Indonesia AirAsia A320 near Perth on Oct 15th 2017, loss of cabin pressure

Last Update: November 27, 2019 / 17:05:55 GMT/Zulu time

Bookmark this article

Photo of Indonesia AirAsia PK-AXD, Airbus A320 — Indonesia AirAsia PK-AXD, Airbus A320 (Photo credit: riyad_filza / Flickr / License: CC by-sa)

Incident Facts

Date of incident
Oct 15, 2017

Classification
Incident

Cause
Loss of cabin pressure

Airline
Indonesia AirAsia

Flight number
QZ-535

Departure
Perth, Australia

Destination
Denpasar, Indonesia

Aircraft Registration
PK-AXD

Aircraft Type
Airbus A320

ICAO Type Designator
A320

An Indonesia AirAsia Airbus A320-200, registration PK-AXD performing flight QZ-535 from Perth,WA (Australia) to Denpasar (Indonesia) with 146 passengers and 6 crew, was climbing through FL338 out of Perth when the crew initiated an emergency descent to FL100 due to the loss of cabin pressure, the passenger oxygen masks were released. The aircraft returned to Perth for a safe landing on runway 21 about one hour after departure.

The aircraft is still on the ground in Perth about 33 hours after landing.

On Oct 16th 2017 the Australian ATSB announced they rated the occurrence a serious incident and have opened an investigation.

On Nov 22nd 2017 the ATSB reported the aircraft was climbing through FL250 out of Perth when the flight crew received a SYS 1 FAULT message for the left hand pressurization system, the message disappeared again. The message did not require any pilot intervention. Climbing through FL300 the crew received an indication "SAFETY VALVE OPEN". The crew worked the related checklist, switched to manual cabin pressure control and detecting the cabin altitude climbing at 1100 fpm attempted to close the outflow valve. The cabin pressure difference was noticed at 8.3 psi with the cabin altitude being at 8,900 feet. Before the checklist could be completed the warning ceased. 3 minutes later the excess cabin altiude warning activated intermittently first then permanently. The flight crew donned their oxygen masks and initiated an emergency descent at an average vertical rate of 2300 fpm (11.6 m/s). Cabin crew reported the passenger oxygen masks had not been released, the flight crew released the masks manually. The aircraft returned to Perth for a safe landing about one hour (58 minutes) later.

The ATSB reported that some crew members noticed some ear discomfort just prior to the emergency descent, however, no signs of hypoxia. There were no injuries and no damage to the aircraft. A post flight examination revealed the cabin pressure controller #1 as cause of the loss of cabin pressure.

The ATSB reported that there are two safety valves opening at a different cabin pressure of 8.2 to 8.9 psi to prevent excessive cabin pressures. The related SAFETY VALVE OPEN message is triggered when the safety valve is not closed for longer than a minute. The SYS 1 FAULT message indicated the cabin pressure controller (CPC) #1 has failed. The ATSB wrote: "The alert is for crew awareness only and no action is required." further explaining that one of the two CPCs is engaged and the other in stand by taking over if the first fails. The investigation is ongoing.

On Nov 27th 2019 the ATSB released their final report concluding the probable causes of the serious incident were:

Contributing factors

- During climb, the active cabin pressure controller produced a series of intermittent faults, which led to the cabin over-pressurising and the safety valve(s) opening. The malfunctioning controller then produced a series of intermittent excess cabin altitude alerts, which resulted in the flight crew performing the emergency descent in accordance with the procedure.

- The source of the cabin pressurisation system faults was isolated to the main circuit board in cabin pressure controller 1, which was the master controller. Cabin pressure controller 1 declared itself in failure after the flight crew had selected manual control of the cabin pressurisation system and therefore cabin pressure controller 2 did not take control.

- The operator had not incorporated two of the aircraft manufacturer's non-mandatory service bulletins for more reliable cabin pressure control, which likely would have facilitated the automatic changeover from cabin pressure controller 1 to cabin pressure controller 2, thereby preventing escalation of the malfunction.

Other factors that increased risk

- The pre-flight safety briefing and safety information card did not include a clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing. This resulted in some passengers not understanding whether or not there was oxygen flowing in the mask [Safety issue].

- The cabin crew provided additional commands to passengers that were inappropriate for a depressurisation, which had the potential to increase confusion in the cabin and likely increased the level of panic experienced by some passengers.

- AirAsia Indonesia’s cabin crew emergency procedures training did not include the role-play of non-compliant passenger behaviour, which likely limited the cabin crew’s opportunity for exposure to more complex real-world scenarios, similar to what they encountered during the incident.

Other findings

- Following activation of the passenger emergency oxygen system, at least two units did not deploy, and two units that did deploy, did not activate to produce oxygen when their release pins were removed. However, as there were about 30 per cent more oxygen masks available than seats, sufficient masks were still available for passengers and cabin crew.

The ATSB analysed:

At about 1122 local time, the aircraft departed Perth Airport for the destination of Bali, Indonesia, with cabin pressure controller 1 (CPC 1) controlling cabin pressurisation in automatic mode. While on climb, passing FL 250 at about 1141, the flight crew received a series of intermittent cabin pressure system 1 (CPC 1) fault messages. However, each time the flight crew selected the cabin pressure display page, the fault message cleared.

Eight fault messages were generated between 1141 and 1148. At 1148:14 the cabin differential pressure had increased to 8.4 pounds per square inch (psi). Five seconds later at 1148:19 the cabin differential pressure had reduced to 7.8 psi. In that time, CPC 1 (incorrectly) commanded the outflow valve to close from the 6 per cent open position to 2 per cent open. This led to the over-pressurisation of the aircraft cabin and activation of the cabin safety valve(s). It is likely that between the period of 1148:14 and 1148:19, the cabin differential pressure reached 8.5 psi, which was within the tolerance to activate the safety valve(s), but the actual time of opening was not traceable.

At 1148:29 the flight crew selected manual control of the pressurisation system, and noting the high rate of cabin altitude climb of 1,100 ft/min, they attempted to manually set 500 ft/min, which was the published target figure. Between 1151 and 1155, while in manual cabin pressure control, the excess cabin altitude alert triggered three times. As the passenger oxygen masks are automatically deployed in response to a sensor independent of the CPCs, and there were no further excess cabin altitude warnings after CPC 1 generated its failure message, it is likely the cabin altitude never exceeded 14,000 ft (the trigger for passenger oxygen masks) and therefore there was low risk of a hypoxia-related event.
The repeated excess cabin altitude warnings were likely the result of what the manufacturer described as ‘abnormal stepwise changes’ in CPC 1’s calculated cabin pressure values, which deviated from the raw cabin pressure values.

As a result of the excess cabin altitude alerts, the flight crew conducted the emergency descent procedure, starting the descent at about 1152:20. A review of operator’s procedures, A320 emergency procedures, cockpit and flight data recorders, found no significant discrepancies between the flight crew’s actions and published procedures. However, the flight crew reported that they should have stopped the climb when the cabin pressurisation system 1 fault messages started and given more attention to the cabin altitude.

The ATSB concur with the flight crews’ comment and note that if a depressurisation had occurred due to incorrect outflow valve control, in-lieu of over-pressurisation, stopping the climb at a lower level would have increased their time of useful consciousness in order to don their oxygen masks. The time of useful consciousness is considered to be the ‘amount of time an individual is able to perform useful flying duties in an environment of inadequate oxygen’, and, for example, this will decrease from 3–5 minutes at 25,000 ft to 30–60 seconds at 35,000 ft.

Cabin pressure controller 1 fault

The aircraft’s CPC 1, CPC 2 and outflow valve were sent to the manufacturer for inspections and tests. They found that CPC 1 produced 12 intermittent fault messages between 1141 and 1151, before registering a failure at 1159. They concluded an automatic changeover from CPC 1 to CPC 2 would likely have occurred at 1159, following the CPC 1 failure code. However, the flight crew had already intervened and taken manual control of the system at 1148:29. Bench testing of CPC 1 reproduced the fault with and without the CPC 1 pressure sensor module, which isolated the fault to the CPC 1 main circuit board. The fault could not be isolated any further.

From the test results, the ATSB noted that if the flight crew had selected CPC 2 (manual changeover) during the initial period of cabin pressurisation system 1 fault messages, the subsequent alerts and emergency descent would have been avoided. Airbus have reviewed the incident flight faults and elected to amend the A320 Quick Reference Handbook to provide further instructions to flight crew as to when it would be appropriate to manually change the active the CPC, rather than rely on automatic change (see Safety issues and actions).

With respect to the passenger oxygen masks the ATSB analysed:

A high percentage of passengers that responded to the survey indicated that they had given their attention to the operator’s safety information card and safety demonstration. They also reported the safety information card was easy to understand. However, despite the generally high positive response to the safety information presented, a number of respondents reported they were not confident in using the oxygen masks and a high number of respondents reported that oxygen was either not flowing, or could not tell if it was flowing (this number was far greater than the number of oxygen units that malfunctioned).

The operator’s safety information included the instruction to ‘Pull the mask down towards you’. This was the required action to start the flow of oxygen, which was consistent with several published standards for passenger safety briefing. However, as it did not state that this action would start the flow of oxygen, there was a risk that passengers would not understand the association.

The ATSB analysed with respect to cabin crew:

During the emergency descent, the cabin crew were confronted with passengers acting in an unexpected manner when they moved about the cabin to obtain spare oxygen masks. This resulted in the cabin crew improvising their instructions to passengers and shouting commands, such as ‘GET DOWN’ and ‘BRACE’, which were appropriate for a crash landing or ditching, but unnecessary for a controlled descent to 10,000 ft. This suggested the operator’s current standard of assessment criteria, strictly against the published procedures, might not be adequate for scenarios that are more complex.