Description

On 13 July 2018, a Boeing 737-800 (EI-EMN) being operated by Ryanair on an international passenger flight from Dublin to Zadar, Croatia as FR7312 was in the cruise at FL 370 in night VMC when a sudden loss of pressurisation occurred and an emergency descent was initiated with the malfunctioning outflow valve (OFV) closed but when this valve was manually reopened at FL090, a second rapid decompression occurred. After a diversion to Hahn it was found that two cabin crew and up to 41 of the 190 passengers had sustained minor injuries and required medical assistance, some receiving this at the airport, others at four local hospitals.

Investigation

On being promptly advised of the event, the German Federal Bureau of Aircraft Accident Investigation (BFU) sent an “external expert in field investigation” to Hahn Airport and the following morning two BFU employees also arrived there. Once it was realised that the event had occurred in French airspace, the French Bureau d’Enquêtes et d´Analyses (BEA) was notified and formally delegated the Serious Incident Investigation to the BFU. The CVR and FDR were both removed and their data were successfully downloaded. The QAR was also available and both cabin pressure controllers were removed from the aircraft and read out at the OEMs facilities in the presence of a BFU representative.

 

The 29 year-old Captain, who had been acting as PF when the event occurred, was a UK citizen with a total of 4,867 hours flying experience, all but 220 hours of which had been on type. The 36 year-old First Officer was a Croatian citizen with a total of 2,447 hours flying experience, all but 203 hours of which had been on type. It was noted that the two pilots had worked together on all their flights on the day of the event as well as on the previous two days.

What Happened

Recorded flight data showed that with the aircraft level at FL 370 and tracking south east and the cabin altitude showing 7,925 feet, the OFV began to move over a nine second period from the 18° open position to fully open (104°) without any input from the fight crew. The crew noticed a drop in cabin pressure after 4 seconds and the Cabin Altitude Warning was annunciated two seconds later as the cabin pressure altitude reached a recorded 9,470 feet. Both pilots reported that the pressure drop had resulted in them having “significant hearing problems” and had seen at that time that the indicated cabin pressure was increasing at a rate of more than 4,000 fpm. They were unable to recall the indicated position of the OFV or the status of the system auto fail and alternate lights.

At a cabin pressure altitude of 13,153 feet, ten seconds after the OFV had begun to open, the pressure switch was triggered and the OFV then began to close automatically with a speed of about 19° per second until it reached an opening angle of 18°. At this point, both pilots had donned their oxygen masks and begun to complete the memory items for a rapid decompression. They reported that making system status changes became temporarily more difficult than expected because their masks were partially misted over and there was initially no verbal communication. At the same time the cabin altitude warning sounded and over a period of approximately 25 seconds, the position of the OFV then oscillated between 18° and 28° open four times as the cabin altitude increased to a recorded 14,639 feet. 

Half a minute after the OFV had begun to open, the First Officer switched the OFV control to manual and proceeded to set it to 9.3° open which stabilised the cabin altitude. The Captain then made a PA address consisting of “Emergency Descent” and repeated it twice before immediately initiating this decent. The First Officer then made a MAYDAY call announcing the emergency descent to Reims ACC and the intention to continue it until reaching FL100.   

A minute after the emergency descent had begun, the OFV was manually closed completely and over the next 12 minutes the cabin altitude decreased at a maximum of 3,300 fpm. Shortly after this, ATC instructed the flight to turn left onto a heading of 050° and asked about the crew’s intentions. They confirmed their intention to continue to F100 and requested a MSA relevant to the new heading and subsequently had a request to descend to 9000 feet approved.  

Just over three minutes after the  emergency descent had begun, the First Officer reached and actioned items 3 and 4 of the ‘Cabin Altitude Warning or Rapid Decompression’ Checklist: which respectively required the selection of manual pressurisation control and holding the OFV switch at the ‘CLOSE’ position until the valve indicated fully closed. The flight was then transferred to Langen Radar where the controller was advised of the crew intention to divert to Frankfurt. 

As the aircraft descended through FL 190, the (indicated and actual) cabin altitude passed below mean sea level but when the aircraft subsequently passed FL 100, the Captain was recorded saying that the cabin altitude was 24 000 feet and “coming down slowly......basically, I’m not too sure why we had this depressurisation”. The Captain instructed the First Officer to take over as PF and then added “now it says the cabin altitude is climbing - it says 33,000 feet......what we have to do is open the valve completely......to depressurise.” 

On levelling at FL090, the cabin altitude was actually about 7,000 feet below sea level with the maximum cabin differential pressure at this time 8.72 psi with both Pressure Relief Valves in the open position. As a result of the Captain then opening the OFV completely, the cabin altitude immediately increased at a maximum rate of about 20,000 fpm to reach same altitude as the aircraft. Both pilots then removed their oxygen masks.

Shortly after this, the SCCM called on the interphone from the cabin and advised that both the cabin crew and passengers were using oxygen masks and that everyone was “more or less okay”. The Captain then conducted a NITS briefing with the SCCM during which he was told that one of the cabin crew at the rear of the cabin had reported a loud hissing sound and on asking if am emergency evacuation would be necessary after landing was assured that this would not be necessary.

The Captain then advised ATC that he was downgrading the flight status from MAYDAY to PAN and, after requesting and receiving the weather conditions at Frankfurt Hahn airport and confirmation that it would be open, advised that he wished to divert the flight to that airport rather than Frankfurt am Main as previously requested and this was approved. He explained to the First Officer that since Hahn was a Ryanair maintenance base and it appeared that a malfunction of the OFV had caused the depressurisation, it made sense to divert there. Having been advised that there was one passenger whose ear was bleeding, he then asked ATC to communicate a request to Hahn for an ambulance to meet the aircraft on arrival which was done.

The flight ground track following the initial sudden pressurisation loss and diversion to Hahn. [Reproduced from the Official Report]

As the aircraft continued towards Hahn, the Captain was recorded noting that the OFV was “now completely open... very strange because cabin altitude reached over 30,000 feet” to which the First Officer responded with “I know, how did that happen?”. The approach to runway 03 at Hahn was without further event and the aircraft landed there 35 minutes after the sudden depressurisation had occurred.

The Investigation was “unable to determine the final number of injured persons because different sources reported different numbers”. Airport RFFS personnel documented 15 patients as treated on site and another 28 taken by rescue vehicles to four different hospitals. The final Police report of the event stated that the total number of injured people was 33. To the extent that facts could be determined, it appeared that nobody suffered a ruptured eardrum and it appeared that all passengers taken to hospitals were treated as Accident and Emergency Outpatients.

Why It Happened 

Automatic control of the position of the OFV is achieved by Cabin Pressure Controllers (CPC) which detect actual cabin pressure. Two CPCs are installed with one actively controlling the OFV position and the other remaining on standby for each flight with the active controller changing between successive flights. The active controller in this case was CPC2 and it was a malfunction of this controller which caused the initial decompression. Closing the OFV manually allowed the cabin pressure to increase but when the emergency descent was conducted, the OFV remained closed rather than its position being managed as required. The Emergency Descent Checklist ‘Deferred Items’ included one on manually controlling cabin altitude during the descent by “moving the OFV switch to OPEN or CLOSE as needed to control cabin altitude and rate” but this was ignored. On completion of the descent, the Captain then inadvertently created the second and more rapid depressurisation event by manually moving the OPV position from fully closed to fully open. This action appeared to have initially focussed on the cabin rate of change indication rather than the indicated cabin altitude whereas reference to the latter was essential to achieve manual pressurisation control. It was concluded that passenger injuries had most likely been caused by the extended re-pressurisation phase between the two decompressions. The following two illustrations compare the cabin and aircraft altitudes with the cabin pressure rate of change, the position of the OFV and the cabin differential pressure.   

The aircraft/cabin altitudes compared with the cabin pressure rate of change and the OFV position. [Reproduced from the Official Report]

The aircraft/cabin altitudes compared with the cabin differential pressure [Reproduced from the Official Report]

Recorded flight data showed that it was a false signal from the active CPC2 which had caused the un-commanded opening of the OPV which had led to the initial depressurisation of the aircraft. The component OEM was able to show that the CPC2 had been subject to a transient fault identified as a ‘Single Event Upset’ (SEU) which had affected the normal functioning of its semi conductor components. It was stated by the OEM that such faults are very rare (one occurrence per 28.4 million flight hours) and do not result in any detectable damage to the equipment concerned. They also concluded that only “2.7% of all rapid decompression occurrences were the result of CPC malfunctions caused by a SEU”. Such rarity meant that aircraft type certification requirements for reliability were comfortably met and the manual control option if correctly used provides a means for a crew to manage pressurisation if the normal automated control fails. Of course, the crew must do this by managing the achieved cabin altitude based on regular reference to the available display of it.

As a context for the mismanagement of manual pressurisation beyond the fact that it occurred at night and that at first condensation on the pilots’ oxygen masks had impeded their vision, the Investigation considered that the position and design of the Cabin Pressure Control panel (see the illustration below) made it relatively difficult for pilots to correctly recognise the indications provided. It was also observed that the pointer of the (analogue) cabin altitude indicator did not have zero dead stop. This meant that if, as happened, the cabin is operated with positive pressure i.e. is below sea level, then the pointer will move counter clockwise towards/into the other end of the scale which represents high cabin altitudes. It was considered that although aircraft are not often intentionally operated with cabin altitudes below sea level, the indication provided “should not allow any misinterpretation”.

The cabin altitude indication panel. [Reproduced from the Official Report

The absence of any aural or visual alerting of “abnormal configurations of the pressurised cabin” which could usefully have been linked to a fully open OFV during cruise flight, a cabin altitude below sea level during descent and cabin differential pressure at maximum was noted. Without such alerting, it was considered that detection of these conditions during a depressurisation event would be dependent on pilots’ active attention at a time when they are likely to be busy. 

The response to the arrival of the diverted flight at Hahn in respect of the treatment of those on board was reviewed and overall was considered to have been poorly performed by both the Airport and other agencies involved. No indication of the extent to which aircraft occupants might need medical assistance was communicated to the flight crew and could therefore not be passed to ATC. To the extent that relevant information was passed to ATC, it was not then shared with the airport RFFS. Airport management did not call in additional rescue personnel until after boarding the aircraft on arrival and recognising the extent of the task. 

Once the airport RFFS had recognised the scale and nature of medical assistance required, their communication of a large number of casualties and the nature of the medical assistance to the regional rescue coordination centre was not acted upon. As a result, it was over an hour after the aircraft arrival before sufficient rescue personnel were on site to respond to the situation in a structured manner and in particular to begin the medical classification of the injured passengers. Specialist (ear nose and throat) medical expertise was required in order to make final assessments of their condition and appropriate response. Once this was clear, there were no local hospitals with such expertise and so it “became necessary to transport passengers to hospitals which were up to (the equivalent of) 60 miles away”. It was also found that the aircraft operator’s Operations Control Centre was not kept properly informed by “the responsible Airport Ground Operations Manager” who had been tasked to do this but had only passed on “incomplete information” infrequently. Had this communication task been done properly, it was considered that the aircraft operator would have been able to contribute to a more timely and optimised response to the situation presented upon the flight’s arrival. Finally, the Investigation noted that the airport’s ICAO standard emergency response plan was not applied (or applicable) “because there was no occurrence scenario with large quantities of injured persons without the simultaneous aircraft accident on airport operating areas”.  

The formally-stated Cause of the investigated event was recorded as an abnormal command by the aircraft Environmental Control System to fully open the Outflow Valve during cruise flight at FL 370 because of a ‘Single Event Upset’ in the active Cabin Pressure Controller.  

Safety Action in response to the event was noted to have included the following:

Ryanair modified its recurrent simulator training for pilots so that the use and interpretation of the indications of the ECS Digital Selector Panels were more effectively covered. In addition, a training scenario was implemented in the recurrent training programme in which the pressurised cabin re-pressurises during the subsequent emergency descent requiring the flight crew to react accordingly. 

Hahn Airport staff in conjunction with staff of the local health care provider re-enacted the event scenario during an ICAO emergency training exercise in May 2019. This focussed, among other things, on patient classification, mission documentation and patient transport. Measures were then implemented to optimise the emergency response should a similar occurrence happen again.

The Final Report was completed on 17 June 2022 and published online in August 2022. In the light of the recorded response to the event by both the aircraft operator and in respect of the emergency response arrangements at the diversion airport, no Safety Recommendations were deemed necessary.

Related Articles

• Loss of Cabin Pressurisation
• Cabin Altitude
• Aerodrome Emergency Medical Response
• Rescue and Fire Fighting Services
• Medical Emergencies - Guidance for Flight Crew
• Contingency Planning
• Cockpit Automation - Advantages and Safety Challenges