Missed Opportunities

coverstory

By Mark Lacagnina missed opportunities

The pilots did not notice a misset pressurization mode selector and misidentified a warning about cabin altitude. After hypoxia struck, autoflight systems kept the 737 flying until the fuel ran out.

18 | flight safety foundation | AeroSafetyWorld | January 2007 coverstory

By Mark Lacagnina missed opportunities he Helios Airways Boeing 737- flight management computer and A green “ALTN” light indicates that 300 was climbing through 16,000 the autopilot, depletion of the the system is in the alternate mode. A ft after departing from Larnaca, fuel and engine flameout, and the green “MANUAL” light indicates that Cyprus, on Aug. 14, 2005, when impact of the aircraft with the the system is in the manual mode. Tthe captain reported a takeoff configu- ground.” ration warning to operations person- The 737-300 pressurization system was Unscheduled Leak Check nel. The warning horn that the captain designed to maintain a cabin altitude The mode selector had been set to heard was actually for a problem with of 8,000 ft at the aircraft’s maximum manual for a pressurization-system the cabin-pressurization system, ac- certified ceiling, 37,000 ft. The mode check the morning before the accident. cording to the Hellenic Air Accident selector, which is in an overhead The unscheduled maintenance was per- Investigation and Aviation Safety Board panel above the first officer’s seat, has formed in response to a technical log in Greece. Unaware of the problem, the three positions: “AUTO” (automatic), entry by the flight crew that had landed pilots were incapacitated by hypoxia, “ALTN” (alternate) and “MAN” (photo, the aircraft in Larnaca at 0425 after a and the aircraft, on automatic control, page 21). With the system in automatic flight from London. The technical log continued toward Athens, entered a mode, which normally is selected for entry stated that an inspection of the holding pattern and plunged to the flight, the crew selects the planned aft galley service door was required ground after the engines flamed out. cruise altitude and destination altitude because the door seal “freezes, and hard None of the 121 occupants survived. in the appropriate windows on the bangs are heard during flight.” In its final report, the board said that mode selector, and a cabin pressure After conducting a visual inspec- the direct causes of the accident were: controller positions the outflow valve tion of the door and the pressurization to maintain a programmed cabin- check, a ground engineer (maintenance • “Nonrecognition that the cabin pressure schedule. The alternate mode technician) wrote in the technical log pressurization mode selector was is selected to change from one cabin that no defects were found and that no in the ‘MAN’ (manual) position pressure controller to the other. With leaks or abnormal noises occurred. The during the performance of the the system in manual mode, the flight report said that although the airplane ‘Preflight’ [checklist] procedure, crew has “direct” control of pressuriza- maintenance manual included no spe- the ‘Before Start’ checklist and the tion, using a toggle switch to position cific requirement to return the mode ‘After Takeoff’ checklist; the outflow valve. “Manual control is selector to “AUTO” after the check, primarily used as a backup to automatic it would have been prudent for the • “Nonidentification of the warn- control,” the report said. ground engineer to have done so. ings and the reasons for the There are four annunciator lights The report also noted that a activation of the warnings (cabin above the pressurization control panel. rapid decompression of the accident altitude warning horn, passenger An amber “AUTO FAIL” light indicates aircraft’s cabin had occurred during a oxygen masks deployment indica- a failure of the automatic mode. An flight from Warsaw, Poland, to Larnaca tion, master caution); [and,] amber “OFF SCHED DESCENT” light on Dec. 16, 2004. The decompres- • “Incapacitation of the flight crew illuminates if the aircraft descends sion occurred when the aircraft was at due to hypoxia, resulting in the before reaching the planned cruise Flight Level (FL) 350 (approximately

www.flightsafety.org | AeroSafetyWorld | January 2007 | 19 coverstory

the flight crew had planned to begin descent. found during a cabin pressure leak check and The crew conducted an emergency descent outflow valve test. and landed the aircraft at the destination. The Cyprus Air Accident and Incident Investigation A Mode Overlooked Board, which investigated the incident, con- The accident occurred during a scheduled flight cluded that the decompression likely occurred to Prague, Czech Republic, with an en route either because the outflow valve opened due stop in Athens. The captain, 59, was a native of to an electrical malfunction or the aft galley Germany. He had 16,900 flight hours, including service door opened due to an improperly po- 5,500 flight hours as a 737 captain. He had been sitioned handle. Maintenance actions included employed by Helios Airways from May 2004 adjustment and rigging of the door and re- to October 2004 and had flown for two other placement of the no. 2 cabin pressure controller aircraft operators before returning to Helios and the chemical oxygen-generator cylinders Airways in May 2005. “According to interviews in the passenger service units. Technical log of his peers at [Helios Airways], during the first entries indicated that no abnormalities were period [of employment], he presented a typical ‘command’ attitude, and his orders to the first officers were in command tone,” the report said. Boeing 737-300 “During the second period, his attitude had improved as far as his communication skills were concerned.” The first officer, 51, was a native of Cyprus. He had 7,549 flight hours, including 3,991 flight hours in type. “He had expressed his views several times [to family, colleagues and friends] about the captain’s attitude,” the report said. “He had also complained about the organizational structure of the operator [and its] flight sched- uling, and he was seeking another job.” The report said that a review of his training records “disclosed numerous remarks and recommenda- tions made by training and check pilots refer- ring to checklist discipline and procedural (SOP

© Alan Lebeda/aviation-images.com [standard operating procedure]) difficulties.” The flight crew did not reset the pressuriza- he Boeing 737 was designed to use many components and as‑ tion mode selector to automatic before departure. semblies from the 727. Deliveries of the first production model, “The fact that the mode selector position was Tthe 737‑200, which has Pratt & Whitney JT8D engines, began in not rectified by the flight crew during the aircraft 1967. The larger 737‑300 was introduced in 1984 with quieter and preflight preparations was crucial in the sequence more fuel-efficient CFM International CFM56 engines, rated at 20,000 of events that led to the accident,” the report said. lb (9,072 kg) thrust. The 737-300 can accommodate 128 to 149 passengers and 1,068 The challenge for the pertinent item on cubic ft (30 cubic m) of cargo. Maximum standard takeoff weight is the “Preflight” checklist refers to both the air- 124,500 lb (56,473 kg). Maximum landing weight is 114,000 lb (51,710 conditioning and pressurization systems. The kg). Maximum operating speed is Mach 0.82. Cruising speed is Mach response is: “Pack(s), bleeds on, set.” The report 0.75. said that the pressurization mode selector rarely Production ceased in 2000 after 1,113 737-300s were built. is positioned to a setting other than automatic, Source: Jane’s All the World’s Aircraft and many pilots interviewed during the investigation said that they typically respond “set”

20 | flight safety foundation | AeroSafetyWorld | January 2007 coverstory

after checking only that the cruise altitude and The pressurization landing altitude are set correctly. system mode selector The aircraft departed from Larnaca at 0907. was in the manual, The first item on the “After Takeoff” checklist “MAN,” position is to check the pressurization system. “This was during the accident the second missed opportunity to note and cor- flight and was moved rect an earlier error,” the report said. beyond that position About 0910, the flight crew was cleared to by impact forces. climb to FL 340 and to fly directly to the Rhodos (Rhodes) VOR (VHF omnidirectional radio). The captain’s acknowledgement of the clearance was the last recorded communication between Hellenic Air Accident Investigation and Aviation Safety Board the flight crew and air traffic control (ATC). made in the two months preceding the acci- Warning Horn dent. “The crew became preoccupied with the The aircraft was climbing through 12,040 ft, and equipment-cooling-system situation and did cabin altitude was slightly below 10,000 ft, at not detect the problem with the pressurization 0912, when the warning horn sounded. Activa- system,” the report said. tion of the warning horn in flight indicates a The equipment-cooling system includes fans problem with cabin pressurization, the report and ducts that direct cool air to and warm air said. On the ground, the warning horn sounds away from electronic equipment on the flight when the throttles are advanced and the aircraft deck and in the electrical and electronic bay. is not in the correct takeoff configuration “Loss of airflow (mass flow) due to failure of — that is, with trim, flaps and/or speed brakes an equipment cooling fan or low air density set incorrectly. associated with excessive cabin altitude results According to the quick reference handbook, in illumination of the related equipment cooling among the actions that the flight crew should ‘OFF’ light,” the report said. take in response to a cabin altitude warning or rapid depressurization are to don their oxygen Communication Difficulties masks and stop the climb. That neither action The captain told the dispatcher about the was taken is one indication that the crew re- equipment-cooling problem, but the dispatcher acted to the warning horn as if it were a takeoff did not understand what he was saying and sug- configuration warning. The report noted that the gested that he talk with the on-duty ground en- crew did not silence the horn, and the loud noise gineer — the same person who had conducted that it produced likely increased their stress. the unscheduled maintenance before departure. The captain established radio communica- The dispatcher did not tell the ground engineer tion with a dispatcher in Helios Airways’ Opera- what the captain had reported before handing tions Center about 0914 and reported a “takeoff him the microphone. configuration warning.” About one minute later, The ground engineer told investigators that the “MASTER CAUTION” and “OVERHEAD” the captain asked for the location of the cooling lights illuminated on the flight deck annunciator fan circuit breakers and that he replied that the panel. On the overhead panel, the “PASS OXY circuit breakers were behind the captain’s seat. ON” light, indicating that the passenger oxygen The ground engineer also told investigators masks had deployed, and the equipment-cooling that he did not understand the nature of the system “OFF” lights also had illuminated. The problem that the captain was experiencing. The report noted that nine technical log entries report said that the communication difficulties about the equipment-cooling system had been likely arose because “the captain spoke with a www.flightsafety.org | AeroSafetyWorld | January 2007 | 21 coverstory

German accent and could not be understood by at [1132] that the captain’s seat was vacant [and] the British engineer. … Moreover, the com- the first officer’s seat was occupied by someone munication difficulties could also have been who was slumped over the controls,” the report compounded by the onset of the initial effects of said. The captain likely had vacated his seat to hypoxia.” check the cooling fan circuit breakers. The F-16 pilot also saw oxygen masks dangling from pas- Off the Air senger service units and three passengers sitting Helios Airways’ training program did not motionless, wearing oxygen masks. specifically require that flight crewmembers and The investigation did not determine what cabin crewmembers be trained to recognize the actions the cabin crew took or whether they symptoms of hypoxia. The report said that the attempted to communicate with the flight crew lack of this training is “a common situation in after the passenger oxygen masks deployed. the airline industry.” The cockpit voice recorder (CVR) provided The aircraft was climbing through 28,900 data only for the last 30 minutes of the three- ft about 0920, when the flight data recorder re- hour flight. The report said that the F-16 pilot’s corded the keying of the no. 2 VHF radio, which observations indicated that few passengers had was tuned to an ATC frequency. “This marked donned their masks. the last known attempt of radio communication The passenger-oxygen system was designed by the flight crew,” the report said. Attempts to supply oxygen for 12 minutes. “In order to The F-16 pilot saw by the airline’s Operations Center and ATC to retain consciousness after the depletion of the re-establish radio communication with the flight oxygen from the passenger oxygen system, a per- a man who was not crew were unsuccessful. son on board would have had to make use of one The aircraft continued to climb at an average of the [four] portable oxygen bottles,” the report wearing an oxygen rate of 3,030 fpm. The pressurization outflow said. The valves in three of the bottles were found mask enter the valve remained about 12 percent open during open. The report said that at least one of the the flight, and the average cabin altitude rate of bottles likely had been used by a cabin attendant. flight deck, sit in the climb was 2,300 fpm. Cabin altitude reached a The aircraft was on its tenth circuit of the maximum of about 24,000 ft. holding pattern about 1149, when the F-16 pilot captain’s seat and “The aircraft leveled off at FL 340 [about saw a man who was not wearing an oxygen don headphones. 0923] and continued on its programmed route,” mask enter the flight deck, sit in the captain’s the report said. The aircraft crossed the Kéa seat and don headphones. From the F-16 pilot’s VOR about 1021 and “began what appeared to description of the man’s clothing, investigators be a standard instrument approach procedure concluded that the person likely was the cabin for landing at Athens International Airport, attendant who had used one of the portable oxy- Runway 03L, but remained at FL 340,” the report gen bottles. “The F-16 pilot may not have been said. The aircraft flew over the airport about able to observe an oxygen mask on the person’s 1029 and turned right, toward the Kéa VOR, in face because the portable oxygen bottle mask accordance with the missed approach procedure was clear in color,” the report said. (Figure 1). The aircraft crossed the VOR about The CVR recorded sounds of an oxygen 1037 and entered the published holding pattern. mask being removed from its stowage box and oxygen flowing through the mask. The F-16 F-16 Intercept pilot tried to attract the cabin attendant’s atten- Two Greek air force F-16s intercepted the aircraft tion, but he did not respond. during its sixth circuit of the holding pattern. The F-16 pilots observed no external structural Attendant Attempts Control damage, smoke or fire. “One of the F-16 pilots About 1150, the left engine flamed out due to observed the aircraft at close range and reported fuel starvation. The aircraft turned steeply left

22 | flight safety foundation | AeroSafetyWorld | January 2007 coverstory

Flight Path of Helios Airways Boeing 737, Aug. 14, 2005

1203 Airplane strikes terrain 1159/7,084 ft Right engine Turkey ames out

1123/FL 340 1029/FL 340 Intercept Airplane overies by F-16s Athens 1150/FL 340 International Left engine Airport ames out 0907 Airplane departs Greece from Larnaca, Cyprus 0914/15,955 ft Communication on company radio 1037/FL 340 frequency begins Airplane 0920/28,900 ft enters Communication on holding company radio pattern frequency ends Cyprus 1021/FL 340 Airplane crosses Kéa VOR 1012/FL 340 0937/FL 340 First of 20 unanswered calls Airplane crosses 0923 0912/12,040 ft by Athinai Area Control Center Rhodes VOR Airplane levels o Cabin altitude at FL 340 warning horn sounds 0930/FL 340 0915/17,012 ft First of seven Master caution unanswered calls by light illuminates Nicosia Area Control Center

FL = Flight level VOR = VHF omnidirectional radio Times are local.

Source: Hellenic Air Accident Investigation and Aviation Safety Board

Figure 1 to a northerly heading and began to descend. and the heading changed from northerly to The report said that recorded fluctuations in southwesterly. About this time, the cabin atten- airspeed and altitude indicated that the cabin dant appeared to acknowledge the presence of attendant, who held a commercial pilot license the F-16. “He made a hand motion,” the report issued by the United Kingdom, was making an said. “The F-16 pilot responded with a hand effort to control the aircraft. signal for the person to follow him on down CVR data indicated that he attempted to towards the airport. The [cabin attendant] only transmit two radio messages about 1154. The pointed downwards but did not follow the F-16.” first was: “Mayday, mayday, mayday. Helios Although the cabin attendant was a licensed Airways Flight 522 Athens” followed by an un- pilot, investigators concluded that anyone with intelligible word. The second message, spoken similar flight experience likely would not have a few seconds later in what was described by been able to control the 737 with both engines the report as a very weak voice, was: “Mayday, inoperative and in the existing conditions of mayday.” Neither message was transmitted, hypoxia and extreme stress. The report said, however, because the microphone key had not however, that the cabin attendant apparently at- been depressed. tempted to level the aircraft before it struck hilly The 737 was descending through 7,084 ft terrain near Grammatiko, about 33 km (18 nm) about 1159, when the right engine flamed out northwest of the airport, about 1203. www.flightsafety.org | AeroSafetyWorld | January 2007 | 23 coverstory

The remains of 118 occupants were the country. CAA audits of Helios these concerned Boeing 737 aircraft, recovered and examined by a forensic Airways had found several deficien- while the other two events concerned pathologist; the bodies of the other three cies. “Management pilots appeared McDonnell Douglas aircraft. These occupants are believed to have been con- to be insufficiently involved in their nine reports all referred to aircraft that sumed by the post-accident fire. “Accord- managerial duties,” the report said. took off with the pressurization selector ing to the pathologist’s report, the cause “Training and duty records were found inadvertently set to ‘MAN.’” of death for all on board was determined to be incomplete. Manuals were found The report said that Boeing had to be multiple injuries due to impact, in to be [partially] deficient; they did not taken or was in the process of taking addition to the extensive burns for 62 of always adhere to regulations, and on several actions before the accident them,” the report said. The pathologist’s some issues they were out of date. In to reduce the likelihood of 737 pres- report also said that the occupants likely the two months before the initiation surization incidents. Among actions were “in deep, nonreversible coma due to of the first flight operations with the underway was a revision of the B737 their prolonged exposure (over 2.5 hours) [accident aircraft], the airline appeared Flight Crew Training Manual to include to the high hypoxic environment” when to be effectively scrambling to piece information on distinguishing between the impact occurred. together manuals and paperwork. This a cabin altitude warning and a takeoff suggested that an underlying pressure configuration warning. “A number of Latent Causes was prevalent to proceed with little remedial actions had been taken by The report said that the following were regard for the required formalities.” the manufacturer since 2000, but the latent causes of the accident: Moreover, flight crew training records measures taken had been inadequate indicated that no follow-up action and ineffective in preventing further • “Operator’s deficiencies in the or- had been taken in response to the first similar incidents and accidents,” the ganization, quality management officer’s record of insufficient checklist report said. and safety culture; discipline and ineffective performance Among actions taken in response • “Regulatory authority’s … in- in abnormal situations. to the findings of the accident inves- adequate execution of its safety The report said that the Cyprus De- tigation was Airworthiness Directive oversight responsibilities; partment of Civil Aviation (DCA) ap- (AD) 2006-13-13, issued in June 2006 peared to be completely dependent on by the U.S. Federal Aviation Admin- • “Inadequate application of crew the U.K. CAA for safety oversight and istration. The AD required revision of resource management principles; that the DCA’s Safety Regulation Unit the 737 airplane flight manual (AFM) [and,] was understaffed and lacked leadership “to advise the flight crew of improved and oversight. There was no record that procedures for preflight setup of the • “Ineffectiveness of measures taken the DCA took action to ensure that cabin pressurization system, as well as by the manufacturer in response to airlines responded to deficiencies and improved procedures for interpreting previous pressurization incidents issues considered by CAA auditors to and responding to the cabin altitude/ in the particular type of aircraft.” require urgent attention. configuration warning horn,” the report Helios Airways was established in 1999 said. The AD also required that the and had begun operating the accident Previous Problems following message be inserted in the aircraft in May 2004. At the time of the Investigators reviewed several previ- AFM: “For normal operations, the pres- accident, the airline also was operating ous occurrences worldwide involving surization mode selector should be in two 737-800s and an Airbus A319 from aircraft pressurization problems. “Of ‘AUTO’ prior to takeoff.” ● Cyprus to 28 destinations in 11 coun- interest and relevance to the [Helios tries. The airline had 228 employees, Airways accident were] nine reports This article is based on Hellenic Air Accident about one-third of whom were part- of pressurization problems directly Investigation and Aviation Safety Board Aircraft Accident Report 11/2006, “Helios time, seasonal employees. attributed to the crews’ failure to set Airways Flight HCY522, Boeing 737-31S, at Cyprus contracted with the U.K. and verify the proper position of Grammatiko, Hellas, on 14 August 2005.” The Civil Aviation Authority (CAA) to the pressurization mode selector to 198-page report contains illustrations and assist in overseeing three airlines in ‘AUTO,’” the report said. “Seven of appendixes.

24 | flight safety foundation | AeroSafetyWorld | January 2007