The recommendations are found in Chapter 4 of the accident final report and involve the following:

• Changes to fire protection requirements in the FAA and EASA Airworthiness Standards

• Changes to aircraft and critical systems related to protection of critical systems from large cargo fires

• Changes to hazardous materials regulations related to lithium-type batteries and cells

• Changes involving aircraft design and pilot training related to smoke in the flight deck

• Testing by government agencies related to lithium-type batteries to determine safe limits for air carriage

• Reviews and changes within ICAO related to hazardous material classification, packaging, and carriage of lithium type batteries and cells, as well as flight deck improvements

• GCAA changes to air traffic control and air navigation services for in-flight emergency response

 

The final report lists a total of 36 safety recommendations which may all be seen here, view Safety Recommendations.

 

Back to top

The regulations pertaining to the aircraft (and related to the accident), which were applicable when the accident aircraft was certified, are as follows:

Title 14 Aeronautics and Space, Part 25 Airworthiness Standards: TRANSPORT CATEGORY AIRPLANES -

25.831, Amendment 25-41, Eff. 9/1/77, Ventilation

25.855, Amendment 25-60, Eff. 6/18/86, Cargo and Baggage Compartments

25.857, Amendment 25-60, Eff. 6/16/86, Cargo Compartment Classification

Title 49 Transportation, Parts 171, 172, 173, 175, Hazardous Materials; Transportation of Lithium Batteries, effective January 1, 2008 (voluntary compliance authorized as of October 1, 2007.

Relevant regulations pertaining to transport of dangerous goods by air are explained by the following:

The regulations governing the transport of dangerous goods are numerous and complex. The industry is subject to both national and international requirements. The United Nations (UN) makes "Recommendations on the Transport of Dangerous Goods" which guide the development of regulations.

International Civil Aviation Organization (ICAO) Annex 18 adopts the UN recommendations and sets the standards for "Safe Transport of Dangerous Goods by Air." Annex 18 requires, among other things, that dangerous goods are carried in accordance with the ICAO "Technical Instructions for the Safe Transport of Dangerous Goods by Air" (Technical Instructions).

The Technical Instructions require states (countries) to adopt legislation which ensures dangerous goods are carried in accordance with these requirements. Some countries adopt variations on the ICAO requirements, which may be found on the ICAO Web site or through the individual government authorities. For example, for transport of dangerous goods to, from, or within the United States of America, regulations are found in the Title 49 Code of Federal Regulations (49 CFR), Hazardous Materials Regulations, Parts 171 through 180.

The Technical Instructions also require that testing of dangerous goods prior to shipping be conducted in accordance with the "UN Manual of Tests and Criteria."

Within the requirements for transport of dangerous goods are general requirements; shipper responsibilities; requirements to test; limitations for air transport; training requirements; security factors; classification of dangerous goods; the list of dangerous goods and special provisions; quantity limitations and exceptions; packing groups, packing requirements, and packaging testing requirements; marking, labelling, and notification requirements; and operators' responsibilities, each based on the particular dangerous goods being transported.

At the time of the accident, Technical Instructions, fifth revised edition, was applicable to carriage of dangerous goods (specifically lithium-type batteries). Additionally, shippers were required to comply with the UN Manual of Tests and Criteria, also at the fifth revised edition, Part III, section 38.3 Lithium metal and lithium-ion batteries.

 

Back to top

International regulations for packaging and shipment of goods by air were well developed and had achieved a long and safe history. Additionally, the causes of thermal runaway were not well understood, and effective manufacturing requirements were not yet being developed. At the time of the accident, lithium-type batteries had been recognized as hazardous cargo, but the magnitude of the hazard they represented was not understood. They were treated similarly to other hazardous materials, which ultimately created a hazard that was not properly addressed. Shippers failed to adhere to the shipping requirements in effect at the time of the accident.

 

Back to top

• Lithium-type batteries, shipped in bulk, pose a significant safety threat to an airplane.
• Battery producers/shippers failed to provide evidence of testing required by dangerous goods regulations
• Battery producers/shippers failed to comply with dangerous goods testing, packing, packaging, shipping and notification requirements
• Airplane protection systems that were inadequate relative to the magnitude of the battery fire

 

Back to top

• Airplane fire protection (regulations/cargo liners/ suppression) were adequate to:
  • Protect airplane critical systems, such as flight controls, flight crew supplemental oxygen, environmental system ducting, from the damaging effects of a fire in the cargo compartment,
  • Contain an on-board fire in the cargo compartment for sufficient time to land the airplane and evacuate
  • Adequately suppress any fire that may be present on a cargo airplane.

• All battery producers/shippers would conduct required testing and comply with packaging, shipping and notification requirements
• At least one air conditioning pack would be available and operating; to clear smoke from the flight deck
• Shippers would not ship a product that would pose an "uncontainable" fire threat

 

Back to top

Lithium battery incident precursors

A battery incident chart is maintained by the FAA, which dates back to March 20, 1991. As of September 15, 2016, 129 air/airport incidents involving lithium batteries carried as cargo or baggage have been recorded since March 20, 1991. View Battery Incident Chart.

A less exhaustive list is provided below: 

• On April 28, 1999, a fire destroyed freight, including lithium batteries, on two aircraft cargo pallets at an airline cargo facility at Los Angeles International Airport. The two pallets involved in the fire contained 120,000 non-rechargeable lithium batteries. Some of the boxes of batteries may have been damaged during handling. An equipment operator noticed smoke, followed quickly by fire. The fire spread to an adjoining pallet containing lithium batteries. Both pallets then erupted in flames. View NTSB Safety Recommendations.
• On November 3, 2000, in Portland, Oregon, a small primary lithium battery short-circuited, causing a small fire and rupture of the battery. The primary lithium battery burned through its inner packaging and charred an adjacent package. The short-circuited battery had long, flexible, protruding positive and negative terminals.
• On April 12, 2002, small primary lithium batteries packaged in a fiberboard box ignited during handling in Indianapolis, Indiana.
• On August 9, 2002, a small secondary lithium battery in an electronic handheld device short-circuited, causing surrounding packing materials (bubble wrap) to catch fire.
• On August 7, 2004, large prototype secondary lithium batteries shipped under a competent authority approval from California to Europe apparently started a fire in a ULD during loading for a transatlantic flight (Memphis-Paris). The ULD and many other packages in it were damaged or destroyed by fire.
• On February 11, 2005, an undeclared package containing 18 small primary lithium batteries caught fire during unloading in White Bear Lake, Minnesota. Cargo handlers reported hearing a "pop" sound and then seeing the box "lifted" off the conveyor belt by the force. The package had been flown from Los Angeles to Minneapolis and was to be trucked to Clear Lake, Wisconsin.
• On or about June 29, 2005, the contents of a ULD caught fire onboard a flight from Shanghai, China to the United States. Airline ground personnel discovered evidence of the fire after the plane landed safely in Ontario, California. A package containing a secondary lithium battery pack was identified as the source of the fire.
• On March 3, 2006, a U.S.-bound package containing secondary lithium batteries ignited in an outbound air transport station in Shenzhen, China.
• On July 17, 2006, a package with no marking or labeling containing 122 secondary lithium batteries of various sizes caught fire while being held in bond for customs clearance in Korea after transportation by air from Vienna, Austria.
• On February 10, 2007, shortly after takeoff of a commercial flight, a fire ignited in a passenger bag stowed in an overhead bin. Preliminary reports indicate both small lithium-ion and small primary batteries were involved in the incident.
• On March 1, 2007, a package sent by an eBay vendor via the United States Postal Service containing 24 primary lithium batteries, caught fire at the Sydney Australia Mail Gateway facility. The package had been transported to Sydney from Los Angeles on a passenger aircraft.
• UPS Flight 1307 experienced an onboard fire on February 7, 2006. The aircraft landed at its destination airport after a cargo smoke indication in the cockpit. The safety issues include inadequacies in the following areas: guidance and checklists relating to in-flight fire and smoke; smoke and fire detection system test certification requirements; fire suppression system requirements; aircraft rescue and firefighting training; cargo airplane emergency exit requirements; hazardous materials information dissemination procedures; and transport of lithium batteries on board aircraft. From the NTSB Report No. AAR-07-07, for this accident, "there have been 34 battery and battery-powered devices aviation incidents reported to the Federal Aviation Administration (FAA) involving batteries that involved smoke, fire, extreme heat, or explosion. Approximately 22 of these aviation incidents involved lithium-ion batteries, with 14 of these incidents having resulted in an actual fire. The remaining 12 aviation incidents involved lithium-metal batteries, with eight of these incidents having resulted in an actual fire."

Hazardous material incident precursor

ValuJet Airlines Flight 592, McDonnell Douglas Model DC-9-32, N904VJ, hazardous materials, improperly shipped, which caught fire and burned uncontrolled, causing a crash which killed all passengers and crew.

 

Back to top

The FAA has released multiple Safety Alerts For Operators (SAFOs) regarding lithium type batteries, including:

SAFO 16012: Lithium-Ion Battery Shipments from Braille Battery, Inc.

SAFO 15010: Carriage of Spare Lithium Batteries in Carry-on and Checked Baggage

SAFO 16001: Risks of Fire or Explosion when Transporting Lithium Ion or Lithium Metal Batteries as Cargo on Passenger and Cargo Aircraft

SAFO 16011: Air Transport Restrictions for Recalled Lithium Batteries and Lithium Battery Powered Devices

SAFO 16004: New International Civil Aviation Organization (ICAO) Regulatory Requirements for Shipping and Transporting Lithium Batteries

Notice of Emergency Restriction/Prohibition Order Braille Battery, Inc.

Notice of Emergency Restriction/Prohibition Order Samsung Note 7

Title 49 Transportation:

• Parts 171, 172, 173, 175, Hazardous Materials; Transportation of Lithium Batteries, effective August 6, 2014 (voluntary compliance authorized as of August 6, 2014. View 2014-Aug 6 PHMSA Lithium battery rule.
• June 2016 update to 175.10
• Photo of lithium-ion battery, UN shipping label
• Notice of Proposed Rulemaking, 49 CFR Parts 107, 171, 172, 173, 175, 176, 178, and 180, Hazardous Materials: Harmonization With International Standards, dated September 7, 2016 (comments due November 7, 2016). View NPRM 9-2016 PHMSA-2015-0273-0001.

 

 

The Boeing non-normal checklist for the 747 freighter was revised to instruct pilots to keep air conditioning packs in 'NORM' mode when activating class E cargo compartment fire suppression.

FAA Advisory Circular, AC 120-80A, In-Flight Fires was updated to incorporate changes relative to flight crew oxygen systems.

FAA Special Conditions: For Certification of New and Modified Aircraft, Installation of Lithium Type Batteries.

Lithium-type batteries are novel and unusual with respect to the state of technology considered when the applicable Title 14, Code of Federal Regulations (14 CFR) part 25 requirements were codified. These batteries introduce higher energy levels into airplane systems through new chemical compositions in various battery cell sizes and construction. Interconnection of these cells in battery packs introduces failure modes that require unique design considerations, such as provisions for thermal management. The FAA determined that part 25 does not contain adequate safety standards for their installation on transport category airplanes and that special conditions are to be issued in accordance with § 21.16. The special conditions are revised, as applicable, to reflect current knowledge about this evolving technology. 14 CFR, Part 25 Special Conditions.

Relevant revised international requirements pertaining to transport of dangerous goods by air:

ICAO Technical Instructions for the Safe Transport of Dangerous Goods by Air, currently at the 2015-2016 edition, with supplements

The UN Manual of Tests and Criteria, currently the sixth revised edition (see Part III, section 38.3 Lithium metal and lithium-ion batteries).

Ongoing Safety Initiatives:

Numerous industry groups and experts are involved in the ongoing research, testing, and evaluation of the fire dangers of lithium-type batteries and cells. Information obtained continues to drive changes to the aircraft operating environment and rules regarding the transport of dangerous goods by air. Regulations and safety initiatives are continuing to evolve as more is learned about lithium-type battery and cell technology.

 

Back to top

There were no Airworthiness Directives issued as a result of this accident.

 

Back to top

Airplane Life Cycle:

• Operational

---

Accident Threat Categories:

• Uncontrolled Fire / Smoke
• Cabin Safety / Hazardous Cargo

---

Groupings:

• N/A

---

Accident Common Themes:

• Organizational Lapses
• Flawed Assumptions
• Pre-existing Failures

 

Back to top

Organizational Lapses

There were no dangerous goods (hazardous materials) declared on this flight. Three of the cargo shipments, however, included lithium-ion battery packs over 100Wh, which required they be classified and shipped as Class 9 dangerous goods and identified as such on the cargo manifest. Pilots had no knowledge of the hazardous materials on board.

Two of these undeclared shipments were located in containers in the area underneath the systems affected by the fire. For one of these shipments, the shippers indicated that the batteries met the UN testing requirements but did not provide evidence (test report) to verify this claim. In addition, the MSDS and specifications provided by this shipper did not match the battery part numbers listed on the packing list.

At least five shipments were loaded which contained lithium-ion batteries for which shippers reported not conducting UN required testing or did not provide evidence of required testing. Additionally, MSDSs provided by these shippers did not match information on the shipping documents.

Flawed Assumptions

Airplane cargo fire protection systems were assumed to be adequate to provide timely fire warning and allow fire suppression. The specific nature of lithium battery fires is such that airplane design features can be overwhelmed and fail to provide adequate protection. In this accident, the fire progressed rapidly and compromised the cargo liners, destroyed control system cables, and produced large quantities of smoke that prevented the flight crew from managing the emergency.

Pre-existing Failures

Non-normal checklist instructions to manually turn pack 2 and 3 switches to the off position in a fire/smoke suppression situation did not take into consideration the possible loss of pack 1. For several flights prior to the accident flight, pack 1 had intermittently failed but was able to be reset in flight. On the accident flight, and after the fire had started, pack 1 failed but the crew did not take any action to reset it. Loss of pack 1 allowed smoke to enter the flight deck in sufficient quantities to severely restrict the crew's vision, and ability to fly the airplane.

 

Back to top

Lithium battery cargo fire related accidents:

United Parcel Service Flight 1307, McDonnell Douglas DC-8-71F, N748UP experienced an onboard fire on February 7, 2006, at Philadelphia International Airport. Emergency landing was successful and three crew aboard escaped without injury. There was a total hull loss. View UPS 1307 final report.

Asiana Flight 991, July 28, 2011, Boeing 747-400F, HL7604, experienced a cargo fire and the airplane crashed into the sea off the Island of Jeju, South Korea. Both pilots were killed. The final report was published July 2015. View Asiana 991 final report.

 

Back to top

Technical Related Lessons

An acceptable level of airplane safety relative to the transport of lithium or lithium-ion batteries is achieved by the combined safety strategies developed for the battery manufacturing process and the air shipment process. This is accomplished by:

BATTERY MANUFACTURING - Battery design, manufacturing processes and quality control/acceptance programs are developed and implemented in order to prevent catastrophic battery failures.

BATTERY SHIPMENT VIA AIRPLANE - Battery packaging, testing, and labeling requirements, airplane smoke/fire protection, and operational procedures are developed and implemented to minimize the hazards to the airplane should a catastrophic battery failure occur. (Threat Category: Cabin Safety/Hazardous Cargo)

• This accident demonstrated that lithium-type batteries pose a potential threat to airplanes that was previously not well understood. Manufacturing process and quality control errors can produce batteries that are susceptible to rapidly progressing catastrophic failures. External abuses (e.g., over temperature, battery charging errors, dropping/crushing) can contribute to either initiation, or probability of failures. For example, charging levels greater than 50% have been found to increase the probability of energetic failures. Additionally, the higher the state of charge, the higher the risk. Testing has shown that there is a significant difference between 50% and 30% charging that might actually reduce the frequency and severity of these accidents.
• On the accident flight, investigators determined that a shipment of lithium-type batteries experienced a thermal runaway, which resulted in a catastrophic fire and overwhelmed airplane protection and flight control systems. Testing has shown these types of failures may be caused by manufacturing defects or some type of external abuse prior to shipping. An emphasis should be placed on methods of battery production with the goal that battery failures do not occur.
• Additionally, shippers had not adequately documented the hazardous nature of the battery shipments, and in some cases did not perform required testing prior to shipping the batteries. Shippers claimed that other battery consignments on board the airplane had been tested, but could not produce the required documents verifying the testing. Investigators also cited the apparent complacency internationally relative to testing, packaging, and labeling requirements and proper identification of hazardous materials intended for shipment by air.

Service experience has demonstrated that lithium and lithium-ion batteries are able to be carried as bulk cargo, as long as specific procedures are followed. However, failures experienced in bulk shipments of these types of batteries can result in rapidly progressing fires that can overwhelm airplane level protection features. (Threat Category: Uncontrolled Fire/Smoke)

• Investigators determined that a large fire developed in palletized cargo on the main deck. The cargo consisted of consignments of mixed cargo, including a significant number of lithium-type batteries and other combustible materials. The consignments of batteries were determined to have been the most likely origin of the fire. The fire escalated rapidly into a catastrophic uncontained fire. The large, uncontained cargo fire caused the cargo compartment liners to fail, exposing the flight control system to excessive heat, and ultimately resulting in the failure of the elevator and rudder control system. The failure of flight control cables prevented the crew from manually controlling the airplane. The uncontained cargo fire also directly affected the independent critical systems necessary for crew survivability. The fire exposed the supplementary oxygen system to extreme heat, which resulted in the abrupt failure of the captain's oxygen supply and the incapacitation of the captain. Further, the levels of smoke generated by the fire severely hampered the crew's ability to see the airplane instruments or external references on the ground.

Common Theme Related Lessons

Certain types of cargo, such as lithium-type batteries, can be hazardous when specific processes are not followed. Rigorous testing by the manufacturer to ensure quality and proper identification of hazardous cargo by the shipper (both in packaging and labeling processes) are essential prior to conducting air shipments. (Common Themes: Organizational Lapses)

• There were no dangerous goods (hazardous materials) declared on this flight. However, three of the cargo shipments included lithium-ion battery packs over 100 watt-hours, which required their classification and shipment as Class 9 dangerous goods, and identification as such on the cargo manifest. The flight crew had no knowledge of the hazardous materials on board.
• Two of the shipments of lithium-ion batteries were in containers located underneath the airplane systems affected by the fire. For one shipment, the shippers indicated that the batteries met the UN testing requirements but did not provide evidence (test report) to verify this claim. Additionally, the Material Safety Data Sheets (MSDS) and specifications provided by the shipper did not match the battery part numbers listed on the packing list.
• At least five shipments were loaded, and located throughout the main deck that contained lithium-ion batteries for which shippers reported either not having conducted UN required testing or did not provide evidence of required testing. Additionally, MSDSs provided by these shippers did not match information on the shipping documents.

 

Back to top