Alone in the Inferno: The crash of UPS Airlines flight 6
On the 3rd of September 2010, a UPS Airlines Boeing 747 freighter declared an emergency at 32,000 feet above the Persian Gulf, reporting the outbreak of every cargo pilot’s worst nightmare: a fire on the main deck. As the crew steered their aircraft back toward Dubai, the situation progressively escalated, as smoke filled the cockpit and the flight controls began to fail; and then the captain lost his oxygen supply and collapsed, leaving the first officer alone at the controls of a crippled leviathan. Unable to see his instruments or retune his radios, he attempted to line up to land at Dubai, but he never made it. As systems failed left and right, the 747 overflew the airport, turned, and crashed into the Emirati desert, claiming the lives of both pilots, despite First Officer Matthew Bell’s heroic attempts to save the stricken airplane.
The cause of the deadly fire would later be traced back to a now-familiar suspect that was not as well known in 2010: the plane’s cargo, consisting of hundreds of kilograms of lithium batteries. The batteries come in all shapes and sizes, and today they power almost everything you own, forming part of the backbone of the global economy. But the aviation industry had yet to fully address the fact that lithium batteries are not only big moneymakers, but are also incredibly reactive, contain highly corrosive chemicals, and can start fires that will quickly overcome an airplane’s fire protection systems. The crew of UPS flight 6 were thus faced with a nightmare scenario in which their own cargo relentlessly hunted them down, throwing one curveball after another, until it eventually overcame the First Officer’s superhuman effort to survive. The fate of the UPS crew unsettled the airline industry, which became even more alarmed after a battery fire brought down another Boeing 747 off the coast of Korea the following year. Safety authorities were left with a pressing question: what was to be done about this ubiquitous hazard endangering air cargo around the world? It ultimately took years to get the ball rolling, but a quiet transformation has since taken place in the way we fly batteries.
◊◊◊
Over the course of the 21st century so far, the global economy has increasingly become dependent on the miraculous invention known as the lithium battery. In the years since the technology became commercially viable, lithium batteries have proliferated into all manner of gadgets, enabling the recent revolution in fields like drones and handheld devices. In fact, if you’re reading this, then there’s probably a lithium battery within arm’s reach of you right now. And it’s also likely that that battery was manufactured somewhere other than where you live, which means it was at some point transported to you by land, sea, or air.
Not all of the products that feed our consumer society are economical to ship by air — clothing, for instance, is usually not — but lithium batteries certainly are, thanks to their high value and high demand. Such batteries have been transported by airplane for as long as they have existed, and that’s unlikely to change anytime soon, as the number produced continues to rise with every passing year. In 2007, three billion lithium batteries were manufactured annually, but by 2017, that number had risen to seven billion — one for every person on earth — and that rate has only continued to increase into the 2020s. Most of these batteries will never see the inside of an airplane, but millions of them will, with a collective energy content that defies comprehension.
With a fleet of 290 mostly wide body freighters and over 800 scheduled destinations, UPS Airlines, the air division of the American shipping company United Parcel Service, Inc., carries more lithium batteries every day than is worth counting. And for many years it did so without incident, until the evening of September 3rd, 2010.
It was on that date that a UPS Airlines Boeing 747–400F purpose built freighter registered as N571UP arrived at Dubai International Airport after a long-haul flight from Hong Kong. All 32 cargo pallet positions were full of consumer goods destined for foreign markets, of which six pallets were unloaded in Dubai and replaced. Like the rest of N571UP’s cargo, these new shipments were bound for Cologne, Germany.
The list of products loaded into the 747’s cargo hold would stretch for pages, but as usual, there were plenty of lithium batteries scattered throughout. The total number of lithium batteries aboard is difficult to say, but it was not less than 80,000, including hundreds of generic battery packs, thousands of mobile phones, hundreds of laptop batteries, dozens of electric vehicle batteries, and a single gargantuan shipment of 54,800 coin-type watch batteries. These collectively amounted to at least 400 kilograms of lithium metal batteries and two tons of lithium ion batteries. Not all of these items were clearly labeled and the exact quantity on board was ultimately never determined. UPS Airlines carries a significant amount of bulk freight that is packaged for transport by the shipper without direct supervision by the airline. For such goods, it’s the shipper’s responsibility to label the contents of each shipment and apply the appropriate hazard and handling labels, as UPS has no means by which to directly verify what’s in, for instance, a plastic-wrapped pallet under a rain cover. And as it turns out, there were plenty of dangerous goods contained the shipments from Hong Kong — many of which were not properly labeled.
In 2010, as is the case today, most lithium batteries were considered Class 9 (“Miscellaneous”) Hazardous Materials under international hazmat regulations, requiring strict labeling and handling protocols.
The specific hazards associated with these batteries are multifarious and depend in part on the specific type of lithium battery in question. Arguably the most dangerous are lithium metal batteries, which are typically used to power devices that need to draw low amounts of power while lasting for a very long time. Lithium metal batteries can be found in everything from watches to the location pingers on aircraft flight recorders, and although they are often small in size and energy content, tens of thousands of them in one place can pack quite a punch. The large majority of the lithium batteries loaded on N571UP were lithium metal. Most of the rest were lithium ion batteries — a term sometimes used incorrectly to refer to all lithium-based batteries — which are only marginally less hazardous. Typical lithium ion batteries can be found in personal electronic devices and rechargeable battery packs, among many other items. Other types of lithium batteries also exist, including lithium polymer and lithium iron phosphate, but these are beyond the scope of this article.
The most dangerous feature of both main types of lithium batteries is their vulnerability to thermal runaway. Severe damage, overheating, or short-circuiting can set off an internal chemical reaction that produces vast quantities of heat energy and flammable gases. Until the battery’s chemical energy is expended, this reaction is essentially unstoppable short of sealing the battery in concrete. And because overheating can initiate this reaction, one battery experiencing thermal runaway can cause adjacent batteries to enter thermal runaway as well, triggering a devastating chain reaction that will continue almost indefinitely as long as there are batteries left to consume. This process is accompanied by intense fire that can burn well in excess of 2,000˚C, and typical fire extinguishers are all but useless against it. CO2 will make a lithium metal fire worse because the lithium will split the C from the O2, creating oxygen that accelerates the blaze. Halon gas is also ineffective because while it will put out the flames, it won’t stop the thermal runaway and won’t prevent the chain reaction from expanding, so the fire will simply re-erupt once the Halon disperses. Depriving the fire of oxygen will fail for the same reason. And to make matters worse, the reaction can cause flammable gases to build up inside the battery until it explodes, launching projectiles that can spread the fire and damage containment structures.
◊◊◊
The crew of two pilots who arrived at Dubai International Airport to operate N571UP on its next leg, flight 6 to Cologne, were likely aware that the flight manifest contained many lithium batteries marked as “hazardous,” even though others were not marked, and they might even have been vaguely aware of the fire risk that the batteries posed, but the quantity aboard was not extraordinary and it’s unlikely that anything about the manifest grabbed their attention. The pilots were probably more concerned by a report from the previous crew about an in-flight failure of one of the 747’s three air conditioning packs, pack №1, which threw a fault but resumed functioning after being reset. Mechanics were unable to reproduce the failure on the ground, but the issue was not serious, and the crew understood that if it recurred they could simply reset it again.
The only crewmembers on flight 6 were the two pilots, consisting of 48-year-old Captain Doug Lampe, who had around 11,200 flying hours including 4,000 on the Boeing 747; and 38-year-old First Officer Matthew Bell, who had 5,500 hours but had only just transferred to the 747, accumulating a mere 77 hours on type. Both were by all accounts ordinary men and competent pilots, who would nevertheless soon find themselves thrust into a truly extraordinary situation.
At 18:51 local time, as dusk fell over the United Arab Emirates, flight 6 departed Dubai and began to climb over the Persian Gulf, heading for its cruise altitude of 32,000 feet. The climb progressed normally with First Officer Bell at the controls, flying manually until he engaged the autopilot at 11,000 feet. At around that same time, the earlier reported fault with air conditioning pack 1 returned, generating a failure message on the Engine Information and Crew Alerting System (EICAS) display, which aggregates warning, caution and advisory information concerning aircraft systems. The procedure accompanying the message instructed the crew to reset Pack 1, which they did, and normal functioning resumed.
It was at some unknown time thereafter — perhaps even as the pilots dealt with the pack failure — that a lithium battery somewhere in the vicinity of cargo positions 4 and 5, located behind and below the cockpit, presumably entered thermal runaway. Where exactly this battery was located, what type of battery was involved, and how it failed are all beyond even speculation. The pallets in these positions contained various unidentified and improperly labeled electronics; mobile phones; laptop power packs; and laptop power adapters, most of which contained lithium ion batteries. The originating battery could have failed due to rough handling, it could have been manufactured improperly, it could have been induced to failure by acoustic effects, or it could have short-circuited due to improper packaging — we just don’t know. All that’s known for sure is that once one battery failed, the density of batteries was likely such that an unstoppable chain reaction followed, culminating at 19:12 and 54 seconds, when smoke detectors in the cargo hold tripped and a fire bell sounded in the cockpit, accompanied by a fire warning light and an EICAS message reading, “Main Deck Fire Forward.”
Immediately in response to the warnings, Captain Lampe said, “Fire, main deck forward. Alright, I’ll fly the aircraft.”
“Okay,” said First Officer Bell.
“Go ahead… we’re gonna return,” Lampe decided, making the prudent choice to cut the flight short. “I got the radio, go ahead and run [the checklist],” he added.
Two seconds later, Lampe radioed the regional air traffic control center in Bahrain and said, “Just got a fire indication on the main deck, I need to land ASAP.”
“Doha at your ten o’clock at one hundred miles, is that close enough?” the controller replied. Flight 6 was at this time over the middle of the Persian Gulf, and Doha, capital of Qatar, had the closest airport of any size.
But instead, Captain Lampe said, “How about we turn around and go back to Dubai, I’d like to declare an emergency.”
“UPS six, make a right turn heading zero nine zero, descend to flight level two eight zero,” said Bahrain.
In response to the clearance, Lampe immediately instructed the autopilot to turn right and descend from 32,000 to 28,000 feet.
Although Dubai was substantially farther away than Doha in terms of track miles, Captain Lampe didn’t provide a reason for his decision to divert there. Investigators would later consider a number of theories, which will be discussed later.
Meanwhile, First Officer Bell retrieved the non-normal checklist for a main deck fire. Steps one and two called for the crew to don oxygen masks and establish communication, which they did, retrieving their masks from beside their seats and setting up the internal microphones, with some difficulty. Notably, crew oxygen masks can be set to “Mix,” which adds oxygen to filtered ambient air, or “100%,” which supplies pure oxygen. In a fire or smoke event, setting the masks to 100% is preferred so as to minimize the possibility of smoke entering the mask, but the checklist did not specifically remind the crew to do this, and it’s thought that Bell’s mask was likely set to “Mix” for the rest of the flight.
Moving forward, however, the fourth item on the fire checklist was to activate the 747’s main deck fire suppression system by arming the Main Deck Cargo Fire switch.
The Boeing 747–400F does not have active fire suppression on the main deck; instead, the pilots can depressurize the cargo area to starve a fire of oxygen. Arming the fire switch starts this process by shutting down air conditioning Packs 2 and 3 and cutting off ventilation air into the cargo area. Subsequently, activating the Cargo Fire Depressurization/Discharge switch will open the pressure relief valves in the main deck, allowing the air pressure to escape and the interior equivalent altitude to increase at a rate of 9,000 feet per minute. The checklist then calls for the flight to climb or descend to 25,000 feet, where the outside air has insufficient oxygen to reliably sustain combustion.
At the same time, air conditioning pack 1 should continue to supply some ventilation air to the cockpit area, creating a positive pressure gradient between the cockpit and the main deck. This pressure gradient prevents smoke from seeping into the crew areas via gaps and vents in the aircraft structure, as the prevailing airflow will be out of the cockpit, not into it.
Following the procedure to the letter, First Officer Bell armed the main deck cargo fire switch, then moved the specific pack control selectors for packs 2 and 3 to the “off” position, as called for in step 5. This step was essentially redundant but was included in order to provide extra assurance ventilation to the cargo area would actually be shut off.
Unfortunately, this procedure left the positive pressure shield dependent on air conditioning Pack 1, the one with the intermittent fault. And in fact, about one minute after Bell selected packs 2 and 3 off, pack 1 also shut down, presumably due to the same error as before. Under normal circumstances, the failure of pack 1 without any other packs active would have caused pack 3 to be automatically restored, maintaining airflow to the cockpit, but this could not happen if the pack 3 switch was specifically selected to “off.” As a result, the failure left the aircraft with no active ventilation system and no smoke barrier between the cockpit and the cargo area.
Although the failure of pack 1 would have generated an EICAS message, the pilots’ attention was swiftly drawn elsewhere, as an additional fire bell sounded with the warning “Fire Main Deck Aft.” On the radio, Captain Lampe now said, “I need a descent down to ten thousand right away sir,” despite the fact that the checklist called for them to remain at 25,000 feet. The reason for his request is again uncertain. But in any case the controller replied, “Descend and maintain one zero thousand at your discretion.”
As he pushed the plane into the descent, Lampe repeatedly disconnected and re-engaged the autopilot, testing out the controls, and he began to realize that something was terribly wrong. When he tried to push the nose down in manual flight, the elevators did not respond normally, prompting him to exclaim at time 19:15, “Alright, I’ve barely got control.”
“I can’t hear you,” said Bell, who was still struggling with communication through the oxygen mask.
“Alright… find out what’s going on, I’ve barely got control of the aircraft,” Lampe repeated.
Control over the elevators on the Boeing 747 is accomplished using a traditional system of cables and pulleys linking the pilots’ control columns to hydraulic actuators in the tail. The Captain and First Officer have redundant but interlinked cable systems, such that moving either control column moves both sets of cables. This allows both columns to continue functioning in the event of a cable failure on either side.
On flight 6, it’s believed that by the time Lampe observed control difficulties, about two thirds of the way through the turnback, the intense fire in the cargo hold had already burst through the cargo hold liner — more on that later — and was impinging upon critical systems, including the pilots’ control cables. When heated, the steel cables lose tension and fall slack; alternatively, the fire could have melted the cable mountings, which would have the same effect. Flight recorder data would later show that the First Officer’s cables had fallen so slack that even full deflection of the control column could not produce any elevator movement. However, Captain Lampe’s cables had an automatic tension regulation device as an extra layer of redundancy, and it’s believed that both sets of controls retained some functionality thanks to this feature. However, even this measure was unable to completely overcome the slack introduced by the intense heat of the blaze, and Lampe needed to move his control column a considerable distance before any elevator movement could occur. And although he made no comment on it, rudder control was also lost at around the same time, likely for the same reason.
As the pilots attempted to understand the problem, Captain Lampe said again, “I have no control of the aircraft.”
“Okay, what?” said Bell.
“I have no pitch control of the aircraft,” said Lampe.
“You don’t have control at all?” Bell asked.
Lampe demonstrated by pushing his control column to the full nose down stop, with minimal response from the airplane. “I have no control of the aircraft. I have no pitch control of the aircraft,” he repeated.
By this point, the lack of positive pressure from pack 1 had allowed a considerable volume of smoke to seep into the cockpit, which was rapidly densifying before the pilots’ eyes. Just before 19:17, alarmed by this development, Captain Lampe said, “Pull the smoke handle.” This comment referred to the handle to open the smoke shutter, located in the cockpit ceiling, which would allow smoke to vent to the atmosphere. Unfortunately, training had failed to emphasize that the smoke shutter should only be used to evacuate smoke after a fire is extinguished, which this fire plainly was not, as additional fire warning zones were tripping every minute. If smoke is still being produced, then opening the shutter to the atmosphere will create a negative pressure gradient between the cockpit and the main deck, actually drawing more smoke up into the crew area. It’s therefore quite likely that this decision accelerated the rate of smoke accumulation, even though the smoke would eventually have filled the cockpit anyway.
Indeed, seconds later, Lampe called Bahrain and said, “UPS six, we are full… the cockpit is full of smoke, attempting to turn to flight, to one thirty please have [men and equipment] standing by in Dubai.” Turning to First Officer Bell, he added, “Can you see anything?”
“No, I can’t see anything,” Bell replied. The black, caustic smoke was already interfering with the pilots’ ability to see what they were doing, and it would only get worse from there.
At that moment Captain Lampe made a critical decision that would hopefully help save the flight: he turned the autopilot back on. On the Boeing 747–400, the autopilot doesn’t use control cables to move the elevators; instead, it sends an electrical signal directly to the hydraulic quadrant at the rear of the aircraft. Electrical wiring doesn’t need to be kept in tension, so the wires carrying these signals had a much greater heat tolerance than the control cables did, and in fact the autopilot would continue to function normally until the end of the flight for this reason. The continued functioning of the autopilot also allowed the crew to potentially solve another developing problem, which was that they would be unable to see the runway due to the smoke in the cockpit. With the autopilot engaged, the Boeing 747–400 is capable of performing a full auto-landing, guiding the plane all the way to touchdown with sufficient precision to land in zero visibility. Therefore, as long as the crew could enter the frequency for the instrument landing system on runway 12 Left at Dubai and maneuver the aircraft to intercept it, they would be able to land even if they were unable to see. To that end, Captain Lampe said, “Try and get Dubai in the flight management system.”
“I can’t see it,” said Bell. The smoke was making it almost impossible to determine what was on the flight management display or what he was entering.
“What’s frequency?” Lampe asked. “Okay. I’m just leveling out.”
“You’re level at twenty two thousand,” said Bell.
“Okay. I’m just trying to see…”
“Can you — you’re level at twenty two thousand,” Bell repeated.
“Let’s just get a uh… straight-in to twelve left,” said Lampe. Runway 12 Left was most closely aligned with their present heading and they would be able to reach it with minimal maneuvering.
“Twelve left, okay,” said Bell. Seconds later, despite barely being able to see what he was doing, Bell somehow managed to enter the frequency for the runway 12 Left instrument landing system (ILS) into the flight management computer. With the frequency in place, the pilots would be able to arm the autopilot’s approach mode, allowing the aircraft to detect the ILS signal and automatically follow it down to the runway. But that still left the question of how they were going to maneuver to intercept the signal in the first place, because the ILS beam only exists within a narrow corridor extending upward and outward from the runway axis. If they failed to maneuver the aircraft into the beam at the right speed and intercept angle, then they would overshoot, and all would be lost.
Unfortunately, a turn of events just one minute later made success much less likely, when at 19:19 and 56 seconds, Captain Lampe said, “I’ve got no oxygen.”
“Okay. Keep working at it, you got it,” Bell said.
“I got no oxygen. I can’t breathe,” Lampe repeated.
“Okay, okay,” said Bell. “What do you want me to get you?”
Unlike passenger oxygen masks, flight crew masks can deliver oxygen for two hours or more, so Lampe’s problem was not that he was running out. Instead, the fire had begun to impinge upon a flexible hose connector that formed part of the distribution system from the common crew oxygen supply to the captain’s side mask, causing it to fail. With no oxygen flowing from his mask, Lampe’s only option was to retrieve the backup crew mask and oxygen bottle from its stowage cabinet behind the jump seat at the rear of the cockpit.
To that end, Lampe replied to Bell’s question with a single word: “Oxygen.”
“Okay,” said Bell.
“Get me oxygen,” Lampe choked.
“Hold on okay, are you okay?” Bell asked.
“I’m out of oxygen,” Lampe repeated.
“I don’t know where to get it,” Bell replied. Although the location of the emergency oxygen equipment had likely been covered in training, Bell’s inexperience on the Boeing 747 and the extreme stress of the emergency may have prevented him from recalling the information.
Finally, Lampe decided he had to take action. Rising from his seat, he said, “You fly,” and for the first time since the emergency began eight minutes earlier, First Officer Bell took the controls. Then came the hardest part: to reach the area where the emergency oxygen was stored, Lampe would have to remove both his mask and his smoke goggles, exposing himself directly to the toxic atmosphere. If he breathed in, he risked inhaling deadly gases such as carbon monoxide, hydrogen cyanide, hydrogen fluoride, and no doubt many others.
In the background, the cockpit voice recorder captured Captain Lampe moving about, searching blindly for the storage cabinet containing the mask, but his luck ran out. His last words, captured at 19:20 and 41 seconds, were “I can’t see.” After that, he was never heard from again.
◊◊◊
From that moment, First Officer Matthew Bell found himself in a waking nightmare. He was alone in the cockpit, with 77 hours on type, a raging inferno burning below decks, and an atmosphere so choked with toxic smoke that he couldn’t see his hand in front of his face. The manual flight controls were barely working and he was unsure of their position. His oxygen mask was still set to “Mix” and its built in filter was struggling to keep out the noxious fumes. And as though Satan himself were orchestrating his fate, things were about to get even worse.
Just seconds after Captain Lampe’s disappearance, the area controller in Bahrain recognized that flight 6 was approaching the boundary with the Dubai area control sector, so he called to provide the Dubai radio frequency. If flight 6 didn’t contact Dubai soon, it would fly out of VHF radio range of Bahrain, at which point communication would become impossible. But First Officer Bell couldn’t change frequency because he couldn’t see his radio in order to tune it. For the same reason, he was also unable to use any long range communication systems, such as HF radio, that would allow him to continue communicating with Bahrain Center. At 19:21 and 24 seconds, Bell summed up his predicament: “Sir, we’re gonna have to stay with you, we cannot see the radios,” he said.
In order to get around this problem, the Bahrain controller immediately selected an aircraft that was in range of both Bahrain and UPS flight 6 to act as a relay between them. That meant that Bell would have to narrate his requests to another flight crew, who would then repeat the transmission to air traffic control; the controller’s replies would then have to reverse this chain on the way back. But as soon as flight 6 passed beyond the boundaries of the Bahrain sector, it flew out of radar range as well. That meant that the Dubai area control center was now the only facility with direct knowledge of the flight’s position, altitude, speed, and heading, but Dubai could not speak directly to the emergency aircraft. Air traffic control centers have strictly defined radio frequencies in order to prevent confusion, and the Dubai controllers couldn’t simply broadcast on the Bahrain frequency because their equipment was not even tunable. Therefore, the only way to guide flight 6 to the ILS intercept point was for Dubai to observe the flight on radar, then pass its position information to Bahrain via landline, who would in turn pass it to the relay aircraft, who would finally pass it to Bell. Then, when it came time to clear flight 6 to land, an additional link had to be added to the chain, since landing clearance could only be issued by the Dubai Tower, which had a landline connection to Dubai Center but not to Bahrain Center. To make matters even worse, relay aircraft also frequently flew out of mutual radio range of both parties, forcing Bahrain to apprise the entire situation all over again to a new relay flight crew every couple of minutes. And with so many parties involved in the chain, this unwieldy setup quickly turned into the telephone game from hell.
(Above: A schematic of the relay communication setup.)
First Officer Bell was now in a position where he was just barely able to see the altitude and heading inputs he was making to the autopilot, but he was unable to see any of the instruments to determine how the airplane was responding. He was also unable to determine his distance from the runway. All of this information had to pass through three or four different people before it could reach him, and along the way, much critical information was lost. The controllers and relay planes also clearly did not appreciate the severity of the situation and were unaware that Bell was alone at the controls. The intractability of his situation and Bell’s mounting frustration are both evident in the following extended excerpt from flight 6’s cockpit voice recording:
19:26:06 — Bell: What is my current altitude?
19:26:09 — SkyDubai 751: Okay ah UPS six current ah nearest airport is Dubai ah Bahrain what is the current altitude of UPS six?
19:26:23 — SkyDubai 751: Okay uh but now ah he is at one one thousand confirm?
19:26:28 — SkyDubai 751: Yes UPS six you are at one one thousand feet nearest airport is Dubai.
19:26:33 — Bell: Nearest airport is how far?
19:26:36 — SkyDubai 751: Ah Dubai. Standby. How far from ah Dubai from the aircraft Bahrain?
19:26:42 — SkyDubai 751: Standby please.
19:26:43 — Bell: Sir you’re gonna need to work faster give me a heading direct to the runway at Dubai and give me immediate vectors.
19:26:51 — SkyDubai 751: Okay Bahrain say again please?
19:27:25 — SkyDubai 751: Bahrain Sky Dubai seven five one?
19:27:29 — SkyDubai 751: UPS request — UPS six request radar vectors to the runway using Dubai, direct vectors runway using Dubai.
19:27:41 — SkyDubai 751: Alright UPS six just standing by for a while please.
19:27:44 — Bell: Sir give me a heading right now what is my current heading?
19:27:51 — Bell: Sir give me a give me a frequency now.
19:27:55 — SkyDubai 751: Okay ah Bahrain ah UPS asked for a frequency now.
19:28:12 — SkyDubai 751: Okay UPS six you are seventy eight miles from Dubai runway one two, frequency now one one eight seven five.
19:28:26 — SkyDubai 751: Okay now we understood okay Bahrain he cannot see the radio he must keep the ah ah frequency and he asked for current altitude and vectors to runway one two.
19:28:42 — SkyDubai 751: Okay your current altitude UPS six is niner thousand and fly the present heading.
19:28:48 — Bell: Okay fly present heading niner thousand roger
19:28:52 — SkyDubai 751: Say again UPS six?
19:28:55 — Bell: I said I’m flying the current heading my heading reads as one zero five and my altitude reads as one zero thousand what do you see for an altitude?
19:29:05 — SkyDubai 751: Okay Bahrain, Bahrain gives you nine thousand altitude you are at nine thousand feet and a heading one zero five is okay to Dubai.
19:29:14 — Bell: Roger.
19:29:16 — SkyDubai 751: Bahrain UPS six roger
19:29:59 — Bell: Okay Bahrain give me what is my current airspeed?
19:30:07 — Bell: Current airspeed immediately, immediately.
19:30:14 — Bell: What is my distance from Dubai International UPS er six what is my distance we are on fire it is getting very hot and we cannot see.
19:30:22 — SkyDubai 751: Okay I ask Bahrain understood and UPS six request the distance from Dubai from now?
19:30:28 — Bell: Sir I need to speak directly to you I cannot be passed along I need to speak directly to you I am flying blind.
19:30:36 — SkyDubai 751: Understood UPS six we are just changes [sic] to another aircraft to be with Dubai to relay with you, I ask again to Bahrain, Bahrain distance UPS six to Dubai?
19:30:49 — Bell: Sir what is my distance to Dubai International and what is my current altitude immediately sir?
19:30:59 — SkyDubai 751: Okay UPS six you are currently six zero miles from the airport.
19:31:04 — Bell: Sir what is my altitude?
19:31:06 — SkyDubai 751: And uh the altitude please?
19:31:11 — SkyDubai 751: Nine thousand six hundred UPS six
19:31:14 — Bell: Nine thousand six hundred roger am I on a vector for the runway?
19:31:21 — SkyDubai 751: Yes you are on vectors to the runway one two in Dubai.
19:31:22 — SkyDubai 159: Sky Dubai seven five one can you hear Sky Dubai one five nine on one two one five?
19:31:28 — Bell: Roger we’re gonna need to speed this up sir we need to hurry you’re gonna need to give me radar guidance to the runway I cannot see.
19:31:34 — SkyDubai 159: Sky Dubai two zero one, are you on Guard?
19:31:36 — SkyDubai 751: Bahrain Sky Dubai seven five one.
19:31:44 — SkyDubai 159: Yeah we’re calling Sky Dubai two zero one or Sky Dubai seven five one, this is Sky Dubai one five nine.
19:31:47 — SkyDubai 751: Sky Dubai seven five one ah UPS six that he’s ah hurry needs vectors at land in Dubai.
19:31:56 — Bell: Sir we are running out of oxygen.
19:32:00 — SkyDubai 159: Sky Dubai two zero one are you on Guard, one two one decimal five?
19:32:05 — Bell: Sir please give us a vector to the final approach.
19:32:10 — SkyDubai 159: Sky Dubai seven five one can you read us on Guard, one two one five?
19:32:11 — SkyDubai 751: Bahrain this is Sky Dubai seven five one.
19:32:17 — SkyDubai 159: If you can read us Sky Dubai seven five one contact us one two seven five two five, one two seven five two five.
19:32:18 — Bell: Sir UPS six what is my current altitude and heading immediately?
19:32:23 — SkyDubai 229: Yeah Sky Dubai two two nine is reading (you/him).
19:32:25 — SkyDubai 159: And for Sky Dubai two zero one, they need (any?) relay help on one three two one two, with UPS.
19:32:33 — SkyDubai 229: Ok UPS you are at five zero miles now from Dubai airport.
At this point the cockpit voice recorder captured several parties attempting to contact flight 6 on the emergency “guard” frequency of 121.5 MHz. All aircraft should have this universal emergency frequency tuned in one radio at all times. Although UPS flight 6 did have a radio tuned to guard, and transmissions on this frequency were picked up by the CVR, Bell did not appear to react to them, and it’s believed that he probably had the volume on this channel turned down too low to hear the activity. At several points it can also be seen that Bell himself attempted to transmit on Guard, but did not perceive any response:
19:32:38 — Dubai ACC: [On Guard] Flight calling, this is UAE.
19:32:38 — Bell: Roger what is my altitude sir?
19:32:41 — SkyDubai 229: And he needs his altitude readout, also.
19:32:43 — SkyDubai 159: Sky Dubai one five niner.
19:32:45 — Bell: what is my altitude sir?
19:32:50 — Dubai ACC: [On Guard] Sky Dubai one five nine, UAE on Guard.
19:32:52 — SkyDubai 229: Height is nine thousand six hundred feet now, five zero miles out of uh the Dubai airport, you have it at twelve o’clock.
19:32:56 — SkyDubai 159: Sky Dubai one five nine is on with Bahrain one two seven five two five.
19:33:01 — Bell: Sir we are flying blind, I have no visual my indicator says ten thousand feet, I cannot see out the window, we’re gonna have to work together on this one, I’d like to descend to nine thousand feet.
19:33:01 — Dubai ACC: Sky Dub — Sky Dubai one five nine, thank — uh thanks for your help. I think the UPS six is now talking to Dubai frequency and he’s uh three zero miles from the field.
19:33:12 — SkyDubai 159: One five niner.
19:33:15 — SkyDubai 229: Two two nine, go ahead.
19:33:19 — [Bell selects 9,000 feet in the autopilot altitude control window.]
19:33:21– SkyDubai 229: That’s a negative uh he’s flying blind and he needs your vectors for coming into the Dubai airport.
19:33:32 — Bell: Sir I’m descending to niner thousand feet.
19:33:43 — Bell: Sir, what is my altitude.
19:33:51 — Bell: UPS six, what is my altitude sir?
19:33:55 — Dubai 1: Bahrain, Dubai one go ahead. [Editor’s note: Dubai One belongs to the Dubai Royal Air Wing, which is responsible for flying high-ranking UAE officials and members of the royal family, including the Emir of Dubai. An example aircraft from this fleet is shown below. I was unable to verify whether the Emir was on this particular flight.]
19:34:02 — Dubai 1: Ok go ahead sir.
19:34:21 — Dubai 1: Alright eh, what do you want me to tell UPS six?
19:34:30 — Dubai 1: Uh three — uh UP six from Dubai one, uh — three zero zero at four.
19:34:41 — Dubai 1: Uh currently three two DME. [Editor’s note: DME stands for distance measuring equipment and refers to the aircraft’s distance from said equipment in nautical miles.]
19:34:50 — Dubai 1: And tower clears you to land, one two left.
19:35:00 — Dubai 1: UPS six UPS six you are cleared to land one two left cleared to land one two left.
19:35:10 — Bell: [On Guard] Mayday mayday UPS six can anybody hear me?
19:35:12 — Dubai 1: Negative.
19:35:14 — Bell: [On Guard] UPS six can you hear me.
19:35:18 — Unknown: [On Guard] UPS six are you on Guard?
19:35:19 — Dubai 1: UP six, this is Dubai zero zero one relay from Dubai tower clears you to land one two left.
19:35:23 — Unknown [On Guard]: UPS six go ahead.
19:35:29 — Bell: Sir we are going to need a heading, we have no heading and no altitude readout. Can you give us ra — precision radar guidance.?
19:35:33 — Unknown: [On Guard] UPS six, go ahead
19:35:36 — Dubai 1: Alright uh they are requesting precision radar guidance they’ve got uh they’ve got no heading.
19:35:41 — Unknown: [On Guard] Traffic on Guard repeat your message, repeat your message.
19:35:44 — Bell: Yes sir we have no — we can see nothing here, we’re flying blind. Tell me what to do. What altitude, what speed, what heading?
19:35:51 — Dubai 1: Okay they want to know what altitude, what speed, what heading they’ve got. They’re flying blind at the moment.
19:35:58 — Dubai 1: Okay, standby one UP six.
19:36:01 — Bell: Roger.
19:36:04 — Unknown: [On Guard] Sky Dubai two zero one, one two one five please.
19:36:17 — Bell: You’re gonna have to do better than that.
Unfortunately, this extremely complex effort to help flight 6 was ultimately unable to get the airplane into position to intercept the ILS. The aircraft was on the correct heading and at the correct altitude, but it was traveling at a blistering 350 knots, which was well above the normal intercept speed. Furthermore, because he was unaware of his position and constantly behind the aircraft, Bell had not yet armed the autopilot’s approach mode when at about 19:38 the aircraft passed through the glide slope beam from below while level at 9,000 feet. With the approach mode not yet engaged, the autopilot didn’t capture the glide slope and the aircraft did not begin descending toward the runway. Bell did arm the approach mode shortly after, but it was too late.
Moments later, flight 6 also reached the localizer beam, which helps the aircraft align with the runway centerline. But this beam is extremely narrow, and a speed of 350 knots simply didn’t leave enough time for the computer to capture the signal, even at the flight’s relatively oblique intercept angle. Consequently, the localizer mode failed to engage and the airplane did not align with the runway.
Not fully aware that this had happened, Bell repeatedly asked for his distance from Dubai, and when told he was only nine, then six miles from the field, he began a fruitless effort to get back on track, demanding a heading to line up with the runway. He also switched the autopilot’s vertical mode to “vertical speed” and selected a steep descent rate in an attempt to return to where he presumed the glide slope to be. But at this point he was far off course, and Dubai One relayed, “Uh, you’re too fast and too high, can you make a three sixty?”
“Negative, negative, negative!” Bell emphatically replied.
At this point Bell attempted to extend the flaps, speed brakes, and landing gear to help slow the plane, but none of these systems worked as expected. The airplane was traveling too fast to fully extend the flaps, and they were automatically prevented from extending past 20 degrees in order to avoid damage. In response, the autothrottle system also reduced engine power to idle in order to prevent the speed from increasing further, which helped, but was not enough by itself to alter the course of events. At the same time, the speed brakes only partially extended, because these too were cable operated and had become slack due to heat from the fire. And worst of all, Bell’s attempt to lower the landing gear elicited only a landing gear configuration alert, warning him that the gear had not extended, also due to fire damage.
Nevertheless, Bell continued his desperate descent, selecting 1,500 feet in the autopilot altitude window. Moments later, still descending, flight 6 overflew Dubai International Airport at an altitude of 4,200 feet with an airspeed of 320 knots, more than twice the 747’s normal landing speed. Over the radio, Bell could be heard reporting, “Uh, I have no gear,” followed seconds later by, “Sir, where are we? Where are we located?”
In response, the relay aircraft provided an alternate airport: “Are you able to do a left turn now, to Sharjah, it’s ten miles away?”
“Gimme a left turn, what heading?” Bell asked.
The relay aircraft then asked Bahrain for the heading, who in turn asked Dubai over the landline. This process took considerable time, during which flight 6 continued to streak through the skies over Dubai at 300 knots. “Hurry up, what heading?” Bell demanded.
“Okay, heading zero nine five, you’re on final for Sharjah,” the relay aircraft finally replied.
In response, Bell attempted to enter a heading of 095 degrees into the autopilot heading window, but amid the pitch black smoke, he accidentally selected 195 degrees instead. Immediately, the autopilot began to steer the airplane to the right instead of the left, achieving its maximum allowable bank angle of 37.5 degrees — enough to set off an automated “BANK ANGLE” warning.
On board, Bell could feel that the plane was turning the wrong way. But over the radio, he continued his desperate transmissions: “What is my altitude, and my heading? My airspeed?” he asked.
“What’s his airspeed?” the relay aircraft asked Bahrain.
“Altitude? Altitude?” Bell demanded. “Give it to me now!”
Seconds later, possibly disoriented in the turn and confused by where the plane was taking him, Bell advanced the thrust levers and then disconnected the autopilot. Almost as soon as he did so, the plane abruptly pitched 14 degrees nose down, an excursion large enough to be considered an “upset” had it occurred in normal flight. This was likely because the autothrottle immediately reduced engine power back to idle in order to prevent the plane from exceeding the limit speed for flaps 20. Reducing power on an airplane with engines mounted below the wings confers a nose down moment, which might have been subsequently exacerbated by a load shift as burning cargo slid toward the front of the aircraft. Bell attempted to reverse this pitch down by pulling back on his control column, but as Captain Lampe had discovered 20 minutes earlier, slack in the cables meant that he had to make large inputs before the elevators would even begin to move. This caused a delayed response of the aircraft relative to control column movement, which would have been extremely confusing. This confusion showed up in the flight data as Bell repeatedly applied and then reversed his nose up inputs, resulting in cyclic pitch oscillations. All the while, the aircraft continued to turn to the right, past the selected heading, as there was no command to level the wings.
By this point, although Bell did eventually stop the turn, the plane was out of control and on track to impact a suburban development called the Dubai Silicon Oasis. Although unaware of this fact, Bell still saved lives on the ground when, at 19:41, he managed to pull back hard enough on his controls to put the plane into a climb of 800 feet per minute. This climb didn’t last more than a few seconds, because the aircraft had developed a natural desire to pitch down, and shortly after that the elevator position ceased to bear any relationship to control column position whatsoever. Nevertheless, this last, desperate act unintentionally shifted the 747’s projected impact point beyond the edge of the Silicon Oasis.
Now, with the autopilot disengaged and all pitch control lost, the end was nigh. The cockpit voice recorder captured a stream of warnings as the plane descended toward the fast approaching ground: “SINK RATE! PULL UP! TERRAIN, TERRAIN!”
Bell’s final transmission was picked up by the CVR: “Sir, we cannot, we cannot!”
From then on, the only sound was the blare of the ground proximity warning system:
“TOO LOW, TERRAIN!”
“TOO LOW, GEAR!”
“SINK RATE!”
“TOO LOW, TERRAIN!”
“FIVE HUNDRED.”
“TOO LOW, TERRAIN!”
“SINK RATE! PULL UP! PULL UP!”
“PULL UP!”
“PULL UP!”
“PULL UP!”
“PULL UP!”
Bell pulled back on his controls with all his might, but the plane did not respond.
Seconds later, at 19:41 and 34 seconds, UPS flight 6 struck the ground in a shallow, descending right turn. The right wing impacted the perimeter road of a military base, then plowed into several unoccupied buildings, sending the fuselage careening through a cluster of service sheds. Sliding across the ground at immense speed, the 747 crossed an area of empty desert then struck a sandy embankment, dealing a massive blow that instantly shattered the aircraft. An explosion billowed into the darkness as the broken remains of the freighter continued forward for 620 meters, disintegrating and engulfed in flames, before the last debris struck and damaged several more military outbuildings, at which point the wreckage finally clattered to a halt. Twenty-nine harrowing minutes after the first fire alarm, UPS flight 6 was down.
◊◊◊
By the time the fire was extinguished and the rescue operation concluded, it was clear that neither pilot had survived the accident. First Officer Matthew Bell died on impact, while tissue sample analysis showed that Captain Doug Lampe had inhaled fatal levels of carbon monoxide prior to the crash, and was likely dead before the plane hit the ground. Miraculously, however, no one on the ground was hurt.
The subsequent investigation was long and complex, producing a weighty tome of a report that touches on a wide range of topics far beyond the scope of this article. The story of how investigators pieced together the cause is one that may be told in another time and place. Instead, I’ve picked out two key areas of analysis to focus on: the effectiveness of the airplane’s fire safety systems, and the various decisions that may or may not have affected the outcome.
Regarding safety systems, all functioned more or less as advertised, but were nevertheless overcome by the particular nature of a lithium battery fire.
The main deck cargo area on the Boeing 747–400F is what’s known as a Class E cargo compartment. This classification applies to large, open, crew-accessible cargo areas on cargo-only aircraft, and it contains a number of stipulations, but it notably does not come with any requirement to install active fire suppression systems, such as halon extinguishers. Instead, the Class E requirements state that such a compartment must include the following features, quoted directly from the accident report:
“There is a separate approved smoke or fire detector system to give warning at the pilot or flight engineer station. There are means to shut off the ventilating airflow to, or within, the compartment, and the controls for these means are accessible to the flight crew in the crew compartment. There are means to exclude hazardous quantities of smoke, flames, or noxious gasses from the flight crew compartment. The required crew emergency exits are accessible under any cargo loading condition.”
The ability to depressurize the main deck was developed by Boeing and other manufacturers as a means to comply with the requirement to shut off ventilating airflow. Depressurization itself was not an explicit requirement but was rather the chosen method of compliance.
Obviously, for reasons already stated, neither depressurization nor a traditional extinguisher system would have prevented the spread of a fire involving a large number of lithium batteries. However, investigators found themselves questioning whether this method would be effective against a traditional fire either. One immediate problem revealed during related experiments is that depriving a fire of oxygen at Boeing’s recommended altitude of 25,000 feet can result in hibernation of the fire instead, extinguishing open flame but allowing pyrolysis — the degradation of organic materials at high temperatures — to continue. This process produces flammable gases that then ignite when oxygen is reintroduced during descent and landing, at which point the fire can return with even greater intensity than before.
Furthermore, the process of extinguishing a fire via depressurization was potentially confusing to flight crews. The checklist for a main deck fire called upon the crew to climb or descend to 25,000 feet “when conditions and terrain allow,” without stating what “conditions” ought to be considered, and in the very next step it called for a landing at the nearest suitable airport, creating an apparent contradiction. If crews must land ASAP in the event of a fire — which they should! — then how and when are they supposed to climb to 25,000 feet to depressurize the cargo hold? On balance it seems safer not to bother.
Investigators also pointed out that while the main deck was equipped with a supposedly fire-resistant liner designed to prevent damage to aircraft systems, it proved completely ineffective on flight 6. This was largely because the liner was never actually designed to withstand a fire for any significant length of time. The regulatory requirements for a Class E cargo compartment don’t include any type of fire hardening, but Boeing had included the liner in order to bridge the gap between detection of a fire and complete depressurization of the cargo hold, which could take two to four minutes. The liner was therefore tested to show that it could withstand exposure to a 1,700˚F (927˚C) flame for five minutes, and its ability to hold out for longer than that was considered immaterial. This rendered the liner useless in the face of a lithium battery fire that could have burned at more than 2,000˚C and could not be extinguished by depressurizing the hold. Furthermore, investigators found that when the liner was subjected to in-flight vibrations while heated, it tended to shatter. In fact, on flight 6 it put up very little resistance at all, as the fire had already broken through the liner and was damaging control cables less than three minutes after the first fire alarm.
Here investigators noted a regulatory requirement that cargo area smoke detectors alert the flight crew to a fire anywhere in the hold within one minute after ignition. The intent of this regulation is to ensure that detection occurs well before the fire reaches its peak intensity, giving the flight crew more time to make an emergency landing before aircraft structural integrity is compromised. However, testing by the US National Transportation Safety Board in connection with this accident showed that fumes can become trapped within a cargo container or under the rain cover on a pallet, preventing detectable quantities of smoke from reaching the sensors for anywhere between two and 18 minutes after ignition. By the time the container or rain cover is destroyed, allowing smoke to escape, the fire may already be approaching its peak intensity, leaving the crew with little time to respond. This factor was not considered during certification of smoke detectors on any cargo aircraft. And in this particular case, NTSB fire tests designed to replicate the conditions during the accident showed that the blaze aboard flight 6 likely erupted as many as 10 to 15 minutes before the first fire alarm. Detection was delayed due to the presence of rain covers on the pallets in positions 4 and 5, where the fire is thought to have started.
From there, a number of other flaws with the emergency procedures further exacerbated the dire circumstances faced by the crew. These included the checklist step to move the switches for air conditioning packs 2 and 3 to the “off” position even though they were already off, which prevented pack 3 from coming back online to provide positive pressure when pack 1 failed. At the same time, procedures did not sufficiently emphasize that the smoke shutter should not be opened unless the fire has been extinguished. The combination of these two factors contributed to the density of smoke in the cockpit, which ultimately became so thick that it left tar-like stains on the exterior of the airplane downwind of the smoke shutter.
Secondly, none of the checklists reminded the crew to ensure that their oxygen masks were set to 100%, resulting in breathing difficulties that further decreased First Officer Bell’s ability to handle the situation. It was also noted that the stowage of the emergency oxygen mask and bottle was such that it couldn’t be reached from the captain’s seat unless the seat was slid all the way back, and even then the contact was marginal. Under the circumstances of the accident, getting out of his seat was Lampe’s only real way to access it, and that required removing his oxygen mask and smoke goggles because the hose was not long enough. Lampe was ultimately unable to find the backup mask before succumbing to the toxic fumes, which left Bell to deal with the emergency alone.
◊◊◊
All of this having been said, the question remained: could the pilots have survived if they made different decisions? Any such analysis is necessarily speculative, but investigators dabbled in the question anyway, probably in part to pre-empt overconfident commentators standing ready to proclaim that they would do better.
The call that most drastically changed the course of events was Captain Lampe’s decision to return to Dubai instead of diverting to Doha. At the time the decision was made, both destinations were close to equidistant as the crow flies, but flight 6 was heading directly away from Dubai, and a 747 at cruising speed requires about 50 to 60 track miles just to turn around. Doha was about 100 track miles away, and in fact had everything gone smoothly then it wouldn’t have taken more than 20 minutes to land there, as opposed to 27 minutes to cover the 180 track miles required to land in Dubai. (On the actual flight, the aircraft crashed after 29 minutes.) It’s not known for sure why Captain Lampe decided to return to Dubai, but investigators did point out several possible factors, including the fact that the crew did not have charts for Doha handy, they were unaware of the intensity of the fire, they were more familiar with Dubai, and a return to Dubai could be programmed into the flight management computer with the push of a button.
However, the timeline of events aboard the flight meant that most of the adverse effects of the fire would have happened regardless of where Lampe chose to land. Even if flight 6 diverted to Doha, manual pitch control still would have been lost, Lampe still would have become incapacitated, cockpit visibility would still have been reduced to zero, and Bell would still have been unable to lower the landing gear. On the other hand, Bell would have been able to speak directly to the Bahrain controller with no need for intermediaries, which would have greatly facilitated real-time delivery of the information needed to intercept the ILS, potentially enabling a successful auto-landing. Investigators asked Boeing what the outcome of a gear-up auto-landing would be, but this was beyond the scope of any engineering analysis that had been conducted. Given the extent of the fire damage, a catastrophic breakup of the aircraft can’t be ruled out.
It’s worth noting that even if the auto-landing succeeded and the aircraft came to a stop intact on the runway, Bell’s chances of survival would have been slim to none. In order to escape, Bell would have needed to leave his seat and open an emergency exit door from the supernumerary area behind the cockpit. The Boeing 747 does not have openable cockpit windows. Therefore, to escape he would have had to take his non-portable oxygen mask off, which in an environment of such dense smoke might have been immediately fatal.
There are also several what-ifs that lead to a landing in Dubai instead. It was noted that communication would have been greatly simplified if Bell had been able to hear transmissions on the guard frequency, which would have allowed him to speak directly to Dubai. Alternatively, the relay process could have been shortened if a relay aircraft had tuned one radio to the Bahrain frequency to speak to Bell and another to the Dubai frequency to receive instructions. However, nobody thought of this at the time. And regardless, even if these measures had been taken and flight 6 had been able to lock on to the ILS, the same post-landing difficulties would have applied.
The scenario of ditching on the Persian Gulf was also considered because it eliminated the need to capture the ILS and could be performed earlier. However, its success was highly unlikely due to the pilots’ inability to see the water and the impossibility of making the fine pitch inputs required for a smooth impact, to say nothing of the improbability of a swift rescue.
In the end, it was determined that the pilots’ decision-making likely played no role in the fire’s fatal outcome. The pilots of flight 6 were almost certainly doomed from the moment the fire ignited, consigned to a futile battle for survival that simultaneously played out over the public airwaves and in the dark, acrid loneliness of the smoke-filled cockpit. Nevertheless, Matthew Bell fought heroically against the odds to bring his airplane down safely, and if he had survived, his efforts would have been nothing short of legendary, a story that would be told and retold for generations. The futility of his struggle may change the way he is remembered, but it cannot diminish the significance of his herculean effort.
◊◊◊
The crash of UPS Airlines flight 6 alarmed the aviation industry, highlighting the clear and present danger posed by the large quantities of lithium batteries that were being carried on aircraft every single day. These fears were further reinforced nine months later, when another Boeing 747–400F belonging to Korean carrier Asiana Airlines suffered a similar fate on the 28th of July, 2011. While flying over the East China Sea, the crew of the freighter reported a fire in the aft cargo hold, where numerous lithium batteries were believed to have been loaded. The pilots fought to control the airplane for 18 minutes, battling smoke in the cockpit and damaged flight controls until contact was lost at 4,000 feet near Jeju Island. Both crewmembers were killed when the airplane crashed into the sea. Although the flight data recorder was unreadable and the cockpit voice recorder was never found, investigators determined that the crew likely faced many of the same challenges as the pilots of flight 6, but ultimately lost control when the fire fatally compromised the aircraft structure, resulting in a catastrophic in-flight breakup of the tail section.
These two back-to-back accidents led to demands throughout the industry to overhaul the regulations surrounding the carriage of lithium batteries on aircraft. This ultimately led to major regulatory changes, but before getting into those, we need to review the history of restrictions on lithium batteries.
The first aircraft fire linked to lithium batteries occurred in 1999, and the first regulations followed, resulting in the batteries’ designation as Class 9 hazmat with corresponding labeling and handling requirements. By December 2004, international and US authorities had banned the carriage of lithium metal batteries as cargo on passenger aircraft, although lithium ion batteries were still allowed. Concerns increased again after a fire on board an unoccupied cargo plane at Philadelphia International Airport in 2006, and in March 2010, the Pipeline and Hazardous Materials Association (PHMSA), which determines Hazmat regulations in the United States, proposed new rules for the carriage of lithium batteries as cargo on aircraft. These included, for the first time, different packaging requirements for lithium metal and lithium ion batteries; the use of Watt hours instead of lithium content as the primary measure of risk; a requirement for battery manufacturers to retain proof of compliance with United Nations battery safety testing standards; new packaging requirements to protect against short circuits; and a requirement to carry lithium batteries in cargo compartments equipped with FAA-approved fire protection systems.
Nevertheless, these regulations clearly did not go far enough, as a number of major risk factors remained. The new requirements didn’t change the fundamental risk posed by carrying large numbers of lithium batteries in one place, didn’t fully acknowledge the fact that no FAA-approved fire suppression system can extinguish a lithium battery fire, and didn’t fully address a key loophole called the “smaller batteries rule.” Under regulations extant at the time, lithium battery packages containing no more than eight cells or two small batteries (“small” being lithium ion batteries under 100 Watt hours and lithium metal batteries under 2 g) were exempt from class 9 hazmat labeling requirements and did not need to be notified to the air carrier or subjected to the carrier’s standard acceptance checks for hazardous materials. Furthermore, there was no limit on the number of such packages per consignment, which meant that it was possible to ship very large numbers of lithium batteries divided into small packages with an enormous total energy content but no special inspections, no warnings against rough handling, and no notification to flight crews. This made it very difficult for bulk carriers like UPS to accurately determine how much risk they were taking on when accepting a shipment, and increased the likelihood of improper handling.
Following the crashes of UPS Airlines flight 6 and Asiana Airlines flight 991, it was clear that further updates were needed. In 2013, the International Civil Aviation Organization (ICAO), which sets regulatory standards for member states, began requiring airlines to conduct acceptance checks before loading large numbers of lithium batteries in order to reduce the probability of incorrect labeling or damaged packages. ICAO followed this up in 2016 with a revolutionary new rule requiring that lithium ion batteries be carried as cargo on aircraft at no more than 30% charge. This was supported by extensive experimental data demonstrating that at 30% charge, lithium ion batteries experiencing thermal runaway are unlikely to get hot enough to initiate a chain reaction in nearby batteries, greatly reducing the fire risk. The 2016 update also instructed member states to require airlines to “ensure, to a reasonable certainty, that in the event of a fire from items transported in the cargo compartment, such a fire can be detected and suppressed.”
In the United States during this period, there was growing concern that the FAA and the PHMSA were not acting swiftly enough to ensure that these reforms were implemented in the world’s largest air cargo market. As a result, in 2018 the US Congress inserted a requirement into that year’s FAA Reauthorization Act compelling the Secretary of Transportation to conform US federal regulations on the transport of lithium batteries to the ICAO rules issued in 2016, within a 90-day deadline. In early 2019, the PHMSA responded to Congress’s mandate with a sweeping new set of regulations that addressed three main safety areas. First, the agency issued a blanket ban on the carriage of any lithium batteries as cargo on passenger airliners, expanding the 2004 ban on lithium metal batteries. It was noted that almost all US passenger airlines had stopped accepting bulk battery shipments by 2015, but the introduction of an enforceable requirement would prevent any backsliding. Second, the new rules mandated the ICAO-defined 30% charge limit for lithium batteries shipped as air cargo, tackling the fire risk on a fundamental level. And third, the agency closed the “small battery” loophole by limiting the number of exempt packages to one per consignment, preventing large quantities of batteries from being loaded onto aircraft without proper oversight.
At the same time, the battery manufacturing industry has introduced more safety measures of its own, resulting in widespread adoption of new packaging configurations, such as better cell separation and fire-suppressant fill materials, that have increased battery reliability.
Today, according to the latest Department of Transportation Hazmat guidance, any lithium batteries shipped as air cargo on a US airline must meet UN reliability standards; must be packaged in such a way as to protect against short-circuiting; must be completely enclosed in a non-metallic inner packaging that prevents damage due to shifting; must be fitted with a Class 9 Hazmat label specifying “cargo aircraft only;” and must not be charged above 30% capacity, among other requirements.
Progress in the field of fire suppression has been more difficult, but a number of key steps have been taken. Immediately after the crash, UPS convened a safety task force incorporating pilots, management, and outside experts in order to examine technology, procedures, and training that could help manage fire and smoke events on aircraft. This task force produced a number of interesting innovations, including audible checklists, more realistic smoke training, and positive pressure visibility enclosures that can be inflated to allow pilots to see the instruments even in conditions of dense fumes. Many of the ideas generated by the task force were adopted by UPS. Boeing, for its part, updated the fire checklist to remove the redundant deactivation of air conditioning packs 2 and 3.
At the same time, the FAA has revised guidance for developing in-flight fire procedures in order to emphasize the need to set oxygen mask regulators to 100%. The agency has also invested considerable time and money into the development of fire resistant cargo containers, containers with built-in fire extinguishing systems and smoke detectors, and fire suppression methods that could be effective against lithium battery fires. However, while these efforts have produced functional containers with impressive fire suppression capabilities, the FAA’s position is that it lacks the authority to mandate their use, and at the time of this writing they are not in widespread circulation.
◊◊◊
In the end, even though avenues for progress remain, the changes that have been implemented have greatly improved aviation safety, especially in the air cargo industry. New rules in response to developments involving lithium batteries are still being introduced, including some familiar to passengers, such as the requirement to carry battery-powered electronic devices in carry-ons instead of checked bags, which makes fires easier for the crew to detect and contain. Public awareness of the risk has also greatly increased as knowledge of batteries — and battery fires — have proliferated into general life. As a result, there hasn’t been a fatal aircraft accident caused by lithium batteries since Asiana Airlines flight 991 in 2011.
This triumph of safety didn’t come from nowhere. It was enabled by dedicated experts, difficult scientific research, robust institutions, and safety-minded industry cultures. Under the conditions that existed in 2010 and 2011, the twin crashes would have been almost impossible to prevent, and four men lost their lives as a result. That such effort was undertaken to change those conditions in response to only four deaths is commendable and illustrates why, even when a reactive approach is taken as it was in this case, the aviation industry is still more active in its reaction than almost any other. And in the end, it might not have happened as soon as it did without Matthew Bell, who through his tragic last stand galvanized a vast process that has since saved uncounted lives. He may have been alone at the controls of a juggernaut, without passengers or crew to weigh on his shoulders, but it would be moving to imagine that all those who have not and will not perish in future accidents were there with him in spirit.
_______________________________________________________________
Don’t forget to listen to Controlled Pod Into Terrain, my new podcast (with slides!), where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode, in which we discuss how American Airlines flight 965 went tragically awry. Or, if you want to hear more about this accident, you can listen to us talk about UPS flight 6. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 250 similar articles
_______________________________________________________________
Note: this accident was previously featured in episode 64 of the plane crash series on November 24th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
