Description

On 14 August 2005, a Boeing 737-300 (5B-DBY) being operated by Helios Airways on an international passenger flight from Larnaca to Athens as HCY522 lost contact with ATC en-route and was subsequently intercepted when level at FL340 by two military aircraft, one of whose pilots observed in day VMC that the two 737 pilots were respectively incapacitated and absent from the flight deck. The aircraft subsequently departed controlled flight and impacted terrain almost three hours after take-off and was destroyed and all 121 occupants were killed.

Investigation

An Investigation was carried out by the Greek Air Accident Investigation and Aviation Safety Board AAIASB. Data from the FDR and from the 30 minute CVR were recovered but the latter "was insufficient to provide key information that would have clarified the chain of events during the climb phase of the flight". Useful data was obtained from the NVM of the No. 2 Pressure Controller - that from the No 1. Controller was damaged beyond use.

It was found that the 59 year-old Captain was a German national who had begun his flying career as a First Officer with Interflug, the former East German airline, in 1970 before gaining his command there in 1978. He had 16,900 total flying hours which included 5,500 hours in command on type and had been with Helios for just three months. The 51 year-old First Officer was a Cyprus national who had completed his pilot training in the UK in the late 1980's. He had 7,549 total flying hours including 3,991 hours on type and had joined Helios in April 2000.

It was established that the flight had been cleared to climb to cruise at the requested FL340 on track by Nicosia ACC just 4½ minutes after take-off. The acknowledgement of this clearance was the last recorded communication between the flight crew and ATC. The ETA for the crossing from Nicosia FIR to Athens FIR at EVENO was passed by AFTN as 30 minutes after take-off. FDR data indicated that 5½ minutes after take-off, as the aircraft climbed through FL120, the cabin high altitude warning sounded. The climb was continued and, as the aircraft passed FL160, the Captain contacted the Company Operations and was reported to have advised the Dispatcher that "the take-off configuration warning was on and that the normal and alternate cooling equipment was off line”. Seven minutes after take-off during this communication, the passenger oxygen masks had deployed as designed when the cabin altitude exceeded 14,000 feet as the aircraft climbed through FL180. In response to the technical remarks by the Captain, the Dispatcher requested a company Ground Engineer to communicate with the Captain. This conversation resulted in information from the Captain that did not make sense to the engineer but given the close proximity of the pressure control panel to lights which the Captain was referring to and the fact that he had operated the pressure panel during an unscheduled maintenance input prior to the flight, he asked the Captain to confirm that the pressurisation panel was selected to AUTO. The response was inconclusive. FDR data suggested that communication between the Captain and the Ground Engineer ended as the aircraft passed FL290 just over 13 minutes after take-off. Soon afterwards, the Dispatcher attempted to contact the aircraft again but there was no response. Three and a half minutes later, the aircraft levelled off at FL340. The Dispatcher called ATC and asked them to call the aircraft but they got no response either. Further attempts using a relay aircraft were also unsuccessful. Nicosia ACC called Athens ACC to say that the aircraft was at the FIR boundary but was not answering calls with a request to let them know if the aircraft called them. It was observed on radar to be continuing on its flight-planned track. Eventually, not having heard from the aircraft, the Athens ACC controller called the flight in order to issue a descent clearance but there was no response to this or other subsequent attempts including on the emergency frequency and by relay aircraft.

As the aircraft approached the KEA VOR south east of Athens, the ACC Radar Controller informed their Supervisor of the loss of radio communication and the Supervisor then notified Athens APP/TWR and the Air Force. On reaching the Athens overhead at FL 340 approximately 90 minutes after take-off, the aircraft was then observed to turn back to the KEA VOR where it joined the holding pattern. During the sixth holding pattern, the 737 was intercepted by two military aircraft and it was seen that the Captain's seat was unoccupied and the First Officer's seat was occupied by someone who was "slumped over the controls". After twenty minutes, "a person not wearing an oxygen mask" was observed to entering the flight deck and sit in the Captain’s seat and ten minutes after that, the left engine flamed out due to fuel exhaustion and the aircraft began to descend. As this descent began, MAYDAY messages were recorded on the CVR but not transmitted as the PTT button was not pressed. After a further ten minutes as the aircraft passed approximately 7,000 feet, the right engine also flamed out and shortly afterwards, the aircraft impacted hilly terrain in the vicinity of the village of Grammatiko. A post-crash fire occurred.

There was insufficient evidence to determine the situation which had prevailed in the cabin following passenger oxygen mask deployment but it was considered that "the cabin crew would have expected initiation of a descent or at least levelling-off of the aircraft" in such circumstances. It was not possible to determine whether any of the cabin crew attempted to contact the flight crew or enter the flight deck after deployment of passenger oxygen masks. However, it was concluded that the person who was observed to enter the flight deck and sit in the Captain's vacant seat shortly before flameout of the first engine was a male member of the four person cabin crew who held a Commercial Pilot Licence.

After reviewing all the evidence gathered, the Investigation made a series of detailed observations related to the conduct of the accident flight which, in summary, included the following:

• The unscheduled line maintenance input to the aircraft prior to its departure on the accident flight included a successful pressurisation test. The record of these maintenance actions in the Aircraft Technical Log was incomplete and the pressurisation mode selector was not returned to the normal AUTO position. The latter was "not a formal omission" although it was considered that "it would have been prudent" to take this action.
• During the Preflight procedure, the Before Start and the After Takeoff checklists completion, the flight crew failed to notice that the cabin pressurisation mode selector was not in the correct position for flight. The After Takeoff checklist section referring to the pressurisation system in the Helios' QRH had not been updated according to the latest Boeing revision. However, the lit indication that the pressurisation mode selector was in the MAN rather than the normal AUTO position "should have been perceived by the flight crew during preflight, takeoff and climb". That the aircraft was being operated with the MAN mode selected was confirmed by data stored in the recovered NVM of the No. 2 Pressure Controller.
• The initial response of the flight crew to the Cabin High Altitude Warning - disconnection of the AP and retarding then advancing the thrust levers - indicated that they had interpreted the warning as a Takeoff Configuration Warning. This "indicated that the flight crew was not aware of the inadequate pressurisation of the aircraft". The warning was not cancelled by the crew and would have represented a continued intrusion to their decision making environment.
• Following the annunciation of a Master Caution as the aircraft was around FL 170 / FL 180, the flight crew did notice an overhead system panel status alert for avionics cooling but not the one which indicated that the cabin oxygen masks had automatically deployed as the cabin altitude had exceeded 14,000 feet. They subsequently "became preoccupied with the Equipment Cooling fan situation and did not detect the problem with the pressurisation system".
• Before hypoxia began to affect the flight crew’s performance, inadequate CRM contributed to the failure to diagnose the pressurisation problem. In this connection, it was noted that there was some evidence to suggest that the Captain was relatively authoritarian in his exercise of command and noted that the First Officer's training records featured "numerous remarks in the last five years […] referring to checklist discipline and procedural (SOP) difficulties".
• Both pilots "probably lost useful consciousness as a result of hypoxia some time after their last radio communication on the company frequency […] approximately 13 minutes after takeoff" which was when the aircraft passed approximately FL 290. It was generally concluded that any of the occupants on board who were not wearing oxygen masks were likely to have begun experiencing a gradual decline of cognitive functions within 2 to 3 minutes of the aircraft reaching and levelling at FL340 soon afterwards.
• The use of the same aural warning to signify two different potentially critical situations - Incorrect Takeoff Configuration and High Cabin Altitude - was considered to be inconsistent with good Human Factors principles. A history of incidents involving confusion between the Takeoff Configuration Warning and the Cabin Altitude Warning on the Boeing 737 type was noted as were a number of remedial actions taken which were considered to have been "inadequate".
• The Manuals, procedures, and training in place at Helios "and to a large extent of the international aviation industry", did not address the actions required of cabin crew if the passenger oxygen masks deploy in the cabin and no relevant announcement from the flight crew follows.
• There was very considerable evidence of the existence of systemic organisational safety deficiencies within Helios' management structure and safety culture and elements of this situation had been detected during independent audits prior to the accident.
• It was considered that "organisational safety-related deficiencies existed within the Cyprus DCA from at least 1999" and that "although some corrective actions were exercised since 2003" many of these deficiencies had continued up to the time of the accident. It was further considered that "these deficiencies prevented the DCA from carrying out its safety oversight obligations".
• In respect of the ATC response to the loss of R/T communication with the aircraft, it was noted that ICAO Doc 4444 PANS-ATM stated that action should be taken if a report from an aircraft is not received within a reasonable period of time and it is left to regional air navigation agreements to prescribe what that period of time should be.

The Direct Causes of the Accident were formally recorded as follows:

1. Non-recognition that the cabin pressurisation mode selector was in the MAN (manual) position during the performance of the:
   1. Preflight procedure;
   2. Before Start checklist; and
   3. After Takeoff checklist.
2. Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb.
3. Incapacitation of the flight crew due to hypoxia, resulting in continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground.

Four "Latent Causes" were also formally identified as follows:

1. The Operator’s deficiencies in organisation, quality management and safety culture, documented over time as findings in numerous audits.
2. The Regulatory Authority’s diachronic inadequate execution of its oversight responsibilities to ensure the safety of operations of the airlines under its supervision and its inadequate responses to findings of deficiencies documented in numerous audits.
3. Inadequate application of Crew Resource Management (CRM) principles by the flight crew.
4. Ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurisation incidents in the particular type of aircraft, both with regard to modifications to aircraft systems as well as to guidance to the crews.

Three Contributory Factors were also identified:

1. Failure to return the pressurisation mode selector to AUTO after unscheduled maintenance on the aircraft.
2. Lack of specific procedures (on an international basis) for cabin crew procedures to address the situation of loss of pressurisation, passenger oxygen masks deployment and continuation of the aircraft climb.
3. Ineffectiveness of international aviation authorities in enforcing implementation of corrective action plans after relevant audits.

Seven Safety Recommendations were made whilst the Investigation was in progress a follows:

Three were issued on 25 August 2005:

• that the NTSB should invite the Boeing Company to consider taking action to emphasize flight crew training and awareness in relation to (a) the importance of verifying the bleed and pack system configuration after take-off and (b) the understanding and recognition of the differences between cabin altitude and take-off configuration warnings. [2005-37]
• that the NTSB should invite the Boeing Company to clarify the Aircraft Maintenance Manual (AMM) (AMM) maintenance procedure for the Cabin Pressure Leakage Test (05-51-91) to explicitly specify the actions necessary to complete the maintenance test including returning the cabin pressure mode selector to the AUTO position. [2005-38]
• that the NTSB should invite the Boeing Company to consider revising the Aircraft Maintenance Manual by adding an additional step requiring the reinstallation of crew oxygen mask regulators (if removed) as part of the process of putting the aircraft back to its initial condition. [2005-39]

One was issued on 20 October 2005:

• that the Cyprus Air Accident and Incident Investigation Board should ensure that all airlines under the jurisdiction of the Cyprus DCA standardise cabin crew procedures for access to the flight deck and for use of the flight deck door and include relevant information in the Operations Manual. [2005 – 40]

Two were issued on 23 December 2005:

• that the NTSB should invite the Boeing Company to consider enhancing the design of the Preflight checklist to better distinguish between items referring to the air conditioning and the pressurisation systems of the aircraft and to include an explicit line item instructing flight crews to set the pressurisation mode selector to AUTO. [2005-41]
• that the NTSB should invite the Boeing Company to reconsider the design of the Cabin Pressure Control System controls and indicators so as to better attract and retain the flight crew’s attention when the pressurisation mode selector position is in the MAN (manual) position. [2005-42]

One was issued on 2 May 2006:

• that the Hellenic ACC should consider the need for an additional indication on the label attached to the target of a flight on the radar scope, to draw a controller’s attention when radio communication has not been achieved and that it should establish procedures to specify a time limit within which a controller should take the initiative to contact a flight that has not reported its position when crossing a compulsory reporting point (FIR boundaries, etc.). [2005-43]

At the end of the Investigation, a further Nine Safety Recommendations were made as follows:

• that the EASA/JAA require all airlines to amend cabin crew procedures so that when the oxygen masks deploy in the cabin due to loss of cabin pressure or insufficient cabin pressure and if the aircraft does not suspend climb, level-off or start a descent, the senior member of Cabin Crew (or the cabin crew member situated closest to the flight deck) is required to immediately notify the flight crew of the oxygen masks deployment and to confirm that the flight crew have donned their oxygen masks. [2006-41]
• that the EASA/JAA require aircraft manufacturers to install, in addition to the existing cabin altitude warning horn, a visual and/or an oral alert warning when the cabin altitude exceeds 10 000 feet in newly manufactured aircraft and on a retrofit basis in older aircraft. [2006–42]
• that the EASA/JAA require practical hypoxia training as a mandatory part of flight crew and cabin crew training. This training should include the use of recently developed hypoxia training tools that reduce the amount of oxygen a trainee receives while wearing a mask and performing tasks. [2006-44]
• that the EASA/JAA and ICAO require aircraft manufacturers to evaluate the feasibility of installation of a CVR that records the entire flight. [2006-45]
• that the EASA/JAA and ICAO require all company communications with the aircraft (operations office, technical base/stations, and airport stations) to be recorded. [2006-46]
• that the EASA/JAA and ICAO require that aircraft manufacturers ensure that cabin altitude is recorded on the FDR. [2006-47]
• that the EASA/JAA and ICAO study the feasibility of requiring the installation of crash protected image recorders on the flight deck of commercial aircraft. [2006-48]
• that the EASA/JAA and ICAO implement a means to record international safety audits of the States’ Civil Aviation Authorities, which ensures that the findings can be tracked in depth, action plans are developed and implemented in shortest possible time; and impose the necessary pressure when they become aware that international obligations and standards are not being met by the Authorities. [2006-49]
• that the Republic of Cyprus should support by all necessary resources the already under-way reorganisation of Cyprus DCA so that it may be better equipped to carry out the governmental aviation safety oversight functions and to meet its international obligations in the shortest possible time. [2006-50]

Safety Action reported to the Investigation whilst it was in progress included the following:

• Boeing revised the FCTMs for all Boeing 737 variants which added a new section reminding flight crews on how to understand and recognise the differences between the two meanings of the warning horn and reminding them of the importance of verifying the bleed and pack system configuration after take-off.
• Boeing revised the AMM for all Boeing 737 variants to add a specific action to put the cabin pressure mode selector in the AUTO position after carrying out a cabin pressure leakage test and to require that any crew oxygen mask regulators that have been removed during maintenance, they must be reinstalled and tested prior to release to service.
• Boeing made changes to the flight crew procedures associated with the Boeing 737 Cabin Altitude Warning System by issuing FCOM/QRH revisions which included modifications to some Normal and Non-Normal Checklists and changes in terminology.
• The Hellenic ACC enhanced the capability of the radar software so that a visual indication is provided to a controller if radio communication between the ACC and an aircraft has not been achieved. It also introduced a three minute time limit within which a controller should take the initiative to contact a flight that has not reported a required en-route position and this requirement has been inserted in the ACC Operations Manual.
• The FAA issued an Airworthiness Directive (AD) applicable to all Boeing 737 series aircraft which required revisions to the Aircraft Flight Manual (AFM) within 60 days to include improved procedures for pre-flight setup of the cabin pressurisation system and improved procedures for interpreting and responding to the cabin altitude / configuration warning horn.

The Final Report of the Investigation was completed on 4 October 2006.

Related Articles

• Loss of Control
• Pilot Incapacitation
• Loss of Cabin Pressurisation
• Cabin Altitude
• Aircraft Pressurisation Systems
• Gradual Depressurisation
• Pressurisation Problems: Guidance for Flight Crews
• Aircraft Oxygen Systems
• Hypoxia
• Time of Useful Consciousness
• Aircraft Technical Log
• Standard Operating Procedures (SOPs)
• Crew Resource Management
• Safety Management System
• Safety Oversight
• Loss of Communication
• Communication Failure: Guidance for Controllers
• ATCO Actions during Prolonged Loss of Communication
• Prolonged loss of communication
• Flight Deck Security